@graphorin/cli 0.5.0

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":["getActiveSecretsStore","createSecretsStore"],"sources":["../../src/commands/auth.ts"],"sourcesContent":["/**\n * `graphorin auth` — outbound OAuth subsystem (e.g. for MCP servers).\n *\n * Surface (per Phase 15 § Auth):\n *\n *  - `graphorin auth login --server <url> [--device-flow]`\n *  - `graphorin auth list`\n *  - `graphorin auth refresh <id>`\n *  - `graphorin auth revoke <id>`\n *  - `graphorin auth status`\n *\n * Honours `GRAPHORIN_OFFLINE=1` — when set, every subcommand short-\n * circuits with an explanatory message and exits `1` so CI pipelines\n * see the failure.\n *\n * @packageDocumentation\n */\n\nimport {\n  getOAuthStatus,\n  type LoginInteractiveResult,\n  listOAuthSessions,\n  loginInteractive,\n  refreshOAuthSession,\n  revokeOAuthSession,\n} from '@graphorin/security';\nimport { createSecretsStore, getActiveSecretsStore } from '@graphorin/security/secrets';\nimport { EXIT_CODES } from '../internal/exit.js';\nimport { checkOfflineModeBlocked } from '../internal/offline.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\n/**\n * Resolve the CLI's secrets store for OAuth token persistence (SPL-1):\n * the already-active store when one exists, else the default auto\n * chain (keyring → encrypted-file → env). Best-effort — a store\n * failure degrades to the in-memory-only pre-SPL-1 behavior instead of\n * blocking the auth command.\n */\nasync function resolveAuthSecretsStore(): Promise<\n  import('@graphorin/core/contracts').SecretsStore | undefined\n> {\n  try {\n    return getActiveSecretsStore() ?? (await createSecretsStore({}));\n  } catch {\n    return undefined;\n  }\n}\n\n/** @stable */\nexport interface AuthCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/** @stable */\nexport interface AuthLoginOptions extends AuthCommonOptions {\n  readonly serverUrl: string;\n  readonly serverId?: string;\n  readonly scope?: string;\n  readonly deviceFlow?: boolean;\n  /**\n   * Optional pre-existing client identifier — skips Dynamic Client\n   * Registration when supplied.\n   */\n  readonly clientId?: string;\n}\n\n/** @stable */\nexport async function runAuthLogin(options: AuthLoginOptions): Promise<LoginInteractiveResult> {\n  if (\n    !checkOfflineModeBlocked('auth login', {\n      ...(options.print !== undefined ? { print: options.print } : {}),\n    })\n  ) {\n    process.exit(EXIT_CODES.RECOVERABLE_FAILURE);\n  }\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const serverId = options.serverId ?? deriveServerId(options.serverUrl);\n    const secretsStore = await resolveAuthSecretsStore();\n    const result = await loginInteractive({\n      serverId,\n      serverUrl: options.serverUrl,\n      storage: ctx.store.oauthServers,\n      ...(secretsStore === undefined ? {} : { secretsStore }),\n      ...(options.deviceFlow !== undefined ? { deviceFlow: options.deviceFlow } : {}),\n      ...(options.scope !== undefined ? { scope: options.scope } : {}),\n      ...(options.clientId !== undefined ? { clientId: options.clientId } : {}),\n    });\n    emitReport(options, result.status, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(brand(`oauth login ${statusMarker('ok')} (server=${result.status.serverId})`));\n      print(`  status: ${result.status.status}`);\n      print(`  expiresAt: ${result.status.expiresAt ?? '-'}`);\n    });\n    return result;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface AuthListOptions extends AuthCommonOptions {}\n\n/** @stable */\nexport async function runAuthList(options: AuthListOptions = {}) {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const secretsStore = await resolveAuthSecretsStore();\n    const list = await listOAuthSessions(ctx.store.oauthServers, {\n      ...(secretsStore === undefined ? {} : { secretsStore }),\n    });\n    emitReport(options, list, () => {\n      const print = options.print ?? defaultPrintSink;\n      if (list.length === 0) {\n        print(brand('no OAuth sessions persisted.'));\n        return;\n      }\n      print(brand(`${list.length} OAuth session(s):`));\n      for (const s of list) {\n        const mark = s.status === 'expired' ? statusMarker('warn') : statusMarker('ok');\n        print(`  ${mark} ${s.serverId} (status=${s.status}, scope=${s.scope ?? '-'})`);\n      }\n    });\n    return list;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface AuthRefreshOptions extends AuthCommonOptions {\n  readonly id: string;\n}\n\n/** @stable */\nexport async function runAuthRefresh(options: AuthRefreshOptions) {\n  if (\n    !checkOfflineModeBlocked('auth refresh', {\n      ...(options.print !== undefined ? { print: options.print } : {}),\n    })\n  ) {\n    process.exit(EXIT_CODES.RECOVERABLE_FAILURE);\n  }\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const secretsStore = await resolveAuthSecretsStore();\n    const session = await refreshOAuthSession(ctx.store.oauthServers, options.id, {\n      ...(secretsStore === undefined ? {} : { secretsStore }),\n    });\n    emitReport(options, { ok: true, id: options.id }, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          `oauth session '${options.id}' refreshed (expiresAt=${new Date(session.expiresAt ?? Date.now()).toISOString()})`,\n        ),\n      );\n    });\n    return session;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface AuthRevokeOptions extends AuthCommonOptions {\n  readonly id: string;\n  readonly reason?: string;\n}\n\n/** @stable */\nexport async function runAuthRevoke(options: AuthRevokeOptions): Promise<{ readonly ok: true }> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const secretsStore = await resolveAuthSecretsStore();\n    await revokeOAuthSession(ctx.store.oauthServers, options.id, {\n      ...(secretsStore === undefined ? {} : { secretsStore }),\n      ...(options.reason !== undefined ? { reason: options.reason } : {}),\n    });\n    emitReport(options, { ok: true } as const, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(brand(`oauth session '${options.id}' revoked.`));\n    });\n    return { ok: true };\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport async function runAuthStatus(options: AuthCommonOptions = {}) {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const secretsStore = await resolveAuthSecretsStore();\n    const status = await getOAuthStatus(ctx.store.oauthServers, {\n      ...(secretsStore === undefined ? {} : { secretsStore }),\n    });\n    emitReport(options, status, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          `oauth subsystem status: ${status.sessions.length} session(s), ${status.providers.length} strategy(ies)`,\n        ),\n      );\n      if (status.defaultStrategy !== null) {\n        print(brand(`default strategy: ${status.defaultStrategy.id}`));\n      }\n    });\n    return status;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction deriveServerId(serverUrl: string): string {\n  try {\n    const u = new URL(serverUrl);\n    return u.host;\n  } catch {\n    return serverUrl;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,eAAe,0BAEb;AACA,KAAI;AACF,SAAOA,yBAAuB,IAAK,MAAMC,qBAAmB,EAAE,CAAC;SACzD;AACN;;;;AAuBJ,eAAsB,aAAa,SAA4D;AAC7F,KACE,CAAC,wBAAwB,cAAc,EACrC,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,EAAE,EAChE,CAAC,CAEF,SAAQ,KAAK,WAAW,oBAAoB;CAE9C,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,WAAW,QAAQ,YAAY,eAAe,QAAQ,UAAU;EACtE,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,SAAS,MAAM,iBAAiB;GACpC;GACA,WAAW,QAAQ;GACnB,SAAS,IAAI,MAAM;GACnB,GAAI,iBAAiB,SAAY,EAAE,GAAG,EAAE,cAAc;GACtD,GAAI,QAAQ,eAAe,SAAY,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;GAC9E,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,EAAE;GAC/D,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,UAAU,GAAG,EAAE;GACzE,CAAC;AACF,aAAW,SAAS,OAAO,cAAc;GACvC,MAAM,QAAQ,QAAQ,SAAS;AAC/B,SAAM,MAAM,eAAe,aAAa,KAAK,CAAC,WAAW,OAAO,OAAO,SAAS,GAAG,CAAC;AACpF,SAAM,aAAa,OAAO,OAAO,SAAS;AAC1C,SAAM,gBAAgB,OAAO,OAAO,aAAa,MAAM;IACvD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAQrB,eAAsB,YAAY,UAA2B,EAAE,EAAE;CAC/D,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,OAAO,MAAM,kBAAkB,IAAI,MAAM,cAAc,EAC3D,GAAI,iBAAiB,SAAY,EAAE,GAAG,EAAE,cAAc,EACvD,CAAC;AACF,aAAW,SAAS,YAAY;GAC9B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OAAI,KAAK,WAAW,GAAG;AACrB,UAAM,MAAM,+BAA+B,CAAC;AAC5C;;AAEF,SAAM,MAAM,GAAG,KAAK,OAAO,oBAAoB,CAAC;AAChD,QAAK,MAAM,KAAK,KAEd,OAAM,KADO,EAAE,WAAW,YAAY,aAAa,OAAO,GAAG,aAAa,KAAK,CAC/D,GAAG,EAAE,SAAS,WAAW,EAAE,OAAO,UAAU,EAAE,SAAS,IAAI,GAAG;IAEhF;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,eAAe,SAA6B;AAChE,KACE,CAAC,wBAAwB,gBAAgB,EACvC,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,QAAQ,OAAO,GAAG,EAAE,EAChE,CAAC,CAEF,SAAQ,KAAK,WAAW,oBAAoB;CAE9C,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,UAAU,MAAM,oBAAoB,IAAI,MAAM,cAAc,QAAQ,IAAI,EAC5E,GAAI,iBAAiB,SAAY,EAAE,GAAG,EAAE,cAAc,EACvD,CAAC;AACF,aAAW,SAAS;GAAE,IAAI;GAAM,IAAI,QAAQ;GAAI,QAAQ;AAEtD,IADc,QAAQ,SAAS,kBAE7B,MACE,kBAAkB,QAAQ,GAAG,yBAAyB,IAAI,KAAK,QAAQ,aAAa,KAAK,KAAK,CAAC,CAAC,aAAa,CAAC,GAC/G,CACF;IACD;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAWrB,eAAsB,cAAc,SAA4D;CAC9F,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,eAAe,MAAM,yBAAyB;AACpD,QAAM,mBAAmB,IAAI,MAAM,cAAc,QAAQ,IAAI;GAC3D,GAAI,iBAAiB,SAAY,EAAE,GAAG,EAAE,cAAc;GACtD,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE;GACnE,CAAC;AACF,aAAW,SAAS,EAAE,IAAI,MAAM,QAAiB;AAE/C,IADc,QAAQ,SAAS,kBACzB,MAAM,kBAAkB,QAAQ,GAAG,YAAY,CAAC;IACtD;AACF,SAAO,EAAE,IAAI,MAAM;WACX;AACR,QAAM,IAAI,OAAO;;;;AAKrB,eAAsB,cAAc,UAA6B,EAAE,EAAE;CACnE,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,eAAe,MAAM,yBAAyB;EACpD,MAAM,SAAS,MAAM,eAAe,IAAI,MAAM,cAAc,EAC1D,GAAI,iBAAiB,SAAY,EAAE,GAAG,EAAE,cAAc,EACvD,CAAC;AACF,aAAW,SAAS,cAAc;GAChC,MAAM,QAAQ,QAAQ,SAAS;AAC/B,SACE,MACE,2BAA2B,OAAO,SAAS,OAAO,eAAe,OAAO,UAAU,OAAO,gBAC1F,CACF;AACD,OAAI,OAAO,oBAAoB,KAC7B,OAAM,MAAM,qBAAqB,OAAO,gBAAgB,KAAK,CAAC;IAEhE;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,eAAe,WAA2B;AACjD,KAAI;AAEF,SADU,IAAI,IAAI,UAAU,CACnB;SACH;AACN,SAAO"}

