sandstream-kit 1.0.0

package/dist/governance.d.ts

@@ -0,0 +1,44 @@
+import type { GovernanceConfig } from "./config.js";
+export type OperationType = "read" | "write" | "delete";
+export interface GovernanceCheckResult {
+    allowed: boolean;
+    reason?: string;
+    requiresApproval?: boolean;
+}
+/**
+ * Default governance configuration
+ */
+export declare const DEFAULT_GOVERNANCE: Required<GovernanceConfig>;
+/**
+ * Merge user config with defaults (synchronous version)
+ */
+export declare function mergeGovernanceConfig(userConfig?: GovernanceConfig): Required<GovernanceConfig>;
+/**
+ * Merge user config with defaults and detect environment (async version)
+ */
+export declare function mergeGovernanceConfigAsync(userConfig?: GovernanceConfig): Promise<Required<GovernanceConfig>>;
+/**
+ * Check if an operation is allowed based on governance rules
+ */
+export declare function checkOperationAllowed(config: Required<GovernanceConfig>, operation: OperationType): GovernanceCheckResult;
+/**
+ * Check if a command contains destructive operations
+ */
+export declare function isDestructiveOperation(config: Required<GovernanceConfig>, command: string): boolean;
+/**
+ * Get current git branch
+ */
+export declare function getCurrentGitBranch(): Promise<string | null>;
+/**
+ * Detect environment from git branch
+ */
+export declare function detectEnvironmentFromBranch(branch: string): "dev" | "staging" | "prod" | null;
+/**
+ * Get current environment from config, environment variable, or git branch
+ * Priority: config.environment > NODE_ENV > git branch > default (dev)
+ */
+export declare function getCurrentEnvironment(config?: GovernanceConfig): Promise<"dev" | "staging" | "prod">;
+/**
+ * Format governance status for display
+ */
+export declare function formatGovernanceStatus(config: Required<GovernanceConfig>): string;

package/dist/governance.js

@@ -0,0 +1,236 @@
+/**
+ * Default environment access configurations
+ */
+const DEFAULT_ACCESS = {
+    dev: { read: true, write: true, delete: true },
+    staging: { read: true, write: true, delete: false },
+    prod: { read: true, write: false, delete: false },
+};
+/**
+ * Default governance configuration
+ */
+export const DEFAULT_GOVERNANCE = {
+    enabled: false,
+    environment: "dev",
+    access: DEFAULT_ACCESS,
+    agent: {
+        id: undefined,
+        name: undefined,
+        max_tokens_per_day: 1000000,
+        max_operations_per_hour: 100,
+    },
+    audit: {
+        enabled: true,
+        log_file: ".kit-audit.jsonl",
+        log_level: "info",
+        include_secrets: false,
+    },
+    approval: {
+        destructive_operations: ["delete", "drop", "truncate", "destroy", "remove"],
+        production_writes: true,
+        secret_rotations: false,
+        approval_timeout: 3600,
+    },
+    secrets: {
+        check_expiration: true,
+        warn_days_before_expiry: 30,
+        rotate_on_expiry: false,
+        revoke_on_agent_disable: true,
+    },
+    revocation: {
+        enabled: false,
+        check_interval: 300,
+        revocation_endpoint: undefined,
+    },
+};
+/**
+ * Merge user config with defaults (synchronous version)
+ */
+export function mergeGovernanceConfig(userConfig) {
+    if (!userConfig) {
+        return DEFAULT_GOVERNANCE;
+    }
+    return {
+        enabled: userConfig.enabled ?? DEFAULT_GOVERNANCE.enabled,
+        environment: userConfig.environment ?? DEFAULT_GOVERNANCE.environment,
+        access: {
+            ...DEFAULT_GOVERNANCE.access,
+            ...userConfig.access,
+        },
+        agent: {
+            ...DEFAULT_GOVERNANCE.agent,
+            ...userConfig.agent,
+        },
+        audit: {
+            ...DEFAULT_GOVERNANCE.audit,
+            ...userConfig.audit,
+        },
+        approval: {
+            ...DEFAULT_GOVERNANCE.approval,
+            ...userConfig.approval,
+        },
+        secrets: {
+            ...DEFAULT_GOVERNANCE.secrets,
+            ...userConfig.secrets,
+        },
+        revocation: {
+            ...DEFAULT_GOVERNANCE.revocation,
+            ...userConfig.revocation,
+        },
+    };
+}
+/**
+ * Merge user config with defaults and detect environment (async version)
+ */
+export async function mergeGovernanceConfigAsync(userConfig) {
+    const merged = mergeGovernanceConfig(userConfig);
+    // If environment is not explicitly set, detect it
+    if (!userConfig?.environment) {
