wingfoil 0.2.1

package/dist/storage/confinement.d.ts

@@ -0,0 +1,93 @@
+/**
+ * True when `target` is **not strictly inside** `resolvedRoot` — the root itself (a mutating op's
+ * target is a file *within* the project, never the project), a climb above it, or an unrelated
+ * absolute path. Both arguments must already be absolute; nothing here touches the filesystem.
+ */
+export declare function escapesRoot(resolvedRoot: string, target: string): boolean;
+/** What {@link resolveRealPathInRoot} found out about a path. */
+export interface RealPathResolution {
+    /** The textual resolution under the root — what a prefix check would have compared. */
+    readonly absolute: string;
+    /** The filesystem resolution: the target's real parent directory, plus the target's own name. */
+    readonly real: string;
+    /** Whether {@link real} is strictly inside the (itself real-resolved) root. */
+    readonly within: boolean;
+}
+/**
+ * Resolve `relativePath` under `root` **on the filesystem** and report whether the result is still
+ * inside the project. The root is real-resolved too, so a project that itself lives under a
+ * symlinked path (a `/tmp` that is a link to `/private/tmp`, a home directory reached through one)
+ * does not read as its own escape.
+ *
+ * **The target's parent is resolved; the target's own name is not** — and that asymmetry is the
+ * contract, not an oversight. A directive that is a **symlinked file** inside a real directory is
+ * removable and must stay so: `unlink` removes the link, the target survives, and git stages the
+ * link as an ordinary blob. It is reaching *through* a symlinked **directory** that leaves the
+ * project — that is the file git itself refuses to stage ("beyond a symbolic link") and the one
+ * whose deletion lands outside the root.
+ *
+ * **That reasoning is a deletion's, and this function has write callers too.** For `unlinkSync` it
+ * holds entire: resolving the leaf would turn a working removal into a refusal protecting nothing.
+ * `task-105` added two **write** consumers — `resolveConfinedMemoryPath` (`./memory-path.ts`) and
+ * `requireConfinedTarget` inside `commitMemoryTransition` (`../core/memory-transition.ts`) — and
+ * `writeFileSync` **follows** a symlinked leaf where `unlinkSync` acts on it, which put bytes
+ * outside the root on both of them (`bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * That is answered **beside** this function rather than inside it, by `task-106`: the write paths
+ * ask {@link targetIsSymlink} as well, and refuse a symlinked target outright. This function is
+ * unchanged, so the delete path is unchanged with it — a wider boundary here would have red exactly
+ * the `bug-044` case the paragraph above exists to keep working. So the asymmetry is read per verb:
+ * resolve the parent everywhere, refuse a symlinked leaf where the syscall would follow it.
+ * `dl-086` carries the argument about which state a guard over a filesystem effect may read.
+ *
+ * @param root - The project root; need not be real-resolved by the caller.
+ * @param relativePath - A root-relative path (an absolute one is honoured as given, and then judged
+ *   by the same boundary).
+ */
+export declare function resolveRealPathInRoot(root: string, relativePath: string): RealPathResolution;
+/**
+ * True when `target`'s **own name** is a symbolic link — the question a write must ask and a delete
+ * must not (task-106, `bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * `writeFileSync` follows a symlinked leaf: the bytes land at the link's destination, not at the
+ * path the operation named, and {@link resolveRealPathInRoot} does not see it because it resolves
+ * the parent and keeps the basename. `unlinkSync` is the opposite — it acts on the link — so the
+ * same input is a defect for one verb and correct behaviour for the other (`bug-044`'s benign case).
+ * Hence a separate predicate, asked only where the syscall follows links, rather than a wider
+ * boundary that would decide both.
+ *
+ * **`lstat`, not `exists`.** `existsSync` follows links and is therefore **false** for a dangling
+ * one, which is how `requireAbsentTarget` (`../core/write-guard.ts`) read an occupied path as free
+ * and let `memory add` write through it and commit (`bug-120` D1). `lstatSync` inspects the link
+ * itself and answers `true`. Its `ENOENT` — nothing at the path at all, the ordinary case for a
+ * document about to be created — is the one failure absorbed here, along with any other `lstat`
+ * error: a path this cannot inspect is not a link it can report, and every caller has already
+ * decided confinement separately.
+ *
+ * **Not an adversarial defence, and the window is real.** Node's `fs` exposes no `O_NOFOLLOW` on a
+ * path-based API, so nothing closes the gap between this check and the write that follows it; only
+ * file-descriptor primitives (`openat`) would. `dl-086` names the same limit for the delete path.
+ * What this converts is a routine, self-inflicted loss — a store aliased into shared space, a
+ * document linked into a folder — into a refusal.
+ *
+ * @param target - An absolute path. Only its own name is inspected; links on the way to it are the
+ *   confinement boundary's business ({@link resolveRealPathInRoot}), not this predicate's.
+ */
+export declare function targetIsSymlink(target: string): boolean;
+/**
+ * The refusal a write path returns for a symlinked target — one sentence, one place, so the
+ * `StorageError` `memory add` raises and the `CoreResult` the transition verbs return cannot drift
+ * apart on what the rule is (task-106).
+ *
+ * It names the path and says the target is a link, and it deliberately does **not** name where the
+ * link points: {@link targetIsSymlink} refuses without resolving, and a message quoting a
+ * destination would imply the guard had judged it. No child-process text goes anywhere near it
+ * (`bug-071`/`bug-093`).
+ *
+ * @param action - The verb for the first clause, e.g. `'write'` → `cannot write '<path>'`, the
+ *   message shape `requireConfinedTarget` and `requireCustomAsset` already use.
+ * @param path - The path as the operation named it, root-relative or rendered — never re-spelled,
+ *   so the operator reads back what they typed against.
+ */
+export declare function symlinkTargetRefusal(action: string, path: string): string;
+//# sourceMappingURL=confinement.d.ts.map

