@lacneu/atrium-mcp 0.30.0

package/dist/server.js

@@ -0,0 +1,250 @@
+#!/usr/bin/env node
+/**
+ * atrium MCP server (stdio).
+ *
+ * A thin proxy over our /api/v1 observability surface. It carries an `oc_live_`
+ * Bearer key (from OPENCLAW_WEBCHAT_API_KEY) against the deployment `.site`
+ * origin (OPENCLAW_WEBCHAT_API_BASE) and exposes traces/KPIs/OpenClaw queries/
+ * anomalies as MCP tools for OpenClaw agents.
+ *
+ * It imports NOTHING from the Convex app — HTTP only. Each tool maps 1:1 to a
+ * permission enforced server-side (`requirePermission`), so a scoped key simply
+ * gets a 403 for tools it isn't allowed to call. A tool whose route is not yet
+ * deployed returns the API's response/error gracefully rather than crashing.
+ */
+import { createRequire } from "node:module";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { ApiError, resolveConfig } from "./config.js";
+import { getChatState, getChatStateInput, getFeedbackReport, getFeedbackReportInput, getCompactionHistory, getCompactionHistoryInput, getTraceEnrichment, getTraceEnrichmentInput, diagnoseChat, diagnoseChatInput, reconcileChat, reconcileChatInput, getCompat, bridgeStatus, syncInstance, syncInstanceInput, getIntegrations, getKpi, getKpiInput, getSchema, getSchemaInput, health, listAnomalies, listAnomaliesInput, listSchemas, listTraces, listTracesInput, queryOpenClaw, queryOpenClawInput, reportAnomaly, reportAnomalyInput, startDeliveryRecord, stopDeliveryRecord, getDeliveryReport, getDeliveryReportInput, listDeliverySessions, deleteDeliverySessions, deleteDeliverySessionsInput, } from "./tools.js";
+// The MCP server's own version, read from package.json at startup. createRequire
+// (not a static JSON import) because tsconfig.build.json roots at src/ and a
+// static import of ../package.json would escape rootDir — same idiom as the bridge
+// (bridge/src/compat.ts). Lockstep with the repo's single version, stamped from the
+// git tag at release time (scripts/set-version.mjs); "0.0.0" only as a last resort.
+const pkg = createRequire(import.meta.url)("../package.json");
+const MCP_VERSION = typeof pkg.version === "string" && pkg.version.length > 0
+    ? pkg.version
+    : "0.0.0";
+/** Wrap a tool call: stringify JSON on success, surface ApiError as text. */
+async function run(fn) {
+    try {
+        const value = await fn();
+        return {
+            content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
+        };
+    }
+    catch (err) {
+        if (err instanceof ApiError) {
+            const bodyText = typeof err.body === "string"
+                ? err.body
+                : JSON.stringify(err.body, null, 2);
+            return {
+                content: [
+                    { type: "text", text: `API error ${err.status}: ${bodyText}` },
+                ],
+                isError: true,
+            };
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            content: [{ type: "text", text: `Error: ${message}` }],
+            isError: true,
+        };
+    }
+}
+function main() {
+    // Resolve config up front so a missing key fails fast with a clear message
+    // (the message names the env var, never its value).
+    const config = resolveConfig();
+    const server = new McpServer({
+        name: "atrium-observability",
+        version: MCP_VERSION,
+    });
+    server.registerTool("health", {
+        title: "API health",
+        description: "Liveness probe for the /api/v1 surface (GET /health).",
+        inputSchema: {},
+    }, async () => run(() => health(config)));
+    server.registerTool("get_compat", {
+        title: "Bridge compatibility snapshot",
+        description: "Bridge version + per-instance gateway versions/capabilities (GET /compat). " +
+            "Requires bridge.read. Diagnoses 'version gateway inconnue': empty targets " +
+            "or a null gatewayVersion gates AgentFiles/ChatDefaults off.",
+        inputSchema: {},
+    }, async () => run(() => getCompat(config)));
+    server.registerTool("bridge_status", {
+        title: "Per-instance bridge/gateway health",
+        description: "A CLEAR per-instance bridge<->gateway health view (GET /bridge-status). " +
+            "Requires bridge.read. Per instance: bridgeUrlConfigured, a health verdict " +
+            "(ok|error|stale|unknown|no_bridge_url, from THIS instance's own signals — not the " +
+            "global bridge state) + degraded, gatewayVersion + gatewayState/lastErrorCode, " +
+            "agentCount + discovery freshness. The fast 'what's wrong with my instances' check " +
+            "— e.g. bridgeUrlConfigured:false is exactly why a sync returns no_bridge_url.",
+        inputSchema: {},
