@cruxy/cli 1.0.3 → 1.0.4

package/dist/render/types.d.ts

@@ -1,201 +0,0 @@
-import type { ActionPreview } from "../tools/types.js";
-import type { Theme } from "../theme/index.js";
-/**
- * The streaming render seam (U.2): the agent loop talks to a
- * {@link StreamRenderer}, never to raw stdout. Two implementations exist —
- * `TtyRenderer` (managed one-line live region, append-only committed content)
- * and `PlainRenderer` (append-only, zero ANSI) — picked by the factory from
- * detected {@link RenderCapabilities}. Same swappable discipline as
- * `Formatter`/`VectorStore`.
- */
-/**
- * What the output medium supports, detected once at construction (see
- * `detectCapabilities`). Renderers and the factory key off these flags; nothing
- * downstream re-probes the environment.
- */
-export interface RenderCapabilities {
-    /** The primary output stream is a terminal. */
-    tty: boolean;
-    /** Emit ANSI color (NO_COLOR / FORCE_COLOR / TTY resolved; `TERM=dumb` → false). */
-    color: boolean;
-    /** Cursor-control sequences are safe (`tty` and not `TERM=dumb`). */
-    cursor: boolean;
-    /** Animation is welcome (`cursor` and motion is not reduced). */
-    spinner: boolean;
-    /**
-     * Motion is reduced (U.11): no spinner animation/timer, no in-place
-     * re-animation — state survives as static text, only movement stops. True
-     * under `CRUXY_NO_SPINNER` (alias) / `NO_MOTION` / `CRUXY_REDUCED_MOTION`, and
-     * implied by `screenReader`. The one axis the spinner gate keys off.
-     */
-    reducedMotion: boolean;
-    /**
-     * Screen-reader mode (U.11): plain, linear, announce-friendly output — no
-     * live-region redraws (each state change is a committed line), no spinners,
-     * status glyphs rendered as words. Opt-in via `CRUXY_SCREEN_READER` /
-     * `ACCESSIBLE`; routes rendering to the linear path regardless of `cursor`.
-     */
-    screenReader: boolean;
-    /** Unicode glyphs are safe (U.1) — false under `TERM=dumb` / `CRUXY_ASCII`;
-     * independent of `color`. Drives the theme's glyph table, not its stylers. */
-    unicode: boolean;
-    /**
-     * Terminal columns (U.12) — the ONE width source every surface reads; 80 when
-     * unknown (non-TTY / no `columns`). Honors `COLUMNS` when set. Mutated in
-     * place on resize (see {@link onResize}), so a surface reading it after a
-     * SIGWINCH sees the new width without re-probing anything.
-     */
-    width: number;
-    /**
-     * Subscribe to width changes (U.12): the SIGWINCH push signal for the live
-     * region / transient frames to reflow at the new width. The listener fires
-     * with the new width AFTER {@link width} has been updated; the returned
-     * function unsubscribes. Absent when the stream cannot resize (non-TTY / no
-     * `columns`) — those surfaces just read the static {@link width}. Committed
-     * output is never re-rendered from here; only live surfaces subscribe.
-     */
-    onResize?(listener: (width: number) => void): () => void;
-}
-/** Accumulated token usage the loop already tracks (U.4) — never fabricated. */
-export interface TokenUsage {
-    input: number;
-    output: number;
-}
-/**
- * Semantic live-state phases (U.4). The loop and the approval seam emit these
- * instead of format strings; renderers decide presentation per capability.
- * One phase is live at a time — it is a register, not a queue.
- */
-export type RenderPhase = 
-/**
- * Waiting on the model. `tokens` = usage accumulated so far, omitted at 0.
- * `tier` = the routing tier this turn runs on (C.30), shown only when routing
- * is active — an honest signal of the real tier, never a fabricated one, and
- * always a tier name (never an upstream model id, U.8).
- */
-{
-    kind: "thinking";
-    tokens?: TokenUsage;
-    tier?: string;
-}
-/** A tool call is executing; `label` is the human form ("read_file src/x.ts"). */
- | {
-    kind: "calling-tool";
-    label: string;
-}
-/** An interactive prompt owns the terminal — the live line must yield to it. */
- | {
-    kind: "awaiting-approval";
-}
-/** A plan step is active but the model is not yet engaged (C.31). */
- | {
-    kind: "executing-step";
-}
-/** A subagent is running its task (C.14); `label` is the (truncated) task. */
- | {
-    kind: "subagent";
-    label: string;
-};
-/**
- * Plan-mode step progress (U.4/C.31): rendered as a persistent `[i/n] title`
- * prefix on the live line. A separate register from {@link RenderPhase} with a
