export { customPolicies } from "./hooks/custom-hooks-registry"
export { getCustomHooks } from "./hooks/custom-hooks-registry"
export { clearCustomHooks } from "./hooks/custom-hooks-registry"

(not documented)

The code exports three functions for managing custom hooks (customPolicies, getCustomHooks, clearCustomHooks), but the documentation does not mention these APIs at all. Developers trying to programmatically manage custom policies via the npm package have no guidance.

Add a section to the documentation describing the custom hook registry API with examples of how to call customPolicies(), getCustomHooks(), and clearCustomHooks(). Include parameter types and return values.

export async function runAudit(opts: RunAuditOptions = {}): Promise<AuditResult>

(not documented)

The code exports runAudit() as a public async function, but the docs do not mention this API. Developers who want to run audits programmatically have no documentation on how to use it or what options/results are available.

Document the runAudit() function with its options parameter type (RunAuditOptions) and return type (AuditResult). Provide code examples showing how to call it and handle the audit result.

export { PolicyContext } from "./hooks/policy-types"
export { PolicyResult } from "./hooks/policy-types"
export { CustomHook } from "./hooks/policy-types"
export { PolicyDecision } from "./hooks/policy-types"
export { PolicyFunction } from "./hooks/policy-types"

(not documented)

The code exports five core type definitions used for custom policies (PolicyContext, PolicyResult, CustomHook, PolicyDecision, PolicyFunction), but the docs do not document any of these types. Developers writing custom policies need to understand these types but have no guidance.

Document all five exported types from policy-types.ts with their properties, usage context, and examples. This is essential for the custom policies feature mentioned in the docs.

export const AUDIT_DETECTORS: Detector[]
export function getDetectorByName(name: string): Detector | undefined

(not documented)

The code exports AUDIT_DETECTORS and getDetectorByName(), enabling programmatic access to detection logic, but the docs do not mention these APIs at all.

Add documentation describing the detector API, including what AUDIT_DETECTORS contains, how to use getDetectorByName(), and examples of the Detector interface structure.

export { ListOpts }
export interface CliAdapter { cli: IntegrationType; listTranscripts: (opts?: ListOpts) => Promise<TranscriptMetadata[]>; streamEvents: (meta: TranscriptMetadata) => Promise<NormalizedToolEvent[]>; }
export const ADAPTERS: Record<IntegrationType, CliAdapter>
export function getAdapter(cli: IntegrationType): CliAdapter

(not documented)

The code exports CliAdapter interface, ADAPTERS, and getAdapter() function, providing a way to access integration-specific adapters, but the docs provide no guidance on this API.

Document the CliAdapter interface, the ADAPTERS registry, and the getAdapter() function with examples of how to list transcripts and stream events for different integrations.

export function pickArchetypeVariant(key: ArchetypeKey, seed: string): ResolvedArchetype
export function classifyAgent(result: AuditResult, seed = ""): Classification
export const ARCHETYPES: Record<ArchetypeKey, Archetype>
export const SIGILS: Record<ArchetypeKey, string[]>

(not documented)

The code exports archetype-related APIs (pickArchetypeVariant, classifyAgent, ARCHETYPES, SIGILS) for agent behavior classification, but the documentation does not mention these functions or their purpose. A developer trying to use this feature programmatically would have no guidance.

Document the archetype system with examples of how classifyAgent() works, what the 8 archetypes represent, and how to use pickArchetypeVariant() to customize output. Include the ArchetypeKey union type and Classification interface.

export function acquireAuditLock(source: AuditLockSource, now?: number): AcquireAuditLockResult
export function readAuditLock(): AuditLockInfo | null
export function readActiveAuditLock(now?: number): AuditLockInfo | null
export const AUDIT_LOCK_MAX_AGE_MS: number
export type AuditLockSource = "cli" | "scheduled" | "dashboard" | "onboarding"
export interface AuditLockInfo { pid: number; startedAt: number; source: AuditLockSource; }
export interface AuditLockHandle { info: AuditLockInfo; release(): void; }
export type AcquireAuditLockResult = { ok: true; lock: AuditLockHandle } | { ok: false; heldBy: AuditLockInfo | null }

(not documented)

The code exports a complete audit locking system (acquireAuditLock, readAuditLock, readActiveAuditLock, and supporting types), but the documentation does not mention this API. Developers needing to coordinate concurrent audit runs have no guidance.

Document the audit lock API with explanations of when and how to use acquireAuditLock(), how to check lock status, and how the lock handles concurrent access. Include type definitions and error handling examples.

export { allow } from "./hooks/policy-helpers"
export { deny } from "./hooks/policy-helpers"
export { instruct } from "./hooks/policy-helpers"

**Custom policies** \
\
Write your own rules in JavaScript with a simple allow / deny / instruct API.

While the docs mention allow/deny/instruct in the quick overview, there is no detailed documentation of these functions, their signatures, parameters, or return types. A developer trying to write a custom policy would need to reverse-engineer the API from examples.

Add a dedicated section in the custom policies documentation with the function signatures, parameter types, return types, and code examples for allow(), deny(), and instruct(). Include what PolicyContext and PolicyResult are and how to use them.

export class CliError extends Error {
  exitCode: 1 | 2
  constructor(message: string, exitCode: 1 | 2 = 1)
}

(not documented)

The code exports a CliError class for structured error handling, but the docs do not mention it. Developers building CLI tools or integrations may need this for proper error handling and exit codes.

Document CliError with examples of how to instantiate it with exit codes and how to catch/handle it in CLI contexts.

export const POSTHOG_API_KEY
export const POSTHOG_PRODUCT

(not documented)

The code exports POSTHOG_API_KEY and POSTHOG_PRODUCT constants used for telemetry, but the docs do not mention these or explain the telemetry behavior. The introduction does state 'Transcripts and policy evaluation stay on your machine. Data is sent only when you explicitly use an online feature' but does not detail what data is sent or how PostHog is used.

Either document these constants as part of the public API (if they are intended for external use) or remove them from the public export. If kept, clarify in the telemetry/privacy section of the docs what PostHog data collection occurs and why.