open-multi-agent-kit 0.79.3 → 0.80.2

package/dist/runtime/data-retention-gate.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Freedomd data-retention gate.
+ *
+ * Decides whether a task's prompt, attachments, and relevant files may be sent
+ * to a provider given its retention profile and the org/user policy. The gate
+ * returns one of {allow, redact, downgrade, block} and never leaks secret-like
+ * spans to a retained provider.
+ */
+import type { AgentRuntime, AgentTask } from "./agent-runtime.js";
+import type { ProviderSovereigntyProfile } from "./provider-sovereignty.js";
+export type DataBoundary = "public" | "internal" | "customer" | "secret";
+export type RetentionDecision = "allow" | "redact" | "downgrade" | "block";
+export interface DataSensitivity {
+    readonly boundary: DataBoundary;
+    readonly containsSecret: boolean;
+    readonly containsCustomerData: boolean;
+    readonly sensitiveSpans: readonly string[];
+}
+export interface ProviderRetentionProfile {
+    readonly retentionDays: number;
+    readonly zeroDataRetention: boolean;
+    readonly trainingUse: boolean;
+    readonly auditAccessUnknown: boolean;
+}
+export interface DataRetentionGateInput {
+    readonly task: AgentTask;
+    readonly runtime: AgentRuntime;
+    readonly providerProfile: ProviderSovereigntyProfile;
+    readonly orgMaxRetentionDays: number;
+    readonly allowRedaction: boolean;
+    readonly relevantFiles?: readonly string[];
+}
+export interface DataRetentionGateResult {
+    readonly decision: RetentionDecision;
+    readonly reason: string;
+    readonly sensitivity: DataSensitivity;
+    readonly redactedSpans?: readonly string[];
+    readonly downgradeMode?: "local-only-or-zdr-provider" | "read-only-local-review";
+}
+export declare function classifyDataSensitivity(task: AgentTask, relevantFiles?: readonly string[]): DataSensitivity;
+export declare function providerRetentionProfileFromSovereignty(profile: ProviderSovereigntyProfile): ProviderRetentionProfile;
+export declare function evaluateDataRetentionGate(input: DataRetentionGateInput): DataRetentionGateResult;