- * separate owner (the plan executor), so `endTurn` clearing the loop's phase
- * can never wipe step context mid-step.
- */
-export interface ProgressState {
-    step: number;
-    of: number;
-    title: string;
-}
-/**
- * Tool-call lifecycle (U.4): `start` paints live state and starts the honest
- * elapsed clock; `end` commits the `✓/✗` trail note (with a duration suffix
- * when the measured start→end gap crossed the threshold — never estimated).
- */
-export type ToolLifecycleEvent = {
-    event: "start";
-    label: string;
-} | {
-    event: "end";
-    label: string;
-    ok: boolean;
-};
-/**
- * How the agent loop paints a turn. The contract that keeps output flicker-free:
- *
- * - **Committed content is append-only.** `write`/`note`/`preview` output is
- *   never repainted, moved, or cleared.
- * - **Transient state is one line.** `status` owns a single live line that is
- *   redrawn in place and erased before any committed write lands.
- *
- * Call shape per user turn: `beginTurn` → per model turn: `write`* +
- * `endSegment`, with `status`/`note`/`preview` between segments → `endTurn`.
- * All methods must be safe to call in any environment — degradation is the
- * implementation's job, not the caller's.
- */
-export interface StreamRenderer {
-    readonly caps: RenderCapabilities;
-    /** The one resolved design system (U.1) — glyphs/roles for chrome a
-     * surface emits through this renderer (e.g. the subagent trail notes). */
-    readonly theme: Theme;
-    /** Start a user turn: reset leading-newline trim and code-fence state. */
-    beginTurn(): void;
-    /**
-     * Append streamed assistant text. Must forward promptly — implementations may
-     * hold back at most the current line (for fence detection), never the block
-     * or the response. Dismisses any live status first.
-     */
-    write(delta: string): void;
-    /**
-     * Close one model-turn text segment: flush any held partial line / open
-     * fence and terminate with a single newline (only if the segment produced
-     * visible text), so whatever follows starts on its own line.
-     */
-    endSegment(): void;
-    /** A committed one-line chrome note (e.g. `✓ read_file src/x.ts`), dim when colored. */
-    note(text: string): void;
-    /** A committed diff/action preview, rendered by the shared diff renderer. */
-    preview(preview: ActionPreview): void;
-    /**
-     * Replace the transient status line ("thinking…", "running bash…"); `null`
-     * clears it. Where in-place updates are impossible this may drop the text —
-     * status is progress decor, never information of record (use `note` for that).
-     * Ad-hoc/legacy; production callers use the typed U.4 methods below.
-     */
-    status(text: string | null): void;
-    /**
-     * Set (or clear) the semantic live phase (U.4). Rendered into the same
-     * managed status line; `awaiting-approval` yields the line to the prompt.
-     * PlainRenderer drops phases — transient state has no meaning append-only.
-     */
-    setPhase(phase: RenderPhase | null): void;
-    /**
-     * Set (or clear) plan-step progress (U.4). Persists across phase changes and
-     * `endTurn` — only the plan executor clears it. Rendered as an `[i/n] title`
-     * prefix on the live line; dropped by PlainRenderer.
-     */
-    progress(state: ProgressState | null): void;
-    /**
-     * Tool-call lifecycle (U.4): `start` → live "label…" state (+ elapsed clock),
-     * `end` → the committed `✓/✗ label` note, with an honest duration suffix for
-     * long calls. Replaces the loop's ad-hoc status/note pair.
-     */
-    toolLifecycle(event: ToolLifecycleEvent): void;
-    /**
-     * The interactive prompt released the terminal (its key/line read resolved):
-     * the pair-closer for `awaiting-approval`. Restores the phase the prompt
-     * displaced — with its original clock, so a long tool call approved late
-     * still reports honest wall-time. No-op where there is no live region.
-     */
-    promptResolved(): void;
-    /** End the user turn: clear any status and the live phase (never progress), flush everything held. */
-    endTurn(): void;
-    /** Release resources (spinner timer). Further calls are no-ops. */
-    close(): void;
-}
-/** The minimal stream surface a renderer writes to. Injectable for tests. */
-export interface RenderStream {
-    isTTY?: boolean;
-    columns?: number;
-    write(text: string): unknown;
-}

