@cruxy/cli 1.0.2 → 1.0.4

package/dist/utils/logger.d.ts

@@ -1,18 +0,0 @@
-export declare const LOG_LEVELS: readonly ["debug", "info", "warn", "error", "silent"];
-export type LogLevel = (typeof LOG_LEVELS)[number];
-declare class Logger {
-    private level;
-    /** Diagnostics go to stderr, so the theme resolves against stderr's color. */
-    private readonly theme;
-    setLevel(level: LogLevel): void;
-    getLevel(): LogLevel;
-    private enabled;
-    debug(...args: unknown[]): void;
-    info(...args: unknown[]): void;
-    warn(...args: unknown[]): void;
-    error(...args: unknown[]): void;
-    /** Primary user-facing output — always written to stdout. */
-    print(...args: unknown[]): void;
-}
-export declare const logger: Logger;
-export {};

package/dist/utils/process-tree.d.ts

@@ -1,16 +0,0 @@
-import { type ChildProcess, type SpawnOptions } from "node:child_process";
-/**
- * Spawn a child as the head of a killable process tree, applying the
- * platform-correct grouping options on top of the caller's own (`shell`, `cwd`,
- * `stdio`, `env`, …). Any `detached`/`windowsHide` the caller passes is
- * overridden — grouping is this module's responsibility, not the call site's.
- */
-export declare function spawnTree(command: string, args?: readonly string[], options?: SpawnOptions): ChildProcess;
-/**
- * Kill a child's ENTIRE process tree — the child and every descendant it
- * spawned. POSIX: negative-PID `SIGKILL` targets the process group created by
- * {@link spawnTree}'s `detached`. win32: `taskkill /PID <pid> /T /F` walks the
- * OS tree (`/T`) and force-terminates it (`/F`). Fire-and-forget and
- * error-swallowing on both paths — the tree may already be gone.
- */
-export declare function killTree(pid: number | undefined): void;

package/dist/vcs/auth.d.ts

@@ -1,22 +0,0 @@
-/**
- * Resolve a forge token (C.15). The chain is, in order:
- *   1. `GITHUB_TOKEN`
- *   2. `GH_TOKEN`
- *   3. `gh auth token` (if the GitHub CLI is installed and logged in)
- *   4. fail loud — {@link forgeAuth} (`CRUXY_E_FORGE_AUTH`)
- *
- * We **never** prompt for, store, or persist a token: it's read from the
- * environment / `gh` on every run, exactly like provider API keys.
- */
-/** Injection seams so the chain is testable without real env / a real `gh`. */
-export interface ForgeAuthDeps {
-    /** Environment to read tokens from (defaults to `process.env`). */
-    env?: NodeJS.ProcessEnv;
-    /** Run `gh auth token`, returning the token or `null`. Defaults to the CLI. */
-    ghToken?: () => string | null;
-}
-/**
- * Resolve a forge token or throw {@link forgeAuth}. `host` is only used to make
- * the error message specific.
- */
-export declare function resolveForgeToken(deps?: ForgeAuthDeps, host?: string): string;

