@praneeth_54/agentdoctor 1.1.1 → 2.0.0

package/dist/core/secrets/scan.js

@@ -0,0 +1,172 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveRepoRoot, toPosixRelative } from "../../utils/path.js";
+const SECRET_PATTERNS = [
+    {
+        id: "aws-access-key",
+        re: /\bAKIA[0-9A-Z]{16}\b/g,
+        severity: "critical",
+    },
+    {
+        id: "generic-api-key",
+        re: /\b(?:api[_-]?key|secret[_-]?key|access[_-]?token)\s*[:=]\s*['"]?[A-Za-z0-9_-]{16,}['"]?/gi,
+        severity: "warning",
+    },
+    {
+        id: "private-key-header",
+        re: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+        severity: "critical",
+    },
+    {
+        id: "github-pat",
+        re: /\bghp_[A-Za-z0-9]{36}\b/g,
+        severity: "critical",
+    },
+];
+const SKIP_DIR = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "coverage",
+    ".agentdoctor",
+    "vendor",
+    ".next",
+]);
+const TEXT_EXT = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".yml",
+    ".yaml",
+    ".md",
+    ".env",
+    ".txt",
+    ".toml",
+    ".ini",
+    ".cfg",
+    ".py",
+    ".go",
+    ".rs",
+    ".java",
+    ".kt",
+    ".php",
+    ".rb",
+    ".sh",
+]);
+function redactMatch(line, match) {
+    const idx = line.indexOf(match);
+    if (idx < 0) {
+        return "[REDACTED]";
+    }
+    const before = line.slice(0, idx).slice(-40);
+    const after = line.slice(idx + match.length).slice(0, 20);
+    return `${before}[REDACTED]${after}`.trim();
+}
+async function walkFiles(root, dir, out, limit) {
+    if (out.length >= limit)
+        return;
+    let entries;
+    try {
+        entries = await fs.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (out.length >= limit)
+            return;
+        if (entry.name.startsWith(".") && entry.name !== ".env" && entry.name !== ".env.local") {
+            if (SKIP_DIR.has(entry.name))
+                continue;
+        }
+        if (SKIP_DIR.has(entry.name))
+            continue;
+        const absolute = path.join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            await walkFiles(root, absolute, out, limit);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        const ext = path.extname(entry.name).toLowerCase();
+        if (!TEXT_EXT.has(ext) && !entry.name.startsWith(".env"))
+            continue;
+        out.push(absolute);
+    }
+}
+/**
+ * Opt-in content secret scan. Findings never include raw secret values.
+ */
+export async function scanSecrets(options) {
+    const root = resolveRepoRoot(options.root);
+    if (!options.enabled) {
+        return {
+            root,
+            enabled: false,
+            filesScanned: 0,
+            findings: [],
+            limitations: ["Content secret scanning disabled (pass --secrets to enable)"],
+        };
+    }
+    const maxFiles = options.maxFiles ?? 400;
+    const files = [];
+    await walkFiles(root, root, files, maxFiles);
+    const findings = [];
+    const limitations = [];
+    if (files.length >= maxFiles) {
+        limitations.push(`Scan capped at ${maxFiles} files`);
+    }
+    for (const absolute of files) {
+        let content;
+        try {
+            const st = await fs.stat(absolute);
+            if (st.size > 512 * 1024)
+                continue;
+            content = await fs.readFile(absolute, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const lines = content.split(/\r?\n/);
+        const rel = toPosixRelative(root, absolute);
+        for (let i = 0; i < lines.length; i += 1) {
+            const line = lines[i] ?? "";
+            for (const pattern of SECRET_PATTERNS) {
+                pattern.re.lastIndex = 0;
+                let match;
+                while ((match = pattern.re.exec(line)) !== null) {
+                    findings.push({
+                        file: rel,
+                        line: i + 1,
+                        ruleId: pattern.id,
+                        redactedSnippet: redactMatch(line, match[0] ?? ""),
+                        severity: pattern.severity,
+                    });
+                    if (findings.length >= 200) {
+                        limitations.push("Finding cap reached (200)");
+                        return {
+                            root,
+                            enabled: true,
+                            filesScanned: files.length,
+                            findings,
+                            limitations,
+                        };
+                    }
+                }
+            }
+        }
+    }
+    return {
+        root,
+        enabled: true,
+        filesScanned: files.length,
+        findings,
+        limitations,
+    };
+}

