@nexalink/carecompass-sdk 0.3.0-beta.15 → 0.5.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { careCompassApiBaseUrlSchema, createDefaultCareCompassConfig, validateCareCompassConfig, } from "./schema.js";
@@ -32,13 +32,26 @@ planning, emergency triage, legal advice, and coverage guarantees. When a member
 needs clinical, emergency, plan-specific, or account-specific help that requires
 a human, route them to the customer's approved support resources.`;
 const CLI_COMMAND_ALLOWLIST = new Set([
+    "auth",
+    "completion",
+    "config",
+    "configure",
     "doctor",
+    "embed",
+    "health",
     "help",
     "init",
     "login",
+    "logout",
+    "query",
+    "setup",
     "snippet",
     "validate",
+    "version",
 ]);
+const UNAUTHENTICATED_AUTH_ATTEMPT_LIMIT = 2;
+const UNAUTHENTICATED_AUTH_RATE_LIMIT_WINDOW_MS = 15 * 60 * 1000;
+const UNAUTHENTICATED_AUTH_RATE_LIMIT_FILE = "auth-rate-limit.json";
 class CliTelemetryError extends Error {
     constructor(message, telemetry) {
         super(message);
@@ -47,6 +60,8 @@ class CliTelemetryError extends Error {
 }
 const sanitizeCommandName = (command) => {
     const normalized = command === "--help" || command === "-h" ? "help" : command;
+    if (command === "--version" || command === "-v")
+        return "version";
     return CLI_COMMAND_ALLOWLIST.has(normalized) ? normalized : "unknown_command";
 };
 const authTelemetryForSource = (source) => {
@@ -58,6 +73,96 @@ const authTelemetryForSource = (source) => {
     }
     return { authMethod: "api_key", keySource: "cli_flag" };
 };
+const unauthenticatedRateLimitPath = (io) => io.env.CARECOMPASS_AUTH_RATE_LIMIT_PATH ??
+    join(dirname(resolveCredentialsPath(io.env)), UNAUTHENTICATED_AUTH_RATE_LIMIT_FILE);
+const unauthenticatedRateLimitKey = (io) => {
+    const keyMaterial = io.env.CARECOMPASS_AUTH_RATE_LIMIT_KEY
+        ? `explicit:${io.env.CARECOMPASS_AUTH_RATE_LIMIT_KEY}`
+        : io.env.CARECOMPASS_CLIENT_IP
+            ? `ip:${io.env.CARECOMPASS_CLIENT_IP}`
+            : `credentials:${resolveCredentialsPath(io.env)}`;
+    return createHash("sha256")
+        .update("carecompass unauthenticated auth rate limit")
+        .update(keyMaterial)
+        .digest("hex");
+};
+const emptyUnauthenticatedAuthLedger = () => ({
+    version: 1,
+    entries: {},
+});
+const readUnauthenticatedAuthLedger = (path) => {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed.version !== 1 || typeof parsed.entries !== "object") {
+            return emptyUnauthenticatedAuthLedger();
+        }
+        const entries = {};
+        for (const [key, value] of Object.entries(parsed.entries)) {
+            if (typeof value === "object" &&
+                value !== null &&
+                typeof value.failures ===
+                    "number" &&
+                typeof value.firstAttemptAt ===
+                    "number" &&
+                typeof value.lastAttemptAt ===
+                    "number") {
+                entries[key] = value;
+            }
+        }
+        return { version: 1, entries };
+    }
+    catch {
+        return emptyUnauthenticatedAuthLedger();
+    }
+};
+const writeUnauthenticatedAuthLedger = (path, ledger) => {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(ledger, null, 2)}\n`, { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // Some filesystems do not support chmod; the ledger contains only hashed
+        // limiter keys and counters.
