@schema-weaver/pg-connector 0.0.0-stage → 2.0.1

package/dist/types/channels/reconnect.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Exponential backoff calculator.
+ * Sequence: 1s, 2s, 4s, 8s, 16s, 32s, 60s, 60s, 60s, ...
+ */
+export declare class Backoff {
+    /** Custom backoff schedule (defaults to DEFAULTS.RECONNECT_BACKOFF_MS). */
+    private readonly schedule;
+    private attempt;
+    private readonly max;
+    constructor(
+    /** Custom backoff schedule (defaults to DEFAULTS.RECONNECT_BACKOFF_MS). */
+    schedule?: readonly number[], 
+    /** Maximum delay cap (defaults to last value in schedule). */
+    maxMs?: number);
+    /** Returns the next delay in ms (does NOT sleep). */
+    next(): number;
+    /** Current attempt number (0 before first next() call). */
+    get attempts(): number;
+    /** Reset to attempt 0 (call after successful connect). */
+    reset(): void;
+    /** Sleep for the next backoff delay. Returns the ms slept. */
+    sleepNext(): Promise<number>;
+}
+/** Promise-based sleep. */
+export declare function sleep(ms: number): Promise<void>;
+/**
+ * Compute jittered backoff (±20% of base delay) to prevent thundering herd.
+ * Optional — use only if you want to add jitter on top of Backoff.
+ */
+export declare function withJitter(delayMs: number, jitterPct?: number): number;
+/** URL schemes that mean "TLS-protected". Nothing else may carry the token. */
+export declare const SECURE_TRANSPORT_SCHEMES: readonly string[];
+/**
+ * Operator-facing remediation for a rejected or expired agent token.
+ *
+ * Wording is kept in step with `sw-agent agent rotate-token`: a running agent
+ * keeps the credential it was started with, so the restart is part of the fix,
+ * not an optional extra.
+ */
+export declare const TOKEN_ROTATION_HINT: string;
+/**
+ * Remediation for a cleartext transport target.
+ *
+ * Names the sanctioned lab escape hatch (`--insecure-transport`, audit H-03) with
+ * its costs attached. The config validators reject plaintext URLs outright, so
+ * the flag is the only route to a cleartext socket — withholding it would leave
+ * the operator with a refusal they cannot act on and a plaintext mode they cannot
+ * discover. The secure remedy still comes first and the flag is stated as a last
+ * resort that keeps the token in cleartext for the whole session.
+ */
+export declare const INSECURE_TRANSPORT_HINT: string;
+/** Marker so operators can grep logs for this condition. */
+export declare const INSECURE_TRANSPORT_MARKER = "[INSECURE TRANSPORT]";
+export type TransportSecurityErrorCode = 'insecure_transport' | 'invalid_url';
+/**
+ * Thrown when an outbound target is not a TLS-protected `wss:`/`https:` URL.
+ *
+ * Every outbound connection path throws this instead of downgrading the
+ * protocol, so the agent token can never be written to a cleartext socket.
+ */
+export declare class TransportSecurityError extends Error {
+    code: TransportSecurityErrorCode;
+    /** The offending target, as supplied by config. */
+    url: string;
+    /** The offending scheme, or '' when the URL could not be parsed. */
+    scheme: string;
+    /** Short description of the connection attempt, e.g. "wake channel". */
+    context: string;
+    constructor(code: TransportSecurityErrorCode, message: string, 
+    /** The offending target, as supplied by config. */
+    url: string, 
+    /** The offending scheme, or '' when the URL could not be parsed. */
+    scheme: string, 
+    /** Short description of the connection attempt, e.g. "wake channel". */
+    context?: string);
+}
+export interface TransportGuardOptions {
+    /**
+     * Opt-in plaintext allowance, for an explicit operator decision only. The CLI
+     * rejects plaintext URLs outright, so nothing in the shipped product sets
+     * this; it exists so a downstream embedder that has made its own decision
+     * cannot do so silently. When set, a loud warning is logged on every call.
+     */
+    allowInsecure?: boolean;
+    /** Short description of the connection attempt, used in error messages. */
+    context?: string;
+}
+/**
+ * True when the target is a TLS-protected `wss:`/`https:` URL. Unparseable
+ * input returns false — callers must fail closed.
+ */
+export declare function isSecureTransportUrl(url: string | URL): boolean;
+/**
+ * Assert that `url` is a `wss:`/`https:` target and return it parsed.
+ *
+ * This is the single enforcement point for audit H-03: every outbound
+ * connection path calls it (directly or via {@link toWebSocketUrl} /
+ * {@link toHttpUrl}) before an `Authorization: Bearer <agent token>` header is
+ * attached. Non-TLS schemes throw instead of being downgraded. Only an
+ * explicit, non-persisted `allowInsecure` opt-in permits plaintext, and it
+ * warns loudly on every call.
+ */
+export declare function assertSecureTransport(url: string | URL, opts?: TransportGuardOptions): URL;
+/**
+ * Build a `wss:` target from a configured cloud URL.
+ *
+ * `https:` maps to `wss:` (same TLS transport, different protocol) and `wss:`
+ * is used as-is. `ws:`/`http:` throw unless the caller passed `allowInsecure`.
+ */
+export declare function toWebSocketUrl(base: string | URL, opts?: TransportGuardOptions): URL;
+/**
+ * Build an `https:` target from a configured cloud URL.
+ *
+ * `wss:` maps to `https:` (same TLS transport, SSE/plain HTTP) and `https:` is
+ * used as-is. `ws:`/`http:` throw unless the caller passed `allowInsecure`.
+ */
+export declare function toHttpUrl(base: string | URL, opts?: TransportGuardOptions): URL;
+/**
+ * Backoff schedule for consecutive authentication failures. Kept separate from
+ * DEFAULTS.RECONNECT_BACKOFF_MS because a rejected credential is a different
+ * class of failure: it is slow to start and slow to give up on.
+ */
+export declare const AUTH_FAILURE_BACKOFF_MS: readonly number[];
+/**
+ * Consecutive 401/403 responses tolerated before the wake loop stops retrying.
+ *
+ * Policy: a credential the server evaluated and rejected cannot become valid by
+ * retrying, so retries are bounded rather than infinite. The bound exists only
+ * to absorb the two realistic transient cases — clock skew and a token the
+ * cloud rotated but has not yet replicated — after which the loop stops instead
+ * of hammering the auth endpoint from every connected agent.
+ */
+export declare const MAX_AUTH_FAILURE_ATTEMPTS = 5;
+/**
+ * Operator-facing message for a credential the cloud rejected.
+ */
+export declare function formatTokenRejectedMessage(status?: number, attempts?: number, maxAttempts?: number): string;
+/**
+ * Operator-facing message for a credential the client itself found expired.
+ */
+export declare function formatTokenExpiredMessage(expiresAt: number, marginMs: number, context: string): string;
+//# sourceMappingURL=reconnect.d.ts.map