+        merged.environment = await getCurrentEnvironment(userConfig);
+    }
+    return merged;
+}
+/**
+ * Check if an operation is allowed based on governance rules
+ */
+export function checkOperationAllowed(config, operation) {
+    if (!config.enabled) {
+        return { allowed: true };
+    }
+    const env = config.environment;
+    const access = config.access[env];
+    if (!access) {
+        return {
+            allowed: false,
+            reason: `No access configuration for environment: ${env}`,
+        };
+    }
+    switch (operation) {
+        case "read":
+            if (!access.read) {
+                return {
+                    allowed: false,
+                    reason: `Read operations not allowed in ${env} environment`,
+                };
+            }
+            break;
+        case "write":
+            if (!access.write) {
+                const requiresApproval = env === "prod" && config.approval.production_writes;
+                if (requiresApproval) {
+                    return {
+                        allowed: false,
+                        requiresApproval: true,
+                        reason: `Write operations in ${env} require approval`,
+                    };
+                }
+                return {
+                    allowed: false,
+                    reason: `Write operations not allowed in ${env} environment`,
+                };
+            }
+            break;
+        case "delete":
+            if (!access.delete) {
+                return {
+                    allowed: false,
+                    requiresApproval: true,
+                    reason: `Delete operations not allowed in ${env} environment`,
+                };
+            }
+            break;
+    }
+    return { allowed: true };
+}
+/**
+ * Check if a command contains destructive operations
+ */
+export function isDestructiveOperation(config, command) {
+    const keywords = config.approval.destructive_operations || [];
+    const lowerCommand = command.toLowerCase();
+    return keywords.some((keyword) => lowerCommand.includes(keyword.toLowerCase()));
+}
+/**
+ * Get current git branch
+ */
+export async function getCurrentGitBranch() {
+    try {
+        const { execSync } = await import("node:child_process");
+        const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        return branch;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Detect environment from git branch
+ */
+export function detectEnvironmentFromBranch(branch) {
+    const lowerBranch = branch.toLowerCase();
+    // Production branches
+    if (lowerBranch === "main" ||
+        lowerBranch === "master" ||
+        lowerBranch === "prod" ||
+        lowerBranch === "production") {
+        return "prod";
+    }
+    // Staging branches
+    if (lowerBranch === "staging" ||
+        lowerBranch === "stage" ||
+        lowerBranch.startsWith("release/")) {
+        return "staging";
+    }
+    // Development branches (all others)
+    return "dev";
+}
+/**
+ * Get current environment from config, environment variable, or git branch
+ * Priority: config.environment > NODE_ENV > git branch > default (dev)
+ */
+export async function getCurrentEnvironment(config) {
+    // 1. Explicit config takes precedence
+    if (config?.environment) {
+        return config.environment;
+    }
+    // 2. NODE_ENV environment variable
+    const nodeEnv = process.env.NODE_ENV?.toLowerCase();
+    if (nodeEnv === "production")
+        return "prod";
+    if (nodeEnv === "staging")
+        return "staging";
+    if (nodeEnv === "development")
+        return "dev";
+    // 3. Git branch detection
+    const branch = await getCurrentGitBranch();
+    if (branch) {
+        const envFromBranch = detectEnvironmentFromBranch(branch);
+        if (envFromBranch) {
+            return envFromBranch;
+        }
+    }
+    // 4. Default to dev
+    return "dev";
+}
+/**
+ * Format governance status for display
+ */
+export function formatGovernanceStatus(config) {
+    if (!config.enabled) {
+        return "Governance: disabled";
+    }
+    const env = config.environment;
+    const access = config.access[env];
+    const permissions = [];
+    if (access?.read)
+        permissions.push("read");
+    if (access?.write)
+        permissions.push("write");
+    if (access?.delete)
+        permissions.push("delete");
+    return `Governance: enabled | Environment: ${env} | Permissions: ${permissions.join(", ")}`;
+}
