@ouro.bot/cli 0.1.0-alpha.66 → 0.1.0-alpha.661

package/dist/nerves/coverage/file-completeness.js

@@ -10,24 +10,158 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.isTypeOnlyFile = isTypeOnlyFile;
 exports.checkFileCompleteness = checkFileCompleteness;
 /**
- * Determines if a source file is type-only (no executable code).
- * A file is type-only if it contains no function, class, or mutable declarations.
- * `const ... as const` declarations are treated as type-equivalent (frozen
- * compile-time values with no side effects).
+ * Determines if a source file is type-only or a pure assembly/re-export file.
+ * Exempt files contain no runtime behavior requiring independent observability.
+ *
+ * Exempt patterns:
+ * - Files with only type/interface/enum declarations
+ * - `const ... as const` declarations (frozen compile-time values)
+ * - Files whose only executable code is const array spreads (assembly/composition)
+ * - Files whose only executable code is re-exports
  */
 function isTypeOnlyFile(source) {
     const lines = source.split("\n");
     for (const line of lines) {
         const trimmed = line.trim();
+        /* v8 ignore start -- regex branches: functionally tested in file-completeness.test.ts @preserve */
         // Skip lines that are const+as-const (type-equivalent frozen values)
         if (/\bconst\s/.test(trimmed) && /\bas\s+const\b/.test(trimmed))
             continue;
+        // Skip const declarations that are pure data (arrays, objects, maps, sets)
+        if (/\bconst\s+\w+[\s:][^=]*=\s*[\[{]/.test(trimmed))
+            continue;
+        if (/\bconst\s+\w+[\s:][^=]*=\s*\w+\.map\(/.test(trimmed))
+            continue;
+        if (/^export\s+const\s+\w+[\s:][^=]*=\s*[\[{]/.test(trimmed))
+            continue;
+        if (/^export\s+const\s+\w+[\s:][^=]*=\s*\w+\.map\(/.test(trimmed))
+            continue;
+        if (/\bconst\s+\w+[\s:][^=]*=\s*new\s+(Set|Map)\b/.test(trimmed))
+            continue;
         // Check for executable code markers
         if (/\b(function|class|const|let|var)\s/.test(trimmed))
             return false;
+        /* v8 ignore stop */
     }
     return true;
 }
+// Sub-modules dispatched through a centralized pattern where the router
+// handles all observability events. These files don't need independent
+// emitNervesEvent calls.
+const DISPATCH_EXEMPT_PATTERNS = [
+    "repertoire/tools-files",
+    "repertoire/tools-shell",
+    "repertoire/tools-notes",
+    "repertoire/tools-bridge",
+    "repertoire/tools-session",
+    "repertoire/tools-continuity",
+    "repertoire/tools-surface",
+    "repertoire/tools-config",
+    "repertoire/tools-base",
+    // CLI sub-modules: cli-exec.ts is the router with emitNervesEvent calls;
+    // cli-parse, cli-render, cli-help, and their small helpers are pure functions/data with no side effects.
+    "daemon/cli-parse",
+    "daemon/cli-render",
+    "daemon/cli-help",
+    "daemon/vault-items",
+    // Shared utility modules: pure helpers consumed by modules that own observability.
+    "arc/json-store",
+    "heart/mail-import-discovery",
+    "repertoire/api-client",
+    "repertoire/github-client",
+    "mind/embedding-provider",
+    // Commerce utility module: error classes and pure helpers (no independent side effects).
+    "repertoire/commerce-errors",
+    // Diary integrity: pure detection utility (pattern matching only). The caller
+    // (diary.ts saveDiaryEntry) owns observability via mind.diary_integrity_warning.
+    "mind/diary-integrity",
+    // Provenance trust: pure classification function (no side effects). Callers
+    // (note-search.ts, tools-notes.ts) own observability for note search results.
