@brainmcp/brainmcp 0.1.11 → 0.1.13

package/dist/runtime/capture.d.ts

@@ -0,0 +1,83 @@
+import { type CaptureTrigger, type PreferencesRecord } from '../lib/cli-contracts.js';
+/** Match the server digest body cap (`MCP_SESSION_DIGEST_MAX_BYTES`). */
+export declare const MAX_DIGEST_BYTES: number;
+export interface ProjectCaptureRestrictions {
+    captureDisabled: boolean;
+    promptsDisabled: boolean;
+}
+export declare function isStopEvent(event: string, stopHookActive?: boolean): boolean;
+export declare function captureTriggerForEvent(event: string): CaptureTrigger | null;
+/**
+ * Project `.brainmcp.json` may disable or further restrict capture; it can
+ * never enable capture or broaden captured fields (AHI-D02).
+ */
+export declare function readProjectCaptureRestrictions(startDir?: string): ProjectCaptureRestrictions;
+export declare function resolveCaptureWorkspaceId(prefs?: PreferencesRecord | null): string | null;
+/** An opaque project boundary for selecting a manual session without storing paths. */
+export declare function captureProjectKey(cwd: string): string;
+export interface DigestPayload {
+    clientDigestId: string;
+    trigger: CaptureTrigger;
+    workspaceId: string;
+    summary?: string;
+    relativePaths?: string[];
+    host?: string;
+    model?: string;
+    gitMetadata?: GitMetadata;
+    prompts?: string[];
+}
+export interface GitMetadata {
+    repository?: string;
+    branch?: string;
+    commit?: string;
+    diffStats?: {
+        filesChanged: number;
+        insertions: number;
+        deletions: number;
+    };
+}
+type GitRunner = (args: string[]) => string;
+/** Read only bounded Git labels/counts; never persist the repository root or changed paths. */
+export declare function collectGitMetadata(cwd?: string, runner?: GitRunner): GitMetadata | undefined;
+/**
+ * Normalizes and filters capture payload fields (AHI-073, AHI-074, AHI-075).
+ * Drops absolute/traversal paths, raw file contents, secrets, and prompts (unless opt-in enabled).
+ */
+export declare function buildDigestPayload(input: {
+    trigger: CaptureTrigger;
+    workspaceId: string;
+    summary?: string;
+    paths?: string[];
+    host?: string;
+    model?: string;
+    gitMetadata?: GitMetadata;
+    prompts?: string[];
+    includePrompts?: boolean;
+}): DigestPayload;
+/**
+ * Serializes payload to JSON and verifies it fits inside MAX_DIGEST_BYTES.
+ */
+export declare function serializeDigestPayload(payload: DigestPayload): string;
+/**
+ * Enables capture for the user (AHI-071, AHI-072).
+ */
+export declare function enableCapture(options?: {
+    baseDir?: string;
+    includePrompts?: boolean;
+    now?: number;
+    workspaceId?: string;
+}): PreferencesRecord;
+/**
+ * Disables capture and atomically cancels all pending automatic queue items (AHI-071).
+ * Re-enabling never resurrects cancelled items.
+ */
+export declare function disableCapture(options?: {
+    baseDir?: string;
+    now?: number;
+}): PreferencesRecord;
+/**
+ * Checks whether an event may be queued or sent (AHI-076).
+ * Stop events MUST NEVER queue or send digests.
