@phnx-labs/agents-cli 1.22.113 → 1.22.114

package/dist/lib/devices/fleet.js

@@ -11,7 +11,7 @@ import { spawnSync } from 'child_process';
 import { isSelfHost } from './self-host.js';
 import { buildSshInvocation, sshTargetFor, writeAskpassShim } from './connect.js';
 /** npm dist-tags / semver pins only — rejects shell metacharacters. */
-export const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
+const FLEET_VERSION_RE = /^[A-Za-z0-9._-]+$/;
 /**
  * Classify each registered device for a fleet operation.
  *

package/dist/lib/devices/harness-inventory.d.ts

@@ -51,7 +51,7 @@ export interface HostHarnessResult {
     skipped?: string;
 }
 /** An account collapsed across the installs on one host that share it. */
-export interface AccountGroup {
+interface AccountGroup {
     /** Account display label, or null for the signed-out bucket. */
     account: string | null;
     /** Distinct agent ids using this account, sorted. */
@@ -130,7 +130,7 @@ export declare function renderHarnessMatrix(results: HostHarnessResult[]): strin
  * account (installs sharing it collapsed), showing which harnesses use it. Pure.
  */
 export declare function renderAccountsMatrix(results: HostHarnessResult[]): string[];
-export interface AccountFleetMatrixRow {
+interface AccountFleetMatrixRow {
     harness: AgentId;
     name: string | null;
     identityLabel: string;
@@ -147,3 +147,4 @@ export interface AccountFleetMatrixRow {
 export declare function renderAccountFleetMatrix(rows: AccountFleetMatrixRow[], opts?: {
     uncoveredDevices?: string[];
 }): string[];
+export {};

package/dist/lib/devices/health-report.d.ts

@@ -52,7 +52,7 @@ export interface FleetHealthRow {
      *  Undefined when no row has been published for the host yet. */
     agents?: FleetAgentCounts;
 }
-export interface FleetWarning {
+interface FleetWarning {
     kind: 'unreachable' | 'drift' | 'cli' | 'version-skew' | 'divergence';
     devices: string[];
     message: string;
@@ -82,7 +82,7 @@ export declare function freshnessFooter(rows: FleetHealthRow[], now?: number): s
 export declare function shortVersion(version: string | null | undefined): string;
 /** OS bucket label for grouping. Anything unrecognized falls under "Other". */
 export declare function platformGroupLabel(platform: string | undefined): 'macOS' | 'Linux' | 'Windows' | 'Other';
-export interface FleetAttentionItem {
+interface FleetAttentionItem {
     /** Leading mark: `○` offline, `⚠` config/CLI/version issue. */
     glyph: 'offline' | 'warn';
     subject: string;
@@ -106,3 +106,4 @@ export declare function renderFleetSummary(report: FleetHealthReport, opts?: {
     self?: string;
     now?: number;
 }): string[];
+export {};

package/dist/lib/devices/health.d.ts

@@ -49,13 +49,6 @@ export declare function probeBudgetMs(device: DeviceProfile): number;
 export declare const WIN_PROBE_TIMEOUT_MS = 6000;
 /** One-shot remote snapshot: load, memory, core count, then root filesystem. */
 export declare const PROBE_SNIPPET = "uptime; echo ---AGSTAT---; (vm_stat 2>/dev/null || cat /proc/meminfo 2>/dev/null); echo ---AGSTAT---; (nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null); echo ---AGSTAT---; df -Pk / 2>/dev/null | tail -1";
-/** Windows equivalent, one labeled line via CIM. PowerShell 5.1-safe: no `||`
- * chaining, plain string concatenation. `LoadPercentage` is $null on some
- * hosts/VMs, which concatenates to an empty field — the parser treats that as
- * "no load signal" and headroom falls back to memory pressure alone.
- * wrapRemoteCommand base64-encodes this for powershell-shell devices, so the
- * quoting survives ssh intact. */
-export declare const WIN_PROBE_SNIPPET = "$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter \"DeviceID='C:'\"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))";
 export declare function localProbeInvocation(platform: NodeJS.Platform): {
     file: string;
     args: string[];
@@ -114,7 +107,7 @@ export declare function parseProbeOutput(host: string, stdout: string, fetchedAt
  * (e.g. CIM unavailable) keeps `reachable: true` — ssh answered — with no
  * numbers, mirroring how garbage POSIX output degrades. */
 export declare function parseWinProbeOutput(host: string, stdout: string, fetchedAt: number): DeviceStats;
-export interface FleetCapacity {
+interface FleetCapacity {
     reachable: number;
     cores: number;
     memTotalBytes: number;

