comisai 1.0.44 → 1.0.46

package/node_modules/@comis/cli/dist/support-bundle/triage.js

@@ -0,0 +1,313 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Pure triage reducer for the support bundle — the one genuinely new piece of
+ * logic behind the machine-readable verdict.
+ *
+ * `buildSupportTriage(inputs)` folds a content-free `DoctorResult` (plus the
+ * optional fleet/explain digests) into the deterministic `SupportTriage`
+ * verdict. It performs no I/O, holds no clock, and calls no model — every read
+ * happens in the caller and is passed in, so the same input always yields a
+ * deeply-equal result (the machine-verdict contract).
+ *
+ * Two ordering contracts are load-bearing:
+ *  - Signals are keyed on each finding's `category` + `status` (with the
+ *    `check` label splitting the config sub-cases), never on a check id: the id
+ *    is absent from the findings a reducer receives, so keying on it would
+ *    silently yield an empty signal set on a broken install.
+ *  - Status precedence is ordered first-match-wins, with `insufficient_evidence`
+ *    ranked above `healthy` so an empty or offline read is never reported
+ *    healthy.
+ *
+ * @module
+ */
+// --- signal derivation -----------------------------------------------------
+/**
+ * Map one finding to its signal, or `undefined` when it carries none (passes,
+ * skips, benign warns). The config fail sub-cases split on the `check` label:
+ * "Config file parseable" is a corrupt/unreadable file; any other config fail
+ * is a missing one.
+ */
+function signalForFinding(f) {
+    if (f.category === "config" && f.status === "fail") {
+        return f.check === "Config file parseable" ? "config_corrupt" : "config_missing";
+    }
+    if (f.category === "config" && f.status === "warn" && f.check === "Config schema validation") {
+        return "config_schema_invalid";
+    }
+    if (f.category === "daemon" && f.status === "warn") {
+        return "daemon_down";
+    }
+    if (f.category === "daemon" && f.status === "fail") {
+        return "daemon_stale_pid";
+    }
+    if (f.category === "gateway" && f.status === "fail") {
+        return "gateway_unreachable";
+    }
+    // Any other failing category (oauth / version / channels / workspace /
+    // secrets-audit / lcd) surfaces its category label verbatim.
+    if (f.status === "fail") {
+        return f.category;
+    }
+    return undefined;
+}
+/** Distinct active signals from a doctor result, order-stable (first seen wins). */
+export function deriveDoctorSignals(doctor) {
+    const seen = new Set();
+    const signals = [];
+    for (const f of doctor.findings) {
+        const signal = signalForFinding(f);
+        if (signal !== undefined && !seen.has(signal)) {
+            seen.add(signal);
+            signals.push(signal);
+        }
+    }
+    return signals;
+}
+/**
+ * Fleet-sourced signals, consumed verbatim — every `finding.code` plus the
+ * report's own `likelyRootCause.code` when it made a verdict. The reducer
+ * forwards the fleet's short codes as-is (no curated allow-list, no threshold
+ * re-derivation): the fleet owns its verdict, so a new finding code surfaces
+ * without a change here. Order follows the report (findings, then the root
+ * cause); the caller dedupes into the active-signal set.
+ */
+export function deriveFleetSignals(fleet) {
+    const codes = fleet.findings.map((f) => f.code);
+    if (fleet.likelyRootCause !== null) {
+        codes.push(fleet.likelyRootCause.code);
+    }
+    return codes;
+}
+/**
+ * Explain-sourced signal, consumed verbatim — the embedded report's
+ * `likelyRootCause.code` when it made a verdict, and nothing otherwise. Like the
+ * fleet root-cause append, the reducer forwards the code as-is (no curated
+ * allow-list, no re-derivation): the explain assembler owns the verdict, so a
+ * new root-cause code surfaces without a change here. The caller dedupes it into
+ * the active-signal set after the doctor and fleet signals.