+    }
+};
+const pruneUnauthenticatedAuthLedger = (ledger, now) => {
+    for (const [key, entry] of Object.entries(ledger.entries)) {
+        if (now - entry.firstAttemptAt >
+            UNAUTHENTICATED_AUTH_RATE_LIMIT_WINDOW_MS) {
+            delete ledger.entries[key];
+        }
+    }
+};
+const recordUnauthenticatedAuthFailure = (io) => {
+    const path = unauthenticatedRateLimitPath(io);
+    const key = unauthenticatedRateLimitKey(io);
+    const now = Date.now();
+    const ledger = readUnauthenticatedAuthLedger(path);
+    pruneUnauthenticatedAuthLedger(ledger, now);
+    const existing = ledger.entries[key];
+    const entry = existing &&
+        now - existing.firstAttemptAt <= UNAUTHENTICATED_AUTH_RATE_LIMIT_WINDOW_MS
+        ? existing
+        : { failures: 0, firstAttemptAt: now, lastAttemptAt: now };
+    entry.failures += 1;
+    entry.lastAttemptAt = now;
+    ledger.entries[key] = entry;
+    writeUnauthenticatedAuthLedger(path, ledger);
+    const failures = entry.failures;
+    if (failures < UNAUTHENTICATED_AUTH_ATTEMPT_LIMIT)
+        return null;
+    return new CliTelemetryError("Too many failed authentication attempts. Wait before trying again or verify the API key in the Nexalink console.", {
+        errorCode: CARECOMPASS_TELEMETRY_ERROR_CODES.RATE_LIMIT_EXCEEDED,
+        failureCategory: "rate_limit_error",
+    });
+};
+const resetUnauthenticatedAuthFailures = (io) => {
+    const path = unauthenticatedRateLimitPath(io);
+    const ledger = readUnauthenticatedAuthLedger(path);
+    delete ledger.entries[unauthenticatedRateLimitKey(io)];
+    writeUnauthenticatedAuthLedger(path, ledger);
+};
 const normalizeBaaStatus = (value) => {
     if (value === "signed" || value === "pending" || value === "not_required") {
         return value;
@@ -526,14 +631,11 @@ async function resolveInitApiKey(flags, io, apiBaseUrl, onAuthChecked = async ()
                 failureCategory: validation.failureCategory,
             });
             io.stdout.write(`${validation.message}\n`);
+            const rateLimitError = recordUnauthenticatedAuthFailure(io);
+            if (rateLimitError)
+                throw rateLimitError;
             continue;
         }
-        await onAuthChecked({
-            authResult: "success",
-            baaStatus: validation.baaStatus,
-            keySource: authTelemetry.keySource,
-            failureCategory: null,
-        });
         if (validation.accountType !== accountType) {
             if (validation.accountType === "enterprise") {
                 io.stdout.write(`This API key belongs to an enterprise account. ${enterpriseUnavailableMessage(urls.developer)}\n`);
@@ -543,12 +645,14 @@ async function resolveInitApiKey(flags, io, apiBaseUrl, onAuthChecked = async ()
             continue;
         }
         writeStoredApiKey(normalizedApiKey, credentialsPath);
+        resetUnauthenticatedAuthFailures(io);
         io.stdout.write(`Stored CareCompass credentials at ${credentialsPath}\n`);
         io.stdout.write("Sign-in successful.\n");
         return {
             apiKey: normalizedApiKey,
             authMethod: authTelemetry.authMethod,
             baaStatus: validation.baaStatus,
+            keySource: authTelemetry.keySource,
             setup: validation.setup,
         };
     }
@@ -790,12 +894,14 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
     const sessionStartedAt = Date.now();
     const rawCommand = argv[0] ?? "help";
     const telemetryCommandName = sanitizeCommandName(rawCommand);
-    const commandStartedAt = Date.now();
+    let commandStartedAt = sessionStartedAt;
+    let commandStartedCaptured = false;
     let commandsAttempted = 0;
     let commandsSucceeded = 0;
     let commandsFailed = 0;
     let activeCommand = rawCommand;
     let authCheckedCaptured = false;
+    let initStartedCaptured = false;
     let sessionEndedCaptured = false;
     const captureAuthChecked = async (telemetry) => {
         if (authCheckedCaptured)
@@ -811,7 +917,19 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
             keySource: telemetry.keySource,
         });
     };
+    const captureCommandStarted = async () => {
+        if (commandStartedCaptured)
+            return;