package/dist/lib/devices/health.js

@@ -63,7 +63,7 @@ export const PROBE_SNIPPET = `uptime; echo ${SEP}; (vm_stat 2>/dev/null || cat /
  * "no load signal" and headroom falls back to memory pressure alone.
  * wrapRemoteCommand base64-encodes this for powershell-shell devices, so the
  * quoting survives ssh intact. */
-export const WIN_PROBE_SNIPPET = `$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))`;
+const WIN_PROBE_SNIPPET = `$os = Get-CimInstance Win32_OperatingSystem; $cpu = (Get-CimInstance Win32_Processor | Measure-Object -Property LoadPercentage -Average).Average; $disk = Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'"; Write-Output ('AGWINSTAT load=' + $cpu + ' freeKb=' + $os.FreePhysicalMemory + ' totalKb=' + $os.TotalVisibleMemorySize + ' ncpu=' + $env:NUMBER_OF_PROCESSORS + ' diskFreeKb=' + ($disk.FreeSpace / 1KB) + ' diskTotalKb=' + ($disk.Size / 1KB))`;
 export function localProbeInvocation(platform) {
     return platform === 'win32'
         ? { file: 'powershell', args: ['-NoProfile', '-Command', WIN_PROBE_SNIPPET] }

package/dist/lib/devices/interactive-host.d.ts

@@ -1,5 +1,3 @@
-/** The reserved `--device` value meaning the box the human is at. */
-export declare const INTERACTIVE_DEVICE_SENTINEL = "interactive";
 /** True when a host flag value is the interactive sentinel. */
 export declare function isDeviceInteractive(value: string | undefined | null): boolean;
 /**

package/dist/lib/devices/interactive-host.js

@@ -19,7 +19,7 @@
 import { getConfigValue } from '../device-config.js';
 import { RESERVED_DEVICE_NAMES } from './registry.js';
 /** The reserved `--device` value meaning the box the human is at. */
-export const INTERACTIVE_DEVICE_SENTINEL = 'interactive';
+const INTERACTIVE_DEVICE_SENTINEL = 'interactive';
 /** True when a host flag value is the interactive sentinel. */
 export function isDeviceInteractive(value) {
     return typeof value === 'string' && value.trim().toLowerCase() === INTERACTIVE_DEVICE_SENTINEL;