+ */
+export declare function isCaptureEligible(event: string, prefs?: PreferencesRecord | null, projectPolicy?: ProjectCaptureRestrictions): boolean;
+export {};

package/dist/runtime/capture.js

@@ -0,0 +1,332 @@
+import crypto from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { PREFERENCES_SCHEMA_VERSION, scrubSecrets, } from '../lib/cli-contracts.js';
+import { readPreferences, writePreferences } from './storage.js';
+import { listQueueItems, updateQueueItem } from './queue.js';
+/** Match the server digest body cap (`MCP_SESSION_DIGEST_MAX_BYTES`). */
+export const MAX_DIGEST_BYTES = 14 * 1024;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const STOP_EVENTS = new Set(['Stop', 'StopNudge', 'stop', 'SessionStop', 'session_stop']);
+const CAPTURE_EVENTS = new Set([
+    'PreCompact',
+    'preCompact',
+    'pre_compact',
+    'precompact',
+    'SessionEnd',
+    'sessionEnd',
+    'session_end',
+    'manual',
+]);
+export function isStopEvent(event, stopHookActive) {
+    return stopHookActive === true || STOP_EVENTS.has(event);
+}
+export function captureTriggerForEvent(event) {
+    if (event === 'SessionEnd' || event === 'sessionEnd' || event === 'session_end')
+        return 'session_end';
+    if (event === 'PreCompact' || event === 'preCompact' || event === 'pre_compact' || event === 'precompact') {
+        return 'pre_compact';
+    }
+    if (event === 'manual')
+        return 'manual';
+    return null;
+}
+/**
+ * Project `.brainmcp.json` may disable or further restrict capture; it can
+ * never enable capture or broaden captured fields (AHI-D02).
+ */
+export function readProjectCaptureRestrictions(startDir) {
+    const result = { captureDisabled: false, promptsDisabled: false };
+    if (!startDir)
+        return result;
+    let dir = path.resolve(startDir);
+    for (let i = 0; i < 16; i += 1) {
+        const candidate = path.join(dir, '.brainmcp.json');
+        if (fs.lstatSync(candidate, { throwIfNoEntry: false })) {
+            try {
+                const stat = fs.lstatSync(candidate);
+                if (stat.isSymbolicLink() || !stat.isFile() || stat.size > 64 * 1024)
+                    return { captureDisabled: true, promptsDisabled: true };
+                const parsed = JSON.parse(fs.readFileSync(candidate, 'utf8'));
+                if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                    return { captureDisabled: true, promptsDisabled: true };
+                const consent = parsed.consent && typeof parsed.consent === 'object'
+                    ? parsed.consent
+                    : undefined;
+                if (parsed.capture === false ||
+                    parsed.captureEnabled === false ||
+                    consent?.captureEnabled === false) {
+                    result.captureDisabled = true;
+                }
+                if (parsed.includePrompts === false || consent?.includePrompts === false) {
+                    result.promptsDisabled = true;
+                }
+            }
+            catch {
+                return { captureDisabled: true, promptsDisabled: true };
+            }
+            return result;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return result;
+}
+export function resolveCaptureWorkspaceId(prefs) {
+    const candidate = prefs?.enabledWorkspaceId?.trim();
+    if (candidate && UUID_RE.test(candidate))
+        return candidate;
+    return null;
+}
+/** An opaque project boundary for selecting a manual session without storing paths. */
+export function captureProjectKey(cwd) {
+    let dir = fs.realpathSync(path.resolve(cwd));
+    const original = dir;
+    for (let i = 0; i < 32; i += 1) {
+        if (fs.existsSync(path.join(dir, '.git')) || fs.lstatSync(path.join(dir, '.brainmcp.json'), { throwIfNoEntry: false }))
+            break;
+        const parent = path.dirname(dir);
+        if (parent === dir) {
+            dir = original;
+            break;
+        }
+        dir = parent;
+    }
+    return crypto.createHash('sha256').update(dir).digest('hex');
+}
+/** Read only bounded Git labels/counts; never persist the repository root or changed paths. */
+export function collectGitMetadata(cwd, runner) {
+    if (!cwd)
+        return undefined;
+    const run = runner ?? ((args) => execFileSync('git', ['-C', cwd, ...args], {
+        encoding: 'utf8',
+        timeout: 125,
+        maxBuffer: 64 * 1024,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim());
+    const safely = (args) => {
+        try {
+            return run(args).trim();
+        }
+        catch {
+            return '';
+        }
+    };
+    const root = safely(['rev-parse', '--show-toplevel']);
+    if (!root)
+        return undefined;
+    const branch = safely(['branch', '--show-current']);
+    const commit = safely(['rev-parse', '--short=12', 'HEAD']);
+    const numstat = safely(['diff', '--numstat', 'HEAD']);
+    const changedFiles = safely(['status', '--porcelain=v1', '--untracked-files=no']);
+    let insertions = 0;
+    let deletions = 0;
+    for (const line of numstat.split('\n')) {
+        if (!line)
+            continue;
+        const [added, removed] = line.split('\t');
+        if (/^\d+$/.test(added ?? ''))
+            insertions += Number(added);
+        if (/^\d+$/.test(removed ?? ''))
+            deletions += Number(removed);
+    }
+    const filesChanged = changedFiles ? changedFiles.split('\n').filter(Boolean).length : 0;
+    return {
+        repository: path.basename(root),
+        branch: branch || undefined,
+        commit: commit || undefined,
+        diffStats: { filesChanged, insertions, deletions },
+    };
+}
+function truncateUtf8(value, maxBytes) {
+    let output = '';
+    let bytes = 0;
+    for (const character of value) {
+        const characterBytes = Buffer.byteLength(character, 'utf8');
+        if (bytes + characterBytes > maxBytes)
+            break;
+        output += character;
+        bytes += characterBytes;
+    }
+    return output;
+}
+/**
+ * Normalizes and filters capture payload fields (AHI-073, AHI-074, AHI-075).
