@theowlops/boombot 0.0.0-stage → 1.1.0

package/dist/node_modules/@boombot/security/reasoning-guard/grounding-check.js

@@ -0,0 +1,234 @@
+/** Lowercase + collapse whitespace, so matching ignores casing and layout. */
+function normalize(text) {
+    return text.toLowerCase().replace(/\s+/gu, ' ').trim();
+}
+// Order matters: ISO dates and DD/MM/YYYY dates before bare decimals, times
+// before bare numbers, so "2026-10-03" and "14:30" extract as single tokens.
+const NUMBER_TOKEN_RE = /\d{4}-\d{2}-\d{2}|\d{1,2}[/-]\d{1,2}[/-]\d{2,4}|\d{1,2}:\d{2}|\d+(?:\.\d+)?%?/g;
+function extractNumberTokens(text) {
+    NUMBER_TOKEN_RE.lastIndex = 0;
+    const tokens = [];
+    let m;
+    while ((m = NUMBER_TOKEN_RE.exec(text)) !== null) {
+        tokens.push(m[0]);
+    }
+    return tokens;
+}
+/**
+ * "95" and "95%" denote the same numeric value for grounding purposes
+ * (the extractor may keep or drop the space before `%`). Strip it before
+ * comparing so a cosmetic `%` never flips a verdict.
+ */
+function canonicalNumber(token) {
+    return token.endsWith('%') ? token.slice(0, -1) : token;
+}
+const QUOTE_RE = /"([^"]+)"|"([^"]+)"|«([^»]+)»/g;
+function extractQuotes(text) {
+    QUOTE_RE.lastIndex = 0;
+    const quotes = [];
+    let m;
+    while ((m = QUOTE_RE.exec(text)) !== null) {
+        const raw = m[1] ?? m[2] ?? m[3] ?? '';
+        const quote = normalize(raw);
+        if (quote.length >= 2) {
+            quotes.push(quote);
+        }
+    }
+    return quotes;
+}
+/**
+ * ~60 Vietnamese + English stopwords. Removed from the claim side before
+ * scoring so overlap measures content words, not glue words.
+ */
+const STOPWORDS = new Set([
+    'là',
+    'của',
+    'và',
+    'đã',
+    'trong',
+    'trên',
+    'với',
+    'cho',
+    'này',
+    'đó',
+    'đây',
+    'các',
+    'một',
+    'những',
+    'bị',
+    'được',
+    'sẽ',
+    'có',
+    'không',
+    'còn',
+    'cũng',
+    'rất',
+    'như',
+    'từ',
+    'đến',
+    'ở',
+    'lại',
+    'mà',
+    'thì',
+    'nếu',
+    'khi',
+    'về',
+    'the',
+    'a',
+    'an',
+    'is',
+    'are',
+    'was',
+    'were',
+    'has',
+    'have',
+    'be',
+    'been',
+    'being',
+    'to',
+    'of',
+    'in',
+    'on',
+    'and',
+    'or',
+    'for',
+    'with',
+    'that',
+    'this',
+    'it',
+    'its',
+    'as',
+    'at',
+    'by',
+    'from',
+    'but',
+    'not',
+]);
+function tokenize(text) {
+    return normalize(text)
+        .split(/[^\p{L}\p{N}]+/u)
+        .filter((t) => t.length > 0 && !STOPWORDS.has(t));
+}
+function checkNumberClaim(claim, evidences) {
+    const claimTokens = extractNumberTokens(normalize(claim.text)).map(canonicalNumber);
+    if (claimTokens.length === 0) {
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: 'factual-number claim contains no numeric tokens to verify',
+        };
+    }
+    const supported = new Set();
+    for (const evidence of evidences) {
+        for (const token of extractNumberTokens(normalize(evidence.excerpt))) {
+            supported.add(canonicalNumber(token));
+        }
+    }
+    const missing = claimTokens.filter((token) => !supported.has(token));
+    if (missing.length > 0) {
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: `missing number token(s): ${missing.join(', ')}`,
+        };
+    }