package/dist/commands/consolidator.d.ts

@@ -0,0 +1,49 @@
+import { CommonOutputOptions } from "../internal/output.js";
+import { ConsolidatorTier } from "@graphorin/memory";
+
+//#region src/commands/consolidator.d.ts
+
+/** @stable */
+interface ConsolidatorCommonOptions extends CommonOutputOptions {
+  readonly config?: string;
+}
+/** @stable */
+interface ConsolidatorStatusResult {
+  readonly tierHint?: ConsolidatorTier;
+  readonly recentRuns: number;
+  readonly successfulRuns: number;
+  readonly failedRuns: number;
+  readonly dlqSize: number;
+  readonly pendingConflicts: number;
+  readonly lastRunAt?: string;
+  readonly lastRunStatus?: string;
+}
+/** @stable */
+declare function runConsolidatorStatus(options?: ConsolidatorCommonOptions): Promise<ConsolidatorStatusResult>;
+/** @stable */
+interface ConsolidatorSetTierOptions extends ConsolidatorCommonOptions {
+  readonly tier: ConsolidatorTier;
+}
+/** @stable */
+declare function runConsolidatorSetTier(options: ConsolidatorSetTierOptions): Promise<{
+  readonly tier: ConsolidatorTier;
+  readonly applied: false;
+  readonly unsupported: true;
+}>;
+/** @stable */
+interface ConsolidatorStopOptions extends ConsolidatorCommonOptions {}
+/** @stable */
+declare function runConsolidatorStop(options?: ConsolidatorStopOptions): Promise<{
+  readonly stopped: false;
+  readonly unsupported: true;
+}>;
+/**
+ * Exit code emitted when a tier value fails validation. Re-exported
+ * so the binary can surface the same code to downstream callers.
+ *
+ * @stable
+ */
+declare const CONSOLIDATOR_INVALID_TIER_EXIT: 1;
+//#endregion
+export { CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop };
+//# sourceMappingURL=consolidator.d.ts.map

package/dist/commands/consolidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consolidator.d.ts","names":[],"sources":["../../src/commands/consolidator.ts"],"sourcesContent":[],"mappings":";;;;;;UA8CiB,yBAAA,SAAkC;;;;UAKlC,wBAAA;sBACK;;;;;;;;;;iBAWA,qBAAA,WACX,4BACR,QAAQ;;UA6DM,0BAAA,SAAmC;iBACnC;;;iBAIK,sBAAA,UAAgC,6BAA6B;iBAClE;;;;;UAmCA,uBAAA,SAAgC;;iBAG3B,mBAAA,WACX,0BACR;;;;;;;;;;cAuCU"}

package/dist/commands/consolidator.js

@@ -0,0 +1,97 @@
+import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
+import { EXIT_CODES } from "../internal/exit.js";
+import { openStoreContext } from "../internal/store-context.js";
+
+//#region src/commands/consolidator.ts
+const VALID_TIERS = Object.freeze([
+	"free",
+	"cheap",
+	"standard",
+	"full",
+	"custom"
+]);
+/** @stable */
+async function runConsolidatorStatus(options = {}) {
+	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	try {
+		const conn = ctx.store.connection;
+		const recent = conn.get("SELECT COUNT(*) AS n FROM consolidator_runs WHERE started_at > ?", [Date.now() - 1440 * 6e4]);
+		const success = conn.get("SELECT COUNT(*) AS n FROM consolidator_runs WHERE status = 'completed' AND started_at > ?", [Date.now() - 1440 * 6e4]);
+		const failed = conn.get("SELECT COUNT(*) AS n FROM consolidator_runs WHERE status = 'failed' AND started_at > ?", [Date.now() - 1440 * 6e4]);
+		const dlq = conn.get("SELECT COUNT(*) AS n FROM consolidator_failed_batches");
+		const pending = conn.get("SELECT COUNT(*) AS n FROM conflict_check_pending WHERE resolved_at IS NULL");
+		const last = conn.get("SELECT started_at, status FROM consolidator_runs ORDER BY started_at DESC LIMIT 1");
+		const out = Object.freeze({
+			recentRuns: recent?.n ?? 0,
+			successfulRuns: success?.n ?? 0,
+			failedRuns: failed?.n ?? 0,
+			dlqSize: dlq?.n ?? 0,
+			pendingConflicts: pending?.n ?? 0,
+			...last !== void 0 ? { lastRunAt: new Date(last.started_at).toISOString() } : {},
+			...last !== void 0 ? { lastRunStatus: last.status } : {}
+		});
+		emitReport(options, out, () => {
+			const print = options.print ?? defaultPrintSink;
+			print(brand(`consolidator status (tier hint: ${out.tierHint ?? "<from running config>"})`));
+			print(`  ${statusMarker("ok")} runs in last 24h: ${out.recentRuns} (${out.successfulRuns} success, ${out.failedRuns} error)`);
+			print(`  ${statusMarker(out.dlqSize > 0 ? "warn" : "ok")} dead-letter queue: ${out.dlqSize}`);
+			print(`  ${statusMarker(out.pendingConflicts > 0 ? "warn" : "ok")} pending CONFLICT-CHECK runs: ${out.pendingConflicts}`);
+			if (out.lastRunAt !== void 0) print(`  last run: ${out.lastRunAt} (${out.lastRunStatus})`);
+		});
+		return out;
+	} finally {
+		await ctx.close();
+	}
+}
+/** @stable */
+async function runConsolidatorSetTier(options) {
+	if (!isTier(options.tier)) throw new Error(`[graphorin/cli] invalid tier '${String(options.tier)}'. Allowed: ${VALID_TIERS.join(" | ")}.`);
+	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	try {
+		const result = {
+			tier: options.tier,
+			applied: false,
+			unsupported: true
+		};
+		emitReport(options, result, () => {
+			(options.print ?? defaultPrintSink)(brand(`runtime tier switching is not wired yet — set the tier in the server config (consolidator.tier: '${options.tier}') and restart, or use the server API when available.`));
+		});
+		process.exitCode = EXIT_CODES.UNSUPPORTED;
+		return result;
+	} finally {
+		await ctx.close();
+	}
+}
+/** @stable */
+async function runConsolidatorStop(options = {}) {
+	const ctx = await openStoreContext({ ...options.config !== void 0 ? { config: options.config } : {} });
+	try {
+		const result = {
+			stopped: false,
+			unsupported: true
+		};
+		emitReport(options, result, () => {
+			const print = options.print ?? defaultPrintSink;
+			print(brand("a CLI stop channel is not wired yet — to stop consolidation NOW, stop the server process (the consolidator runs inside it)."));
+			print(brand("To stay stopped across restarts set consolidator.tier to a zero-budget tier in the config."));
+		});
+		process.exitCode = EXIT_CODES.UNSUPPORTED;
+		return result;
+	} finally {
+		await ctx.close();
+	}
+}
+function isTier(value) {
+	return typeof value === "string" && VALID_TIERS.includes(value);
+}
+/**
+* Exit code emitted when a tier value fails validation. Re-exported
+* so the binary can surface the same code to downstream callers.
+*
+* @stable
+*/
+const CONSOLIDATOR_INVALID_TIER_EXIT = EXIT_CODES.RECOVERABLE_FAILURE;
+
+//#endregion
+export { CONSOLIDATOR_INVALID_TIER_EXIT, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop };
+//# sourceMappingURL=consolidator.js.map