package/dist/runtime/data-retention-gate.js

@@ -0,0 +1,123 @@
+/**
+ * Freedomd data-retention gate.
+ *
+ * Decides whether a task's prompt, attachments, and relevant files may be sent
+ * to a provider given its retention profile and the org/user policy. The gate
+ * returns one of {allow, redact, downgrade, block} and never leaks secret-like
+ * spans to a retained provider.
+ */
+import { maskSensitiveText } from "../util/secret-mask.js";
+import { runtimeProviderId, runtimeModeOf } from "./authority-matrix.js";
+const SECRET_KEYWORDS = [
+    "password", "secret", "token", "api_key", "apikey", "private_key",
+    "credential", "bearer", "authorization", "session", "cookie",
+];
+const CUSTOMER_DATA_KEYWORDS = [
+    "customer", "user_id", "email", "phone", "ssn", "personal",
+    "gdpr", "hipaa", "pci", "pii",
+];
+function boundaryForRisk(risk) {
+    if (risk === "shell" || risk === "merge")
+        return "secret";
+    if (risk === "write" || risk === "patch")
+        return "internal";
+    return "public";
+}
+function classifyTextSensitivity(text) {
+    const lower = text.toLowerCase();
+    const sensitiveSpans = [];
+    let containsSecret = false;
+    let containsCustomerData = false;
+    for (const keyword of SECRET_KEYWORDS) {
+        if (lower.includes(keyword)) {
+            containsSecret = true;
+            sensitiveSpans.push(`keyword:${keyword}`);
+        }
+    }
+    for (const keyword of CUSTOMER_DATA_KEYWORDS) {
+        if (lower.includes(keyword)) {
+            containsCustomerData = true;
+            sensitiveSpans.push(`keyword:${keyword}`);
+        }
+    }
+    const masked = maskSensitiveText(text);
+    if (masked !== text) {
+        containsSecret = true;
+        sensitiveSpans.push("pattern:secret-like");
+    }
+    return { containsSecret, containsCustomerData, sensitiveSpans: [...new Set(sensitiveSpans)] };
+}
+export function classifyDataSensitivity(task, relevantFiles) {
+    const text = [
+        task.prompt,
+        task.context.goal ?? "",
+        task.context.system ?? "",
+        ...(task.attachments ?? []).map((a) => a.name),
+        ...(relevantFiles ?? []),
+    ].join("\n");
+    const classified = classifyTextSensitivity(text);
+    const boundary = boundaryForRisk(task.safety?.risk);
+    return {
+        boundary,
+        containsSecret: classified.containsSecret,
+        containsCustomerData: classified.containsCustomerData,
+        sensitiveSpans: classified.sensitiveSpans,
+    };
+}
+export function providerRetentionProfileFromSovereignty(profile) {
+    return {
+        retentionDays: profile.retentionDays,
+        zeroDataRetention: profile.zeroDataRetention,
+        trainingUse: profile.trainingUse,
+        auditAccessUnknown: !profile.zeroDataRetention && profile.retentionDays > 0,
+    };
+}
+export function evaluateDataRetentionGate(input) {
+    const { task, runtime, providerProfile, orgMaxRetentionDays, allowRedaction } = input;
+    const sensitivity = classifyDataSensitivity(task, input.relevantFiles);
+    if (sensitivity.containsSecret) {
+        return {
+            decision: "block",
+            reason: "secret-like data cannot be sent to retained provider",
+            sensitivity,
+        };
+    }
+    const retention = providerRetentionProfileFromSovereignty(providerProfile);
+    if (sensitivity.containsCustomerData && !retention.zeroDataRetention) {
+        if (allowRedaction) {
+            return {
+                decision: "redact",
+                reason: `customer data redacted before sending to ${runtimeProviderId(runtime)}:${runtimeModeOf(runtime)}`,
+                sensitivity,
+                redactedSpans: sensitivity.sensitiveSpans,
+            };
+        }
+        return {
+            decision: "downgrade",
+            reason: "customer data with non-zero retention provider; downgrade required",
+            sensitivity,
+            downgradeMode: "local-only-or-zdr-provider",
+        };
+    }
+    if (retention.retentionDays > orgMaxRetentionDays) {
+        return {
+            decision: "block",
+            reason: `provider retention ${retention.retentionDays}d exceeds policy ${orgMaxRetentionDays}d`,
+            sensitivity,
+        };
+    }
+    const risk = task.safety?.risk;
+    if ((risk === "write" || risk === "shell" || risk === "merge") && retention.auditAccessUnknown) {
+        return {
+            decision: "downgrade",
+            reason: "high-risk task with unclear retention/audit boundary",
+            sensitivity,
+            downgradeMode: "read-only-local-review",
+        };
+    }
+    return {
+        decision: "allow",
+        reason: "retention policy acceptable for data boundary",
+        sensitivity,
+    };
+}

package/dist/runtime/deepseek-runtime.d.ts

@@ -5,6 +5,7 @@
  * Supports SSE streaming, tool calling, and reasoning_content.
  */
 import type { AgentRuntime, AgentRunResult, AgentResult, AgentTask, RuntimeCapabilities, RuntimeHealth } from "./agent-runtime.js";
+import type { RuntimeHealthProbeRequest } from "./contracts/shared.js";
 import type { ContextCapsule } from "./context-capsule.js";
 export interface DeepSeekRuntimeOptions {
     apiKey?: string;
@@ -13,6 +14,9 @@ export interface DeepSeekRuntimeOptions {
 }
 export declare class DeepSeekRuntime implements AgentRuntime {
     readonly id = "deepseek-api";
+    readonly providerId = "deepseek";
+    readonly advisory = true;
+    readonly runtimeMode = "api";
     readonly kind = "api";
     readonly priority = 40;
     readonly capabilities: RuntimeCapabilities;
@@ -21,7 +25,7 @@ export declare class DeepSeekRuntime implements AgentRuntime {
     private readonly baseUrl;
     constructor(options?: DeepSeekRuntimeOptions);
     supports(capsule: ContextCapsule): boolean;
-    health(): Promise<RuntimeHealth>;
+    health(input?: RuntimeHealthProbeRequest): Promise<RuntimeHealth>;
     runNode(capsule: ContextCapsule, signal: AbortSignal): Promise<AgentRunResult>;
     execute(task: AgentTask): Promise<AgentResult>;
     private parseStreamResponse;