+    const evidenceIds = [];
+    for (const evidence of evidences) {
+        const evidenceTokens = new Set(extractNumberTokens(normalize(evidence.excerpt)).map(canonicalNumber));
+        if (claimTokens.some((token) => evidenceTokens.has(token))) {
+            evidenceIds.push(evidence.id);
+        }
+    }
+    return { claimId: claim.id, verdict: 'grounded', evidenceIds };
+}
+function checkQuoteClaim(claim, evidences) {
+    const quotes = extractQuotes(normalize(claim.text));
+    if (quotes.length === 0) {
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: 'quote claim contains no quotable segment to verify',
+        };
+    }
+    const normalizedExcerpts = evidences.map((e) => normalize(e.excerpt));
+    const missing = quotes.filter((quote) => !normalizedExcerpts.some((excerpt) => excerpt.includes(quote)));
+    if (missing.length > 0) {
+        const first = missing[0] ?? '';
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: `quote not found in evidence: "${first}"`,
+        };
+    }
+    const evidenceIds = [];
+    for (const evidence of evidences) {
+        const excerpt = normalize(evidence.excerpt);
+        if (quotes.some((quote) => excerpt.includes(quote))) {
+            evidenceIds.push(evidence.id);
+        }
+    }
+    return { claimId: claim.id, verdict: 'grounded', evidenceIds };
+}
+function checkOverlapClaim(claim, evidences, minEntityOverlap) {
+    const claimTokens = tokenize(claim.text);
+    if (claimTokens.length === 0) {
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: 'no verifiable tokens after stopword removal',
+        };
+    }
+    const matchingIds = [];
+    let best = 0;
+    for (const evidence of evidences) {
+        const evidenceTokens = new Set(tokenize(evidence.excerpt));
+        let hits = 0;
+        for (const token of claimTokens) {
+            if (evidenceTokens.has(token)) {
+                hits += 1;
+            }
+        }
+        const score = hits / claimTokens.length;
+        if (score > best) {
+            best = score;
+        }
+        if (score >= minEntityOverlap) {
+            matchingIds.push(evidence.id);
+        }
+    }
+    if (matchingIds.length === 0) {
+        return {
+            claimId: claim.id,
+            verdict: 'ungrounded',
+            evidenceIds: [],
+            reason: `best overlap ${best.toFixed(2)} < threshold ${minEntityOverlap}`,
+        };
+    }
+    return { claimId: claim.id, verdict: 'grounded', evidenceIds: matchingIds };
+}
+/**
+ * Verify every claim against the evidence ledger.
+ *
+ * Conservative by design: when in doubt the claim is `ungrounded`, never
+ * silently passed. `non-falsifiable` claims always pass without evidence.
+ */
+export function checkGrounding(claims, evidences, opts) {
+    return claims.map((claim) => {
+        switch (claim.kind) {
+            case 'non-falsifiable':
+                return { claimId: claim.id, verdict: 'non-falsifiable', evidenceIds: [] };
+            case 'factual-number':
+                return checkNumberClaim(claim, evidences);
+            case 'quote':
+                return checkQuoteClaim(claim, evidences);
+            case 'factual-entity':
+            case 'factual-status':
+                return checkOverlapClaim(claim, evidences, opts.minEntityOverlap);
+        }
+    });
+}

