codiedev 0.10.0-beta.4 → 0.10.0-beta.5

package/dist/codieUsage.d.ts

@@ -1,57 +0,0 @@
-export interface CodieUsageBudget {
-    companyBudgetUsd: number | null;
-    companySpentUsd: number;
-    companyHeldUsd: number;
-    userBudgetUsd: number | null;
-    userSpentUsd: number;
-    userHeldUsd: number;
-    keyBudgetUsd: number | null;
-    keySpentUsd: number;
-    keyHeldUsd: number | null;
-}
-export interface CodieUsageInFlight {
-    /** Reservations open inside the gateway's hold TTL: real work running now. */
-    requests: number;
-    heldUsd: number;
-    /** Reservations past the TTL, waiting for the sweep. They hold budget
-     * without doing work, so they are never counted as live work. */
-    staleRequests: number;
-    staleHeldUsd: number;
-}
-export interface CodieUsage {
-    enabled: boolean;
-    user: {
-        name: string;
-        email: string;
-        role: string;
-    } | null;
-    budget: CodieUsageBudget;
-    inFlight: CodieUsageInFlight;
-    since?: {
-        costUsd: number;
-        promptTokens: number;
-        completionTokens: number;
-        requests: number;
-    };
-}
-/**
- * One line: who is spending, how much, against what, and what is running.
- * Returns "" when there is nothing honest to say.
- */
-export declare function formatUsageLine(usage: CodieUsage | null | undefined): string;
-/**
- * What this session just cost. Returns "" when the session billed nothing,
- * because a developer who spent nothing does not need to be told a number.
- */
-export declare function formatSessionCostLine(usage: CodieUsage | null | undefined): string;
-/**
- * Read the developer's budget snapshot. Returns null on any refusal, network
- * failure, timeout, or malformed answer — a status poll is never worth an
- * error in front of a developer who asked for none.
- */
-export declare function fetchCodieUsage({ baseUrl, key, sinceMs, fetchImpl, }: {
-    baseUrl?: string;
-    key: string;
-    sinceMs?: number;
-    fetchImpl?: typeof fetch;
-}): Promise<CodieUsage | null>;

package/dist/commands/ask.d.ts

@@ -1 +0,0 @@
-export declare function runAsk(args: string[]): Promise<void>;

package/dist/commands/capture.d.ts

@@ -1,14 +0,0 @@
-import { type CodiedevConfig } from "../utils";
-import { apiRequest } from "./shared";
-export interface CaptureCommandDeps {
-    readConfig: () => CodiedevConfig | null;
-    writeConfig: (config: CodiedevConfig) => void;
-    apiRequest: typeof apiRequest;
-    log: (line: string) => void;
-    warn: (line: string) => void;
-    randomUUID: () => string;
-    hostname: () => string;
-    normalizePath: (value: string) => string;
-    configForRequest: (config: CodiedevConfig) => CodiedevConfig;
-}
-export declare function runCaptureCommand(args: string[], depsOverride?: Partial<CaptureCommandDeps>): Promise<void>;

package/dist/commands/createTicket.d.ts

@@ -1,27 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function substitutePrompt(protocol: string, prompt: string | undefined): string;
-interface ConnectedRepo {
-    repoId: string;
-    fullName: string;
-}
-export declare function validatePlanHasRepo(parsedPlan: any): string | null;
-export declare function resolveRepoIds(fullNames: string[], repos: ConnectedRepo[]): string[];
-export interface CreateTicketArgs {
-    mode: "bare" | "submit";
-    prompt?: string;
-    submitSource?: "stdin" | string;
-}
-export declare function parseCreateTicketArgs(args: string[]): CreateTicketArgs;
-export declare function runCreateTicket(args: string[]): Promise<void>;
-/**
- * Bare-mode entrypoint. Fetches the protocol body from the backend so we can
- * iterate on it without shipping a new CLI, substitutes the user's prompt,
- * and writes the result to stdout for the agent to follow. Hard-errors on
- * fetch failure rather than falling back to a stale local copy — the whole
- * point of moving the protocol server-side is that the freshest version is
- * the only version.
- */
-export declare function runBare(config: CodiedevConfig, prompt: string | undefined): Promise<void>;
-export declare function runSubmit(config: CodiedevConfig, rawJson: string): Promise<void>;
-export declare function readSubmitInput(source: "stdin" | string): string;
-export {};

package/dist/commands/delete.d.ts

@@ -1 +0,0 @@
-export declare function runDelete(args: string[]): Promise<void>;

package/dist/commands/doctor.d.ts

@@ -1 +0,0 @@
-export declare function runDoctor(_args: string[]): Promise<void>;

package/dist/commands/inbox.d.ts

@@ -1,3 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runInbox(args: string[], configOverride?: CodiedevConfig): Promise<void>;
-export declare function runRead(args: string[]): Promise<void>;

package/dist/commands/library.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runLibrary(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/note.d.ts

