atabey 0.0.37 → 0.1.0

package/dist/shared/src/lock.d.ts

@@ -1,82 +1 @@
-/**
- * [LOCK] Multi-user Distributed Lock Mechanism
- *
- * Git-based lock system. Enables team members to work on the same
- * files/resources without conflicts.
- *
- * Usage:
- *   const lock = new DistributedLock("database/schema.sql");
- *   if (lock.acquire("user-123", 60000)) {
- *     // Apply changes
- *     lock.release("user-123");
- *   }
- */
-export type LockStatus = "LOCKED" | "AVAILABLE" | "STALE" | "EXPIRED";
-export interface LockInfo {
-    resource: string;
-    ownerId: string;
-    ownerName: string;
-    acquiredAt: string;
-    expiresAt: string;
-    reason: string;
-    traceId?: string;
-}
-export declare class DistributedLock {
-    private static TABLE;
-    /**
-     * Initialize the locks table (run once at startup).
-     */
-    static initialize(): void;
-    /**
-     * Attempts to acquire a lock on a resource.
-     *
-     * @param resource - Lock resource name (e.g., "apps/backend/src/types/user.ts")
-     * @param ownerId - Unique owner identifier (e.g., "yusuf", "ci-bot-01")
-     * @param options - Optional parameters
-     * @returns true if lock acquired, false if already locked
-     */
-    static acquire(resource: string, ownerId: string, options?: {
-        ownerName?: string;
-        ttlMs?: number;
-        reason?: string;
-        traceId?: string;
-        force?: boolean;
-    }): boolean;
-    /**
-     * Releases a lock. Only the lock owner can release.
-     *
-     * @param resource - Lock resource name
-     * @param ownerId - Owner identifier for verification
-     * @returns true if released successfully
-     */
-    static release(resource: string, ownerId: string): boolean;
-    /**
-     * Checks if a resource is locked.
-     */
-    static isLocked(resource: string): boolean;
-    /**
-     * Gets lock information for a resource.
-     */
-    static getLock(resource: string): LockInfo | null;
-    /**
-     * Lists all active locks.
-     */
-    static listActiveLocks(): LockInfo[];
-    /**
-     * Lists all locks owned by a specific owner.
-     */
-    static listOwnerLocks(ownerId: string): LockInfo[];
-    /**
-     * Releases all locks owned by a specific owner (e.g., on disconnect).
-     */
-    static releaseAllByOwner(ownerId: string): number;
-    /**
-     * Releases all expired/stale locks.
-     */
-    private static releaseStaleLocks;
-    /**
-     * Generates a unique owner ID for the current user/machine.
-     * Uses git config user.name or hostname as fallback.
-     */
-    static getLocalOwnerId(): string;
-}
+export * from "./modules/concurrency/lock.js";

