vouchington-tooling 0.45.0 → 0.47.0

package/dist/session-friction/log-file.mjs

@@ -1,95 +0,0 @@
-import { closeSync, constants, fstatSync, openSync, readSync, writeSync } from 'node:fs';
-import { isSafeAuditText } from "./text.mjs";
-import { decodeUtf8 } from "./utf8.mjs";
-export const LOG_MAX_BYTES = 2_000_000;
-export function validEvent(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a record view after the runtime object check
-    const record = value;
-    return ((record.kind === 'sandbox-escalation' ||
-        record.kind === 'sandbox-failure' ||
-        record.kind === 'ambiguous-failure') &&
-        isSafeAuditText(record.timestamp) &&
-        isSafeAuditText(record.commandPrefix) &&
-        isSafeAuditText(record.detail) &&
-        (record.failure === undefined || validFailure(record.failure)) &&
-        (record.outcome === undefined ||
-            (typeof record.outcome === 'string' &&
-                ['requested', 'approved', 'denied', 'unknown'].includes(record.outcome))));
-}
-function validFailure(value) {
-    if (!value || typeof value !== 'object')
-        return false;
-    // oxlint-disable-next-line no-mistakes/ts-no-const-aliases -- establish a validated object view
-    const failure = value;
-    return (Object.keys(failure).length === 2 &&
-        (failure.kind === 'sandbox-failure' || failure.kind === 'ambiguous-failure') &&
-        isSafeAuditText(failure.detail));
-}
-export function openLogFile(path, flags) {
-    let descriptor;
-    try {
-        descriptor = openSync(path, flags | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
-    }
-    catch (error) {
-        if (error &&
-            typeof error === 'object' &&
-            'code' in error &&
-            (error.code === 'ELOOP' || error.code === 'EISDIR' || error.code === 'ENOTDIR'))
-            throw new Error('session-friction log must be a regular file');
-        throw error;
-    }
-    try {
-        const status = fstatSync(descriptor);
-        if (!status.isFile() || status.nlink !== 1)
-            throw new Error('session-friction log must be a regular file');
-        return descriptor;
-    }
-    catch (error) {
-        closeSync(descriptor);
-        throw error;
-    }
-}
-export function readLogContent(descriptor, maximumBytes = LOG_MAX_BYTES) {
-    if (fstatSync(descriptor).size > maximumBytes)
-        throw new Error('session-friction log is too large');
-    const buffer = Buffer.alloc(maximumBytes + 1);
-    let length = 0;
-    while (length < buffer.length) {
-        const bytes = readSync(descriptor, buffer, length, buffer.length - length, length);
-        if (bytes === 0)
-            break;
-        length += bytes;
-    }
-    /* v8 ignore next -- detects external growth after the descriptor size check. */
-    if (length > maximumBytes)
-        throw new Error('session-friction log is too large');
-    return decodeUtf8(buffer.subarray(0, length));
-}
-export function validEventCount(content, limit) {
-    let count = 0;
-    for (const line of content.split('\n')) {
-        if (!line.trim())
-            continue;
-        try {
-            if (validEvent(JSON.parse(line)))
-                count++;
-        }
-        catch { }
-        if (count >= limit)
-            break;
-    }
-    return count;
-}
-export function writeAll(descriptor, value) {
-    const buffer = Buffer.from(value);
-    let offset = 0;
-    while (offset < buffer.length) {
-        const written = writeSync(descriptor, buffer, offset, buffer.length - offset);
-        /* v8 ignore next -- a zero-byte synchronous file write is an external I/O failure. */
-        if (written === 0)
-            throw new Error('session-friction log write made no progress');
-        offset += written;
-    }
-}