+    "mind/provenance-trust",
+    // Log redaction: pure utility consumed by the NDJSON sink (no independent side effects).
+    "nerves/redact",
+    // Bundle templates: pure constants (gitignore template string, PII
+    // directory list). No runtime behavior — consumed by tools-bundle.ts
+    // which owns the observability for bundle operations.
+    "repertoire/bundle-templates",
+    // HTTP health probe: pure HTTP utility factory. The HealthMonitor caller
+    // owns observability via daemon.health_result events.
+    "daemon/http-health-probe",
+    // Rollup decision function: pure decision tree mapping per-agent
+    // snapshots + bootstrap-degraded entries + safe-mode flag to a
+    // RollupStatus. No side effects. The caller (daemon-entry.ts
+    // buildDaemonHealthState → DaemonHealthWriter) owns observability via
+    // daemon.health_written when the rolled-up state is persisted.
+    "daemon/daemon-rollup",
+    // Attachment helper modules: generic file-path/extension utilities and the
+    // source registry are pure support seams. The orchestrator/adapters that
+    // call them own the observability.
+    "heart/attachments/originals",
+    "heart/attachments/sources/index",
+    "heart/attachments/sources/cli-local-file",
+    // Browser-safe Mailbox contract helpers: shared types/formatting helpers
+    // consumed by server readers and the UI. Mailbox read/render modules own
+    // the observability for these projections.
+    "heart/mailbox/mailbox-types",
+    // Mail search relevance scorer: pure heuristic function (regex + counter
+    // arithmetic). The caller (search-cache.ts searchMailSearchCache) owns
+    // observability via senses.mail_search_cache_upserted and friends.
+    "mailroom/search-relevance",
+    // Mail thread reconstruction: pure graph-walk over decrypted message
+    // metadata. Consumers (tools-mail.ts mail_thread handler) own observability.
+    "mailroom/thread",
+    // Trip ledger crypto helpers: pure RSA/AES envelope construction + slug
+    // hashing. The caller (trips/store.ts) owns observability via
+    // trips.ledger_created and trips.evidence_attached.
+    "trips/core",
+    // Mailbox HTTP helper modules: route/static/transport/hook seams are
+    // dispatched by mailbox-http.ts, whose server lifecycle owns observability.
+    "heart/mailbox/mailbox-http-transport",
+    "heart/mailbox/mailbox-http-static",
+    "heart/mailbox/mailbox-http-hooks",
+    "heart/mailbox/mailbox-http-routes",
+    "heart/mailbox/mailbox-http-response",
+    // Session playback: read-only debugging CLI for sanitize-pipeline replay.
+    // No side effects on the runtime; output is human-readable diagnostics only.
+    "heart/session-playback-cli-main",
+    "heart/session-playback-cli",
+    "heart/session-playback",
+    // Nerves review: read-only NDJSON tail/filter CLI for debugging.
+    // Diagnostics-only utility; the running daemon owns observability.
+    "nerves/review/cli-main",
+    "nerves/review/cli",
+    "nerves/review/core",
+    // Mail body cache: in-process LRU helper. Cache hit/miss observability
+    // lives at the caller (tools-mail.ts mail_body handler) which fires
+    // repertoire.mail_body_cache_hit on cache reuse.
+    "mailroom/body-cache",
+    // Session stats: read-only session.json analyzer CLI for debugging.
+    // Diagnostics-only utility; output is human-readable summary.
+    "heart/session-stats-cli-main",
+    "heart/session-stats",
+    // Layer 2 sync classifier: pure pattern-matcher mapping (error, context)
+    // to a SyncClassification. The orchestrator (boot-sync-probe.ts) owns
+    // observability via daemon.boot_sync_probe_start/end events; the
+    // post-turn push path (sync.ts) emits its own classification events.
+    "heart/sync-classification",
+    // Layer 2 timeout wrapper: pure soft/hard timeout abstraction over
+    // AbortController + setTimeout. Callers (boot-sync-probe.ts and any
+    // future consumer) own observability; the wrapper itself is mechanical.