@@ -1 +0,0 @@
-export declare function runNote(args: string[]): Promise<void>;

package/dist/commands/ping.d.ts

@@ -1 +0,0 @@
-export declare function runPing(args: string[]): Promise<void>;

package/dist/commands/promote.d.ts

@@ -1 +0,0 @@
-export declare function runPromote(args: string[]): Promise<void>;

package/dist/commands/pull.d.ts

@@ -1,2 +0,0 @@
-export declare function candidateKeys(key: string): string[];
-export declare function runPull(args: string[]): Promise<void>;

package/dist/commands/push.d.ts

@@ -1,33 +0,0 @@
-import { requireConfig } from "./shared";
-interface PushResponse {
-    ok: boolean;
-    artifactId: string;
-    key: string;
-    version: number;
-    type: string;
-    kind: "doc" | "skill";
-    tags: string[];
-    destination: string;
-}
-export interface ParsedArgs {
-    file: string;
-    type?: string;
-    kind?: string;
-    tags: string[];
-    force: boolean;
-    as?: string;
-    private?: boolean;
-}
-export declare function parseArgs(args: string[]): ParsedArgs;
-export declare function pushFile(config: ReturnType<typeof requireConfig>, opts: {
-    absPath: string;
-    key: string;
-    visibility?: "private" | "team";
-    contentHash?: string;
-    type?: string;
-    kind?: string;
-    tags?: string[];
-    force?: boolean;
-}): Promise<PushResponse>;
-export declare function runPush(args: string[]): Promise<void>;
-export {};

package/dist/commands/react.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runReact(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/reverseTicket.d.ts

@@ -1,2 +0,0 @@
-export declare function isSafeRef(ref: string): boolean;
-export declare function runReverseTicket(args: string[]): Promise<void>;

package/dist/commands/search.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runSearch(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/security.d.ts

@@ -1 +0,0 @@
-export declare function runSecurityCommand(args: string[]): Promise<void>;

package/dist/commands/send.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runSend(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/share.d.ts

@@ -1,2 +0,0 @@
-import type { CodiedevConfig } from "../utils";
-export declare function runShare(args: string[], configOverride?: CodiedevConfig): Promise<void>;

package/dist/commands/shared.d.ts

@@ -1,64 +0,0 @@
-import { CodiedevConfig } from "../utils";
-/**
- * Layer per-command env overrides on top of the on-disk config. Useful for
- * ad-hoc testing — point a prod-connected CLI at a dev Convex deployment
- * without re-running `codiedev connect`. Both CODIEDEV_URL and CODIEDEV_TOKEN
- * must be set together (half-overrides would mismatch URL and auth realm).
- * Other fields (companyId, repos[]) come from the file unchanged.
- */
-export declare function applyConfigEnvOverrides(config: CodiedevConfig): CodiedevConfig;
-/**
- * Require a connected Codiedev config. Exits the process with a helpful
- * message if the user hasn't run `codiedev connect` yet.
- */
-export declare function requireConfig(): CodiedevConfig;
-/**
- * Perform an authenticated HTTP request against the Codiedev backend.
- * Returns the parsed JSON response body. Throws on non-2xx.
- */
-export declare function apiRequest<T = unknown>(method: "GET" | "POST", path: string, options: {
-    config: CodiedevConfig;
-    body?: Record<string, unknown>;
-    query?: Record<string, string | number | undefined>;
-}): Promise<T>;
-/**
- * Fire-and-forget per-invocation telemetry from CLI subcommands. Mirrors
- * the MCP server's emitTelemetry but stamps `source: "cli"` so adoption
- * dashboards can distinguish between the two surfaces. Never blocks the
- * user's command, never throws — telemetry must not change behavior.
- */
-export declare function recordAgentEvent(config: CodiedevConfig, event: {
-    tool: string;
-    ok: boolean;
-    latencyMs: number;
-    error?: string;
-}): void;
-/**
- * Per-step install telemetry for `npx codiedev connect`. One row per phase
- * (started, detect, install_target, validate_token, completed, failed) so
- * the admin company page can show a timeline when a customer says "it says
- * connected but it doesn't work." Fire-and-forget, never throws. Auto-stamps
- * platform + node + cli version so call sites only need step/target/ok/error.
- */
-export type InstallTelemetryStep = "started" | "detect" | "install_target" | "validate_token" | "completed" | "failed";
-export declare function recordInstallEvent(config: CodiedevConfig, event: {
-    step: InstallTelemetryStep;
-    target?: string;
-    ok: boolean;
-    error?: string;
-}): void;
-/**
- * Wraps a CLI subcommand body so success and failure both record telemetry
- * and the original error propagates after the event is queued. Use this in
- * each `runXxx` command instead of inline timing + try/catch boilerplate.
- */
-export declare function withTelemetry<T>(config: CodiedevConfig, tool: string, fn: () => Promise<T>): Promise<T>;
-/**
- * Relative-time formatter for inbox / listing output.
- */
-export declare function timeAgo(ts: number): string;
-/**
- * Strip surrounding quotes from a CLI argument if the user wrapped it.
- * `codiedev ping <name> "hey"` on some shells passes the quotes through.
- */
-export declare function stripQuotes(s: string): string;