+//# sourceMappingURL=governance.js.map

package/dist/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAUA;;GAEG;AACH,MAAM,cAAc,GAAsC;IACxD,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;IACnD,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE;CAClD,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,KAAK;IAClB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE;QACL,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,SAAS;QACf,kBAAkB,EAAE,OAAO;QAC3B,uBAAuB,EAAE,GAAG;KAC7B;IACD,KAAK,EAAE;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,kBAAkB;QAC5B,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,KAAK;KACvB;IACD,QAAQ,EAAE;QACR,sBAAsB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC3E,iBAAiB,EAAE,IAAI;QACvB,gBAAgB,EAAE,KAAK;QACvB,gBAAgB,EAAE,IAAI;KACvB;IACD,OAAO,EAAE;QACP,gBAAgB,EAAE,IAAI;QACtB,uBAAuB,EAAE,EAAE;QAC3B,gBAAgB,EAAE,KAAK;QACvB,uBAAuB,EAAE,IAAI;KAC9B;IACD,UAAU,EAAE;QACV,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,GAAG;QACnB,mBAAmB,EAAE,SAAS;KAC/B;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAA6B;IAE7B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,kBAAkB,CAAC,OAAO;QACzD,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,kBAAkB,CAAC,WAAW;QACrE,MAAM,EAAE;YACN,GAAG,kBAAkB,CAAC,MAAM;YAC5B,GAAG,UAAU,CAAC,MAAM;SACrB;QACD,KAAK,EAAE;YACL,GAAG,kBAAkB,CAAC,KAAK;YAC3B,GAAG,UAAU,CAAC,KAAK;SACpB;QACD,KAAK,EAAE;YACL,GAAG,kBAAkB,CAAC,KAAK;YAC3B,GAAG,UAAU,CAAC,KAAK;SACpB;QACD,QAAQ,EAAE;YACR,GAAG,kBAAkB,CAAC,QAAQ;YAC9B,GAAG,UAAU,CAAC,QAAQ;SACvB;QACD,OAAO,EAAE;YACP,GAAG,kBAAkB,CAAC,OAAO;YAC7B,GAAG,UAAU,CAAC,OAAO;SACtB;QACD,UAAU,EAAE;YACV,GAAG,kBAAkB,CAAC,UAAU;YAChC,GAAG,UAAU,CAAC,UAAU;SACzB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAA6B;IAE7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAEjD,kDAAkD;IAClD,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,WAAW,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkC,EAClC,SAAwB;IAExB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAElC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,4CAA4C,GAAG,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM;YACT,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,kCAAkC,GAAG,cAAc;iBAC5D,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,OAAO;YACV,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,gBAAgB,GACpB,GAAG,KAAK,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;gBACtD,IAAI,gBAAgB,EAAE,CAAC;oBACrB,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,gBAAgB,EAAE,IAAI;wBACtB,MAAM,EAAE,uBAAuB,GAAG,mBAAmB;qBACtD,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,mCAAmC,GAAG,cAAc;iBAC7D,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,IAAI;oBACtB,MAAM,EAAE,oCAAoC,GAAG,cAAc;iBAC9D,CAAC;YACJ,CAAC;YACD,MAAM;IACV,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAkC,EAClC,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,sBAAsB,IAAI,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAE3C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,iCAAiC,EAAE;YACzD,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEzC,sBAAsB;IACtB,IACE,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,QAAQ;QACxB,WAAW,KAAK,MAAM;QACtB,WAAW,KAAK,YAAY,EAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mBAAmB;IACnB,IACE,WAAW,KAAK,SAAS;QACzB,WAAW,KAAK,OAAO;QACvB,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oCAAoC;IACpC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAyB;IAEzB,sCAAsC;IACtC,IAAI,MAAM,EAAE,WAAW,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,mCAAmC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACpD,IAAI,OAAO,KAAK,YAAY;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAE5C,0BAA0B;IAC1B,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,aAAa,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAkC;IAElC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,sBAAsB,CAAC;IAChC,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAElC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,MAAM,EAAE,IAAI;QAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,MAAM;QAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAE/C,OAAO,sCAAsC,GAAG,mBAAmB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/hooks.d.ts

@@ -0,0 +1,25 @@
+import type { HooksConfig } from "./config.js";
+/**
+ * Path (relative to .git) of the sentinel file written by the kit
+ * pre-commit hook. The post-commit detector reads it back; if it's missing
+ * the commit was made with `--no-verify` and we audit the skip.
