@aixle/insights 0.1.0

package/dist/risk-scanner.d.ts

@@ -0,0 +1,8 @@
+export type RiskLevel = "low" | "medium" | "high" | "critical";
+export interface ScanResult {
+    risk_level: RiskLevel;
+    risk_score: number;
+    risk_categories: string[];
+    scannable: true;
+}
+export declare function scanText(text: string): ScanResult;

package/dist/risk-scanner.js

@@ -0,0 +1,59 @@
+const CATEGORIES = {
+    secrets: {
+        weight: 3,
+        patterns: [
+            /AKIA[0-9A-Z]{16}/gi, // AWS Access Key
+            /ghp_[A-Za-z0-9]{36}/gi, // GitHub personal access token
+            /gho_[A-Za-z0-9]{36}/gi, // GitHub OAuth token
+            /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/gi, // JWT
+        ],
+    },
+    pii_high: {
+        weight: 3,
+        patterns: [
+            /\b\d{3}-\d{2}-\d{4}\b/g, // SSN
+            /\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11})\b/g, // Credit card
+        ],
+    },
+    pii_standard: {
+        weight: 1,
+        patterns: [
+            /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/gi, // Email
+            /\b(?:\+?1[-.\s]?)?(?:\([0-9]{3}\)|[0-9]{3})[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}\b/g, // Phone
+        ],
+    },
+};
+const THRESHOLDS = { medium: 1, high: 3, critical: 5 };
+export function scanText(text) {
+    let risk_score = 0;
+    const risk_categories = [];
+    for (const [categoryName, { patterns, weight }] of Object.entries(CATEGORIES)) {
+        let categoryMatches = 0;
+        for (const pattern of patterns) {
+            const matches = text.match(pattern);
+            if (matches) {
+                categoryMatches += matches.length;
+            }
+        }
+        if (categoryMatches > 0) {
+            risk_score += weight * categoryMatches;
+            risk_categories.push(categoryName);
+        }
+    }
+    let risk_level = "low";
+    if (risk_score >= THRESHOLDS.critical) {
+        risk_level = "critical";
+    }
+    else if (risk_score >= THRESHOLDS.high) {
+        risk_level = "high";
+    }
+    else if (risk_score >= THRESHOLDS.medium) {
+        risk_level = "medium";
+    }
+    return {
+        risk_level,
+        risk_score,
+        risk_categories,
+        scannable: true,
+    };
+}

package/dist/server.d.ts

@@ -0,0 +1,14 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+export declare const SERVER_NAME = "aixle-insights-mcp";
+export declare const SYNC_NOW_INPUT_SCHEMA: z.ZodObject<{
+    tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        claude_code: "claude_code";
+        cursor: "cursor";
+    }>>>;
+}, z.core.$strict>;
+/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
+export declare function buildDb90StatusPayload(): Promise<Record<string, unknown>>;
+/** In-process MCP server instance (stdio not attached). */
+export declare function createDb90McpServer(): McpServer;
+export declare function startServer(): Promise<void>;