package/dist/routing/index.d.ts

@@ -1,2 +0,0 @@
-export * from "./types.js";
-export { ConfigRouter, DEFAULT_TIER, routerForConfig, resolveTaskModel, } from "./router.js";

package/dist/routing/resolve.d.ts

@@ -1,17 +0,0 @@
-import type { Tier } from "./types.js";
-/**
- * Tier → gateway wire model-id. This is the SINGLE place the mapping lives, and
- * it is INTERNAL to the routing package (deliberately not re-exported from the
- * barrel) so it can never be called from a user-facing render path.
- *
- * For the Cruxy gateway a tier IS the wire model id — the gateway maps the tier
- * to a concrete upstream model SERVER-SIDE. So this returns the tier name
- * unchanged: the output is always a tier, and no upstream model name can
- * originate here. That property is what keeps the U.8 gag structural rather than
- * a filter — there is no upstream id in the process to leak (see the tier-gag
- * test, which asserts this output is always a MODEL_TIERS member).
- *
- * The seam exists for a future provider whose tiers map to distinct wire ids;
- * that mapping would live here and here only.
- */
-export declare function resolveModelId(tier: Tier): string;

package/dist/routing/router.d.ts

@@ -1,47 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import type { Router, RoutingConfig, TaskClass, Tier } from "./types.js";
-/**
- * The tier a config resolves to when nothing else pins one down — mirrors the
- * gateway's `auto` fallback (`AUTO_FALLBACK_TIER` in the SDK), so an unrouted
- * cruxy session lands on exactly the tier it does today.
- */
-export declare const DEFAULT_TIER: Tier;
-/**
- * The config-driven {@link Router}: maps a declared task class to a tier from
- * `{ default, map }`, and fails loud when the resolved tier is not offered. It
- * NEVER inspects prompt content — selection is purely `map[taskClass] ?? default`.
- */
-export declare class ConfigRouter implements Router {
-    private readonly cfg;
-    private readonly offered;
-    /**
-     * @param cfg      the resolved routing table (default tier + per-task map)
-     * @param offered  the tiers this gateway/plan actually provides; a resolved
-     *                 tier outside this set fails loud. Defaults to all tiers — the
-     *                 seam a future entitlement check narrows (never a silent
-     *                 downgrade).
-     */
-    constructor(cfg: RoutingConfig, offered?: Iterable<Tier>);
-    select(taskClass: TaskClass): Tier;
-}
-/**
- * Build a router from resolved config, or `null` when routing should stay
- * inert. Routing is:
- *
- * - a cruxy-gateway concept — tiers do not apply to BYO providers, so non-cruxy
- *   providers get `null` (no override, their `model.model` is used unchanged);
- * - opt-in — with no `routing.default` and an empty `routing.map`, this returns
- *   `null` so behavior (and the wire body, and the state line) is byte-identical
- *   to today. Multi-tier routing activates only once the user configures it.
- */
-export declare function routerForConfig(config: CruxyConfig): Router | null;
-/**
- * Resolve a declared task class to `{ tier, model }`: the tier for honest
- * surfacing (the U.4 state line), the wire model id for the request. The model
- * id comes from the internal {@link resolveModelId} — callers never touch that
- * mapping directly, so it stays the single source of truth.
- */
-export declare function resolveTaskModel(router: Router, taskClass: TaskClass): {
-    tier: Tier;
-    model: string;
-};