+ */
+export declare const HOOK_SENTINEL_REL = ".kit-hook-ran";
+/**
+ * Project-relative log of commits that bypassed pre-commit. Written by the
+ * post-commit hook; read once per `kit` invocation to surface a banner.
+ */
+export declare const SKIPPED_COMMITS_LOG = ".kit-skipped-commits.jsonl";
+export interface HookInstallResult {
+    hookName: string;
+    action: "installed" | "updated" | "skipped" | "failed";
+    detail: string;
+}
+/**
+ * Install git hooks from configuration
+ */
+export declare function installHooks(config: HooksConfig, gitDir?: string): Promise<HookInstallResult[]>;
+/**
+ * Uninstall git hooks
+ */
+export declare function uninstallHooks(hookNames: string[], gitDir?: string): Promise<HookInstallResult[]>;

package/dist/hooks.js

@@ -0,0 +1,281 @@
+import { writeFile, chmod, mkdir } from "node:fs/promises";
+import { resolve } from "node:path";
+import { existsSync } from "node:fs";
+/**
+ * Path (relative to .git) of the sentinel file written by the kit
+ * pre-commit hook. The post-commit detector reads it back; if it's missing
+ * the commit was made with `--no-verify` and we audit the skip.
+ */
+export const HOOK_SENTINEL_REL = ".kit-hook-ran";
+/**
+ * Project-relative log of commits that bypassed pre-commit. Written by the
+ * post-commit hook; read once per `kit` invocation to surface a banner.
+ */
+export const SKIPPED_COMMITS_LOG = ".kit-skipped-commits.jsonl";
+/**
+ * Install git hooks from configuration
+ */
+export async function installHooks(config, gitDir = ".git") {
+    // Read-only mode: hooks are writes to .git/hooks/. Refuse + audit.
+    const { isReadOnlyMode, refuseWrite } = await import("./read-only-mode.js");
+    if (isReadOnlyMode()) {
+        const refusal = await refuseWrite("install-hooks", {
+            hook_count: Object.keys(config).length,
+        });
+        return [{ hookName: "read-only-refusal", action: "failed", detail: refusal.reason }];
+    }
+    const results = [];
+    const hooksDir = resolve(process.cwd(), gitDir, "hooks");
+    // Ensure hooks directory exists
+    try {
+        await mkdir(hooksDir, { recursive: true });
+    }
+    catch (error) {
+        return [
+            {
+                hookName: "hooks-dir",
+                action: "failed",
+                detail: `Failed to create hooks directory: ${error}`,
+            },
+        ];
+    }
+    // Install each hook
+    for (const [hookName, commands] of Object.entries(config)) {
+        if (!commands || commands.length === 0) {
+            continue;
+        }
+        const result = await installHook(hooksDir, hookName, commands);
+        results.push(result);
+    }
+    // Always install the bypass detector — independent of HooksConfig so the
+    // user can't omit it. Even repos that don't configure any other hooks get
+    // the sentinel pair so `--no-verify` is detectable post-facto.
+    const detectorResults = await installBypassDetector(hooksDir);
+    results.push(...detectorResults);
+    return results;
+}
+/**
+ * Writes (or re-writes) the pre-commit sentinel-writer and the post-commit
+ * detector. The pair makes `git commit --no-verify` non-silent: the
+ * post-commit hook compares the sentinel to HEAD and logs a skip event
+ * when they don't match (or the sentinel is missing entirely).
+ *
+ * Git doesn't expose `--no-verify` to hooks, so we can't prevent the skip
+ * — but we can guarantee a forensic trail and a stderr banner on the next
+ * `kit` command in the repo.
+ */
+async function installBypassDetector(hooksDir) {
+    const results = [];
+    const preCommitDetectorPath = resolve(hooksDir, "pre-commit");
+    const postCommitDetectorPath = resolve(hooksDir, "post-commit");
+    // The pre-commit sentinel WRITER must run even when the user has no
+    // other pre-commit steps configured. If a real pre-commit script
+    // already exists (from installHook above), prepend the sentinel write.