package/dist/runtime/deepseek-runtime.js

@@ -6,8 +6,12 @@
  */
 import { capsuleToTask } from "./context-broker-converter.js";
 import { buildProviderToolPayload } from "./provider-tool-contracts.js";
+import { probeOpenAiCompatibleModels } from "./runtime-health-probes.js";
 export class DeepSeekRuntime {
     id = "deepseek-api";
+    providerId = "deepseek";
+    advisory = true;
+    runtimeMode = "api";
     kind = "api";
     priority = 40;
     capabilities = {
@@ -42,14 +46,16 @@ export class DeepSeekRuntime {
             return false;
         return true;
     }
-    async health() {
-        const available = Boolean(this.apiKey);
-        return {
+    async health(input = { probeKind: "static", highRisk: false }) {
+        return probeOpenAiCompatibleModels({
             runtimeId: this.id,
-            available,
-            reason: available ? undefined : "DEEPSEEK_API_KEY is not set",
-            checkedAt: new Date().toISOString(),
-        };
+            baseUrl: this.baseUrl,
+            apiKey: this.apiKey,
+            apiKeyName: "DEEPSEEK_API_KEY",
+            model: this.model,
+            providerName: "DeepSeek",
+            probeKind: input.probeKind,
+        });
     }
     async runNode(capsule, signal) {
         try {

package/dist/runtime/external-cli-adapter.js

@@ -5,14 +5,17 @@
 import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { checkCommand, } from "../util/shell.js";
+import { checkCommand, runShell, } from "../util/shell.js";
 import { runtimeMetadataEnv } from "./child-env.js";
 import { runProcessSession } from "./process-session.js";
 import { createRuntimeSandboxProfile } from "./sandbox-profile.js";
+import { staticRuntimeHealth } from "./runtime-health-probes.js";
 export function createExternalCliAdapter(options) {
     let pendingOnOutput;
     return {
         id: options.id,
+        providerId: options.id.split("-")[0],
+        runtimeMode: "cli",
         displayName: options.displayName,
         kind: "cli",
         priority: options.priority,
@@ -20,14 +23,24 @@ export function createExternalCliAdapter(options) {
         supports(capsule) {
             return runtimeCapabilitiesSupportCapsule(options.capabilities, capsule);
         },
-        async health() {
-            const available = await checkCommand(options.bin);
-            return {
+        async health(input = { probeKind: "static", highRisk: false }) {
+            const started = Date.now();
+            const available = input.probeKind === "static"
+                ? await checkCommand(options.bin)
+                : (await runShell(options.bin, ["--version"], { cwd: options.cwd ?? process.cwd(), timeout: 5000 }).catch(() => ({ exitCode: 1 }))).exitCode === 0;
+            return staticRuntimeHealth({
                 runtimeId: options.id,
                 available,
-                reason: available ? undefined : `Command not found: ${options.bin}`,
-                checkedAt: new Date().toISOString(),
-            };
+                reason: available ? undefined : `Command not found or failed --version probe: ${options.bin}`,
+                runtimeOk: available,
+                authOk: available,
+                modelOk: true,
+                quotaOk: true,
+                rateLimitOk: true,
+                latencyMs: input.probeKind === "static" ? undefined : Date.now() - started,
+                probeKind: input.probeKind,
+                ttlMs: input.probeKind === "static" ? 60_000 : 30_000,
+            });
         },
         async execute(task) {
             pendingOnOutput = task.context.onOutput;