package/dist/shared/src/lock.js

@@ -1,159 +1,2 @@
-/**
- * [LOCK] Multi-user Distributed Lock Mechanism
- *
- * Git-based lock system. Enables team members to work on the same
- * files/resources without conflicts.
- *
- * Usage:
- *   const lock = new DistributedLock("database/schema.sql");
- *   if (lock.acquire("user-123", 60000)) {
- *     // Apply changes
- *     lock.release("user-123");
- *   }
- */
-import { execSync } from "child_process";
-import os from "os";
-import { databaseHolder } from "./database.js";
-export class DistributedLock {
-    static TABLE = "distributed_locks";
-    /**
-     * Initialize the locks table (run once at startup).
-     */
-    static initialize() {
-        const db = databaseHolder.getDB();
-        db.exec(`
-            CREATE TABLE IF NOT EXISTS ${this.TABLE} (
-                resource TEXT PRIMARY KEY,
-                ownerId TEXT NOT NULL,
-                ownerName TEXT NOT NULL,
-                acquiredAt TEXT NOT NULL,
-                expiresAt TEXT NOT NULL,
-                reason TEXT,
-                traceId TEXT
-            )
-        `);
-    }
-    /**
-     * Attempts to acquire a lock on a resource.
-     *
-     * @param resource - Lock resource name (e.g., "apps/backend/src/types/user.ts")
-     * @param ownerId - Unique owner identifier (e.g., "yusuf", "ci-bot-01")
-     * @param options - Optional parameters
-     * @returns true if lock acquired, false if already locked
-     */
-    static acquire(resource, ownerId, options = {}) {
-        const db = databaseHolder.getDB();
-        const now = new Date();
-        const expiresAt = new Date(now.getTime() + (options.ttlMs || 60000)).toISOString();
-        const ownerName = options.ownerName || ownerId;
-        const reason = options.reason || "No reason provided";
-        // Clean up stale locks first
-        this.releaseStaleLocks();
-        // If force=true, override existing lock directly using INSERT OR REPLACE
-        if (options.force) {
-            db.prepare(`
-                INSERT OR REPLACE INTO ${this.TABLE} (resource, ownerId, ownerName, acquiredAt, expiresAt, reason, traceId)
-                VALUES (?, ?, ?, ?, ?, ?, ?)
-            `).run(resource, ownerId, ownerName, now.toISOString(), expiresAt, reason, options.traceId || null);
-            return true;
-        }
-        // Acquire new lock atomically using INSERT OR IGNORE.
-        // If the resource is already locked, changes will be 0.
-        const result = db.prepare(`
-            INSERT OR IGNORE INTO ${this.TABLE} (resource, ownerId, ownerName, acquiredAt, expiresAt, reason, traceId)
-            VALUES (?, ?, ?, ?, ?, ?, ?)
-        `).run(resource, ownerId, ownerName, now.toISOString(), expiresAt, reason, options.traceId || null);
-        return result.changes > 0;
-    }
-    /**
-     * Releases a lock. Only the lock owner can release.
-     *
-     * @param resource - Lock resource name
-     * @param ownerId - Owner identifier for verification
-     * @returns true if released successfully
-     */
-    static release(resource, ownerId) {
-        const db = databaseHolder.getDB();
-        const result = db.prepare(`DELETE FROM ${this.TABLE} WHERE resource = ? AND ownerId = ?`).run(resource, ownerId);
-        return result.changes > 0;
-    }
-    /**
-     * Checks if a resource is locked.
-     */
-    static isLocked(resource) {
-        const db = databaseHolder.getDB();
-        const nowIso = new Date().toISOString();
-        const lock = db.prepare(`SELECT * FROM ${this.TABLE} WHERE resource = ? AND expiresAt > ?`).get(resource, nowIso);
-        return !!lock;
-    }
-    /**
-     * Gets lock information for a resource.
-     */
-    static getLock(resource) {
-        const db = databaseHolder.getDB();
-        this.releaseStaleLocks();
-        const lock = db.prepare(`SELECT * FROM ${this.TABLE} WHERE resource = ?`).get(resource);
-        return lock || null;
-    }
-    /**
-     * Lists all active locks.
-     */
-    static listActiveLocks() {
-        const db = databaseHolder.getDB();
-        this.releaseStaleLocks();
-        const nowIso = new Date().toISOString();
-        return db.prepare(`SELECT * FROM ${this.TABLE} WHERE expiresAt > ? ORDER BY acquiredAt DESC`).all(nowIso);
-    }
-    /**
-     * Lists all locks owned by a specific owner.
-     */
-    static listOwnerLocks(ownerId) {
-        const db = databaseHolder.getDB();
-        return db.prepare(`SELECT * FROM ${this.TABLE} WHERE ownerId = ? ORDER BY acquiredAt DESC`).all(ownerId);
-    }
-    /**
-     * Releases all locks owned by a specific owner (e.g., on disconnect).
-     */
-    static releaseAllByOwner(ownerId) {
-        const db = databaseHolder.getDB();
-        const result = db.prepare(`DELETE FROM ${this.TABLE} WHERE ownerId = ?`).run(ownerId);
-        return result.changes;
-    }
-    /**
-     * Releases all expired/stale locks.
-     */
-    static releaseStaleLocks() {
-        const db = databaseHolder.getDB();
-        const nowIso = new Date().toISOString();
-        const result = db.prepare(`DELETE FROM ${this.TABLE} WHERE expiresAt < ?`).run(nowIso);
-        return result.changes;
-    }
-    /**
-     * Generates a unique owner ID for the current user/machine.
-     * Uses git config user.name or hostname as fallback.
-     */
-    static getLocalOwnerId() {
-        // Try git config
-        try {
-            const name = execSync("git config user.name", { encoding: "utf8" }).trim();
-            if (name)
-                return name;
-        }
-        catch {
-            // Fallback
-        }
-        // Try environment
-        if (process.env.USER)
-            return process.env.USER;
-        if (process.env.USERNAME)
-            return process.env.USERNAME;
-        // Fallback to hostname
-        try {
-            return os.hostname();
-        }
-        catch {
-            return "unknown-user";
-        }
-    }
-}
+export * from "./modules/concurrency/lock.js";
 //# sourceMappingURL=lock.js.map