+ */
+export function deriveExplainSignals(explain) {
+    return explain.likelyRootCause != null ? [explain.likelyRootCause.code] : [];
+}
+/**
+ * Whether a fleet report carries positive operator evidence — at least one real
+ * session or one diagnostic finding. Evidence is keyed on the
+ * synthetic-EXCLUDED population (matching `sessions.total`), NOT on the
+ * `coverage.sessionSummary.found` read breadcrumb: that flag is
+ * synthetic-INCLUSIVE (`rows > 0` over the pre-exclusion row set), so a window
+ * holding only synthetic/test rows would otherwise be mistaken for evidence and
+ * let a thrown doctor run (zero passes) fall through to a false `healthy`. An
+ * absent report (offline read, no fleet at all), a synthetic-only window, or a
+ * coverage-empty one is treated as no evidence, so the status rules never
+ * report `healthy` off a fleet that carries no real activity.
+ */
+export function fleetHasEvidence(fleet) {
+    return fleet !== undefined && (fleet.sessions.total > 0 || fleet.findings.length > 0);
+}
+/**
+ * Content-free summary of the doctor aggregate. Counts are copied verbatim from
+ * the `DoctorResult` (never recomputed); `failing` is the distinct set of
+ * failing finding categories — the only per-check identity a pure reducer holds.
+ */
+export function buildDoctorSummary(doctor) {
+    const failing = [
+        ...new Set(doctor.findings.filter((f) => f.status === "fail").map((f) => f.category)),
+    ];
+    return {
+        checksRun: doctor.checksRun,
+        pass: doctor.passCount,
+        warn: doctor.warnCount,
+        fail: doctor.failCount,
+        skip: doctor.skipCount,
+        repairable: doctor.repairableCount,
+        failing,
+    };
+}
+/**
+ * Content-free summary of the fleet aggregate — the five fields copied verbatim
+ * from the `FleetHealthReport` (never recomputed). `degradedRate` and the root
+ * `topErrorKinds`/`breakerTripTotal` are consumed as-is, `findingCodes` is the
+ * finding codes in report order, and `likelyRootCause` collapses the report's
+ * nullable verdict object to its code (or `null`).
+ */
+export function buildFleetSummary(fleet) {
+    return {
+        degradedRate: fleet.sessions.degradedRate,
+        topErrorKinds: fleet.topErrorKinds.map((e) => ({ kind: e.kind, count: e.count })),
+        breakerTripTotal: fleet.breakerTripTotal,
+        findingCodes: fleet.findings.map((f) => f.code),
+        likelyRootCause: fleet.likelyRootCause !== null ? fleet.likelyRootCause.code : null,
+    };
+}
+/**
+ * Content-free summary of the embedded incident report — the three fields copied
+ * verbatim from the `IncidentReport` (never recomputed). `degraded` and
+ * `endReason` are consumed as-is from the report's outcome, and `likelyRootCause`
+ * collapses the report's nullable verdict object to its code (or `null`).
+ */
+export function buildExplainSummary(explain) {
+    return {
+        degraded: explain.outcome.degraded,
+        endReason: explain.outcome.endReason,
+        likelyRootCause: explain.likelyRootCause?.code ?? null,
+    };
+}
+/**
+ * Ordered, first-match-wins status rules — the precedence contract. The array
+ * order is load-bearing: a config failure outranks every other signal, and
+ * `insufficient_evidence` is evaluated before the `healthy` fallthrough so an
+ * empty read is never reported healthy.
+ */
+const STATUS_RULES = [
+    // 1. Any config-health failure -> misconfigured (outranks everything else).
+    (ctx) => ctx.doctor.findings.some((f) => f.category === "config" && f.status === "fail")
+        ? "misconfigured"
+        : null,
+    // 2. Any other failure, a down daemon, or an upstream degraded / root-caused
+    //    verdict -> degraded.
+    (ctx) => ctx.doctor.findings.some((f) => f.status === "fail") ||
+        ctx.signals.includes("daemon_down") ||
+        ctx.fleet?.likelyRootCause != null ||
+        ctx.explain?.outcome?.degraded === true
+        ? "degraded"
+        : null,
+    // 3. No positive evidence anywhere -> insufficient_evidence (ranked ABOVE
+    //    healthy so an empty or offline read is never reported healthy). The
+    //    fleet is now always passed, so an absent OR coverage-empty fleet both
+    //    count as no evidence — never re-derive a fleet threshold here.