package/dist/node_modules/@boombot/security/reasoning-guard/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Public API of `@boombot/security`.
+ *
+ * Deterministic, rule-based verification layer (no LLM): extract factual
+ * claims from a draft, check them against an evidence ledger of tool
+ * outputs, and enforce a warn/strict/off policy.
+ */
+export { extractClaims } from './claim-extractor.js';
+export { EvidenceLedger } from './evidence-ledger.js';
+export type { RecordInput } from './evidence-ledger.js';
+export { checkGrounding } from './grounding-check.js';
+export type { GroundingOptions } from './grounding-check.js';
+export { applyPolicy, UNGROUNDED_DISCLAIMER } from './policy.js';
+export { verifyTurn, verifyTurnWithClaims } from './gate.js';
+export type { TurnResult, TurnVerification } from './gate.js';
+export { DEFAULT_GUARD_CONFIG } from './types.js';
+export type { Claim, ClaimKind, ClaimSpan, ClaimVerdict, Evidence, GuardConfig, GuardMode, VerificationReport, } from './types.js';

package/dist/node_modules/@boombot/security/reasoning-guard/index.js

@@ -0,0 +1,13 @@
+/**
+ * Public API of `@boombot/security`.
+ *
+ * Deterministic, rule-based verification layer (no LLM): extract factual
+ * claims from a draft, check them against an evidence ledger of tool
+ * outputs, and enforce a warn/strict/off policy.
+ */
+export { extractClaims } from './claim-extractor.js';
+export { EvidenceLedger } from './evidence-ledger.js';
+export { checkGrounding } from './grounding-check.js';
+export { applyPolicy, UNGROUNDED_DISCLAIMER } from './policy.js';
+export { verifyTurn, verifyTurnWithClaims } from './gate.js';
+export { DEFAULT_GUARD_CONFIG } from './types.js';

package/dist/node_modules/@boombot/security/reasoning-guard/policy.d.ts

@@ -0,0 +1,15 @@
+import type { Claim, ClaimVerdict, GuardMode } from './types.js';
+/** Replacement text for ungrounded factual spans in `strict` mode. */
+export declare const UNGROUNDED_DISCLAIMER = "[unverified]";
+/**
+ * Enforce the guard mode on a verified draft.
+ *
+ * - `off` / `warn`: return the text untouched (`warn` only reports).
+ * - `strict`: replace the `[start, end)` span of every ungrounded factual
+ *   claim with a disclaimer. Spans are spliced from the end backwards so
+ *   earlier offsets stay valid.
+ *
+ * The policy never invents replacement content: it only deletes
+ * unverifiable spans and marks them.
+ */
+export declare function applyPolicy(text: string, claims: readonly Claim[], verdicts: readonly ClaimVerdict[], mode: GuardMode): string;

package/dist/node_modules/@boombot/security/reasoning-guard/policy.js

@@ -0,0 +1,39 @@
+/** Replacement text for ungrounded factual spans in `strict` mode. */
+export const UNGROUNDED_DISCLAIMER = '[unverified]';
+/**
+ * Enforce the guard mode on a verified draft.
+ *
+ * - `off` / `warn`: return the text untouched (`warn` only reports).
+ * - `strict`: replace the `[start, end)` span of every ungrounded factual
+ *   claim with a disclaimer. Spans are spliced from the end backwards so
+ *   earlier offsets stay valid.
+ *
+ * The policy never invents replacement content: it only deletes
+ * unverifiable spans and marks them.
+ */
+export function applyPolicy(text, claims, verdicts, mode) {
+    if (mode === 'off' || mode === 'warn') {
+        return text;
+    }
+    const verdictByClaim = new Map();
+    for (const verdict of verdicts) {
+        verdictByClaim.set(verdict.claimId, verdict);
+    }
+    const targets = [];
+    for (const claim of claims) {
+        if (claim.kind === 'non-falsifiable') {
+            continue;
+        }
+        const verdict = verdictByClaim.get(claim.id);
+        if (verdict !== undefined && verdict.verdict === 'ungrounded') {
+            targets.push({ start: claim.span.start, end: claim.span.end });
+        }
+    }
+    targets.sort((a, b) => b.start - a.start);
+    let result = text;
+    for (const target of targets) {
+        result =
+            result.slice(0, target.start) + UNGROUNDED_DISCLAIMER + result.slice(target.end);
+    }
+    return result;
+}

