@cruxy/cli 1.0.3 → 1.0.4

package/dist/approval/prompt.d.ts

@@ -1,48 +0,0 @@
-import type { ApprovalRequest } from "./types.js";
-/**
- * The interactive prompt: render a pending action (a real diff for file edits,
- * the exact command + cwd for shell) and read a 4-way choice. Rendering is data
- * → string so it's testable; color is gated on `io.color` (NO_COLOR / non-TTY
- * aware). **Default-deny**: EOF / Ctrl-C / any unrecognized key → reject.
- *
- * Diff/preview rendering is the shared implementation in `render/diff.ts` —
- * the streaming path and this prompt draw the same bytes for the same change.
- */
-/** The four user choices (plus the implicit default-deny). */
-export type PromptChoice = {
-    kind: "once";
-} | {
-    kind: "session";
-} | {
-    kind: "reject";
-    reason?: string;
-} | {
-    kind: "instruct";
-    instruction: string;
-};
-/** I/O surface for the prompt — injectable so tests script the keys/lines. */
-export interface PromptIO {
-    write(text: string): void;
-    /** Read a single keypress; resolves "" on EOF / Ctrl-C. */
-    readKey(): Promise<string>;
-    /** Read one line (no trailing newline); resolves "" on EOF. */
-    readLine(): Promise<string>;
-    /** Whether to emit ANSI color. */
-    color: boolean;
-    /**
-     * Terminal columns (U.12). Optional so every existing PromptIO literal is
-     * unchanged; when absent the render resolves the width itself. Threaded so a
-     * narrow prompt reflows the command and never truncates the risk marker.
-     */
-    columns?: number;
-}
-/**
- * Render the action, read one key, and map it to a {@link PromptChoice}. `n`/`t`
- * read a follow-up line (reason / instruction). Anything else — including EOF —
- * is a reject.
- */
-export declare function promptForApproval(request: ApprovalRequest, io: PromptIO): Promise<PromptChoice>;
-/** Render the full prompt block: header, detail (diff or command+cwd), choices. */
-export declare function render(request: ApprovalRequest, color: boolean, columns?: number): string;
-/** Build the real PromptIO: prompt to stderr, read keys/lines from stdin. */
-export declare function defaultPromptIO(color: boolean): PromptIO;

package/dist/approval/service.d.ts

@@ -1,36 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-import { type PromptIO } from "./prompt.js";
-import type { ApprovalDecision, ApprovalPolicy } from "./types.js";
-/**
- * The approval gate, called by the tool layer **before any side effect**. It
- * classifies the action, lets read-only actions through, **throws
- * CRUXY_E_APPROVAL_REQUIRED when it can't ask** (non-interactive — default-deny,
- * never auto-approve), and otherwise defers to the policy. It owns the
- * per-session allowlist, so a new service ⇒ a fresh session.
- */
-export interface ApprovalServiceOptions {
-    /** Resolved project root the actions run in. */
-    cwd: string;
-    /** Whether cruxy can actually prompt (stdin is a TTY). */
-    interactive: boolean;
-    /** Override the decision policy (the seam — tests / a future CI policy). */
-    policy?: ApprovalPolicy;
-    /** Override the prompt I/O (tests script keys/lines). */
-    io?: PromptIO;
-}
-export declare class ApprovalService {
-    private readonly cwd;
-    private readonly interactive;
-    private readonly allowlist;
-    private readonly policy;
-    constructor(opts: ApprovalServiceOptions);
-    /**
-     * Decide whether `action` may proceed. Read-only ⇒ allow. Non-interactive ⇒
-     * throw {@link approvalRequired} (the U.5 error system, exit 10). Otherwise the
-     * policy prompts. A returned `{allow:false}` is a clean rejection (fed back to
-     * the agent), not an error.
-     */
-    requestApproval(action: ApproveAction): Promise<ApprovalDecision>;
-    /** Clear all session grants (a fresh session). */
-    resetSession(): void;
-}

