@namzu/cli 11.0.0 → 12.0.1

package/dist/doctor/checks/index.js

@@ -1,11 +1,46 @@
+import { capabilityCheckId } from '../../context/capabilities.js';
 import { providerChainCheck } from './chain.js';
 import { credentialSourcesCheck } from './credentials.js';
+import { invariantsCheck } from './invariants.js';
+import { loggingPipelineCheck } from './logging.js';
 import { providersRegisteredCheck } from './providers.js';
 import { cwdWritableCheck, tmpdirWritableCheck } from './runtime.js';
 import { sandboxPlatformCheck } from './sandbox.js';
-import { telemetryInstalledCheck } from './telemetry.js';
+import { describeInstalledPackage, telemetryInstalledCheck } from './telemetry.js';
 import { vaultRegisteredCheck } from './vault.js';
-export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
+/**
+ * Build an `installed` check for one optional package, over the same
+ * absent/present/broken mapping `telemetryInstalledCheck` already used.
+ *
+ * `telemetryInstalledCheck` keeps its own hand-written definition below
+ * rather than being rebuilt through this factory — it shipped first, and
+ * `doctor/checks/__tests__/telemetry.test.ts` already exercises that exact
+ * object with zero edits required by NZ-BOOT-02. A fifth optional package
+ * needs one call to this factory, not a fourth hand-written check that can
+ * drift from the other three.
+ */
+function installedCheck(specifier, category) {
+    return {
+        id: capabilityCheckId(specifier),
+        category,
+        run: () => describeInstalledPackage(specifier),
+    };
+}
+// `sandboxPlatformCheck` already owns the `sandbox` category for a different
+// question (does THIS PLATFORM enforce isolation); this check asking IS THE
+// PACKAGE HERE fits the same category. `DoctorCategory` has no `files` or
+// `computer-use` member, and widening that union is an SDK type change this
+// task does not make, so those two register under `custom` — the category
+// the registry's own tests already use for exactly this situation.
+export const sandboxInstalledCheck = installedCheck('@namzu/sandbox', 'sandbox');
+export const filesInstalledCheck = installedCheck('@namzu/files', 'custom');
+export const computerUseInstalledCheck = installedCheck('@namzu/computer-use', 'custom');
+// NOTE the fix versus the original submission: sandboxInstalledCheck /
+// filesInstalledCheck / computerUseInstalledCheck are NOT repeated here.
+// They already carry their own `export` keyword above; naming them again in
+// this aggregation block is a duplicate-export declaration and fails
+// `tsc --build` with TS2323/TS2484 (confirmed by building this exact file).
+export { credentialSourcesCheck, providerChainCheck, providersRegisteredCheck, cwdWritableCheck, tmpdirWritableCheck, invariantsCheck, loggingPipelineCheck, sandboxPlatformCheck, telemetryInstalledCheck, vaultRegisteredCheck, };
 export const builtInDoctorChecks = [
     sandboxPlatformCheck,
     cwdWritableCheck,
@@ -17,6 +52,14 @@ export const builtInDoctorChecks = [
     // the operator has seen what was found.
     providerChainCheck,
     vaultRegisteredCheck,
+    sandboxInstalledCheck,
+    filesInstalledCheck,
+    computerUseInstalledCheck,
     telemetryInstalledCheck,
+    // Last, deliberately: it reports what the pipeline did to the records
+    // every check above it just produced, so running it first would report a
+    // process that had barely logged anything yet.
+    loggingPipelineCheck,
+    invariantsCheck,
 ];
 //# sourceMappingURL=index.js.map

package/dist/doctor/checks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IAC1D,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,4EAA4E;IAC5E,0EAA0E;IAC1E,wCAAwC;IACxC,kBAAkB;IAClB,oBAAoB;IACpB,uBAAuB;CACvB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/doctor/checks/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACnD,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,QAAiC;IAC3E,OAAO;QACN,EAAE,EAAE,iBAAiB,CAAC,SAAS,CAAC;QAChC,QAAQ;QACR,GAAG,EAAE,GAA+B,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;KAC1E,CAAA;AACF,CAAC;AAED,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAgB,cAAc,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAA;AAC7F,MAAM,CAAC,MAAM,mBAAmB,GAAgB,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAgB,cAAc,CACnE,qBAAqB,EACrB,QAAQ,CACR,CAAA;AAED,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,qEAAqE;AACrE,4EAA4E;AAC5E,OAAO,EACN,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,oBAAoB,GACpB,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IAC1D,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;IACxB,sBAAsB;IACtB,4EAA4E;IAC5E,0EAA0E;IAC1E,wCAAwC;IACxC,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,yBAAyB;IACzB,uBAAuB;IACvB,sEAAsE;IACtE,yEAAyE;IACzE,+CAA+C;IAC/C,oBAAoB;IACpB,eAAe;CACf,CAAA"}