+    }, async () => run(() => bridgeStatus(config)));
+    server.registerTool("get_integrations", {
+        title: "Observability integration status (Opik / Langfuse)",
+        description: "Per-vendor configured/enabled + non-secret effective endpoints + shipping " +
+            "cursors (lastAt/failureCount/error code), NEVER a key (GET /integrations). " +
+            "Requires traces.read. Use FIRST when self-diagnosing: it tells an agent " +
+            "whether enriched Opik/Langfuse trace data is available and shipping is healthy.",
+        inputSchema: {},
+    }, async () => run(() => getIntegrations(config)));
+    server.registerTool("get_feedback_report", {
+        title: "Read a user-submitted report",
+        description: "One feedback report by its shareable reference (GET /feedback-report). " +
+            "Key must have traces.read. Returns the FROZEN forensic snapshot the " +
+            "reporter volunteered (message text/parts, prompt, bounded context, " +
+            "session settings) + chatExists/messageExists flags — the report " +
+            "survives deletion of its message or chat.",
+        inputSchema: getFeedbackReportInput,
+    }, async (args) => run(() => getFeedbackReport(config, args)));
+    server.registerTool("get_chat_state", {
+        title: "Inspect chat state",
+        description: "Per-message lifecycle of one chat (GET /chat-state). Key must have " +
+            "traces.read. METADATA ONLY (no message text). Exposes a stuck-streaming " +
+            "turn: a message with status 'streaming' + large ageSeconds " +
+            "(stuckStreaming:true) = the bridge never relayed its finalize frame. Each " +
+            "provenance part carries a SOC2-safe `structure` (per-item kind " +
+            "document|context|memory + hasFileName/hasScore booleans, itemCount, " +
+            "hasExcerpts, allowlisted source/retrievalRoute) — diagnose a Sources panel " +
+            "issue ('documents show no score/excerpt' = a bare lightrag attribution turn: " +
+            "kind document + hasScore:false) without any content.",
+        inputSchema: getChatStateInput,
+    }, async (args) => run(() => getChatState(config, args)));
+    server.registerTool("get_compaction_history", {
+        title: "Gateway compaction history",
+        description: "The gateway's compaction checkpoints for one chat's session (GET " +
+            "/compaction-history). Key must have traces.read. LAZY read (on-demand " +
+            "gateway RPC — never on the turn path). CONTENT-FREE: per checkpoint " +
+            "{checkpointId, createdAt, reason, tokensBefore, tokensAfter}; the stored " +
+            "summary text never crosses the API. Pair with list_traces " +
+            "kind=chat.gateway_pressure (per-turn fill ratio + compaction flag) to see " +
+            "WHEN a session filled up and WHAT each compaction condensed.",
+        inputSchema: getCompactionHistoryInput,
+    }, async (args) => run(() => getCompactionHistory(config, args)));
+    server.registerTool("list_schemas", {
+        title: "List published contract schemas",
+        description: "The machine-readable CONTRACT schemas an integration author can conform to " +
+            "(GET /schemas). Metadata only (id, title, version, category) — provenance/v1 " +
+            "today, more as the surface grows. PUBLIC (no key required). Use get_schema to " +
+            "fetch one.",
+        inputSchema: {},
+    }, async () => run(() => listSchemas(config)));
+    server.registerTool("get_schema", {
+        title: "Get a published contract schema",
+        description: "One contract schema's JSON by registry id (GET /schemas/:id), e.g. " +
+            "\"provenance.v1\" — validate a plugin's emitted reports against it. PUBLIC " +
+            "(no key required). 404 for an unknown id.",
+        inputSchema: getSchemaInput,
+    }, async (args) => run(() => getSchema(config, args)));
+    server.registerTool("get_trace_enrichment", {
+        title: "Enriched trace structure (Opik / Langfuse)",
+        description: "SOC2-safe STRUCTURE of a turn's trace (keyed by its correlationId) " +
+            "fetched from the configured Opik/Langfuse: span " +
+            "names/types/lifecycle/timing/parent tree, NEVER input/output/message " +
+            "text (GET /trace-enrichment). Requires traces.read. Get the correlationId " +
+            "from list_traces/list_anomalies, then use this to see the REAL OpenClaw " +
+            "message structure behind an anomaly without seeing regulated data. Pass " +
+            "chatId too to also surface OTHER traces on the same chat session " +