package/dist/storage/confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../../src/storage/confinement.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGzE;AA2BD,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,kBAAkB,CAK5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAMzE"}

package/dist/storage/confinement.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.escapesRoot = escapesRoot;
+exports.resolveRealPathInRoot = resolveRealPathInRoot;
+exports.targetIsSymlink = targetIsSymlink;
+exports.symlinkTargetRefusal = symlinkTargetRefusal;
+/**
+ * Storage confinement — **the one place that decides whether a path is inside the project root**
+ * (REQ-SEC-06, `task-017-storage-confinement`; extended to the filesystem by `task-102` for
+ * `bug-044-symlinked-directives-custom-escapes-confinement`).
+ *
+ * `resolveConfinedMemoryPath` (`./memory-path.ts`) shipped that boundary first, but only over a
+ * rendered Memory-path *pattern* and only **textually**: `resolve` + `relative`. Textual resolution
+ * answers a different question from the filesystem's. `.wingfoil/directives/custom/legacy-rule.md`
+ * has no traversal in it and every segment is inside the project — and when `custom` is a symlink to
+ * a directory elsewhere, the file it names is not in the project at all. `src/core/builtin-asset.ts`
+ * predicted exactly this when it refused to normalise `.`/`..` textually: "a symlinked `custom/`
+ * aliasing `built-in/` defeats any string-level normalisation".
+ *
+ * So the predicate lives here and `resolveConfinedMemoryPath` calls it, rather than a second
+ * boundary check being written next to it — two places deciding confinement is how a guarantee
+ * becomes a suggestion. {@link escapesRoot} is the decision; {@link resolveRealPathInRoot} is the
+ * filesystem-resolving entry point a caller uses when the path names a real file on disk.
+ *
+ * {@link targetIsSymlink} (task-106, `bug-120`) is a **different question** kept in the same module
+ * because it is asked in the same breath: not *where does this path lead* but *would the syscall
+ * land on this path at all*. It is asked only by callers whose syscall follows links — a write —
+ * and never by a delete, which acts on the link and must go on doing so.
+ *
+ * All three are deterministic (REQ-SYS-07): no wall clock, no randomness, no unordered iteration —
+ * only `path` arithmetic, `realpathSync` and `lstatSync`, whose answers are properties of the
+ * filesystem.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+/**
+ * True when `target` is **not strictly inside** `resolvedRoot` — the root itself (a mutating op's
+ * target is a file *within* the project, never the project), a climb above it, or an unrelated
+ * absolute path. Both arguments must already be absolute; nothing here touches the filesystem.
+ */
+function escapesRoot(resolvedRoot, target) {
+    const rel = (0, node_path_1.relative)(resolvedRoot, target);
+    return rel.length === 0 || rel === '..' || rel.startsWith(`..${node_path_1.sep}`) || (0, node_path_1.isAbsolute)(rel);
+}
+/**
+ * The real location of `directory`, following symlinks as far as the filesystem actually goes and
+ * keeping the not-yet-existing tail verbatim.
+ *
+ * `realpathSync` throws `ENOENT` for a path that does not exist, which would make a confinement
+ * check fail differently depending on whether the caller's target had been created yet — a guard
+ * must answer the same question either way. Walking up to the nearest existing ancestor is the
+ * resolution the filesystem itself would give once the missing directories were created.
+ */
+function realpathOfDirectory(directory) {
+    const pending = [];
+    let current = (0, node_path_1.resolve)(directory);
+    for (;;) {
+        try {
+            return (0, node_path_1.join)((0, node_fs_1.realpathSync)(current), ...pending);
+        }
+        catch {
+            const parent = (0, node_path_1.dirname)(current);
+            // `dirname` is its own fixed point at the filesystem root: nothing above it left to resolve.
+            if (parent === current)
+                return (0, node_path_1.join)(current, ...pending);
+            pending.unshift((0, node_path_1.basename)(current));
+            current = parent;
+        }
+    }
+}
+/**
+ * Resolve `relativePath` under `root` **on the filesystem** and report whether the result is still
+ * inside the project. The root is real-resolved too, so a project that itself lives under a
+ * symlinked path (a `/tmp` that is a link to `/private/tmp`, a home directory reached through one)
+ * does not read as its own escape.
+ *
+ * **The target's parent is resolved; the target's own name is not** — and that asymmetry is the
+ * contract, not an oversight. A directive that is a **symlinked file** inside a real directory is
+ * removable and must stay so: `unlink` removes the link, the target survives, and git stages the
+ * link as an ordinary blob. It is reaching *through* a symlinked **directory** that leaves the
+ * project — that is the file git itself refuses to stage ("beyond a symbolic link") and the one
+ * whose deletion lands outside the root.
+ *