+    "heart/timeouts",
+    // Shared frontmatter parser: pure YAML-ish parser used by habit-parser,
+    // habit-migration, await-parser, and any other small markdown reader.
+    // No side effects of its own; callers emit nerves events around their
+    // parse calls (e.g. daemon.habit_parse, daemon.await_parse).
+    "util/frontmatter",
+    // Legacy-tasks-to-desk migration classifier: pure-data per-file bucketing function.
+    // The caller (migrate-to-desk.ts) owns observability via
+    // daemon.migrate_to_desk_* events around the runMigrateToDesk() entry
+    // points.
+    "repertoire/desk/classifier",
+];
+function isDispatchExempt(filePath) {
+    return DISPATCH_EXEMPT_PATTERNS.some((pattern) => filePath.includes(pattern));
+}
 /**
  * Check that all production files have at least one emitNervesEvent call.
  *
@@ -41,7 +175,7 @@ function checkFileCompleteness(filesWithKeys, fileContents) {
         const hasKeys = filesWithKeys.has(filePath) && filesWithKeys.get(filePath).length > 0;
         if (hasKeys)
             continue;
-        if (isTypeOnlyFile(source)) {
+        if (isTypeOnlyFile(source) || isDispatchExempt(filePath)) {
             exempt.push(filePath);
         }
         else {

package/dist/nerves/event-buffer.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createBufferedSink = createBufferedSink;
+const runtime_1 = require("./runtime");
+const DEFAULT_MAX_SIZE = 1000;
+const DEFAULT_TTL_MS = 5 * 60 * 1000; // 5 minutes
+function createBufferedSink(inner, options = {}) {
+    const maxSize = options.maxSize ?? DEFAULT_MAX_SIZE;
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const nowMs = options.nowMs ?? (() => Date.now());
+    const buffer = [];
+    let dropped = 0;
+    let sinkHealthy = true;
+    let unhealthySince = null;
+    function tryInner(event) {
+        try {
+            inner(event);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    function markUnhealthy() {
+        sinkHealthy = false;
+        unhealthySince = unhealthySince ?? nowMs();
+    }
+    function markHealthy() {
+        sinkHealthy = true;
+        unhealthySince = null;
+    }
+    function discardBuffer() {
+        const count = buffer.length;
+        dropped += count;
+        buffer.length = 0;
+        (0, runtime_1.emitNervesEvent)({
+            component: "nerves",
+            event: "nerves.buffer_ttl_discard",
+            message: `discarded ${count} buffered events after TTL`,
+            meta: { discarded: count, ttlMs },
+        });
+    }
+    function checkTtl() {
+        if (unhealthySince !== null && nowMs() - unhealthySince > ttlMs) {
+            discardBuffer();
+            // Reset unhealthySince to now so TTL starts fresh for newly buffered events
+            unhealthySince = nowMs();
+            return true;
+        }
+        return false;
+    }
+    function addToBuffer(event) {
+        if (buffer.length >= maxSize) {
+            buffer.shift();
+            dropped++;
+        }
+        buffer.push(event);
+    }
+    function flushBuffer() {
+        while (buffer.length > 0) {
+            const event = buffer[0];
+            if (tryInner(event)) {
+                buffer.shift();
+            }
+            else {
+                markUnhealthy();
+                return;
+            }
+        }
+    }
+    function sink(event) {
+        if (!sinkHealthy) {
+            checkTtl();
+            // Try sending the new event to see if inner has recovered
+            if (tryInner(event)) {
+                markHealthy();
+                flushBuffer();
+            }
+            else {
+                addToBuffer(event);
+            }
+            return;
+        }
+        if (tryInner(event)) {
+            return;
+        }
+        // Inner failed
+        markUnhealthy();
+        addToBuffer(event);