+        commandStartedCaptured = true;
+        commandStartedAt = Date.now();
+        commandsAttempted += 1;
+        await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_COMMAND_STARTED, {
+            commandName: telemetryCommandName,
+            commandArgsCount: Math.max(argv.length - 1, 0),
+        });
+    };
     const captureCommandCompleted = async () => {
+        await captureCommandStarted();
         commandsSucceeded += 1;
         await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_COMMAND_COMPLETED, {
             commandName: telemetryCommandName,
@@ -820,6 +938,34 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
             modelId: null,
         });
     };
+    const authenticateConfigCommand = async (flags) => {
+        let credentials;
+        try {
+            credentials = requireApiKey(flags, io);
+        }
+        catch (error) {
+            const failure = classifyCliFailure(error);
+            await captureAuthChecked({
+                authResult: "failure",
+                baaStatus: "signed",
+                keySource: "cli_flag",
+                errorCode: failure.errorCode,
+                failureCategory: failure.failureCategory,
+            });
+            const rateLimitError = recordUnauthenticatedAuthFailure(io);
+            throw rateLimitError ?? error;
+        }
+        const config = readConfig(flagString(flags, "config") ?? DEFAULT_CONFIG_PATH);
+        resetUnauthenticatedAuthFailures(io);
+        cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
+        await captureAuthChecked({
+            authResult: "success",
+            baaStatus: "not_required",
+            keySource: authTelemetryForSource(credentials.source).keySource,
+            failureCategory: null,
+        });
+        return { config, credentials };
+    };
     const captureSessionEnded = async (exitReason) => {
         if (sessionEndedCaptured)
             return;
@@ -833,11 +979,6 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
         });
     };
     await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_STARTED);
-    await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_COMMAND_STARTED, {
-        commandName: telemetryCommandName,
-        commandArgsCount: Math.max(argv.length - 1, 0),
-    });
-    commandsAttempted += 1;
     try {
         const { command, flags, positionals } = parseArgs(argv);
         activeCommand = command;
@@ -847,6 +988,7 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
             return 0;
         }
         if (command === "login") {
+            await captureCommandStarted();
             await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_LOGIN_STARTED);
             const apiKey = flagString(flags, "api-key") ?? positionals[0];
             if (!apiKey) {
@@ -867,12 +1009,22 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
             return 0;
         }
         if (command === "init") {
-            const initStartedAt = Date.now();
-            await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_INIT_STARTED);
             rejectLegacyBaaInitFlags(flags, io);
             const outputDir = flagString(flags, "output-dir") ?? DEFAULT_OUTPUT_DIR;
             const apiBaseUrl = resolveTrustedApiBaseUrl(flagString(flags, "api-base-url") ?? DEFAULT_API_BASE_URL);
             const initAuth = await resolveInitApiKey(flags, io, apiBaseUrl, captureAuthChecked);
+            const config = buildInitConfig(flags, initAuth.setup);
+            cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
+            await captureAuthChecked({
+                authResult: "success",
+                baaStatus: initAuth.baaStatus,
+                keySource: initAuth.keySource,
+                failureCategory: null,
+            });
+            await captureCommandStarted();
+            const initStartedAt = Date.now();
+            await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_INIT_STARTED);
+            initStartedCaptured = true;
             const output = flagString(flags, "output") ??
                 join(outputDir, "carecompass.config.json");
             const snippetOutput = flagString(flags, "snippet-output") ??