package/dist/node_modules/@boombot/security/reasoning-guard/types.d.ts

@@ -0,0 +1,46 @@
+/** Shared types for the deterministic reasoning-verification layer. */
+export type ClaimKind = 'factual-number' | 'factual-entity' | 'factual-status' | 'quote' | 'non-falsifiable';
+export interface ClaimSpan {
+    readonly start: number;
+    readonly end: number;
+}
+export interface Claim {
+    readonly id: string;
+    readonly text: string;
+    readonly kind: ClaimKind;
+    readonly span: ClaimSpan;
+}
+export interface Evidence {
+    readonly id: string;
+    readonly tool: string;
+    readonly argsHash: string;
+    readonly excerpt: string;
+    readonly ts: number;
+}
+export type Verdict = 'grounded' | 'ungrounded' | 'non-falsifiable';
+export interface ClaimVerdict {
+    readonly claimId: string;
+    readonly verdict: Verdict;
+    readonly evidenceIds: readonly string[];
+    readonly reason?: string;
+}
+export interface VerificationReport {
+    readonly verdicts: readonly ClaimVerdict[];
+    readonly ungroundedCount: number;
+    readonly mode: GuardMode;
+    readonly msElapsed: number;
+    readonly truncated: boolean;
+}
+export type GuardMode = 'strict' | 'warn' | 'off';
+export interface GuardConfig {
+    readonly mode: GuardMode;
+    readonly maxClaimChars?: number;
+    readonly maxExcerptChars?: number;
+    readonly minEntityOverlap?: number;
+}
+export declare const DEFAULT_GUARD_CONFIG: {
+    readonly mode: GuardMode;
+    readonly maxClaimChars: number;
+    readonly maxExcerptChars: number;
+    readonly minEntityOverlap: number;
+};

package/dist/node_modules/@boombot/security/reasoning-guard/types.js

@@ -0,0 +1,7 @@
+/** Shared types for the deterministic reasoning-verification layer. */
+export const DEFAULT_GUARD_CONFIG = {
+    mode: 'warn',
+    maxClaimChars: 4000,
+    maxExcerptChars: 500,
+    minEntityOverlap: 0.6,
+};

package/dist/node_modules/@boombot/security/security/approval.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @boombot/security — approval policy (mandatory middleware, not an optional hook).
+ *
+ * Honest framing (root SECURITY.md §1): approval and denylists are
+ * **accident prevention**, not a security boundary against a determined
+ * adversary. The real boundary is the OS (sandbox). This module makes the
+ * accident-prevention layer deterministic: a pure function of
+ * (policy, tool call) → decision, no LLM judgement involved.
+ *
+ * Risk floors:
+ * - known-destructive commands → `deny` (never executes, even with approval)
+ * - unknown or side-effecting tools → `require-approval`
+ * - known read-only tools → `allow`
+ * - subagent policy: `require-approval` escalates to `deny`
+ *   (a child never gets a looser decision than its parent)
+ */
+import type { AuditSink } from './audit.js';
+/** A tool call proposed by the agent. Args are untrusted data. */
+export interface ToolCall {
+    /** Tool name, e.g. 'exec', 'file.write', 'memory.search'. */
+    readonly tool: string;
+    /** Arguments. Never interpolated into shell/SQL — validated per tool. */
+    readonly args: Readonly<Record<string, unknown>>;
+    /** Authenticated principal id requesting the call. */
+    readonly principalId: string;
+}
+export type ApprovalDecision = 'allow' | 'deny' | 'require-approval';
+export interface PolicyEvaluation {
+    readonly decision: ApprovalDecision;
+    /** Which rule fired. Stable strings for audit. */
+    readonly rule: string;
+    readonly reason: string;
+}
+/** A policy that deterministically evaluates tool calls. */
+export interface ApprovalPolicy {
+    evaluate(call: ToolCall): PolicyEvaluation;
+}
+export interface ApprovalPolicyOptions {
+    /** Extra tools that are always allowed (read-only, side-effect free). */
+    readonly allowTools?: readonly string[];
+    /** Extra tools that are always denied. */
+    readonly denyTools?: readonly string[];
+    /** Sink receiving one audit event per non-allow decision. Optional. */
+    readonly auditSink?: AuditSink;
+    /** Autonomous mode: allow non-destructive tools without HITL pause. */
+    readonly autonomous?: boolean;
+}
+/** Default deterministic approval policy with risk floors. */
+export declare class DefaultApprovalPolicy implements ApprovalPolicy {
+    private readonly allowTools;
+    private readonly denyTools;
+    private readonly auditSink?;
+    private readonly autonomous;
+    constructor(options?: ApprovalPolicyOptions);
+    evaluate(call: ToolCall): PolicyEvaluation;
+    private decide;
+}
+/**
+ * Derive a child (subagent) policy from a parent policy. A subagent never
+ * gets a looser decision: `require-approval` escalates to `deny` because
+ * there is no operator in the loop to approve on its behalf.
+ */
+export declare function deriveSubagentPolicy(parent: ApprovalPolicy): ApprovalPolicy;