package/dist/vcs/generate.d.ts

@@ -1,74 +0,0 @@
-import type { Provider } from "@cruxy/sdk";
-import type { GeneratedContent } from "./types.js";
-/**
- * Turn a diff + session context into the PR publish content (C.15): a
- * conventional-commit subject, a structured body, a branch name, and the PR
- * title/body. The repo's commit rules (the C.18 git-commit skill + the
- * commitlint scope list) are honored two ways: they're handed to the LLM in the
- * prompt, **and** every field is run through deterministic normalizers so the
- * lowercase-subject rule (and scope allow-list) hold even if the model slips.
- *
- * Secrets never leave: the diff is redacted before the LLM sees it, and the
- * generated bodies are redacted again (defense-in-depth).
- */
-/** Conventional-commit types accepted by `@commitlint/config-conventional`. */
-export declare const CONVENTIONAL_TYPES: readonly ["feat", "fix", "chore", "docs", "refactor", "test", "perf", "build", "ci", "style", "revert"];
-export interface GenerateInput {
-    /** The change set to summarize (already from `diffAgainst`). */
-    diff: string;
-    /** The PR base branch. */
-    base: string;
-    /** The branch the change is on, if already a feature branch. */
-    currentBranch?: string;
-    /** A short summary of what the agent did this session, if available. */
-    sessionSummary?: string;
-    /** commitlint scope allow-list; empty ⇒ no scope constraint. */
-    scopes: string[];
-    /** The git-commit SKILL.md body, embedded into the LLM prompt verbatim. */
-    skillBody?: string;
-    /** Caller-supplied title (e.g. the agent's), normalized rather than generated. */
-    title?: string;
-    /** Caller-supplied body. */
-    body?: string;
-}
-/** Strip anything that looks like a credential from `text`. */
-export declare function redactSecrets(text: string): string;
-/**
- * Force `raw` into a valid conventional-commit subject: a known `type`, an
- * allow-listed scope (dropped if it isn't), a **lowercase** first word, no
- * trailing period, clamped to 72 chars. This is the deterministic guarantee that
- * the commitlint `subject-case` + `scope-enum` rules pass.
- */
-export declare function normalizeSubject(raw: string, scopes?: string[]): string;
-/** A safe branch name `type/slug` derived from a conventional subject. */
-export declare function slugifyBranch(subject: string): string;
-/** Assemble a structured PR body: what changed · why · verification. */
-export declare function assembleBody(parts: {
-    what: string;
-    why?: string;
-    verification?: string;
-}): string;
-/**
- * Build the publish content deterministically (used by the `create_pull_request`
- * tool, where the agent itself authored the title/body). Missing fields are
- * derived; every field is still normalized + redacted.
- */
-export declare function fillContent(input: GenerateInput): GeneratedContent;
-/**
- * Generate publish content from the diff with the model, honoring the commit
- * rules, then normalize + redact. Resilient: if the model's reply isn't the
- * expected JSON, the first line becomes the subject and the rest the body.
- */
-export declare function generateWithLlm(provider: Provider, input: GenerateInput, opts?: {
-    model?: string;
-}): Promise<GeneratedContent>;
-interface ParsedGenerated {
-    branchName?: string;
-    commitSubject?: string;
-    commitBody?: string;
-    prTitle?: string;
-    prBody?: string;
-}
-/** Parse the model reply: a JSON object if present, else first-line/rest. */
-export declare function parseGenerated(text: string): ParsedGenerated;
-export {};