@@ -895,8 +1047,6 @@ export async function runCareCompassCli(argv = process.argv.slice(2), io = {
                 }
             }
             mkdirSync(outputDir, { recursive: true });
-            const config = buildInitConfig(flags, initAuth.setup);
-            cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
             writeFileSync(output, `${JSON.stringify(config, null, 2)}\n`);
             writeFileSync(promptOutput, `${DEFAULT_SYSTEM_PROMPT}\n`);
             const resolvedConfig = readConfig(output);
@@ -946,9 +1096,8 @@ Next command:
         }
         if (command === "validate") {
             try {
-                const credentials = requireApiKey(flags, io);
-                const config = readConfig(flagString(flags, "config") ?? DEFAULT_CONFIG_PATH);
-                cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
+                const { config, credentials } = await authenticateConfigCommand(flags);
+                await captureCommandStarted();
                 if (flags["local-only"] !== true) {
                     await assertHostedConfig(config, credentials.apiKey);
                 }
@@ -959,17 +1108,18 @@ Next command:
             }
             catch (error) {
                 const failure = classifyCliFailure(error);
-                await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_VALIDATION_FAILED, {
-                    errorCode: failure.errorCode,
-                    failureCategory: failure.failureCategory,
-                });
+                if (commandStartedCaptured) {
+                    await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_VALIDATION_FAILED, {
+                        errorCode: failure.errorCode,
+                        failureCategory: failure.failureCategory,
+                    });
+                }
                 throw error;
             }
         }
         if (command === "snippet") {
-            requireApiKey(flags, io);
-            const config = readConfig(flagString(flags, "config") ?? DEFAULT_CONFIG_PATH);
-            cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
+            const { config } = await authenticateConfigCommand(flags);
+            await captureCommandStarted();
             const snippet = generateCareCompassSnippet(runtimeConfig(config), {
                 mode: snippetMode(flags),
             });
@@ -987,9 +1137,8 @@ Next command:
             return 0;
         }
         if (command === "doctor") {
-            const credentials = requireApiKey(flags, io);
-            const config = readConfig(flagString(flags, "config") ?? DEFAULT_CONFIG_PATH);
-            cliTelemetry = createCareCompassCliTelemetry(cliSessionId, config);
+            const { config, credentials } = await authenticateConfigCommand(flags);
+            await captureCommandStarted();
             let hostedStatus = "not checked";
             try {
                 await assertHostedConfig(config, credentials.apiKey);
@@ -1013,12 +1162,16 @@ Status: ready for staging verification
             await captureCommandCompleted();
             return 0;
         }
+        await captureCommandStarted();
         throw new Error(`Unknown command: ${command}`);
     }
     catch (error) {
         commandsFailed += 1;
+        if (!commandStartedCaptured && commandsAttempted === 0) {
+            commandsAttempted = 1;
+        }
         const failure = classifyCliFailure(error);
-        if (activeCommand === "init") {
+        if (activeCommand === "init" && initStartedCaptured) {
             await cliTelemetry.captureAsync(CARECOMPASS_TELEMETRY_EVENTS.CLI_INIT_FAILED, {
                 errorCode: failure.errorCode,
                 failureCategory: failure.failureCategory,

package/dist/client.d.ts

@@ -1,21 +1,51 @@
 import { type CareCompassConfig } from "./schema.js";
 export type CareCompassAskRequest = {
     prompt: string;
+    /** Stable client-generated id used to make a submit/retry idempotent. */
+    requestId?: string;
+    workflow?: CareCompassWorkflowId;
     sessionId?: string;
     userContext?: Record<string, unknown>;
 };
+export type CareCompassWorkflowId = "rcm-coding-assistance";
 export type CareCompassAskResponse = {
     jobId: string;
 };
+export type CareCompassRetrievalReference = {
+    referenceId: string;
+    documentId: string;
+    title: string;
+    version: string;
+    excerpt: string;
+};
+export type CareCompassRetrievalMetadata = {
+    corpusId: string;
+    corpusVersion: string;
+    outcome: string;
+    latencyMs: number;
+    references: CareCompassRetrievalReference[];
+};
 export type CareCompassStatusResponse = {
     status: "queued" | "running" | "complete" | "failed";
     result?: string;
+    retrieval?: CareCompassRetrievalMetadata;
 };
 type Fetcher = typeof fetch;
-export declare function createCareCompassClient(inputConfig: CareCompassConfig, options?: {