+            "(content-free). Call get_integrations first to confirm a vendor is wired.",
+        inputSchema: getTraceEnrichmentInput,
+    }, async (args) => run(() => getTraceEnrichment(config, args)));
+    server.registerTool("diagnose_chat", {
+        title: "Diagnose a chat (assessment + suggested fix)",
+        description: "ONE actionable assessment of a chat (GET /diagnose): SOC2-safe chat-state " +
+            "+ bridge availability, classified (stuck_stream | dispatch_error | " +
+            "attachment_problem | bridge_unavailable | bridge_degraded | healthy) with a " +
+            "`suggestedAction` and, when safe, a `suggestedTool` (e.g. reconcile_chat). " +
+            "Requires traces.read. Read-only. CALL THIS FIRST on a user report, then act " +
+            "on the suggestion.",
+        inputSchema: diagnoseChatInput,
+    }, async (args) => run(() => diagnoseChat(config, args)));
+    server.registerTool("reconcile_chat", {
+        title: "Self-correct: release a chat's stuck stream",
+        description: "BOUNDED corrective (POST /reconcile-chat): flip this chat's stuck " +
+            "'streaming' message(s) to error (preserving text) so the hung UI releases " +
+            "and the user can retry. Requires `selfheal` (a sensitive write). Audited. " +
+            "Only touches messages already streaming past a short cutoff. Use when " +
+            "diagnose_chat returns class 'stuck_stream' / suggestedTool 'reconcile_chat'.",
+        inputSchema: reconcileChatInput,
+    }, async (args) => run(() => reconcileChat(config, args)));
+    server.registerTool("sync_instance", {
+        title: "Force an instance sync (resolve creds + pull agents)",
+        description: "Force-sync ONE instance (POST /instances/sync): poke the bridge (resolve creds " +
+            "+ connect -> pairing) then pull that instance's agents into Atrium NOW, instead " +
+            "of waiting for the discovery cron. Requires `selfheal` (admin + agent service " +
+            "roles). Returns { status, agents, detail }: status is the exact outcome (synced " +
+            "| no_agents | no_bridge_url | unreachable | unauthorized | not_served | " +
+            "deploy_misconfigured) and detail is a plain-English explanation to act on.",
+        inputSchema: syncInstanceInput,
+    }, async (args) => run(() => syncInstance(config, args)));
+    server.registerTool("list_traces", {
+        title: "List recent traces",
+        description: "Recent trace events (GET /traces). Key must have traces.read.",
+        inputSchema: listTracesInput,
+    }, async (args) => run(() => listTraces(config, args)));
+    server.registerTool("get_kpi", {
+        title: "Get KPI rollups",
+        description: "KPI rollups (GET /kpi). Key must have kpi.read.",
+        inputSchema: getKpiInput,
+    }, async (args) => run(() => getKpi(config, args)));
+    server.registerTool("query_openclaw", {
+        title: "Query OpenClaw",
+        description: "Query OpenClaw via the bridge (POST /openclaw/query). " +
+            "Key must have openclaw.query.",
+        inputSchema: queryOpenClawInput,
+    }, async (args) => run(() => queryOpenClaw(config, args)));
+    server.registerTool("list_anomalies", {
+        title: "List anomalies",
+        description: "Detected anomalies (GET /anomalies). Key must have anomalies.read.",
+        inputSchema: listAnomaliesInput,
+    }, async (args) => run(() => listAnomalies(config, args)));
+    server.registerTool("report_anomaly", {
+        title: "Report an anomaly",
+        description: "Report an anomaly / self-repair signal (POST /anomalies). " +
+            "Key must have anomalies.report.",
+        inputSchema: reportAnomalyInput,
+    }, async (args) => run(() => reportAnomaly(config, args)));
+    server.registerTool("start_delivery_record", {
+        title: "Start delivery-latency recording",
+        description: "Start a delivery-latency recording session (POST /delivery-record/start). " +
+            "Measures the bridge->Convex->frontend streaming pipeline per delta, content-free. " +
+            "Requires selfheal (activation is a privileged write). Returns { sessionId, " +
+            "autoStopAt }; auto-stops after ~10 min. Run a chat turn while active, then " +
+            "get_delivery_report.",
+        inputSchema: {},
+    }, async () => run(() => startDeliveryRecord(config)));
+    server.registerTool("stop_delivery_record", {
+        title: "Stop delivery-latency recording",
+        description: "Stop the active delivery-latency recording (POST /delivery-record/stop). " +
+            "Requires selfheal.",
+        inputSchema: {},
+    }, async () => run(() => stopDeliveryRecord(config)));