+ * **That reasoning is a deletion's, and this function has write callers too.** For `unlinkSync` it
+ * holds entire: resolving the leaf would turn a working removal into a refusal protecting nothing.
+ * `task-105` added two **write** consumers — `resolveConfinedMemoryPath` (`./memory-path.ts`) and
+ * `requireConfinedTarget` inside `commitMemoryTransition` (`../core/memory-transition.ts`) — and
+ * `writeFileSync` **follows** a symlinked leaf where `unlinkSync` acts on it, which put bytes
+ * outside the root on both of them (`bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * That is answered **beside** this function rather than inside it, by `task-106`: the write paths
+ * ask {@link targetIsSymlink} as well, and refuse a symlinked target outright. This function is
+ * unchanged, so the delete path is unchanged with it — a wider boundary here would have red exactly
+ * the `bug-044` case the paragraph above exists to keep working. So the asymmetry is read per verb:
+ * resolve the parent everywhere, refuse a symlinked leaf where the syscall would follow it.
+ * `dl-086` carries the argument about which state a guard over a filesystem effect may read.
+ *
+ * @param root - The project root; need not be real-resolved by the caller.
+ * @param relativePath - A root-relative path (an absolute one is honoured as given, and then judged
+ *   by the same boundary).
+ */
+function resolveRealPathInRoot(root, relativePath) {
+    const realRoot = realpathOfDirectory(root);
+    const absolute = (0, node_path_1.resolve)(realRoot, relativePath);
+    const real = (0, node_path_1.join)(realpathOfDirectory((0, node_path_1.dirname)(absolute)), (0, node_path_1.basename)(absolute));
+    return { absolute, real, within: !escapesRoot(realRoot, real) };
+}
+/**
+ * True when `target`'s **own name** is a symbolic link — the question a write must ask and a delete
+ * must not (task-106, `bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * `writeFileSync` follows a symlinked leaf: the bytes land at the link's destination, not at the
+ * path the operation named, and {@link resolveRealPathInRoot} does not see it because it resolves
+ * the parent and keeps the basename. `unlinkSync` is the opposite — it acts on the link — so the
+ * same input is a defect for one verb and correct behaviour for the other (`bug-044`'s benign case).
+ * Hence a separate predicate, asked only where the syscall follows links, rather than a wider
+ * boundary that would decide both.
+ *
+ * **`lstat`, not `exists`.** `existsSync` follows links and is therefore **false** for a dangling
+ * one, which is how `requireAbsentTarget` (`../core/write-guard.ts`) read an occupied path as free
+ * and let `memory add` write through it and commit (`bug-120` D1). `lstatSync` inspects the link
+ * itself and answers `true`. Its `ENOENT` — nothing at the path at all, the ordinary case for a
+ * document about to be created — is the one failure absorbed here, along with any other `lstat`
+ * error: a path this cannot inspect is not a link it can report, and every caller has already
+ * decided confinement separately.
+ *
+ * **Not an adversarial defence, and the window is real.** Node's `fs` exposes no `O_NOFOLLOW` on a
+ * path-based API, so nothing closes the gap between this check and the write that follows it; only
+ * file-descriptor primitives (`openat`) would. `dl-086` names the same limit for the delete path.
+ * What this converts is a routine, self-inflicted loss — a store aliased into shared space, a
+ * document linked into a folder — into a refusal.
+ *
+ * @param target - An absolute path. Only its own name is inspected; links on the way to it are the
+ *   confinement boundary's business ({@link resolveRealPathInRoot}), not this predicate's.
+ */
+function targetIsSymlink(target) {
+    try {
+        return (0, node_fs_1.lstatSync)(target).isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The refusal a write path returns for a symlinked target — one sentence, one place, so the
+ * `StorageError` `memory add` raises and the `CoreResult` the transition verbs return cannot drift
+ * apart on what the rule is (task-106).
+ *
+ * It names the path and says the target is a link, and it deliberately does **not** name where the
+ * link points: {@link targetIsSymlink} refuses without resolving, and a message quoting a
+ * destination would imply the guard had judged it. No child-process text goes anywhere near it
+ * (`bug-071`/`bug-093`).
+ *
+ * @param action - The verb for the first clause, e.g. `'write'` → `cannot write '<path>'`, the
+ *   message shape `requireConfinedTarget` and `requireCustomAsset` already use.
+ * @param path - The path as the operation named it, root-relative or rendered — never re-spelled,
+ *   so the operator reads back what they typed against.
+ */
+function symlinkTargetRefusal(action, path) {
+    return (`cannot ${action} '${path}': the target is itself a symbolic link. A write follows a link where a delete acts ` +
+        'on it, so the bytes would land wherever the link points — not at the path named here, and outside the project ' +
+        'entirely when the link leaves it. Replace the link with a regular file, then retry.');
+}
+//# sourceMappingURL=confinement.js.map