package/dist/types/channels/reconnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconnect.d.ts","sourceRoot":"","sources":["../../../src/channels/reconnect.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,qBAAa,OAAO;IAKhB,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAL3B,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;;IAG3B,2EAA2E;IAC1D,QAAQ,GAAE,SAAS,MAAM,EAAkC;IAC5E,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM;IAKhB,qDAAqD;IACrD,IAAI,IAAI,MAAM;IAOd,2DAA2D;IAC3D,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,0DAA0D;IAC1D,KAAK,IAAI,IAAI;IAIb,8DAA8D;IACxD,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;CAKnC;AAED,2BAA2B;AAC3B,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY,GAAG,MAAM,CAG3E;AAMD,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAsC,CAAC;AAE7F;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QAEE,CAAC;AAEnC;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAKoC,CAAC;AAEzE,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE,MAAM,MAAM,0BAA0B,GAAG,oBAAoB,GAAG,aAAa,CAAC;AAE9E;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAEtC,IAAI,EAAE,0BAA0B;IAEvC,mDAAmD;IAC5C,GAAG,EAAE,MAAM;IAClB,oEAAoE;IAC7D,MAAM,EAAE,MAAM;IACrB,wEAAwE;IACjE,OAAO,EAAE,MAAM;gBAPf,IAAI,EAAE,0BAA0B,EACvC,OAAO,EAAE,MAAM;IACf,mDAAmD;IAC5C,GAAG,EAAE,MAAM;IAClB,oEAAoE;IAC7D,MAAM,EAAE,MAAM;IACrB,wEAAwE;IACjE,OAAO,GAAE,MAA8B;CAKjD;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAqBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,CAQ/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,qBAA0B,GAAG,GAAG,CAiB9F;AAaD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,qBAA0B,GAAG,GAAG,CAQxF;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAE,qBAA0B,GAAG,GAAG,CAUnF;AAMD;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAEnD,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAWR;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,MAAM,CAMR"}