+    server.registerTool("get_delivery_report", {
+        title: "Delivery-latency report",
+        description: "Skew-corrected per-segment latency for a recording session (GET /delivery-report): " +
+            "A=bridge->Convex, B=Convex exec, C=Convex->frontend, each p50/p95/max + count. " +
+            "C.count <= A.count by design (the client only observes coalesced states). " +
+            "Requires traces.read. Omit sessionId for the active/latest session.",
+        inputSchema: getDeliveryReportInput,
+    }, async (args) => run(() => getDeliveryReport(config, args)));
+    server.registerTool("list_delivery_sessions", {
+        title: "List delivery-latency recording sessions",
+        description: "List recent delivery-latency recording sessions (GET /delivery-sessions): " +
+            "sessionId, startedAt, stoppedAt, startedBy, active. Requires traces.read. " +
+            "Pick a sessionId for get_delivery_report or delete_delivery_sessions.",
+        inputSchema: {},
+    }, async () => run(() => listDeliverySessions(config)));
+    server.registerTool("delete_delivery_sessions", {
+        title: "Delete delivery-latency recording sessions",
+        description: "Delete recording sessions and their timing rows (POST /delivery-record/delete). " +
+            "Requires selfheal. Deleting the active session also stops recording.",
+        inputSchema: deleteDeliverySessionsInput,
+    }, async (args) => run(() => deleteDeliverySessions(config, args)));
+    const transport = new StdioServerTransport();
+    void server.connect(transport);
+}
+main();
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,MAAM,EACN,WAAW,EACX,SAAS,EACT,cAAc,EACd,MAAM,EACN,aAAa,EACb,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,6EAA6E;AAC7E,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AACpF,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAE3D,CAAC;AACF,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;IACvD,CAAC,CAAC,GAAG,CAAC,OAAO;IACb,CAAC,CAAC,OAAO,CAAC;AAOd,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,EAA0B;IAC3C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAC1B,CAAC,CAAC,GAAG,CAAC,IAAI;gBACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,EAAE;iBAC/D;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,IAAI;IACX,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CACjB,QAAQ,EACR;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,uDAAuD;QACpE,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CACtC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EACT,6EAA6E;YAC7E,4EAA4E;YAC5E,6DAA6D;QAC/D,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CACzC,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,oCAAoC;QAC3C,WAAW,EACT,0EAA0E;YAC1E,4EAA4E;YAC5E,oFAAoF;YACpF,gFAAgF;YAChF,oFAAoF;YACpF,+EAA+E;QACjF,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAC5C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,kBAAkB,EAClB;QACE,KAAK,EAAE,oDAAoD;QAC3D,WAAW,EACT,4EAA4E;YAC5E,6EAA6E;YAC7E,0EAA0E;YAC1E,iFAAiF;QACnF,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,yEAAyE;YACzE,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,2CAA2C;QAC7C,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAC3D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,qEAAqE;YACrE,0EAA0E;YAC1E,6DAA6D;YAC7D,4EAA4E;YAC5E,iEAAiE;YACjE,sEAAsE;YACtE,6EAA6E;YAC7E,+EAA+E;YAC/E,sDAAsD;QACxD,WAAW,EAAE,iBAAiB;KAC/B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,mEAAmE;YACnE,wEAAwE;YACxE,sEAAsE;YACtE,2EAA2E;YAC3E,4DAA4D;YAC5D,4EAA4E;YAC5E,8DAA8D;QAChE,WAAW,EAAE,yBAAyB;KACvC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAC9D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,cAAc,EACd;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,6EAA6E;YAC7E,+EAA+E;YAC/E,gFAAgF;YAChF,YAAY;QACd,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,YAAY,EACZ;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,qEAAqE;YACrE,6EAA6E;YAC7E,2CAA2C;QAC7C,WAAW,EAAE,cAAc;KAC5B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,qEAAqE;YACrE,kDAAkD;YAClD,uEAAuE;YACvE,4EAA4E;YAC5E,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,2EAA2E;QAC7E,WAAW,EAAE,uBAAuB;KACrC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAC5D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,8CAA8C;QACrD,WAAW,EACT,4EAA4E;YAC5E,qEAAqE;YACrE,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,oBAAoB;QACtB,WAAW,EAAE,iBAAiB;KAC/B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,6CAA6C;QACpD,WAAW,EACT,oEAAoE;YACpE,4EAA4E;YAC5E,4EAA4E;YAC5E,wEAAwE;YACxE,8EAA8E;QAChF,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,eAAe,EACf;QACE,KAAK,EAAE,sDAAsD;QAC7D,WAAW,EACT,iFAAiF;YACjF,kFAAkF;YAClF,gFAAgF;YAChF,kFAAkF;YAClF