+    }
+    function flush() {
+        if (buffer.length === 0)
+            return;
+        // Test if inner is recovered by trying the first buffered event
+        const first = buffer[0];
+        if (tryInner(first)) {
+            buffer.shift();
+            markHealthy();
+            flushBuffer();
+        }
+        // If still broken, leave buffer intact
+    }
+    function state() {
+        return {
+            buffered: buffer.length,
+            dropped,
+            sinkHealthy,
+        };
+    }
+    return { sink, flush, state };
+}

package/dist/nerves/index.js

@@ -1,17 +1,60 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MAX_GENERATIONS = exports.DEFAULT_MAX_LOG_SIZE_BYTES = void 0;
 exports.createTraceId = createTraceId;
 exports.ensureTraceId = ensureTraceId;
 exports.createFanoutSink = createFanoutSink;
 exports.formatTerminalEntry = formatTerminalEntry;
+exports.registerSpinnerHooks = registerSpinnerHooks;
 exports.createTerminalSink = createTerminalSink;
 exports.createStderrSink = createStderrSink;
+exports.rotateIfNeeded = rotateIfNeeded;
 exports.createNdjsonFileSink = createNdjsonFileSink;
 exports.registerGlobalLogSink = registerGlobalLogSink;
 exports.createLogger = createLogger;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const crypto_1 = require("crypto");
+const zlib = __importStar(require("zlib"));
+// NOTE: runtime.ts imports `createLogger` and `ensureTraceId` from this file.
+// The cycle is safe in CommonJS because runtime.ts only uses those values
+// lazily inside `getRuntimeLogger()`, and we only call `emitNervesEvent` from
+// inside `rotateIfNeeded` — never at module top level.
+const runtime_1 = require("./runtime");
+const redact_1 = require("./redact");
 const LEVEL_PRIORITY = {
     debug: 10,
     info: 20,
@@ -73,36 +116,213 @@ function formatTerminalEntry(entry) {
     const level = entry.level.toUpperCase();
     return `${formatTerminalTime(entry.ts)} ${level} [${entry.component}] ${entry.message}${formatTerminalMeta(entry.meta)}`;
 }
-function createTerminalSink(write = (chunk) => process.stderr.write(chunk), colorize = true) {
+// Spinner coordination: the CLI sense registers these so log output
+// doesn't interleave with the active spinner animation.
+let _pauseSpinner = null;
+let _resumeSpinner = null;
+function registerSpinnerHooks(pause, resume) {
+    _pauseSpinner = pause;
+    _resumeSpinner = resume;
+}
+function createTerminalSink(write = (chunk) => { try {
+    process.stderr.write(chunk);
+}
+catch { /* EPIPE: daemon detached, no terminal */ } }, colorize = true) {
     return (entry) => {
+        _pauseSpinner?.();
         const line = formatTerminalEntry(entry);
         if (!colorize) {
             write(`${line}\n`);
+            _resumeSpinner?.();
             return;
         }
         const prefix = LEVEL_COLORS[entry.level];
         write(`${prefix}${line}\x1b[0m\n`);
+        _resumeSpinner?.();
     };
 }
-function createStderrSink(write = (chunk) => process.stderr.write(chunk)) {
+function createStderrSink(write) {
     return createTerminalSink(write);
 }
-function createNdjsonFileSink(filePath) {
+exports.DEFAULT_MAX_LOG_SIZE_BYTES = 25 * 1024 * 1024; // 25 MB per active stream
+exports.DEFAULT_MAX_GENERATIONS = 5; // keep 5 gzipped historical generations
+const DEFAULT_ROTATION_CHECK_INTERVAL_BYTES = 1024 * 1024; // ~1MB between stat checks
+/** Internal: compute the gzipped generation path for a given ndjson file. */
+function generationGzPath(base, ext, n) {
+    return ext === ".ndjson" ? `${base}.${n}.ndjson.gz` : `${base}.${n}.gz`;
+}
+/** Internal: compute the legacy uncompressed generation path for a given file. */
+function generationPlainPath(base, ext, n) {
+    return ext === ".ndjson" ? `${base}.${n}.ndjson` : `${base}.${n}`;
+}
+/**
+ * Rotate a log file in place.