package/dist/doctor/checks/invariants.d.ts

@@ -0,0 +1,23 @@
+import type { DoctorCheck, DoctorCheckResult, InvariantRegistry } from '@namzu/sdk';
+/**
+ * Evaluate every invariant `registry` holds and fold the outcomes, plus each
+ * invariant's own violation counter, into one doctor row.
+ *
+ * Exported separately from the `DoctorCheck` — same reasoning as
+ * `describeInstalledPackage` on the telemetry check — so a test can drive a
+ * SCOPED registry directly, rather than mutating the process-wide singleton
+ * every other test also reads. The check itself is still exercised through
+ * `invariantsCheck.run`, because a helper proven in isolation says nothing
+ * about whether the check reaches it.
+ *
+ * Every invariant is evaluated with `ctx: undefined`. `namzu doctor` runs
+ * with no live run and no candidate compaction reduction — there is nothing
+ * a real invariant's check could read that is specific to one run — so
+ * `undefined` is the honest context, not a shortcut: each check registered
+ * against it is written to answer `unknown` rather than guess (see
+ * `compaction.ts` and `claim-disk.ts` in `@namzu/sdk`), and this row reports
+ * that state rather than papering over it as a pass.
+ */
+export declare function describeInvariants(registry: InvariantRegistry): Promise<DoctorCheckResult>;
+export declare const invariantsCheck: DoctorCheck;
+//# sourceMappingURL=invariants.d.ts.map

package/dist/doctor/checks/invariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariants.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/invariants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAanF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyDhG;AAED,eAAO,MAAM,eAAe,EAAE,WAI7B,CAAA"}

package/dist/doctor/checks/invariants.js

@@ -0,0 +1,79 @@
+import { invariants } from '@namzu/sdk';
+function label(row) {
+    return `${row.id} (${row.violations} violation${row.violations === 1 ? '' : 's'})`;
+}
+/**
+ * Evaluate every invariant `registry` holds and fold the outcomes, plus each
+ * invariant's own violation counter, into one doctor row.
+ *
+ * Exported separately from the `DoctorCheck` — same reasoning as
+ * `describeInstalledPackage` on the telemetry check — so a test can drive a
+ * SCOPED registry directly, rather than mutating the process-wide singleton
+ * every other test also reads. The check itself is still exercised through
+ * `invariantsCheck.run`, because a helper proven in isolation says nothing
+ * about whether the check reaches it.
+ *
+ * Every invariant is evaluated with `ctx: undefined`. `namzu doctor` runs
+ * with no live run and no candidate compaction reduction — there is nothing
+ * a real invariant's check could read that is specific to one run — so
+ * `undefined` is the honest context, not a shortcut: each check registered
+ * against it is written to answer `unknown` rather than guess (see
+ * `compaction.ts` and `claim-disk.ts` in `@namzu/sdk`), and this row reports
+ * that state rather than papering over it as a pass.
+ */
+export async function describeInvariants(registry) {
+    const ids = registry.listIds();
+    if (ids.length === 0) {
+        return { status: 'skipped', message: 'no invariants registered' };
+    }
+    const rows = await Promise.all(ids.map(async (id) => ({
+        id,
+        outcome: await registry.evaluate(id, undefined),
+        violations: registry.violationCount(id),
+    })));
+    const violated = rows.filter((r) => r.outcome.state === 'violated');
+    const unknown = rows.filter((r) => r.outcome.state === 'unknown');
+    if (violated.length > 0) {
+        const detail = violated
+            .map((r) => (r.outcome.state === 'violated' ? `${label(r)}: ${r.outcome.detail}` : label(r)))
+            .join('; ');
+        return {
+            status: 'fail',
+            message: `${violated.length}/${ids.length} invariant(s) violated — ${detail}`,
+            remediation: 'Check the warn/error logs at the module that registered the violated invariant.',
+        };
+    }
+    if (unknown.length > 0) {
+        const names = unknown.map(label).join(', ');
+        // `skipped`, not `inconclusive`, and the difference is the whole
+        // behaviour of this row. `inconclusive` maps to exit 69 in
+        // `doctor/registry.ts` and means "I asked and could not establish an
+        // answer" — a real signal that something is wrong with the check
+        // itself. A runtime invariant outside a live run is a different thing:
+        // the question has no subject yet, every registered check is written
+        // to answer `unknown` here on purpose, and so this state is reached on
+        // EVERY doctor run. Reporting it as inconclusive made `namzu doctor`
+        // exit 69 unconditionally, which retires the one code that was
+        // supposed to mean something.
+        //
+        // `skipped` is not "satisfied" either — the summary counts it
+        // separately from `pass`, and the message still names which invariants
+        // went unevaluated and how many violations each has accumulated. The
+        // violation counters above are what actually carry a live run's
+        // findings back to this row.
+        return {
+            status: 'skipped',
+            message: `${unknown.length}/${ids.length} invariant(s) have no subject outside a live run: ${names}`,
+        };
+    }
+    return {
+        status: 'pass',
+        message: `${ids.length} invariant(s) hold: ${rows.map(label).join(', ')}`,
+    };
+}
+export const invariantsCheck = {
+    id: 'runtime.invariants',
+    category: 'runtime',
+    run: () => describeInvariants(invariants),
+};
+//# sourceMappingURL=invariants.js.map