package/dist/commands/consolidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consolidator.js","names":["VALID_TIERS: ReadonlyArray<ConsolidatorTier>","out: ConsolidatorStatusResult"],"sources":["../../src/commands/consolidator.ts"],"sourcesContent":["/**\n * `graphorin consolidator` — inspect and steer the background memory\n * consolidation pipeline.\n *\n * Surface (per Phase 15 § Consolidator):\n *\n *  - `graphorin consolidator status` — current tier + pending CONFLICT-\n *    CHECK runs + DLQ size + recent run history.\n *  - `graphorin consolidator set-tier <free|cheap|standard|enterprise>`\n *    — persist the requested tier so the next process startup picks it\n *    up.\n *  - `graphorin consolidator stop` — pause the consolidator until the\n *    operator resumes it (next `graphorin start`).\n *\n * The consolidator runs **inside** the server process, so the CLI\n * cannot direct-control a live in-memory instance from a different\n * process. `status` reads the SQLite tables the running consolidator\n * writes to (`consolidator_state`, `consolidator_runs`,\n * `consolidator_failed_batches`, `conflict_check_pending`); `set-tier`\n * and `stop` honestly report UNSUPPORTED until a daemon-side control\n * channel exists (IP-4) — nothing polls an admin table.\n *\n * @packageDocumentation\n */\n\nimport type { ConsolidatorTier } from '@graphorin/memory';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\nimport { openStoreContext } from '../internal/store-context.js';\n\nconst VALID_TIERS: ReadonlyArray<ConsolidatorTier> = Object.freeze([\n  'free',\n  'cheap',\n  'standard',\n  'full',\n  'custom',\n] as const);\n\n/** @stable */\nexport interface ConsolidatorCommonOptions extends CommonOutputOptions {\n  readonly config?: string;\n}\n\n/** @stable */\nexport interface ConsolidatorStatusResult {\n  readonly tierHint?: ConsolidatorTier;\n  readonly recentRuns: number;\n  readonly successfulRuns: number;\n  readonly failedRuns: number;\n  readonly dlqSize: number;\n  readonly pendingConflicts: number;\n  readonly lastRunAt?: string;\n  readonly lastRunStatus?: string;\n}\n\n/** @stable */\nexport async function runConsolidatorStatus(\n  options: ConsolidatorCommonOptions = {},\n): Promise<ConsolidatorStatusResult> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    const conn = ctx.store.connection;\n    const recent = conn.get<{ n: number }>(\n      'SELECT COUNT(*) AS n FROM consolidator_runs WHERE started_at > ?',\n      [Date.now() - 24 * 60 * 60_000],\n    );\n    // MCON-5: the store writes 'running' | 'completed' | 'failed' |\n    // 'partial' | 'deferred' (consolidator-store.ts) — the old queries\n    // asked for 'success'/'error'/'pending' and always returned 0.\n    const success = conn.get<{ n: number }>(\n      \"SELECT COUNT(*) AS n FROM consolidator_runs WHERE status = 'completed' AND started_at > ?\",\n      [Date.now() - 24 * 60 * 60_000],\n    );\n    const failed = conn.get<{ n: number }>(\n      \"SELECT COUNT(*) AS n FROM consolidator_runs WHERE status = 'failed' AND started_at > ?\",\n      [Date.now() - 24 * 60 * 60_000],\n    );\n    const dlq = conn.get<{ n: number }>('SELECT COUNT(*) AS n FROM consolidator_failed_batches');\n    // Pending conflict work lives in conflict_check_pending, not in\n    // consolidator_runs ('pending' was never a run status).\n    const pending = conn.get<{ n: number }>(\n      'SELECT COUNT(*) AS n FROM conflict_check_pending WHERE resolved_at IS NULL',\n    );\n    const last = conn.get<{ started_at: number; status: string }>(\n      'SELECT started_at, status FROM consolidator_runs ORDER BY started_at DESC LIMIT 1',\n    );\n    const out: ConsolidatorStatusResult = Object.freeze({\n      recentRuns: recent?.n ?? 0,\n      successfulRuns: success?.n ?? 0,\n      failedRuns: failed?.n ?? 0,\n      dlqSize: dlq?.n ?? 0,\n      pendingConflicts: pending?.n ?? 0,\n      ...(last !== undefined ? { lastRunAt: new Date(last.started_at).toISOString() } : {}),\n      ...(last !== undefined ? { lastRunStatus: last.status } : {}),\n    });\n    emitReport(options, out, () => {\n      const print = options.print ?? defaultPrintSink;\n      const tier = out.tierHint ?? '<from running config>';\n      print(brand(`consolidator status (tier hint: ${tier})`));\n      print(\n        `  ${statusMarker('ok')} runs in last 24h: ${out.recentRuns} (${out.successfulRuns} success, ${out.failedRuns} error)`,\n      );\n      print(`  ${statusMarker(out.dlqSize > 0 ? 'warn' : 'ok')} dead-letter queue: ${out.dlqSize}`);\n      print(\n        `  ${statusMarker(out.pendingConflicts > 0 ? 'warn' : 'ok')} pending CONFLICT-CHECK runs: ${out.pendingConflicts}`,\n      );\n      if (out.lastRunAt !== undefined) {\n        print(`  last run: ${out.lastRunAt} (${out.lastRunStatus})`);\n      }\n    });\n    return out;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface ConsolidatorSetTierOptions extends ConsolidatorCommonOptions {\n  readonly tier: ConsolidatorTier;\n}\n\n/** @stable */\nexport async function runConsolidatorSetTier(options: ConsolidatorSetTierOptions): Promise<{\n  readonly tier: ConsolidatorTier;\n  readonly applied: false;\n  readonly unsupported: true;\n}> {\n  if (!isTier(options.tier)) {\n    throw new Error(\n      `[graphorin/cli] invalid tier '${String(options.tier)}'. Allowed: ${VALID_TIERS.join(' | ')}.`,\n    );\n  }\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    // IP-4: the old implementation upserted a `consolidator_admin` row\n    // NOTHING polls (neither the daemon nor process startup reads it —\n    // createConsolidator takes the tier from opts) and reported\n    // success. Honest answer until a daemon-side control channel\n    // exists: UNSUPPORTED with the working alternative.\n    const result = { tier: options.tier, applied: false, unsupported: true } as const;\n    emitReport(options, result, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          `runtime tier switching is not wired yet — set the tier in the server config (consolidator.tier: '${options.tier}') and restart, or use the server API when available.`,\n        ),\n      );\n    });\n    process.exitCode = EXIT_CODES.UNSUPPORTED;\n    return result;\n  } finally {\n    await ctx.close();\n  }\n}\n\n/** @stable */\nexport interface ConsolidatorStopOptions extends ConsolidatorCommonOptions {}\n\n/** @stable */\nexport async function runConsolidatorStop(\n  options: ConsolidatorStopOptions = {},\n): Promise<{ readonly stopped: false; readonly unsupported: true }> {\n  const ctx = await openStoreContext({\n    ...(options.config !== undefined ? { config: options.config } : {}),\n  });\n  try {\n    // IP-4: the old implementation persisted a pause flag NOTHING\n    // honoured and told the operator the daemon would stop — the worst\n    // possible lie when someone is trying to stop runaway LLM spend.\n    const result = { stopped: false, unsupported: true } as const;\n    emitReport(options, result, () => {\n      const print = options.print ?? defaultPrintSink;\n      print(\n        brand(\n          'a CLI stop channel is not wired yet — to stop consolidation NOW, stop the server process (the consolidator runs inside it).',\n        ),\n      );\n      print(\n        brand(\n          'To stay stopped across restarts set consolidator.tier to a zero-budget tier in the config.',\n        ),\n      );\n    });\n    process.exitCode = EXIT_CODES.UNSUPPORTED;\n    return result;\n  } finally {\n    await ctx.close();\n  }\n}\n\nfunction isTier(value: unknown): value is ConsolidatorTier {\n  return typeof value === 'string' && (VALID_TIERS as ReadonlyArray<string>).includes(value);\n}\n\n/**\n * Exit code emitted when a tier value fails validation. Re-exported\n * so the binary can surface the same code to downstream callers.\n *\n * @stable\n */\nexport const CONSOLIDATOR_INVALID_TIER_EXIT = EXIT_CODES.RECOVERABLE_FAILURE;\n"],"mappings":";;;;;AAqCA,MAAMA,cAA+C,OAAO,OAAO;CACjE;CACA;CACA;CACA;CACA;CACD,CAAU;;AAoBX,eAAsB,sBACpB,UAAqC,EAAE,EACJ;CACnC,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EACF,MAAM,OAAO,IAAI,MAAM;EACvB,MAAM,SAAS,KAAK,IAClB,oEACA,CAAC,KAAK,KAAK,GAAG,OAAU,IAAO,CAChC;EAID,MAAM,UAAU,KAAK,IACnB,6FACA,CAAC,KAAK,KAAK,GAAG,OAAU,IAAO,CAChC;EACD,MAAM,SAAS,KAAK,IAClB,0FACA,CAAC,KAAK,KAAK,GAAG,OAAU,IAAO,CAChC;EACD,MAAM,MAAM,KAAK,IAAmB,wDAAwD;EAG5F,MAAM,UAAU,KAAK,IACnB,6EACD;EACD,MAAM,OAAO,KAAK,IAChB,oFACD;EACD,MAAMC,MAAgC,OAAO,OAAO;GAClD,YAAY,QAAQ,KAAK;GACzB,gBAAgB,SAAS,KAAK;GAC9B,YAAY,QAAQ,KAAK;GACzB,SAAS,KAAK,KAAK;GACnB,kBAAkB,SAAS,KAAK;GAChC,GAAI,SAAS,SAAY,EAAE,WAAW,IAAI,KAAK,KAAK,WAAW,CAAC,aAAa,EAAE,GAAG,EAAE;GACpF,GAAI,SAAS,SAAY,EAAE,eAAe,KAAK,QAAQ,GAAG,EAAE;GAC7D,CAAC;AACF,aAAW,SAAS,WAAW;GAC7B,MAAM,QAAQ,QAAQ,SAAS;AAE/B,SAAM,MAAM,mCADC,IAAI,YAAY,wBACuB,GAAG,CAAC;AACxD,SACE,KAAK,aAAa,KAAK,CAAC,qBAAqB,IAAI,WAAW,IAAI,IAAI,eAAe,YAAY,IAAI,WAAW,SAC/G;AACD,SAAM,KAAK,aAAa,IAAI,UAAU,IAAI,SAAS,KAAK,CAAC,sBAAsB,IAAI,UAAU;AAC7F,SACE,KAAK,aAAa,IAAI,mBAAmB,IAAI,SAAS,KAAK,CAAC,gCAAgC,IAAI,mBACjG;AACD,OAAI,IAAI,cAAc,OACpB,OAAM,eAAe,IAAI,UAAU,IAAI,IAAI,cAAc,GAAG;IAE9D;AACF,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAUrB,eAAsB,uBAAuB,SAI1C;AACD,KAAI,CAAC,OAAO,QAAQ,KAAK,CACvB,OAAM,IAAI,MACR,iCAAiC,OAAO,QAAQ,KAAK,CAAC,cAAc,YAAY,KAAK,MAAM,CAAC,GAC7F;CAEH,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EAMF,MAAM,SAAS;GAAE,MAAM,QAAQ;GAAM,SAAS;GAAO,aAAa;GAAM;AACxE,aAAW,SAAS,cAAc;AAEhC,IADc,QAAQ,SAAS,kBAE7B,MACE,oGAAoG,QAAQ,KAAK,uDAClH,CACF;IACD;AACF,UAAQ,WAAW,WAAW;AAC9B,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;;AAQrB,eAAsB,oBACpB,UAAmC,EAAE,EAC6B;CAClE,MAAM,MAAM,MAAM,iBAAiB,EACjC,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,QAAQ,GAAG,EAAE,EACnE,CAAC;AACF,KAAI;EAIF,MAAM,SAAS;GAAE,SAAS;GAAO,aAAa;GAAM;AACpD,aAAW,SAAS,cAAc;GAChC,MAAM,QAAQ,QAAQ,SAAS;AAC/B,SACE,MACE,8HACD,CACF;AACD,SACE,MACE,6FACD,CACF;IACD;AACF,UAAQ,WAAW,WAAW;AAC9B,SAAO;WACC;AACR,QAAM,IAAI,OAAO;;;AAIrB,SAAS,OAAO,OAA2C;AACzD,QAAO,OAAO,UAAU,YAAa,YAAsC,SAAS,MAAM;;;;;;;;AAS5F,MAAa,iCAAiC,WAAW"}