package/dist/session-friction/log.d.mts

@@ -1,8 +0,0 @@
-import type { FrictionLogOptions, FrictionLogReadResult, FrictionObservation } from './types.mts';
-export declare const FRICTION_LOG_MAX_EVENTS = 500;
-export declare function requireDirectory(directory: string): string;
-export declare function eventLimit(maxEvents: number | undefined): number;
-export declare function recordFriction(sessionId: string, observation: FrictionObservation, options: FrictionLogOptions & {
-    timestamp?: string | (() => string);
-}): void;
-export declare function readFrictionLog(sessionId: string, options: FrictionLogOptions): FrictionLogReadResult;

package/dist/session-friction/log.mjs

@@ -1,163 +0,0 @@
-import { readCoverageLedger, writeCoverageLedger } from "./coverage-ledger.mjs";
-import { closeSync, constants, fchmodSync, fstatSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
-import { classifyFrictionObservation } from "./classify.mjs";
-import { ensurePrivateDirectory } from "./directory.mjs";
-import { withFileLock } from "./lock.mjs";
-import { validEventCount, LOG_MAX_BYTES, openLogFile, readLogContent, validEvent, writeAll, } from "./log-file.mjs";
-import { sanitizeSessionId } from "./session-id.mjs";
-import { boundedText, isWellFormedUnicode, normalizeAuditText } from "./text.mjs";
-export const FRICTION_LOG_MAX_EVENTS = 500;
-const EVENT_FIELD_MAX_LENGTH = 1_000;
-export function requireDirectory(directory) {
-    if (typeof directory !== 'string')
-        throw new Error('log directory must be a string');
-    if (Buffer.byteLength(directory) > 4096)
-        throw new Error('session-friction log directory path is too long');
-    if (!isAbsolute(directory))
-        throw new Error('session-friction log directory must be absolute');
-    return resolve(directory);
-}
-export function eventLimit(maxEvents) {
-    const limit = maxEvents ?? FRICTION_LOG_MAX_EVENTS;
-    if (!Number.isInteger(limit) || limit < 1)
-        throw new Error('maxEvents must be a positive integer');
-    return Math.min(limit, FRICTION_LOG_MAX_EVENTS);
-}
-function logPath(sessionId, directory) {
-    return join(requireDirectory(directory), `${sanitizeSessionId(sessionId)}.jsonl`);
-}
-export function recordFriction(sessionId, observation, options) {
-    const maxEvents = eventLimit(options.maxEvents);
-    const timestamp = typeof options.timestamp === 'function' ? options.timestamp() : options.timestamp;
-    if (timestamp !== undefined && typeof timestamp !== 'string')
-        throw new Error('timestamp must be a string');
-    const rawTimestamp = timestamp ?? new Date().toISOString();
-    const normalizedTimestamp = normalizeAuditText(boundedText(rawTimestamp, EVENT_FIELD_MAX_LENGTH));
-    if (!normalizedTimestamp)
-        throw new Error('timestamp must be non-empty');
-    if (!isWellFormedUnicode(normalizedTimestamp))
-        throw new Error('timestamp must be well-formed Unicode');
-    const classified = classifyFrictionObservation(observation);
-    const path = logPath(sessionId, options.directory);
-    const directory = requireDirectory(options.directory);
-    ensurePrivateDirectory(directory, true);
-    withFileLock(path, () => {
-        /* v8 ignore next 2 -- requires the directory path to be replaced after its lock is acquired. */
-        if (!ensurePrivateDirectory(directory, false))
-            throw new Error('session-friction log directory disappeared while acquiring the lock');
-        const descriptor = openLogFile(path, constants.O_CREAT | constants.O_RDWR | constants.O_APPEND);
-        try {
-            fchmodSync(descriptor, 0o600);
-            if (fstatSync(descriptor).size > LOG_MAX_BYTES)
-                throw new Error('session-friction log is too large');
-            if (!classified)
-                return;
-            const coverage = readCoverageLedger(path);
-            const logBytes = fstatSync(descriptor).size;
-            if (coverage && coverage.logBytes === logBytes && coverage.retainedEvents >= maxEvents) {
-                writeCoverageLedger(path, { ...coverage, droppedCount: coverage.droppedCount + 1 });
-                return;
-            }
-            const content = readLogContent(descriptor);
-            const retainedEvents = validEventCount(content, FRICTION_LOG_MAX_EVENTS);
-            if (retainedEvents >= maxEvents) {