,0EAA0E;YAC1E,4EAA4E;QAC9E,WAAW,EAAE,iBAAiB;KAC/B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EACT,+DAA+D;QACjE,WAAW,EAAE,eAAe;KAC7B,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACpD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,SAAS,EACT;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,iDAAiD;QACnD,WAAW,EAAE,WAAW;KACzB,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAChD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,wDAAwD;YACxD,+BAA+B;QACjC,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,oEAAoE;QACtE,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,gBAAgB,EAChB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACT,4DAA4D;YAC5D,iCAAiC;QACnC,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CACvD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,uBAAuB,EACvB;QACE,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,4EAA4E;YAC5E,oFAAoF;YACpF,6EAA6E;YAC7E,6EAA6E;YAC7E,sBAAsB;QACxB,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,2EAA2E;YAC3E,oBAAoB;QACtB,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAClD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,qBAAqB,EACrB;QACE,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,qFAAqF;YACrF,iFAAiF;YACjF,4EAA4E;YAC5E,qEAAqE;QACvE,WAAW,EAAE,sBAAsB;KACpC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAC3D,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,wBAAwB,EACxB;QACE,KAAK,EAAE,0CAA0C;QACjD,WAAW,EACT,4EAA4E;YAC5E,4EAA4E;YAC5E,uEAAuE;QACzE,WAAW,EAAE,EAAE;KAChB,EACD,KAAK,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CACpD,CAAC;IAEF,MAAM,CAAC,YAAY,CACjB,0BAA0B,EAC1B;QACE,KAAK,EAAE,4CAA4C;QACnD,WAAW,EACT,kFAAkF;YAClF,sEAAsE;QACxE,WAAW,EAAE,2BAA2B;KACzC,EACD,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAChE,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/tools.d.ts

@@ -0,0 +1,341 @@
+/**
+ * Shared tool logic for both the MCP server and the CLI.
+ *
+ * Each function here maps 1:1 to one /api/v1 route. The package is a thin proxy:
+ * whether a route is deployed is a *runtime* concern — a not-yet-deployed route
+ * returns the API's own response/error (e.g. 404) which we surface, rather than
+ * crashing the server.
+ *
+ * Server-side `requirePermission` enforces the key's scope, so a tool call to a
+ * route the key lacks permission for naturally returns 403.
+ */
+import { z } from "zod";
+import { type ApiFetchOptions, type Config } from "./config.js";
+export interface ListTracesArgs {
+    limit?: number;
+    /** Case-insensitive substring over kind/principalId/roleKey/route/correlationId. */
+    q?: string;
+    /** Lower time bound: epoch ms OR Grafana relative token (e.g. `now-24h`). */
+    from?: string;
+    /** Upper time bound: epoch ms OR Grafana relative token (e.g. `now`). */
+    to?: string;
+    kind?: string;
+    /** Exact HTTP status code (e.g. 404). */
+    status?: number;
+    /** HTTP status class. */
+    statusClass?: "2xx" | "4xx" | "5xx";
+    direction?: string;
+    principalType?: string;
+    roleKey?: string;
+    correlationId?: string;
+}
+export interface GetKpiArgs {
+    metric?: string;
+    since?: string;
+    /** Lower time bound: epoch ms OR Grafana relative token (e.g. `now-24h`). */
+    from?: string;
+    /** Upper time bound: epoch ms OR Grafana relative token (e.g. `now`). */
+    to?: string;
+}
+export interface QueryOpenClawArgs {
+    /** Matches the server contract: POST /api/v1/openclaw/query reads `question`. */
+    question?: string;
+    /** Free-form passthrough the route forwards to the bridge action. */
+    payload?: unknown;
+}
+export interface ListAnomaliesArgs {
+    limit?: number;
+    since?: string;
+    /** Case-insensitive substring over message/kind/correlationId. */
+    q?: string;
+    /** Lower time bound: epoch ms OR Grafana relative token (e.g. `now-24h`). */
+    from?: string;
+    /** Upper time bound: epoch ms OR Grafana relative token (e.g. `now`). */
+    to?: string;
+    /** Anomaly status (maps to anomalyStatus, e.g. 'open'|'acknowledged'). */
+    status?: string;
+    severity?: string;
+    source?: string;
+    kind?: string;
+}
+export interface ReportAnomalyArgs {
+    kind: string;
+    /** Server accepts only info|warn|critical (400 otherwise). */
+    severity: "info" | "warn" | "critical";
+    message: string;
+    correlationId?: string;
+    /** Maps to the server's `evidence` field (non-PHI structured context). */
+    evidence?: unknown;
+}
+/**
+ * Shared MCP input schemas, kept here (not in server.ts) so they can be unit
+ * tested without importing server.ts/cli.ts — both of which call `main()` at
+ * module load. server.ts spreads these into `registerTool({ inputSchema })`.