package/dist/vcs/git.d.ts

@@ -1,60 +0,0 @@
-export interface GitResult {
-    readonly ok: boolean;
-    readonly stdout: string;
-    readonly stderr: string;
-    readonly code: number | null;
-}
-/** Run `git <args>` in `cwd`, capturing stdout/stderr/exit. Never throws. */
-export declare function runGitCapture(args: string[], cwd: string): GitResult;
-/**
- * The absolute path of the git working tree that contains `cwd` (its
- * `--show-toplevel`), or `null` when `cwd` is not inside a git repository. Git
- * returns a canonical (symlink-resolved) path. Used by the C.26 cross-root guard
- * to detect two declared roots that share one repository (a commit for one would
- * `git add -A` the other's changes too).
- */
-export declare function gitToplevel(cwd: string): string | null;
-/** The current branch name, or `null` when detached / not a repo. */
-export declare function currentBranch(cwd: string): string | null;
-/** The default set of branch names cruxy will never write to directly. */
-export declare const DEFAULT_PROTECTED_BRANCHES: readonly ["main", "master"];
-/**
- * Is `branch` protected? The built-in `main`/`master` plus any names from config.
- * Case-insensitive so `Main`/`MASTER` are caught too.
- */
-export declare function isProtectedBranch(branch: string, extra?: readonly string[]): boolean;
-export interface EnsureBranchResult {
-    /** The branch we ended up on (always a non-protected branch). */
-    readonly branch: string;
-    /** Whether we created/switched (true) or were already on a feature branch. */
-    readonly switched: boolean;
-}
-/**
- * Guarantee we're on a non-protected feature branch before any commit/push. If
- * already on a feature branch, stay there. If on a protected branch, switch to
- * `desired` (creating it if needed). Throws if `desired` is itself protected.
- */
-export declare function ensureFeatureBranch(cwd: string, desired: string, protectedExtra?: readonly string[]): EnsureBranchResult;
-/** Stage every change in the working tree (`git add -A`). */
-export declare function stageAll(cwd: string): void;
-/** Whether the working tree (staged or not) has any changes to commit. */
-export declare function hasChanges(cwd: string): boolean;
-/**
- * Commit the staged changes with a conventional message. Refuses on a protected
- * branch (last-line guard) and **never** passes `--no-verify`, so the commitlint
- * `commit-msg` hook runs. Subject and body go as separate `-m` flags.
- */
-export declare function commit(cwd: string, subject: string, body: string, protectedExtra?: readonly string[]): void;
-/**
- * Push `branch` to `origin`, setting upstream. **Never** `--force`, **never**
- * `--no-verify` — the pre-push hook (build · typecheck · lint · test + main
- * guard) runs and a failure is surfaced verbatim. Refuses on a protected branch.
- */
-export declare function push(cwd: string, branch: string, protectedExtra?: readonly string[]): void;
-/**
- * The change set for content generation: the working-tree diff relative to
- * `base` (covers committed-on-branch *and* uncommitted edits), plus the names of
- * untracked files (which a plain `git diff` omits). Falls back to the diff vs
- * `HEAD` when `base` isn't reachable (shallow clone / brand-new repo).
- */
-export declare function diffAgainst(cwd: string, base: string): string;

package/dist/vcs/github.d.ts

@@ -1,50 +0,0 @@
-import type { ForgeProvider, PullRequestResult, PullRequestSpec, RepoIdentity, RepoInfo } from "./types.js";
-/**
- * GitHub implementation of {@link ForgeProvider} (C.15) — the only forge that
- * ships today. It talks to the REST API directly (no octokit dependency) and
- * keeps `fetch` injectable for tests. Everything GitHub-specific lives here;
- * nothing above {@link ForgeProvider} knows it's GitHub.
- */
-export interface GitHubProviderOptions {
-    /** The resolved forge token (see `auth.ts`). */
-    token: string;
-    /** Injected fetch (tests / advanced); defaults to global `fetch`. */
-    fetchImpl?: typeof fetch;
-}
-export declare class GitHubProvider implements ForgeProvider {
-    readonly id = "github";
-    private readonly token;
-    private readonly fetchImpl;
-    constructor(opts: GitHubProviderOptions);
-    /**
-     * The LOCAL half of {@link getRepoInfo}: read `origin` and parse it, no network.
-     * Shared by the full lookup and by the Step-4 wrong-repo re-check so both derive
-     * the target from the exact same rule.
-     */
-    resolveRepoIdentity(cwd: string): RepoIdentity;
-    getRepoInfo(cwd: string): Promise<RepoInfo>;
-    createPullRequest(repo: RepoInfo, spec: PullRequestSpec): Promise<PullRequestResult>;
-    /** Look up an open PR for `owner:head`, or `null` if there isn't one. */
-    private findOpenPr;
-    private fetchDefaultBranch;
-    /** Issue an authenticated REST call, resolving the API base from the host. */
-    private api;
-}
-/**
- * Parse a git remote URL into `{ host, owner, repo }`, supporting the https,
- * `scp`-style ssh, and `ssh://` forms. Returns `null` for anything we can't
- * confidently parse as `host/owner/repo`.
- */
-export declare function parseRemote(url: string): {
-    host: string;
-    owner: string;
-    repo: string;
-} | null;
-/**
- * Construct the forge provider for a token. GitHub today; the GitLab/Bitbucket
- * branch slots in here later (e.g. switch on a configured provider id) without
- * touching the orchestrator.
- */
-export declare function createForgeProvider(token: string, opts?: {
-    fetchImpl?: typeof fetch;
-}): ForgeProvider;