package/dist/dashboard/server.d.ts

@@ -0,0 +1,24 @@
+export interface DashboardServerOptions {
+    root: string;
+    host?: string;
+    port?: number;
+    /** Read-only by default; mutating routes are never registered. */
+    readOnly?: boolean;
+    /**
+     * Unsafe opt-in to bind outside loopback. Not an enterprise security boundary.
+     * Local ?user= role selection remains spoofable.
+     */
+    allowNonLoopback?: boolean;
+}
+export declare function isLoopbackHost(host: string): boolean;
+/**
+ * Local read-only HTTP dashboard. Never applies Safe Fix or mutates the repo.
+ * Defaults to loopback binding; non-loopback requires explicit allowNonLoopback.
+ */
+export declare function startDashboardServer(options: DashboardServerOptions): Promise<{
+    host: string;
+    port: number;
+    close: () => Promise<void>;
+}>;
+/** Write a static snapshot HTML for offline viewing (optional helper). */
+export declare function writeDashboardSnapshot(rootInput: string, outputPath: string): Promise<string>;

package/dist/dashboard/server.js

@@ -0,0 +1,386 @@
+import http from "node:http";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { getBrainStatus } from "../core/brain-cli/service.js";
+import { listFixAudits } from "../core/fix/backup.js";
+import { listNamedBaselines } from "../core/baseline/store.js";
+import { detectMonorepo } from "../core/monorepo/detect.js";
+import { scan } from "../core/scanner/scan.js";
+import { resolveRepoRoot } from "../utils/path.js";
+import { agentRegistry } from "../agents/registry.js";
+import { listSessions } from "../platform/sessions/store.js";
+import { platformDir, readJsonIfExists } from "../platform/store.js";
+import { canAccess, loadLocalAuthConfig, resolveRole } from "../platform/auth/local.js";
+import { EVALUATE_ONLY } from "../platform/firewall/evaluate.js";
+import { redactSecrets, sanitizeFindingsForExport } from "../platform/security/redact.js";
+import { buildIntelligenceGraph } from "../intelligence/graph/build.js";
+import { analyzeGitIntelligence } from "../intelligence/git/analyze.js";
+import { buildC4Views } from "../architecture/c4.js";
+import { listKnowledge } from "../knowledge/store.js";
+import { CONTRACTS_VERSION } from "../contracts/index.js";
+import { collectOpsHealth } from "../ops/health.js";
+import { listPolicyPacks } from "../policy/packs.js";
+import { sanitizeForOutput } from "../utils/path.js";
+function safeJsonError(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    const { text } = redactSecrets(sanitizeForOutput(raw));
+    return text.slice(0, 240);
+}
+function pathnameLooksHostile(pathname) {
+    const lower = pathname.toLowerCase();
+    const decoded = (() => {
+        try {
+            return decodeURIComponent(pathname);
+        }
+        catch {
+            return pathname;
+        }
+    })();
+    return (pathname.includes("\0") ||
+        decoded.includes("\0") ||
+        pathname.includes("..") ||
+        decoded.includes("..") ||
+        lower.includes("%2e%2e") ||
+        lower.includes("%2e.") ||
+        lower.includes(".%2e") ||
+        pathname.includes("\\") ||
+        decoded.includes("\\"));
+}
+function redactGraphSamples(nodes) {
+    return nodes.map((n) => {
+        const next = { ...n };
+        if (typeof next.label === "string") {
+            next.label = redactSecrets(next.label).text;
+        }
+        if (typeof next.path === "string") {
+            next.path = redactSecrets(next.path).text;
+        }
+        return next;
+    });
+}
+export function isLoopbackHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return (normalized === "127.0.0.1" ||
+        normalized === "::1" ||
+        normalized === "localhost" ||
+        normalized === "0:0:0:0:0:0:0:1");
+}
+function htmlPage() {
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>AgentDoctor Dashboard</title>
+  <style>
+    :root { --bg:#0f1419; --fg:#e7ecf1; --muted:#9aa7b5; --accent:#3d9cfd; --card:#1a222c; }
+    * { box-sizing: border-box; }
+    body { margin:0; font-family: ui-sans-serif, system-ui, sans-serif; background:var(--bg); color:var(--fg); }
+    header { padding:1.25rem 1.5rem; border-bottom:1px solid #243040; }
+    h1 { margin:0; font-size:1.25rem; letter-spacing:0.02em; }
+    p { color:var(--muted); margin:0.35rem 0 0; }
+    main { padding:1.5rem; display:grid; gap:1rem; max-width:1100px; margin:0 auto; }