+ *
+ * Scheme (25 MB × 5 gzipped generations by default):
+ *   active       : foo.ndjson
+ *   newest gen   : foo.1.ndjson.gz
+ *   oldest gen   : foo.5.ndjson.gz (dropped on next rotation)
+ *
+ * Legacy tolerance: uncompressed `foo.1.ndjson` / `foo.2.ndjson` files from the
+ * old scheme are treated as the corresponding generation and gzipped on first
+ * rotation.
+ *
+ * Concurrent-writer safety: the active file is renamed (inode stays alive for
+ * any open writer fd) then gzipped at the renamed path. An active writer
+ * continues writing to its original fd; on the next write cycle it sees the
+ * old path is missing and creates a fresh file.
+ *
+ * Backwards-compatible signature: passing a `number` as the second argument
+ * (the old API) is still accepted and interpreted as `maxSizeBytes`.
+ */
+function rotateIfNeeded(filePath, optionsOrMaxSize) {
+    const options = typeof optionsOrMaxSize === "number"
+        ? { maxSizeBytes: optionsOrMaxSize }
+        : optionsOrMaxSize ?? {};
+    const maxSizeBytes = options.maxSizeBytes ?? exports.DEFAULT_MAX_LOG_SIZE_BYTES;
+    const maxGenerations = options.maxGenerations ?? exports.DEFAULT_MAX_GENERATIONS;
+    const compress = options.compress ?? true;
+    let size;
+    try {
+        size = (0, fs_1.statSync)(filePath).size;
+    }
+    catch {
+        return false;
+    }
+    if (size < maxSizeBytes)
+        return false;
+    const ext = filePath.endsWith(".ndjson") ? ".ndjson" : "";
+    const base = ext ? filePath.slice(0, -ext.length) : filePath;
+    const traceId = (0, crypto_1.randomUUID)();
+    (0, runtime_1.emitNervesEvent)({
+        component: "nerves",
+        event: "nerves.rotation_start",
+        trace_id: traceId,
+        message: "rotating log file",
+        meta: { path: filePath, currentSize: size, threshold: maxSizeBytes, generation: 1 },
+    });
+    let completed = false;
+    try {
+        // Step 1: drop / shift existing generations starting from the oldest.
+        // For each slot N (maxGenerations..2), find whatever occupies slot (N-1)
+        // (as .gz or legacy uncompressed) and move it to slot N. Slot N occupants
+        // get overwritten (oldest is dropped). Non-existent slots are skipped.
+        for (let n = maxGenerations; n >= 2; n--) {
+            const destGz = generationGzPath(base, ext, n);
+            const srcGz = generationGzPath(base, ext, n - 1);
+            const srcPlain = generationPlainPath(base, ext, n - 1);
+            // Drop whatever currently occupies the destination slot (oldest generation).
+            if ((0, fs_1.existsSync)(destGz)) {
+                (0, fs_1.unlinkSync)(destGz);
+            }
+            const destPlain = generationPlainPath(base, ext, n);
+            if ((0, fs_1.existsSync)(destPlain)) {
+                (0, fs_1.unlinkSync)(destPlain);
+            }
+            // Prefer moving .gz → .gz (cheap rename).
+            if ((0, fs_1.existsSync)(srcGz)) {
+                (0, fs_1.renameSync)(srcGz, destGz);
+                continue;
+            }
+            // Legacy migration: if a plain .ndjson generation file exists from the
+            // old scheme, read it, gzip it into the destination slot, and delete
+            // the plain source.