package/dist/types/channels/types.d.ts

@@ -0,0 +1,112 @@
+import { AgentMessage, Role } from '../protocol/envelope';
+/**
+ * State of the wake channel (SSE).
+ * - disconnected: not connected, possibly mid-backoff
+ * - connecting: HTTPS request in flight, awaiting response
+ * - connected: SSE stream open, receiving events
+ * - error: connection failed, will retry
+ */
+export type WakeChannelState = 'disconnected' | 'connecting' | 'connected' | 'error';
+/**
+ * Per-session envelope authentication policy.
+ *
+ * Supplied by the daemon from machine config; every field is optional and every
+ * default lives in `src/protocol/constants.ts` so the policy has exactly one
+ * definition. Nothing here can turn the negotiated-role check or the replay
+ * check off.
+ */
+export interface EnvelopeAuthPolicy {
+    /**
+     * Reject inbound envelopes that carry no per-session MAC. Defaults to
+     * ENVELOPE_MAC_REQUIRED_DEFAULT (true).
+     */
+    requireMac?: boolean;
+    /**
+     * Local ceiling: the highest role the relay may negotiate for this session,
+     * regardless of what it asks for. Defaults to
+     * ENVELOPE_MAX_NEGOTIABLE_ROLE_DEFAULT.
+     */
+    maxNegotiableRole?: Role;
+}
+/**
+ * State of the data channel (WSS).
+ * - closed: not open (either never opened, or closed after idle/disconnect)
+ * - connecting: WSS handshake in flight
+ * - open: ready to send/receive messages
+ * - closing: close handshake in flight
+ * - error: connection failed
+ */
+export type DataChannelState = 'closed' | 'connecting' | 'open' | 'closing' | 'error';
+/**
+ * Reason the data channel closed. Used for reconnect decisions and audit.
+ */
+export type DataChannelCloseReason = 'idle_timeout' | 'explicit_close' | 'remote_close' | 'protocol_error' | 'network_error' | 'auth_failed' | 'fatal_error' | 'shutdown';
+/**
+ * Wake event pushed by cloud via SSE.
+ * Tells the agent: "open the data channel, browser has work for you."
+ */
+export interface WakeEvent {
+    /** Unique ID for this wake (for dedup if SSE redelivers). */
+    wake_id: string;
+    /** Why cloud is waking the agent. */
+    reason: 'browser_request' | 'ping' | 'migration_queued' | 'config_sync';
+    /** Browser session ID that wants to talk (for routing). */
+    browser_session_id?: string;
+    /** Optional request_id that triggered the wake (for fast-track). */
+    request_id?: string;
+    /** When cloud queued this wake (epoch ms). */
+    queued_at: number;
+    /** Short-lived token to use when opening the data channel. */
+    data_channel_token: string;
+    /** When data_channel_token expires (epoch ms). */
+    data_channel_token_expires_at: number;
+    /**
+     * Roles the cloud agreed this session may act as. The connector intersects
+     * this with its own local ceiling and rejects every inbound envelope whose
+     * `user.role` is not in the result, so the relay cannot mint a role after the
+     * fact.
+     *
+     * Omitting this field is not a way to get "any role": an absent or empty list
+     * yields an empty permitted set and every envelope is rejected.
+     */
+    allowed_roles?: Role[];
+}
+/**
+ * Callback signature for incoming messages on the data channel.
+ * Part 5 will register a handler that dispatches to execution engine.
+ */
+export type MessageHandler = (msg: AgentMessage) => Promise<void> | void;
+/**
+ * Callback for state changes (used by agent-session to update browser UI).
+ */
+export type StateChangeHandler = (state: AgentSessionState) => void;
+export interface AgentSessionState {
+    wake: WakeChannelState;
+    data: DataChannelState;
+    /** True if at least one message is in-flight (waiting for response). */
+    has_in_flight: boolean;
+    /** Number of reconnect attempts since last successful connect. */
+    reconnect_attempts: number;
+    /** Last error message (if any). */
+    last_error?: string;
+    /** Epoch ms of last successful wake channel connect. */
+    wake_connected_at?: number;
+    /** Epoch ms of last successful data channel open. */
+    data_opened_at?: number;
+    /** Roles negotiated for the current data-channel session. Empty = none permitted. */
+    negotiated_roles: Role[];
+    /** True once a per-session envelope MAC key has been derived for the open channel. */
+    envelope_mac_active: boolean;
+    /** Inbound envelopes dropped by envelope authentication since start. */
+    envelope_authn_failures: number;
+    /** Epoch ms of the last inbound envelope dropped by envelope authentication. */
+    last_envelope_authn_failure_at?: number;
+    /**
+     * Wake events that were permitted to take over the data channel (audit M-15).
+     * Every increment is also written to the audit sink as a security event.
+     */
+    session_replacements: number;
+    /** Wake events refused because they named a different browser session. */
+    session_replacement_rejections: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types/channels/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,YAAY,GAAG,WAAW,GAAG,OAAO,CAAC;AAErF;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAC9B,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,aAAa,GACb,aAAa,GACb,UAAU,CAAC;AAEf;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GAAG,kBAAkB,GAAG,aAAa,CAAC;IACxE,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kDAAkD;IAClD,6BAA6B,EAAE,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEzE;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,wEAAwE;IACxE,aAAa,EAAE,OAAO,CAAC;IACvB,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzB,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,wEAAwE;IACxE,uBAAuB,EAAE,MAAM,CAAC;IAChC,gFAAgF;IAChF,8BAA8B,CAAC,EAAE,MAAM,CAAC;IACxC;;;OAGG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,8BAA8B,EAAE,MAAM,CAAC;CACxC"}