+ */
+export declare const queryOpenClawInput: {
+    readonly question: z.ZodOptional<z.ZodString>;
+    readonly payload: z.ZodOptional<z.ZodUnknown>;
+};
+export declare const reportAnomalyInput: {
+    readonly kind: z.ZodString;
+    readonly severity: z.ZodEnum<{
+        info: "info";
+        warn: "warn";
+        critical: "critical";
+    }>;
+    readonly message: z.ZodString;
+    readonly correlationId: z.ZodOptional<z.ZodString>;
+    readonly evidence: z.ZodOptional<z.ZodUnknown>;
+};
+export declare const getDeliveryReportInput: {
+    readonly sessionId: z.ZodOptional<z.ZodString>;
+};
+export declare const deleteDeliverySessionsInput: {
+    readonly sessionIds: z.ZodArray<z.ZodString>;
+};
+export declare const listTracesInput: {
+    readonly limit: z.ZodOptional<z.ZodNumber>;
+    readonly q: z.ZodOptional<z.ZodString>;
+    readonly from: z.ZodOptional<z.ZodString>;
+    readonly to: z.ZodOptional<z.ZodString>;
+    readonly kind: z.ZodOptional<z.ZodString>;
+    readonly status: z.ZodOptional<z.ZodNumber>;
+    readonly statusClass: z.ZodOptional<z.ZodEnum<{
+        "2xx": "2xx";
+        "4xx": "4xx";
+        "5xx": "5xx";
+    }>>;
+    readonly direction: z.ZodOptional<z.ZodString>;
+    readonly principalType: z.ZodOptional<z.ZodString>;
+    readonly roleKey: z.ZodOptional<z.ZodString>;
+    readonly correlationId: z.ZodOptional<z.ZodString>;
+};
+export declare const getKpiInput: {
+    readonly metric: z.ZodOptional<z.ZodString>;
+    readonly since: z.ZodOptional<z.ZodString>;
+    readonly from: z.ZodOptional<z.ZodString>;
+    readonly to: z.ZodOptional<z.ZodString>;
+};
+export declare const listAnomaliesInput: {
+    readonly limit: z.ZodOptional<z.ZodNumber>;
+    readonly since: z.ZodOptional<z.ZodString>;
+    readonly q: z.ZodOptional<z.ZodString>;
+    readonly from: z.ZodOptional<z.ZodString>;
+    readonly to: z.ZodOptional<z.ZodString>;
+    readonly status: z.ZodOptional<z.ZodString>;
+    readonly severity: z.ZodOptional<z.ZodString>;
+    readonly source: z.ZodOptional<z.ZodString>;
+    readonly kind: z.ZodOptional<z.ZodString>;
+};
+export declare const getFeedbackReportInput: {
+    feedbackId: z.ZodString;
+};
+/**
+ * GET /api/v1/feedback-report — one user-submitted report by its shareable
+ * REFERENCE. Returns the frozen forensic snapshot (message text/parts, prompt,
+ * context window, session settings — volunteered by the reporter) + survival
+ * flags (chatExists/messageExists: the report OUTLIVES message/chat deletion).
+ * Requires `traces.read`.
+ */
+export declare function getFeedbackReport(config: Config, args: {
+    feedbackId: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+export declare const getChatStateInput: {
+    readonly chatId: z.ZodString;
+};
+export declare const getCompactionHistoryInput: {
+    readonly chatId: z.ZodString;
+};
+export declare const getSchemaInput: {
+    readonly id: z.ZodString;
+};
+export declare const getTraceEnrichmentInput: {
+    readonly correlationId: z.ZodString;
+    readonly chatId: z.ZodOptional<z.ZodString>;
+    readonly at: z.ZodOptional<z.ZodNumber>;
+};
+export interface GetTraceEnrichmentArgs {
+    correlationId: string;
+    chatId?: string;
+    at?: number;
+}
+export declare const diagnoseChatInput: {
+    readonly chatId: z.ZodString;
+};
+export declare const reconcileChatInput: {
+    readonly chatId: z.ZodString;
+};
+export declare const syncInstanceInput: {
+    readonly instance: z.ZodString;
+};
+/** GET /api/v1/health — liveness probe (no auth needed, but we send the key). */
+export declare function health(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/compat — the bridge compatibility snapshot (reachable,
+ * bridgeVersion, per-instance targets + their gatewayVersion). Requires
+ * `bridge.read`. Diagnoses the "version gateway inconnue" gating: empty
+ * `targets` (or a `gatewayVersion: null` target) is what gates AgentFiles /
+ * ChatDefaults off.