+export type CareCompassRuntimeTokenRequest = {
+    payerId: string;
+    environment: CareCompassConfig["environment"];
+    embedKey: string;
+    workflow?: CareCompassWorkflowId;
+    jobId?: string;
+};
+/** Obtains a short-lived production token from the integrator's BFF. */
+export type CareCompassRuntimeTokenProvider = (request: CareCompassRuntimeTokenRequest) => Promise<string> | string;
+export type CareCompassClientOptions = {
     fetcher?: Fetcher;
     now?: () => number;
-}): {
+    runtimeTokenProvider?: CareCompassRuntimeTokenProvider;
+};
+export declare function createCareCompassClient(inputConfig: CareCompassConfig, options?: CareCompassClientOptions): {
     validateConfig: () => Promise<{
         ok: true;
     }>;

package/dist/client.js

@@ -105,6 +105,30 @@ export function createCareCompassClient(inputConfig, options = {}) {
         "x-carecompass-environment": config.environment,
     };
     const jobStartedAt = new Map();
+    const jobWorkflows = new Map();
+    async function requestHeaders(request = {}) {
+        if (config.environment !== "production")
+            return headers;
+        if (!options.runtimeTokenProvider) {
+            throw new CareCompassClientError("Production CareCompass embeds require a runtimeTokenProvider backed by your server.", CARECOMPASS_TELEMETRY_ERROR_CODES.AUTHENTICATION_FAILED, "authentication");
+        }
+        let token;
+        try {
+            token = await options.runtimeTokenProvider({
+                payerId: config.payerId,
+                environment: config.environment,
+                embedKey: config.embedKey,
+                ...request,
+            });
+        }
+        catch {
+            throw new CareCompassClientError("CareCompass runtime authorization could not be obtained.", CARECOMPASS_TELEMETRY_ERROR_CODES.AUTHENTICATION_FAILED, "authentication");
+        }
+        if (typeof token !== "string" || !token.trim()) {
+            throw new CareCompassClientError("CareCompass runtime authorization could not be obtained.", CARECOMPASS_TELEMETRY_ERROR_CODES.AUTHENTICATION_FAILED, "authentication");
+        }
+        return { ...headers, "x-carecompass-runtime-token": token.trim() };
+    }
     telemetry.capture(CARECOMPASS_TELEMETRY_EVENTS.SDK_INITIALIZED);
     telemetry.capture(CARECOMPASS_TELEMETRY_EVENTS.THEME_LOADED);
     telemetry.capture(CARECOMPASS_TELEMETRY_EVENTS.PROMPT_CONFIGURATION_LOADED);
@@ -137,7 +161,7 @@ export function createCareCompassClient(inputConfig, options = {}) {
             try {
                 const response = await send(joinUrl(config.apiBaseUrl, "/api/carecompass/embed/config/validate"), {
                     method: "POST",
-                    headers,
+                    headers: await requestHeaders(),
                     body: JSON.stringify({ config }),
                 });
                 const result = await parseJson(response);
@@ -155,18 +179,25 @@ export function createCareCompassClient(inputConfig, options = {}) {
             try {
                 const response = await send(joinUrl(config.apiBaseUrl, "/api/carecompass/embed/ask"), {
                     method: "POST",
-                    headers,
+                    headers: await requestHeaders({ workflow: request.workflow }),
                     body: JSON.stringify({
                         prompt: request.prompt,
+                        requestId: request.requestId,
+                        workflow: request.workflow,
                         sessionId: request.sessionId,
                         userContext: request.userContext,
                         promptConfig: config.prompt,
+                        // Public routing preferences; the hosted runtime validates model
+                        // availability and may ignore disabled feature flags.
+                        model: config.model,
+                        featureFlags: config.featureFlags,
                     }),
                 });
                 const result = await parseJson(response);
                 // Status polling is asynchronous, so retain the submit timestamp until
                 // the final job state lets telemetry report end-to-end latency.
                 jobStartedAt.set(result.jobId, startedAt);
+                jobWorkflows.set(result.jobId, request.workflow);
                 return result;
             }
             catch (error) {
@@ -177,16 +208,23 @@ export function createCareCompassClient(inputConfig, options = {}) {
         status: async (jobId) => {
             const startedAt = jobStartedAt.get(jobId) ?? now();
             try {
-                const response = await send(joinUrl(config.apiBaseUrl, `/api/carecompass/embed/status/${encodeURIComponent(jobId)}`), { headers });
+                const response = await send(joinUrl(config.apiBaseUrl, `/api/carecompass/embed/status/${encodeURIComponent(jobId)}`), {