package/dist/configDir.d.ts

@@ -1 +0,0 @@
-export declare function codiedevStateDir(): string;

package/dist/connect.d.ts

@@ -1 +0,0 @@
-export declare function runConnect(args?: string[]): Promise<void>;

package/dist/connectFlow.d.ts

@@ -1,13 +0,0 @@
-import type { CodiedevConfig } from "./utils";
-export type ConnectTokenSource = "reused" | "prompt-required";
-export interface ConnectTokenInput {
-    savedConfig: CodiedevConfig | null;
-    force: boolean;
-}
-export type ConnectTokenResult = {
-    source: "reused";
-    token: string;
-} | {
-    source: "prompt-required";
-};
-export declare function resolveConnectToken(input: ConnectTokenInput): ConnectTokenResult;

package/dist/cursorHooks.d.ts

@@ -1,23 +0,0 @@
-/** Cursor's native hook payload is close to Claude Code's, but its stable
- * conversation identifier and several tool fields use different names. Keep
- * the translation at the process boundary so the shared capture/security
- * pipeline never has to guess which surface produced an event. */
-export declare function normalizeCursorHookInput<T extends Record<string, unknown>>(input: T): T & Record<string, unknown>;
-/** Cursor stores JSONL message roles in `role`; the shared capture pipeline
- * uses Claude's top-level `type` discriminator. Preserve all original fields
- * and add only that discriminator so the existing parsers see real messages. */
-export declare function normalizeCursorTranscript(content: string): string;
-/** Cursor may change its private JSONL record shape independently of the hook
- * contract. Only a byte-empty snapshot is safe to discard; a non-empty file
- * that the current normalizer cannot parse must still be uploaded for backend
- * recovery and diagnosis. */
-export declare function isCursorTranscriptEmpty(content: string): boolean;
-export declare function cursorPreToolBlockResponse(reason: string): {
-    permission: "deny";
-    user_message: string;
-    agent_message: string;
-};
-export declare function cursorPromptBlockResponse(reason: string): {
-    continue: false;
-    user_message: string;
-};

package/dist/detection.d.ts

@@ -1,30 +0,0 @@
-export interface ClaudeCodeProbe {
-    dirExists: boolean;
-    binOnPath: boolean;
-}
-/**
- * Claude Code is "installed" if either ~/.claude exists (the user has
- * launched the app at least once) OR the `claude` binary is on PATH (the
- * user installed via npm/brew but hasn't launched yet). Either signal is
- * sufficient — we want to wire up the hook the moment the user has
- * obviously committed to the tool.
- */
-export declare function detectClaudeCode(probe: ClaudeCodeProbe): boolean;
-/**
- * True iff `cmd` looks like a hook command codiedev itself wrote. Used
- * both by the install filter (so `connect` replaces the existing entry
- * instead of stacking another one) and by `codiedev doctor` (so it can
- * grade whether the hook is wired up).
- *
- * Must match every form codiedev can write:
- *   - Legacy `npx codiedev-hook <subcommand>`
- *   - Absolute path from npm-registry install:
- *     `<node> /.../node_modules/codiedev/dist/hook.js <subcommand>`
- *   - Absolute path from `npm link` dev install (the monorepo folder
- *     is named `codiedev-cli`, not `codiedev`):
- *     `<node> /.../codiedev-cli/dist/hook.js <subcommand>`
- *
- * The `codiedev[^/\\]*` allows the trailing `-cli` (or any future suffix)
- * without matching unrelated paths like `notcodiedev/dist/hook.js`.
- */
-export declare function isCodiedevHookCommand(cmd: string | undefined): boolean;

