@indigoai-us/hq-cli 5.108.5 → 5.108.7

package/dist/utils/cognito-session.js

@@ -23,7 +23,7 @@ import * as os from "os";
 import * as path from "path";
 import * as yaml from "js-yaml";
 import chalk from "chalk";
-import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, } from "@indigoai-us/hq-cloud";
+import { loadCachedTokens, isExpiring, refreshTokens, browserLogin, detectHqCoreVersion, isMachineIdentity, getValidMachineTokens, CognitoRefreshError, accessTokenFingerprint, invalidateCachedTokensByFingerprint, } from "@indigoai-us/hq-cloud";
 import { CLI_NAME, CLI_VERSION } from "../cli-version.js";
 import { daemonDir } from "../lib/mesh/live/daemon/paths.js";
 import { workMeshRoot } from "../lib/mesh/live/paths.js";
@@ -248,40 +248,36 @@ export function machineTokenCacheFile(home = os.homedir(), env = process.env) {
 }
 /**
  * True when `HQ_MACHINE_CREDS_FILE` is explicitly set (non-empty) in `env`.
- * The mere presence of `~/.hq-agent/machine-creds.json` is NOT enough — minting
- * and doctor "machine" reporting are opt-in via this env (systemd unit) or an
- * explicit `{ tokenSource: "machine" }` caller option.
+ * Explicit env remains the primary opt-in for daemon units. Fresh agent boxes
+ * without the env still mint via {@link wantsMachineCognitoTokens}'s
+ * default-file fallback when no usable person session exists.
  */
 export function isMachineCredsFileEnvSet(env = process.env) {
     const raw = env.HQ_MACHINE_CREDS_FILE;
     return typeof raw === "string" && raw.trim().length > 0;
 }
+/** Default machine-creds path hq-cloud also checks when the env is unset. */
+export function defaultMachineCredsFile(home = os.homedir()) {
+    return path.join(home, ".hq-agent", "machine-creds.json");
+}
 /**
- * Whether this call should mint/cache via machine creds (USER_PASSWORD_AUTH).
- * Opt-in only: explicit `{ tokenSource: "machine" }`, or `HQ_MACHINE_CREDS_FILE`
- * set in the environment. Default-path `~/.hq-agent/machine-creds.json` alone
- * never flips other CLI commands onto the machine path.
+ * Align `process.env.HQ_MACHINE_CREDS_FILE` with a (possibly synthetic) `env`
+ * for the duration of `fn`, so hq-cloud's `isMachineIdentity()` sees the same
+ * value doctor / tests intended.
  */
-export function wantsMachineCognitoTokens(options = {}, env = process.env) {
-    if (options.tokenSource === "person")
-        return false;
-    if (options.tokenSource === "machine") {
-        return isMachineIdentity();
-    }
-    if (!isMachineCredsFileEnvSet(env))
-        return false;
-    // Align process.env for hq-cloud's isMachineIdentity() when a synthetic env
-    // is supplied (doctor / tests).
+function withAlignedMachineCredsEnv(env, fn) {
     const prevCreds = process.env.HQ_MACHINE_CREDS_FILE;
     const nextCreds = env.HQ_MACHINE_CREDS_FILE;
     if (nextCreds !== prevCreds) {
-        if (nextCreds === undefined)
+        if (nextCreds === undefined || String(nextCreds).trim() === "") {
             delete process.env.HQ_MACHINE_CREDS_FILE;
-        else
+        }
+        else {
             process.env.HQ_MACHINE_CREDS_FILE = nextCreds;
+        }
     }
     try {
-        return isMachineIdentity();
+        return fn();
     }
     finally {
         if (nextCreds !== prevCreds) {
@@ -293,9 +289,104 @@ export function wantsMachineCognitoTokens(options = {}, env = process.env) {
     }
 }
 /**
- * Which Cognito token source this process will use for doctor / reporting:
- * machine only when `HQ_MACHINE_CREDS_FILE` is explicitly set and readable;
- * otherwise the person login cache. Default-path machine-creds alone → person.
+ * On-disk person Cognito cache path for `env` (`HQ_STATE_DIR` or `~/.hq`).
+ * Deliberately does not use hq-cloud's `loadCachedTokens()`: after a machine
+ * mint in this process, that helper returns in-memory machine tokens when the
+ * person file is absent, which would falsely block the fresh-box fallback.