package/dist/shared/src/lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../../shared/src/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAc/C,MAAM,OAAO,eAAe;IAChB,MAAM,CAAC,KAAK,GAAG,mBAAmB,CAAC;IAE3C;;OAEG;IACI,MAAM,CAAC,UAAU;QACpB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,EAAE,CAAC,IAAI,CAAC;yCACyB,IAAI,CAAC,KAAK;;;;;;;;;SAS1C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CACjB,QAAgB,EAChB,OAAe,EACf,UAMI,EAAE;QAEN,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,oBAAoB,CAAC;QAEtD,6BAA6B;QAC7B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,yEAAyE;QACzE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,EAAE,CAAC,OAAO,CAAC;yCACkB,IAAI,CAAC,KAAK;;aAEtC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;YACpG,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,sDAAsD;QACtD,wDAAwD;QACxD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;oCACE,IAAI,CAAC,KAAK;;SAErC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QAEpG,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,OAAO,CAAC,QAAgB,EAAE,OAAe;QACnD,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,eAAe,IAAI,CAAC,KAAK,qCAAqC,CACjE,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAEzB,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,QAAQ,CAAC,QAAgB;QACnC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB,iBAAiB,IAAI,CAAC,KAAK,uCAAuC,CACrE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAyB,CAAC;QAEhD,OAAO,CAAC,CAAC,IAAI,CAAC;IAClB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,QAAgB;QAClC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACnB,iBAAiB,IAAI,CAAC,KAAK,qBAAqB,CACnD,CAAC,GAAG,CAAC,QAAQ,CAAyB,CAAC;QAExC,OAAO,IAAI,IAAI,IAAI,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,eAAe;QACzB,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC,OAAO,CACb,iBAAiB,IAAI,CAAC,KAAK,+CAA+C,CAC7E,CAAC,GAAG,CAAC,MAAM,CAAe,CAAC;IAChC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,cAAc,CAAC,OAAe;QACxC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,OAAO,EAAE,CAAC,OAAO,CACb,iBAAiB,IAAI,CAAC,KAAK,6CAA6C,CAC3E,CAAC,GAAG,CAAC,OAAO,CAAe,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,iBAAiB,CAAC,OAAe;QAC3C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,eAAe,IAAI,CAAC,KAAK,oBAAoB,CAChD,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEf,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,iBAAiB;QAC5B,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACrB,eAAe,IAAI,CAAC,KAAK,sBAAsB,CAClD,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEd,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,eAAe;QACzB,iBAAiB;QACjB,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACL,WAAW;QACf,CAAC;QAED,kBAAkB;QAClB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAEtD,uBAAuB;QACvB,IAAI,CAAC;YACD,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,cAAc,CAAC;QAC1B,CAAC;IACL,CAAC"}
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../../shared/src/lock.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAC"}