package/dist/routing/types.d.ts

@@ -1,42 +0,0 @@
-import { MODEL_TIERS } from "../brand/voice.js";
-/**
- * Multi-model routing (C.30): route each unit of work to the right tier instead
- * of running one model for everything. The caller DECLARES a {@link TaskClass}
- * at the call site; a {@link Router} maps that class to a {@link Tier} via config
- * — it never sniffs the prompt to guess difficulty. The tier→gateway model-id
- * mapping is internal (see `resolve.ts`); only tier names ever appear in config,
- * logs, errors, or the state line (the U.8 tier gag).
- */
-/**
- * The unit-of-work classes a caller can declare. Each is an explicit intent —
- * NOT a difficulty the router infers. Unknown/unset resolves to the router's
- * default tier, never a crash.
- */
-export declare const TASK_CLASSES: readonly ["main-turn", "subagent", "plan", "commit-msg", "classify", "summarize"];
-export type TaskClass = (typeof TASK_CLASSES)[number];
-/** A routing tier — the ONLY model vocabulary the user ever sees (U.8). */
-export type Tier = (typeof MODEL_TIERS)[number];
-/**
- * Selects a tier for a declared task class. Deliberately one method: the caller
- * passes intent, the router returns a tier from its configured mapping. No
- * prompt-content inspection, ever — difficulty detection is explicitly out of
- * scope (a caller declares; the router does not guess).
- */
-export interface Router {
-    /**
-     * Map a task class to its tier. Falls back to the configured default when the
-     * class has no explicit mapping; throws `CRUXY_E_ROUTING_TIER_UNAVAILABLE`
-     * (fail loud, never a silent substitution) when the resolved tier is not
-     * offered.
-     */
-    select(taskClass: TaskClass): Tier;
-}
-/**
- * The declarative routing table: a `default` tier plus per-task overrides. Lives
- * in config (`routing.default`, `routing.map`). An empty map means every class
- * resolves to `default` — a single tier, no traffic splitting.
- */
-export interface RoutingConfig {
-    default: Tier;
-    map: Partial<Record<TaskClass, Tier>>;
-}

package/dist/sandbox/detect.d.ts

@@ -1,22 +0,0 @@
-import type { SandboxCapability } from "./types.js";
-/**
- * Runtime detection (C.16): a container runtime is a *capability*, not an
- * assumption. Presence means both that the binary exists AND its daemon
- * answers — `docker` installed with a dead daemon is NOT available, and the
- * caller must fail loud rather than pretend a box exists.
- */
-/** Injectable probe seam — spawns a short command and reports how it exited. */
-export type RuntimeProbe = (bin: string, args: string[]) => Promise<{
-    code: number | null;
-    stdout: string;
-    stderr: string;
-}>;
-/**
- * Detect the Docker runtime. `docker version --format {{.Server.Version}}`
- * exits non-zero when the daemon is unreachable (even though the client is
- * installed), so a zero exit with a server version is the honest "available"
- * signal. Memoized for the process; pass a probe (tests) to bypass the cache.
- */
-export declare function detectDocker(probe?: RuntimeProbe): Promise<SandboxCapability>;
-/** Clear the memoized capability (tests). */
-export declare function resetDetectionCache(): void;

package/dist/sandbox/docker-runtime.d.ts

@@ -1,32 +0,0 @@
-import type { ExecOptions, ExecResult, IsolationPolicy, SandboxRuntime } from "./types.js";
-/**
- * The shipped {@link SandboxRuntime}: shells out to the `docker` CLI (no SDK —
- * matches the no-vendor-client ethos). {@link buildRunArgs} is a pure function
- * so the entire isolation posture can be asserted from the argv without a live
- * daemon; `exec` spawns docker, captures bias-capped output, enforces the
- * wall-clock timeout by force-killing the container, and maps the result.
- *
- * The exit code from `docker run` is the command's own — EXCEPT `125`, which
- * docker reserves for "the run itself failed" (bad flags, daemon error): that,
- * and a spawn failure, are the only container-start failures, surfaced as a
- * coded {@link sandboxExec} error. An ordinary non-zero command exit is a
- * normal result (exit code is truth), never a thrown error and never a host run.
- */
-export declare class DockerRuntime implements SandboxRuntime {
-    private readonly bin;
-    readonly name = "docker";
-    constructor(bin?: string);
-    ensureImage(image: string, onPull?: () => void): Promise<void>;
-    /** Run a non-container docker subcommand to completion, capturing output. */
-    private simpleRun;
-    exec(command: string, policy: IsolationPolicy, opts: ExecOptions): Promise<ExecResult>;
-    private run;
-    /** Best-effort container teardown after a timeout kill. */
-    private forceRemove;
-}
-/**
- * Build the `docker run` argv from a resolved policy. Pure and total — the
- * single source of truth for the isolation boundary, asserted directly in
- * tests. Order is stable for readability; docker is order-insensitive for flags.
- */
-export declare function buildRunArgs(policy: IsolationPolicy, container: string, command: string): string[];

package/dist/sandbox/index.d.ts

@@ -1,7 +0,0 @@
-export * from "./types.js";
-export { detectDocker, resetDetectionCache } from "./detect.js";
-export type { RuntimeProbe } from "./detect.js";
-export { DockerRuntime, buildRunArgs } from "./docker-runtime.js";
-export { buildPolicy } from "./policy.js";
-export { SandboxService } from "./service.js";
-export type { SandboxReporter, SandboxServiceDeps } from "./service.js";