package/dist/commands/doctor.d.ts

@@ -0,0 +1,64 @@
+import { CommonOutputOptions } from "../internal/output.js";
+import { CheckResult } from "@graphorin/security";
+
+//#region src/commands/doctor.d.ts
+
+/**
+ * @stable
+ */
+interface DoctorCommandOptions extends CommonOutputOptions {
+  /**
+   * Override the directory the doctor checks. Defaults to
+   * `~/.graphorin/`. Tests inject a fresh tmp dir.
+   */
+  readonly home?: string;
+  /** Run the file-perms repair. */
+  readonly fixPerms?: boolean;
+  /** Run the file-perms check. Implied by `--all`. */
+  readonly checkPerms?: boolean;
+  /** Run the secrets-store check. */
+  readonly checkSecrets?: boolean;
+  /** Run the audit-encryption check. */
+  readonly checkEncryption?: boolean;
+  /** Run the systemd check. Linux-only. */
+  readonly checkSystemd?: boolean;
+  /** Optional systemd unit identifier (default `graphorin.service`). */
+  readonly systemdUnit?: string;
+  /** Run every check. Equivalent to passing every `--check-*` flag. */
+  readonly all?: boolean;
+  /** Test seam — supply a custom systemd executor. */
+  readonly systemdRun?: (cmd: string) => Promise<string>;
+}
+/**
+ * @stable
+ */
+interface DoctorReport {
+  readonly version: string;
+  readonly home: string;
+  readonly platform: NodeJS.Platform;
+  readonly checks: ReadonlyArray<CheckResult>;
+  readonly summary: {
+    readonly ok: number;
+    readonly warn: number;
+    readonly fail: number;
+    readonly skip: number;
+  };
+  readonly fixedPerms?: ReadonlyArray<string>;
+}
+/**
+ * Programmatic entry point. Returns the {@link DoctorReport} so tests
+ * and downstream automations consume the structured payload directly.
+ *
+ * @stable
+ */
+declare function runDoctor(options?: DoctorCommandOptions): Promise<DoctorReport>;
+/**
+ * Default expected file modes per the project's process-hardening
+ * policy (DEC-135).
+ *
+ * @internal
+ */
+declare function expectedFileModes(home: string): Readonly<Record<string, number>>;
+//#endregion
+export { DoctorCommandOptions, DoctorReport, expectedFileModes, runDoctor };
+//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","names":[],"sources":["../../src/commands/doctor.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAkDiB,oBAAA,SAA6B;;;;;;;;;;;;;;;;;;;;;yCAqBL;;;;;UAMxB,YAAA;;;qBAGI,MAAA,CAAO;mBACT,cAAc;;;;;;;wBAOT;;;;;;;;iBASF,SAAA,WAAmB,uBAA4B,QAAQ;;;;;;;iBA4F7D,iBAAA,gBAAiC,SAAS"}