package/dist/approval/types.d.ts

@@ -1,82 +0,0 @@
-import type { ApproveAction } from "../tools/types.js";
-/**
- * Types for the approval gate (U.3) — the security boundary between the agent
- * and side-effecting actions. The gate is **default-deny**: no response means
- * reject, never auto-approve.
- */
-/**
- * Risk classification for a pending action. Friction is reserved for what's
- * risky, so users don't rubber-stamp.
- * - `read` — read-only, auto-allowed (read tools bypass the gate entirely).
- * - `mutate` — reversible-ish mutation (file write/edit) → approve, normal style.
- * - `destructive` — irreversible / high blast radius (shell, delete) → approve,
- *   visually distinct. **Unknown actions classify here.**
- */
-export type RiskTier = "read" | "mutate" | "destructive";
-/**
- * The tight scope a session grant is keyed by. Never blanket.
- * - `shell-prefix` — a command's leading program token (e.g. `git`); only ever
- *   matches commands we can *positively* prove are simple (no shell features).
- *   **Bound to `root`** (C.26): a `git` grant in repo A never covers `git` in B.
- * - `shell-exact` — one exact command string, for `test` actions only (C.13):
- *   a grant covers re-runs of precisely that test command, nothing else.
- *   **Bound to `root`**: a `pnpm test` grant in A never covers B.
- * - `file-subtree` — an absolute directory (or, under the root-cap, an exact
- *   file path); matches targets that resolve inside it. Inherently root-safe —
- *   different roots are different absolute subtrees, so it needs no `root` field.
- * - `mcp-tool` — one exact MCP server+tool pair (C.27): a grant covers re-calls
- *   of precisely that tool on that server, and never any other MCP tool.
- *   **Bound to `root`**: the same server+tool in another root still prompts.
- * - `none` — nothing safe to grant (e.g. a multi-file patch spanning the root).
- */
-export type Scope = {
-    readonly kind: "shell-prefix";
-    readonly token: string;
-    readonly root: string;
-} | {
-    readonly kind: "shell-exact";
-    readonly command: string;
-    readonly root: string;
-} | {
-    readonly kind: "file-subtree";
-    readonly root: string;
-} | {
-    readonly kind: "mcp-tool";
-    readonly server: string;
-    readonly tool: string;
-    readonly root: string;
-} | {
-    readonly kind: "none";
-};
-/** A pending action, classified and ready to show / decide on. */
-export interface ApprovalRequest {
-    /** The raw tool action (kind, path/command, preview). */
-    readonly action: ApproveAction;
-    /** Risk classification. */
-    readonly tier: RiskTier;
-    /** The tight scope a session grant would use. */
-    readonly scope: Scope;
-    /** One plain line describing the action (e.g. "run: git status"). */
-    readonly summary: string;
-    /** Absolute resolved target paths for file actions; `[]` for shell. */
-    readonly targets: readonly string[];
-    /** Resolved project root the action runs in (shown as the shell cwd). */
-    readonly cwd: string;
-}
-/**
- * The gate's verdict. On reject, `feedback` (if any) is fed back to the agent as
- * the tool result so it can adapt — a rejection is data, not an error.
- */
-export type ApprovalDecision = {
-    readonly allow: true;
-} | {
-    readonly allow: false;
-    readonly feedback?: string;
-};
-/**
- * Pluggable decision strategy — the seam. Only `InteractivePolicy` ships in U.3;
- * a future non-interactive/CI policy slots in here without touching call sites.
- */
-export interface ApprovalPolicy {
-    decide(request: ApprovalRequest): Promise<ApprovalDecision>;
-}

package/dist/brand/index.d.ts

@@ -1 +0,0 @@
-export { CANONICAL_TERMS, FORBIDDEN_MODEL_NAMES, FORBIDDEN_TERMS, MODEL_NAME_PLACEHOLDER, MODEL_TIERS, PRODUCT_MASTHEAD, PRODUCT_NAME, PRODUCT_TAGLINE, scanForbidden, scrubModelNames, type ForbiddenTerm, type LexiconViolation, } from "./voice.js";