package/dist/storage/confinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confinement.js","sourceRoot":"","sources":["../../src/storage/confinement.ts"],"names":[],"mappings":";;AAmCA,kCAGC;AAoED,sDAKC;AA8BD,0CAMC;AAiBD,oDAMC;AA1KD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qCAAkD;AAClD,yCAAwF;AAExF;;;;GAIG;AACH,SAAgB,WAAW,CAAC,YAAoB,EAAE,MAAc;IAC9D,MAAM,GAAG,GAAG,IAAA,oBAAQ,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,eAAG,EAAE,CAAC,IAAI,IAAA,sBAAU,EAAC,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAA,gBAAI,EAAC,IAAA,sBAAY,EAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;YAChC,6FAA6F;YAC7F,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,IAAA,gBAAI,EAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC;YACzD,OAAO,CAAC,OAAO,CAAC,IAAA,oBAAQ,EAAC,OAAO,CAAC,CAAC,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,qBAAqB,CAAC,IAAY,EAAE,YAAoB;IACtE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAA,mBAAO,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,mBAAmB,CAAC,IAAA,mBAAO,EAAC,QAAQ,CAAC,CAAC,EAAE,IAAA,oBAAQ,EAAC,QAAQ,CAAC,CAAC,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,eAAe,CAAC,MAAc;IAC5C,IAAI,CAAC;QACH,OAAO,IAAA,mBAAS,EAAC,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,OAAO,CACL,UAAU,MAAM,KAAK,IAAI,sFAAsF;QAC/G,gHAAgH;QAChH,qFAAqF,CACtF,CAAC;AACJ,CAAC"}

package/dist/storage/document.d.ts

@@ -0,0 +1,27 @@
+/** Read a document's full contents as UTF-8 text. */
+export declare function readDocument(absolutePath: string): string;
+/** Whether a document exists at `absolutePath`. */
+export declare function documentExists(absolutePath: string): boolean;
+/**
+ * Write `content` to `absolutePath`, creating any missing parent directories. No other file or
+ * directory is created or touched — the write is exactly this one path, nothing else.
+ */
+export declare function writeDocument(absolutePath: string, content: string): void;
+/**
+ * Delete the document at `absolutePath` — {@link writeDocument}'s exact counterpart, added for
+ * `directive remove` (P3.3, task-052-directive-remove), the first operation in the system that
+ * removes a file rather than writing one.
+ *
+ * Exactly this one path is unlinked: no parent directory is pruned (an emptied
+ * `directives/custom/` must keep existing — `spec-011-storage-layout`'s `built-in/` vs `custom/`
+ * split is what REQ-SEC-07 keys removability on, so the directory is structure, not content), and
+ * nothing is ever removed recursively. Staging and committing the deletion is the caller's job,
+ * exactly as it is for a write (`commitPaths`, ./commit) — this module only owns the bytes at an
+ * already-resolved absolute path.
+ *
+ * @throws Node's `ENOENT` when nothing is there. Callers resolve the target before calling (P3.3
+ *   resolves a directive NAME to a file that `loadDirectives` just read), so a missing path is a
+ *   programmer error rather than a domain outcome to swallow.
+ */
+export declare function removeDocument(absolutePath: string): void;
+//# sourceMappingURL=document.d.ts.map

package/dist/storage/document.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../src/storage/document.ts"],"names":[],"mappings":"AAWA,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAGzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAEzD"}