package/dist/shared/src/logger.d.ts

@@ -1,30 +1 @@
-export declare enum LogLevel {
-    DEBUG = 0,
-    INFO = 1,
-    WARN = 2,
-    ERROR = 3,
-    FATAL = 4
-}
-export interface LoggerConfig {
-    minLevel: LogLevel;
-    enableColors: boolean;
-    jsonFormat: boolean;
-    logFile?: string;
-    enablePiiMasking: boolean;
-    piiWarning: boolean;
-}
-export declare class EnterpriseLogger {
-    private config;
-    private static instance;
-    private constructor();
-    static getInstance(): EnterpriseLogger;
-    configure(config: Partial<LoggerConfig>): void;
-    private formatMessage;
-    private log;
-    debug(message: string, meta?: unknown): void;
-    info(message: string, meta?: unknown): void;
-    warn(message: string, meta?: unknown): void;
-    error(message: string, meta?: unknown): void;
-    fatal(message: string, meta?: unknown): void;
-}
-export declare const logger: EnterpriseLogger;
+export * from "./modules/observability/logger.js";

package/dist/shared/src/logger.js

@@ -1,127 +1,2 @@
-import chalk from "chalk";
-import path from "path";
-import { appendFile, ensureDir } from "./fs.js";
-import { containsPII, maskObject, maskText } from "./pii.js";
-export var LogLevel;
-(function (LogLevel) {
-    LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
-    LogLevel[LogLevel["INFO"] = 1] = "INFO";
-    LogLevel[LogLevel["WARN"] = 2] = "WARN";
-    LogLevel[LogLevel["ERROR"] = 3] = "ERROR";
-    LogLevel[LogLevel["FATAL"] = 4] = "FATAL";
-})(LogLevel || (LogLevel = {}));
-export class EnterpriseLogger {
-    config;
-    static instance;
-    constructor() {
-        const isProd = process.env.NODE_ENV === "production";
-        this.config = {
-            minLevel: isProd ? LogLevel.INFO : LogLevel.DEBUG,
-            enableColors: !isProd,
-            jsonFormat: isProd,
-            enablePiiMasking: true, // KVKK: PII masking ON by default
-            piiWarning: true,
-        };
-    }
-    static getInstance() {
-        if (!EnterpriseLogger.instance) {
-            EnterpriseLogger.instance = new EnterpriseLogger();
-        }
-        return EnterpriseLogger.instance;
-    }
-    configure(config) {
-        this.config = { ...this.config, ...config };
-        if (this.config.logFile) {
-            try {
-                ensureDir(path.dirname(this.config.logFile));
-            }
-            catch (err) {
-                // Directly write to stderr — using console here would be circular
-                process.stderr.write(`[Logger] Failed to create log directory: ${err}\n`);
-            }
-        }
-    }
-    formatMessage(level, message, meta) {
-        const timestamp = new Date().toISOString();
-        const pid = process.pid;
-        // [KVKK] PII masking — mask sensitive data before logging
-        const safeMessage = this.config.enablePiiMasking ? maskText(message) : message;
-        const safeMeta = this.config.enablePiiMasking && meta ? maskObject(meta) : meta;
-        // [KVKK] Warn if PII detected in production
-        if (this.config.piiWarning && (containsPII(message) || (meta && containsPII(JSON.stringify(meta))))) {
-            process.stderr.write(`[PII WARNING] Potential PII detected in log at ${timestamp}\n`);
-        }
-        if (this.config.jsonFormat) {
-            return JSON.stringify({
-                timestamp,
-                level: LogLevel[level],
-                pid,
-                message: safeMessage,
-                meta: safeMeta,
-            });
-        }
-        const levelName = LogLevel[level].padEnd(5);
-        let coloredLevel = levelName;
-        if (this.config.enableColors) {
-            switch (level) {
-                case LogLevel.DEBUG:
-                    coloredLevel = chalk.blue(levelName);
-                    break;
-                case LogLevel.INFO:
-                    coloredLevel = chalk.green(levelName);
-                    break;
-                case LogLevel.WARN:
-                    coloredLevel = chalk.yellow(levelName);
-                    break;
-                case LogLevel.ERROR:
-                    coloredLevel = chalk.red(levelName);
-                    break;
-                case LogLevel.FATAL:
-                    coloredLevel = chalk.bgRed.white.bold(levelName);
-                    break;
-            }
-        }
-        const metaStr = safeMeta ? ` | Meta: ${JSON.stringify(safeMeta)}` : "";
-        return `[${timestamp}] [PID:${pid}] [${coloredLevel}]: ${safeMessage}${metaStr}`;
-    }
-    log(level, message, meta) {
-        if (level < this.config.minLevel)
-            return;
-        const formatted = this.formatMessage(level, message, meta);
-        // Route to stderr for ERROR/FATAL, stdout otherwise.
-        // Using process.write directly here is intentional — this IS the logger.
-        if (level >= LogLevel.ERROR) {
-            process.stderr.write(formatted + "\n");
-        }
-        else {
-            process.stdout.write(formatted + "\n");
-        }
-        // Output to file if configured
-        if (this.config.logFile) {
-            try {
-                appendFile(this.config.logFile, formatted + "\n");
-            }
-            catch (err) {
-                // Directly write to stderr — using console here would be circular
-                process.stderr.write(`[Logger] Failed to write to log file: ${err}\n`);
-            }
-        }
-    }
-    debug(message, meta) {
-        this.log(LogLevel.DEBUG, message, meta);
-    }
-    info(message, meta) {
-        this.log(LogLevel.INFO, message, meta);
-    }
-    warn(message, meta) {
-        this.log(LogLevel.WARN, message, meta);
-    }
-    error(message, meta) {
-        this.log(LogLevel.ERROR, message, meta);
-    }
-    fatal(message, meta) {
-        this.log(LogLevel.FATAL, message, meta);
-    }
-}
-export const logger = EnterpriseLogger.getInstance();
+export * from "./modules/observability/logger.js";
 //# sourceMappingURL=logger.js.map