package/dist/brand/voice.d.ts

@@ -1,94 +0,0 @@
-/**
- * The cruxy brand voice (U.8) — a tiny living document, enforced by a test, not
- * vibes. It centralizes the product name/tagline, the canonical lexicon, and the
- * forbidden set (deprecated synonyms + the base-model gag) so every user-facing
- * surface reads as one product. Presentation/copy only — nothing here changes
- * behavior; the {@link scanForbidden} helper backs the lexicon test.
- *
- * Voice, in one breath: concise, direct, second-person for guidance,
- * lowercase-leaning for status, no marketing fluff, no exclamation-spam. The
- * product name is ALWAYS lowercase `cruxy`.
- */
-/** The product name — always lowercase, in running text, banners, and help. */
-export declare const PRODUCT_NAME = "cruxy";
-/** The one-line tagline (mirrors package.json's description). */
-export declare const PRODUCT_TAGLINE = "an agentic coding CLI";
-/** The `cruxy --help` / banner masthead: `cruxy — an agentic coding CLI`. */
-export declare const PRODUCT_MASTHEAD = "cruxy \u2014 an agentic coding CLI";
-/**
- * The ONLY model names cruxy ever shows a user. The upstream model powering a
- * tier is never named — a hard rule asserted by the lexicon test.
- */
-export declare const MODEL_TIERS: readonly ["kavi", "vaani", "mira"];
-/**
- * The canonical term for each concept — the words every surface must use.
- * Documented here so the lexicon is reviewable in one place; the forbidden
- * synonyms below are what the test actually enforces.
- */
-export declare const CANONICAL_TERMS: {
-    readonly product: "cruxy";
-    readonly backend: "gateway";
-    readonly extension: "skill";
-    readonly lifecycleHook: "hook";
-    readonly undoUnit: "checkpoint";
-    readonly isolation: "sandbox";
-    readonly secret: "API key";
-    readonly pullRequest: "pull request";
-    readonly permission: "approval";
-};
-/** One deprecated/off-voice term the copy must not use, and what to use instead. */
-export interface ForbiddenTerm {
-    /** Matches the forbidden term (word-bounded, case-insensitive). */
-    pattern: RegExp;
-    /** The forbidden term, for the failure message. */
-    term: string;
-    /** The canonical term to use instead. */
-    use: string;
-}
-/**
- * Deprecated synonyms banned from user-facing copy. Scoped to the curated
- * surfaces the lexicon test scans (command descriptions, error output, brand +
- * onboarding constants) — NOT a raw source grep — so legitimate internal uses
- * (`mcp.servers` config key, docker `.Server.Version`, code comments) never
- * false-trip, while every string a user reads is covered.
- */
-export declare const FORBIDDEN_TERMS: readonly ForbiddenTerm[];
-/**
- * Upstream model names — the base-model gag. None may appear in user-facing
- * copy; only {@link MODEL_TIERS} ever do. `anthropic`/`openai` are deliberately
- * absent: they are real bring-your-own-provider config values, not model names.
- */
-export declare const FORBIDDEN_MODEL_NAMES: RegExp;
-/** The neutral token an upstream model name is replaced with in user-facing copy. */
-export declare const MODEL_NAME_PLACEHOLDER = "\u00ABmodel\u00BB";
-/**
- * Replace every upstream model IDENTIFIER in an arbitrary, externally-sourced
- * string with {@link MODEL_NAME_PLACEHOLDER}, collapsing a whole `name-name-vers`
- * run to a single token.
- *
- * The U.8 gag is structural *inside the process* (the routing package can't
- * produce an upstream id — see `resolveModelId`), but a gateway/provider error
- * body is an arbitrary external string that bypasses that guarantee. This is the
- * scrub applied at the error-construction boundary so no upstream id reaches a
- * user-facing `CruxyError.cause`.
- *
- * Scrubs model ids as whole TOKENS, never a bare vendor word or a substring
- * inside an unrelated word/path — so legitimate output (`/home/claude`, the
- * `opus` codec, a `claude-bot` username) is left intact (see {@link isModelId}).
- * Provider names (`anthropic`/`openai`) are absent from the set, so bring-your-own
- * provider config values survive too.
- */
-export declare function scrubModelNames(text: string): string;
-/** One lexicon violation found in a scanned string. */
-export interface LexiconViolation {
-    /** The forbidden term (or "model-name" for a gag violation). */
-    term: string;
-    /** The canonical replacement, when the term is a deprecated synonym. */
-    use?: string;
-}
-/**
- * Scan one user-facing string for lexicon violations — deprecated synonyms and
- * upstream model names. Returns every violation (empty ⇒ on-voice). Pure; the
- * lexicon test runs it over the curated surfaces.
- */
-export declare function scanForbidden(text: string): LexiconViolation[];