-                writeCoverageLedger(path, {
-                    schemaVersion: 1,
-                    logBytes,
-                    retainedEvents,
-                    droppedCount: (coverage?.droppedCount ?? 0) + 1,
-                });
-                return;
-            }
-            const event = {
-                ...classified,
-                commandPrefix: normalizeAuditText(classified.commandPrefix),
-                detail: normalizeAuditText(classified.detail),
-                timestamp: normalizedTimestamp,
-            };
-            /* v8 ignore next -- normalized classified fields satisfy validEvent defensively. */
-            if (!validEvent(event))
-                return;
-            const prefix = content && !content.endsWith('\n') ? '\n' : '';
-            const addition = `${prefix}${JSON.stringify(event)}\n`;
-            if (logBytes + Buffer.byteLength(addition) > LOG_MAX_BYTES) {
-                writeCoverageLedger(path, {
-                    schemaVersion: 1,
-                    logBytes,
-                    retainedEvents,
-                    droppedCount: (coverage?.droppedCount ?? 0) + 1,
-                });
-                return;
-            }
-            writeAll(descriptor, addition);
-            if (coverage)
-                writeCoverageLedger(path, {
-                    ...coverage,
-                    logBytes: fstatSync(descriptor).size,
-                    retainedEvents: retainedEvents + 1,
-                });
-        }
-        finally {
-            closeSync(descriptor);
-        }
-    });
-}
-export function readFrictionLog(sessionId, options) {
-    const maxEvents = eventLimit(options.maxEvents);
-    const path = logPath(sessionId, options.directory);
-    const directory = requireDirectory(options.directory);
-    if (!ensurePrivateDirectory(directory, false))
-        return { status: 'absent' };
-    try {
-        return withFileLock(path, () => {
-            /* v8 ignore next -- detects directory removal after acquiring the file lock. */
-            if (!ensurePrivateDirectory(directory, false))
-                return { status: 'absent' };
-            const descriptor = openLogFile(path, constants.O_RDONLY);
-            try {
-                const events = [];
-                const ledger = readCoverageLedger(path);
-                let droppedCount = ledger?.droppedCount ?? 0;
-                let retainedEvents = 0;
-                for (const line of readLogContent(descriptor).split('\n')) {
-                    if (!line.trim())
-                        continue;
-                    try {
-                        const value = JSON.parse(line);
-                        if (validEvent(value)) {
-                            retainedEvents++;
-                            if (events.length < maxEvents)
-                                events.push(value);
-                            else
-                                droppedCount++;
-                        }
-                        else
-                            droppedCount++;
-                    }
-                    catch {
-                        droppedCount++;
-                    }
-                }
-                if (ledger &&
-                    (ledger.logBytes !== fstatSync(descriptor).size ||
-                        ledger.retainedEvents !== Math.min(retainedEvents, FRICTION_LOG_MAX_EVENTS)))
-                    throw new Error('session-friction coverage ledger does not match retained log');
-                if (!Number.isSafeInteger(droppedCount))
-                    throw new Error('session-friction dropped count overflow; capture incomplete');
-                const coverage = droppedCount ? { truncated: true, droppedCount } : {};
-                return events.length
-                    ? { status: 'events', events, ...coverage }
-                    : { status: 'empty', ...coverage };
-            }
-            finally {
-                closeSync(descriptor);
-            }
-        });
-    }
-    catch (error) {
-        if (error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT')
-            return { status: 'absent' };
-        throw error;
-    }
-}

package/dist/session-friction/normalize.d.mts

@@ -1 +0,0 @@
-export declare function normalizeCommandPrefix(command: string, wrappersToStrip?: string[]): string;