package/dist/commands/doctor.js

@@ -0,0 +1,150 @@
+import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
+import { EXIT_CODES } from "../internal/exit.js";
+import { join } from "node:path";
+import process from "node:process";
+import { checkEncryption, checkPerms, checkSecrets, checkSystemd, ensureDirMode, ensureFileMode } from "@graphorin/security";
+import { homedir } from "node:os";
+
+//#region src/commands/doctor.ts
+/**
+* `graphorin doctor` — host health check.
+*
+* Wraps the read-only library helpers in `@graphorin/security/hardening`
+* (`checkPerms`, `checkSecrets`, `checkEncryption`, `checkSystemd`)
+* with `--fix-perms` repair, `--all` aggregation, JSON output for CI
+* pipelines, and exit-code semantics:
+*
+*  - exit `0` — every check passed (`fail` count is `0`).
+*  - exit `1` — at least one check returned `'fail'`.
+*  - exit `2` — invocation could not even start (e.g. config missing
+*    when `--check-secrets` requires the bootstrapped store).
+*
+* The doctor never writes to disk unless `--fix-perms` is supplied.
+* When repair is requested the CLI calls `ensureFileMode(...)` /
+* `ensureDirMode(...)` from `@graphorin/security/hardening` and re-runs
+* the perms check so the report reflects the post-fix state.
+*
+* Source-of-truth: process-hardening + `graphorin doctor` policy
+* (DEC-135).
+*
+* @packageDocumentation
+*/
+/**
+* Programmatic entry point. Returns the {@link DoctorReport} so tests
+* and downstream automations consume the structured payload directly.
+*
+* @stable
+*/
+async function runDoctor(options = {}) {
+	const home = options.home ?? join(homedir(), ".graphorin");
+	const expected = expectedFileModes(home);
+	const enable = expandFlags(options);
+	const checks = [];
+	const fixed = [];
+	if (enable.perms) if (options.fixPerms === true) {
+		const before = await checkPerms({ expected });
+		for (const result of before) if (result.status === "fail" && expected[result.check] !== void 0) {
+			const mode = expected[result.check];
+			try {
+				if (mode === 448) await ensureDirMode(result.check, mode);
+				else await ensureFileMode(result.check, mode);
+				fixed.push(result.check);
+			} catch (err) {
+				checks.push({
+					check: result.check,
+					status: "fail",
+					message: `--fix-perms failed: ${err.message}`
+				});
+			}
+		}
+		const after = await checkPerms({ expected });
+		checks.push(...after);
+	} else {
+		const result = await checkPerms({ expected });
+		checks.push(...result);
+	}
+	if (enable.secrets) checks.push(...checkSecrets());
+	if (enable.encryption) checks.push(...checkEncryption());
+	if (enable.systemd) {
+		const unit = options.systemdUnit ?? (process.platform === "linux" ? "graphorin.service" : void 0);
+		const result = await checkSystemd({
+			...unit !== void 0 ? { unit } : {},
+			...options.systemdRun !== void 0 ? { run: options.systemdRun } : {}
+		});
+		checks.push(...result);
+	}
+	const summary = {
+		ok: 0,
+		warn: 0,
+		fail: 0,
+		skip: 0
+	};
+	for (const c of checks) summary[c.status] += 1;
+	const report = Object.freeze({
+		version: "0.5.0",
+		home,
+		platform: process.platform,
+		checks: Object.freeze(checks),
+		summary: Object.freeze(summary),
+		...fixed.length > 0 ? { fixedPerms: Object.freeze(fixed) } : {}
+	});
+	emitReport(options, report, () => emitHumanReport(report, options));
+	if (summary.fail > 0) process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;
+	return report;
+}
+/**
+* Default expected file modes per the project's process-hardening
+* policy (DEC-135).
+*
+* @internal
+*/
+function expectedFileModes(home) {
+	return Object.freeze({
+		[home]: 448,
+		[`${home}/config.json`]: 384,
+		[`${home}/data.db`]: 384,
+		[`${home}/audit.db`]: 384,
+		[`${home}/secrets.kse`]: 384
+	});
+}
+function expandFlags(options) {
+	if (options.all === true) return {
+		perms: true,
+		secrets: true,
+		encryption: true,
+		systemd: true
+	};
+	if (!(options.checkPerms === true || options.checkSecrets === true || options.checkEncryption === true || options.checkSystemd === true || options.fixPerms === true)) return {
+		perms: true,
+		secrets: false,
+		encryption: false,
+		systemd: false
+	};
+	return {
+		perms: options.checkPerms === true || options.fixPerms === true,
+		secrets: options.checkSecrets === true,
+		encryption: options.checkEncryption === true,
+		systemd: options.checkSystemd === true
+	};
+}
+function emitHumanReport(report, options) {
+	const print = options.print ?? defaultPrintSink;
+	print(brand(`graphorin doctor v${report.version} (host: ${report.home}, platform: ${report.platform})`));
+	if (report.fixedPerms !== void 0) {
+		print(brand(`--fix-perms repaired:`));
+		for (const path of report.fixedPerms) print(`  - ${path}`);
+	}
+	if (report.checks.length === 0) {
+		print(brand("no checks were enabled. Pass --all or one of --check-*."));
+		return;
+	}
+	for (const c of report.checks) {
+		print(`  ${statusMarker(c.status)} ${c.check}: ${c.message}`);
+		if (c.hint !== void 0) print(`        -> ${c.hint}`);
+	}
+	print(brand(`summary: ${report.summary.ok} ok, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`));
+}
+
+//#endregion
+export { expectedFileModes, runDoctor };
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","names":["checks: CheckResult[]","fixed: string[]","summary: Record<'ok' | 'warn' | 'fail' | 'skip', number>","report: DoctorReport"],"sources":["../../src/commands/doctor.ts"],"sourcesContent":["/**\n * `graphorin doctor` — host health check.\n *\n * Wraps the read-only library helpers in `@graphorin/security/hardening`\n * (`checkPerms`, `checkSecrets`, `checkEncryption`, `checkSystemd`)\n * with `--fix-perms` repair, `--all` aggregation, JSON output for CI\n * pipelines, and exit-code semantics:\n *\n *  - exit `0` — every check passed (`fail` count is `0`).\n *  - exit `1` — at least one check returned `'fail'`.\n *  - exit `2` — invocation could not even start (e.g. config missing\n *    when `--check-secrets` requires the bootstrapped store).\n *\n * The doctor never writes to disk unless `--fix-perms` is supplied.\n * When repair is requested the CLI calls `ensureFileMode(...)` /\n * `ensureDirMode(...)` from `@graphorin/security/hardening` and re-runs\n * the perms check so the report reflects the post-fix state.\n *\n * Source-of-truth: process-hardening + `graphorin doctor` policy\n * (DEC-135).\n *\n * @packageDocumentation\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport process from 'node:process';\n\nimport {\n  type CheckResult,\n  checkEncryption,\n  checkPerms,\n  checkSecrets,\n  checkSystemd,\n  ensureDirMode,\n  ensureFileMode,\n} from '@graphorin/security';\n\nimport { EXIT_CODES } from '../internal/exit.js';\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/**\n * @stable\n */\nexport interface DoctorCommandOptions extends CommonOutputOptions {\n  /**\n   * Override the directory the doctor checks. Defaults to\n   * `~/.graphorin/`. Tests inject a fresh tmp dir.\n   */\n  readonly home?: string;\n  /** Run the file-perms repair. */\n  readonly fixPerms?: boolean;\n  /** Run the file-perms check. Implied by `--all`. */\n  readonly checkPerms?: boolean;\n  /** Run the secrets-store check. */\n  readonly checkSecrets?: boolean;\n  /** Run the audit-encryption check. */\n  readonly checkEncryption?: boolean;\n  /** Run the systemd check. Linux-only. */\n  readonly checkSystemd?: boolean;\n  /** Optional systemd unit identifier (default `graphorin.service`). */\n  readonly systemdUnit?: string;\n  /** Run every check. Equivalent to passing every `--check-*` flag. */\n  readonly all?: boolean;\n  /** Test seam — supply a custom systemd executor. */\n  readonly systemdRun?: (cmd: string) => Promise<string>;\n}\n\n/**\n * @stable\n */\nexport interface DoctorReport {\n  readonly version: string;\n  readonly home: string;\n  readonly platform: NodeJS.Platform;\n  readonly checks: ReadonlyArray<CheckResult>;\n  readonly summary: {\n    readonly ok: number;\n    readonly warn: number;\n    readonly fail: number;\n    readonly skip: number;\n  };\n  readonly fixedPerms?: ReadonlyArray<string>;\n}\n\n/**\n * Programmatic entry point. Returns the {@link DoctorReport} so tests\n * and downstream automations consume the structured payload directly.\n *\n * @stable\n */\nexport async function runDoctor(options: DoctorCommandOptions = {}): Promise<DoctorReport> {\n  const home = options.home ?? join(homedir(), '.graphorin');\n  const expected = expectedFileModes(home);\n\n  const enable = expandFlags(options);\n  const checks: CheckResult[] = [];\n  const fixed: string[] = [];\n\n  if (enable.perms) {\n    if (options.fixPerms === true) {\n      const before = await checkPerms({ expected });\n      for (const result of before) {\n        if (result.status === 'fail' && expected[result.check] !== undefined) {\n          const mode = expected[result.check] as number;\n          try {\n            if (mode === 0o700) {\n              await ensureDirMode(result.check, mode);\n            } else {\n              await ensureFileMode(result.check, mode);\n            }\n            fixed.push(result.check);\n          } catch (err) {\n            checks.push({\n              check: result.check,\n              status: 'fail',\n              message: `--fix-perms failed: ${(err as Error).message}`,\n            });\n          }\n        }\n      }\n      // Re-run after the repair so the final report reflects the\n      // post-fix state.\n      const after = await checkPerms({ expected });\n      checks.push(...after);\n    } else {\n      const result = await checkPerms({ expected });\n      checks.push(...result);\n    }\n  }\n\n  if (enable.secrets) {\n    checks.push(...checkSecrets());\n  }\n\n  if (enable.encryption) {\n    checks.push(...checkEncryption());\n  }\n\n  if (enable.systemd) {\n    const unit =\n      options.systemdUnit ?? (process.platform === 'linux' ? 'graphorin.service' : undefined);\n    const result = await checkSystemd({\n      ...(unit !== undefined ? { unit } : {}),\n      ...(options.systemdRun !== undefined ? { run: options.systemdRun } : {}),\n    });\n    checks.push(...result);\n  }\n\n  const summary: Record<'ok' | 'warn' | 'fail' | 'skip', number> = {\n    ok: 0,\n    warn: 0,\n    fail: 0,\n    skip: 0,\n  };\n  for (const c of checks) {\n    summary[c.status] += 1;\n  }\n\n  const report: DoctorReport = Object.freeze({\n    version: '0.5.0',\n    home,\n    platform: process.platform,\n    checks: Object.freeze(checks),\n    summary: Object.freeze(summary),\n    ...(fixed.length > 0 ? { fixedPerms: Object.freeze(fixed) } : {}),\n  });\n\n  emitReport(options, report, () => emitHumanReport(report, options));\n\n  if (summary.fail > 0) {\n    process.exitCode = EXIT_CODES.RECOVERABLE_FAILURE;\n  }\n\n  return report;\n}\n\n/**\n * Default expected file modes per the project's process-hardening\n * policy (DEC-135).\n *\n * @internal\n */\nexport function expectedFileModes(home: string): Readonly<Record<string, number>> {\n  return Object.freeze({\n    [home]: 0o700,\n    [`${home}/config.json`]: 0o600,\n    [`${home}/data.db`]: 0o600,\n    [`${home}/audit.db`]: 0o600,\n    [`${home}/secrets.kse`]: 0o600,\n  });\n}\n\ninterface DoctorChecks {\n  readonly perms: boolean;\n  readonly secrets: boolean;\n  readonly encryption: boolean;\n  readonly systemd: boolean;\n}\n\nfunction expandFlags(options: DoctorCommandOptions): DoctorChecks {\n  if (options.all === true) {\n    return { perms: true, secrets: true, encryption: true, systemd: true };\n  }\n  const explicit =\n    options.checkPerms === true ||\n    options.checkSecrets === true ||\n    options.checkEncryption === true ||\n    options.checkSystemd === true ||\n    options.fixPerms === true;\n  if (!explicit) {\n    return { perms: true, secrets: false, encryption: false, systemd: false };\n  }\n  return {\n    perms: options.checkPerms === true || options.fixPerms === true,\n    secrets: options.checkSecrets === true,\n    encryption: options.checkEncryption === true,\n    systemd: options.checkSystemd === true,\n  };\n}\n\nfunction emitHumanReport(report: DoctorReport, options: DoctorCommandOptions): void {\n  const print = options.print ?? defaultPrintSink;\n  print(\n    brand(\n      `graphorin doctor v${report.version} (host: ${report.home}, platform: ${report.platform})`,\n    ),\n  );\n  if (report.fixedPerms !== undefined) {\n    print(brand(`--fix-perms repaired:`));\n    for (const path of report.fixedPerms) print(`  - ${path}`);\n  }\n  if (report.checks.length === 0) {\n    print(brand('no checks were enabled. Pass --all or one of --check-*.'));\n    return;\n  }\n  for (const c of report.checks) {\n    print(`  ${statusMarker(c.status)} ${c.check}: ${c.message}`);\n    if (c.hint !== undefined) print(`        -> ${c.hint}`);\n  }\n  print(\n    brand(\n      `summary: ${report.summary.ok} ok, ${report.summary.warn} warn, ${report.summary.fail} fail, ${report.summary.skip} skip`,\n    ),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGA,eAAsB,UAAU,UAAgC,EAAE,EAAyB;CACzF,MAAM,OAAO,QAAQ,QAAQ,KAAK,SAAS,EAAE,aAAa;CAC1D,MAAM,WAAW,kBAAkB,KAAK;CAExC,MAAM,SAAS,YAAY,QAAQ;CACnC,MAAMA,SAAwB,EAAE;CAChC,MAAMC,QAAkB,EAAE;AAE1B,KAAI,OAAO,MACT,KAAI,QAAQ,aAAa,MAAM;EAC7B,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,OAAK,MAAM,UAAU,OACnB,KAAI,OAAO,WAAW,UAAU,SAAS,OAAO,WAAW,QAAW;GACpE,MAAM,OAAO,SAAS,OAAO;AAC7B,OAAI;AACF,QAAI,SAAS,IACX,OAAM,cAAc,OAAO,OAAO,KAAK;QAEvC,OAAM,eAAe,OAAO,OAAO,KAAK;AAE1C,UAAM,KAAK,OAAO,MAAM;YACjB,KAAK;AACZ,WAAO,KAAK;KACV,OAAO,OAAO;KACd,QAAQ;KACR,SAAS,uBAAwB,IAAc;KAChD,CAAC;;;EAMR,MAAM,QAAQ,MAAM,WAAW,EAAE,UAAU,CAAC;AAC5C,SAAO,KAAK,GAAG,MAAM;QAChB;EACL,MAAM,SAAS,MAAM,WAAW,EAAE,UAAU,CAAC;AAC7C,SAAO,KAAK,GAAG,OAAO;;AAI1B,KAAI,OAAO,QACT,QAAO,KAAK,GAAG,cAAc,CAAC;AAGhC,KAAI,OAAO,WACT,QAAO,KAAK,GAAG,iBAAiB,CAAC;AAGnC,KAAI,OAAO,SAAS;EAClB,MAAM,OACJ,QAAQ,gBAAgB,QAAQ,aAAa,UAAU,sBAAsB;EAC/E,MAAM,SAAS,MAAM,aAAa;GAChC,GAAI,SAAS,SAAY,EAAE,MAAM,GAAG,EAAE;GACtC,GAAI,QAAQ,eAAe,SAAY,EAAE,KAAK,QAAQ,YAAY,GAAG,EAAE;GACxE,CAAC;AACF,SAAO,KAAK,GAAG,OAAO;;CAGxB,MAAMC,UAA2D;EAC/D,IAAI;EACJ,MAAM;EACN,MAAM;EACN,MAAM;EACP;AACD,MAAK,MAAM,KAAK,OACd,SAAQ,EAAE,WAAW;CAGvB,MAAMC,SAAuB,OAAO,OAAO;EACzC,SAAS;EACT;EACA,UAAU,QAAQ;EAClB,QAAQ,OAAO,OAAO,OAAO;EAC7B,SAAS,OAAO,OAAO,QAAQ;EAC/B,GAAI,MAAM,SAAS,IAAI,EAAE,YAAY,OAAO,OAAO,MAAM,EAAE,GAAG,EAAE;EACjE,CAAC;AAEF,YAAW,SAAS,cAAc,gBAAgB,QAAQ,QAAQ,CAAC;AAEnE,KAAI,QAAQ,OAAO,EACjB,SAAQ,WAAW,WAAW;AAGhC,QAAO;;;;;;;;AAST,SAAgB,kBAAkB,MAAgD;AAChF,QAAO,OAAO,OAAO;GAClB,OAAO;GACP,GAAG,KAAK,gBAAgB;GACxB,GAAG,KAAK,YAAY;GACpB,GAAG,KAAK,aAAa;GACrB,GAAG,KAAK,gBAAgB;EAC1B,CAAC;;AAUJ,SAAS,YAAY,SAA6C;AAChE,KAAI,QAAQ,QAAQ,KAClB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAM,YAAY;EAAM,SAAS;EAAM;AAQxE,KAAI,EALF,QAAQ,eAAe,QACvB,QAAQ,iBAAiB,QACzB,QAAQ,oBAAoB,QAC5B,QAAQ,iBAAiB,QACzB,QAAQ,aAAa,MAErB,QAAO;EAAE,OAAO;EAAM,SAAS;EAAO,YAAY;EAAO,SAAS;EAAO;AAE3E,QAAO;EACL,OAAO,QAAQ,eAAe,QAAQ,QAAQ,aAAa;EAC3D,SAAS,QAAQ,iBAAiB;EAClC,YAAY,QAAQ,oBAAoB;EACxC,SAAS,QAAQ,iBAAiB;EACnC;;AAGH,SAAS,gBAAgB,QAAsB,SAAqC;CAClF,MAAM,QAAQ,QAAQ,SAAS;AAC/B,OACE,MACE,qBAAqB,OAAO,QAAQ,UAAU,OAAO,KAAK,cAAc,OAAO,SAAS,GACzF,CACF;AACD,KAAI,OAAO,eAAe,QAAW;AACnC,QAAM,MAAM,wBAAwB,CAAC;AACrC,OAAK,MAAM,QAAQ,OAAO,WAAY,OAAM,OAAO,OAAO;;AAE5D,KAAI,OAAO,OAAO,WAAW,GAAG;AAC9B,QAAM,MAAM,0DAA0D,CAAC;AACvE;;AAEF,MAAK,MAAM,KAAK,OAAO,QAAQ;AAC7B,QAAM,KAAK,aAAa,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,UAAU;AAC7D,MAAI,EAAE,SAAS,OAAW,OAAM,cAAc,EAAE,OAAO;;AAEzD,OACE,MACE,YAAY,OAAO,QAAQ,GAAG,OAAO,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,SAAS,OAAO,QAAQ,KAAK,OACpH,CACF"}