package/dist/lib/devices/known-hosts.d.ts

@@ -3,8 +3,6 @@ import type { DeviceProfile } from './registry.js';
 export declare function managedKnownHostsPath(): string;
 /** Ensure the parent directory of the managed store exists (mode 0700). */
 export declare function ensureManagedKnownHostsDir(file?: string): void;
-/** Read the managed store, or '' when it does not exist yet. */
-export declare function readManagedKnownHosts(file?: string): string;
 /**
  * True if `host` has at least one pinned key line in `content`. Pure (content
  * in) so the match logic is unit-testable without touching disk. Matching is
@@ -44,7 +42,7 @@ export declare function hostKeyCheckingOpts(pinned: boolean, file?: string): str
  * contract is unit-testable without spawning ssh-keyscan.
  */
 export declare function newKnownHostsLines(existing: string, scanned: string): string[];
-export interface PinResult {
+interface PinResult {
     /** True if the host is pinned in the managed store after this call. */
     pinned: boolean;
     /** How many new key lines were appended. */
@@ -58,20 +56,4 @@ export interface PinResult {
  * network (the spawn stays in `pinHostKey`).
  */
 export declare function recordScannedKeys(host: string, scanned: string, file?: string): PinResult;
-/**
- * `ssh-keyscan` a host at a trusted moment and append any new key lines to the
- * managed store, idempotently. This is the explicit pin path; the implicit one
- * is a normal `accept-new` connection whose learned key lands in the same store.
- * Returns whether the host is pinned afterward.
- *
- * Host-name-agnostic: it scans whatever address it is handed, so it also pins a
- * host `agents ssh` can't reach — notably a bare `~/.ssh/config` `Host` alias,
- * which is not a registered device. The `--copy-creds` gate (commands/exec.ts)
- * calls this for exactly that case so the credential copy is usable for
- * ssh-config-alias hosts (RUSH-1767).
- */
-export declare function pinHostKey(host: string, opts?: {
-    file?: string;
-    timeoutMs?: number;
-    port?: number;
-}): PinResult;
+export {};

package/dist/lib/devices/known-hosts.js

@@ -32,7 +32,7 @@ export function ensureManagedKnownHostsDir(file = managedKnownHostsPath()) {
     fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
 }
 /** Read the managed store, or '' when it does not exist yet. */
-export function readManagedKnownHosts(file = managedKnownHostsPath()) {
+function readManagedKnownHosts(file = managedKnownHostsPath()) {
     try {
         return fs.readFileSync(file, 'utf-8');
     }
@@ -135,7 +135,7 @@ export function recordScannedKeys(host, scanned, file = managedKnownHostsPath())
  * calls this for exactly that case so the credential copy is usable for
  * ssh-config-alias hosts (RUSH-1767).
  */
-export function pinHostKey(host, opts = {}) {
+function pinHostKey(host, opts = {}) {
     // Same injection guard as sshExec: a host starting with `-` (or carrying shell
     // metacharacters) must never reach ssh-keyscan as a bare argv where it could
     // be parsed as a flag.

package/dist/lib/devices/pool.d.ts

@@ -30,7 +30,7 @@
  * ranker ({@link autoLaunchPreferredSet}, applied by `pickBestDevice`).
  */
 import { type AutoLaunchPreference, type AutoPoolMode, type ConfiguredDeviceRole } from '../device-config.js';
-export interface AutoPoolOptions {
+interface AutoPoolOptions {
     /** Pool mode; defaults to the configured `auto.pool`. */
     mode?: AutoPoolMode;
     /** Configured roles by device name; defaults to the fleet-shared block. */
@@ -77,3 +77,4 @@ export declare function listWorkerDevices(opts?: Pick<AutoPoolOptions, 'roles'>)
  * callers can append it unconditionally.
  */
 export declare function describeAutoPool(opts?: AutoPoolOptions): string;
+export {};

package/dist/lib/devices/resolve-target.d.ts

@@ -3,14 +3,14 @@ import { type DeviceProfile } from './registry.js';
 export { splitUserHost };
 /** A dialable peer: the ssh target, the machine id used to tag its rows, a
  * display name, and the OS family that picks the remote shell dialect. */
-export interface ResolvedSshTarget {
+interface ResolvedSshTarget {
     target: string;
     machine: string;
     name: string;
     os?: string;
     extraSshArgs?: string[];
 }
-export interface ResolvedExplicitTargetSet {
+interface ResolvedExplicitTargetSet {
     targets: ResolvedSshTarget[];
     unresolved: string[];
 }