package/dist/storage/document.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDocument = readDocument;
+exports.documentExists = documentExists;
+exports.writeDocument = writeDocument;
+exports.removeDocument = removeDocument;
+/**
+ * Plain document read/write/remove (task-003-git-backed-sot, REQ-SYS-01). Every Memory/DNA/Directives/
+ * Workflow mutation is a regular file write with no side-channel state — no `.wingfoil/state/`
+ * index (REQ-SYS-03), no cache file that isn't itself just a copy of what's already on disk.
+ * `git add`/`git commit` of the result is the caller's job (dev-loop's commit conventions, CLAUDE.md
+ * §5.1) — this module only owns the bytes at an already-resolved absolute path (see
+ * `./memory-path`).
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+/** Read a document's full contents as UTF-8 text. */
+function readDocument(absolutePath) {
+    return (0, fs_1.readFileSync)(absolutePath, 'utf-8');
+}
+/** Whether a document exists at `absolutePath`. */
+function documentExists(absolutePath) {
+    return (0, fs_1.existsSync)(absolutePath);
+}
+/**
+ * Write `content` to `absolutePath`, creating any missing parent directories. No other file or
+ * directory is created or touched — the write is exactly this one path, nothing else.
+ */
+function writeDocument(absolutePath, content) {
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(absolutePath), { recursive: true });
+    (0, fs_1.writeFileSync)(absolutePath, content, 'utf-8');
+}
+/**
+ * Delete the document at `absolutePath` — {@link writeDocument}'s exact counterpart, added for
+ * `directive remove` (P3.3, task-052-directive-remove), the first operation in the system that
+ * removes a file rather than writing one.
+ *
+ * Exactly this one path is unlinked: no parent directory is pruned (an emptied
+ * `directives/custom/` must keep existing — `spec-011-storage-layout`'s `built-in/` vs `custom/`
+ * split is what REQ-SEC-07 keys removability on, so the directory is structure, not content), and
+ * nothing is ever removed recursively. Staging and committing the deletion is the caller's job,
+ * exactly as it is for a write (`commitPaths`, ./commit) — this module only owns the bytes at an
+ * already-resolved absolute path.
+ *
+ * @throws Node's `ENOENT` when nothing is there. Callers resolve the target before calling (P3.3
+ *   resolves a directive NAME to a file that `loadDirectives` just read), so a missing path is a
+ *   programmer error rather than a domain outcome to swallow.
+ */
+function removeDocument(absolutePath) {
+    (0, fs_1.unlinkSync)(absolutePath);
+}
+//# sourceMappingURL=document.js.map

package/dist/storage/document.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document.js","sourceRoot":"","sources":["../../src/storage/document.ts"],"names":[],"mappings":";;AAYA,oCAEC;AAGD,wCAEC;AAMD,sCAGC;AAkBD,wCAEC;AAhDD;;;;;;;GAOG;AACH,2BAAoF;AACpF,+BAA+B;AAE/B,qDAAqD;AACrD,SAAgB,YAAY,CAAC,YAAoB;IAC/C,OAAO,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,mDAAmD;AACnD,SAAgB,cAAc,CAAC,YAAoB;IACjD,OAAO,IAAA,eAAU,EAAC,YAAY,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,YAAoB,EAAE,OAAe;IACjE,IAAA,cAAS,EAAC,IAAA,cAAO,EAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAA,kBAAa,EAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,cAAc,CAAC,YAAoB;IACjD,IAAA,eAAU,EAAC,YAAY,CAAC,CAAC;AAC3B,CAAC"}

package/dist/storage/errors.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Shared storage-layer error type (task-003-git-backed-sot, REQ-SYS-01, spec-011-storage-layout).
+ *
+ * Mirrors the shape of {@link ../validation/errors.ValidationError} — a single typed `Error`
+ * subclass carrying a stable `E_*` code — but for storage/root/init-detection failures, which are
+ * process-environment problems (wrong cwd, not a git repo, an unresolved path placeholder), not
+ * data-validation problems. Kept separate from `src/validation` rather than reusing
+ * `ValidationError` because these failures never carry a `ValidationIssue[]`/`exitCode` pair: they
+ * are single, precise conditions raised before any document parsing happens.
+ */
+export declare class StorageError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Raised by {@link resolveProjectRoot} when no ancestor of `cwd` contains a `.git` entry. */
+export declare const E_NO_GIT_ROOT = "E_NO_GIT_ROOT";
+/** Raised by {@link resolveProjectRoot} when the git root exists but isn't `cwd` itself. */
+export declare const E_NOT_AT_GIT_ROOT = "E_NOT_AT_GIT_ROOT";
+/** Raised by {@link renderMemoryPath} when a `{placeholder}` in a `path` pattern has no value. */
+export declare const E_MISSING_PATH_VALUE = "E_MISSING_PATH_VALUE";
+/**
+ * Raised by {@link resolveConfinedMemoryPath} when a resolved Memory-entry path would land outside the
+ * project root — e.g. a crafted `id`/value containing `../` traversal (REQ-SEC-06 storage confinement).
+ */
+export declare const E_PATH_ESCAPES_ROOT = "E_PATH_ESCAPES_ROOT";
+/**
+ * Raised by {@link resolveConfinedMemoryPath} when the target's **own name** is a symbolic link
+ * (task-106, `bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * Distinct from {@link E_PATH_ESCAPES_ROOT} because it reports a different finding: that code says
+ * where the path leads, this one says a write would not land on the named path at all. The link is
+ * refused without being resolved, so where it points is deliberately not part of the answer — see
+ * `targetIsSymlink` (`./confinement.ts`).
+ */
+export declare const E_TARGET_IS_SYMLINK = "E_TARGET_IS_SYMLINK";
+//# sourceMappingURL=errors.d.ts.map