package/dist/runtime/freedomd-evidence-envelope.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Local-first evidence envelope for Freedomd.
+ *
+ * Provider responses and evidence observations are persisted outside the
+ * provider runtime so that runs remain replayable and auditable even when a
+ * provider becomes unavailable or changes policy.
+ */
+import type { AgentRuntime, AgentRunResult, AgentTask, AgentTaskSovereignty } from "./agent-runtime.js";
+import type { EvidenceObservation, EvidenceRequirement } from "./contracts/evidence.js";
+import type { LocalGraphMemoryStore } from "../memory/local-graph-memory-store.js";
+export interface EvidenceEnvelopeArtifact {
+    readonly path: string;
+    readonly sha256: string;
+    readonly sizeBytes: number;
+    readonly redacted: boolean;
+    readonly replayable: boolean;
+}
+export interface EvidenceEnvelopeObservation {
+    readonly kind: string;
+    readonly verdict: "pass" | "fail" | "partial" | "pending";
+    readonly artifactRef?: string;
+    readonly sha256?: string;
+    readonly replayable: boolean;
+    readonly redacted: boolean;
+    readonly confidence: number;
+    readonly timestamp: string;
+}
+export interface FreedomdEvidenceEnvelope {
+    schemaVersion: "omk.freedomd.evidence-envelope.v1";
+    runId: string;
+    nodeId: string;
+    taskHash: string;
+    selectedRuntime: string;
+    providerId: string;
+    runtimeMode: string;
+    sovereignty: AgentTaskSovereignty;
+    evidenceRequirements: readonly EvidenceRequirement[];
+    evidenceObservations: readonly EvidenceEnvelopeObservation[];
+    providerResponseRef?: string;
+    localArtifacts: readonly EvidenceEnvelopeArtifact[];
+    createdAt: string;
+}
+export interface BuildEvidenceEnvelopeOptions {
+    readonly task: AgentTask;
+    readonly selectedRuntime: AgentRuntime;
+    readonly runContext: {
+        readonly runId: string;
+        readonly nodeId: string;
+        readonly projectRoot?: string;
+    };
+    readonly evidenceObservations?: readonly EvidenceObservation[];
+    readonly providerResponse?: AgentRunResult;
+    readonly sovereignty: AgentTaskSovereignty;
+}
+export declare function hashTaskPrompt(prompt: string): string;
+export declare function buildLocalFirstEvidenceEnvelope(options: BuildEvidenceEnvelopeOptions): Promise<FreedomdEvidenceEnvelope>;
+export declare function materializeEvidenceEnvelopeInGraph(store: LocalGraphMemoryStore, envelope: FreedomdEvidenceEnvelope): Promise<void>;

package/dist/runtime/freedomd-evidence-envelope.js

@@ -0,0 +1,110 @@
+/**
+ * Local-first evidence envelope for Freedomd.
+ *
+ * Provider responses and evidence observations are persisted outside the
+ * provider runtime so that runs remain replayable and auditable even when a
+ * provider becomes unavailable or changes policy.
+ */
+import { mkdir, writeFile } from "fs/promises";
+import { dirname, join, resolve } from "path";
+import { sha256Hex } from "../util/hash.js";
+function envelopeDir(root, runId) {
+    return join(resolve(root), ".omk", "runs", runId, "freedomd");
+}
+function artifactPath(root, runId, nodeId, kind) {
+    const safeNodeId = nodeId.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join(envelopeDir(root, runId), `${safeNodeId}-${kind}.json`);
+}
+export function hashTaskPrompt(prompt) {
+    return sha256Hex(prompt);
+}
+async function persistArtifact(root, runId, nodeId, kind, payload) {
+    const path = artifactPath(root, runId, nodeId, kind);
+    await mkdir(dirname(path), { recursive: true });
+    const text = JSON.stringify(payload, null, 2);
+    await writeFile(path, text, "utf-8");
+    return {
+        path,
+        sha256: sha256Hex(text),
+        sizeBytes: Buffer.byteLength(text, "utf-8"),
+        redacted: false,
+        replayable: true,
+    };
+}
+export async function buildLocalFirstEvidenceEnvelope(options) {
+    const { task, selectedRuntime, runContext, evidenceObservations, providerResponse, sovereignty } = options;
+    const root = runContext.projectRoot ?? process.cwd();
+    const now = new Date().toISOString();
+    const localArtifacts = [];
+    const evidenceObservationList = [];
+    for (const observation of evidenceObservations ?? []) {
+        const artifact = await persistArtifact(root, runContext.runId, runContext.nodeId, `observation-${observation.kind}`, observation);
+        localArtifacts.push(artifact);
+        evidenceObservationList.push({
+            kind: observation.kind,
+            verdict: observation.confidence >= 0.8 ? "pass" : observation.confidence >= 0.4 ? "partial" : "fail",
+            artifactRef: artifact.path,
+            sha256: artifact.sha256,
+            replayable: observation.replayable,
+            redacted: observation.redacted,
+            confidence: observation.confidence,
+            timestamp: observation.timestamp,
+        });
+    }
+    if (providerResponse) {
+        const safeResponse = {
+            success: providerResponse.success,
+            exitCode: providerResponse.exitCode,
+            stdout: providerResponse.stdout,
+            stderr: providerResponse.stderr,
+            tokenUsage: providerResponse.tokenUsage,
+            metadata: providerResponse.metadata,
+        };
+        const artifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "provider-response", safeResponse);
+        localArtifacts.push(artifact);
+        const envelope = {
+            schemaVersion: "omk.freedomd.evidence-envelope.v1",
+            runId: runContext.runId,
+            nodeId: runContext.nodeId,
+            taskHash: hashTaskPrompt(task.prompt),
+            selectedRuntime: selectedRuntime.id,
+            providerId: selectedRuntime.providerId ?? selectedRuntime.id.split("-")[0] ?? selectedRuntime.id,
+            runtimeMode: selectedRuntime.runtimeMode,
+            sovereignty,
+            evidenceRequirements: [],
+            evidenceObservations: evidenceObservationList,
+            providerResponseRef: artifact.path,
+            localArtifacts,
+            createdAt: now,
+        };
+        const envelopeArtifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "evidence-envelope", envelope);
+        return {
+            ...envelope,
+            localArtifacts: [...localArtifacts, envelopeArtifact],
+        };
+    }
+    const envelope = {
+        schemaVersion: "omk.freedomd.evidence-envelope.v1",
+        runId: runContext.runId,
+        nodeId: runContext.nodeId,
+        taskHash: hashTaskPrompt(task.prompt),
+        selectedRuntime: selectedRuntime.id,
+        providerId: selectedRuntime.providerId ?? selectedRuntime.id.split("-")[0] ?? selectedRuntime.id,
+        runtimeMode: selectedRuntime.runtimeMode,
+        sovereignty,
+        evidenceRequirements: [],
+        evidenceObservations: evidenceObservationList,
+        localArtifacts,
+        createdAt: now,
+    };
+    const envelopeArtifact = await persistArtifact(root, runContext.runId, runContext.nodeId, "evidence-envelope", envelope);
+    return {
+        ...envelope,
+        localArtifacts: [...localArtifacts, envelopeArtifact],
+    };
+}
+export async function materializeEvidenceEnvelopeInGraph(store, envelope) {
+    const runId = envelope.runId;
+    const nodeId = envelope.nodeId;
+    await store.write(join(".omk", "runs", runId, "freedomd", `${nodeId}-evidence-envelope.json`), JSON.stringify(envelope, null, 2));
+}