+ */
+export function personTokenCacheFile(home = os.homedir(), env = process.env) {
+    const override = env.HQ_STATE_DIR?.trim();
+    const stateDir = override && override.length > 0 ? override : path.join(home, ".hq");
+    return path.join(stateDir, "cognito-tokens.json");
+}
+/**
+ * True when a usable person Cognito cache file exists under the effective
+ * `HQ_STATE_DIR` (or `~/.hq`). Presence alone keeps human commands on the
+ * person path even when the default machine-creds file is also on disk
+ * (no-flip guarantee).
+ */
+export function hasPersonCachedSession(env = process.env) {
+    try {
+        const file = personTokenCacheFile(os.homedir(), env);
+        if (!fs.existsSync(file))
+            return false;
+        const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (typeof raw.accessToken !== "string" ||
+            raw.accessToken.length === 0 ||
+            typeof raw.idToken !== "string" ||
+            raw.idToken.length === 0) {
+            return false;
+        }
+        // Definitive refresh rejection writes `${file}.invalid.<fingerprint>`;
+        // treat that as no usable person session so status/whoami report machine.
+        const marker = `${file}.invalid.${accessTokenFingerprint(raw.accessToken)}`;
+        if (fs.existsSync(marker))
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether hq-cloud currently sees readable machine creds (env override or
+ * default `~/.hq-agent/machine-creds.json`), honoring a synthetic `env`.
+ */
+function probeMachineIdentity(env) {
+    return withAlignedMachineCredsEnv(env, () => isMachineIdentity());
+}
+/**
+ * Fresh-box / Outpost bootstrap: env unset, not forced to person, no person
+ * cache, and the default machine-creds file is readable. Distinct from
+ * explicit `HQ_MACHINE_CREDS_FILE` / `{ tokenSource: "machine" }` opt-in.
+ */
+export function isDefaultMachineCredsFallback(options = {}, env = process.env) {
+    if (options.tokenSource === "person")
+        return false;
+    if (options.tokenSource === "machine")
+        return false;
+    if (isMachineCredsFileEnvSet(env))
+        return false;
+    if (hasPersonCachedSession(env))
+        return false;
+    return probeMachineIdentity(env);
+}
+function logDefaultMachineCredsFallback() {
+    console.error(chalk.dim("machine identity from default creds file"));
+}
+/**
+ * Whether this call should mint/cache via machine creds (USER_PASSWORD_AUTH).
+ *
+ * Machine path when:
+ *   - explicit `{ tokenSource: "machine" }` and creds are readable, or
+ *   - `HQ_MACHINE_CREDS_FILE` is set and readable, or
+ *   - fresh-box fallback: env unset, no person cache, default
+ *     `~/.hq-agent/machine-creds.json` readable.
+ *
+ * Explicit `{ tokenSource: "person" }` never uses machine creds. A present
+ * person cache keeps the person path even when the default creds file exists
+ * (do not flip a human's commands onto machine tokens).
+ */
+export function wantsMachineCognitoTokens(options = {}, env = process.env) {
+    if (options.tokenSource === "person")
+        return false;
+    if (options.tokenSource === "machine") {
+        return probeMachineIdentity(env);
+    }
+    if (isMachineCredsFileEnvSet(env)) {
+        return probeMachineIdentity(env);
+    }
+    // Fresh-box fallback — default creds file only when no person session.
+    if (hasPersonCachedSession(env))
+        return false;
+    return probeMachineIdentity(env);
+}
+/**
+ * Which Cognito token source this process will use for doctor / status / whoami.
+ * Matches {@link wantsMachineCognitoTokens}: env opt-in, or default-file
+ * fallback when no usable person session is cached (absent, or marked rejected
+ * after a definitive Cognito refresh refusal). Transient refresh failures do
+ * not flip this to machine.
  */
 export function resolveCognitoTokenSource(env = process.env) {
     return wantsMachineCognitoTokens({}, env) ? "machine" : "person";
@@ -400,16 +491,13 @@ export function describeCognitoTokenSource(opts = {}) {
  * Run `fn` with `HQ_STATE_DIR` pointed at the machine/daemon token cache so
  * hq-cloud's mint writes never touch the person login file.
  *
- * When `HQ_STATE_DIR` is already set (tests / explicit callers), leave it alone
- * so a pre-seeded machine session is still found — only redirect when unset.