package/dist/lib/devices/rollout-verify.d.ts

@@ -43,7 +43,7 @@ import { runLocalCommand, runOnDevice, type FleetRunResult, type FleetTarget } f
  * falling back to the unresolved path where `readlink -f` is unavailable.
  */
 export declare function rolloutVerifyCommand(): string[];
-export interface RolloutProbe {
+interface RolloutProbe {
     /** Path the box's own `agents` resolves to, symlinks followed. */
     resolvedPath?: string;
     /** Version that resolved copy reports. */
@@ -81,7 +81,7 @@ export declare function isRolloutSuccess(verdict: RolloutVerdict): boolean;
 export declare function resolveRolloutTarget(explicitVersion: string | undefined, probes: RolloutProbe[]): string | undefined;
 /** Classify one box's probe against the rollout target. */
 export declare function classifyRolloutVerification(probe: RolloutProbe, targetVersion: string | undefined): RolloutVerification;
-export interface VerifyFleetRolloutOptions {
+interface VerifyFleetRolloutOptions {
     /** Name of THIS machine; its target is probed locally, mirroring `runFleet`. */
     self?: string;
     /** Injectable ssh runner (tests). */
@@ -99,3 +99,4 @@ export interface VerifyFleetRolloutOptions {
  * "we could not check" and "it is upgraded" are different answers.
  */
 export declare function verifyFleetRollout(targets: FleetTarget[], results: FleetRunResult[], explicitVersion: string | undefined, opts?: VerifyFleetRolloutOptions): Map<string, RolloutVerification>;
+export {};

package/dist/lib/devices/stats-cache.d.ts

@@ -42,7 +42,7 @@ export declare function writeStatsCache(entries: Record<string, DeviceStats>): v
 export declare function removeStatsCacheEntry(name: string): void;
 /** Immutable cache pruning primitive, exported for lifecycle regression tests. */
 export declare function pruneStatsCache(entries: Record<string, DeviceStats>, name: string): Record<string, DeviceStats>;
-export interface FleetStatsResult {
+interface FleetStatsResult {
     /** name → stats for every requested device (cache-served + freshly probed). */
     stats: Map<string, DeviceStats>;
     /** Oldest `fetchedAt` among the returned rows, or null when empty. Drives the
@@ -51,7 +51,7 @@ export interface FleetStatsResult {
     /** True when at least one row was served from cache rather than probed this call. */
     servedFromCache: boolean;
 }
-export interface LoadFleetStatsOptions {
+interface LoadFleetStatsOptions {
     /** Skip the cache and live-probe every device (the `--refresh`/`--live` path). */
     forceRefresh?: boolean;
     /** Device name of THIS machine — always probed locally (no ssh), never cached-served. */
@@ -70,3 +70,4 @@ export interface LoadFleetStatsOptions {
  * `reachable: false` row exactly as the live probe does.
  */
 export declare function loadFleetStats(devices: DeviceProfile[], opts?: LoadFleetStatsOptions): Promise<FleetStatsResult>;
+export {};

package/dist/lib/devices/sync.d.ts

@@ -34,8 +34,8 @@ export declare function withDefaultUser(input: DeviceInput, prevUser: string | u
  *   through the menu-bar "NEW DEVICES → Register / Ignore" gate instead of
  *   silently landing in the registry.
  */
-export type DeviceSyncMode = 'bootstrap' | 'refresh';
-export interface DeviceSyncResult {
+type DeviceSyncMode = 'bootstrap' | 'refresh';
+interface DeviceSyncResult {
     /** False when discovery could not run (e.g. tailscale absent) in soft mode. */
     ok: boolean;
     /** Number of tailscale nodes upserted into the registry. */
@@ -89,7 +89,7 @@ export declare function runDeviceSync(opts?: {
     soft?: boolean;
     mode?: DeviceSyncMode;
 }): Promise<DeviceSyncResult>;
-export interface EnsureDevicesResult {
+interface EnsureDevicesResult {
     /** Names newly resolved from Tailscale and upserted into the registry. */
     registered: string[];
     /** Names that could not be resolved (not on the tailnet / tailscale absent). */
@@ -102,7 +102,7 @@ export interface EnsureDevicesResult {
  * registered names need nothing. Pure so the bootstrap's filter matrix is
  * unit-testable without a tailnet or registry writes.
  */
-export interface WantedPartition {
+interface WantedPartition {
     toRegister: string[];
     unresolved: string[];
 }
@@ -127,10 +127,11 @@ export declare function ensureDevicesRegistered(wantedNames: string[]): Promise<
  * => remove from the registry if it was there, and ignore it so auto-sync never
  * re-adds it.
  */
-export interface DeviceReconciliation {
+interface DeviceReconciliation {
     toRegister: string[];
     toUnignore: string[];
     toRemove: string[];
     toIgnore: string[];
 }
 export declare function planDeviceReconciliation(allNames: Iterable<string>, keep: Iterable<string>, registered: Iterable<string>, ignored: Iterable<string>): DeviceReconciliation;
+export {};