package/dist/vcs/guidance.d.ts

@@ -1,20 +0,0 @@
-/**
- * The repo's commit conventions, gathered best-effort so PR generation honors
- * them automatically (C.15): the C.18 git-commit skill body and the commitlint
- * scope allow-list. Both are optional — a repo may have neither — so every lookup
- * degrades to a sensible empty default rather than failing the PR flow.
- */
-export interface CommitGuidance {
-    /** The git-commit SKILL.md body, embedded verbatim into the LLM prompt. */
-    skillBody?: string;
-    /** commitlint `scope-enum` values; empty ⇒ no scope constraint. */
-    scopes: string[];
-}
-/** Load the git-commit skill body + commitlint scopes for `cwd`. Never throws. */
-export declare function loadCommitGuidance(cwd: string): Promise<CommitGuidance>;
-/**
- * Extract the `scope-enum` allow-list from a repo's commitlint config. Supports
- * the JS/CJS module forms (imported) and JSON. Any failure ⇒ `[]` (no
- * constraint), so a malformed or absent config never blocks a PR.
- */
-export declare function loadCommitlintScopes(cwd: string): Promise<string[]>;

package/dist/vcs/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./types.js";
-export * from "./git.js";
-export * from "./github.js";
-export * from "./auth.js";
-export * from "./generate.js";
-export * from "./guidance.js";
-export * from "./service.js";

package/dist/vcs/service.d.ts

@@ -1,61 +0,0 @@
-import type { ApprovalDecision } from "../approval/types.js";
-import type { CruxyConfig } from "../config/index.js";
-import type { ApproveAction } from "../tools/types.js";
-import type { ForgeProvider, GeneratedContent } from "./types.js";
-/**
- * The PR-publish orchestrator (C.15): ensure a feature branch → commit → push →
- * open PR, with the **entire** plan gated by one U.3 approval. Nothing mutates
- * before the user approves; a rejection aborts cleanly with no commit or push.
- *
- * The forge and the content generator are injected, so both call sites — the
- * `create_pull_request` tool (deterministic fill) and the `cruxy pr` command
- * (LLM generation) — share this exact flow.
- */
-/** Produce the publish content for a change set (LLM or deterministic). */
-export type GenerateContent = (input: {
-    diff: string;
-    base: string;
-    currentBranch?: string;
-    title?: string;
-    body?: string;
-}) => Promise<GeneratedContent>;
-export interface PrServiceDeps {
-    cwd: string;
-    /**
-     * The name of the declared workspace root this PR acts in (C.26 Step 4). It is
-     * the exact root the caller selected — the U.3 attribution and the wrong-repo
-     * error name it verbatim, rather than re-deriving a basename from `cwd`. Defaults
-     * to `basename(cwd)` for callers that don't select a root (the single-root `cruxy
-     * pr` command), which is byte-identical to the pre-Step-4 attribution.
-     */
-    rootName?: string;
-    config: CruxyConfig;
-    forge: ForgeProvider;
-    generate: GenerateContent;
-    /** The U.3 gate (the same capability tools receive as `ctx.requestApproval`). */
-    requestApproval: (action: ApproveAction) => Promise<ApprovalDecision>;
-}
-export interface OpenPrOptions {
-    /** Override the base branch (else config.git.defaultBase → repo default → main). */
-    base?: string;
-    /** Caller-supplied PR title (normalized, not generated). */
-    title?: string;
-    /** Caller-supplied PR body. */
-    body?: string;
-    draft?: boolean;
-}
-export type OpenPrOutcome = {
-    approved: false;
-    feedback?: string;
-} | {
-    approved: true;
-    url: string;
-    number: number;
-    branch: string;
-    base: string;
-    alreadyExists: boolean;
-};
-/** Build a PR service from its dependencies. */
-export declare function createPrService(deps: PrServiceDeps): {
-    openPullRequest: (opts?: OpenPrOptions) => Promise<OpenPrOutcome>;
-};