package/dist/server.js

@@ -0,0 +1,234 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { getGitRemote, resolveProjectId } from "./lib/index.js";
+import { loadCredentials, credentialsHaveAnyToken, pickProjectLookupToken } from "./credentials.js";
+import { defaultKeycloakClientId, defaultKeycloakIssuer, startDeviceAuthorization } from "./auth/keycloak.js";
+import { migrateLegacyState, getAppDir } from "./state.js";
+import { syncTelemetryTools } from "./sync.js";
+import { DEFAULT_PRICING, mergePricing } from "./pricing.js";
+import { resolveCursorPricing } from "./cursor-config.js";
+import { buildHealthSnapshot, healthSnapshotToStatusPayload } from "./health.js";
+import { mcpLog } from "./log.js";
+export const SERVER_NAME = "aixle-insights-mcp";
+const SERVER_VERSION = "0.1.0";
+const SYNC_INTERVAL_MS = 5 * 60 * 1000;
+export const SYNC_NOW_INPUT_SCHEMA = z
+    .object({
+    tools: z.array(z.enum(["claude_code", "cursor"])).min(1).optional(),
+})
+    .superRefine((value, ctx) => {
+    if (value.tools && new Set(value.tools).size !== value.tools.length) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "tools must not contain duplicates",
+            path: ["tools"],
+        });
+    }
+})
+    .strict();
+function jsonContent(value) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(value, null, 2),
+            },
+        ],
+    };
+}
+function defaultPricing() {
+    return mergePricing(DEFAULT_PRICING, {});
+}
+function cursorPricingForSync() {
+    return resolveCursorPricing(undefined, getAppDir());
+}
+function migrateAllLegacyState(creds) {
+    const appDir = getAppDir();
+    const seenTokens = new Set();
+    for (const [_tool, tok] of Object.entries(creds.accounts)) {
+        if (typeof tok === "string" && tok.length > 0 && !seenTokens.has(tok)) {
+            migrateLegacyState(appDir, creds.host, tok);
+            seenTokens.add(tok);
+        }
+    }
+}
+function syncResultOk(result) {
+    return !result.locked && result.failed === 0;
+}
+// Process-lifetime cache keyed on the inputs that drive resolveProjectId: host,
+// lookup token, and the current repo's git remote. Re-resolve when any of them
+// changes (re-auth, repo cwd change). `source: "none"` is never cached so a
+// transient lookup failure doesn't poison the cache.
+let cachedProjectResolution = null;
+async function getProjectResolutionForSync(creds) {
+    const token = pickProjectLookupToken(creds);
+    if (!token)
+        return { projectId: null, source: "none" };
+    const gitRemote = getGitRemote(false) ?? "no-remote";
+    const cacheKey = `${creds.host}|${token}|${gitRemote}`;
+    if (cachedProjectResolution?.key === cacheKey) {
+        return cachedProjectResolution.value;
+    }
+    const result = await resolveProjectId(undefined, undefined, creds.host, token, false);
+    mcpLog.info("project_attribution_resolved", { project_id: result.projectId, source: result.source }, false);
+    if (result.source !== "none") {
+        cachedProjectResolution = { key: cacheKey, value: result };
+    }
+    return result;
+}
+/** Structured status for `db90_status` — tolerates missing/malformed credentials and state. */
+export async function buildDb90StatusPayload() {
+    const snapshot = await buildHealthSnapshot();
+    return healthSnapshotToStatusPayload(snapshot);
+}
+async function executeSync(parsed) {
+    const creds = await loadCredentials();
+    if (!creds || !credentialsHaveAnyToken(creds)) {
+        mcpLog.warn("credential_validation_failed", { source: "db90_sync_now", reason: "missing_credentials" }, false);
+        return { ok: false, error: "missing_credentials" };
+    }
+    migrateAllLegacyState(creds);
+    const projectResolution = await getProjectResolutionForSync(creds);
+    const result = await syncTelemetryTools({
+        credentials: creds,
+        dryRun: false,
+        verbose: false,
+        projectId: projectResolution.projectId,
+        projectIdSource: projectResolution.source,
+        projectLookupToken: pickProjectLookupToken(creds),
+        pricing: defaultPricing(),
+        cursorPricing: cursorPricingForSync(),
+        tools: parsed.tools,
+        scopeDir: process.cwd(),
+    });
+    return { ok: syncResultOk(result), result };
+}
+/** In-process MCP server instance (stdio not attached). */
+export function createDb90McpServer() {
+    const server = new McpServer({ name: SERVER_NAME, version: SERVER_VERSION }, { capabilities: { tools: {} } });
+    server.registerTool("db90_status", {
+        description: "Returns Aixle Insights MCP connectivity and last sync metadata from disk (credentials + state). No arguments.",
+    }, async () => jsonContent(await buildDb90StatusPayload()));