package/dist/checkpoint/capture.d.ts

@@ -1,17 +0,0 @@
-import type { CaptureFile } from "./types.js";
-/**
- * Snapshot-scope enumeration (C.32): every regular file the agent could touch —
- * tracked + untracked-non-ignored — and nothing it must never see:
- *   • gitignored paths (they are not the run's undo unit and may be huge),
- *   • the C.17 secrets denylist ({@link isSecretPath} — a checkpoint must never
- *     copy a secret into `.cruxy/` or the git object DB),
- *   • `.cruxy/` itself (a checkpoint of the checkpoints would recurse),
- *   • symlinks and other non-regular files (restore writes plain files only).
- *
- * In a git repo the file list comes from `git ls-files` (read-only), which
- * honors `.gitignore`, `.git/info/exclude`, and the user's global excludes
- * exactly. Outside a repo, the indexing walker enumerates with its gitignore
- * emulation — with binaries included and no size cap, because a snapshot that
- * skips files cannot restore them.
- */
-export declare function captureFiles(root: string, gitWorkTree: boolean): Promise<CaptureFile[]>;

package/dist/checkpoint/gate-hook.d.ts

@@ -1,28 +0,0 @@
-import type { ApprovalDecision } from "../approval/types.js";
-import type { ApproveAction } from "../tools/types.js";
-import type { Workspace } from "../workspace/index.js";
-import type { CheckpointGate } from "./gate.js";
-/**
- * Wrap an approval gate with the C.32 auto-checkpoint hook. Ordering is the whole
- * point: a tool mutates only *after* `requestApproval` resolves, so snapshotting
- * after an `allow` decision but before returning it means the checkpoint always
- * lands before the run's first mutation — and a denied action never creates one.
- * The same seam records which paths the run touched (file actions) or that
- * attribution is lost (shell), for rollback's external-change detection.
- *
- * Lives in the checkpoint package (not the CLI wiring) so the SAME hook can be
- * composed by the session factory, the subagent orchestrator, AND the C.28 job
- * approval path without any of them importing the others.
- */
-export declare function withCheckpointGate(requestApproval: (action: ApproveAction) => Promise<ApprovalDecision>, gate: CheckpointGate | undefined, ws: Workspace): (action: ApproveAction) => Promise<ApprovalDecision>;
-/**
- * Group a file action's resolved absolute targets by the root that contains each
- * (JC-G). write/edit carry an already-absolute `path`; patch preview paths are
- * relative to the PRIMARY cwd (`path.relative(ctx.cwd, abs)` in apply_patch), so
- * we reconstruct the absolute path from the primary root rather than trusting
- * classify's `targets` — which also correctly handles a patch spanning roots.
- */
-export declare function attributeFileTargets(action: ApproveAction, ws: Workspace): Map<string, {
-    rootAbsPath: string;
-    paths: string[];
-}>;