package/dist/doctor/checks/invariants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invariants.js","sourceRoot":"","sources":["../../../src/doctor/checks/invariants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAQvC,SAAS,KAAK,CAAC,GAAiB;IAC/B,OAAO,GAAG,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,aAAa,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAA2B;IACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAA;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;IAClE,CAAC;IAED,MAAM,IAAI,GAAmB,MAAM,OAAO,CAAC,GAAG,CAC7C,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACtB,EAAE;QACF,OAAO,EAAE,MAAM,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;QAC/C,UAAU,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;KACvC,CAAC,CAAC,CACH,CAAA;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAA;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;IAEjE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;aAC5F,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,4BAA4B,MAAM,EAAE;YAC7E,WAAW,EACV,iFAAiF;SAClF,CAAA;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,iEAAiE;QACjE,2DAA2D;QAC3D,qEAAqE;QACrE,iEAAiE;QACjE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,8BAA8B;QAC9B,EAAE;QACF,8DAA8D;QAC9D,uEAAuE;QACvE,qEAAqE;QACrE,gEAAgE;QAChE,6BAA6B;QAC7B,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,qDAAqD,KAAK,EAAE;SACpG,CAAA;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,uBAAuB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACzE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC3C,EAAE,EAAE,oBAAoB;IACxB,QAAQ,EAAE,SAAS;IACnB,GAAG,EAAE,GAA+B,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;CACrE,CAAA"}

package/dist/doctor/checks/logging.d.ts

@@ -0,0 +1,10 @@
+import type { DoctorCheck, DoctorCheckResult, LogSinkCounters } from '@namzu/sdk';
+/**
+ * Exported separately from the check so all three outcomes can be driven
+ * directly, the same arrangement `describeInstalledPackage` uses: a check
+ * whose only entry point is `run` can be tested for the state the machine
+ * happens to be in and nothing else.
+ */
+export declare function describeLogPipeline(counters: LogSinkCounters | undefined): DoctorCheckResult;
+export declare const loggingPipelineCheck: DoctorCheck;
+//# sourceMappingURL=logging.d.ts.map

package/dist/doctor/checks/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAkCjF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,iBAAiB,CA6B5F;AAED,eAAO,MAAM,oBAAoB,EAAE,WAOlC,CAAA"}