+    server.registerTool("db90_sync_now", {
+        description: "Runs one DB90 ingest sync cycle for enabled tools immediately (matches background cadence). " +
+            "Optional `tools` subset filter: omit to sync every tool credential you have authenticated (Claude transcripts + Cursor telemetry).",
+        inputSchema: SYNC_NOW_INPUT_SCHEMA,
+    }, async (input) => {
+        try {
+            const parsed = SYNC_NOW_INPUT_SCHEMA.parse(input ?? {});
+            return jsonContent(await executeSync(parsed));
+        }
+        catch (err) {
+            if (err instanceof z.ZodError) {
+                return jsonContent({
+                    ok: false,
+                    error: "validation_error",
+                    details: err.flatten(),
+                });
+            }
+            return jsonContent({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    server.registerTool("db90_authenticate", {
+        description: "Starts Keycloak device login and returns the visit URL/code for the user. Use aixle-insights init for the full terminal flow that saves credentials.",
+        inputSchema: z.object({
+            keycloakUrl: z.string().optional(),
+            clientId: z.string().optional(),
+        }),
+    }, async (input) => {
+        try {
+            const args = input;
+            const kc = (args.keycloakUrl?.trim() || defaultKeycloakIssuer()).trim();
+            if (!kc) {
+                return jsonContent({
+                    ok: false,
+                    error: "keycloakUrl or KEYCLOAK_ISSUER / DB90_KEYCLOAK_ISSUER is required",
+                });
+            }
+            const clientId = args.clientId?.trim() || defaultKeycloakClientId();
+            const device = await startDeviceAuthorization({
+                issuer: kc,
+                clientId,
+            });
+            return jsonContent({
+                ok: true,
+                verificationUri: device.verification_uri,
+                verificationUriComplete: device.verification_uri_complete ?? null,
+                userCode: device.user_code,
+                expiresIn: device.expires_in,
+                interval: device.interval ?? 5,
+                issuer: kc,
+                clientId,
+                message: `Visit ${device.verification_uri} and enter code ${device.user_code}`,
+            });
+        }
+        catch (err) {
+            return jsonContent({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+    return server;
+}
+export async function startServer() {
+    const server = createDb90McpServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    let intervalId;
+    let jitterTimeout;
+    let shuttingDown = false;
+    let activeBackground = Promise.resolve();
+    const onSignal = () => {
+        shuttingDown = true;
+        if (jitterTimeout !== undefined)
+            clearTimeout(jitterTimeout);
+        if (intervalId !== undefined)
+            clearInterval(intervalId);
+        activeBackground.finally(() => {
+            process.exit(0);
+        });
+    };
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    const runBackground = async (source) => {
+        if (shuttingDown)
+            return;
+        const creds = await loadCredentials();
+        if (!creds || !credentialsHaveAnyToken(creds)) {
+            mcpLog.warn("credential_validation_failed", { source, reason: "missing_credentials" }, false);
+            return;
+        }
+        try {
+            migrateAllLegacyState(creds);
+            const projectResolution = await getProjectResolutionForSync(creds);
+            await syncTelemetryTools({
+                credentials: creds,
+                dryRun: false,
+                verbose: false,
+                projectId: projectResolution.projectId,
+                projectIdSource: projectResolution.source,
+                projectLookupToken: pickProjectLookupToken(creds),
+                pricing: defaultPricing(),
+                scopeDir: process.cwd(),
+                cursorPricing: cursorPricingForSync(),
+            });
+        }
+        catch (err) {
+            mcpLog.error("background_sync_failed", { source, error: err instanceof Error ? err.message : String(err) }, true);
+        }
+    };
+    activeBackground = runBackground("startup");
+    // Jitter the recurring interval start by up to 60 s to spread load across the install base.
+    jitterTimeout = setTimeout(() => {
+        if (shuttingDown)
+            return;
+        intervalId = setInterval(() => {
+            activeBackground = activeBackground.finally(() => runBackground("interval"));
+        }, SYNC_INTERVAL_MS);
+    }, Math.floor(Math.random() * 60_000));
+}