package/dist/shared/src/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../../shared/src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAE7D,MAAM,CAAN,IAAY,QAMX;AAND,WAAY,QAAQ;IAChB,yCAAS,CAAA;IACT,uCAAQ,CAAA;IACR,uCAAQ,CAAA;IACR,yCAAS,CAAA;IACT,yCAAS,CAAA;AACb,CAAC,EANW,QAAQ,KAAR,QAAQ,QAMnB;AAWD,MAAM,OAAO,gBAAgB;IACjB,MAAM,CAAe;IACrB,MAAM,CAAC,QAAQ,CAAmB;IAE1C;QACI,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG;YACV,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK;YACjD,YAAY,EAAE,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM;YAClB,gBAAgB,EAAE,IAAI,EAAE,kCAAkC;YAC1D,UAAU,EAAE,IAAI;SACnB,CAAC;IACN,CAAC;IAEM,MAAM,CAAC,WAAW;QACrB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC7B,gBAAgB,CAAC,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,gBAAgB,CAAC,QAAQ,CAAC;IACrC,CAAC;IAEM,SAAS,CAAC,MAA6B;QAC1C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAE5C,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,kEAAkE;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,GAAG,IAAI,CAAC,CAAC;YAC9E,CAAC;QACL,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,KAAe,EAAE,OAAe,EAAE,IAAc;QAClE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAExB,0DAA0D;QAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/E,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhF,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,SAAS,IAAI,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,SAAS,CAAC;gBAClB,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACtB,GAAG;gBACH,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,QAAQ;aACjB,CAAC,CAAC;QACP,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,YAAY,GAAG,SAAS,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3B,QAAQ,KAAK,EAAE,CAAC;gBACZ,KAAK,QAAQ,CAAC,KAAK;oBACf,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrC,MAAM;gBACV,KAAK,QAAQ,CAAC,IAAI;oBACd,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBACtC,MAAM;gBACV,KAAK,QAAQ,CAAC,IAAI;oBACd,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACvC,MAAM;gBACV,KAAK,QAAQ,CAAC,KAAK;oBACf,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACpC,MAAM;gBACV,KAAK,QAAQ,CAAC,KAAK;oBACf,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACjD,MAAM;YACd,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,SAAS,UAAU,GAAG,MAAM,YAAY,MAAM,WAAW,GAAG,OAAO,EAAE,CAAC;IACrF,CAAC;IAEO,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAAc;QACxD,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO;QAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE3D,qDAAqD;QACrD,yEAAyE;QACzE,IAAI,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAC3C,CAAC;QAED,+BAA+B;QAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,kEAAkE;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,GAAG,IAAI,CAAC,CAAC;YAC3E,CAAC;QACL,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,OAAe,EAAE,IAAc;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAEM,IAAI,CAAC,OAAe,EAAE,IAAc;QACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,IAAI,CAAC,OAAe,EAAE,IAAc;QACvC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,OAAe,EAAE,IAAc;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAEM,KAAK,CAAC,OAAe,EAAE,IAAc;QACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../../../shared/src/logger.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC"}