package/dist/session-friction/normalize.mjs

@@ -1,81 +0,0 @@
-import { REDACTED_TOKEN, splitCommand, stripAssignments } from "./command-segments.mjs";
-const MAX_COMMAND_TOKEN_LENGTH = 40;
-const MAX_COMMAND_LENGTH = 100_000;
-const MAX_COMMAND_WRAPPERS = 16;
-const CREDENTIAL_OPTION = /^--?(?:api[-_]?key|auth|credential|password|secret|token)=/i;
-const URL_USERINFO = /^[a-z][a-z0-9+.-]*:\/\/[^/@\s]+@/i;
-const PACKAGE_RUNNERS = new Set(['npm', 'npx', 'pnpm', 'pnpx', 'yarn']);
-const GIT_OPTIONS_WITH_ARGS = new Set(['-C', '-c', '--git-dir', '--work-tree']);
-const GIT_OPTIONS_WITHOUT_ARGS = new Set([
-    '-v',
-    '--version',
-    '-h',
-    '--help',
-    '--exec-path',
-    '--html-path',
-    '--man-path',
-    '--info-path',
-    '-p',
-    '--paginate',
-    '-P',
-    '--no-pager',
-    '--no-replace-objects',
-    '--bare',
-]);
-function redact(token) {
-    return token.length > MAX_COMMAND_TOKEN_LENGTH ||
-        CREDENTIAL_OPTION.test(token) ||
-        URL_USERINFO.test(token)
-        ? REDACTED_TOKEN
-        : token;
-}
-function stripGitOptions(tokens) {
-    let index = 0;
-    while (index < tokens.length) {
-        const token = tokens[index];
-        if (token === '--')
-            return tokens.slice(index + 1);
-        if (GIT_OPTIONS_WITH_ARGS.has(token)) {
-            if (index + 1 >= tokens.length)
-                return [REDACTED_TOKEN];
-            index += 2;
-        }
-        else if (GIT_OPTIONS_WITHOUT_ARGS.has(token) || /^--[a-z0-9-]+=/i.test(token))
-            index++;
-        else
-            break;
-    }
-    return tokens.slice(index);
-}
-function packageRunner(token) {
-    return [...PACKAGE_RUNNERS].some((runner) => token === runner || token.endsWith(`/${runner}`));
-}
-function normalizeSegment(tokens) {
-    const [first, ...rest] = tokens;
-    if (!first)
-        return '';
-    if (packageRunner(first) && (rest[0] === 'run' || rest[0] === 'exec') && rest[1])
-        return `${redact(first)} ${rest[0]} ${redact(rest[1])}`;
-    const effective = first === 'git' || first.endsWith('/git') ? stripGitOptions(rest) : rest;
-    return effective[0] ? `${redact(first)} ${redact(effective[0])}` : redact(first);
-}
-export function normalizeCommandPrefix(command, wrappersToStrip = []) {
-    if (command.length > MAX_COMMAND_LENGTH)
-        return '[REDACTED: command too long]';
-    const segments = splitCommand(command);
-    let index = 0;
-    while (index < segments.length - 1 && stripAssignments(segments[index])[0] === 'cd')
-        index++;
-    const tokens = stripAssignments(segments[index] ?? []);
-    const wrapperValues = Array.isArray(wrappersToStrip) ? wrappersToStrip : [];
-    const wrapperNames = new Set(wrapperValues
-        .slice(0, MAX_COMMAND_WRAPPERS)
-        .filter((value) => typeof value === 'string' && value.length > 0 && value.length <= MAX_COMMAND_TOKEN_LENGTH));
-    let wrappers = 0;
-    while (tokens[wrappers] && wrapperNames.has(tokens[wrappers]))
-        wrappers++;
-    if (!wrappers)
-        return normalizeSegment(tokens);
-    const nested = normalizeSegment(stripAssignments(tokens.slice(wrappers)));
-    return nested ? `${redact(tokens[0])} ${nested}` : redact(tokens[0]);
-}