package/dist/runtime/freedomd-exception.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Freedomd provider exception approval.
+ *
+ * Interactive approval flow for blocked providers. Records user decisions as
+ * local artifacts and graph nodes so every override is auditable.
+ */
+import type { LocalGraphMemoryStore } from "../memory/local-graph-memory-store.js";
+export type ProviderExceptionScope = "once" | "run" | "deny";
+export interface ProviderExceptionRequest {
+    readonly providerId: string;
+    readonly runtimeMode?: string;
+    readonly blockedReason: string;
+    readonly retentionDays: number;
+    readonly jurisdictionRisk: number;
+    readonly localFallbackAvailable: boolean;
+    readonly taskSensitivity: string;
+}
+export interface ProviderExceptionResult {
+    readonly decision: ProviderExceptionScope;
+    readonly reason: string;
+    readonly artifactPath?: string;
+    readonly policyOverridePath?: string;
+}
+export interface ProviderExceptionApproverOptions {
+    readonly runId: string;
+    readonly nodeId: string;
+    readonly projectRoot?: string;
+    readonly graphStore?: LocalGraphMemoryStore;
+    readonly isTty?: boolean;
+    readonly promptUser?: (message: string) => Promise<string>;
+}
+export declare function requestProviderException(request: ProviderExceptionRequest, options: ProviderExceptionApproverOptions): Promise<ProviderExceptionResult>;