+            if ((0, fs_1.existsSync)(srcPlain)) {
+                if (compress) {
+                    const buf = (0, fs_1.readFileSync)(srcPlain);
+                    const compressed = zlib.gzipSync(buf);
+                    (0, fs_1.writeFileSync)(destGz, compressed);
+                    (0, fs_1.unlinkSync)(srcPlain);
+                }
+                else {
+                    // compress=false: just rename
+                    (0, fs_1.renameSync)(srcPlain, destPlain);
+                }
+            }
+        }
+        // Step 2: rename the active file to the generation-1 plain path. The
+        // active writer keeps its open fd; the file path now points elsewhere.
+        const plain1 = generationPlainPath(base, ext, 1);
+        // If a stale .1 plain path exists (e.g. a previous compress=false run),
+        // remove it so the rename can claim the slot cleanly.
+        if ((0, fs_1.existsSync)(plain1)) {
+            (0, fs_1.unlinkSync)(plain1);
+        }
+        (0, fs_1.renameSync)(filePath, plain1);
+        // Step 3: gzip (or keep plain) the renamed file into the .1 generation.
+        if (compress) {
+            const gz1 = generationGzPath(base, ext, 1);
+            // Remove any lingering .1.ndjson.gz to avoid "file exists" on write.
+            if ((0, fs_1.existsSync)(gz1)) {
+                (0, fs_1.unlinkSync)(gz1);
+            }
+            const buf = (0, fs_1.readFileSync)(plain1);
+            const compressed = zlib.gzipSync(buf);
+            (0, fs_1.writeFileSync)(gz1, compressed);
+            (0, fs_1.unlinkSync)(plain1);
+        }
+        completed = true;
+        (0, runtime_1.emitNervesEvent)({
+            component: "nerves",
+            event: "nerves.rotation_end",
+            trace_id: traceId,
+            message: "log rotation complete",
+            meta: { path: filePath, compressedPath: compress ? generationGzPath(base, ext, 1) : plain1, bytesFreed: size },
+        });
+        return true;
+    }
+    catch (err) {
+        /* v8 ignore next -- defensive: completed=true only reached after the try block's return @preserve */
+        if (!completed) {
+            /* v8 ignore next -- defensive: fs ops throw real Errors @preserve */
+            const reason = err instanceof Error ? err.message : String(err);
+            (0, runtime_1.emitNervesEvent)({
+                component: "nerves",
+                event: "nerves.rotation_error",
+                trace_id: traceId,
+                level: "error",
+                message: "log rotation failed",
+                meta: { path: filePath, error: reason },
+            });
+        }
+        throw err;
+    }
+}
+function createNdjsonFileSink(filePath, optionsOrMaxSize) {
     (0, fs_1.mkdirSync)((0, path_1.dirname)(filePath), { recursive: true });
+    const options = typeof optionsOrMaxSize === "number"
+        ? { maxSizeBytes: optionsOrMaxSize }
+        : optionsOrMaxSize ?? {};
+    const rotationCheckInterval = options.rotationCheckIntervalBytes ?? DEFAULT_ROTATION_CHECK_INTERVAL_BYTES;
+    const verbose = process.env.OURO_LOG_VERBOSE === "1";
     const queue = [];
     let flushing = false;
+    let bytesSinceCheck = 0;
     function flush() {
         if (flushing || queue.length === 0)
             return;
         flushing = true;
         const line = queue.shift();
+        if (bytesSinceCheck >= rotationCheckInterval) {
+            bytesSinceCheck = 0;
+            try {
+                rotateIfNeeded(filePath, options);
+            }
+            catch {
+                // Rotation errors are surfaced via nerves events; never block writes.