+    (ctx) => ctx.doctor.passCount === 0 && !fleetHasEvidence(ctx.fleet) && ctx.explain === undefined
+        ? "insufficient_evidence"
+        : null,
+    // 4. Otherwise the read is positive and clean -> healthy.
+    () => "healthy",
+];
+function deriveStatus(ctx) {
+    for (const rule of STATUS_RULES) {
+        const status = rule(ctx);
+        if (status !== null) {
+            return status;
+        }
+    }
+    return "healthy";
+}
+// --- next steps (reused; never a parallel remediation table) ---------------
+const REPAIR_COMMAND = "comis doctor --repair";
+const INIT_COMMAND = "comis init";
+const MAX_NEXT_STEPS = 8;
+/** Content-free follow-up commands for a maintainer drilling into the daemon. */
+const MAINTAINER_NEXT_STEPS = [
+    "comis fleet --since 24",
+    'comis explain "<sessionKey>"',
+];
+function dedupeCap(items, cap) {
+    const seen = new Set();
+    const out = [];
+    for (const item of items) {
+        if (seen.has(item)) {
+            continue;
+        }
+        seen.add(item);
+        out.push(item);
+        if (out.length >= cap) {
+            break;
+        }
+    }
+    return out;
+}
+/**
+ * Reporter next steps REUSE each present `finding.suggestion` plus the two
+ * standing repair commands — never a hand-authored remediation catalog. The
+ * repair hint is added when the doctor found anything auto-repairable, and the
+ * init hint when the config is missing.
+ */
+function buildReporterNextSteps(doctor, signals) {
+    const steps = [];
+    for (const f of doctor.findings) {
+        if (f.suggestion !== undefined && f.suggestion.length > 0) {
+            steps.push(f.suggestion);
+        }
+    }
+    if (doctor.repairableCount > 0) {
+        steps.push(REPAIR_COMMAND);
+    }
+    if (signals.includes("config_missing")) {
+        steps.push(INIT_COMMAND);
+    }
+    return dedupeCap(steps, MAX_NEXT_STEPS);
+}
+// --- evidence + privacy ----------------------------------------------------
+/**
+ * The bundle's allowlisted output files, in writer order (manifest last), each
+ * with a content-free description. `explain.json` is present only under
+ * `--session` and is filtered out of the index otherwise; `audit-summary.json`
+ * is attempted on every run and omitted only on an unreadable store (exactly
+ * like `fleet.json`/`config-posture.json`).
+ */
+const EVIDENCE_FILES = [
+    { path: "issue-summary.md", description: "Human-readable triage summary for a bug report" },
+    {
+        path: "ai-issue-draft.md",
+        description: "AI-fillable GitHub issue draft with the auto-known facts pre-filled",
+    },
+    { path: "triage.json", description: "Machine-readable triage verdict" },
+    { path: "doctor.json", description: "Full diagnostic findings from the health checks" },
+    { path: "fleet.json", description: "Cross-session fleet health digest (counts and short codes)" },
+    {
+        path: "config-posture.json",
+        description: "Which config sections are present, plus flagged-key labels",
+    },
+    {
+        path: "explain.json",
+        description: "Per-session incident digest, present with --session",
+    },
+    {
+        path: "audit-summary.json",
+        description: "Window-scoped audit event counts by kind, omitted when the store is unreadable",
+    },
+    {
+        path: "manifest.json",
+        description: "Bundle index with the redaction fingerprint and any warnings",
+    },
+];
+/** The enumerated exclusion set every downstream render and writer honors. */
+const PRIVACY_EXCLUDES = [
+    "secrets",
+    "raw-config-values",
+    "message-bodies",
+    "file-contents",
+    ".env",
+];
+// --- reducer ---------------------------------------------------------------
+/**
+ * Fold the inputs into the deterministic triage verdict. Pure: no I/O, no
+ * clock, no model. `generatedAt` is deliberately NOT stamped here — it lives
+ * only on the bundle manifest so this verdict stays timestamp-free and
+ * byte-stable across runs.