package/dist/sandbox/policy.d.ts

@@ -1,26 +0,0 @@
-import type { SandboxConfig } from "../config/index.js";
-import type { IsolationPolicy } from "./types.js";
-/**
- * Turn a validated {@link SandboxConfig} + the run's cwd into a fully-resolved
- * {@link IsolationPolicy}. This is where the security posture is decided, and
- * every default here is deny/minimal:
- *
- * - the DEFAULT read-write mount is the command's own project workdir (at its
- *   identical absolute path, so paths stay coherent with the host and the C.32
- *   checkpoint);
- * - other declared roots in a multi-repo session (C.26, R5) are mounted READ-ONLY
- *   — readable for legit cross-repo builds, never writable unless an explicit
- *   per-command escalation names that root in `writableRoots`;
- * - extra mounts come solely from `sandbox.mounts` (explicit by construction),
- *   and a mount of the docker socket, the cruxy home, or the user's home root
- *   is rejected — those are the escape hatches we refuse to open;
- * - the container runs as the host's non-root uid:gid so mounted edits are
- *   writable and never left root-owned;
- * - network defaults to `none`; any widening can only come from explicit config.
- */
-export declare function buildPolicy(cfg: SandboxConfig, cwd: string, opts?: {
-    /** Absolute paths of the OTHER declared roots (this command's siblings). */
-    siblingRoots?: readonly string[];
-    /** Sibling roots that got an approved cross-root-write escalation (R5). */
-    writableRoots?: readonly string[];
-}): IsolationPolicy;

package/dist/sandbox/service.d.ts

@@ -1,64 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import type { ExecOptions, ExecResult, IsolationPolicy, SandboxCapability, SandboxRuntime } from "./types.js";
-/**
- * The minimal surface the sandbox needs to report a first-run image pull
- * through the U.4 state layer. `StreamRenderer` satisfies it structurally, so
- * callers pass the renderer directly and the sandbox stays render-decoupled.
- */
-export interface SandboxReporter {
-    status(text: string | null): void;
-}
-export interface SandboxServiceDeps {
-    config: CruxyConfig;
-    /** The command's own workspace root — mounted read-write as the workdir. */
-    cwd: string;
-    /** The OTHER declared roots in a multi-repo session (C.26, R5). Each is
-     * mounted READ-ONLY so cross-repo reads work but a command can't silently
-     * write a sibling. Empty/absent in a single-root session. */
-    siblingRoots?: readonly string[];
-    /** Sibling roots granted an approved cross-root-write escalation (R5): each
-     * named one flips to read-write, and ONLY that one — never blanket. */
-    writableRoots?: readonly string[];
-    /** Execution runtime seam (defaults to Docker). */
-    runtime?: SandboxRuntime;
-    /** Capability probe seam (defaults to real docker detection). */
-    detect?: () => Promise<SandboxCapability>;
-    /** U.4 sink for the "pulling sandbox image…" line (optional). */
-    reporter?: SandboxReporter;
-}
-/**
- * The sandbox execution service (C.16) — what `ToolContext.sandbox` points at.
- * It is only ever constructed when the sandbox is enabled, and constructing it
- * is where the fail-loud guarantee lives: {@link SandboxService.create} probes
- * the runtime and throws {@link sandboxUnavailable} if it isn't available, so a
- * user who asked for the box either gets the box or a loud, coded error — never
- * a silent drop back to host execution. `exec` then contains an approved
- * command inside the isolation policy, ensuring the image on first use.
- */
-export declare class SandboxService {
-    private readonly runtime;
-    private readonly policy;
-    private readonly reporter?;
-    private imageReady?;
-    private constructor();
-    /**
-     * Resolve the runtime and build the policy. THROWS {@link sandboxUnavailable}
-     * when the runtime is missing/unreachable — the caller (session wiring) lets
-     * it propagate so the run stops before any command executes. There is no code
-     * path from here to host execution.
-     */
-    static create(deps: SandboxServiceDeps): Promise<SandboxService>;
-    /** The runtime backing this service (e.g. "docker") — for logging. */
-    get runtimeName(): string;
-    /** The resolved isolation policy — exposed for logging/inspection. */
-    get isolationPolicy(): IsolationPolicy;
-    /**
-     * Execute an already-approved command inside the box. Ensures the image once
-     * (surfacing the pull via U.4), then delegates to the runtime. A container
-     * that fails to start throws a coded error; an ordinary non-zero command exit
-     * comes back as a normal {@link ExecResult} — exit code is truth.
-     */
-    exec(command: string, opts: ExecOptions): Promise<ExecResult>;
-    /** Ensure the image is present, at most once per service (memoized). */
-    private ensureImage;
-}