package/dist/state.d.ts

@@ -0,0 +1,69 @@
+export interface SessionRecord {
+    /** File size in bytes when this session was last successfully sent. */
+    fileSize: number;
+    /** ISO timestamp when this session was sent. */
+    sentAt: string;
+    /** SHA-256 prefix (32 hex chars) of the transcript file at time of send — preferred over fileSize for change detection. */
+    contentHash?: string;
+}
+/** Persisted summary of the last sync run (for CLI/MCP health across processes). */
+export interface SyncResultSnapshot {
+    sent: number;
+    failed: number;
+    skipped: number;
+    locked?: boolean;
+    rate_limited_until?: string | null;
+    errors?: string[];
+}
+/** Operator-facing metadata stored beside checkpoint `sessions` (same credential-scoped file). */
+export interface McpOperatorState {
+    last_sync_at: string | null;
+    last_result: SyncResultSnapshot | null;
+    recent_errors: string[];
+}
+export interface State {
+    version: number;
+    /**
+     * Map of session ID → last known state.
+     * Key namespaces:
+     *   `claude_code:<sessionId>` — Claude transcript turns
+     *   `cursor:watermark` / `cursor:events:watermark` / etc. — Cursor timestamp watermarks
+     *   `cursor:hook:<conversation_id>:<generation_id>:<hook_event_name>` — Cursor hook event dedup (DB90DV-286)
+     */
+    sessions: Record<string, SessionRecord>;
+    /**
+     * All `metadata.commit_hash` values successfully POSTed for Cursor Path B (recent commit).
+     * Hash dedupe is authoritative; timestamp watermarks alone
+     * can block retries after ingest accepted 202 but failed to persist.
+     */
+    lastRecentCommitHashes?: string[];
+    /**
+     * ISO timestamp: suspend sync for this credential until this time (persisted 429 backoff).
+     * Primed into the in-memory backoff map on startup so rate-limits survive process restarts.
+     */
+    rate_limited_until?: string | null;
+    /** Optional MCP diagnostics for health / debugging (does not replace session checkpoints). */
+    mcp_operator?: McpOperatorState;
+}
+export declare function getAppDir(): string;
+/**
+ * Derives a per-credential filename stem.
+ * Format: `state-<hostname>-<8-char token hash>`
+ * Example: `state-app.db90.io-a1b2c3d4.json`
+ */
+export declare function stateKey(host: string, token: string): string;
+/** Absolute path to the credential-scoped state JSON on disk. */
+export declare function credentialStateFilePath(dir: string, host: string, token: string): string;
+/**
+ * One-time migration: if a legacy `state.json` exists but no credential-scoped
+ * file does, rename it to the new name so existing sessions are not re-sent on
+ * the first upgrade run. No-op when the new file already exists or no legacy
+ * file is present.
+ */
+export declare function migrateLegacyState(dir: string, host: string, token: string): void;
+export declare function readState(dir?: string, host?: string, token?: string): State;
+/** Atomic write: write to a temp file then rename over the target. */
+export declare function writeState(state: State, dir?: string, host?: string, token?: string): void;
+export declare function markSessionSent(state: State, sessionId: string, fileSize: number, contentHash?: string): State;
+/** Merge operator snapshot into an existing state object before `writeState`. */
+export declare function withMcpOperator(state: State, operator: McpOperatorState): State;