+            }
+        }
         (0, fs_1.appendFile)(filePath, line, "utf8", () => {
             flushing = false;
             flush();
         });
     }
     return (entry) => {
-        queue.push(`${JSON.stringify(entry)}\n`);
+        const line = verbose
+            ? `${JSON.stringify(entry)}\n`
+            : `${(0, redact_1.redactString)(JSON.stringify((0, redact_1.redactLogEntry)(entry)))}\n`;
+        bytesSinceCheck += line.length;
+        queue.push(line);
         flush();
     };
 }

package/dist/nerves/observation.js

@@ -0,0 +1,20 @@
+"use strict";
+/**
+ * Nerves observation layer — shared typed readers for runtime state.
+ *
+ * This module re-exports domain types that multiple consumers need
+ * (Mailbox, CLI, agent tools) so they don't maintain parallel type universes.
+ *
+ * The Mailbox UI consumes these through the HTTP API, but the same
+ * observation functions back CLI commands and future native clients.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+/* v8 ignore start — module-level observability event */
+const runtime_1 = require("./runtime");
+(0, runtime_1.emitNervesEvent)({
+    component: "nerves",
+    event: "nerves.observation_loaded",
+    message: "observation layer loaded",
+    meta: {},
+});
+/* v8 ignore stop */

package/dist/nerves/redact.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_PATTERNS = exports.SENSITIVE_KEYS = void 0;
+exports.redactMeta = redactMeta;
+exports.redactString = redactString;
+exports.redactLogEntry = redactLogEntry;
+/**
+ * Lowercase key names that trigger structured redaction.
+ * Matched case-insensitively against meta object keys.
+ */
+exports.SENSITIVE_KEYS = new Set([
+    "password",
+    "secret",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "clientsecret",
+    "apikey",
+    "oauthaccesstoken",
+    "authorization",
+    "cookie",
+    "set-cookie",
+]);
+/**
+ * Regex patterns for string-level fallback redaction.
+ * Applied in order; each match is replaced with `[REDACTED:name]`.
+ */
+exports.SENSITIVE_PATTERNS = [
+    { name: "anthropic_key", pattern: /sk-ant-[A-Za-z0-9_-]+/g },
+    { name: "openai_key", pattern: /sk-proj-[A-Za-z0-9_-]+/g },
+    { name: "bearer_token", pattern: /Bearer [A-Za-z0-9\-_.]+/g },
+    { name: "api_key_assignment", pattern: /api[_-]?key[=:]\s*["']?[A-Za-z0-9\-_.]+/g },
+    { name: "url_token", pattern: /[?&](?:token|key|api_key|access_token)=[A-Za-z0-9\-_.%]+/g },
+];
+/**
+ * Deep-clone meta and replace values at sensitive keys with `[REDACTED:key_name]`.
+ * Recurses into nested objects. Case-insensitive key matching.
+ */
+function redactMeta(meta) {
+    const result = {};
+    for (const key of Object.keys(meta)) {
+        const value = meta[key];
+        if (exports.SENSITIVE_KEYS.has(key.toLowerCase())) {
+            result[key] = `[REDACTED:${key}]`;
+        }
+        else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+            result[key] = redactMeta(value);
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Apply all regex patterns to a string, replacing matches with `[REDACTED:pattern_name]`.
+ */
+function redactString(text) {
+    let result = text;
+    for (const { name, pattern } of exports.SENSITIVE_PATTERNS) {
+        // Reset lastIndex for global regexes reused across calls
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, `[REDACTED:${name}]`);
+    }
+    return result;
+}
+/**
+ * Full redaction pipeline: redact meta (structured keys), then redact message (regex patterns).
+ * Returns a new LogEvent -- never mutates the input.
+ */
+function redactLogEntry(entry) {
+    const redactedMeta = redactMeta(entry.meta);
+    const redactedMessage = redactString(entry.message);
+    return {
+        ...entry,
+        meta: redactedMeta,
+        message: redactedMessage,
+    };
+}

package/dist/nerves/review/cli-main.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const cli_1 = require("./cli");
+const code = (0, cli_1.runNervesReviewCli)(process.argv.slice(2));
+process.exit(code);