package/dist/checkpoint/gate.d.ts

@@ -1,71 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import { CheckpointService } from "./service.js";
-import type { CheckpointSet } from "./types.js";
-/**
- * Per-root checkpoint gate (C.26 step 3). One run may mutate several declared
- * roots; this owns one {@link CheckpointService} PER touched root (created lazily
- * the first time a mutation is gated for that root) plus the run's
- * {@link CheckpointSet} accumulator, so `cruxy rollback` can restore exactly the
- * roots the run touched — no more, no less.
- *
- * Two invariants live here:
- *   • **exactly-touched** — {@link serviceFor} is the ONLY construction site for a
- *     per-root service, and it is called only when a mutation is actually gated for
- *     that root, so an untouched root's service is never constructed and never
- *     appears in the set.
- *   • **one set per run, shared across subagents** — the parent and every subagent
- *     share this one gate (C.14 wires the child gate over the same object), so a
- *     subagent's writes join the run's single set and are covered by the run's
- *     rollback (⚖︎JC-δ). The set manifest lives under the PRIMARY root (⚖︎#7).
- */
-export type CreateCheckpointService = (root: string, config: CruxyConfig) => CheckpointService;
-export interface CheckpointGateOptions {
-    config: CruxyConfig;
-    /** Absolute path of the primary root — home of the set manifest (⚖︎#7). */
-    primaryRoot: string;
-    /**
-     * Test seam: the sole factory for per-root services. A constructor spy passed
-     * here proves an untouched root's service is never built.
-     */
-    createService?: CreateCheckpointService;
-}
-export declare class CheckpointGate {
-    private readonly config;
-    private readonly primaryRoot;
-    private readonly create;
-    private readonly services;
-    private runId;
-    private summary;
-    private set;
-    constructor(opts: CheckpointGateOptions);
-    /**
-     * Start a new undo unit for the WHOLE run (every root + the set). Resets each
-     * existing per-root service's once-per-run latch and clears the set so the next
-     * mutation begins a fresh run. The set is materialized lazily on the first member
-     * (so its `createdAt` marks the run's first mutation, and a no-mutation run
-     * writes no manifest).
-     *
-     * `runId` may be supplied to key the set manifest by a caller-chosen id (C.28: a
-     * background job passes its OWN id, so `cruxy rollback <jobId>` maps straight to
-     * that job's set and reverts exactly the job — pre- AND post-pause mutations,
-     * because a job calls this ONCE at start and never again on resume). Omitted → a
-     * fresh generated `run-…` id, unchanged from C.26.
-     */
-    beginRun(summary: string, runId?: string): void;
-    /**
-     * Get-or-create the per-root service. The first time a root is touched this
-     * process, its service is constructed and joined to the current run; an untouched
-     * root's service is never built.
-     */
-    serviceFor(rootName: string, rootAbsPath: string): CheckpointService;
-    /**
-     * Record that `rootName` was checkpointed this run: append its member to the set
-     * and persist the manifest under the primary root. Idempotent — later mutations
-     * to the same root this run are no-ops (the root already has exactly one member).
-     */
-    recordMember(rootName: string, rootAbsPath: string, checkpointId: string): Promise<void>;
-    /** Root names that got a per-root service this process (inspection/tests). */
-    get touchedRoots(): readonly string[];
-    /** The current run's set, or null before its first mutation (inspection/tests). */
-    get currentSet(): CheckpointSet | null;
-}