package/dist/doctor/checks/logging.js

@@ -0,0 +1,69 @@
+import { getLogCounters } from '@namzu/sdk';
+/**
+ * What the log pipeline actually did to this process's records.
+ *
+ * `LogSinkCounters` has counted five things on every record since the sink
+ * seam landed — dropped, redacted, attributes shed, values truncated,
+ * records shrunk — and until this check nothing read any of them. That is
+ * `declared-but-undriven` with an unusually direct tell: the comment above
+ * `createLogger` promised "a caller that wants to observe the pipeline — a
+ * test, `namzu doctor` later — reads `.counters` off the same reference",
+ * and `namzu doctor` did not. This file is that comment coming true.
+ *
+ * The counters only became readable as part of this change. They lived on
+ * whatever logger `createLogger` happened to build, and `getRootLogger`
+ * builds a new one on every call, so each count died with the expression
+ * that produced it. `installProcessSink` now owns one set for the process
+ * and every logger routed through it adds to those totals.
+ */
+/** Field-by-field, so a new counter cannot be silently left unreported. */
+const FIELDS = [
+    'dropped',
+    'redacted',
+    'attributesDropped',
+    'valuesTruncated',
+    'recordsTruncated',
+];
+function summarise(counters) {
+    return FIELDS.map((f) => `${f}=${counters[f]}`).join(' ');
+}
+/**
+ * Exported separately from the check so all three outcomes can be driven
+ * directly, the same arrangement `describeInstalledPackage` uses: a check
+ * whose only entry point is `run` can be tested for the state the machine
+ * happens to be in and nothing else.
+ */
+export function describeLogPipeline(counters) {
+    if (counters === undefined) {
+        // NOT `pass`, and not five zeros dressed up as one. Nothing measured
+        // these records, so "nothing was dropped" is a claim this check has no
+        // standing to make — and it is the claim a reader would take from a
+        // green row. The CLI installs a sink during boot, so reaching here at
+        // all means that boot step did not run.
+        return {
+            status: 'inconclusive',
+            message: 'no log sink installed — records reach stderr through the legacy path, where nothing is counted, redacted or size-capped',
+            remediation: 'A host owns its log destination: call installProcessSink(sink, level) during boot. The CLI does this itself, so seeing this from `namzu doctor` means that step did not run.',
+        };
+    }
+    if (counters.dropped > 0) {
+        return {
+            status: 'fail',
+            message: `${counters.dropped} log record(s) never reached the sink — ${summarise(counters)}`,
+            remediation: 'A record is counted dropped when the installed sink threw, or when the sink is NOOP_SINK. Check the sink passed to installProcessSink: a sink that throws is caught so one bad record cannot fail a run, which is exactly why the count is the only place this shows up.',
+        };
+    }
+    return {
+        status: 'pass',
+        message: `log pipeline live, nothing dropped — ${summarise(counters)}`,
+    };
+}
+export const loggingPipelineCheck = {
+    id: 'logging.pipeline',
+    // `DoctorCategory` has no `logging` member, and widening that union is an
+    // SDK type change this check does not need — the same call the optional
+    // package probes made for `files` and `computer-use`.
+    category: 'custom',
+    run: () => Promise.resolve(describeLogPipeline(getLogCounters())),
+};
+//# sourceMappingURL=logging.js.map

package/dist/doctor/checks/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../../../src/doctor/checks/logging.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE3C;;;;;;;;;;;;;;;;GAgBG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,GAAuC;IAClD,SAAS;IACT,UAAU;IACV,mBAAmB;IACnB,iBAAiB;IACjB,kBAAkB;CAClB,CAAA;AAED,SAAS,SAAS,CAAC,QAAyB;IAC3C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAqC;IACxE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,qEAAqE;QACrE,uEAAuE;QACvE,oEAAoE;QACpE,sEAAsE;QACtE,wCAAwC;QACxC,OAAO;YACN,MAAM,EAAE,cAAc;YACtB,OAAO,EACN,yHAAyH;YAC1H,WAAW,EACV,8KAA8K;SAC/K,CAAA;IACF,CAAC;IAED,IAAI,QAAQ,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,2CAA2C,SAAS,CAAC,QAAQ,CAAC,EAAE;YAC5F,WAAW,EACV,0QAA0Q;SAC3Q,CAAA;IACF,CAAC;IAED,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,wCAAwC,SAAS,CAAC,QAAQ,CAAC,EAAE;KACtE,CAAA;AACF,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAgB;IAChD,EAAE,EAAE,kBAAkB;IACtB,0EAA0E;IAC1E,wEAAwE;IACxE,sDAAsD;IACtD,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,GAA+B,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,cAAc,EAAE,CAAC,CAAC;CAC7F,CAAA"}