package/dist/shared/src/memory-prune.d.ts

@@ -0,0 +1 @@
+export * from "./modules/storage/memory-prune.js";

package/dist/shared/src/memory-prune.js

@@ -0,0 +1,2 @@
+export * from "./modules/storage/memory-prune.js";
+//# sourceMappingURL=memory-prune.js.map

package/dist/shared/src/memory-prune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-prune.js","sourceRoot":"","sources":["../../../../shared/src/memory-prune.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC"}

package/dist/shared/src/migrations.d.ts

@@ -0,0 +1 @@
+export * from "./modules/storage/migrations.js";

package/dist/shared/src/migrations.js

@@ -0,0 +1,2 @@
+export * from "./modules/storage/migrations.js";
+//# sourceMappingURL=migrations.js.map

package/dist/shared/src/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../../shared/src/migrations.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAC"}

package/dist/shared/src/modules/agent/agent-identity.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+export interface AgentIdentity {
+    agent: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface AgentTokenResult {
+    valid: boolean;
+    agent?: string;
+    reason?: string;
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export declare function isAgentIdentityEnforced(): boolean;
+/** Sign an agent identity into a compact token. */
+export declare function signAgentToken(agent: string, options?: {
+    ttlMs?: number;
+    key?: string | Buffer;
+}): string;
+/** Verify an agent token (signature + expiry). */
+export declare function verifyAgentToken(token: string, options?: {
+    key?: string | Buffer;
+}): AgentTokenResult;
+/** Decode a token's identity without verification (for diagnostics only). */
+export declare function decodeAgentToken(token: string): AgentIdentity | null;