package/dist/checkpoint/git-store.d.ts

@@ -1,61 +0,0 @@
-import type { CaptureFile, CheckpointStore, FileEntry } from "./types.js";
-/**
- * Git-object-backed checkpoint content store (C.32 primary substrate).
- *
- * How a snapshot works — and exactly why it can never disturb the user's git
- * state. Every git invocation is one of these five, and nothing else:
- *
- *   1. `git rev-parse --absolute-git-dir`          (read-only)
- *   2. `git update-index --add -z --stdin`, with `GIT_INDEX_FILE` pointing at a
- *      **temporary index file in os.tmpdir()**. Git hashes each captured file
- *      into `.git/objects` as loose blobs and stages them *in the temp index*.
- *      The user's `.git/index` is never opened for writing.
- *   3. `git write-tree`, same `GIT_INDEX_FILE` — writes tree objects, returns
- *      the root tree oid.
- *   4. `git ls-files --stage -z`, same `GIT_INDEX_FILE` — reads back
- *      `mode oid stage\tpath` per file for the manifest. The temp index is then
- *      deleted.
- *   5. `git cat-file blob <oid>` on restore/preview                (read-only)
- *
- * No `commit-tree`, no `update-ref`, no `stash`, no branch: **no ref is ever
- * created or moved, and HEAD / the index / the stash are never written.** The
- * blobs and trees are deliberately *dangling* — referenced only by the manifest
- * JSON under `.cruxy/checkpoints/`.
- *
- * Enforced, not assumed: {@link snapshot} fingerprints the user-visible state
- * (raw `.git/HEAD` bytes, a hash of `.git/index`, `git for-each-ref`, and
- * `git stash list`) before and after, and throws CRUXY_E_CHECKPOINT_FAILED
- * naming what moved if anything drifted.
- *
- * Accepted trade-off: dangling objects are subject to `git gc --prune`. The
- * default two-week grace plus retention pruning makes that a non-issue, but a
- * user running `git gc --prune=now` can orphan a manifest — then rollback fails
- * loudly (never restores partial state), and the shadow store remains the
- * fallback substrate for new checkpoints.
- */
-export declare class GitCheckpointStore implements CheckpointStore {
-    private readonly root;
-    readonly kind: "git";
-    constructor(root: string);
-    /** Git blob sha-1: `sha1("blob <len>\0" + content)` — matches `git hash-object`. */
-    hashContent(content: Buffer): string;
-    snapshot(files: CaptureFile[]): Promise<FileEntry[]>;
-    readContent(entry: FileEntry): Promise<Buffer>;
-    /** Dangling objects belong to git's own gc; nothing for us to sweep. */
-    collect(): Promise<void>;
-    /** Parse `git ls-files --stage -z` from the temp index into manifest entries. */
-    private readStagedEntries;
-    /**
-     * Run git with binary-safe stdout (restore must round-trip arbitrary bytes),
-     * optional stdin, and optional extra env. Local to this store on purpose —
-     * `runGitCapture` is text-mode and env-less, and the rest of the CLI should
-     * stay that way.
-     */
-    private git;
-    /**
-     * Everything a user can observe of their git state, byte-for-byte: HEAD file,
-     * index contents, every ref (branches, tags, remotes, stash tip — packed or
-     * loose, via for-each-ref), and the full stash reflog (stash list).
-     */
-    private fingerprint;
-}

package/dist/checkpoint/index.d.ts

@@ -1,10 +0,0 @@
-export * from "./types.js";
-export * from "./capture.js";
-export * from "./git-store.js";
-export * from "./shadow-store.js";
-export * from "./restore.js";
-export * from "./service.js";
-export * from "./set.js";
-export * from "./set-rollback.js";
-export * from "./gate.js";
-export * from "./gate-hook.js";

package/dist/checkpoint/restore.d.ts

@@ -1,23 +0,0 @@
-import type { ActionPreview } from "../tools/types.js";
-import type { Checkpoint, CheckpointStore, RollbackApplied, RollbackPlan } from "./types.js";
-/**
- * Diff the current working tree against a checkpoint by content address.
- * External attribution: a differing path the tracked run never touched is
- * flagged `external` — unless the run executed shell commands, in which case
- * attribution is unknowable and the plan says so instead of guessing.
- */
-export declare function computeRollbackPlan(root: string, checkpoint: Checkpoint, store: CheckpointStore, gitWorkTree: boolean): Promise<RollbackPlan>;
-/**
- * Build the U.2 preview for a plan: patch-style entries (byte-identical with
- * apply_patch previews) plus the external-change and boundary annotations that
- * `renderActionPreview` places *above* the diff.
- */
-export declare function buildRollbackPreview(root: string, plan: RollbackPlan, store: CheckpointStore): Promise<Extract<ActionPreview, {
-    type: "rollback";
-}>>;
-/**
- * Apply a plan: recreate deleted files, revert edited ones (content and mode),
- * then remove run-created files (and any directories that emptied out). Any
- * failure is a loud CRUXY_E_CHECKPOINT_FAILED; re-running rollback resumes.
- */
-export declare function applyRollback(root: string, plan: RollbackPlan, store: CheckpointStore): Promise<RollbackApplied>;