+ * Drops absolute/traversal paths, raw file contents, secrets, and prompts (unless opt-in enabled).
+ */
+export function buildDigestPayload(input) {
+    const clientDigestId = crypto.randomUUID();
+    // Filter paths: relative only, no traversal (../), no absolute
+    const safePaths = [];
+    if (input.paths) {
+        for (const p of input.paths) {
+            if (typeof p !== 'string')
+                continue;
+            const normalized = path.normalize(p.trim());
+            if (path.isAbsolute(normalized))
+                continue;
+            if (normalized.startsWith('..') || normalized.includes('../') || normalized.includes('..\\'))
+                continue;
+            safePaths.push(truncateUtf8(scrubSecrets(normalized), 180));
+        }
+    }
+    // Include prompts only if explicitly opted in
+    const safePrompts = [];
+    if (input.includePrompts && input.prompts) {
+        for (const pr of input.prompts) {
+            if (typeof pr === 'string' && pr.trim()) {
+                safePrompts.push(truncateUtf8(scrubSecrets(pr), 800));
+            }
+        }
+    }
+    const payload = {
+        clientDigestId,
+        trigger: input.trigger,
+        workspaceId: input.workspaceId,
+        host: input.host ? truncateUtf8(scrubSecrets(input.host), 80) : undefined,
+        model: input.model ? truncateUtf8(scrubSecrets(input.model), 120) : undefined,
+        summary: input.summary ? truncateUtf8(scrubSecrets(input.summary), 4_000) : undefined,
+        relativePaths: safePaths.slice(0, 50),
+        gitMetadata: input.gitMetadata
+            ? {
+                branch: input.gitMetadata.branch
+                    ? truncateUtf8(scrubSecrets(input.gitMetadata.branch), 180)
+                    : undefined,
+                commit: input.gitMetadata.commit
+                    ? truncateUtf8(scrubSecrets(input.gitMetadata.commit), 180)
+                    : undefined,
+                repository: input.gitMetadata.repository
+                    ? truncateUtf8(scrubSecrets(input.gitMetadata.repository), 180)
+                    : undefined,
+                diffStats: input.gitMetadata.diffStats
+                    ? {
+                        filesChanged: Math.max(0, Math.min(100_000, Math.trunc(input.gitMetadata.diffStats.filesChanged))),
+                        insertions: Math.max(0, Math.min(10_000_000, Math.trunc(input.gitMetadata.diffStats.insertions))),
+                        deletions: Math.max(0, Math.min(10_000_000, Math.trunc(input.gitMetadata.diffStats.deletions))),
+                    }
+                    : undefined,
+            }
+            : undefined,
+        prompts: safePrompts.length > 0 ? safePrompts.slice(0, 10) : undefined,
+    };
+    // JSON escaping and multibyte text can expand independently of character counts.