package/dist/state.js

@@ -0,0 +1,155 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
+export function getAppDir() {
+    const override = process.env["AIXLE_INSIGHTS_HOME"]?.trim();
+    if (override && override.length > 0)
+        return override;
+    return join(homedir(), ".aixle-insights");
+}
+/**
+ * Derives a per-credential filename stem.
+ * Format: `state-<hostname>-<8-char token hash>`
+ * Example: `state-app.db90.io-a1b2c3d4.json`
+ */
+export function stateKey(host, token) {
+    let hostname;
+    try {
+        hostname = new URL(host).hostname;
+    }
+    catch {
+        // host is not a valid URL — sanitise for use as a filename component
+        hostname = host.replace(/[^a-zA-Z0-9.-]/g, "_").slice(0, 40);
+    }
+    const tokenHash = createHash("sha256").update(token).digest("hex").slice(0, 8);
+    return `state-${hostname}-${tokenHash}`;
+}
+function stateFilePath(dir, host, token) {
+    const filename = host && token ? `${stateKey(host, token)}.json` : "state.json";
+    return join(dir, filename);
+}
+/** Absolute path to the credential-scoped state JSON on disk. */
+export function credentialStateFilePath(dir, host, token) {
+    return stateFilePath(dir, host, token);
+}
+function parseMcpOperator(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return undefined;
+    const o = raw;
+    let lastSyncAt = null;
+    if (o.last_sync_at === null)
+        lastSyncAt = null;
+    else if (typeof o.last_sync_at === "string")
+        lastSyncAt = o.last_sync_at;
+    let lastResult = null;
+    if (o.last_result === null) {
+        lastResult = null;
+    }
+    else if (typeof o.last_result === "object" && o.last_result !== null) {
+        const r = o.last_result;
+        if (typeof r.sent === "number" &&
+            typeof r.failed === "number" &&
+            typeof r.skipped === "number") {
+            lastResult = {
+                sent: r.sent,
+                failed: r.failed,
+                skipped: r.skipped,
+                locked: typeof r.locked === "boolean" ? r.locked : undefined,
+                rate_limited_until: r.rate_limited_until === null || typeof r.rate_limited_until === "string"
+                    ? r.rate_limited_until
+                    : undefined,
+                errors: Array.isArray(r.errors)
+                    ? r.errors.filter((e) => typeof e === "string")
+                    : undefined,
+            };
+        }
+    }
+    const recentErrors = Array.isArray(o.recent_errors)
+        ? o.recent_errors.filter((e) => typeof e === "string")
+        : [];
+    return {
+        last_sync_at: lastSyncAt,
+        last_result: lastResult,
+        recent_errors: recentErrors,
+    };
+}
+/**
+ * One-time migration: if a legacy `state.json` exists but no credential-scoped
+ * file does, rename it to the new name so existing sessions are not re-sent on
+ * the first upgrade run. No-op when the new file already exists or no legacy
+ * file is present.
+ */
+export function migrateLegacyState(dir, host, token) {
+    const legacyPath = join(dir, "state.json");
+    const newPath = stateFilePath(dir, host, token);
+    if (existsSync(legacyPath) && !existsSync(newPath)) {
+        renameSync(legacyPath, newPath);
+    }
+}
+export function readState(dir, host, token) {
+    const filePath = stateFilePath(dir ?? getAppDir(), host, token);
+    try {
+        const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+        if (typeof parsed === "object" && parsed !== null) {
+            const p = parsed;
+            if (typeof p.version === "number" &&
+                typeof p.sessions === "object" &&
+                p.sessions !== null) {
+                const lastRecentCommitHashes = Array.isArray(p.lastRecentCommitHashes)
+                    ? p.lastRecentCommitHashes.filter((h) => typeof h === "string")
+                    : undefined;
+                const out = {
+                    version: p.version,
+                    sessions: p.sessions,
+                };
+                if (lastRecentCommitHashes !== undefined) {
+                    out.lastRecentCommitHashes = lastRecentCommitHashes;
+                }
+                if ("mcp_operator" in p) {
+                    const mcp = parseMcpOperator(p.mcp_operator);
+                    if (mcp)
+                        out.mcp_operator = mcp;
+                }
+                if ("rate_limited_until" in p) {
+                    if (typeof p.rate_limited_until === "string") {
+                        out.rate_limited_until = p.rate_limited_until;
+                    }
+                    else if (p.rate_limited_until === null) {
+                        out.rate_limited_until = null;
+                    }
+                }
+                return out;
+            }
+        }
+    }
+    catch {
+        // missing or malformed state file — start fresh
+    }
+    return { version: 1, sessions: {} };
+}
+/** Atomic write: write to a temp file then rename over the target. */
+export function writeState(state, dir, host, token) {
+    const stateDir = dir ?? getAppDir();
+    mkdirSync(stateDir, { recursive: true });
+    const finalPath = stateFilePath(stateDir, host, token);
+    const tmpPath = join(stateDir, `.tmp-${randomBytes(6).toString("hex")}.json`);
+    writeFileSync(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+    renameSync(tmpPath, finalPath);
+}
+export function markSessionSent(state, sessionId, fileSize, contentHash) {
+    const record = { fileSize, sentAt: new Date().toISOString() };
+    if (contentHash !== undefined)
+        record.contentHash = contentHash;
+    return {
+        ...state,
+        sessions: {
+            ...state.sessions,
+            [sessionId]: record,
+        },
+    };
+}
+/** Merge operator snapshot into an existing state object before `writeState`. */
+export function withMcpOperator(state, operator) {
+    return { ...state, mcp_operator: operator };
+}