package/dist/storage/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/storage/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAO1C;AAED,8FAA8F;AAC9F,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,kGAAkG;AAClG,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC"}

package/dist/storage/errors.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E_TARGET_IS_SYMLINK = exports.E_PATH_ESCAPES_ROOT = exports.E_MISSING_PATH_VALUE = exports.E_NOT_AT_GIT_ROOT = exports.E_NO_GIT_ROOT = exports.StorageError = void 0;
+/**
+ * Shared storage-layer error type (task-003-git-backed-sot, REQ-SYS-01, spec-011-storage-layout).
+ *
+ * Mirrors the shape of {@link ../validation/errors.ValidationError} — a single typed `Error`
+ * subclass carrying a stable `E_*` code — but for storage/root/init-detection failures, which are
+ * process-environment problems (wrong cwd, not a git repo, an unresolved path placeholder), not
+ * data-validation problems. Kept separate from `src/validation` rather than reusing
+ * `ValidationError` because these failures never carry a `ValidationIssue[]`/`exitCode` pair: they
+ * are single, precise conditions raised before any document parsing happens.
+ */
+class StorageError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = 'StorageError';
+        this.code = code;
+        // Restore the prototype chain so `instanceof StorageError` holds after transpilation.
+        Object.setPrototypeOf(this, StorageError.prototype);
+    }
+}
+exports.StorageError = StorageError;
+/** Raised by {@link resolveProjectRoot} when no ancestor of `cwd` contains a `.git` entry. */
+exports.E_NO_GIT_ROOT = 'E_NO_GIT_ROOT';
+/** Raised by {@link resolveProjectRoot} when the git root exists but isn't `cwd` itself. */
+exports.E_NOT_AT_GIT_ROOT = 'E_NOT_AT_GIT_ROOT';
+/** Raised by {@link renderMemoryPath} when a `{placeholder}` in a `path` pattern has no value. */
+exports.E_MISSING_PATH_VALUE = 'E_MISSING_PATH_VALUE';
+/**
+ * Raised by {@link resolveConfinedMemoryPath} when a resolved Memory-entry path would land outside the
+ * project root — e.g. a crafted `id`/value containing `../` traversal (REQ-SEC-06 storage confinement).
+ */
+exports.E_PATH_ESCAPES_ROOT = 'E_PATH_ESCAPES_ROOT';
+/**
+ * Raised by {@link resolveConfinedMemoryPath} when the target's **own name** is a symbolic link
+ * (task-106, `bug-120-a-symlinked-document-leaf-is-followed-by-the-write`).
+ *
+ * Distinct from {@link E_PATH_ESCAPES_ROOT} because it reports a different finding: that code says
+ * where the path leads, this one says a write would not land on the named path at all. The link is
+ * refused without being resolved, so where it points is deliberately not part of the answer — see
+ * `targetIsSymlink` (`./confinement.ts`).
+ */
+exports.E_TARGET_IS_SYMLINK = 'E_TARGET_IS_SYMLINK';
+//# sourceMappingURL=errors.js.map

package/dist/storage/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/storage/errors.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,MAAa,YAAa,SAAQ,KAAK;IAC5B,IAAI,CAAS;IAEtB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,sFAAsF;QACtF,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;CACF;AAVD,oCAUC;AAED,8FAA8F;AACjF,QAAA,aAAa,GAAG,eAAe,CAAC;AAE7C,4FAA4F;AAC/E,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,kGAAkG;AACrF,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;GAGG;AACU,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAG,qBAAqB,CAAC"}

package/dist/storage/frontmatter.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Frontmatter extraction (task-003-git-backed-sot). Memory element state is derived from each
+ * document's frontmatter, not any external index (CLAUDE.md §5, REQ-STATE-01/-02): this is the
+ * shared primitive for reading it, as raw YAML text. Parsing that text against a type's schema is
+ * the validation module's job (spec-009-validation-strategy, task-002), not this module's — keeping
+ * the two concerns separate lets the storage layer stay YAML-schema-agnostic.
+ */
+/**
+ * Extract the raw YAML frontmatter block (the text between the first pair of `---` delimiters)
+ * from a Memory document's content. Returns `null` if the document has no frontmatter block at all
+ * (no leading `---` line).
+ */
+export declare function extractFrontmatter(content: string): string | null;
+/** The result of {@link splitFrontmatter}: the raw frontmatter text (or `null`) plus the body. */
+export interface FrontmatterSplit {
+    readonly frontmatter: string | null;
+    readonly body: string;
+}
+/**
+ * Split a Memory document into its raw frontmatter text (see {@link extractFrontmatter}) and the
+ * body that follows it (task-008-dna-memory-query-latency: the query primitives need the body text
+ * for keyword matching, in the same read pass that already extracts frontmatter — no second parse).
+ * When there is no frontmatter block at all, `frontmatter` is `null` and `body` is the whole
+ * document, unchanged.
+ */
+export declare function splitFrontmatter(content: string): FrontmatterSplit;
+//# sourceMappingURL=frontmatter.d.ts.map