package/dist/shared/src/modules/agent/agent-identity.js

@@ -0,0 +1,77 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+import crypto from "crypto";
+import { resolveAuditChainKey } from "../observability/audit-chain.js";
+function resolveKey(explicit) {
+    if (explicit) {
+        return Buffer.isBuffer(explicit) ? explicit : crypto.createHash("sha256").update(explicit, "utf8").digest();
+    }
+    const envSecret = process.env.ATABEY_AGENT_SECRET;
+    if (envSecret && envSecret.trim()) {
+        return crypto.createHash("sha256").update(envSecret.trim(), "utf8").digest();
+    }
+    return resolveAuditChainKey();
+}
+function timingSafeEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ba, bb);
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export function isAgentIdentityEnforced() {
+    return process.env.ATABEY_AGENT_IDENTITY_REQUIRED === "true";
+}
+/** Sign an agent identity into a compact token. */
+export function signAgentToken(agent, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key) {
+        throw new Error("[AGENT_IDENTITY] No signing key. Set ATABEY_AGENT_SECRET.");
+    }
+    const name = agent.replace(/^@/, "");
+    const issuedAt = Date.now();
+    const expiresAt = issuedAt + (options.ttlMs ?? 60 * 60 * 1000);
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const sig = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    return `${payload}.${sig}`;
+}
+/** Verify an agent token (signature + expiry). */
+export function verifyAgentToken(token, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key)
+        return { valid: false, reason: "No signing key configured." };
+    if (!token || typeof token !== "string")
+        return { valid: false, reason: "Empty token." };
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return { valid: false, reason: "Malformed token." };
+    const [name, issuedAt, expiresAt, sig] = parts;
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const expected = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    if (!timingSafeEqual(sig, expected))
+        return { valid: false, reason: "Signature mismatch." };
+    const exp = Number(expiresAt);
+    if (!Number.isFinite(exp))
+        return { valid: false, reason: "Invalid expiry." };
+    if (Date.now() > exp)
+        return { valid: false, reason: "Token expired." };
+    return { valid: true, agent: `@${name}` };
+}
+/** Decode a token's identity without verification (for diagnostics only). */
+export function decodeAgentToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return null;
+    return { agent: `@${parts[0]}`, issuedAt: Number(parts[1]), expiresAt: Number(parts[2]) };
+}
+//# sourceMappingURL=agent-identity.js.map

package/dist/shared/src/modules/agent/agent-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity.js","sourceRoot":"","sources":["../../../../../../shared/src/modules/agent/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAcvE,SAAS,UAAU,CAAC,QAA0B;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAClD,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM,CAAC;AACjE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,UAAqD,EAAE;IACjG,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAAqC,EAAE;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC5E,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAE5F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/shared/src/modules/agent/api-catalog.d.ts

@@ -0,0 +1,57 @@
+/**
+ * API Catalog — endpoint registry, route/OpenAPI scanner, and drift detection.
+ *
+ * Purpose: let frontend/mobile agents integrate against the backend API using
+ * a compact JSON catalog instead of reading large route source files (token
+ * savings + zero context pollution).
+ *
+ * The scanner is HEURISTIC (regex/AST-lite) and covers:
+ *   - Express / Fastify:  app|router|server|fastify.get('/path', ...)
+ *   - Fastify route():    fastify.route({ method, url, ... })
+ *   - NestJS decorators:  @Get('path') / @Post('path')
+ *   - OpenAPI v3 / Swagger v2 JSON specs
+ */
+export interface ApiEndpoint {
+    method: string;
+    path: string;
+    tag?: string;
+    summary?: string;
+    authRequired: boolean;
+    requestSchema?: string;
+    responseSchema?: string;
+    source?: string;
+    updatedAt: string;
+}
+export interface ApiCatalog {
+    version: 1;
+    generatedAt: string;
+    endpoints: ApiEndpoint[];
+}
+export interface ApiDrift {
+    added: ApiEndpoint[];
+    removed: ApiEndpoint[];
+    changed: Array<{
+        previous: ApiEndpoint;
+        current: ApiEndpoint;
+    }>;
+}
+export declare function endpointKey(e: {
+    method: string;
+    path: string;
+}): string;
+export declare function normalizePath(p: string): string;
+/** Parse an OpenAPI v3 or Swagger v2 spec object into endpoints. */
+export declare function parseOpenApiSpec(spec: unknown): ApiEndpoint[];
+/**
+ * Walk a project tree and collect endpoints from route source files and any
+ * OpenAPI/Swagger JSON specs.
+ */
+export declare function scanProjectForEndpoints(rootDir: string, options?: {
+    maxFiles?: number;
+}): ApiEndpoint[];
+export declare function dedupe(endpoints: ApiEndpoint[]): ApiEndpoint[];
+/**
+ * Diff a previous catalog against a freshly scanned one.
+ */
+export declare function detectApiDrift(previous: ApiEndpoint[], current: ApiEndpoint[]): ApiDrift;
+export declare function isApiDriftClean(drift: ApiDrift): boolean;