+    while (Buffer.byteLength(JSON.stringify(payload), 'utf8') > MAX_DIGEST_BYTES) {
+        if (payload.prompts?.length) {
+            payload.prompts.pop();
+            if (payload.prompts.length === 0)
+                payload.prompts = undefined;
+            continue;
+        }
+        if (payload.relativePaths?.length) {
+            payload.relativePaths.pop();
+            if (payload.relativePaths.length === 0)
+                payload.relativePaths = undefined;
+            continue;
+        }
+        if (payload.summary) {
+            payload.summary = truncateUtf8(payload.summary, Math.max(0, Buffer.byteLength(payload.summary, 'utf8') - 512));
+            if (!payload.summary)
+                payload.summary = undefined;
+            continue;
+        }
+        payload.gitMetadata = undefined;
+        break;
+    }
+    return payload;
+}
+/**
+ * Serializes payload to JSON and verifies it fits inside MAX_DIGEST_BYTES.
+ */
+export function serializeDigestPayload(payload) {
+    const json = JSON.stringify(payload);
+    const bytes = Buffer.byteLength(json, 'utf8');
+    if (bytes > MAX_DIGEST_BYTES) {
+        throw new Error(`Digest payload exceeds max byte cap: ${bytes} > ${MAX_DIGEST_BYTES}`);
+    }
+    return json;
+}
+/**
+ * Enables capture for the user (AHI-071, AHI-072).
+ */
+export function enableCapture(options) {
+    const current = readPreferences(options?.baseDir) ?? {
+        version: PREFERENCES_SCHEMA_VERSION,
+        consent: {
+            captureEnabled: false,
+            includePrompts: false,
+            policyVersion: '2026-09-02.capture-v1',
+            revision: 0,
+        },
+    };
+    const workspaceId = options?.workspaceId?.trim();
+    const updated = {
+        ...current,
+        consent: {
+            ...current.consent,
+            captureEnabled: true,
+            includePrompts: Boolean(options?.includePrompts),
+            consentedAt: new Date(options?.now ?? Date.now()).toISOString(),
+            revision: (current.consent.revision ?? 0) + 1,
+        },
+        enabledWorkspaceId: workspaceId && UUID_RE.test(workspaceId) ? workspaceId : current.enabledWorkspaceId,
+    };
+    writePreferences(updated, options?.baseDir);
+    return updated;
+}
+/**
+ * Disables capture and atomically cancels all pending automatic queue items (AHI-071).
+ * Re-enabling never resurrects cancelled items.
+ */
+export function disableCapture(options) {
+    const current = readPreferences(options?.baseDir) ?? {
+        version: PREFERENCES_SCHEMA_VERSION,
+        consent: {
+            captureEnabled: false,
+            includePrompts: false,
+            policyVersion: '2026-09-02.capture-v1',
+            revision: 0,
+        },
+    };
+    const updated = {
+        ...current,
+        consent: {
+            ...current.consent,
+            captureEnabled: false,
+            includePrompts: false,
+            revision: (current.consent.revision ?? 0) + 1,
+        },
+    };
+    writePreferences(updated, options?.baseDir);
+    // Cancel only unsent automatic items. Manual items remain explicit user
+    // actions, and ambiguous in-flight deliveries retain their honest status.
+    const items = listQueueItems(options?.baseDir);
+    for (const item of items) {
+        if (item.captureTrigger !== 'manual' && item.status === 'pending') {
+            updateQueueItem(item.digestId, {
+                status: 'cancelled',
+                lastError: 'Capture disabled by user',
+            }, options?.baseDir);
+        }
+    }
+    return updated;
+}
+/**
+ * Checks whether an event may be queued or sent (AHI-076).
+ * Stop events MUST NEVER queue or send digests.