package/dist/checkpoint/service.d.ts

@@ -1,89 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import type { ApprovalDecision } from "../approval/types.js";
-import type { ApproveAction } from "../tools/types.js";
-import type { Checkpoint, CheckpointStore, CheckpointStoreKind, RollbackApplied } from "./types.js";
-/** Is `root` inside a git working tree? (Decides the checkpoint substrate.) */
-export declare function isGitWorkTree(root: string): boolean;
-/**
- * The substrate factory: git-object store inside a repo, shadow store outside.
- * Pass `kind` to pin the substrate (rollback must read a checkpoint back with
- * the store that wrote it, recorded in its manifest).
- */
-export declare function createCheckpointStore(root: string, kind?: CheckpointStoreKind): CheckpointStore;
-export interface CheckpointServiceOptions {
-    root: string;
-    config: CruxyConfig;
-    /** Test seam: pin the content store (disables the git→shadow fallback). */
-    store?: CheckpointStore;
-}
-/** What `rollback()` needs from the caller: the U.3 gate and TTY interactivity. */
-export interface RollbackDeps {
-    requestApproval(action: ApproveAction): Promise<ApprovalDecision>;
-    interactive: boolean;
-}
-export type RollbackResult = 
-/** The working tree already matches the checkpoint — nothing to do. */
-{
-    kind: "noop";
-    checkpoint: Checkpoint;
-}
-/** The user saw the preview and declined; nothing was applied. */
- | {
-    kind: "rejected";
-    feedback?: string;
-} | {
-    kind: "applied";
-    checkpoint: Checkpoint;
-    applied: RollbackApplied;
-};
-/**
- * Checkpoint lifecycle (C.32): create once before a run's first mutation,
- * record what the run touches, list/prune, and drive the gated rollback.
- * Manifests are JSON under `.cruxy/checkpoints/` — they survive process exit,
- * so `cruxy rollback` works in a later invocation.
- */
-export declare class CheckpointService {
-    private readonly root;
-    private readonly config;
-    private readonly pinnedStore?;
-    private runSummary;
-    private active;
-    /** In-flight `ensureCheckpoint` construction (C.33). PROMISE-latched, not
-     * value-latched: two concurrent gated writes to this root await the SAME
-     * snapshot instead of each taking one (the once-per-run latch `this.active`
-     * is only set AFTER several awaits, so a boolean/value latch would let a
-     * second caller slip through and double-snapshot). The approval mutex already
-     * serializes gated writes, so this is defense-in-depth — but it makes the
-     * service correct on its own, independent of the caller's discipline. */
-    private pending;
-    constructor(opts: CheckpointServiceOptions);
-    /** Start a new undo unit: reset the once-per-run latch and name the run. */
-    beginRun(summary: string): void;
-    /**
-     * The auto-checkpoint hook, called from the approval seam after every allowed
-     * mutating action and latched to fire once per run — before the first
-     * mutation ever reaches disk. Returns the run's checkpoint, or `null` when
-     * the feature is disabled. Fail-loud: if a checkpoint cannot be written by
-     * either substrate, the run must not mutate without its undo protection.
-     */
-    ensureCheckpoint(): Promise<Checkpoint | null>;
-    private buildCheckpoint;
-    /** Attribute mutated paths to the current run (persisted for later rollback). */
-    recordTouched(absPaths: string[]): Promise<void>;
-    /** The run ran a shell command: per-path attribution is no longer possible. */
-    recordShellMutation(): Promise<void>;
-    /** All checkpoints, newest first. Corrupt manifests are warned about, not fatal. */
-    list(): Promise<Checkpoint[]>;
-    /** One checkpoint by id, or the newest when `id` is omitted. Fail-loud. */
-    read(id?: string): Promise<Checkpoint>;
-    /**
-     * The whole gated restore: preview → U.3 destructive approval → apply.
-     * Non-interactive callers are refused up front — there is no auto-rollback.
-     */
-    rollback(id: string | undefined, deps: RollbackDeps): Promise<RollbackResult>;
-    /** Enforce `checkpoint.retention`: drop oldest manifests, then GC content. */
-    prune(): Promise<void>;
-    private dir;
-    private writeManifest;
-    private readManifestFile;
-}