package/dist/vcs/types.d.ts

@@ -1,73 +0,0 @@
-/**
- * Version-control / forge types for PR generation (C.15). The {@link ForgeProvider}
- * interface is the swap seam — GitHub ships first, GitLab/Bitbucket slot in later
- * without touching call sites (same discipline as `VectorStore`/`Embedder`).
- */
-/**
- * The forge-target identity parsed from the `origin` remote — just host/owner/repo,
- * no network lookup. This is the value the C.26 Step-4 wrong-repo guard compares
- * across the preview→API-call window (see {@link ForgeProvider.resolveRepoIdentity}).
- */
-export interface RepoIdentity {
-    /** Forge host, e.g. `github.com`. */
-    readonly host: string;
-    /** Repository owner (user or org). */
-    readonly owner: string;
-    /** Repository name (no `.git` suffix). */
-    readonly repo: string;
-}
-/** Where a repository lives and who owns it, parsed from the `origin` remote. */
-export interface RepoInfo extends RepoIdentity {
-    /** Default branch, when the provider can resolve it (PR base fallback). */
-    readonly defaultBranch?: string;
-}
-/** Everything needed to open one pull request. */
-export interface PullRequestSpec {
-    readonly title: string;
-    readonly body: string;
-    /** The branch carrying the change. */
-    readonly head: string;
-    /** The branch to merge into. */
-    readonly base: string;
-    readonly draft?: boolean;
-}
-/** The outcome of opening (or finding an already-open) pull request. */
-export interface PullRequestResult {
-    readonly url: string;
-    readonly number: number;
-    /** True when a PR for this head already existed and we returned it. */
-    readonly alreadyExists: boolean;
-}
-/**
- * An abstract forge. The orchestrator depends only on this; the concrete
- * GitHub/GitLab implementation is chosen by {@link createForgeProvider}.
- */
-export interface ForgeProvider {
-    /** Stable id, e.g. `"github"`. */
-    readonly id: string;
-    /** Parse the repository's `origin` remote into structured {@link RepoInfo}. */
-    getRepoInfo(cwd: string): Promise<RepoInfo>;
-    /**
-     * Re-parse just the `origin` remote's {@link RepoIdentity} — LOCAL only, no
-     * network. The C.26 Step-4 wrong-repo guard calls this immediately before the
-     * pull-request API call and compares it against the identity shown at approval;
-     * a mismatch (a mid-run `git remote set-url`) refuses the PR. It stays local so
-     * the re-check is cheap and cannot fail on a network hiccup. Throws the same
-     * coded usage errors as {@link getRepoInfo} when there is no parseable `origin`.
-     */
-    resolveRepoIdentity(cwd: string): RepoIdentity;
-    /** Open a pull request and return its URL (idempotent on already-exists). */
-    createPullRequest(repo: RepoInfo, spec: PullRequestSpec): Promise<PullRequestResult>;
-}
-/**
- * The full set of fields a PR publish needs, produced by `generate.ts`. The
- * commit subject and PR title are the same conventional-commit line; the bodies
- * may differ (the PR body is the richer, structured summary).
- */
-export interface GeneratedContent {
-    readonly branchName: string;
-    readonly commitSubject: string;
-    readonly commitBody: string;
-    readonly prTitle: string;
-    readonly prBody: string;
-}