+    section { background:var(--card); border-radius:10px; padding:1rem 1.1rem; }
+    h2 { margin:0 0 0.75rem; font-size:1rem; }
+    pre { white-space:pre-wrap; word-break:break-word; font-size:0.85rem; color:#d5dde6; }
+    .muted { color:var(--muted); }
+    a { color:var(--accent); }
+    .notice { border-left:3px solid var(--accent); padding-left:0.75rem; margin-top:0.75rem; }
+  </style>
+</head>
+<body>
+  <header>
+    <h1>AgentDoctor 2.0</h1>
+    <p>Local read-only dashboard — Safety + Brain + intelligence. No cloud writes.</p>
+    <p class="notice muted">Action Policy Evaluator is evaluate-only. Local ?user= is not authentication. Team local-dev auth is separate and not SSO.</p>
+  </header>
+  <main>
+    <nav aria-label="Views" style="display:flex;flex-wrap:wrap;gap:0.75rem;font-size:0.9rem">
+      <a href="#overview">Overview</a>
+      <a href="#scan">Safety scan</a>
+      <a href="#platform">Platform</a>
+      <a href="#brain">Brain</a>
+      <a href="#graph">Graph</a>
+      <a href="#knowledge">Knowledge</a>
+      <a href="#meta">Audit / baselines</a>
+    </nav>
+    <section id="overview">
+      <h2>Overview</h2>
+      <pre id="status" class="muted">Loading…</pre>
+    </section>
+    <section id="scan">
+      <h2>Safety scan</h2>
+      <pre id="scanBody" class="muted">Loading…</pre>
+    </section>
+    <section id="platform">
+      <h2>Platform snapshot (incl. test-impact)</h2>
+      <pre id="platformBody" class="muted">Loading…</pre>
+    </section>
+    <section id="brain">
+      <h2>Project Brain</h2>
+      <pre id="brainBody" class="muted">Loading…</pre>
+    </section>
+    <section id="graph">
+      <h2>Intelligence graph / git / C4</h2>
+      <pre id="graphBody" class="muted">Loading…</pre>
+    </section>
+    <section id="knowledge">
+      <h2>Governed knowledge</h2>
+      <pre id="knowledgeBody" class="muted">Loading…</pre>
+    </section>
+    <section id="meta">
+      <h2>Safe Fix audit / baselines / sessions</h2>
+      <pre id="metaBody" class="muted">Loading…</pre>
+    </section>
+  </main>
+  <script>
+    async function load() {
+      const [status, scan, brain, meta, platform, graph, knowledge] = await Promise.all([
+        fetch('/api/status').then(r => r.json()),
+        fetch('/api/scan').then(r => r.json()),
+        fetch('/api/brain').then(r => r.json()),
+        fetch('/api/meta').then(r => r.json()),
+        fetch('/api/platform').then(r => r.json()),
+        fetch('/api/v2/graph').then(r => r.json()),
+        fetch('/api/v2/knowledge').then(r => r.json()),
+      ]);
+      document.getElementById('status').textContent = JSON.stringify(status, null, 2);
+      document.getElementById('scanBody').textContent = JSON.stringify(scan, null, 2);
+      document.getElementById('brainBody').textContent = JSON.stringify(brain, null, 2);
+      document.getElementById('metaBody').textContent = JSON.stringify(meta, null, 2);
+      document.getElementById('platformBody').textContent = JSON.stringify(platform, null, 2);
+      document.getElementById('graphBody').textContent = JSON.stringify(graph, null, 2);
+      document.getElementById('knowledgeBody').textContent = JSON.stringify(knowledge, null, 2);
+    }
+    load().catch(err => {
+      document.getElementById('status').textContent = String(err);
+    });
+  </script>
+</body>
+</html>`;
+}
+function sendJson(res, status, body) {
+    const payload = JSON.stringify(body, null, 2);
+    res.writeHead(status, {
+        "Content-Type": "application/json; charset=utf-8",
+        "Cache-Control": "no-store",
+    });
+    res.end(payload);
+}
+/**
+ * Local read-only HTTP dashboard. Never applies Safe Fix or mutates the repo.
+ * Defaults to loopback binding; non-loopback requires explicit allowNonLoopback.
+ */
+export async function startDashboardServer(options) {
+    const root = resolveRepoRoot(options.root);
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 8787;
+    if (!isLoopbackHost(host) && options.allowNonLoopback !== true) {
+        throw new Error(`Refusing to bind dashboard to non-loopback host "${host}". Pass allowNonLoopback / --allow-non-loopback to override (unsafe; not an enterprise security boundary).`);
+    }
+    const server = http.createServer(async (req, res) => {
+        try {
+            const rawUrl = req.url ?? "/";
+            if (pathnameLooksHostile(rawUrl.split("?")[0] ?? rawUrl)) {
+                sendJson(res, 400, { error: "invalid path" });