package/dist/checkpoint/set-rollback.d.ts

@@ -1,51 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import type { ActionPreview } from "../tools/types.js";
-import { CheckpointService } from "./service.js";
-import type { CheckpointSet, CheckpointStore, RollbackPlan, SetRollbackApplied } from "./types.js";
-/**
- * Set-based rollback orchestration (C.26 step 3). Restore every member of a run's
- * {@link CheckpointSet} as one gated operation, with the R3/⚖︎#8 guarantees:
- *   1. **validate-all before any apply** — every member's checkpoint must load and
- *      plan cleanly first ({@link validateSet}); a missing/corrupt one throws
- *      `CRUXY_E_CHECKPOINT_SET_INCOMPLETE` and NOTHING is applied.
- *   2. **one combined preview** grouped by root ({@link buildSetPreview}), each with
- *      its own external-change warnings, behind one U.3 approval (⚖︎JC-ι).
- *   3. **sequential apply, stop on first failure** ({@link applySet}) →
- *      `CRUXY_E_CHECKPOINT_SET_PARTIAL` carrying restored-vs-not; the plan is
- *      recomputed from disk each run, so an idempotent re-run finishes the job.
- */
-export type CreateService = (root: string, config: CruxyConfig) => CheckpointService;
-/** A member whose rollback has been fully validated + planned, ready to apply. */
-export interface ValidatedMember {
-    rootName: string;
-    rootPath: string;
-    checkpointId: string;
-    plan: RollbackPlan;
-    store: CheckpointStore;
-    preview: Extract<ActionPreview, {
-        type: "rollback";
-    }>;
-}
-/**
- * Validate + plan EVERY member up front (R3 gate #1). Loads each root's checkpoint
- * and computes its rollback plan/preview; the first member that cannot be loaded
- * throws `CRUXY_E_CHECKPOINT_SET_INCOMPLETE` — before any filesystem apply — so a
- * partial rollback can never masquerade as success.
- */
-export declare function validateSet(set: CheckpointSet, config: CruxyConfig, createService?: CreateService): Promise<ValidatedMember[]>;
-/**
- * One combined preview grouped by root (⚖︎JC-ι): each root keeps its own file diffs
- * and external-change warnings, so a single U.3 approval covers the whole set.
- */
-export declare function buildSetPreview(set: CheckpointSet, members: ValidatedMember[]): Extract<ActionPreview, {
-    type: "rollback-set";
-}>;
-/**
- * Apply the validated set sequentially, stopping on the first failure (R3/⚖︎#8).
- * On any member's failure this throws `CRUXY_E_CHECKPOINT_SET_PARTIAL` with the
- * restored-vs-not split; re-running (which recomputes each plan from disk) safely
- * finishes the job.
- */
-export declare function applySet(set: CheckpointSet, members: ValidatedMember[]): Promise<SetRollbackApplied>;
-/** Is a validated set a no-op (every member's plan is empty)? */
-export declare function setIsNoop(members: ValidatedMember[]): boolean;