package/dist/doctor/checks/session-export.d.ts

@@ -0,0 +1,21 @@
+import type { DoctorCheck, DoctorCheckResult } from '@namzu/sdk';
+import type { NamzuCliConfig } from '../../config/schema.js';
+import { type TelemetryLoader } from '../../integrations/telemetry/session-export.js';
+/**
+ * Is this machine sending conversation content anywhere?
+ *
+ * A doctor row rather than only a boot line, because the two answer for
+ * different people at different moments: the boot narrative tells whoever
+ * started the run, and `namzu doctor` is what somebody runs when they are
+ * asked "does this tool send our transcripts off the box" and need an answer
+ * they can paste.
+ *
+ * The row is a `pass` in both directions on purpose. Export being ON is not
+ * a fault — it is a configuration somebody chose — so reporting it as a
+ * warning would train a reader to ignore the one row that describes their
+ * data leaving. What the row owes them is the destination and the redactor
+ * count, which is exactly what `describeSessionExport` already builds.
+ */
+export declare function describeSessionExportStatus(config: NamzuCliConfig, loader?: TelemetryLoader): Promise<DoctorCheckResult>;
+export declare function sessionExportCheck(config: NamzuCliConfig, loader?: TelemetryLoader): DoctorCheck;
+//# sourceMappingURL=session-export.d.ts.map

package/dist/doctor/checks/session-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-export.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/session-export.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EACN,KAAK,eAAe,EAEpB,MAAM,gDAAgD,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,2BAA2B,CAChD,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAyC5B;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,WAAW,CAMhG"}

package/dist/doctor/checks/session-export.js

@@ -0,0 +1,62 @@
+import { describeSessionExportOff, } from '../../integrations/telemetry/session-export.js';
+/**
+ * Is this machine sending conversation content anywhere?
+ *
+ * A doctor row rather than only a boot line, because the two answer for
+ * different people at different moments: the boot narrative tells whoever
+ * started the run, and `namzu doctor` is what somebody runs when they are
+ * asked "does this tool send our transcripts off the box" and need an answer
+ * they can paste.
+ *
+ * The row is a `pass` in both directions on purpose. Export being ON is not
+ * a fault — it is a configuration somebody chose — so reporting it as a
+ * warning would train a reader to ignore the one row that describes their
+ * data leaving. What the row owes them is the destination and the redactor
+ * count, which is exactly what `describeSessionExport` already builds.
+ */
+export async function describeSessionExportStatus(config, loader) {
+    const configured = config.telemetry?.sessionExport;
+    if (!configured) {
+        const off = await describeSessionExportOff(loader);
+        return {
+            status: 'pass',
+            message: off ?? 'Session export is off: telemetry.sessionExport is not configured.',
+        };
+    }
+    // The disclosure is built from the config, not from a live listener: a
+    // doctor run must be able to answer this without starting a session, and
+    // starting one to find out what it would export would be the check
+    // causing the thing it reports on.
+    const off = await describeSessionExportOff(loader);
+    if (off === null) {
+        // Configured, but the package that would do it is not installed. The
+        // run itself refuses in this state (`attachSessionExport`), and saying
+        // so here is what stops an operator discovering it at run time.
+        return {
+            status: 'fail',
+            message: `telemetry.sessionExport is configured (destination: ${configured.destination}) but "@namzu/telemetry" is not installed, so nothing would be recorded.`,
+            remediation: 'Install @namzu/telemetry, or remove telemetry.sessionExport from your config. namzu refuses to start a session in this state rather than run one whose export silently does not exist.',
+        };
+    }
+    const redactorCount = configured.redactors?.length ?? 1;
+    const typePhrase = configured.eventTypes
+        ? `${configured.eventTypes.length} event type(s)`
+        : 'every run event';
+    return {
+        status: 'pass',
+        message: `Session export is ON: ${typePhrase} is written to ${configured.destination}, with ${redactorCount} redactor(s) installed.`,
+        ...(redactorCount === 0
+            ? {
+                remediation: '`redactors: []` turns redaction off entirely — credential-shaped values in tool results will be written verbatim. Remove the key to install the shipped `secrets` redactor.',
+            }
+            : {}),
+    };
+}
+export function sessionExportCheck(config, loader) {
+    return {
+        id: 'telemetry.session-export',
+        category: 'telemetry',
+        run: () => describeSessionExportStatus(config, loader),
+    };
+}
+//# sourceMappingURL=session-export.js.map