package/dist/commands/guard.d.ts

@@ -0,0 +1,35 @@
+import { CommonOutputOptions } from "../internal/output.js";
+import { MemoryGuardTier, guardVariantForTier } from "@graphorin/security";
+
+//#region src/commands/guard.d.ts
+
+/** @stable */
+interface GuardCommonOptions extends CommonOutputOptions {}
+/** @stable */
+interface GuardStatusEntry {
+  readonly tier: MemoryGuardTier;
+  readonly variant: ReturnType<typeof guardVariantForTier>;
+  readonly description: string;
+}
+/** @stable */
+declare function runGuardStatus(options?: GuardCommonOptions): ReadonlyArray<GuardStatusEntry>;
+/** @stable */
+interface GuardExplainOptions extends GuardCommonOptions {
+  readonly toolName: string;
+  readonly tags?: ReadonlyArray<string>;
+  readonly secretsAllowed?: ReadonlyArray<string>;
+  readonly trustLevel?: 'built-in' | 'user-defined' | 'trusted' | 'untrusted';
+  readonly explicitTier?: MemoryGuardTier;
+}
+/** @stable */
+interface GuardExplainResult {
+  readonly toolName: string;
+  readonly tier: MemoryGuardTier;
+  readonly variant: ReturnType<typeof guardVariantForTier>;
+  readonly reason: string;
+}
+/** @stable */
+declare function runGuardExplain(options: GuardExplainOptions): GuardExplainResult;
+//#endregion
+export { GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, runGuardExplain, runGuardStatus };
+//# sourceMappingURL=guard.d.ts.map

package/dist/commands/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","names":[],"sources":["../../src/commands/guard.ts"],"sourcesContent":[],"mappings":";;;;;;AAuE+D,UArC9C,kBAAA,SAA2B,mBAqCmB,CAAA,CAS/D;;AAGsC,UAtCrB,gBAAA,CAsCqB;EAAlB,SAAA,IAAA,EArCH,eAqCG;EAAU,SAAA,OAAA,EApCV,UAoCU,CAAA,OApCQ,mBAoCR,CAAA;EAKd,SAAA,WAAe,EAAA,MAAA;;;iBApCf,cAAA,WAAwB,qBAA0B,cAAc;;UAmB/D,mBAAA,SAA4B;;kBAE3B;4BACU;;0BAEF;;;UAIT,kBAAA;;iBAEA;oBACG,kBAAkB;;;;iBAKtB,eAAA,UAAyB,sBAAsB"}