package/dist/hook.d.ts

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-export declare function buildDiscoveryContext(skills: Array<{
-    key: string;
-    title: string;
-    score: number;
-}>): string | null;

package/dist/inboxFormat.d.ts

@@ -1,38 +0,0 @@
-export interface InboxPing {
-    pingId: string;
-    createdAt: number;
-    readAt?: number;
-    from: {
-        name: string;
-        email: string;
-    } | null;
-    subjectKey: string | null;
-    subject: {
-        title?: string;
-    } | null;
-    preview: string;
-}
-export interface InboxMention {
-    mentionId: string;
-    createdAt: number;
-    readAt?: number | null;
-    from: {
-        name: string;
-        email: string;
-    } | null;
-    postTitle: string | null;
-    preview: string | null;
-    url: string | null;
-}
-/**
- * Render the inbox for BOTH surfaces — `codiedev inbox` and the MCP
- * `codiedev_inbox` tool an agent calls for "any messages?". Shared so the
- * agent path can never drift back to pings-only while the human path shows
- * mentions.
- */
-export declare function formatInbox(opts: {
-    pings: InboxPing[];
-    mentions?: InboxMention[];
-    unreadOnly: boolean;
-    limit?: number;
-}): string[];

package/dist/limitEvent.d.ts

@@ -1,16 +0,0 @@
-export type LimitKind = "session" | "user_spend" | "org_spend" | "other";
-export interface LimitEvent {
-    kind: LimitKind;
-    at: number;
-    resetText: string | null;
-    reason?: string;
-}
-export declare function classifyLimitKind(text: string): LimitKind;
-export declare function parseLimitEventFromTranscript(transcript: string): LimitEvent | null;
-/**
- * Codex writes a structured RateLimitSnapshot on token_count events. A normal
- * turn has `rate_limit_reached_type: null`; a blocked turn names the exact
- * boundary. Reading that field avoids locale-dependent terminal copy.
- */
-export declare function parseCodexLimitEventFromTranscript(transcript: string): LimitEvent | null;
-export declare function tailForLimitEvent(transcript: string, maxChars?: number): string;

package/dist/limitEventReporter.d.ts

@@ -1,21 +0,0 @@
-import { type LimitEvent } from "./limitEvent";
-export type LimitEventSource = "claude-code" | "codex";
-export type LimitEventPayload = LimitEvent & {
-    source: LimitEventSource;
-    sessionId?: string;
-    transcriptTail?: string;
-};
-export declare function postLimitEvent(config: {
-    backendUrl: string;
-    token: string;
-}, payload: LimitEventPayload, timeoutMs?: number): Promise<void>;
-export declare function reportTranscriptLimitEvent(args: {
-    config: {
-        backendUrl: string;
-        token: string;
-    };
-    source: LimitEventSource;
-    sessionId?: string;
-    transcript: string;
-    emitMinimalOnMiss?: boolean;
-}): Promise<boolean>;

package/dist/mcp.d.ts

@@ -1,12 +0,0 @@
-#!/usr/bin/env node
-/**
- * Codiedev MCP server.
- *
- * Exposes the Codiedev artifact-collaboration surface as Model Context
- * Protocol tools so Claude Code / Codex / any MCP-capable agent can invoke
- * them natively from natural language (e.g. "push the spec we just worked on").
- *
- * Reads the same ~/.codiedev/config.json the CLI uses. Install + wire up by
- * running `npx codiedev connect`.
- */
-export {};

package/dist/prUrl.d.ts

@@ -1,9 +0,0 @@
-export type GitProvider = "github" | "gitlab";
-export interface PrOrMrRef {
-    provider: GitProvider;
-    host: string;
-    owner: string;
-    repo: string;
-    number: number;
-}
-export declare function parsePrOrMrUrl(url: string): PrOrMrRef | null;