package/dist/session-friction/report.d.mts

@@ -1,16 +0,0 @@
-import { type JournalScan } from './journal.mts';
-import type { FrictionLogReadResult, SessionFrictionReport, SessionFrictionReportOptions } from './types.mts';
-type FrictionRead = {
-    result: FrictionLogReadResult;
-} | {
-    error: unknown;
-};
-/** Everything a report reads from outside, loaded once so rendering can be repeated for free. */
-export type FrictionReportInputs = {
-    scanned: JournalScan;
-    read: FrictionRead;
-};
-export declare function loadFrictionReportInputs(sessionId: string, options: SessionFrictionReportOptions): Promise<FrictionReportInputs>;
-export declare function renderFrictionReport(sessionId: string, options: SessionFrictionReportOptions, { scanned, read }: FrictionReportInputs): SessionFrictionReport;
-export declare function buildSessionFrictionReport(sessionId: string, options: SessionFrictionReportOptions): Promise<SessionFrictionReport>;
-export {};

package/dist/session-friction/report.mjs

@@ -1,91 +0,0 @@
-import { eventLimit, readFrictionLog, requireDirectory } from "./log.mjs";
-import { buildCiFailuresSection, getConformingGroups, incompleteCiSection } from "./ci-failures.mjs";
-import { errorMessage, scanJournal } from "./journal.mjs";
-import { buildSandboxSection } from "./sandbox.mjs";
-import { validateSessionId } from "./session-id.mjs";
-function sandboxMarkdown(friction, options) {
-    if (friction.status === 'events')
-        return `${friction.truncated ? `## Capture Coverage\nStatus: partial\nDropped records: ${friction.droppedCount}\n\n` : ''}${buildSandboxSection(friction.events, options.redact, options.budgets?.sandboxBytes)}`;
-    if (friction.status === 'empty' && friction.truncated)
-        return `## Sandbox & Permission Audit\nStatus: unavailable (partial capture; dropped ${friction.droppedCount} records)`;
-    const status = friction.status === 'empty' ? 'none observed' : 'unavailable (no friction log)';
-    return `## Sandbox & Permission Audit\nStatus: ${status}`;
-}
-function reportFromLog(sessionId, logOptions, journal, read) {
-    if ('result' in read) {
-        const friction = read.result;
-        const coverage = {
-            journalStatus: journal.status === 'unreachable'
-                ? 'unavailable'
-                : journal.truncated
-                    ? 'partial'
-                    : 'complete',
-            frictionStatus: friction.status,
-            truncated: friction.status !== 'absent' && friction.truncated === true,
-            ...(friction.status === 'absent' ? {} : { droppedCount: friction.droppedCount ?? 0 }),
-        };
-        if (journal.status === 'ok' && journal.truncated)
-            return {
-                coverage,
-                markdown: incompleteCiSection(journal.markdownBlocks) +
-                    '\n\n' +
-                    sandboxMarkdown(friction, logOptions),
-            };
-        const markdown = buildCiFailuresSection(sessionId, journal, friction.status);
-        return { coverage, markdown: `${markdown}\n\n${sandboxMarkdown(friction, logOptions)}` };
-    }
-    else {
-        const ciMarkdown = journal.status === 'ok' && journal.truncated
-            ? incompleteCiSection(journal.markdownBlocks)
-            : journal.status === 'ok' && journal.markdownBlocks.length === 0
-                ? '## CI Failures\nStatus: unavailable (friction log unreadable)'
-                : buildCiFailuresSection(sessionId, journal, 'empty');
-        return {
-            coverage: {
-                journalStatus: journal.status === 'unreachable'
-                    ? 'unavailable'
-                    : journal.truncated
-                        ? 'partial'
-                        : 'complete',
-                frictionStatus: 'unreadable',
-                truncated: true,
-            },
-            markdown: `${ciMarkdown}\n\n## Sandbox & Permission Audit\nStatus: unavailable (friction log unreadable)`,
-            diagnostic: errorMessage(read.error),
-        };
-    }
-}
-export async function loadFrictionReportInputs(sessionId, options) {
-    validateSessionId(sessionId);
-    requireDirectory(options.directory);
-    eventLimit(options.maxEvents);
-    const scanned = await scanJournal(sessionId, options.journalLoader);
-    try {
-        return { scanned, read: { result: readFrictionLog(sessionId, options) } };
-    }
-    catch (error) {
-        return { scanned, read: { error } };
-    }
-}
-export function renderFrictionReport(sessionId, options, { scanned, read }) {
-    const journal = scanned.status === 'unreachable'
-        ? scanned
-        : scanned.status === 'not-found'
-            ? { status: 'ok', markdownBlocks: [], truncated: false }
-            : {
-                status: 'ok',
-                markdownBlocks: getConformingGroups(scanned.entries, options.redact, options.budgets?.ciBytes),
-                truncated: scanned.truncated,
-            };
-    const report = reportFromLog(sessionId, options, journal, read);
-    if (journal.status === 'unreachable') {
-        const diagnostic = report.diagnostic
-            ? `${journal.diagnostic}; ${report.diagnostic}`
-            : journal.diagnostic;
-        return { ...report, diagnostic };
-    }
-    return report;
-}
-export async function buildSessionFrictionReport(sessionId, options) {
-    return renderFrictionReport(sessionId, options, await loadFrictionReportInputs(sessionId, options));
-}