+ */
+export function buildSupportTriage(inputs) {
+    const { host, doctor, fleet, explain } = inputs;
+    // Doctor signals first, then fleet, then explain, deduped first-seen-wins: a
+    // later code that repeats an earlier signal keeps the earlier entry's slot.
+    const activeSignals = [
+        ...new Set([
+            ...deriveDoctorSignals(doctor),
+            ...(fleet !== undefined ? deriveFleetSignals(fleet) : []),
+            ...(explain !== undefined ? deriveExplainSignals(explain) : []),
+        ]),
+    ];
+    return {
+        schemaVersion: 1,
+        status: deriveStatus({ doctor, signals: activeSignals, fleet, explain }),
+        activeSignals,
+        host,
+        doctorSummary: buildDoctorSummary(doctor),
+        ...(fleet !== undefined ? { fleetSummary: buildFleetSummary(fleet) } : {}),
+        ...(explain !== undefined ? { explainSummary: buildExplainSummary(explain) } : {}),
+        reporterNextSteps: buildReporterNextSteps(doctor, activeSignals),
+        maintainerNextSteps: [...MAINTAINER_NEXT_STEPS],
+        // explain.json is written only under --session; drop it from the index when
+        // no session was embedded. Every other file is attempted on every run.
+        evidenceFiles: EVIDENCE_FILES.filter((file) => file.path !== "explain.json" || explain !== undefined).map((file) => ({ path: file.path, description: file.description })),
+        privacy: { redaction: "platform-aware-v1", excludes: [...PRIVACY_EXCLUDES] },
+    };
+}

package/node_modules/@comis/cli/dist/support-bundle/types.d.ts

@@ -0,0 +1,241 @@
+/**
+ * Schema module for the support bundle — the contract every other part of the
+ * bundle reads and writes against.
+ *
+ * `HostSnapshot`, `SupportTriage`, and `SupportBundleWarning` are declared as
+ * `z.strictObject` schemas paired with `z.infer` types and a `parseX()` helper
+ * returning `Result<T, z.ZodError>`. A later reader parses a possibly-corrupt
+ * `triage.json` back into typed objects, so the schema is the trust boundary:
+ * `strictObject` rejects any unknown key, `z.literal` pins `schemaVersion`, and
+ * `z.enum` closes the `status` set — so a drifted or forged artifact fails to
+ * parse rather than flowing through as a partially-typed object.
+ *
+ * @module
+ */
+import { type Result } from "@comis/shared";
+import { z } from "zod";
+/**
+ * Content-free host/install facts. Deliberately omits hostname, environment
+ * values, and repository state so no host-enumerating field can be added
+ * silently — `strictObject` forbids anything outside this set. `cliVersion`
+ * and `daemonVersion` are optional: the shared version reader may return
+ * undefined and the daemon build version is only known when the daemon is up.
+ */
+export declare const HostSnapshotSchema: z.ZodObject<{
+    cliVersion: z.ZodOptional<z.ZodString>;
+    daemonVersion: z.ZodOptional<z.ZodString>;
+    nodeVersion: z.ZodString;
+    platform: z.ZodString;
+    arch: z.ZodString;
+}, z.core.$strict>;
+export type HostSnapshot = z.infer<typeof HostSnapshotSchema>;
+/**
+ * A recoverable, section-level failure recorded on the bundle manifest so a
+ * partial bundle is still generated (the section that failed is annotated
+ * rather than aborting the whole run). `source` is the closed set of bundle
+ * sections that can fail — the doctor run, the host snapshot, the file writer,
+ * the fleet report, the config-posture digest, the embedded explain report, the
+ * audit-summary read, or the trace-export bundle; `code` is the section-failure
+ * identifier; `rows` carries offending indices when applicable.