+ * Always redirects — even when the caller already set `HQ_STATE_DIR` (person
+ * cache / tests). Override the machine cache location with
+ * `HQ_MACHINE_TOKEN_STATE_DIR` instead. Restores the prior env afterwards.
  */
 export async function withMachineTokenStateDir(fn, opts = {}) {
     const home = opts.home ?? os.homedir();
     const env = opts.env ?? process.env;
-    const existing = env.HQ_STATE_DIR?.trim() || process.env.HQ_STATE_DIR?.trim() || "";
-    if (existing) {
-        return fn();
-    }
     const prev = process.env.HQ_STATE_DIR;
     process.env.HQ_STATE_DIR = machineTokenStateDir(home, env);
     try {
@@ -425,12 +513,54 @@ export async function withMachineTokenStateDir(fn, opts = {}) {
 async function ensureMachineTokens() {
     return withMachineTokenStateDir(() => getValidMachineTokens(DEFAULT_COGNITO));
 }
+/**
+ * Mint machine tokens (daemon state dir cache). Logs once when the fresh-box
+ * default-creds fallback is what selected the machine path.
+ */
+async function ensureMachineTokensMaybeFallback(options = {}) {
+    if (isDefaultMachineCredsFallback(options)) {
+        logDefaultMachineCredsFallback();
+    }
+    return ensureMachineTokens();
+}
+/**
+ * After a person-cache miss or refresh failure: if the default machine-creds
+ * file is readable and the caller did not force person mode, mint from it.
+ * Returns null when the fallback does not apply.
+ */
+async function tryDefaultMachineCredsFallback(options = {}) {
+    if (options.tokenSource === "person")
+        return null;
+    if (isMachineCredsFileEnvSet())
+        return null;
+    if (!isMachineIdentity())
+        return null;
+    logDefaultMachineCredsFallback();
+    return ensureMachineTokens();
+}
+/**
+ * True when a person-token refresh failed with a definitive Cognito auth
+ * rejection (refresh token invalid/revoked). Transient network/5xx/timeouts
+ * must NOT trigger machine-identity fallback.
+ */
+export function isDefinitivePersonAuthRejection(err) {
+    if (err instanceof CognitoRefreshError) {
+        return err.requiresReauth === true;
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    return /NotAuthorizedException|invalid_grant|invalid refresh token/i.test(msg);
+}
+function markPersonSessionRejected(accessToken) {
+    invalidateCachedTokensByFingerprint(accessTokenFingerprint(accessToken));
+}
 /**
  * Return a non-expired Cognito access token, refreshing or browser-logging-in
  * as needed. Person cache lives at ~/.hq/cognito-tokens.json. Machine minting
- * is opt-in: `HQ_MACHINE_CREDS_FILE` explicitly set, or
- * `{ tokenSource: "machine" }` — then USER_PASSWORD_AUTH and (when
- * `HQ_STATE_DIR` is unset) a cache under the daemon state dir.
+ * uses `HQ_MACHINE_CREDS_FILE` / `{ tokenSource: "machine" }`, or the fresh-box
+ * fallback when the default creds file is readable and no person session
+ * exists (or person refresh fails with a definitive auth rejection).
+ * Machine tokens always cache under the dedicated machine/daemon state dir
+ * (never the caller's `HQ_STATE_DIR` person cache).
  *
  * Pass `interactive: false` from automated contexts (e.g. the `hq-auth-refresh`
  * bin invoked by the deploy skill) where failing fast is better than opening
@@ -445,10 +575,10 @@ export async function ensureCognitoToken(options = {}) {
     // so vault-API calls from a machine identity send the ID token. The cached
     // token file keeps correct field semantics (real access token in
     // accessToken) for consumers that need token_use=access, e.g. the deploy
-    // API via the deploy skill. Cache path: daemon state dir when HQ_STATE_DIR
-    // is unset, never a silent overwrite of a person's ~/.hq.
+    // API via the deploy skill. Cache path: dedicated machine/daemon state dir
+    // (isolated even when HQ_STATE_DIR points at a person cache).
     if (wantsMachineCognitoTokens(options)) {
-        const machine = await ensureMachineTokens();
+        const machine = await ensureMachineTokensMaybeFallback(options);
         return machine.idToken;
     }
     const cached = loadCachedTokens();
@@ -464,11 +594,24 @@ export async function ensureCognitoToken(options = {}) {
             return refreshed.accessToken;
         }
         catch (err) {
+            // Transient/network/server errors stay person errors — never mint machine.