package/dist/session-friction/sandbox.d.mts

@@ -1,3 +0,0 @@
-import type { FrictionEvent } from './types.mts';
-import { type AuditRedactor } from './text.mts';
-export declare function buildSandboxSection(events: FrictionEvent[], redact?: AuditRedactor, maxBytes?: number): string;

package/dist/session-friction/sandbox.mjs

@@ -1,43 +0,0 @@
-import { byteLength, fitFields, selectWithin } from "./audit-fit.mjs";
-import { markdownAuditUnits } from "./text.mjs";
-const SANDBOX_SECTION_HEADER = '## Sandbox & Permission Audit';
-const SANDBOX_SECTION_MAX_BYTES = 3_000;
-// Room for the `- kind (n)` group lines, which are rendered outside the per-event budget.
-const GROUP_LINES_BYTES = 120;
-// Below this an event line would keep little beyond its timestamp, so it is omitted and counted.
-const MIN_EVENT_SHARE_BYTES = 120;
-// Event line fields: command prefix, detail, timestamp. Cut detail first, the timestamp never.
-const SHRINK_ORDER = [1, 0];
-const KIND_ORDER = [
-    'sandbox-escalation',
-    'sandbox-failure',
-    'ambiguous-failure',
-];
-/** Reports dropped events as a group in the same shape as the rest, so omission is never silent. */
-function omissionGroup(count) {
-    return `- omitted (${count})\n  - see journal — ${count} events omitted to fit the size limit — n/a`;
-}
-export function buildSandboxSection(events, redact, maxBytes = SANDBOX_SECTION_MAX_BYTES) {
-    const observations = events.flatMap((event) => event.failure
-        ? [event, { ...event, kind: event.failure.kind, detail: event.failure.detail }]
-        : [event]);
-    const render = (event, budgetBytes) => {
-        const outcome = event.kind === 'sandbox-escalation' ? ` — outcome: ${event.outcome ?? 'unknown'}` : '';
-        const [prefix, detail, timestamp] = fitFields([event.commandPrefix, event.detail, event.timestamp].map((field) => markdownAuditUnits(field, redact)), byteLength(`  -  —  — ${outcome}`), budgetBytes, SHRINK_ORDER);
-        return `  - ${prefix} — ${detail} — ${timestamp}${outcome}`;
-    };
-    const total = Math.max(0, Math.min(maxBytes, SANDBOX_SECTION_MAX_BYTES) - GROUP_LINES_BYTES);
-    const { rendered, omitted } = selectWithin(observations, total, byteLength(omissionGroup(observations.length)) + 1, 1, MIN_EVENT_SHARE_BYTES, render);
-    const kept = observations
-        .slice(0, rendered.length)
-        .map((event, i) => ({ event, line: rendered[i] }));
-    const groups = KIND_ORDER.map((kind) => {
-        const selected = kept.filter(({ event }) => event.kind === kind);
-        return selected.length
-            ? [`- ${kind} (${selected.length})`, ...selected.map(({ line }) => line)].join('\n')
-            : undefined;
-    }).filter((group) => group !== undefined);
-    if (omitted)
-        groups.push(omissionGroup(omitted));
-    return `${SANDBOX_SECTION_HEADER}\nEvents observed: ${observations.length}\n\n${groups.join('\n')}`;
-}