+ */
+export declare function getCompat(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/bridge-status — a CLEAR per-instance bridge<->gateway health view: per
+ * instance `bridgeUrlConfigured`, `available`/`degraded` + `reason`, `gatewayVersion` +
+ * `gatewayState`/`lastErrorCode`, `agentCount` + discovery freshness. Requires
+ * `bridge.read`. The fast "what's wrong with my instances" check — e.g. an instance with
+ * `bridgeUrlConfigured:false` is exactly why a sync returns `no_bridge_url`.
+ */
+export declare function bridgeStatus(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/integrations — Opik/Langfuse integration status: per vendor
+ * `configured`/`enabled` + the NON-SECRET effective endpoints + the shipping
+ * cursors (lastAt/failureCount/error code). NEVER a key. Requires `traces.read`.
+ * The self-correction loop's first step: an agent learns whether enriched
+ * observability data is available (and shipping is healthy) before asking for it.
+ */
+export declare function getIntegrations(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/chat-state — per-message lifecycle of one chat (METADATA ONLY: no
+ * text). Requires `traces.read`. Exposes the stuck-streaming signal: a message
+ * `status:"streaming"` with a large `ageSeconds` (`stuckStreaming:true`) is a
+ * turn whose finalize frame the bridge never relayed. A provenance part also
+ * carries a SOC2-safe `structure` (per-item kind + hasFileName/hasScore booleans,
+ * counts, allowlisted source/route) for diagnosing the Sources panel content-free.
+ *
+ * TURN RECONSTRUCTION (content-free): per message, `outbox:{outboxId,status}` is
+ * the dispatch JOIN KEY — `chatId:outboxId` is the correlationId of that turn's
+ * chat.send / openclaw.dispatch (and openclaw.rehydrate) traces, so list_traces
+ * stitches a message to its dispatch chain. NOTE on `outbox:null`: it means EITHER
+ * no outbox row (an assistant message — only user turns dispatch) OR a user message
+ * older than the per-status read cap; when top-level `outboxTruncated` is true, read
+ * null on an OLDER user message as "beyond the cap", NOT as "never dispatched". The
+ * most-recent user turns are always covered. Per message, `routedInstanceName` /
+ * `routedAgentId` give the per-turn routed agent (null = the chat's primary).
+ * Chat-level `routing` (perTurnRouting + lastRouted* + the opaque `routingSegment`)
+ * shows whether/where the chat fans turns to specialists. `subAgents` is the
+ * content-free delegation summary: `byStatus` counts + capped `failedSample` /
+ * `runningSample` (each = childIdShort + status enum + errorCategory enum +
+ * hasTaskName bool + ageSeconds — NEVER the task/result/error text or phase).
+ */
+export declare function getChatState(config: Config, args: {
+    chatId: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/compaction-history — the gateway's compaction checkpoints for one
+ * chat's session (LAZY: the only caller of the gateway's sessions.compaction.list,
+ * never on the turn path). Requires `traces.read`. CONTENT-FREE: each checkpoint =
+ * {checkpointId, createdAt, reason, tokensBefore, tokensAfter} — the stored summary
+ * (conversation content) never crosses this API. Correlate with the per-turn
+ * `chat.gateway_pressure` traces (list_traces kind=chat.gateway_pressure): pressure
+ * shows WHEN the session filled up + which turn compacted; this shows what each
+ * compaction condensed (e.g. reason "auto-threshold", 19698 -> 1050 tokens).
+ */
+export declare function getCompactionHistory(config: Config, args: {
+    chatId: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/schemas — the published CONTRACT schemas an integration author can
+ * conform to (provenance/v1 today; more as the surface grows). Metadata list (id,
+ * title, version, category). PUBLIC (no key required). The discovery step before
+ * fetching one schema with get_schema.
+ */
+export declare function listSchemas(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/schemas/:id — one published contract schema's JSON (e.g.
+ * "provenance.v1"), to validate a plugin's emitted reports against. PUBLIC (no key
+ * required). 404 for an unknown id.
+ */
+export declare function getSchema(config: Config, args: {
+    id: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/trace-enrichment — the SOC2-safe STRUCTURE of a turn's trace (keyed
+ * by its correlationId) from the configured Opik/Langfuse: span
+ * names/types/lifecycle/timing/parent tree, NEVER input/output/message
+ * text/metadata. Requires `traces.read`. The self-correction loop's deep read: an
+ * agent sees the REAL OpenClaw message structure behind an anomaly without ever
+ * seeing regulated data.