package/dist/node_modules/@boombot/security/security/approval.js

@@ -0,0 +1,140 @@
+/**
+ * @boombot/security — approval policy (mandatory middleware, not an optional hook).
+ *
+ * Honest framing (root SECURITY.md §1): approval and denylists are
+ * **accident prevention**, not a security boundary against a determined
+ * adversary. The real boundary is the OS (sandbox). This module makes the
+ * accident-prevention layer deterministic: a pure function of
+ * (policy, tool call) → decision, no LLM judgement involved.
+ *
+ * Risk floors:
+ * - known-destructive commands → `deny` (never executes, even with approval)
+ * - unknown or side-effecting tools → `require-approval`
+ * - known read-only tools → `allow`
+ * - subagent policy: `require-approval` escalates to `deny`
+ *   (a child never gets a looser decision than its parent)
+ */
+/** Tools whose only effect is reading state — safe to auto-allow. */
+const DEFAULT_ALLOW_TOOLS = new Set([
+    'memory.search',
+    'memory.recall',
+    'provider.list',
+    'scheduler.list',
+    'scheduler.get',
+    'file.read',
+    'help',
+    'research.search',
+    'research.extract',
+    'research.deep',
+    'research.academic',
+    'research.crawl',
+]);
+/** Destructive command patterns — deny floor, no approval can override. */
+const DESTRUCTIVE_PATTERNS = [
+    { pattern: /\brm\s+(-[a-z]*r[a-z]*\s+|--recursive\s+)(\S*\s+)*\/( |$)/, label: 'recursive delete from /' },
+    { pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;?\s*:/, label: 'fork bomb' },
+    { pattern: /\bmkfs(\.\w+)?\b/, label: 'filesystem format' },
+    { pattern: /\bdd\b[^;|&]*\bof=\/dev\//, label: 'raw disk write' },
+    { pattern: /\b(shutdown|reboot|halt|poweroff)\b/, label: 'host power control' },
+    { pattern: /\bcurl\b[^|]*\|\s*(ba)?sh\b/, label: 'remote script piped to shell' },
+    { pattern: /\bwget\b[^|]*\|\s*(ba)?sh\b/, label: 'remote script piped to shell' },
+    { pattern: />\s*\/dev\/(sd[a-z]|nvme|hd[a-z]|vd[a-z])/, label: 'raw device overwrite' },
+    { pattern: /chmod\s+-R\s+777\s+\//, label: 'recursive chmod 777 from /' },
+];
+function argsToText(args) {
+    return Object.values(args)
+        .map((v) => (typeof v === 'string' ? v : JSON.stringify(v) ?? ''))
+        .join('\n');
+}
+/** Default deterministic approval policy with risk floors. */
+export class DefaultApprovalPolicy {
+    allowTools;
+    denyTools;
+    auditSink;
+    autonomous;
+    constructor(options = {}) {
+        this.allowTools = new Set([...DEFAULT_ALLOW_TOOLS, ...(options.allowTools ?? [])]);
+        this.denyTools = new Set(options.denyTools ?? []);
+        this.auditSink = options.auditSink;
+        this.autonomous = options.autonomous ?? false;
+    }
+    evaluate(call) {
+        const result = this.decide(call);
+        if (result.decision !== 'allow' && this.auditSink !== undefined) {
+            this.auditSink.append({
+                actor: call.principalId,
+                action: `approval.${result.decision}`,
+                target: call.tool,
+                meta: { rule: result.rule, reason: result.reason },
+            });
+        }
+        return result;
+    }
+    decide(call) {
+        if (this.denyTools.has(call.tool)) {
+            return { decision: 'deny', rule: 'deny-list', reason: `tool '${call.tool}' is on the deny list` };
+        }
+        if (this.allowTools.has(call.tool)) {
+            return { decision: 'allow', rule: 'allow-list', reason: `tool '${call.tool}' is read-only` };
+        }
+        // Destructive-command floor for shell-like tools: deny, no override.
+        if (call.tool === 'exec' || call.tool === 'shell' || call.tool === 'run_command' || call.tool === 'shell.exec') {
+            const text = argsToText(call.args);
+            for (const { pattern, label } of DESTRUCTIVE_PATTERNS) {
+                if (pattern.test(text)) {
+                    return { decision: 'deny', rule: 'destructive-command', reason: `destructive pattern: ${label}` };
+                }
+            }
+            if (this.autonomous) {
+                return { decision: 'allow', rule: 'autonomous-mode', reason: 'autonomous mode enabled' };
+            }
+            return {
+                decision: 'require-approval',
+                rule: 'exec-default',
+                reason: 'shell execution always requires approval',
+            };
+        }
+        // If autonomous mode is enabled, non-destructive tools are automatically allowed.
+        if (this.autonomous) {
+            return { decision: 'allow', rule: 'autonomous-mode', reason: 'autonomous mode enabled' };
+        }
+        // Side-effecting tool families require approval by default (fail closed).
+        if (call.tool.startsWith('file.write') ||
+            call.tool.startsWith('secret.') ||
+            call.tool.startsWith('channel.send') ||
+            call.tool.startsWith('scheduler.') ||
+            call.tool.startsWith('memory.')) {
+            return {
+                decision: 'require-approval',
+                rule: 'side-effect-default',
+                reason: `tool '${call.tool}' has side effects`,
+            };
+        }
+        // Unknown tools: fail closed.
+        return {
+            decision: 'require-approval',
+            rule: 'unknown-tool',
+            reason: `tool '${call.tool}' is not recognized; defaulting to require-approval`,
+        };
+    }
+}
+/**
+ * Derive a child (subagent) policy from a parent policy. A subagent never
+ * gets a looser decision: `require-approval` escalates to `deny` because
+ * there is no operator in the loop to approve on its behalf.
+ */
+export function deriveSubagentPolicy(parent) {
+    return {
+        evaluate(call) {
+            const parentResult = parent.evaluate(call);
+            if (parentResult.decision === 'require-approval') {
+                return {
+                    decision: 'deny',
+                    rule: 'subagent-escalation',
+                    reason: `parent required approval for '${call.tool}'; subagents cannot request approval → deny`,
+                };
+            }
+            return parentResult;
+        },
+    };
+}