package/dist/session-friction/session-id.d.mts

@@ -1,2 +0,0 @@
-export declare function validateSessionId(sessionId: string): void;
-export declare function sanitizeSessionId(sessionId: string): string;

package/dist/session-friction/types.d.mts

@@ -1,80 +0,0 @@
-export type FrictionEventKind = 'sandbox-escalation' | 'sandbox-failure' | 'ambiguous-failure';
-export type FrictionEvent = {
-    kind: FrictionEventKind;
-    timestamp: string;
-    commandPrefix: string;
-    detail: string;
-    outcome?: 'requested' | 'approved' | 'denied' | 'unknown';
-    failure?: {
-        kind: 'sandbox-failure' | 'ambiguous-failure';
-        detail: string;
-    };
-};
-export type ToolResultObservation = {
-    type: 'tool-result';
-    command: string;
-    commandWrappers?: string[];
-    permissionOutcome?: 'approved' | 'denied';
-    escalationDetail?: string;
-    structuredStderr?: string;
-};
-export type PermissionRequestObservation = {
-    type: 'permission-request';
-    command: string;
-    commandWrappers?: string[];
-};
-export type FrictionObservation = ToolResultObservation | PermissionRequestObservation;
-type FrictionLogCoverage = {
-    truncated: true;
-    droppedCount: number;
-} | {
-    truncated?: false;
-    droppedCount?: never;
-};
-export type FrictionLogReadResult = {
-    status: 'absent';
-} | ({
-    status: 'empty';
-} & FrictionLogCoverage) | ({
-    status: 'events';
-    events: FrictionEvent[];
-} & FrictionLogCoverage);
-export type FrictionLogOptions = {
-    directory: string;
-    maxEvents?: number;
-};
-export type JournalEntry = {
-    data?: {
-        type?: unknown;
-        markdown?: unknown;
-    };
-};
-export type JournalLoadResult = {
-    status: 'ok';
-    entries: Iterable<JournalEntry> | AsyncIterable<JournalEntry>;
-} | {
-    status: 'not-found';
-};
-export type JournalLoader = (sessionId: string) => JournalLoadResult | Promise<JournalLoadResult>;
-export type SessionFrictionCoverage = {
-    journalStatus: 'complete' | 'partial' | 'unavailable';
-    frictionStatus: 'absent' | 'empty' | 'events' | 'unreadable';
-    truncated: boolean;
-    droppedCount?: number;
-};
-export type SessionFrictionReport = {
-    coverage: SessionFrictionCoverage;
-    markdown: string;
-    diagnostic?: string;
-};
-export type SessionFrictionReportOptions = FrictionLogOptions & {
-    journalLoader: JournalLoader;
-    /** Redacts raw field text before Markdown escaping, which would otherwise break matching. */
-    redact?: (value: string) => string;
-    /** Byte allowances for the CI and sandbox sections, as maximums over the built-in budgets. */
-    budgets?: {
-        ciBytes: number;
-        sandboxBytes: number;
-    };
-};
-export {};