+ */
+export function isCaptureEligible(event, prefs, projectPolicy) {
+    if (isStopEvent(event)) {
+        return false;
+    }
+    if (projectPolicy?.captureDisabled) {
+        return false;
+    }
+    if (!prefs?.consent?.captureEnabled) {
+        return false;
+    }
+    return CAPTURE_EVENTS.has(event);
+}
+//# sourceMappingURL=capture.js.map

package/dist/runtime/capture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture.js","sourceRoot":"","sources":["../../src/runtime/capture.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,YAAY,GAGb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7D,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1C,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,aAAa;IACb,QAAQ;CACT,CAAC,CAAC;AAOH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,cAAwB;IACjE,OAAO,cAAc,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACtG,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QAC1G,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAiB;IAC9D,MAAM,MAAM,GAA+B,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IAC9F,IAAI,CAAC,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE7B,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACnD,IAAI,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;oBAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC9H,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAA4B,CAAC;gBACzF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;oBAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC5H,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;oBAClD,CAAC,CAAE,MAAM,CAAC,OAAmC;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBAChB,IACE,MAAM,CAAC,OAAO,KAAK,KAAK;oBACxB,MAAM,CAAC,cAAc,KAAK,KAAK;oBAC/B,OAAO,EAAE,cAAc,KAAK,KAAK,EACjC,CAAC;oBACD,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;gBAChC,CAAC;gBACD,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,IAAI,OAAO,EAAE,cAAc,KAAK,KAAK,EAAE,CAAC;oBACzE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;YAC1D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACxE,MAAM,SAAS,GAAG,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;YAAE,MAAM;QAC9H,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,QAAQ,CAAC;YAAC,MAAM;QAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AA2BD,+FAA+F;AAC/F,MAAM,UAAU,kBAAkB,CAAC,GAAY,EAAE,MAAkB;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAc,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE;QACpF,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,EAAE,GAAG,IAAI;QACpB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;KACpC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACX,MAAM,MAAM,GAAG,CAAC,IAAc,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAClF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC/B,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,MAAM,EAAE,MAAM,IAAI,SAAS;QAC3B,SAAS,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAgB;IACnD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,GAAG,cAAc,GAAG,QAAQ;YAAE,MAAM;QAC7C,MAAM,IAAI,SAAS,CAAC;QACpB,KAAK,IAAI,cAAc,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAUlC;IACC,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAE3C,+DAA+D;IAC/D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,SAAS;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,SAAS;YAC1C,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvG,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC1C,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACxC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAkB;QAC7B,cAAc;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC5B,CAAC,CAAC;gBACE,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;oBAC9B,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;oBAC3D,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;oBAC9B,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC;oBAC3D,CAAC,CAAC,SAAS;gBACb,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,UAAU;oBACtC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC;oBAC/D,CAAC,CAAC,SAAS;gBACb,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,SAAS;oBACpC,CAAC,CAAC;wBACE,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;wBAClG,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;wBACjG,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;qBAChG;oBACH,CAAC,CAAC,SAAS;aACd;YACH,CAAC,CAAC,SAAS;QACb,OAAO,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;IAEF,iFAAiF;IACjF,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;QAC7E,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YAClC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,YAAY,CAC5B,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAC9D,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAClD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;QAChC,MAAM;IACR,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsB;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,KAAK,GAAG,gBAAgB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,MAAM,gBAAgB,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI;QACnD,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE;YACP,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,uBAAuB;YACtC,QAAQ,EAAE,CAAC;SACZ;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAsB;QACjC,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,OAAO;YAClB,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC;YAChD,WAAW,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;YAC/D,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;SAC9C;QACD,kBAAkB,EAAE,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB;KACxG,CAAC;IAEF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4C;IACzE,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI;QACnD,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE;YACP,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,uBAAuB;YACtC,QAAQ,EAAE,CAAC;SACZ;KACF,CAAC;IAEF,MAAM,OAAO,GAAsB;QACjC,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,OAAO,CAAC,OAAO;YAClB,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,KAAK;YACrB,QAAQ,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;SAC9C;KACF,CAAC;IAEF,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAE5C,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClE,eAAe,CACb,IAAI,CAAC,QAAQ,EACb;gBACE,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,0BAA0B;aACtC,EACD,OAAO,EAAE,OAAO,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,KAAgC,EAChC,aAA0C;IAE1C,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,aAAa,EAAE,eAAe,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/runtime/diagnostics.d.ts

@@ -0,0 +1,7 @@
+import type { LogEntryRecord } from '../lib/cli-contracts.js';
+/**
+ * Recursively scrubs sensitive values from metadata objects (AHI-D04, AHI-D06).