package/dist/node_modules/@boombot/security/security/audit.d.ts

@@ -0,0 +1,39 @@
+/** A single auditable security event. Never carries secret values. */
+export interface AuditEvent {
+    /** Unique id, assigned by the sink. */
+    readonly id: string;
+    /** ISO-8601 timestamp, assigned by the sink. */
+    readonly ts: string;
+    /** Authenticated actor id (from `createAuthenticatedPrincipal`, never raw input). */
+    readonly actor: string;
+    /** Machine-readable action, e.g. 'secret.rotate', 'approval.deny', 'memory.revoke'. */
+    readonly action: string;
+    /** Optional target of the action (record id, tool name, …). */
+    readonly target?: string;
+    /** Structured detail. Secret-looking values are redacted on append. */
+    readonly meta?: Readonly<Record<string, unknown>>;
+}
+/** Input for `AuditSink.append` — id/ts are assigned by the sink. */
+export type NewAuditEvent = Omit<AuditEvent, 'id' | 'ts'>;
+/**
+ * Append-only audit sink. Implementations must guarantee:
+ * - every appended event is persisted before `append` returns;
+ * - events are never mutated or deleted through this interface.
+ */
+export interface AuditSink {
+    append(event: NewAuditEvent): AuditEvent;
+}
+/** Redact secret-looking entries from audit metadata (defense in depth). */
+export declare function redactAuditMeta(meta: Readonly<Record<string, unknown>> | undefined): Record<string, unknown> | undefined;
+/** In-memory audit sink. Bounded (default 10k events, oldest dropped first). */
+export declare class InMemoryAuditSink implements AuditSink {
+    private readonly maxEvents;
+    private readonly events;
+    constructor(maxEvents?: number);
+    append(event: NewAuditEvent): AuditEvent;
+    /** Newest last. Returns a copy — the log itself is immutable. */
+    list(): readonly AuditEvent[];
+    /** Filter by action prefix, e.g. 'approval.'. */
+    query(actionPrefix: string): readonly AuditEvent[];
+    get size(): number;
+}