package/dist/doctor/checks/session-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-export.js","sourceRoot":"","sources":["../../../src/doctor/checks/session-export.ts"],"names":[],"mappings":"AAGA,OAAO,EAEN,wBAAwB,GACxB,MAAM,gDAAgD,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,MAAsB,EACtB,MAAwB;IAExB,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,EAAE,aAAa,CAAA;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAA;QAClD,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,IAAI,mEAAmE;SACnF,CAAA;IACF,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,mEAAmE;IACnE,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAClB,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,OAAO;YACN,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uDAAuD,UAAU,CAAC,WAAW,0EAA0E;YAChK,WAAW,EACV,wLAAwL;SACzL,CAAA;IACF,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU;QACvC,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,gBAAgB;QACjD,CAAC,CAAC,iBAAiB,CAAA;IACpB,OAAO;QACN,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,UAAU,kBAAkB,UAAU,CAAC,WAAW,UAAU,aAAa,yBAAyB;QACpI,GAAG,CAAC,aAAa,KAAK,CAAC;YACtB,CAAC,CAAC;gBACA,WAAW,EACV,6KAA6K;aAC9K;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAsB,EAAE,MAAwB;IAClF,OAAO;QACN,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,WAAW;QACrB,GAAG,EAAE,GAA+B,EAAE,CAAC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC;KAClF,CAAA;AACF,CAAC"}

package/dist/doctor/checks/telemetry.d.ts

@@ -8,38 +8,25 @@ import type { DoctorCheck, DoctorCheckResult } from '@namzu/sdk';
  * deferred to a follow-up check that the consumer can register
  * themselves once their telemetry config is known.
  *
- * ## Resolving and loading are asked separately, on purpose
- *
- * This used to be one `import()` in a `try`, and every rejection was reported
- * as `not installed (optional package)`. A package that IS installed and throws
- * on load — a broken build, a native binding that will not open, a dependency
- * of its own that cannot resolve — was reported as absent. One word, two facts,
- * and the reader is told the reassuring one.
- *
- * Splitting the question is what makes each answer honest, and a code check on
- * the thrown error is not enough to do it: a transitive dependency that cannot
- * resolve raises `ERR_MODULE_NOT_FOUND` exactly as a missing `@namzu/telemetry`
- * does, so matching on the code would report a broken installation as no
- * installation. `resolve` asks only about THIS specifier, so it separates the
- * two by construction rather than by reading a message that may be reworded.
- *
- *   - cannot resolve  → the package is not here          → `skipped`
- *   - resolves, import throws → it is here and unusable  → `fail`
+ * The three-state resolve-then-import probe this used to do inline now
+ * lives at `context/capabilities.ts` as `probeOptionalPackage` (NZ-BOOT-02),
+ * extracted so the boot path can report the SAME answer about
+ * `@namzu/sandbox`, `@namzu/files` and `@namzu/computer-use` that this file
+ * has always given about telemetry, instead of inventing its own. What
+ * stays here is the one thing the doctor still owns: turning that answer
+ * into the prose and remediation a `DoctorCheckResult` carries.
  */
 /**
- * Whether `specifier` is installed, and whether it loads.
+ * `specifier`'s `CapabilityProbe`, read as a `DoctorCheckResult`.
  *
  * Exported separately from the `DoctorCheck` so all three outcomes can be
- * driven with a specifier the test controls — there is no way to uninstall or
- * break the real optional package from inside a test run. The check itself is
- * still exercised through `telemetryInstalledCheck.run`, because a helper
- * proven in isolation says nothing about whether the check reaches it. Same
- * arrangement, and the same reason, as `describeProviderChain`.
- *
- * The import goes through the RESOLVED path rather than the specifier, so one
- * code path serves a package name and a file, which is what lets the
- * present-but-broken case be reached at all. Resolution has already applied the
- * package's export map by that point.
+ * asserted directly — there is no way to uninstall or break a real optional
+ * package from inside a test run, so `capabilities.test.ts` drives
+ * `probeOptionalPackage` with fixtures and this function's own tests only
+ * need to check the mapping. The check itself is still exercised through
+ * `telemetryInstalledCheck.run`, because a helper proven in isolation says
+ * nothing about whether the check reaches it. Same arrangement, and the
+ * same reason, as `describeProviderChain`.
  */
 export declare function describeInstalledPackage(specifier: string): Promise<DoctorCheckResult>;
 export declare const telemetryInstalledCheck: DoctorCheck;

package/dist/doctor/checks/telemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAIhE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0B5F;AAED,eAAO,MAAM,uBAAuB,EAAE,WAIrC,CAAA"}
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAMhE;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoB5F;AAED,eAAO,MAAM,uBAAuB,EAAE,WAIrC,CAAA"}