+    try {
+        const sentinelWriter = sentinelWriterScript();
+        if (existsSync(preCommitDetectorPath)) {
+            const { readFile } = await import("node:fs/promises");
+            const current = await readFile(preCommitDetectorPath, "utf-8");
+            if (!current.includes("KIT_HOOK_SENTINEL")) {
+                // Inject the sentinel-write block right after the shebang line.
+                const lines = current.split("\n");
+                const injected = [lines[0], "", sentinelWriter, ...lines.slice(1)].join("\n");
+                await writeFile(preCommitDetectorPath, injected, "utf-8");
+                await chmod(preCommitDetectorPath, 0o755);
+            }
+        }
+        else {
+            await writeFile(preCommitDetectorPath, `#!/bin/sh\n${sentinelWriter}\nexit 0\n`, "utf-8");
+            await chmod(preCommitDetectorPath, 0o755);
+        }
+        results.push({
+            hookName: "pre-commit (sentinel)",
+            action: "installed",
+            detail: "writes .git/.kit-hook-ran on every pre-commit pass",
+        });
+    }
+    catch (error) {
+        results.push({
+            hookName: "pre-commit (sentinel)",
+            action: "failed",
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+    try {
+        const detectorScript = postCommitDetectorScript();
+        if (existsSync(postCommitDetectorPath)) {
+            const { readFile } = await import("node:fs/promises");
+            const current = await readFile(postCommitDetectorPath, "utf-8");
+            if (!current.includes("KIT_HOOK_SENTINEL")) {
+                const lines = current.split("\n");
+                const injected = [lines[0], "", detectorScript, ...lines.slice(1)].join("\n");
+                await writeFile(postCommitDetectorPath, injected, "utf-8");
+                await chmod(postCommitDetectorPath, 0o755);
+            }
+        }
+        else {
+            await writeFile(postCommitDetectorPath, `#!/bin/sh\n${detectorScript}\nexit 0\n`, "utf-8");
+            await chmod(postCommitDetectorPath, 0o755);
+        }
+        results.push({
+            hookName: "post-commit (bypass-detector)",
+            action: "installed",
+            detail: "logs commits whose pre-commit hook didn't run",
+        });
+    }
+    catch (error) {
+        results.push({
+            hookName: "post-commit (bypass-detector)",
+            action: "failed",
+            detail: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return results;
+}
+function sentinelWriterScript() {
+    return `# KIT_HOOK_SENTINEL: record that pre-commit actually ran. The
+# post-commit detector compares the sentinel to HEAD; mismatch or absence
+# means \`git commit --no-verify\` skipped the gate.
+__kit_git_dir=\${GIT_DIR:-$(git rev-parse --git-dir 2>/dev/null)}
+if [ -n "$__kit_git_dir" ]; then
+  date -u +"%Y-%m-%dT%H:%M:%SZ" > "$__kit_git_dir/${HOOK_SENTINEL_REL}" 2>/dev/null || true
+fi`;
+}
+function postCommitDetectorScript() {
+    return `# KIT_HOOK_SENTINEL: detect --no-verify skips. If the sentinel
+# is missing OR older than the commit (i.e. wasn't written by this commit's
+# pre-commit pass), record a skip event so the operator and CI can see it.
+__kit_git_dir=\${GIT_DIR:-$(git rev-parse --git-dir 2>/dev/null)}
+__kit_repo_root=$(git rev-parse --show-toplevel 2>/dev/null)
+if [ -n "$__kit_git_dir" ] && [ -n "$__kit_repo_root" ]; then
+  __kit_sentinel="$__kit_git_dir/${HOOK_SENTINEL_REL}"
+  __kit_head=$(git rev-parse HEAD 2>/dev/null)
+  if [ ! -f "$__kit_sentinel" ]; then
+    __kit_reason="sentinel-missing"
+  else
+    # If the sentinel timestamp pre-dates the commit author time by more
+    # than ~5min, treat as stale (left from an earlier run).