+                    headers: await requestHeaders({
+                        jobId,
+                        workflow: jobWorkflows.get(jobId),
+                    }),
+                });
                 const result = await parseJson(response);
                 if (result.status === "complete") {
                     jobStartedAt.delete(jobId);
+                    jobWorkflows.delete(jobId);
                     telemetry.capture(CARECOMPASS_TELEMETRY_EVENTS.INFERENCE_SUCCEEDED, {
                         durationMs: now() - startedAt,
                     });
                 }
                 else if (result.status === "failed") {
                     jobStartedAt.delete(jobId);
+                    jobWorkflows.delete(jobId);
                     telemetry.capture(CARECOMPASS_TELEMETRY_EVENTS.INFERENCE_FAILED, {
                         durationMs: now() - startedAt,
                         errorCode: CARECOMPASS_TELEMETRY_ERROR_CODES.INFERENCE_FAILED,
@@ -197,6 +235,7 @@ export function createCareCompassClient(inputConfig, options = {}) {
             }
             catch (error) {
                 jobStartedAt.delete(jobId);
+                jobWorkflows.delete(jobId);
                 captureInferenceFailure(telemetry, error, now() - startedAt);
                 throw error;
             }

package/dist/compliance.d.ts

@@ -0,0 +1,69 @@
+import type { CareCompassComplianceConfig } from "./schema.js";
+/** The identifier categories detected by the SDK's local PHI preflight. */
+export type CareCompassPhiCategory = "date_of_birth" | "email" | "medical_record_number" | "member_id" | "phone" | "ssn";
+export type CareCompassPhiMatch = {
+    category: CareCompassPhiCategory;
+    start: number;
+    end: number;
+};
+export type CareCompassPhiSource = "message" | "response" | "context";
+export type CareCompassPhiDetectionContext = {
+    source: CareCompassPhiSource;
+};
+export type CareCompassPhiDetector = (value: string, context: CareCompassPhiDetectionContext) => CareCompassPhiMatch[];
+export type CareCompassPhiRedactor = (value: string, matches: CareCompassPhiMatch[], replacement: string) => string;
+export type CareCompassPhiHooks = {
+    /** Replaces the built-in detector. The hook receives raw content; never emit it. */
+    detect?: CareCompassPhiDetector;
+    /** Replaces the built-in redactor. The hook receives raw content; never emit it. */
+    redact?: CareCompassPhiRedactor;
+};
+export type CareCompassComplianceRuntimeOptions = {
+    phi?: CareCompassPhiHooks;
+};
+export type CareCompassCompliancePreset = "standard" | "healthcare" | "strict";
+export type CareCompassPhiAction = "allow" | "redact" | "block";
+export type CareCompassCompliancePolicy = {
+    auditEnabled: boolean;
+    phiAction: CareCompassPhiAction;
+    preset: CareCompassCompliancePreset;
+    replacement: string;
+};
+export declare const CARECOMPASS_COMPLIANCE_PRESETS: Readonly<Record<CareCompassCompliancePreset, Omit<CareCompassCompliancePolicy, "preset">>>;
+export type CareCompassAuditEventType = "message" | "tool_call" | "widget_action" | "error" | "safety_decision";
+export type CareCompassAuditOutcome = "submitted" | "completed" | "failed" | "blocked" | "redacted" | "escalated" | "recorded";
+export type CareCompassAuditSource = CareCompassPhiSource | "tool_call" | "widget_action";
+export type CareCompassAuditEvent = {
+    id: string;
+    occurredAt: number;
+    outcome: CareCompassAuditOutcome;
+    phi: {
+        categories: CareCompassPhiCategory[];
+        count: number;
+    };
+    source?: CareCompassAuditSource;
+    type: CareCompassAuditEventType;
+};
+export type CareCompassSafetyDecision = "blocked" | "escalated" | "redacted" | "policy_sensitive";
+export type CareCompassSafetyEvent = {
+    decision: CareCompassSafetyDecision;
+    occurredAt: number;
+    phi: {
+        categories: CareCompassPhiCategory[];
+        count: number;
+    };
+    source: CareCompassPhiSource | "tool_call" | "widget_action";
+};
+export type CareCompassAuditListener = (event: CareCompassAuditEvent) => void;
+export type CareCompassSafetyListener = (event: CareCompassSafetyEvent) => void;
+export declare const detectCareCompassPhi: CareCompassPhiDetector;
+export declare const redactCareCompassPhi: CareCompassPhiRedactor;
+export declare const resolveCareCompassCompliancePolicy: (config: CareCompassComplianceConfig | undefined) => CareCompassCompliancePolicy;
+export declare const phiSummary: (matches: CareCompassPhiMatch[]) => {
+    categories: CareCompassPhiCategory[];
+    count: number;
+};
+export declare const sanitizeCareCompassValue: (value: unknown, source: CareCompassPhiSource, policy: CareCompassCompliancePolicy, hooks: CareCompassPhiHooks | undefined) => {
+    matches: CareCompassPhiMatch[];
+    value: unknown;
+};