package/dist/types/channels/wake-channel.d.ts

@@ -0,0 +1,232 @@
+import { WakeChannelState, WakeEvent } from './types';
+/**
+ * Hard ceiling on the incremental SSE parser buffer, in characters.
+ *
+ * A stream that never emits a blank line would otherwise grow this buffer
+ * monotonically for the lifetime of the daemon. JavaScript string length counts
+ * UTF-16 code units, which never exceeds the UTF-8 byte length of the same
+ * text, so a character cap is strictly tighter than a byte cap on
+ * LIMITS.MAX_PAYLOAD_BYTES.
+ */
+export declare const SSE_BUFFER_MAX_CHARS: 16777216;
+/** Maximum characters of `data:` payload parsed out of one SSE event. */
+export declare const SSE_EVENT_DATA_MAX_CHARS: 16777216;
+/** Maximum events queued from a single TCP chunk before the stream is failed. */
+export declare const SSE_MAX_QUEUED_EVENTS = 4096;
+/** Maximum events processed per event-loop turn before yielding. */
+export declare const SSE_MAX_EVENTS_PER_TICK = 64;
+export interface WakeChannelOptions {
+    /** Cloud URL, e.g. "wss://api.schemaweaver.dev" — wss/https are the only accepted schemes. */
+    cloudUrl: string;
+    /** Agent token (sent as Bearer header). */
+    token: string;
+    /** Agent ID (sent as X-Agent-Id header for routing). */
+    agentId: string;
+    /** Optional: returns configured database list from databases.config.json. */
+    getDatabases?: () => Array<{
+        db_alias: string;
+        database: string;
+    }>;
+    /** Called when a wake event arrives. */
+    onWake: (event: WakeEvent) => void;
+    /** Called when channel state changes. */
+    onStateChange?: (state: WakeChannelState, error?: string) => void;
+    /** Optional: custom backoff schedule (for tests). */
+    backoffSchedule?: readonly number[];
+    /** Optional: disable keepalive (for tests). Default true. */
+    enableKeepalive?: boolean;
+    /** Optional: abort signal for clean shutdown. */
+    abortSignal?: AbortSignal;
+    /** Optional: custom backoff schedule for consecutive 401/403 responses. */
+    authBackoffSchedule?: readonly number[];
+    /** Optional: consecutive auth failures tolerated before stopping. Default 5. */
+    maxAuthFailures?: number;
+    /**
+     * Allow a cleartext `http:`/`ws:` target. Only wire this to an explicit,
+     * non-persisted operator flag (`--insecure-transport`).
+     */
+    allowInsecureTransport?: boolean;
+    /** Clock injection point for replay/freshness checks. Defaults to `Date.now`. */
+    now?: () => number;
+    /**
+     * Age of an acceptable wake event, from `queued_at`. Defaults to
+     * DEFAULTS.WAKE_MAX_EVENT_AGE_MS.
+     */
+    maxEventAgeMs?: number;
+    /**
+     * Clock skew tolerated on the cloud-stamped `queued_at` and
+     * `data_channel_token_expires_at`. Defaults to DEFAULTS.WAKE_CLOCK_SKEW_MS.
+     */
+    clockSkewMs?: number;
+    /**
+     * Capacity of the `wake_id` replay cache. Defaults to
+     * LIMITS.WAKE_REPLAY_CACHE_MAX_ENTRIES. The cache is hard-bounded: an
+     * unbounded set of cloud-supplied ids is itself a memory-exhaustion vector.
+     */
+    replayCacheEntries?: number;
+    /** Called when a wake event is refused, for operator-visible reporting. */
+    onWakeRejected?: (reason: WakeRejectionReason, detail: string, event: unknown) => void;
+}
+/** Why a wake event was refused without being dispatched. */
+export type WakeRejectionReason = 'malformed' | 'expired_token' | 'stale' | 'future_dated' | 'replayed' | 'cache_full';
+/** Counters for the wake-event admission checks. Diagnostics only. */
+export interface WakeAdmissionStats {
+    /** Wake ids currently held in the replay cache. Never exceeds the bound. */
+    cached: number;
+    /** Events refused as replays of a cached `wake_id`. */
+    duplicates: number;
+    /** Events refused because the cache was already at its bound. */
+    denied_cache_full: number;
+    /** Events refused for any other reason (malformed, stale, expired token). */
+    refused: number;
+    accepted: number;
+}
+export interface SseBufferStats {
+    /** Current parser buffer size in characters. */
+    current: number;
+    /** High-water mark of the parser buffer since process start. */
+    peak: number;
+    /** Events waiting to be dispatched. */
+    queued: number;
+}
+export declare class WakeChannel {
+    private state;
+    private backoff;
+    private authBackoff;
+    private currentReq?;
+    private shutdownRequested;
+    private readonly opts;
+    private keepaliveTimer?;
+    private lastEventTime;
+    private sleepTimer?;
+    private sleepReject?;
+    private loopPromise?;
+    private loopRunning;
+    private firstAttemptResolver?;
+    private currentReject?;
+    private authFailures;
+    private sseBuffer;
+    private sseQueue;
+    private sseDrainScheduled;
+    private ssePeakChars;
+    private sseFailure?;
+    /**
+     * Admission limits for wake events (audit M-14). Frozen at construction so a
+     * later mutation of `opts` cannot widen them mid-stream.
+     */
+    private readonly wakeLimits;
+    /**