+                return;
+            }
+            const url = new URL(rawUrl, `http://${host}:${port}`);
+            if (req.method !== "GET") {
+                sendJson(res, 405, { error: "read-only dashboard; GET only" });
+                return;
+            }
+            if (pathnameLooksHostile(url.pathname)) {
+                sendJson(res, 400, { error: "invalid path" });
+                return;
+            }
+            if (url.pathname === "/" || url.pathname === "/index.html") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+                res.end(htmlPage());
+                return;
+            }
+            if (url.pathname === "/api/status") {
+                const mono = await detectMonorepo(root);
+                const health = await collectOpsHealth(root);
+                sendJson(res, 200, {
+                    root,
+                    readOnly: true,
+                    host,
+                    loopbackOnly: isLoopbackHost(host),
+                    contractsVersion: CONTRACTS_VERSION,
+                    roleNote: "Local ?user= role selection is not authentication",
+                    actionPolicyNote: EVALUATE_ONLY,
+                    adapters: agentRegistry.map((a) => a.id),
+                    policyPacks: listPolicyPacks(),
+                    ops: health,
+                    monorepo: {
+                        isMonorepo: mono.isMonorepo,
+                        tool: mono.tool,
+                        packages: mono.packages.length,
+                    },
+                });
+                return;
+            }
+            if (url.pathname === "/api/scan") {
+                const result = await scan({ cwd: root });
+                sendJson(res, 200, {
+                    summary: result.summary,
+                    scores: result.scores,
+                    findingCount: result.findings.length,
+                    findings: result.findings.slice(0, 50).map((f) => ({
+                        id: f.id,
+                        ruleId: f.ruleId,
+                        severity: f.severity,
+                        title: f.title,
+                        path: f.evidence?.path ?? null,
+                    })),
+                });
+                return;
+            }
+            if (url.pathname === "/api/brain") {
+                sendJson(res, 200, await getBrainStatus(root));
+                return;
+            }
+            if (url.pathname === "/api/meta") {
+                const audits = await listFixAudits(root);
+                const baselines = await listNamedBaselines(root);
+                const sessions = await listSessions(root);
+                sendJson(res, 200, {
+                    fixAudits: audits.slice(0, 20).map((a) => ({
+                        id: a.id,
+                        mode: a.mode,
+                        createdAt: a.createdAt,
+                        entryCount: a.entries.length,
+                    })),
+                    baselines,
+                    sessions: sessions.slice(0, 50),
+                });
+                return;
+            }
+            if (url.pathname === "/api/platform") {
+                const auth = await loadLocalAuthConfig(root);
+                const role = resolveRole(auth, url.searchParams.get("user") ?? undefined);
+                if (!canAccess(role, "read-findings")) {
+                    sendJson(res, 403, { error: "forbidden" });
+                    return;
+                }
+                const snapshot = await readJsonIfExists(path.join(platformDir(root), "snapshots", "latest.json"));
+                const canExport = canAccess(role, "export-reports");
+                const safeFindings = snapshot
+                    ? sanitizeFindingsForExport(snapshot.findings).slice(0, 30)
+                    : [];
+                sendJson(res, 200, {
+                    role,
+                    hasSnapshot: snapshot !== null,
+                    findingCount: snapshot?.findings.length ?? 0,
+                    graphNodes: snapshot?.graph.nodes.length ?? 0,
+                    readiness: snapshot?.readiness.categories ?? [],
+                    testImpact: snapshot?.testImpact
+                        ? {
+                            gitAvailable: snapshot.testImpact.gitAvailable,
+                            changedFiles: snapshot.testImpact.changedFiles.length,