package/dist/runtime/freedomd-exception.js

@@ -0,0 +1,95 @@
+/**
+ * Freedomd provider exception approval.
+ *
+ * Interactive approval flow for blocked providers. Records user decisions as
+ * local artifacts and graph nodes so every override is auditable.
+ */
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+export async function requestProviderException(request, options) {
+    const root = resolve(options.projectRoot ?? process.cwd());
+    if (options.isTty === false) {
+        return { decision: "deny", reason: "non-interactive provider exception denied" };
+    }
+    const summary = [
+        `Provider: ${request.providerId}${request.runtimeMode ? ` (${request.runtimeMode})` : ""}`,
+        `Blocked reason: ${request.blockedReason}`,
+        `Retention: ${request.retentionDays} days`,
+        `Jurisdiction risk: ${request.jurisdictionRisk.toFixed(2)}`,
+        `Local fallback available: ${request.localFallbackAvailable}`,
+        `Task sensitivity: ${request.taskSensitivity}`,
+    ].join("\n");
+    const choice = await (options.promptUser?.(summary) ?? Promise.resolve("deny"));
+    const normalized = choice.trim().toLowerCase();
+    if (normalized.startsWith("allow once")) {
+        const artifactPath = await writeExceptionArtifact(root, options.runId, options.nodeId, request, "once");
+        await materializeExceptionInGraph(options, request, "once", artifactPath);
+        return { decision: "once", reason: "user approved once", artifactPath };
+    }
+    if (normalized.startsWith("allow for run") || normalized.startsWith("allow run")) {
+        const artifactPath = await writeExceptionArtifact(root, options.runId, options.nodeId, request, "run");
+        const policyOverridePath = await writeRunPolicyOverride(root, options.runId, request);
+        await materializeExceptionInGraph(options, request, "run", artifactPath);
+        return { decision: "run", reason: "user approved for this run", artifactPath, policyOverridePath };
+    }
+    return { decision: "deny", reason: "user denied provider exception" };
+}
+async function writeExceptionArtifact(root, runId, nodeId, request, scope) {
+    const dir = join(root, ".omk", "runs", runId, "freedomd");
+    const path = join(dir, `${nodeId}-provider-exception.json`);
+    await mkdir(dirname(path), { recursive: true });
+    const payload = {
+        schemaVersion: "omk.freedomd.provider-exception.v1",
+        runId,
+        nodeId,
+        providerId: request.providerId,
+        runtimeMode: request.runtimeMode,
+        scope,
+        requestedAt: new Date().toISOString(),
+        request,
+    };
+    await writeFile(path, JSON.stringify(payload, null, 2), "utf-8");
+    return path;
+}
+async function writeRunPolicyOverride(root, runId, request) {
+    const dir = join(root, ".omk", "runs", runId, "freedomd");
+    const path = join(dir, "policy-overrides.json");
+    await mkdir(dirname(path), { recursive: true });
+    const payload = {
+        schemaVersion: "omk.freedomd.policy-overrides.v1",
+        runId,
+        providerOverrides: {
+            [request.providerId]: {
+                enabled: true,
+                reason: request.blockedReason,
+            },
+        },
+        createdAt: new Date().toISOString(),
+    };
+    await writeFile(path, JSON.stringify(payload, null, 2), "utf-8");
+    return path;
+}
+async function materializeExceptionInGraph(options, request, scope, _artifactPath) {
+    if (!options.graphStore)
+        return;
+    try {
+        await options.graphStore.materializeFreedomdSovereignty({
+            runId: options.runId,
+            nodeId: options.nodeId,
+            providerId: request.providerId,
+            runtimeMode: request.runtimeMode ?? "api",
+            sovereignty: {
+                mode: "freedomd",
+                dataBoundary: "internal",
+                retentionDecision: "allow",
+                jurisdictionDecision: "allow",
+                providerCutoffRisk: 0,
+                localFallbackAvailable: request.localFallbackAvailable,
+                reason: `provider exception approved: ${scope}`,
+            },
+        });
+    }
+    catch {
+        // Best-effort graph materialization.
+    }
+}

package/dist/runtime/freedomd-incidents.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Freedomd provider incident monitor.
+ *
+ * Reads local incident overrides from `.omk/provider-incidents.json` and
+ * optional per-project policy files. This avoids scraping public web pages by
+ * default while still letting operators react to events like Fable 5 quickly.
+ */
+import type { ProviderIncidentState } from "./provider-sovereignty.js";
+export interface ProviderIncidentFile {
+    readonly schemaVersion?: string;
+    readonly updatedAt?: string;
+    readonly incidents: readonly ProviderIncidentState[];
+}
+export interface LoadIncidentsOptions {
+    readonly projectRoot?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly feedUrls?: readonly string[];
+    readonly fetch?: (url: string) => Promise<{
+        ok: boolean;
+        text: () => Promise<string>;
+    }>;
+}
+export declare function loadProviderIncidents(options?: LoadIncidentsOptions): Promise<ProviderIncidentState[]>;