package/dist/repoResolver.d.ts

@@ -1,17 +0,0 @@
-export type ResolveSource = "provided" | "resolved" | "unmatched";
-export interface RepoLite {
-    _id: string;
-    owner: string;
-    name: string;
-    gitProvider?: "github" | "gitlab";
-}
-export interface ResolveInput {
-    remoteUrl: string | null | undefined;
-    providedRepoId: string | null;
-    companyRepos: ReadonlyArray<RepoLite>;
-}
-export interface ResolveResult {
-    repoId: string | null;
-    source: ResolveSource;
-}
-export declare function resolveRepoForCapture(input: ResolveInput): ResolveResult;

package/dist/secret.d.ts

@@ -1 +0,0 @@
-export declare function maskToken(token: string | null | undefined): string;

package/dist/security.d.ts

@@ -1,102 +0,0 @@
-export type SecurityHookPhase = "pre" | "post" | "failure";
-export type AgentSurface = "claude-code" | "codex" | "cursor" | "codie-harness";
-export declare const SECURITY_RUNTIME_VERSION = 1;
-export interface RawSecurityHookInput {
-    session_id?: string;
-    sessionId?: string;
-    cwd?: string;
-    hook_event_name?: string;
-    hookEventName?: string;
-    tool_name?: string;
-    toolName?: string;
-    tool_input?: unknown;
-    toolInput?: unknown;
-    tool_response?: unknown;
-    toolResponse?: unknown;
-    tool_use_id?: string;
-    toolUseId?: string;
-    duration_ms?: number;
-    durationMs?: number;
-    error?: unknown;
-    prompt?: string;
-}
-export interface SecurityWorkflowEvent {
-    schemaVersion: 1;
-    source: AgentSurface;
-    phase: SecurityHookPhase;
-    sessionId: string;
-    toolName: string;
-    toolUseId?: string;
-    cwd?: string;
-    observedAt: number;
-    toolDurationMs?: number;
-    payload: unknown;
-    redactionCount: number;
-    localDecision?: LocalSecurityAction;
-    localCategory?: LocalSecurityDecision["category"];
-    endpointId?: string;
-    endpointName?: string;
-    cliVersion?: string;
-    securityRuntimeVersion?: number;
-    securityPolicyVersion?: number;
-}
-export type LocalSecurityAction = "allow" | "alert" | "block";
-export type SecurityCategory = "secret_in_prompt" | "secret_exfiltration" | "destructive_outside_workspace" | "sensitive_file_read" | "sensitive_file_write" | "protected_agent_config_write" | "unapproved_network_egress" | "untrusted_mcp_tool" | "unapproved_command" | "obfuscated_shell_command" | "package_install" | "sensitive_read_then_egress";
-export interface EndpointSecurityPolicy {
-    schemaVersion: 1;
-    policyVersion: number;
-    enforcementMode: "alert" | "block";
-    rules: Partial<Record<SecurityCategory, LocalSecurityAction>>;
-    constraints?: {
-        allowedMcpServers?: string[];
-        allowedHosts?: string[];
-        allowedCommands?: string[];
-    };
-    exceptions: Array<{
-        scope: "company" | "user" | "source" | "repository" | "tool" | "category";
-        scopeValue: string;
-    }>;
-    fetchedAt: number;
-    signature?: {
-        algorithm: "Ed25519";
-        keyId: string;
-        signedAt: number;
-        value: string;
-    };
-}
-export interface LocalSecurityDecision {
-    action: LocalSecurityAction;
-    category?: SecurityCategory;
-    reason?: string;
-}
-export declare function withEndpointIdentity(event: SecurityWorkflowEvent, identity: {
-    endpointId?: string;
-    endpointName?: string;
-    cliVersion?: string;
-    securityRuntimeVersion?: number;
-    securityPolicyVersion?: number;
-}): SecurityWorkflowEvent;
-/**
- * Runs before a user prompt reaches the model. This is intentionally narrow:
- * block credential material, but allow safe references such as
- * `$OPENAI_API_KEY` so developers can ask agents to use environment variables
- * without pasting their values.
- */
-export declare function evaluatePromptSecurity(prompt: string | undefined, policy?: EndpointSecurityPolicy, source?: AgentSurface): LocalSecurityDecision;
-/** Runs synchronously before a tool executes. No network or model is involved. */
-export declare function evaluateToolSecurity(input: RawSecurityHookInput, phase: SecurityHookPhase, policy?: EndpointSecurityPolicy, source?: AgentSurface, sessionContext?: {
-    sensitiveReadAt?: number;
-    now?: number;
-}): LocalSecurityDecision;
-export declare function securityInputHasSensitivePath(input: RawSecurityHookInput): boolean;
-export declare function buildSecurityWorkflowEvent(input: RawSecurityHookInput, phase: SecurityHookPhase, source: AgentSurface, now?: () => number): SecurityWorkflowEvent | null;
-/**
- * Captures the intent side of the causal chain without weakening the local
- * privacy boundary. A prompt that the deterministic policy blocks never
- * becomes an uploadable event; allowed prompts are redacted and bounded using
- * the same sanitizer as tool payloads.
- */
-export declare function buildSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd" | "prompt">, source: AgentSurface, now?: () => number, policy?: EndpointSecurityPolicy): SecurityWorkflowEvent | null;
-/** Audit-safe evidence for a blocked prompt. The secret-bearing prompt is
- * intentionally omitted; administrators still see that prevention occurred. */
-export declare function buildBlockedSecurityPromptEvent(input: Pick<RawSecurityHookInput, "session_id" | "sessionId" | "cwd">, source: AgentSurface, category: NonNullable<LocalSecurityDecision["category"]>, now?: () => number): SecurityWorkflowEvent | null;