package/dist/sandbox/types.d.ts

@@ -1,123 +0,0 @@
-/**
- * Sandbox execution (C.16) — the isolation boundary beneath the U.3 gate.
- *
- * When the sandbox is enabled, the highest-risk tools (`run_command`,
- * `run_tests`) execute inside a container instead of directly on the host: the
- * project workdir is mounted so the agent edits real files, but the *process*
- * cannot reach the network, cannot touch the host beyond that mount, and cannot
- * exhaust the machine. Approval still gates every command (see U.3) — the
- * sandbox contains what an approved command is able to do; it does not replace
- * the decision to run it.
- *
- * Execution is abstracted behind {@link SandboxRuntime} (Docker ships; podman /
- * none slot in without touching call sites), and the neutral {@link ExecResult}
- * matches what host execution conceptually returns so `run_command`/`run_tests`
- * stay substrate-agnostic — exit code is the source of truth on either path.
- */
-/** Egress policy for the container. `none` is the default (deny all). */
-export type NetworkPolicy = "none" | "host-loopback" | "full";
-/** One resolved bind mount: an absolute host path exposed in the container. */
-export interface BindMount {
-    /** Absolute host path. */
-    readonly source: string;
-    /** Absolute container path (the workdir mount uses `source === target`). */
-    readonly target: string;
-    /** Read-only when true; the workdir mount is read-write. */
-    readonly readonly: boolean;
-}
-/**
- * A fully-resolved isolation policy — every knob the runtime needs, already
- * merged from config and validated. `docker-runtime` turns this (plus the
- * command) into an argv; nothing here is optional or defaulted downstream.
- */
-export interface IsolationPolicy {
-    /** Pinned base image the container runs (never chosen dynamically). */
-    readonly image: string;
-    /** Egress policy — `none` unless the user deliberately widened it. */
-    readonly network: NetworkPolicy;
-    /** Non-root `uid:gid` the container runs as (host uid, so mounts stay writable). */
-    readonly user: string;
-    /** Memory cap (`--memory`, also mirrored to `--memory-swap` to disable swap). */
-    readonly memory: string;
-    /** Process/thread cap (`--pids-limit`). */
-    readonly pids: number;
-    /** CPU cap (`--cpus`, fractional allowed). */
-    readonly cpus: number;
-    /** The command's OWN workspace root, mounted read-write at its absolute path. */
-    readonly workdir: BindMount;
-    /**
-     * The OTHER declared workspace roots in a multi-repo session (C.26, R5). Each
-     * is mounted **read-only** so a legit build can *read* a sibling (e.g. generated
-     * client types) — but never write it. A sibling flips to read-write ONLY when an
-     * explicit per-command cross-root-write escalation was approved for that exact
-     * root; ambient cross-root write authority is never the default. Empty in a
-     * single-root session (identical to the pre-C.26 posture).
-     */
-    readonly siblingRoots?: readonly BindMount[];
-    /** Extra explicit mounts beyond the workdir (from `sandbox.mounts`). */
-    readonly mounts: readonly BindMount[];
-    /** Writable in-memory tmp mount point; the rest of the root fs is read-only. */
-    readonly tmpfs: string;
-}
-/** Which end of the output to keep when the byte cap is exceeded. */
-export type CaptureBias = "head" | "tail";
-/** Per-exec bounds handed to a runtime. */
-export interface ExecOptions {
-    /** Host project directory → bind-mounted as the workdir (same absolute path). */
-    readonly cwd: string;
-    /** Wall-clock timeout in ms; overrun kills the container and returns a failure. */
-    readonly timeoutMs: number;
-    /** Cap on combined stdout+stderr bytes captured. */
-    readonly maxOutputBytes: number;
-    /**
-     * Head-bias keeps the start of the output (`run_command`); tail-bias keeps
-     * the end, where test runners print their failure summaries (`run_tests`).
-     */
-    readonly capture: CaptureBias;
-}
-/**
- * The neutral outcome of one sandboxed execution — the SAME shape host
- * execution conceptually produces, so both `run_command` and `run_tests` map it
- * to their own result type without caring which substrate ran the command.
- */
-export interface ExecResult {
-    /** Process exit code; `null` on a signal kill / timeout. Exit code is truth. */
-    readonly exitCode: number | null;
-    /** Combined stdout+stderr, already bias-capped to `maxOutputBytes`. */
-    readonly output: string;
-    /** True when output was dropped to honor the cap. */
-    readonly outputTruncated: boolean;
-    /** Measured wall-clock duration of the execution. */
-    readonly durationMs: number;
-    /** True when the wall-clock timeout fired and the container was killed. */
-    readonly timedOut: boolean;
-}
-/**
- * The swappable execution seam. Docker ships as {@link DockerRuntime}; a future
- * podman/other runtime implements this without touching the tools or service.
- * `exec` never falls back to the host and never throws for an ordinary non-zero
- * command exit — it throws only when the container itself cannot run (a coded
- * {@link CruxyError}), so the fail-loud guarantee is structural.
- */
-export interface SandboxRuntime {
-    /** Identifier surfaced in errors/logs (e.g. "docker"). */
-    readonly name: string;
-    /**
-     * Ensure `image` is present locally, pulling it if needed. `onPull` fires
-     * once, only if a pull actually starts (so callers can surface it via U.4).
-     * Throws a coded {@link CruxyError} on pull/build failure — never silently
-     * substitutes another image.
-     */
-    ensureImage(image: string, onPull?: () => void): Promise<void>;
-    /** Run `command` inside the box under `policy`, returning a neutral result. */
-    exec(command: string, policy: IsolationPolicy, opts: ExecOptions): Promise<ExecResult>;
-}
-/** Result of probing for a container runtime; presence is a capability. */
-export interface SandboxCapability {
-    /** True when the runtime binary exists AND its daemon is reachable. */
-    readonly available: boolean;
-    /** The runtime that was probed. */
-    readonly runtime: string;
-    /** Why it's unavailable (for the fail-loud error), when not available. */
-    readonly detail?: string;
-}