+ */
+export declare function getTraceEnrichment(config: Config, args: GetTraceEnrichmentArgs, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/diagnose — ONE actionable assessment of a chat for the
+ * self-correction loop: SOC2-safe chat-state + bridge availability, classified
+ * (stuck_stream | dispatch_error | attachment_problem | subagent_stuck |
+ * subagent_failure | bridge_unavailable | bridge_degraded | healthy) with a
+ * `suggestedAction` and, when a safe corrective exists, a `suggestedTool`.
+ * `subagent_stuck` (a delegated sub-agent running far too long — a main turn
+ * awaiting it can hang) and `subagent_failure` (a recent failed delegation) read
+ * the new chat-state `subAgents` summary. Requires `traces.read`. Read-only. Call
+ * FIRST on a user report, then act on the suggestion.
+ */
+export declare function diagnoseChat(config: Config, args: {
+    chatId: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/reconcile-chat — the BOUNDED corrective `diagnose` may recommend:
+ * flip this chat's stuck 'streaming' message(s) to error (preserving text),
+ * releasing the hung UI so the user can retry. Requires `selfheal` (a sensitive
+ * write). Audited. Only touches messages already streaming past a short cutoff.
+ */
+export declare function reconcileChat(config: Config, args: {
+    chatId: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/instances/sync — force an instance sync: poke the bridge (resolve creds +
+ * connect -> pairing) then pull THAT instance's agents into Atrium NOW, instead of waiting
+ * for the discovery cron. Requires `selfheal` (the admin + agent service-account roles).
+ * Returns `{ status, agents, detail }` — `status` is the exact outcome (synced | no_agents
+ * | no_bridge_url | unreachable | unauthorized | not_served | deploy_misconfigured) and
+ * `detail` is a plain-English explanation an agent can act on.
+ */
+export declare function syncInstance(config: Config, args: {
+    instance: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/delivery-record/start — start a delivery-latency recording session
+ * (measures the bridge->Convex->frontend streaming pipeline, per delta, content-free).
+ * Requires `selfheal` (activation is a privileged write). Returns { sessionId,
+ * autoStopAt }; the session auto-stops after ~10 min.
+ */
+export declare function startDeliveryRecord(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/** POST /api/v1/delivery-record/stop — stop the active recording. Requires `selfheal`. */
+export declare function stopDeliveryRecord(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/delivery-report — skew-corrected per-segment latency for a recording
+ * session: A=bridge->Convex, B=Convex exec, C=Convex->frontend (p50/p95/max + counts;
+ * C.count <= A.count by design, since the client only observes coalesced states).
+ * Requires `traces.read`. Omit sessionId for the active (or most recent) session.
+ */
+export declare function getDeliveryReport(config: Config, args: {
+    sessionId?: string;
+}, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * GET /api/v1/delivery-sessions — list recent recording sessions (sessionId,
+ * startedAt, stoppedAt, startedBy, active). Requires `traces.read`. Use to pick a
+ * sessionId for get_delivery_report or delete_delivery_sessions.
+ */
+export declare function listDeliverySessions(config: Config, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/delivery-record/delete — delete recording sessions and their timing
+ * rows. Requires `selfheal`. Deleting the active session also stops recording.
+ */
+export declare function deleteDeliverySessions(config: Config, args: {
+    sessionIds: string[];
+}, options?: ApiFetchOptions): Promise<unknown>;
+/** GET /api/v1/traces — recent trace events. Requires `traces.read`. */
+export declare function listTraces(config: Config, args?: ListTracesArgs, options?: ApiFetchOptions): Promise<unknown>;
+/** GET /api/v1/kpi — KPI rollups. Requires `kpi.read`. */
+export declare function getKpi(config: Config, args?: GetKpiArgs, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/openclaw/query — query OpenClaw via the bridge.
+ * Requires `openclaw.query`. Sends `{ question, payload }` (the only keys the
+ * server route reads; it 400s when both are undefined).
+ */
+export declare function queryOpenClaw(config: Config, args?: QueryOpenClawArgs, options?: ApiFetchOptions): Promise<unknown>;
+/** GET /api/v1/anomalies — detected anomalies. Requires `anomalies.read`. */
+export declare function listAnomalies(config: Config, args?: ListAnomaliesArgs, options?: ApiFetchOptions): Promise<unknown>;
+/**
+ * POST /api/v1/anomalies — report an anomaly. Requires
+ * `anomalies.report`. Sends `evidence` (the server's field name), not `details`.
+ */
+export declare function reportAnomaly(config: Config, args: ReportAnomalyArgs, options?: ApiFetchOptions): Promise<unknown>;