package/dist/securityDeepScan.d.ts

@@ -1,41 +0,0 @@
-import { type SpawnSyncReturns } from "child_process";
-import type { SecurityFindingSeverity, SecurityInventoryReport } from "./securityInventory";
-export interface ExternalSecurityFinding {
-    scanner: string;
-    componentKey?: string;
-    severity: SecurityFindingSeverity;
-    ruleId?: string;
-    title: string;
-}
-export interface ExternalScannerRun {
-    scanner: string;
-    status: "passed" | "findings" | "unavailable" | "error" | "skipped";
-    detail: string;
-    findings: ExternalSecurityFinding[];
-}
-export interface DeepSecurityScanReport {
-    schemaVersion: 1;
-    generatedAt: string;
-    runs: ExternalScannerRun[];
-    findings: ExternalSecurityFinding[];
-}
-/** Adds component-addressable OSS scanner findings to the uploadable inventory.
- * Workspace-level findings (for example OSV dependency results) stay in the
- * deep-scan report because they do not identify one agent component. */
-export declare function mergeDeepScanFindings(report: SecurityInventoryReport, deep: DeepSecurityScanReport): SecurityInventoryReport;
-type Runner = (command: string, args: string[], timeoutMs: number) => SpawnSyncReturns<string>;
-/**
- * Runs optional open-source scanners. No scanner is downloaded implicitly.
- * MCP server connection is a separate opt-in because scanning a live stdio
- * server starts third-party code; the normal deep scan remains static.
- */
-export declare function runDeepSecurityScan(report: SecurityInventoryReport, options?: {
-    homeDir?: string;
-    workspace?: string;
-    connectMcp?: boolean;
-    supplyChain?: boolean;
-    timeoutMs?: number;
-    runner?: Runner;
-    now?: () => number;
-}): DeepSecurityScanReport;
-export {};

package/dist/securityDoctor.d.ts

@@ -1,32 +0,0 @@
-import { type SecurityInstallInspection, type SecurityInstallManifest } from "./securityInstall";
-export type SecurityDoctorStatus = "pass" | "fail" | "warn";
-export interface SecurityDoctorCheck {
-    name: string;
-    status: SecurityDoctorStatus;
-    detail: string;
-}
-export interface SecurityDoctorReport {
-    schemaVersion: 1;
-    ok: boolean;
-    integrity: {
-        ok: boolean;
-        detail: string;
-    };
-    manifest: SecurityInstallManifest | null;
-    installations: SecurityInstallInspection[];
-    policyExists: boolean;
-    /** Retained for `codiedev security doctor --json` compatibility. */
-    policySignature: {
-        ok: boolean;
-        trusted: boolean;
-        detail: string;
-    };
-    policySelfTest: {
-        ok: boolean;
-        cases: number;
-    };
-}
-/** One security-health model shared by `doctor` and its legacy alias. */
-export declare function collectSecurityDoctorReport(companyId?: string): SecurityDoctorReport;
-/** Convert security health into the same compact rows used by core doctor. */
-export declare function securityDoctorChecks(report: SecurityDoctorReport): SecurityDoctorCheck[];

package/dist/securityFeature.d.ts

@@ -1,5 +0,0 @@
-export interface AgentSecurityEntitlement {
-    agentSecurityEnabled?: boolean;
-}
-/** Security is opt-in per company. Missing/stale entitlement data is dormant. */
-export declare function isAgentSecurityEnabled(config: AgentSecurityEntitlement | null | undefined): boolean;