package/dist/commands/guard.js

@@ -0,0 +1,86 @@
+import { brand, defaultPrintSink, emitReport, statusMarker } from "../internal/output.js";
+import { classifyTool, guardVariantForTier } from "@graphorin/security";
+
+//#region src/commands/guard.ts
+/**
+* `graphorin guard` — inspect the memory-modification guard tier
+* policy.
+*
+* Surface (per Phase 15 § Guard):
+*
+*  - `graphorin guard status` — print the four tiers + their guard
+*    variants (per DEC-153).
+*  - `graphorin guard explain <toolName>` — derive the tier the
+*    classifier would assign to a tool with the supplied trust class
+*    and tags. The CLI accepts the metadata via `--tags` /
+*    `--trust-level` / `--allowed-secrets` so the explain operation
+*    matches the runtime classifier without requiring the operator to
+*    boot the agent.
+*
+* @packageDocumentation
+*/
+const TIERS = Object.freeze([
+	"pure",
+	"side-effecting-no-memory",
+	"memory-aware",
+	"unknown",
+	"untrusted"
+]);
+/** @stable */
+function runGuardStatus(options = {}) {
+	const rows = TIERS.map((tier) => Object.freeze({
+		tier,
+		variant: guardVariantForTier(tier),
+		description: descriptionFor(tier)
+	}));
+	emitReport(options, rows, () => {
+		const print = options.print ?? defaultPrintSink;
+		print(brand("memory-modification guard tiers (DEC-153):"));
+		for (const row of rows) print(`  ${statusMarker("info")} ${row.tier} -> ${row.variant} (${row.description})`);
+	});
+	return rows;
+}
+/** @stable */
+function runGuardExplain(options) {
+	const tool = {
+		name: options.toolName,
+		...options.tags !== void 0 ? { tags: options.tags } : {},
+		...options.secretsAllowed !== void 0 ? { secretsAllowed: options.secretsAllowed } : {},
+		...options.trustLevel !== void 0 ? { trustLevel: options.trustLevel } : {},
+		...options.explicitTier !== void 0 ? { memoryGuardTier: options.explicitTier } : {}
+	};
+	const tier = classifyTool(tool);
+	const variant = guardVariantForTier(tier);
+	const reason = explainReason(tool, tier);
+	const result = Object.freeze({
+		toolName: options.toolName,
+		tier,
+		variant,
+		reason
+	});
+	emitReport(options, result, () => {
+		const print = options.print ?? defaultPrintSink;
+		print(brand(`${statusMarker("info")} ${result.toolName} -> tier=${result.tier} (variant=${result.variant})`));
+		print(`  reason: ${result.reason}`);
+	});
+	return result;
+}
+function descriptionFor(tier) {
+	switch (tier) {
+		case "pure": return "no side effects, no guard required";
+		case "side-effecting-no-memory": return "side effects but no long-term memory writes";
+		case "memory-aware": return "API-boundary guard around memory operations";
+		case "unknown": return "audit-only guard (default for unclassified tools)";
+		case "untrusted": return "strict full guard with xxhash integrity check";
+	}
+}
+function explainReason(tool, tier) {
+	if (tool.memoryGuardTier !== void 0) return `operator-set memoryGuardTier='${tool.memoryGuardTier}' (precedence wins)`;
+	if (tool.trustLevel === "untrusted") return `trustLevel='untrusted' forces tier='untrusted'`;
+	if (tier === "memory-aware") return `tags / secretsAllowed / name match the default memory-tag patterns`;
+	return `default classification (no memory hints found in tags / secretsAllowed)`;
+}
+
+//#endregion
+export { runGuardExplain, runGuardStatus };
+//# sourceMappingURL=guard.js.map

package/dist/commands/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","names":["TIERS: ReadonlyArray<MemoryGuardTier>","rows: GuardStatusEntry[]","tool: ClassifiableTool","result: GuardExplainResult"],"sources":["../../src/commands/guard.ts"],"sourcesContent":["/**\n * `graphorin guard` — inspect the memory-modification guard tier\n * policy.\n *\n * Surface (per Phase 15 § Guard):\n *\n *  - `graphorin guard status` — print the four tiers + their guard\n *    variants (per DEC-153).\n *  - `graphorin guard explain <toolName>` — derive the tier the\n *    classifier would assign to a tool with the supplied trust class\n *    and tags. The CLI accepts the metadata via `--tags` /\n *    `--trust-level` / `--allowed-secrets` so the explain operation\n *    matches the runtime classifier without requiring the operator to\n *    boot the agent.\n *\n * @packageDocumentation\n */\n\nimport {\n  type ClassifiableTool,\n  classifyTool,\n  guardVariantForTier,\n  type MemoryGuardTier,\n} from '@graphorin/security';\n\nimport {\n  brand,\n  type CommonOutputOptions,\n  defaultPrintSink,\n  emitReport,\n  statusMarker,\n} from '../internal/output.js';\n\n/** @stable */\nexport interface GuardCommonOptions extends CommonOutputOptions {}\n\nconst TIERS: ReadonlyArray<MemoryGuardTier> = Object.freeze([\n  'pure',\n  'side-effecting-no-memory',\n  'memory-aware',\n  'unknown',\n  'untrusted',\n] as const);\n\n/** @stable */\nexport interface GuardStatusEntry {\n  readonly tier: MemoryGuardTier;\n  readonly variant: ReturnType<typeof guardVariantForTier>;\n  readonly description: string;\n}\n\n/** @stable */\nexport function runGuardStatus(options: GuardCommonOptions = {}): ReadonlyArray<GuardStatusEntry> {\n  const rows: GuardStatusEntry[] = TIERS.map((tier) =>\n    Object.freeze({\n      tier,\n      variant: guardVariantForTier(tier),\n      description: descriptionFor(tier),\n    }),\n  );\n  emitReport(options, rows, () => {\n    const print = options.print ?? defaultPrintSink;\n    print(brand('memory-modification guard tiers (DEC-153):'));\n    for (const row of rows) {\n      print(`  ${statusMarker('info')} ${row.tier} -> ${row.variant} (${row.description})`);\n    }\n  });\n  return rows;\n}\n\n/** @stable */\nexport interface GuardExplainOptions extends GuardCommonOptions {\n  readonly toolName: string;\n  readonly tags?: ReadonlyArray<string>;\n  readonly secretsAllowed?: ReadonlyArray<string>;\n  readonly trustLevel?: 'built-in' | 'user-defined' | 'trusted' | 'untrusted';\n  readonly explicitTier?: MemoryGuardTier;\n}\n\n/** @stable */\nexport interface GuardExplainResult {\n  readonly toolName: string;\n  readonly tier: MemoryGuardTier;\n  readonly variant: ReturnType<typeof guardVariantForTier>;\n  readonly reason: string;\n}\n\n/** @stable */\nexport function runGuardExplain(options: GuardExplainOptions): GuardExplainResult {\n  const tool: ClassifiableTool = {\n    name: options.toolName,\n    ...(options.tags !== undefined ? { tags: options.tags } : {}),\n    ...(options.secretsAllowed !== undefined ? { secretsAllowed: options.secretsAllowed } : {}),\n    ...(options.trustLevel !== undefined ? { trustLevel: options.trustLevel } : {}),\n    ...(options.explicitTier !== undefined ? { memoryGuardTier: options.explicitTier } : {}),\n  };\n  const tier = classifyTool(tool);\n  const variant = guardVariantForTier(tier);\n  const reason = explainReason(tool, tier);\n  const result: GuardExplainResult = Object.freeze({\n    toolName: options.toolName,\n    tier,\n    variant,\n    reason,\n  });\n  emitReport(options, result, () => {\n    const print = options.print ?? defaultPrintSink;\n    print(\n      brand(\n        `${statusMarker('info')} ${result.toolName} -> tier=${result.tier} (variant=${result.variant})`,\n      ),\n    );\n    print(`  reason: ${result.reason}`);\n  });\n  return result;\n}\n\nfunction descriptionFor(tier: MemoryGuardTier): string {\n  switch (tier) {\n    case 'pure':\n      return 'no side effects, no guard required';\n    case 'side-effecting-no-memory':\n      return 'side effects but no long-term memory writes';\n    case 'memory-aware':\n      return 'API-boundary guard around memory operations';\n    case 'unknown':\n      return 'audit-only guard (default for unclassified tools)';\n    case 'untrusted':\n      return 'strict full guard with xxhash integrity check';\n  }\n}\n\nfunction explainReason(tool: ClassifiableTool, tier: MemoryGuardTier): string {\n  if (tool.memoryGuardTier !== undefined) {\n    return `operator-set memoryGuardTier='${tool.memoryGuardTier}' (precedence wins)`;\n  }\n  if (tool.trustLevel === 'untrusted') {\n    return `trustLevel='untrusted' forces tier='untrusted'`;\n  }\n  if (tier === 'memory-aware') {\n    return `tags / secretsAllowed / name match the default memory-tag patterns`;\n  }\n  return `default classification (no memory hints found in tags / secretsAllowed)`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoCA,MAAMA,QAAwC,OAAO,OAAO;CAC1D;CACA;CACA;CACA;CACA;CACD,CAAU;;AAUX,SAAgB,eAAe,UAA8B,EAAE,EAAmC;CAChG,MAAMC,OAA2B,MAAM,KAAK,SAC1C,OAAO,OAAO;EACZ;EACA,SAAS,oBAAoB,KAAK;EAClC,aAAa,eAAe,KAAK;EAClC,CAAC,CACH;AACD,YAAW,SAAS,YAAY;EAC9B,MAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,MAAM,6CAA6C,CAAC;AAC1D,OAAK,MAAM,OAAO,KAChB,OAAM,KAAK,aAAa,OAAO,CAAC,GAAG,IAAI,KAAK,MAAM,IAAI,QAAQ,IAAI,IAAI,YAAY,GAAG;GAEvF;AACF,QAAO;;;AAqBT,SAAgB,gBAAgB,SAAkD;CAChF,MAAMC,OAAyB;EAC7B,MAAM,QAAQ;EACd,GAAI,QAAQ,SAAS,SAAY,EAAE,MAAM,QAAQ,MAAM,GAAG,EAAE;EAC5D,GAAI,QAAQ,mBAAmB,SAAY,EAAE,gBAAgB,QAAQ,gBAAgB,GAAG,EAAE;EAC1F,GAAI,QAAQ,eAAe,SAAY,EAAE,YAAY,QAAQ,YAAY,GAAG,EAAE;EAC9E,GAAI,QAAQ,iBAAiB,SAAY,EAAE,iBAAiB,QAAQ,cAAc,GAAG,EAAE;EACxF;CACD,MAAM,OAAO,aAAa,KAAK;CAC/B,MAAM,UAAU,oBAAoB,KAAK;CACzC,MAAM,SAAS,cAAc,MAAM,KAAK;CACxC,MAAMC,SAA6B,OAAO,OAAO;EAC/C,UAAU,QAAQ;EAClB;EACA;EACA;EACD,CAAC;AACF,YAAW,SAAS,cAAc;EAChC,MAAM,QAAQ,QAAQ,SAAS;AAC/B,QACE,MACE,GAAG,aAAa,OAAO,CAAC,GAAG,OAAO,SAAS,WAAW,OAAO,KAAK,YAAY,OAAO,QAAQ,GAC9F,CACF;AACD,QAAM,aAAa,OAAO,SAAS;GACnC;AACF,QAAO;;AAGT,SAAS,eAAe,MAA+B;AACrD,SAAQ,MAAR;EACE,KAAK,OACH,QAAO;EACT,KAAK,2BACH,QAAO;EACT,KAAK,eACH,QAAO;EACT,KAAK,UACH,QAAO;EACT,KAAK,YACH,QAAO;;;AAIb,SAAS,cAAc,MAAwB,MAA+B;AAC5E,KAAI,KAAK,oBAAoB,OAC3B,QAAO,iCAAiC,KAAK,gBAAgB;AAE/D,KAAI,KAAK,eAAe,YACtB,QAAO;AAET,KAAI,SAAS,eACX,QAAO;AAET,QAAO"}