+     * `wake_id` -> first-seen timestamp, insertion-ordered so the oldest entry is
+     * the eviction candidate. Hard-bounded by `wakeLimits.replayCacheEntries`:
+     * when the bound is reached a new id is refused rather than evicting, so a
+     * flood of ids cannot shrink the defence applied to ids already seen.
+     */
+    private readonly seenWakeIds;
+    private wakeDuplicates;
+    private wakeCacheFullDenials;
+    private wakeRefusals;
+    private wakeAccepted;
+    constructor(opts: WakeChannelOptions);
+    /** Start the wake channel. Returns immediately; runs in background. */
+    start(): Promise<void>;
+    /** Graceful shutdown. Waits for current request to abort. */
+    stop(): Promise<void>;
+    /** Current state. */
+    getState(): WakeChannelState;
+    /** Get current backoff reconnect attempts. */
+    getReconnectAttempts(): number;
+    /** Consecutive auth failures observed since the last successful connect. */
+    getAuthFailures(): number;
+    /** Diagnostics: current/peak SSE parser buffer size and pending events. */
+    getSseBufferStats(): SseBufferStats;
+    /** Last SSE stream failure reason, if any. Diagnostics only. */
+    getSseFailureReason(): string | undefined;
+    /**
+     * Wake-event admission counters. `cached` is the current occupancy of the
+     * bounded replay cache and never exceeds the configured bound.
+     */
+    getWakeAdmissionStats(): WakeAdmissionStats;
+    /** Forget every cached `wake_id`. Used when the stream is re-established. */
+    private resetWakeReplayCache;
+    /** Force a reconnect (e.g. after token rotation). Restarts a stopped loop. */
+    reconnect(): Promise<void>;
+    private ensureLoop;
+    /**
+     * Start the liveness checker that tears down a stream the cloud stopped
+     * feeding. Opaque unless the operator disabled it.
+     */
+    private startKeepalive;
+    private stopKeepalive;
+    private abortCurrentRequest;
+    private setState;
+    /**
+     * Report an error even when the state is already `error`, so an escalating
+     * failure (repeated auth rejections, repeated stream violations) stays
+     * visible to the operator instead of going silent on the first message.
+     */
+    private reportError;
+    private sleepNextJittered;
+    private runLoop;
+    private connectOnce;
+    /**
+     * Drop all untrusted partial state. The buffer is never carried into the
+     * next connection: it is entirely cloud-controlled bytes.
+     */
+    private resetSseState;
+    /**
+     * Drop every untrusted partial state on reconnect, INCLUDING the replay cache.
+     *
+     * The cloud is the only producer of a legitimate `wake_id`, so a reconnect can
+     * re-deliver ids the previous connection already consumed (at-least-once SSE);
+     * keeping the cache across reconnects turns that into a denial of service. The
+     * cloud's own expiry on `data_channel_token_expires_at` remains the durable
+     * backstop: a token that was valid before the reconnect has not become valid
+     * again.
+     */
+    private resetStreamState;
+    /**
+     * Feed one decoded chunk into the incremental SSE parser (audit H-09).
+     *
+     * Bounded on every axis: the carry-over buffer, the number of events a
+     * single chunk may enqueue, and (in {@link drainSseQueue}) how many events
+     * run per event-loop turn.
+     */
+    private ingestSseChunk;
+    /** Queue a drain on the next event-loop turn (never inline in `data`). */
+    private scheduleSseDrain;
+    /**
+     * Dispatch queued events, capped per turn and yielding in between so a burst
+     * cannot starve the event loop the rest of the daemon runs on.
+     */
+    private drainSseQueue;
+    /**
+     * Handle one event block. Only a well-formed frame counts as liveness, so a
+     * flood of unparseable bytes cannot keep a dead stream looking healthy.
+     */
+    private dispatchSseBlock;
+    /**
+     * Fail the current stream: discard untrusted state, report, and force a
+     * reconnect through the normal (backed-off) retry path.
+     */
+    private failSseStream;
+    /**
+     * Parse one SSE event block per the SSE grammar. Returns what the block was:
+     * a keepalive comment, a dispatched wake event, a well-formed event that is
+     * not a wake, or a protocol error.
+     */
+    private parseEventBlock;
+    /**
+     * Shape plus freshness plus replay. Returns true only when the event was
+     * dispatched to `onWake`.
+     *
+     * Audit M-14. `data_channel_token_expires_at` used to be type-checked and then
+     * ignored, so a captured SSE event could be replayed indefinitely to re-open a
+     * data channel with a token the relay had already expired. Every check here
+     * denies by default: an event that fails any of them is never dispatched, and
+     * no path re-checks or relaxes them downstream.
+     */
+    private validateAndTriggerWake;
+    /** Record and report a refusal. Always returns false so callers can `return`. */
+    private reject;
+}
+//# sourceMappingURL=wake-channel.d.ts.map