+            if (!isDefinitivePersonAuthRejection(err)) {
+                throw err;
+            }
+            markPersonSessionRejected(cached.accessToken);
+            const fallback = await tryDefaultMachineCredsFallback(options);
+            if (fallback)
+                return fallback.idToken;
             if (interactive) {
                 console.error(chalk.dim(`  Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`));
             }
         }
     }
+    else {
+        const fallback = await tryDefaultMachineCredsFallback(options);
+        if (fallback)
+            return fallback.idToken;
+    }
     if (!interactive) {
         throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
     }
@@ -490,7 +633,7 @@ export async function ensureCognitoToken(options = {}) {
 export async function ensureCognitoIdToken(options = {}) {
     const interactive = options.interactive ?? true;
     if (wantsMachineCognitoTokens(options)) {
-        const machine = await ensureMachineTokens();
+        const machine = await ensureMachineTokensMaybeFallback(options);
         return machine.idToken;
     }
     const cached = loadCachedTokens();
@@ -506,11 +649,23 @@ export async function ensureCognitoIdToken(options = {}) {
             return refreshed.idToken;
         }
         catch (err) {
+            if (!isDefinitivePersonAuthRejection(err)) {
+                throw err;
+            }
+            markPersonSessionRejected(cached.accessToken);
+            const fallback = await tryDefaultMachineCredsFallback(options);
+            if (fallback)
+                return fallback.idToken;
             if (interactive) {
                 console.error(chalk.dim(`  Refresh failed (${err instanceof Error ? err.message : err}), falling back to browser login`));
             }
         }
     }
+    else {
+        const fallback = await tryDefaultMachineCredsFallback(options);
+        if (fallback)
+            return fallback.idToken;
+    }
     if (!interactive) {
         throw new Error("No valid HQ session and interactive login is disabled. Run `hq login` first.");
     }
@@ -551,10 +706,11 @@ export function buildVaultConfig(authToken) {
 export async function refreshCachedSession(options = {}) {
     // Machine identities have no refresh token; ensure a valid cached machine
     // session without forcing a re-mint when the cache is already healthy.
-    // Tokens land under the daemon state dir when HQ_STATE_DIR is unset.
+    // Tokens land under the dedicated machine/daemon state dir.
+    // Includes the fresh-box default-creds fallback when no person session.
     if (wantsMachineCognitoTokens(options)) {
         try {
-            await ensureMachineTokens();
+            await ensureMachineTokensMaybeFallback(options);
             return { refreshed: true };
         }
         catch (err) {
@@ -566,6 +722,20 @@ export async function refreshCachedSession(options = {}) {
     }
     const cached = loadCachedTokens();
     if (!cached) {
+        // Person path had nothing; last chance is default machine creds (e.g. the
+        // cache was cleared between the wantsMachine check and now, or identity
+        // became readable). Prefer machine mint over "no cached session" on boxes.
+        try {
+            const fallback = await tryDefaultMachineCredsFallback(options);
+            if (fallback)
+                return { refreshed: true };
+        }
+        catch (err) {
+            return {
+                refreshed: false,
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
         return { refreshed: false, reason: "no cached session" };
     }
     if (!isExpiring(cached, 120)) {
@@ -576,6 +746,26 @@ export async function refreshCachedSession(options = {}) {
         return { refreshed: true };
     }
     catch (err) {
+        // Transient/network/server refresh errors stay person failures.
+        if (!isDefinitivePersonAuthRejection(err)) {
+            return {
+                refreshed: false,
+                reason: err instanceof Error ? err.message : String(err),
+            };
+        }
+        // Definitive rejection — person session is dead; mark it and fall back.
+        markPersonSessionRejected(cached.accessToken);
+        try {
+            const fallback = await tryDefaultMachineCredsFallback(options);
+            if (fallback)
+                return { refreshed: true };
+        }
+        catch (mintErr) {
+            return {
+                refreshed: false,
+                reason: mintErr instanceof Error ? mintErr.message : String(mintErr),
+            };
+        }
         return {
             refreshed: false,
             reason: err instanceof Error ? err.message : String(err),

package/dist/utils/feedback-diagnostics.d.ts

@@ -1,4 +1,5 @@
 import { type VersionInfo } from "./feedback-versions.js";
+import type { FeedbackLogsBlob } from "./feedback-logs.js";
 export interface GitContext {
     branch: string | null;
     head: string | null;
@@ -23,6 +24,16 @@ export interface DiagnosticsBlob {
     cwd: string;
     git: GitContext;
     recentSentryBreadcrumbs: unknown[];
+    /**
+     * Redacted tails of the submitter's `~/.hq` log files.