+ */
+export declare const SupportBundleWarningSchema: z.ZodObject<{
+    source: z.ZodEnum<{
+        audit: "audit";
+        host: "host";
+        doctor: "doctor";
+        writer: "writer";
+        fleet: "fleet";
+        "config-posture": "config-posture";
+        explain: "explain";
+        "trace-export": "trace-export";
+    }>;
+    code: z.ZodString;
+    count: z.ZodNumber;
+    rows: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    message: z.ZodString;
+}, z.core.$strict>;
+export type SupportBundleWarning = z.infer<typeof SupportBundleWarningSchema>;
+/**
+ * The closed triage verdict set. `insufficient_evidence` exists so an empty or
+ * offline read never reports `healthy` — the reducer ranks it above `healthy`.
+ */
+export declare const SupportTriageStatusSchema: z.ZodEnum<{
+    healthy: "healthy";
+    degraded: "degraded";
+    misconfigured: "misconfigured";
+    insufficient_evidence: "insufficient_evidence";
+}>;
+export type SupportTriageStatus = z.infer<typeof SupportTriageStatusSchema>;
+/**
+ * The deterministic triage verdict — the machine-readable core of the bundle.
+ *
+ * `schemaVersion` is the literal 1 and `status` is the closed four-value set,
+ * so a version-drifted or out-of-set artifact fails `parseSupportTriage`.
+ * `fleetSummary` and `explainSummary` are optional and always omitted here;
+ * they are declared now so later enrichment can populate them without a
+ * schema-version bump. `doctorSummary.failing` holds the distinct failing
+ * check categories (the pure reducer only ever holds category labels, not
+ * per-check ids).
+ */
+export declare const SupportTriageSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    status: z.ZodEnum<{
+        healthy: "healthy";
+        degraded: "degraded";
+        misconfigured: "misconfigured";
+        insufficient_evidence: "insufficient_evidence";
+    }>;
+    activeSignals: z.ZodArray<z.ZodString>;
+    host: z.ZodObject<{
+        cliVersion: z.ZodOptional<z.ZodString>;
+        daemonVersion: z.ZodOptional<z.ZodString>;
+        nodeVersion: z.ZodString;
+        platform: z.ZodString;
+        arch: z.ZodString;
+    }, z.core.$strict>;
+    doctorSummary: z.ZodObject<{
+        checksRun: z.ZodNumber;
+        pass: z.ZodNumber;
+        warn: z.ZodNumber;
+        fail: z.ZodNumber;
+        skip: z.ZodNumber;
+        repairable: z.ZodNumber;
+        failing: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    fleetSummary: z.ZodOptional<z.ZodObject<{
+        degradedRate: z.ZodNumber;
+        topErrorKinds: z.ZodArray<z.ZodObject<{
+            kind: z.ZodString;
+            count: z.ZodNumber;
+        }, z.core.$strict>>;
+        breakerTripTotal: z.ZodNumber;
+        findingCodes: z.ZodArray<z.ZodString>;
+        likelyRootCause: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    explainSummary: z.ZodOptional<z.ZodObject<{
+        degraded: z.ZodBoolean;
+        endReason: z.ZodString;
+        likelyRootCause: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    reporterNextSteps: z.ZodArray<z.ZodString>;
+    maintainerNextSteps: z.ZodArray<z.ZodString>;
+    evidenceFiles: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        description: z.ZodString;
+    }, z.core.$strict>>;
+    privacy: z.ZodObject<{
+        redaction: z.ZodLiteral<"platform-aware-v1">;
+        excludes: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type SupportTriage = z.infer<typeof SupportTriageSchema>;
+/**
+ * Parse unknown input into a SupportTriage, returning `Result<T, z.ZodError>`.
+ *
+ * Wraps `safeParse` so call sites chain by early-return and never touch
+ * `.parse()` (which throws). A malformed artifact — an unknown key, an
+ * out-of-set status, or a version other than 1 — returns `err`.
+ */
+export declare function parseSupportTriage(raw: unknown): Result<SupportTriage, z.ZodError>;
+/**
+ * The config-posture digest written as `config-posture.json`.
+ *
+ * Content-free by construction. `sections` is the set of top-level config
+ * section NAMES the raw config file wrote (each a member of the fixed
+ * AppConfigSchema universe) — a category structurally incapable of holding a
+ * config value. `configPosture` is the fleet `config_posture` finding copied
+ * verbatim: its `detail` carries closed name+state labels (e.g.