package/dist/web/demarcate.d.ts

@@ -1,13 +0,0 @@
-import type { SearchResult } from "./types.js";
-/**
- * Wrap a list of already-bounded search results as untrusted data for the model.
- * Each field (title/url/snippet) is sanitized; the whole block is fenced so the
- * model treats it as reference data, never commands.
- */
-export declare function demarcateSearchResults(query: string, results: SearchResult[]): string;
-/**
- * Wrap a fetched page's text as untrusted data for the model. Same discipline as
- * search results: sanitized, fence-neutralized, and clearly boxed as data. The
- * caller passes the FINAL url (post-redirect) and any truncation note.
- */
-export declare function demarcatePage(url: string, rawText: string, note?: string): string;

package/dist/web/fetch.d.ts

@@ -1,11 +0,0 @@
-import type { FetchResult, WebConfig, WebDeps } from "./types.js";
-/**
- * Fetch one URL as text, enforcing every bound. Returns a {@link FetchResult}.
- * Throws {@link webBlockedHost} for an SSRF-refused URL (never dispatched),
- * {@link webFetchFailed} for a network error / timeout / non-text or over-redirect
- * response. A page fetched successfully but empty of text is a valid result with
- * empty `text` (the tool surfaces it as `ok:true`, not an error).
- */
-export declare function fetchUrl(rawUrl: string, config: WebConfig, deps?: WebDeps): Promise<FetchResult>;
-/** Fetch a URL and render it as a demarcated, scrubbed, untrusted-data block. */
-export declare function runWebFetch(rawUrl: string, config: WebConfig, deps?: WebDeps): Promise<string>;

package/dist/web/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./types.js";
-export * from "./provider.js";
-export * from "./search.js";
-export * from "./fetch.js";
-export * from "./ssrf.js";
-export * from "./demarcate.js";
-export * from "./tools.js";

package/dist/web/provider.d.ts

@@ -1,29 +0,0 @@
-import type { SearchProvider, SearchResult, WebConfig, WebDeps } from "./types.js";
-/**
- * Search-provider seam (C.20). `createSearchProvider` resolves the configured
- * backend and its API key. There is no gateway search endpoint today (the SDK
- * Provider only streams chat), so the direct Tavily provider sits behind the seam;
- * a gateway-backed provider would slot in here with no change to the tools.
- *
- * A missing key or unknown provider throws {@link webUnavailable} — a coded,
- * actionable failure, NEVER a silent empty result (the honesty rule: "no provider"
- * must not read as "no results").
- */
-export declare function createSearchProvider(config: WebConfig, deps?: WebDeps): SearchProvider;
-/**
- * Tavily direct provider. The API key travels ONLY in the `Authorization` header
- * (never in the query text or URL, never logged), so the outbound query carries no
- * secret. Any non-2xx / network / timeout outcome becomes a thrown
- * {@link webSearchFailed}; an empty `results` array is a legitimate zero-result
- * outcome and is returned as `[]` (the tool renders "no results" as `ok:true`).
- */
-export declare class TavilyProvider implements SearchProvider {
-    private readonly apiKey;
-    private readonly fetchImpl;
-    readonly name = "tavily";
-    constructor(apiKey: string, fetchImpl: typeof fetch);
-    search(query: string, opts: {
-        maxResults: number;
-        signal: AbortSignal;
-    }): Promise<SearchResult[]>;
-}

package/dist/web/search.d.ts

@@ -1,17 +0,0 @@
-import type { SearchResult, WebConfig, WebDeps } from "./types.js";
-/**
- * Apply the top-N and per-snippet caps. The provider is asked for `maxResults`,
- * but we re-cap defensively (a provider may over-return) and truncate each snippet
- * with a visible marker so a long body can't blow the context budget.
- */
-export declare function boundResults(results: SearchResult[], config: WebConfig): SearchResult[];
-/**
- * Run one web search and return the demarcated, bounded, scrubbed result block.
- *
- * Throws coded errors for the two failure modes the caller must NOT collapse into
- * an empty result: {@link webUnavailable} (no provider/key — via
- * `createSearchProvider`) and {@link webSearchFailed} (the search errored — via the
- * provider). A search that runs and finds nothing returns a demarcated "(no
- * results)" block — an ordinary success the tool surfaces as `ok:true`.
- */
-export declare function runWebSearch(query: string, config: WebConfig, deps?: WebDeps): Promise<string>;