+                            recommendedTests: snapshot.testImpact.recommendedTests.length,
+                            missingTestWarnings: snapshot.testImpact.missingTestWarnings.length,
+                            relatedModules: snapshot.testImpact.relatedModules,
+                            skipRisk: snapshot.testImpact.skipRisk,
+                            sampleRecommended: canExport
+                                ? snapshot.testImpact.recommendedTests.slice(0, 20)
+                                : [],
+                            sampleMissing: canExport
+                                ? snapshot.testImpact.missingTestWarnings.slice(0, 10)
+                                : [],
+                        }
+                        : null,
+                    limitations: [
+                        ...(snapshot?.limitations ?? [
+                            "No platform snapshot yet — run: agentdoctor platform scan",
+                        ]),
+                        "Local ?user= role selection is not authentication — spoofable on shared hosts",
+                        EVALUATE_ONLY,
+                    ],
+                    sampleFindings: canExport
+                        ? safeFindings.map((f) => ({
+                            id: f.id,
+                            module: f.module,
+                            severity: f.severity,
+                            title: f.title,
+                        }))
+                        : [],
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/graph") {
+                const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+                sendJson(res, 200, {
+                    contractsVersion: CONTRACTS_VERSION,
+                    builder: graph.builder,
+                    nodeCount: graph.nodes.length,
+                    edgeCount: graph.edges.length,
+                    sampleNodes: redactGraphSamples(graph.nodes.slice(0, 40)),
+                    sampleEdges: graph.edges.slice(0, 40),
+                    limitations: graph.limitations,
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/health") {
+                sendJson(res, 200, await analyzeGitIntelligence(root));
+                return;
+            }
+            if (url.pathname === "/api/v2/c4") {
+                const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+                sendJson(res, 200, {
+                    views: buildC4Views(graph),
+                    label: "Inferred/proposed — not approved architecture facts",
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/knowledge") {
+                const records = await listKnowledge(root);
+                sendJson(res, 200, {
+                    count: records.length,
+                    records: records.slice(0, 100).map((r) => ({
+                        id: r.id,
+                        title: r.title,
+                        status: r.status,
+                        version: r.version,
+                    })),
+                });
+                return;
+            }
+            if (url.pathname === "/api/v2/projects" || url.pathname === "/api/v2/workspaces") {
+                sendJson(res, 200, {
+                    mode: "local-single-repo",
+                    root,
+                    notice: "Multi-repo workspaces are partially implemented (storage abstraction). Cloud org workspaces unsupported.",
+                });
+                return;
+            }
+            sendJson(res, 404, { error: "not found" });
+        }
+        catch (error) {
+            sendJson(res, 500, { error: safeJsonError(error) });
+        }
+    });
+    await new Promise((resolve, reject) => {
+        server.listen(port, host, () => resolve());
+        server.on("error", reject);
+    });
+    const address = server.address();
+    const boundPort = typeof address === "object" && address && typeof address.port === "number"
+        ? address.port
+        : port;
+    return {
+        host,
+        port: boundPort,
+        close: async () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+/** Write a static snapshot HTML for offline viewing (optional helper). */
+export async function writeDashboardSnapshot(rootInput, outputPath) {
+    const absolute = path.resolve(outputPath);
+    await fs.mkdir(path.dirname(absolute), { recursive: true });
+    await fs.writeFile(absolute, htmlPage(), "utf8");
+    return absolute;
+}