+ * `gateway.tls (off)`) and a stranded-secret COUNT, never a secret value, and
+ * it is null when no such finding fired. `schemaVersion` is the literal 1 and
+ * the object is strict, so a drifted or forged digest fails
+ * `parseConfigPosture` rather than flowing through as a partially-typed object.
+ */
+export declare const ConfigPostureDigestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    sections: z.ZodArray<z.ZodString>;
+    configPosture: z.ZodNullable<z.ZodObject<{
+        detail: z.ZodString;
+        count: z.ZodNumber;
+        hint: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConfigPostureDigest = z.infer<typeof ConfigPostureDigestSchema>;
+/**
+ * Parse unknown input into a ConfigPostureDigest, returning
+ * `Result<T, z.ZodError>`. An unknown key, a version other than 1, or a
+ * malformed posture finding returns `err`.
+ */
+export declare function parseConfigPosture(raw: unknown): Result<ConfigPostureDigest, z.ZodError>;
+/**
+ * The audit-summary digest written as `audit-summary.json`.
+ *
+ * Content-free by construction: `total` is how many audit events the window
+ * read returned, and `byKind` maps each closed audit-kind label to its count —
+ * counts and closed kind labels only, never an audit action, actor, or `refs`
+ * value. `byKind` stays a `z.record(z.string(), z.number())` to mirror the
+ * upstream incident report's `audit` shape (the kind keys are the fixed
+ * AuditKind universe at runtime). `capped` marks a window read that hit the
+ * store's row ceiling, so `total` is a lower bound rather than the true window
+ * count. `schemaVersion` is the literal 1 and the object is strict, so a drifted
+ * or forged digest fails `parseAuditSummary` rather than flowing through as a
+ * partially-typed object.
+ */
+export declare const AuditSummarySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    total: z.ZodNumber;
+    byKind: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    capped: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type AuditSummary = z.infer<typeof AuditSummarySchema>;
+/**
+ * Parse unknown input into an AuditSummary, returning `Result<T, z.ZodError>`.
+ * An unknown key, a version other than 1, or a non-number `byKind` value
+ * returns `err`.
+ */
+export declare function parseAuditSummary(raw: unknown): Result<AuditSummary, z.ZodError>;
+/**
+ * The bundle manifest — the top-level index written as `manifest.json`.
+ *
+ * `redaction.policy` is the platform-aware fingerprint recorded so a reader
+ * can confirm which redaction pass produced the bundle; `privacy` enumerates
+ * the machine-readable exclusion set every writer honors. `warnings` is
+ * optional and holds recoverable, section-level failures so a partial bundle
+ * still carries an honest record of what could not be produced. `generatedAt`
+ * is caller-stamped (ISO 8601), keeping the reducer that builds the triage
+ * pure and timestamp-free.
+ */
+export declare const SupportBundleManifestSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    bundle: z.ZodString;
+    generatedAt: z.ZodString;
+    redaction: z.ZodObject<{
+        policy: z.ZodLiteral<"platform-aware-v1">;
+    }, z.core.$strict>;
+    privacy: z.ZodObject<{
+        redaction: z.ZodLiteral<"platform-aware-v1">;
+        excludes: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    warnings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodEnum<{
+            audit: "audit";
+            host: "host";
+            doctor: "doctor";
+            writer: "writer";
+            fleet: "fleet";
+            "config-posture": "config-posture";
+            explain: "explain";
+            "trace-export": "trace-export";
+        }>;
+        code: z.ZodString;
+        count: z.ZodNumber;
+        rows: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        message: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type SupportBundleManifest = z.infer<typeof SupportBundleManifestSchema>;
+/**
+ * Parse unknown input into a SupportBundleManifest, returning
+ * `Result<T, z.ZodError>`. A drifted redaction policy, an unknown key, or a
+ * version other than 1 returns `err`.
+ */
+export declare function parseSupportBundleManifest(raw: unknown): Result<SupportBundleManifest, z.ZodError>;