package/dist/web/ssrf.d.ts

@@ -1,41 +0,0 @@
-import { type Dispatcher } from "undici";
-import type { HostResolver } from "./types.js";
-/**
- * SSRF guard (C.20). A URL the MODEL chose must not be able to reach the user's
- * internal network, cloud metadata service, or loopback interface. Three layers:
- *
- * 1. Scheme allowlist — only `http`/`https` (blocks `file:`, `data:`, `gopher:`…).
- * 2. Address check — the hostname is RESOLVED and every returned address is
- *    checked against private/loopback/link-local/reserved ranges (v4 and v6,
- *    including IPv4-mapped and alternate IP encodings).
- * 3. Connection pinning — the connection is pinned to the exact address the check
- *    validated (see {@link createPinnedDispatcher}). Without this, resolving-then-
- *    fetching re-resolves the hostname at connect time, so a DNS-rebind attacker
- *    can pass the check with a public IP and have the socket land on 127.0.0.1
- *    (a TOCTOU hole). Pinning closes it: the connection can only reach a validated
- *    address, and the host header / TLS SNI still carry the original hostname.
- *
- * The check runs BEFORE any request is dispatched, and again on every redirect hop
- * (see fetch.ts). A block is a security refusal, distinct from a network failure.
- *
- * The IP range math, the pin shim, and the error types now live in the shared
- * {@link ../net/ip-guard ip-guard} module (JC-A) — the ONE owner of "is this IP
- * allowed"; this file keeps only the web-specific policy (scheme + the
- * `allowPrivateHosts` escape hatch) and the web one-shot dispatcher.
- */
-export { BlockedHostError, HostUnresolvedError, isBlockedAddress, defaultResolveHost, pinnedLookup, } from "../net/ip-guard.js";
-/** An undici dispatcher whose connections are pinned to `addresses`. */
-export declare function createPinnedDispatcher(addresses: string[]): Dispatcher;
-/**
- * Assert that `url` may be fetched and return the validated addresses to pin the
- * connection to. Throws {@link BlockedHostError} for a bad scheme or a host
- * resolving into a blocked range, or `HostUnresolvedError` if the host cannot be
- * resolved.
- *
- * The returned list is the exact set of addresses the caller must restrict the
- * connection to (via {@link createPinnedDispatcher}). An empty list means "do not
- * pin" — only returned under `allowPrivate`, the deliberate internal-network escape
- * hatch (from `web.allowPrivateHosts`), which bypasses the address check and lets
- * the transport resolve normally. The scheme check always applies.
- */
-export declare function assertFetchable(url: URL, resolveHost: HostResolver, allowPrivate: boolean): Promise<string[]>;

package/dist/web/tools.d.ts

@@ -1,20 +0,0 @@
-import { z } from "zod";
-import type { Tool } from "../tools/types.js";
-import type { WebDeps } from "./types.js";
-declare const searchParams: z.ZodObject<{
-    query: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    query: string;
-}, {
-    query: string;
-}>;
-export declare function createWebSearchTool(deps?: WebDeps): Tool<typeof searchParams>;
-declare const fetchParams: z.ZodObject<{
-    url: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    url: string;
-}, {
-    url: string;
-}>;
-export declare function createWebFetchTool(deps?: WebDeps): Tool<typeof fetchParams>;
-export {};