package/dist/doctor/checks/telemetry.js

@@ -1,5 +1,4 @@
-import { createRequire } from 'node:module';
-import { pathToFileURL } from 'node:url';
+import { probeOptionalPackage } from '../../context/capabilities.js';
 const TELEMETRY = '@namzu/telemetry';
 /**
  * Telemetry presence probe.
@@ -10,64 +9,45 @@ const TELEMETRY = '@namzu/telemetry';
  * deferred to a follow-up check that the consumer can register
  * themselves once their telemetry config is known.
  *
- * ## Resolving and loading are asked separately, on purpose
- *
- * This used to be one `import()` in a `try`, and every rejection was reported
- * as `not installed (optional package)`. A package that IS installed and throws
- * on load — a broken build, a native binding that will not open, a dependency
- * of its own that cannot resolve — was reported as absent. One word, two facts,
- * and the reader is told the reassuring one.
- *
- * Splitting the question is what makes each answer honest, and a code check on
- * the thrown error is not enough to do it: a transitive dependency that cannot
- * resolve raises `ERR_MODULE_NOT_FOUND` exactly as a missing `@namzu/telemetry`
- * does, so matching on the code would report a broken installation as no
- * installation. `resolve` asks only about THIS specifier, so it separates the
- * two by construction rather than by reading a message that may be reworded.
- *
- *   - cannot resolve  → the package is not here          → `skipped`
- *   - resolves, import throws → it is here and unusable  → `fail`
+ * The three-state resolve-then-import probe this used to do inline now
+ * lives at `context/capabilities.ts` as `probeOptionalPackage` (NZ-BOOT-02),
+ * extracted so the boot path can report the SAME answer about
+ * `@namzu/sandbox`, `@namzu/files` and `@namzu/computer-use` that this file
+ * has always given about telemetry, instead of inventing its own. What
+ * stays here is the one thing the doctor still owns: turning that answer
+ * into the prose and remediation a `DoctorCheckResult` carries.
  */
 /**
- * Whether `specifier` is installed, and whether it loads.
+ * `specifier`'s `CapabilityProbe`, read as a `DoctorCheckResult`.
  *
  * Exported separately from the `DoctorCheck` so all three outcomes can be
- * driven with a specifier the test controls — there is no way to uninstall or
- * break the real optional package from inside a test run. The check itself is
- * still exercised through `telemetryInstalledCheck.run`, because a helper
- * proven in isolation says nothing about whether the check reaches it. Same
- * arrangement, and the same reason, as `describeProviderChain`.
- *
- * The import goes through the RESOLVED path rather than the specifier, so one
- * code path serves a package name and a file, which is what lets the
- * present-but-broken case be reached at all. Resolution has already applied the
- * package's export map by that point.
+ * asserted directly — there is no way to uninstall or break a real optional
+ * package from inside a test run, so `capabilities.test.ts` drives
+ * `probeOptionalPackage` with fixtures and this function's own tests only
+ * need to check the mapping. The check itself is still exercised through
+ * `telemetryInstalledCheck.run`, because a helper proven in isolation says
+ * nothing about whether the check reaches it. Same arrangement, and the
+ * same reason, as `describeProviderChain`.
  */
 export async function describeInstalledPackage(specifier) {
-    const require = createRequire(import.meta.url);
-    let resolved;
-    try {
-        resolved = require.resolve(specifier);
-    }
-    catch {
-        return {
-            status: 'skipped',
-            message: `${specifier} not installed (optional package)`,
-        };
-    }
-    try {
-        await import(pathToFileURL(resolved).href);
-        return { status: 'pass', message: `${specifier} is installed` };
-    }
-    catch (err) {
-        return {
-            status: 'fail',
-            // The reason is the whole value of separating these: "installed but
-            // will not load" sends the reader somewhere, and "not installed" would
-            // have sent them to install what is already there.
-            message: `${specifier} is installed but failed to load: ${err instanceof Error ? err.message : String(err)}`,
-            remediation: `Reinstall ${specifier}, or remove it if you are not using telemetry — it is optional and namzu runs without it.`,
-        };
+    const probe = await probeOptionalPackage(specifier);
+    switch (probe.state) {
+        case 'absent':
+            return {
+                status: 'skipped',
+                message: `${specifier} not installed (optional package)`,
+            };
+        case 'present':
+            return { status: 'pass', message: `${specifier} is installed` };
+        case 'broken':
+            return {
+                status: 'fail',
+                // The reason is the whole value of separating these: "installed but
+                // will not load" sends the reader somewhere, and "not installed" would
+                // have sent them to install what is already there.
+                message: `${specifier} is installed but failed to load: ${probe.error.message}`,
+                remediation: `Reinstall ${specifier}, or remove it if you are not using it — it is optional and namzu runs without it.`,
+            };
     }
 }
 export const telemetryInstalledCheck = {