package/dist/storage/frontmatter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.d.ts","sourceRoot":"","sources":["../../src/storage/frontmatter.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEjE;AAED,kGAAkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAIlE"}

package/dist/storage/frontmatter.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Frontmatter extraction (task-003-git-backed-sot). Memory element state is derived from each
+ * document's frontmatter, not any external index (CLAUDE.md §5, REQ-STATE-01/-02): this is the
+ * shared primitive for reading it, as raw YAML text. Parsing that text against a type's schema is
+ * the validation module's job (spec-009-validation-strategy, task-002), not this module's — keeping
+ * the two concerns separate lets the storage layer stay YAML-schema-agnostic.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractFrontmatter = extractFrontmatter;
+exports.splitFrontmatter = splitFrontmatter;
+// Opening delimiter must be the very first line of the document (no leading blank line); content is
+// everything up to the next standalone "---" line; trailing newline after the closing delimiter is
+// optional so a frontmatter-only document (no body) still matches.
+const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+/**
+ * Extract the raw YAML frontmatter block (the text between the first pair of `---` delimiters)
+ * from a Memory document's content. Returns `null` if the document has no frontmatter block at all
+ * (no leading `---` line).
+ */
+function extractFrontmatter(content) {
+    return splitFrontmatter(content).frontmatter;
+}
+/**
+ * Split a Memory document into its raw frontmatter text (see {@link extractFrontmatter}) and the
+ * body that follows it (task-008-dna-memory-query-latency: the query primitives need the body text
+ * for keyword matching, in the same read pass that already extracts frontmatter — no second parse).
+ * When there is no frontmatter block at all, `frontmatter` is `null` and `body` is the whole
+ * document, unchanged.
+ */
+function splitFrontmatter(content) {
+    const match = FRONTMATTER_RE.exec(content);
+    if (!match)
+        return { frontmatter: null, body: content };
+    return { frontmatter: match[1] ?? '', body: content.slice(match[0].length) };
+}
+//# sourceMappingURL=frontmatter.js.map

package/dist/storage/frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontmatter.js","sourceRoot":"","sources":["../../src/storage/frontmatter.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAYH,gDAEC;AAeD,4CAIC;AA/BD,oGAAoG;AACpG,mGAAmG;AACnG,mEAAmE;AACnE,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAE3D;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,OAAe;IAChD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC;AAC/C,CAAC;AAQD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACxD,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/dist/storage/git-root.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Walk up from `cwd` looking for a `.git` entry (spec-011: "no upward search for `.wingfoil/`
+ * itself, only for `.git`"). Returns the first ancestor directory (inclusive of `cwd`) that
+ * contains `.git`, or `null` if the filesystem root is reached without finding one. `cwd` is
+ * resolved first so relative paths and trailing separators don't affect the result (determinism).
+ */
+export declare function findGitRoot(cwd: string): string | null;
+/**
+ * Resolve the WingFoil project root: the git root, and only the git root. Per spec-011, `wingfoil`
+ * must be invoked at the exact repository root — no upward search for `.wingfoil/` and no running
+ * from a subdirectory of the root.
+ *
+ * @throws {@link StorageError} `E_NO_GIT_ROOT` if `cwd` is not inside a git repository at all, or
+ *   `E_NOT_AT_GIT_ROOT` if a git root was found but it isn't `cwd` itself.
+ */
+export declare function resolveProjectRoot(cwd: string): string;
+//# sourceMappingURL=git-root.d.ts.map

package/dist/storage/git-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-root.d.ts","sourceRoot":"","sources":["../../src/storage/git-root.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQtD;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUtD"}