package/dist/web/types.d.ts

@@ -1,64 +0,0 @@
-import type { HostResolver } from "../net/ip-guard.js";
-import type { WebConfig } from "../config/index.js";
-/**
- * Web subtool seams + shapes (C.20). Everything the `web_search`/`web_fetch`
- * tools touch is defined here so the injectable dependencies (HTTP, DNS) have one
- * home and tests can substitute them without patching globals.
- */
-/** One ranked search hit — the only fields we surface to the model. */
-export interface SearchResult {
-    title: string;
-    url: string;
-    snippet: string;
-}
-/** The outcome of reading a single URL as text. */
-export interface FetchResult {
-    /** The final URL actually read (after any followed, re-validated redirects). */
-    url: string;
-    /** The response's declared content type (lower-cased, params stripped). */
-    contentType: string;
-    /** The decoded, size-capped body text. */
-    text: string;
-    /** True when the body was truncated at the byte cap. */
-    truncated: boolean;
-}
-/**
- * The swappable search backend. A direct provider (Tavily) implements this today;
- * a gateway-backed provider would implement the SAME interface if the backend ever
- * proxies search. Implementations translate provider errors into thrown
- * {@link CruxyError}s (never a silent empty) — the tool layer owns the honesty
- * split between "search failed" and "search found nothing".
- */
-export interface SearchProvider {
-    /** Stable id for logging/tests (e.g. "tavily"). */
-    readonly name: string;
-    /**
-     * Run one query. Returns the provider's results (the tool applies the top-N and
-     * snippet caps). Throws on provider/network/timeout failure. An empty array is a
-     * legitimate "no results" — NOT an error.
-     */
-    search(query: string, opts: {
-        maxResults: number;
-        signal: AbortSignal;
-    }): Promise<SearchResult[]>;
-}
-/**
- * Resolve a hostname to its IP addresses. Injected so the SSRF guard can be tested
- * deterministically (a hostname that "resolves" to an internal IP) without real
- * DNS. Owned by the shared {@link ../net/ip-guard ip-guard} module (JC-A) and
- * re-exported here for web importers.
- */
-export type { HostResolver } from "../net/ip-guard.js";
-/**
- * Injectable dependencies for the web tools. Defaults wire the real `fetch` and
- * DNS; tests pass spies/fakes. No global is ever patched.
- */
-export interface WebDeps {
-    /** HTTP transport (default: global `fetch`). */
-    fetchImpl?: typeof fetch;
-    /** DNS resolver used by the SSRF guard (default: `dns.lookup`, all addresses). */
-    resolveHost?: HostResolver;
-    /** Read the provider API key from the environment (default: `process.env`). */
-    env?: NodeJS.ProcessEnv;
-}
-export type { WebConfig };

package/dist/workspace/add-root.d.ts

@@ -1,27 +0,0 @@
-import type { RootSpec } from "./types.js";
-import { Workspace } from "./workspace.js";
-/**
- * The interactive add-root path (C.26 step 5). Adding a workspace root is an
- * EXPLICIT HUMAN act — it grows the trust surface (a new root can carry its own
- * hooks / MCP / project memory), so it is:
- *
- *   - reachable ONLY from the REPL command and the CLI, never as a model tool.
- *     The model can act only through the tool registry (`registry.get(name)`),
- *     and no tool is registered for this — the allowlist argument is unchanged.
- *   - TTY-only: refused (coded) when there is no interactive human to vouch.
- *   - held to the SAME validation as `--root`: the new root must exist, be a
- *     directory, have a unique name, and NOT nest/overlap an existing root
- *     (CRUXY_E_ROOT_OVERLAP) — reusing {@link buildWorkspace}, the single
- *     Workspace constructor from user input.
- *
- * Returns the NEW immutable Workspace (the root set only ever grows by
- * constructing a new one). A freshly added root starts UNTRUSTED; its hooks and
- * project memory stay inert until explicitly trusted.
- */
-export interface AddRootOptions {
-    /** Base dir for resolving a relative `path` (the session's primary root). */
-    cwd: string;
-    /** Whether stdin is a TTY — add-root is refused without an interactive human. */
-    tty: boolean;
-}
-export declare function addRootToWorkspace(current: Workspace, spec: RootSpec, opts: AddRootOptions): Promise<Workspace>;