package/dist/sync.d.ts

@@ -0,0 +1,74 @@
+import type { TelemetryToolId, StoredCredentials } from "./auth/credentials.js";
+import { type PricingTable } from "./pricing.js";
+import type { PricingConfig } from "./readers/cursor.js";
+import { type ProjectResolution } from "./lib/index.js";
+import type { CursorDb90Payload } from "./readers/cursor.js";
+/** Prefix for Claude Code session keys in shared MCP state. */
+export declare const CLAUDE_STATE_PREFIX: "claude_code:";
+export { CURSOR_WATERMARK_KEY, CURSOR_EVENTS_WATERMARK_KEY, CURSOR_DAILY_STATS_WATERMARK_KEY, CURSOR_RECENT_COMMIT_WATERMARK_KEY, CURSOR_TRANSCRIPT_TURN_PREFIX, cursorTranscriptTurnStateKey, filterRecentCommitsByHashDedup, } from "./cursor-checkpoints.js";
+export declare function sessionStateKey(sessionId: string): string;
+export interface SyncResult {
+    sent: number;
+    failed: number;
+    skipped: number;
+    locked?: boolean;
+    errors?: string[];
+    rateLimitedUntil?: string | null;
+    validationFailed?: boolean;
+}
+/** Legacy Claude-only sync options (backward compatible with existing tests/tooling). */
+export interface SyncOptions {
+    token: string;
+    host: string;
+    dryRun: boolean;
+    verbose: boolean;
+    projectId: string | null;
+    projectIdSource?: ProjectResolution["source"];
+    pricing: PricingTable;
+    appDir?: string;
+    transcriptBaseDirs?: string[];
+    /**
+     * When set, only Claude turns whose `cwd` matches this directory (exact or
+     * subdirectory) are synced. All matching turns use `projectId` directly
+     * — no per-turn remote lookup. Turns from other directories are skipped.
+     * Typically set to `process.cwd()` so each MCP instance is scoped to the
+     * repo it was launched from.
+     */
+    scopeDir?: string;
+}
+export interface MultiSyncOptions {
+    credentials: StoredCredentials;
+    dryRun: boolean;
+    verbose: boolean;
+    projectId: string | null;
+    projectIdSource?: ProjectResolution["source"];
+    /** Token for GET /projects/lookup (defaults to cursor ingest token in cursor slice). */
+    projectLookupToken?: string | null;
+    pricing: PricingTable;
+    /** Cursor line-cost rates (defaults + optional ~/.aixle-insights/config.json overrides). */
+    cursorPricing?: PricingConfig;
+    appDir?: string;
+    transcriptBaseDirs?: string[];
+    /** Synthetic Cursor paths for Vitest isolation. Omit for real installs. */
+    cursorBaseDir?: string;
+    cursorTranscriptProjectDirs?: string[];
+    tools?: TelemetryToolId[];
+    /** See SyncOptions.scopeDir. */
+    scopeDir?: string;
+    /** Ignore watermarks and commit hash dedupe (pairs with `--dry-run` on CLI). */
+    fullScan?: boolean;
+}
+/** Clears in-memory rate-limit backoff (test hook). */
+export declare function resetBackoffStateForTests(): void;
+export declare function getSyncTelemetry(): {
+    lastSyncAt: string | null;
+    lastResult: SyncResult | null;
+    recentErrors: string[];
+};
+export declare function cursorRepoPathFromPayload(payload: CursorDb90Payload): string | undefined;
+/**
+ * Parallel multi-tool cycle under the global advisory ingest lock (`state.lock`).
+ */
+export declare function syncTelemetryTools(options: MultiSyncOptions): Promise<SyncResult>;
+/** Claude-only sync helper (delegates into `syncTelemetryTools`). */
+export declare function syncOnce(options: SyncOptions): Promise<SyncResult>;