+    __kit_sentinel_ts=$(stat -c %Y "$__kit_sentinel" 2>/dev/null || stat -f %m "$__kit_sentinel" 2>/dev/null)
+    __kit_commit_ts=$(git log -1 --format=%ct HEAD 2>/dev/null)
+    if [ -n "$__kit_sentinel_ts" ] && [ -n "$__kit_commit_ts" ]; then
+      __kit_delta=$(( __kit_commit_ts - __kit_sentinel_ts ))
+      if [ "$__kit_delta" -gt 300 ] || [ "$__kit_delta" -lt -300 ]; then
+        __kit_reason="sentinel-stale"
+      fi
+    fi
+  fi
+  if [ -n "$__kit_reason" ]; then
+    __kit_log="$__kit_repo_root/${SKIPPED_COMMITS_LOG}"
+    __kit_ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+    printf '{"timestamp":"%s","sha":"%s","reason":"%s","user":"%s"}\\n' \\
+      "$__kit_ts" "$__kit_head" "$__kit_reason" "\${USER:-unknown}" \\
+      >> "$__kit_log" 2>/dev/null || true
+    echo "[kit] WARNING: pre-commit hook was skipped ($__kit_reason). Logged to ${SKIPPED_COMMITS_LOG}." >&2
+  fi
+  # Clean up sentinel so the next commit starts fresh.
+  rm -f "$__kit_sentinel" 2>/dev/null || true
+fi`;
+}
+/**
+ * Install a single git hook
+ */
+async function installHook(hooksDir, hookName, commands) {
+    const hookPath = resolve(hooksDir, hookName);
+    const hookContent = generateHookScript(hookName, commands);
+    try {
+        // Check if hook already exists
+        const exists = existsSync(hookPath);
+        const action = exists ? "updated" : "installed";
+        // Write hook file
+        await writeFile(hookPath, hookContent, "utf-8");
+        // Make executable
+        await chmod(hookPath, 0o755);
+        return {
+            hookName,
+            action,
+            detail: `${commands.length} command(s)`,
+        };
+    }
+    catch (error) {
+        return {
+            hookName,
+            action: "failed",
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+/**
+ * Generate hook script content
+ */
+function generateHookScript(hookName, commands) {
+    const total = commands.length;
+    // Each command is framed as a numbered step with live ▶ / ✓ / ✗ markers and
+    // a per-step duration, mirroring the runStep() util used by the CLI
+    // (src/output.ts). The raw command text is echoed and executed verbatim so
+    // check-hooks' `content.includes(cmd)` up-to-date detection keeps working.
+    const steps = commands
+        .map((cmd, index) => {
+        const n = index + 1;
+        return `
+__s=$(date +%s)
+echo "▶ [${n}/${total}] ${cmd}"
+if ${cmd}; then
+  echo "✓ [${n}/${total}] ${cmd}  ($(( $(date +%s) - __s ))s)"
+else
+  echo "✗ ${hookName} step ${n}/${total} failed: ${cmd}"
+  exit 1
+fi`;
+    })
+        .join("\n");
+    return `#!/bin/sh
+# Generated by kit
+# Hook: ${hookName}
+# Commands: ${total}
+
+set -e
+
+__t0=$(date +%s)
+echo "🔍 ${hookName} — running ${total} step(s)…"
+${steps}
+
+echo "✅ ${hookName} passed — ${total} step(s) in $(( $(date +%s) - __t0 ))s"
+exit 0
+`;
+}
+/**
+ * Uninstall git hooks
+ */
+export async function uninstallHooks(hookNames, gitDir = ".git") {
+    const results = [];
+    const hooksDir = resolve(process.cwd(), gitDir, "hooks");
+    for (const hookName of hookNames) {
+        const hookPath = resolve(hooksDir, hookName);
+        try {
+            if (existsSync(hookPath)) {
+                const { unlink } = await import("node:fs/promises");
+                await unlink(hookPath);
+                results.push({
+                    hookName,
+                    action: "installed", // Using "installed" to mean "removed"
+                    detail: "uninstalled",
+                });
+            }
+            else {
+                results.push({
+                    hookName,
+                    action: "skipped",
+                    detail: "not found",
+                });
+            }
+        }
+        catch (error) {
+            results.push({
+                hookName,
+                action: "failed",
+                detail: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAGrC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAQhE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAmB,EACnB,MAAM,GAAG,MAAM;IAEf,mEAAmE;IACnE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC5E,IAAI,cAAc,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE;YACjD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;SACvC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzD,gCAAgC;IAChC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL;gBACE,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,qCAAqC,KAAK,EAAE;aACrD;SACF,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,eAAe,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAEjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAAgB;IAEhB,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,MAAM,qBAAqB,GAAG,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,sBAAsB,GAAG,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAEhE,oEAAoE;IACpE,iEAAiE;IACjE,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;QAC9C,IAAI,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC3C,gEAAgE;gBAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9E,MAAM,SAAS,CAAC,qBAAqB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC1D,MAAM,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CACb,qBAAqB,EACrB,cAAc,cAAc,YAAY,EACxC,OAAO,CACR,CAAC;YACF,MAAM,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,uBAAuB;YACjC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,oDAAoD;SAC7D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,uBAAuB;YACjC,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;QAClD,IAAI,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;YACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC9E,MAAM,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,CACb,sBAAsB,EACtB,cAAc,cAAc,YAAY,EACxC,OAAO,CACR,CAAC;YACF,MAAM,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,+BAA+B;YACzC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,+CAA+C;SACxD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,+BAA+B;YACzC,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;;;;;oDAK2C,iBAAiB;GAClE,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO;;;;;;mCAM0B,iBAAiB;;;;;;;;;;;;;;;;;kCAiBlB,mBAAmB;;;;;kFAK6B,mBAAmB;;;;GAIlG,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CACxB,QAAgB,EAChB,QAAgB,EAChB,QAAkB;IAElB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAE3D,IAAI,CAAC;QACH,+BAA+B;QAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;QAEhD,kBAAkB;QAClB,MAAM,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAEhD,kBAAkB;QAClB,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE7B,OAAO;YACL,QAAQ;YACR,MAAM;YACN,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,aAAa;SACxC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,QAAkB;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,4EAA4E;IAC5E,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAClB,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QACpB,OAAO;;WAEF,CAAC,IAAI,KAAK,KAAK,GAAG;KACxB,GAAG;aACK,CAAC,IAAI,KAAK,KAAK,GAAG;;YAEnB,QAAQ,SAAS,CAAC,IAAI,KAAK,YAAY,GAAG;;GAEnD,CAAC;IACA,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;UAEC,QAAQ;cACJ,KAAK;;;;;WAKR,QAAQ,cAAc,KAAK;EACpC,KAAK;;UAEG,QAAQ,aAAa,KAAK;;CAEnC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAmB,EACnB,MAAM,GAAG,MAAM;IAEf,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;gBACpD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,MAAM,EAAE,WAAW,EAAE,sCAAsC;oBAC3D,MAAM,EAAE,aAAa;iBACtB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,WAAW;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ;gBACR,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/id-generator.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Centralized ID generation utility
+ * Consolidates Date.now() + random pattern used across services
+ */
+/**
+ * Generate unique ID with optional prefix
+ * Pattern: prefix + timestamp-randomString (max 255 chars)
+ */
+export declare function generateId(prefix?: string): string;
+/**
+ * Generate prefixed IDs for domain entities
+ */
+export declare const IdGenerators: {
+    partner: (suffix?: string) => string;
+    agreement: (suffix?: string) => string;
+    apiKey: (suffix?: string) => string;
+    coPlugin: (suffix?: string) => string;
+    featured: (suffix?: string) => string;
+    feedback: (suffix?: string) => string;
+    betaDev: (suffix?: string) => string;
+    refine: (suffix?: string) => string;
+    payout: (suffix?: string) => string;
+    grant: (suffix?: string) => string;
+    approval: (suffix?: string) => string;
+    alert: (suffix?: string) => string;
+    trace: (suffix?: string) => string;
+    span: (suffix?: string) => string;
+    notification: (suffix?: string) => string;
+    publish: (suffix?: string) => string;
+    documentation: (suffix?: string) => string;
+    error: (suffix?: string) => string;
+    errorGroup: (suffix?: string) => string;
+    search: (suffix?: string) => string;
+    review: (suffix?: string) => string;
+    report: (suffix?: string) => string;
+    modAction: (suffix?: string) => string;
+    appeal: (suffix?: string) => string;
+    audit: (suffix?: string) => string;
+    policy: (suffix?: string) => string;
+    transaction: (suffix?: string) => string;
+    sla: (suffix?: string) => string;
+    breach: (suffix?: string) => string;
+};