+     *
+     * Attached by `submitFeedback`, NOT by `collectDiagnostics`, because the
+     * size budget can only be computed once the rest of the request body is
+     * known (the server caps the whole body at 64 KiB). Absent when the user
+     * opted out (`--no-logs` / `HQ_FEEDBACK_LOGS=0`), when no eligible log file
+     * exists, or when the body left no headroom.
+     */
+    logs?: FeedbackLogsBlob;
 }
 export declare function sanitizeArgv(argv: string[]): string[];
 export declare function collectDiagnostics(): DiagnosticsBlob;

package/dist/utils/feedback-log-bundle.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Full-history log bundle for `hq feedback` — the out-of-band companion to the
+ * inline `diagnostics.logs` blob in `feedback-logs.ts`.
+ *
+ * Inline logs are capped twice over: the feedback endpoint rejects a request
+ * body above 64 KiB, and `diagnostics` is written into a DynamoDB item, which
+ * caps at 400 KB. Neither can be tuned into carrying a real log history, so the
+ * inline blob is deliberately a ~40 KiB summary of 16 KiB tails. This module
+ * produces the other half: a gzipped bundle uploaded direct to S3, carrying the
+ * files whole rather than in tail-sized slivers.
+ *
+ * Three properties are load-bearing and none may be traded away:
+ *
+ *   1. SAME ALLOWLIST. Discovery reuses `feedback-logs.ts` verbatim —
+ *      `discoverLogFiles`, `discoverStateFiles`, `discoverFlatDirFiles`,
+ *      `walkJsonFiles`. The bundle carries MORE OF the same files, never more
+ *      files. Credential material lives outside `~/.hq` (`~/.codex/auth.json`,
+ *      `~/.hq-agent/machine-creds.json`), so widening discovery here — not
+ *      raising the size — is what would turn this into an exfiltration bug.
+ *
+ *   2. SAME REDACTION. Every line goes through `redactLogText` before it is
+ *      compressed. Shipping a raw archive would be far simpler and would
+ *      silently undo the entire security model of the inline path.
+ *
+ *   3. BOUNDED MEMORY. 50 MB compressed is roughly a gigabyte of raw log text
+ *      at the ratio these files compress at. Nothing is ever fully materialised:
+ *      files are read in slices, redacted a line at a time, and streamed into
+ *      gzip, with only the compressed output retained.
+ *
+ * Output format — gzipped NDJSON, one JSON record per line:
+ *   {"kind":"manifest","version":1,...}                    exactly one, first
+ *   {"kind":"file","name":"logs/hq-sync.log",...}          one per file
+ *   {"kind":"chunk","name":"logs/hq-sync.log","seq":0,...} many per file
+ *   {"kind":"summary","fileCount":12,...}                  exactly one, last
+ *
+ * NDJSON rather than tar so there is no archive dependency, so a truncated
+ * bundle is still parseable line-by-line up to the cut, and so the records
+ * carry the same redaction metadata the inline blob already reports.
+ */
+import { type LogCandidate } from "./feedback-logs.js";
+import { vaultApiFetch } from "./vault-api.js";
+/**
+ * Compressed ceiling. Mirrors `MAX_LOG_BUNDLE_BYTES` in the hq-pro handler
+ * `feedback-log-bundles.ts`, which refuses to presign above it — the two must
+ * stay in step or the CLI will build bundles the server will not accept.
+ */
+export declare const LOG_BUNDLE_MAX_BYTES: number;
+/**
+ * Headroom between the size we stop feeding at and the hard cap.
+ *
+ * gzip reports compressed bytes only as its internal buffer flushes, so the
+ * running total lags the bytes actually consumed. The lag is bounded by that
+ * buffer (tens of KiB); a 1 MiB margin covers it with three orders of magnitude
+ * to spare, and the final size is asserted against the real cap regardless.