package/dist/skills/index.d.ts

@@ -1,4 +0,0 @@
-export * from "./types.js";
-export * from "./parser.js";
-export * from "./loader.js";
-export * from "./service.js";

package/dist/skills/loader.d.ts

@@ -1,43 +0,0 @@
-import { CruxyError } from "../errors/index.js";
-import { type Skill, type SkillCatalog, type SkillError, type SkillSource } from "./types.js";
-/** The three source directories the loader scans. */
-export interface LoaderSources {
-    /** `<cwd>/.cruxy/skills` */
-    project: string;
-    /** `~/.cruxy/skills` */
-    user: string;
-    /** `<pkg>/skills` (shipped). */
-    builtin: string;
-}
-/** A valid skill discovered in a source, before precedence is resolved. */
-interface SkillCandidate {
-    name: string;
-    description: string;
-    source: SkillSource;
-    dir: string;
-}
-/** Thrown by `getSkill` when no catalog entry matches the requested name. */
-export declare class SkillNotFoundError extends CruxyError {
-    constructor(message: string);
-}
-/**
- * Scan all three sources, validate every SKILL.md, and resolve precedence into a
- * {@link SkillCatalog}. Validation failures become {@link SkillError}s (excluded
- * from the catalog, surfaced in `cruxy skills --status`) rather than throwing —
- * one bad skill never breaks the rest.
- */
-export declare function loadCatalog(sources: LoaderSources): Promise<SkillCatalog>;
-/**
- * Resolve candidates into a catalog. Pure (no I/O) so precedence and collision
- * rules are directly testable. `candidates` must arrive in precedence order
- * (project first); the first occurrence of a name wins across sources, while a
- * second occurrence *within the same source* is a loud, excluded error.
- */
-export declare function resolvePrecedence(candidates: SkillCandidate[], baseErrors?: SkillError[]): SkillCatalog;
-/**
- * Read a skill's full body and resolve its asset paths on demand. The body is
- * re-read from disk every call (never cached), so edits are always live. Throws
- * {@link SkillNotFoundError} if `name` isn't in the catalog.
- */
-export declare function getSkill(catalog: SkillCatalog, name: string): Promise<Skill>;
-export {};