package/dist/doctor/checks/telemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAIxC,MAAM,SAAS,GAAG,kBAAkB,CAAA;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACJ,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO;YACN,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,GAAG,SAAS,mCAAmC;SACxD,CAAA;IACF,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,eAAe,EAAE,CAAA;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,OAAO;YACN,MAAM,EAAE,MAAM;YACd,oEAAoE;YACpE,uEAAuE;YACvE,mDAAmD;YACnD,OAAO,EAAE,GAAG,SAAS,qCACpB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAChD,EAAE;YACF,WAAW,EAAE,aAAa,SAAS,2FAA2F;SAC9H,CAAA;IACF,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAgB;IACnD,EAAE,EAAE,qBAAqB;IACzB,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,GAA+B,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;CAC1E,CAAA"}
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../../../src/doctor/checks/telemetry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAEpE,MAAM,SAAS,GAAG,kBAAkB,CAAA;AAEpC;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IAC/D,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAA;IACnD,QAAQ,KAAK,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,GAAG,SAAS,mCAAmC;aACxD,CAAA;QACF,KAAK,SAAS;YACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,eAAe,EAAE,CAAA;QAChE,KAAK,QAAQ;YACZ,OAAO;gBACN,MAAM,EAAE,MAAM;gBACd,oEAAoE;gBACpE,uEAAuE;gBACvE,mDAAmD;gBACnD,OAAO,EAAE,GAAG,SAAS,qCAAqC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC/E,WAAW,EAAE,aAAa,SAAS,oFAAoF;aACvH,CAAA;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAgB;IACnD,EAAE,EAAE,qBAAqB;IACzB,QAAQ,EAAE,WAAW;IACrB,GAAG,EAAE,GAA+B,EAAE,CAAC,wBAAwB,CAAC,SAAS,CAAC;CAC1E,CAAA"}

package/dist/doctor/checks/vault.d.ts

@@ -1,22 +1,6 @@
-import type { DoctorCheck } from '@namzu/sdk';
-/**
- * Built-in vault probe is intentionally `skipped`.
- *
- * `CredentialVault` is an interface, not a globally-discoverable
- * registry — consumers instantiate their own (`InMemoryCredentialVault`,
- * file-backed, env-backed, KMS-backed, …). The doctor cannot enumerate
- * vaults it doesn't know about. To get a real vault healthcheck, the
- * consumer registers a custom check via `registerDoctorCheck` that
- * exercises their specific vault wiring.
- *
- * `skipped`, not `inconclusive`, and the difference is the whole point of the
- * split: `inconclusive` means a check tried and could not answer, which is a
- * gap in the report and now carries a non-zero exit code. This check has no
- * subject to answer about — there is no discovery mechanism to fail — and that
- * is true on every machine, permanently, by design. Reporting a permanent
- * design decision as an unanswered question would make `namzu doctor` non-zero
- * on every healthy machine, and a diagnostic that always complains is one
- * nobody reads.
- */
+import type { CredentialProvider, DoctorCheck } from '@namzu/sdk';
+export declare function registerCredentialProvider(provider: CredentialProvider, label: string, refs: readonly string[]): () => void;
+/** For tests, and for a host rebuilding its wiring. */
+export declare function clearRegisteredCredentialProviders(): void;
 export declare const vaultRegisteredCheck: DoctorCheck;
 //# sourceMappingURL=vault.d.ts.map

package/dist/doctor/checks/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAQlC,CAAA"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../../src/doctor/checks/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAA;AAmBpF,wBAAgB,0BAA0B,CACzC,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,MAAM,EAAE,GACrB,MAAM,IAAI,CAOZ;AAED,uDAAuD;AACvD,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAED,eAAO,MAAM,oBAAoB,EAAE,WA0ClC,CAAA"}