package/dist/commands/index.d.ts

@@ -0,0 +1,21 @@
+import { AuditCommonOptions, AuditExportOptions, AuditExportResult, AuditPruneOptions, AuditVerifyResult, runAuditExport, runAuditPrune, runAuditVerify } from "./audit.js";
+import { AuthCommonOptions, AuthListOptions, AuthLoginOptions, AuthRefreshOptions, AuthRevokeOptions, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus } from "./auth.js";
+import { CONSOLIDATOR_INVALID_TIER_EXIT, ConsolidatorCommonOptions, ConsolidatorSetTierOptions, ConsolidatorStatusResult, ConsolidatorStopOptions, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop } from "./consolidator.js";
+import { DoctorCommandOptions, DoctorReport, expectedFileModes, runDoctor } from "./doctor.js";
+import { GuardCommonOptions, GuardExplainOptions, GuardExplainResult, GuardStatusEntry, runGuardExplain, runGuardStatus } from "./guard.js";
+import { InitCommandOptions, InitCommandResult, runInit } from "./init.js";
+import { MemoryActivityConflict, MemoryActivityEvent, MemoryActivityOptions, MemoryActivityResult, MemoryCitingInsight, MemoryCommonOptions, MemoryConflictEntry, MemoryHistoryEntry, MemoryInspectEntity, MemoryInspectFact, MemoryInspectOptions, MemoryInspectResult, MemoryMigrateOptions, MemoryReviewItem, MemoryReviewOptions, MemoryReviewResult, MemoryStatusEmbedder, MemoryStatusResult, MemoryWhyOptions, MemoryWhyRecall, MemoryWhyResult, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy } from "./memory.js";
+import { MigrateCommandOptions, MigrateCommandResult, runMigrate } from "./migrate.js";
+import { MigrateConfigOptions, MigrateConfigResult, runMigrateConfig } from "./migrate-config.js";
+import { MigrateExportOptions, MigrateExportResult, runMigrateExport } from "./migrate-export.js";
+import { PricingCommonOptions, PricingDiffOptions, PricingLookupOptions, PricingMissingOptions, PricingRefreshOptions, PricingStatusResult, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus } from "./pricing.js";
+import { SecretsCommonOptions, SecretsDeleteOptions, SecretsGetOptions, SecretsGetResult, SecretsListOptions, SecretsRefOptions, SecretsRefResult, SecretsRotateOptions, SecretsSetOptions, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet } from "./secrets.js";
+import { SkillTrustLevelInput, SkillsAuditOptions, SkillsCommonOptions, SkillsInspectOptions, SkillsInstallOptions, SkillsMigrateFrontmatterOptions, SkillsMigrateFrontmatterResult, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter } from "./skills.js";
+import { SecretsSourceFlag, StartCommandOptions, runStart } from "./start.js";
+import { StorageCleanupBackupsOptions, StorageCleanupBackupsResult, StorageCommonOptions, StorageEncryptOptions, StorageRekeyOptions, StorageStatusResult, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus } from "./storage.js";
+import { TelemetryStatusResult, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus } from "./telemetry.js";
+import { TokenCommonOptions, TokenCreateOptions, TokenCreateResult, TokenListOptions, TokenRekeyOptions, TokenRevokeOptions, TokenRotateOptions, TokenVerifyOptions, TokenVerifyResult, parseDuration, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify } from "./token.js";
+import { ToolsLintOptions, ToolsLintReport, runToolsLint } from "./tools-lint.js";
+import { TracesCommonOptions, TracesPruneOptions, TracesPruneResult, TracesStatusResult, runTracesPrune, runTracesStatus } from "./traces.js";
+import { TriggersCommonOptions, TriggersDisableOptions, TriggersFireOptions, TriggersPruneOptions, TriggersPruneResult, TriggersStatusOptions, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus } from "./triggers.js";
+export { type AuditCommonOptions, type AuditExportOptions, type AuditExportResult, type AuditPruneOptions, type AuditVerifyResult, type AuthCommonOptions, type AuthListOptions, type AuthLoginOptions, type AuthRefreshOptions, type AuthRevokeOptions, CONSOLIDATOR_INVALID_TIER_EXIT, type ConsolidatorCommonOptions, type ConsolidatorSetTierOptions, type ConsolidatorStatusResult, type ConsolidatorStopOptions, type DoctorCommandOptions, type DoctorReport, type GuardCommonOptions, type GuardExplainOptions, type GuardExplainResult, type GuardStatusEntry, type InitCommandOptions, type InitCommandResult, type MemoryActivityConflict, type MemoryActivityEvent, type MemoryActivityOptions, type MemoryActivityResult, type MemoryCitingInsight, type MemoryCommonOptions, type MemoryConflictEntry, type MemoryHistoryEntry, type MemoryInspectEntity, type MemoryInspectFact, type MemoryInspectOptions, type MemoryInspectResult, type MemoryMigrateOptions, type MemoryReviewItem, type MemoryReviewOptions, type MemoryReviewResult, type MemoryStatusEmbedder, type MemoryStatusResult, type MemoryWhyOptions, type MemoryWhyRecall, type MemoryWhyResult, type MigrateCommandOptions, type MigrateCommandResult, type MigrateConfigOptions, type MigrateConfigResult, type MigrateExportOptions, type MigrateExportResult, type PricingCommonOptions, type PricingDiffOptions, type PricingLookupOptions, type PricingMissingOptions, type PricingRefreshOptions, type PricingStatusResult, type SecretsCommonOptions, type SecretsDeleteOptions, type SecretsGetOptions, type SecretsGetResult, type SecretsListOptions, type SecretsRefOptions, type SecretsRefResult, type SecretsRotateOptions, type SecretsSetOptions, type SecretsSourceFlag, type SkillTrustLevelInput, type SkillsAuditOptions, type SkillsCommonOptions, type SkillsInspectOptions, type SkillsInstallOptions, type SkillsMigrateFrontmatterOptions, type SkillsMigrateFrontmatterResult, type StartCommandOptions, type StorageCleanupBackupsOptions, type StorageCleanupBackupsResult, type StorageCommonOptions, type StorageEncryptOptions, type StorageRekeyOptions, type StorageStatusResult, type TelemetryStatusResult, type TokenCommonOptions, type TokenCreateOptions, type TokenCreateResult, type TokenListOptions, type TokenRekeyOptions, type TokenRevokeOptions, type TokenRotateOptions, type TokenVerifyOptions, type TokenVerifyResult, type ToolsLintOptions, type ToolsLintReport, type TracesCommonOptions, type TracesPruneOptions, type TracesPruneResult, type TracesStatusResult, type TriggersCommonOptions, type TriggersDisableOptions, type TriggersFireOptions, type TriggersPruneOptions, type TriggersPruneResult, type TriggersStatusOptions, expectedFileModes, parseDuration, runAuditExport, runAuditPrune, runAuditVerify, runAuthList, runAuthLogin, runAuthRefresh, runAuthRevoke, runAuthStatus, runConsolidatorSetTier, runConsolidatorStatus, runConsolidatorStop, runDoctor, runGuardExplain, runGuardStatus, runInit, runMemoryActivity, runMemoryInspect, runMemoryMigrate, runMemoryReview, runMemoryStatus, runMemoryWhy, runMigrate, runMigrateConfig, runMigrateExport, runPricingDiff, runPricingLookup, runPricingMissing, runPricingRefresh, runPricingStatus, runSecretsDelete, runSecretsGet, runSecretsList, runSecretsRef, runSecretsRotate, runSecretsSet, runSkillsAudit, runSkillsInspect, runSkillsInstall, runSkillsMigrateFrontmatter, runStart, runStorageCleanupBackups, runStorageEncrypt, runStorageRekey, runStorageStatus, runTelemetryDisable, runTelemetryEnable, runTelemetryInspect, runTelemetryStatus, runTokenCreate, runTokenList, runTokenRekey, runTokenRevoke, runTokenRotate, runTokenVerify, runToolsLint, runTracesPrune, runTracesStatus, runTriggersDisable, runTriggersFire, runTriggersList, runTriggersPrune, runTriggersStatus };