+ */
+export declare const LOG_BUNDLE_SAFETY_MARGIN_BYTES: number;
+/**
+ * Per-file raw ceiling. The desktop logger rotates at 32 MiB (hq-desktop-core
+ * `logfile.rs`), so this admits a full generation with headroom while stopping
+ * one pathological file from consuming the whole bundle. Files above it are
+ * read from the TAIL — the end of a log is what explains a failure.
+ */
+export declare const LOG_BUNDLE_MAX_FILE_RAW_BYTES: number;
+export interface LogBundleResult {
+    /** The gzipped NDJSON bytes, ready to PUT. */
+    gzip: Buffer;
+    /** `gzip.byteLength` — what the presign request must declare. */
+    sizeBytes: number;
+    /** How many files contributed at least one chunk. */
+    fileCount: number;
+    /** True when the size cap stopped collection before every file was read. */
+    truncated: boolean;
+    /** Raw (pre-compression, post-redaction) bytes read into the bundle. */
+    rawBytes: number;
+    /** Total redacted spans across every file. Non-zero is expected and fine. */
+    redactions: number;
+}
+/**
+ * What a submission records about its uploaded bundle. Must stay in step with
+ * `LogBundleRef` in the hq-pro handler `feedback-log-bundles.ts`, which
+ * re-validates every field before persisting it.
+ */
+export interface LogBundleRef {
+    key: string;
+    sizeBytes: number;
+    fileCount: number;
+    truncated: boolean;
+}
+export interface BuildLogBundleOptions {
+    /** Compressed ceiling. Clamped to {@link LOG_BUNDLE_MAX_BYTES}. */
+    maxBytes?: number;
+    /** Override `~/.hq` (tests). */
+    hqDir?: string;
+    /** Override the home directory used to derive `~/.hq` (tests). */
+    homeDir?: string;
+    /** Override the per-file raw ceiling (tests). */
+    maxFileRawBytes?: number;
+}
+/**
+ * Order candidates so that, when the cap truncates collection, what survives is
+ * what a triager reads first.
+ *
+ * State documents lead: they are tiny and answer questions a log cannot (which
+ * operation is claimed, what the sync cursor is). Log files follow, newest
+ * first. Reversing this would let one large old log crowd out every status
+ * file — the same class of ordering defect that let ordinary lock entries
+ * crowd out a stale claim in the inline collector.
+ */
+export declare function orderBundleCandidates(hqDir: string): LogCandidate[];
+/**
+ * Read `absPath` in slices, redacting whole lines, invoking `onChunk` with
+ * roughly {@link CHUNK_TEXT_BYTES} of redacted text at a time.
+ *
+ * Reads from the tail when the file exceeds `maxRawBytes`, and drops the first
+ * partial line after seeking so a chunk never begins mid-record. `onChunk`
+ * returns false to stop early (the cap was hit).
+ */
+export declare function streamRedactedFile(absPath: string, sizeBytes: number, maxRawBytes: number, chunkBytes: number, onChunk: (text: string, redactions: number) => Promise<boolean>): Promise<{
+    fromTail: boolean;
+    stopped: boolean;
+}>;
+/**
+ * Build a gzipped NDJSON bundle of the submitter's redacted `~/.hq` logs.
+ *
+ * Returns `undefined` when nothing eligible exists, so the caller can skip the
+ * upload entirely. Never throws: a bug report must not fail over its own
+ * diagnostics, so any unexpected error yields `undefined` and the submission
+ * proceeds with inline logs alone.
+ */
+export declare function buildLogBundle(opts?: BuildLogBundleOptions): Promise<LogBundleResult | undefined>;
+/**
+ * Build, presign, and upload a log bundle; return the reference the submission
+ * should carry, or `undefined` if anything at all did not work out.
+ *
+ * Every failure path is silent and non-fatal by design. The bundle is an
+ * enrichment on top of the inline logs that already ship in the request body,
+ * so a missing endpoint, a disabled bucket, a refused presign, or a failed PUT
+ * must all degrade to "submit without it" rather than cost the user their bug
+ * report. In particular a 404 is expected and unremarkable while a CLI that
+ * knows about bundles is running against a server that does not yet.
+ */
+export declare function uploadLogBundle(opts: {
+    token: string;
+    enabled: boolean;
+    fetchImpl?: typeof fetch;
+    build?: typeof buildLogBundle;
+    apiFetch?: typeof vaultApiFetch;
+}): Promise<LogBundleRef | undefined>;
+//# sourceMappingURL=feedback-log-bundle.d.ts.map