package/dist/enforcement/runner.d.ts

@@ -0,0 +1,23 @@
+import type { PolicyDecisionContract } from "../contracts/index.js";
+export interface EnforcementResult {
+    decision: PolicyDecisionContract;
+    enforced: boolean;
+    notice: string;
+}
+/**
+ * AgentDoctor-controlled command runner.
+ * Only this boundary can mark execution as blocked-by-enforcement when it refuses to run.
+ */
+export declare function runControlledCommand(options: {
+    root: string;
+    command: string;
+    failClosed?: boolean;
+    /** When true, actually attempt execution only if policy allows — still default false. */
+    executeIfAllowed?: boolean;
+}): Promise<EnforcementResult>;
+/** Append-only tamper-evident audit chain (HMAC over previous hash). */
+export declare function appendAuditChain(previousHash: string | null, record: unknown, secret?: string): {
+    hash: string;
+    payload: string;
+};
+export declare function auditRecordId(parts: string): string;

package/dist/enforcement/runner.js

@@ -0,0 +1,56 @@
+import { createHash, randomUUID } from "node:crypto";
+import { createHmac } from "node:crypto";
+import { evaluateAgentAction, EVALUATE_ONLY } from "../platform/firewall/evaluate.js";
+/**
+ * AgentDoctor-controlled command runner.
+ * Only this boundary can mark execution as blocked-by-enforcement when it refuses to run.
+ */
+export async function runControlledCommand(options) {
+    const action = {
+        actionId: randomUUID(),
+        agentId: "enforcement-runner",
+        timestamp: new Date().toISOString(),
+        type: "shell",
+        params: { command: options.command },
+        repositoryRoot: options.root,
+    };
+    const verdict = await evaluateAgentAction(options.root, action, {
+        failClosed: options.failClosed === true,
+    });
+    const blocked = verdict.decision === "block" || verdict.decision === "deny-network";
+    const decision = {
+        actionId: verdict.actionId,
+        decision: verdict.decision,
+        reason: verdict.reason,
+        ...(verdict.policyId ? { policyId: verdict.policyId } : {}),
+        policyVersion: "2.0",
+        inputClassification: "shell",
+        evidence: [{ id: "ev_policy", kind: "observed", detail: verdict.reason }],
+        riskLevel: verdict.riskLevel,
+        executionStatus: blocked
+            ? "blocked-by-enforcement"
+            : options.executeIfAllowed && verdict.decision === "allow"
+                ? "not-executed"
+                : "not-executed",
+        approvalStatus: verdict.approvalStatus,
+        timestamp: new Date().toISOString(),
+    };
+    return {
+        decision,
+        enforced: blocked,
+        notice: blocked
+            ? `Blocked by AgentDoctor-controlled runner. ${EVALUATE_ONLY}`
+            : `Policy ${verdict.decision}; runner did not execute. ${EVALUATE_ONLY}`,
+    };
+}
+/** Append-only tamper-evident audit chain (HMAC over previous hash). */
+export function appendAuditChain(previousHash, record, secret = "local-dev-audit-key") {
+    const body = JSON.stringify(record);
+    const hash = createHmac("sha256", secret)
+        .update(`${previousHash ?? "GENESIS"}:${body}`)
+        .digest("hex");
+    return { hash, payload: body };
+}
+export function auditRecordId(parts) {
+    return `audit_${createHash("sha1").update(parts).digest("hex").slice(0, 12)}`;
+}

package/dist/index.d.ts

@@ -1,3 +1,15 @@
+export { CONTRACTS_VERSION, DEFAULT_FEATURE_FLAGS } from "./contracts/index.js";
+export { buildIntelligenceGraph } from "./intelligence/graph/build.js";
+export { analyzeGitIntelligence } from "./intelligence/git/analyze.js";
+export { buildC4Views } from "./architecture/c4.js";
+export { createKnowledgeRecord, listKnowledge, transitionKnowledge, retrieveAuthoritative, } from "./knowledge/store.js";
+export { FilesystemStorageProvider, MemoryStorageProvider } from "./storage/provider.js";
+export { runControlledCommand } from "./enforcement/runner.js";
+export { registerLocalDevUser, authenticateLocalDev, authorize } from "./team/auth.js";
+export { runProjectInit, listProposals, reviewProposal } from "./core/brain-product/init.js";
+export { collectOpsHealth } from "./ops/health.js";
+export { listPolicyPacks, getPolicyPack } from "./policy/packs.js";
+export { listIntelligenceMcpTools, INTELLIGENCE_MCP_TOOL_NAMES, } from "./mcp/intelligence/registry.js";
 export { scan } from "./core/scanner/scan.js";
 export { verify } from "./core/verify/verify.js";
 export { compareFindings } from "./core/verify/compare.js";
@@ -12,6 +24,7 @@ export { ruleRegistry, getRuleById } from "./core/rules/registry.js";
 export { runRules } from "./core/rules/run-rules.js";
 export { buildFixPlan } from "./core/fix/plan.js";
 export { applyFixPlan } from "./core/fix/apply.js";
+export type { ApplyFixPlanOptions } from "./core/fix/apply.js";
 export { runFix } from "./core/fix/run.js";
 export { evaluatePolicy, evaluateScanPolicy, evaluateVerifyPolicy, parseFailOnRules, parseSeverityGate, } from "./core/policy/evaluate.js";
 export type { PolicyOptions, PolicyViolation, PolicyViolationCode, PolicyInput, } from "./core/policy/evaluate.js";