+ */
+export declare function scrubMetadata(value: unknown): any;
+export declare function getLogsDir(baseDir?: string): string;
+export declare function logRuntimeEvent(level: LogEntryRecord['level'], event: string, metadata?: Record<string, unknown>, baseDir?: string): void;

package/dist/runtime/diagnostics.js

@@ -0,0 +1,75 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { ensureDirectory0700, assertNotSymlink, resolveStateDir } from './storage.js';
+const SENSITIVE_KEY_PATTERNS = [
+    /token/i,
+    /bearer/i,
+    /auth/i,
+    /secret/i,
+    /cookie/i,
+    /password/i,
+    /verifier/i,
+    /code/i,
+    /prompt/i,
+    /assistant/i,
+    /content/i,
+    /(api|secret|private|access|auth)key$/i,
+    /^key$/i,
+];
+/**
+ * Recursively scrubs sensitive values from metadata objects (AHI-D04, AHI-D06).
+ */
+export function scrubMetadata(value) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value !== 'object') {
+        if (typeof value === 'string') {
+            // Scrub potential token patterns
+            if (/bearer\s+[a-zA-Z0-9._-]+/i.test(value) || /brain_[a-zA-Z0-9_-]{20,}/i.test(value)) {
+                return '[REDACTED_TOKEN]';
+            }
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map(scrubMetadata);
+    }
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+        if (SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(k))) {
+            result[k] = '[REDACTED]';
+        }
+        else {
+            result[k] = scrubMetadata(v);
+        }
+    }
+    return result;
+}
+export function getLogsDir(baseDir) {
+    const logsDir = path.join(resolveStateDir(baseDir), 'logs');
+    ensureDirectory0700(logsDir);
+    return logsDir;
+}
+export function logRuntimeEvent(level, event, metadata, baseDir) {
+    try {
+        const logsDir = getLogsDir(baseDir);
+        const logFile = path.join(logsDir, 'runtime.log');
+        assertNotSymlink(logFile);
+        if (fs.existsSync(logFile) && fs.lstatSync(logFile).size >= 5 * 1024 * 1024) {
+            // Bound diagnostics even when capture is disabled and no ledger is pruned.
+            fs.truncateSync(logFile, 0);
+        }
+        const entry = {
+            timestamp: new Date().toISOString(),
+            level,
+            event,
+            metadata: metadata ? scrubMetadata(metadata) : undefined,
+        };
+        fs.appendFileSync(logFile, JSON.stringify(entry) + '\n', { mode: 0o600 });
+    }
+    catch {
+        // Logging failures fail open
+    }
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/runtime/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/runtime/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEtF,MAAM,sBAAsB,GAAG;IAC7B,QAAQ;IACR,SAAS;IACT,OAAO;IACP,SAAS;IACT,SAAS;IACT,WAAW;IACX,WAAW;IACX,OAAO;IACP,SAAS;IACT,YAAY;IACZ,UAAU;IACV,uCAAuC;IACvC,QAAQ;CACT,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,iCAAiC;YACjC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvF,OAAO,kBAAkB,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,KAA8B,EAC9B,KAAa,EACb,QAAkC,EAClC,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC5E,2EAA2E;YAC3E,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAmB;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SACzD,CAAC;QAEF,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;AACH,CAAC"}

package/dist/runtime/doctor-checks.d.ts

@@ -0,0 +1,14 @@
+import { type SecretVault } from '../lib/vault.js';
+export interface DoctorCheckResult {
+    name: string;
+    passed: boolean;
+    detail: string;
+    repairGuidance?: string;
+}
+export declare function checkCredentialHealth(baseDir?: string, options?: {
+    probeVault?: boolean;
+    vault?: SecretVault;
+}): Promise<DoctorCheckResult>;
+export declare function checkRuntimeDrift(expectedVersion?: string, baseDir?: string): DoctorCheckResult;
+export declare function checkConsentPreferences(baseDir?: string): DoctorCheckResult;
+export declare function checkQueueStatus(baseDir?: string): DoctorCheckResult;