package/dist/types/channels/wake-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wake-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/wake-channel.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAatD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,UAA2B,CAAC;AAE7D,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,UAA2B,CAAC;AAEjE,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAE3C,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAI1C,MAAM,WAAW,kBAAkB;IACjC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,wCAAwC;IACxC,MAAM,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACnC,yCAAyC;IACzC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,qDAAqD;IACrD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iDAAiD;IACjD,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;CACxF;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,OAAO,GACP,cAAc,GACd,UAAU,GACV,YAAY,CAAC;AAEjB,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,UAAU,CAAC,CAAqB;IACxC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,aAAa,CAAK;IAE1B,OAAO,CAAC,UAAU,CAAC,CAAiB;IACpC,OAAO,CAAC,WAAW,CAAC,CAAa;IACjC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAa;IAC1C,OAAO,CAAC,aAAa,CAAC,CAAqB;IAC3C,OAAO,CAAC,YAAY,CAAK;IAEzB,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,QAAQ,CAAgB;IAChC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,UAAU,CAAC,CAAS;IAE5B;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAKzB;IAEF;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,oBAAoB,CAAK;IACjC,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;gBAEb,IAAI,EAAE,kBAAkB;IAmCpC,uEAAuE;IACjE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAe5B,6DAA6D;IACvD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB3B,qBAAqB;IACrB,QAAQ,IAAI,gBAAgB;IAI5B,8CAA8C;IAC9C,oBAAoB,IAAI,MAAM;IAI9B,4EAA4E;IAC5E,eAAe,IAAI,MAAM;IAIzB,2EAA2E;IAC3E,iBAAiB,IAAI,cAAc;IAQnC,gEAAgE;IAChE,mBAAmB,IAAI,MAAM,GAAG,SAAS;IAIzC;;;OAGG;IACH,qBAAqB,IAAI,kBAAkB;IAU3C,6EAA6E;IAC7E,OAAO,CAAC,oBAAoB;IAI5B,8EAA8E;IACxE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBhC,OAAO,CAAC,UAAU;IAsBlB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,mBAAmB;IAmB3B,OAAO,CAAC,QAAQ;IAgBhB;;;;OAIG;IACH,OAAO,CAAC,WAAW;YAUL,iBAAiB;YAWjB,OAAO;IA+DrB,OAAO,CAAC,WAAW;IA0InB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAOrB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAKxB;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAyCtB,0EAA0E;IAC1E,OAAO,CAAC,gBAAgB;IAWxB;;;OAGG;YACW,aAAa;IAiB3B;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAarB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAmDvB;;;;;;;;;OASG;IACH,OAAO,CAAC,sBAAsB;IA+E9B,iFAAiF;IACjF,OAAO,CAAC,MAAM;CAaf"}