package/dist/storage/git-root.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findGitRoot = findGitRoot;
+exports.resolveProjectRoot = resolveProjectRoot;
+/**
+ * Git-root detection and project-root resolution (task-003-git-backed-sot, REQ-SYS-01,
+ * spec-011-storage-layout "Git-root detection algorithm"). Every other storage primitive assumes it
+ * is operating against a resolved project root — this is where that root comes from.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const errors_1 = require("./errors");
+/**
+ * Walk up from `cwd` looking for a `.git` entry (spec-011: "no upward search for `.wingfoil/`
+ * itself, only for `.git`"). Returns the first ancestor directory (inclusive of `cwd`) that
+ * contains `.git`, or `null` if the filesystem root is reached without finding one. `cwd` is
+ * resolved first so relative paths and trailing separators don't affect the result (determinism).
+ */
+function findGitRoot(cwd) {
+    let dir = (0, path_1.resolve)(cwd);
+    for (;;) {
+        if ((0, fs_1.existsSync)((0, path_1.join)(dir, '.git')))
+            return dir;
+        const parent = (0, path_1.dirname)(dir);
+        if (parent === dir)
+            return null; // reached the filesystem root without finding .git
+        dir = parent;
+    }
+}
+/**
+ * Resolve the WingFoil project root: the git root, and only the git root. Per spec-011, `wingfoil`
+ * must be invoked at the exact repository root — no upward search for `.wingfoil/` and no running
+ * from a subdirectory of the root.
+ *
+ * @throws {@link StorageError} `E_NO_GIT_ROOT` if `cwd` is not inside a git repository at all, or
+ *   `E_NOT_AT_GIT_ROOT` if a git root was found but it isn't `cwd` itself.
+ */
+function resolveProjectRoot(cwd) {
+    const resolvedCwd = (0, path_1.resolve)(cwd);
+    const root = findGitRoot(resolvedCwd);
+    if (root === null) {
+        throw new errors_1.StorageError(errors_1.E_NO_GIT_ROOT, 'not inside a git repository');
+    }
+    if (root !== resolvedCwd) {
+        throw new errors_1.StorageError(errors_1.E_NOT_AT_GIT_ROOT, 'run wingfoil from the project root');
+    }
+    return root;
+}
+//# sourceMappingURL=git-root.js.map

package/dist/storage/git-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-root.js","sourceRoot":"","sources":["../../src/storage/git-root.ts"],"names":[],"mappings":";;AAgBA,kCAQC;AAUD,gDAUC;AA5CD;;;;GAIG;AACH,2BAAgC;AAChC,+BAA8C;AAE9C,qCAA0E;AAE1E;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,IAAI,GAAG,GAAG,IAAA,cAAO,EAAC,GAAG,CAAC,CAAC;IACvB,SAAS,CAAC;QACR,IAAI,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,cAAO,EAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;QACpF,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,WAAW,GAAG,IAAA,cAAO,EAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,qBAAY,CAAC,sBAAa,EAAE,6BAA6B,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAY,CAAC,0BAAiB,EAAE,oCAAoC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/storage/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `storage` module — git-backed file storage (YAML + Markdown); single source of truth
+ * (REQ-SYS-01, task-003-git-backed-sot). Single entry point for: resolving the WingFoil project
+ * root, detecting initialization state, rendering a Memory type's `path` pattern
+ * (spec-001-memory-yaml-schema) against concrete values, reading/writing document bytes, and
+ * computing the whole-project state snapshot the REQ-SYS-01 fit criterion is stated in terms of.
+ */
+export declare const MODULE_NAME: "storage";
+export { StorageError, E_NO_GIT_ROOT, E_NOT_AT_GIT_ROOT, E_MISSING_PATH_VALUE } from './errors';
+export { findGitRoot, resolveProjectRoot } from './git-root';
+export { detectInitState } from './init-state';
+export type { InitState } from './init-state';
+export { renderMemoryPath, resolveMemoryPath } from './memory-path';
+export { escapesRoot, resolveRealPathInRoot } from './confinement';
+export type { RealPathResolution } from './confinement';
+export { extractFrontmatter, splitFrontmatter } from './frontmatter';
+export type { FrontmatterSplit } from './frontmatter';
+export { readDocument, documentExists, removeDocument, writeDocument } from './document';
+export { changedPathsBetween, commitParent, commitPaths, EMPTY_TREE_SHA, listPathsAtRev, pathPorcelainStatus, readPathAtRev } from './commit';
+export type { CommitOptions } from './commit';
+export { initStorage, scaffoldFiles, WINGFOIL_DIR, INIT_COMMIT_MESSAGE } from './layout';
+export type { ScaffoldFile } from './layout';
+export { TEMPLATES, TEMPLATE_NAMES, DEFAULT_TEMPLATE, resolveTemplate, templateScaffold, initProjectCommitMessage, builtinTemplateSources, BUILTIN_DIRECTIVES_DIR, BUILTIN_WORKFLOWS_DIR, } from './templates';
+export type { TemplateDefinition, BuiltinTemplateKind, BuiltinTemplateSource } from './templates';
+export { BUILTIN_DIRECTIVE_TEMPLATES, BUILTIN_DIRECTIVE_IDS, builtinDirectiveMd } from './builtin-directives';
+export type { BuiltinDirectiveTemplate } from './builtin-directives';
+export { computeStateSnapshot, serializeSnapshot } from './snapshot';
+export type { SnapshotEntry } from './snapshot';
+//# sourceMappingURL=index.d.ts.map