package/dist/types/cli/banner.d.ts

@@ -0,0 +1,2 @@
+export declare function printBanner(): void;
+//# sourceMappingURL=banner.d.ts.map

package/dist/types/cli/banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../../../src/cli/banner.ts"],"names":[],"mappings":"AAwFA,wBAAgB,WAAW,IAAI,IAAI,CAuClC"}

package/dist/types/cli/commands/agent.d.ts

@@ -0,0 +1,30 @@
+import { runStart } from './start';
+import { runStop } from './stop';
+import { runStatus } from './status';
+import { runClean } from './clean';
+export { runStart, runStop, runStatus, runClean };
+export declare function runRestart(args: string[]): Promise<void>;
+/** Result of a token rotation. `token` must be shown to the operator once. */
+export interface AgentCommandResult {
+    agent_id: string;
+    token: string;
+    previous_agent_id: string;
+    previous_token_masked: string;
+}
+/**
+ * Mints a new agent token, keeps `agent_id` stable so cloud-side project links
+ * survive, and returns the new token. Never logs the token; callers decide how
+ * to display it, and it must be displayed exactly once.
+ */
+export declare function rotateAgentToken(): AgentCommandResult;
+/**
+ * `sw-agent agent rotate-token` — issues a replacement token for this agent
+ * without changing `agent_id`.
+ */
+export declare function runAgentRotateToken(args?: string[]): Promise<void>;
+/**
+ * `sw-agent agent unlink` — drops this machine's local link to the cloud by
+ * rotating the token away and clearing the credential from local state.
+ */
+export declare function runAgentUnlink(args?: string[]): Promise<void>;
+//# sourceMappingURL=agent.d.ts.map

package/dist/types/cli/commands/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AASnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAUlD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9D;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,kBAAkB,CA6BrD;AAmBD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAwF5E;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEvE"}

package/dist/types/cli/commands/audit-verify.d.ts

@@ -0,0 +1,19 @@
+export interface AuditVerifyOptions {
+    verbose?: boolean;
+}
+export interface VerifyResult {
+    file: string;
+    totalEvents: number;
+    validEvents: number;
+    hashErrors: number;
+    parseErrors: number;
+    chainBrokenIndex?: number;
+}
+export declare function runAuditVerify(args: string[], opts?: AuditVerifyOptions): Promise<void>;
+/**
+ * Per-file diagnostic view retained for callers that report on individual
+ * rotated files. It reports parse integrity only; chain verdicts come from
+ * `verifyAuditLog`, which verifies the whole log as one sequence.
+ */
+export declare function verifyFile(file: string, _verbose: boolean): Promise<VerifyResult>;
+//# sourceMappingURL=audit-verify.d.ts.map

package/dist/types/cli/commands/audit-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-verify.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/audit-verify.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAiJD,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0LjG;AAqBD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CA6BvF"}

package/dist/types/cli/commands/clean.d.ts

@@ -0,0 +1,23 @@
+export interface CleanOptions {
+    force?: boolean;
+    logs?: boolean;
+    all?: boolean;
+    audit?: boolean;
+}
+/**
+ * Removes an audit directory together with the monotonic floor anchor that sits
+ * *beside* it.
+ *
+ * The anchor is a sibling of the audit directory, not a file inside it, so
+ * deleting the directory alone leaves a floor behind that then refuses every
+ * later append with a "log was deleted" verdict — a reset that cannot be used.
+ * The operator would have to find and delete a hidden file by hand to recover.
+ *
+ * The `audit.key` HMAC key is deliberately left alone: it lives outside the
+ * audit directory and a new chain re-derives its identity from it.
+ *
+ * @returns the paths that were actually removed, in the order they were tried.
+ */
+export declare function purgeAuditTrail(auditDir: string): string[];
+export declare function runClean(args?: string[], opts?: CleanOptions): Promise<void>;
+//# sourceMappingURL=clean.d.ts.map

package/dist/types/cli/commands/clean.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/clean.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAY1D;AA0BD,wBAAsB,QAAQ,CAAC,IAAI,GAAE,MAAM,EAAO,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqL1F"}

package/dist/types/cli/commands/config-show.d.ts

@@ -0,0 +1,2 @@
+export { runConfigShow, runConfigGet, runConfigSet, runConfigPath, runConfig } from './config';
+//# sourceMappingURL=config-show.d.ts.map

package/dist/types/cli/commands/config-show.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-show.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/config-show.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC"}

package/dist/types/cli/commands/config.d.ts

@@ -0,0 +1,6 @@
+export declare function runConfigShow(args?: string[]): Promise<void>;
+export declare function runConfigGet(args: string[]): Promise<void>;
+export declare function runConfigSet(args: string[]): Promise<void>;
+export declare function runConfigPath(): Promise<void>;
+export declare function runConfig(args?: string[]): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/types/cli/commands/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/config.ts"],"names":[],"mappings":"AAiEA,wBAAsB,aAAa,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDtE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+DhE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFhE;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAenD;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0ClE"}

package/dist/types/cli/commands/db-add.d.ts

@@ -0,0 +1,16 @@
+/**
+ * One-shot password channel read from the environment.
+ *
+ * `/proc/<pid>/environ` is mode 0400 and owned by the process's own user, so
+ * unlike argv it is NOT readable by another local UID, and the value never
+ * enters `ps` output, the shell history or a CI command echo. `SW_AGENT_DB_PASSWORD=x
+ * sw-agent db add …` is therefore a genuine secret channel, and the only one
+ * that needs no file and no TTY.
+ *
+ * Checked before the interactive prompt so a scripted `db add` is unattended,
+ * and never echoed, never passed to a child process, and never written to any
+ * log: the NAME is safe to print, the VALUE is not.
+ */
+export declare const DB_PASSWORD_ENV_VAR = "SW_AGENT_DB_PASSWORD";
+export declare function runDbAdd(args?: string[]): Promise<void>;
+//# sourceMappingURL=db-add.d.ts.map

package/dist/types/cli/commands/db-add.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-add.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/db-add.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAuC1D,wBAAsB,QAAQ,CAAC,IAAI,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0mBjE"}

package/dist/types/cli/commands/db-edit.d.ts

@@ -0,0 +1,2 @@
+export declare function runDbEdit(args: string[]): Promise<void>;
+//# sourceMappingURL=db-edit.d.ts.map

package/dist/types/cli/commands/db-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-edit.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/db-edit.ts"],"names":[],"mappings":"AAgCA,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoV7D"}