package/dist/lib/devices/worker-pick.d.ts

@@ -4,7 +4,7 @@ export interface WorkerExclusion {
     device: string;
     reason: 'unreachable' | 'probe timed out' | 'overloaded' | 'wrong-platform' | 'interactive';
 }
-export interface WorkerPickPlan {
+interface WorkerPickPlan {
     /** The chosen device name. Never the local box unless it is an auto-pool member. */
     device: string;
     /** True when the pick IS this machine (the caller should run in place). */
@@ -16,7 +16,7 @@ export interface WorkerPickPlan {
     }>;
     excluded: WorkerExclusion[];
 }
-export interface WorkerPickOptions {
+interface WorkerPickOptions {
     /** Restrict to these platforms. Defaults to POSIX (`linux`, `macos`). */
     platforms?: string[];
     /** Override the candidate pool (tests). */
@@ -25,16 +25,6 @@ export interface WorkerPickOptions {
     /** Injected probe (tests). */
     probe?: (pool: string[]) => Promise<Map<string, DevicePlacementSignal>>;
 }
-/**
- * Platforms a bun/vitest offload can actually run on.
- *
- * Windows is excluded by policy, not by accident: `AGENTS.md` states Windows is
- * not a required PR or ordinary-release platform and `tests.yml` runs it only as
- * a `continue-on-error` post-merge smoke. Silently shipping the tree to
- * `win-mini` would produce a confusing failure for a platform whose result
- * nobody gates on.
- */
-export declare const POSIX_PLATFORMS: readonly ["linux", "macos"];
 /**
  * Resolve the least-loaded eligible worker.
  *
@@ -46,3 +36,4 @@ export declare const POSIX_PLATFORMS: readonly ["linux", "macos"];
 export declare function resolveWorkerDevice(opts?: WorkerPickOptions): Promise<WorkerPickPlan>;
 /** The one no-worker message, naming every candidate and why it was dropped. */
 export declare function formatNoWorkerError(excluded: WorkerExclusion[], platforms: Set<string>): string;
+export {};

package/dist/lib/devices/worker-pick.js

@@ -34,7 +34,7 @@ import { probePoolSignals } from '../teams/placement-probe.js';
  * `win-mini` would produce a confusing failure for a platform whose result
  * nobody gates on.
  */
-export const POSIX_PLATFORMS = ['linux', 'macos'];
+const POSIX_PLATFORMS = ['linux', 'macos'];
 /**
  * Resolve the least-loaded eligible worker.
  *

package/dist/lib/diff-text.d.ts

@@ -5,7 +5,7 @@
  * pre-coloured unified diff (red = removed, green = added, dim = context).
  * Used by `agents doctor --diff`.
  */
-export interface UnifiedDiffOptions {
+interface UnifiedDiffOptions {
     /** Number of context lines around each change (default: 3). */
     context?: number;
     /** Filename label shown in the patch header for the "expected" side. */
@@ -23,3 +23,4 @@ export declare function unifiedDiff(expected: string, actual: string, options?:
  * a constant prefix so it nests cleanly under a header.
  */
 export declare function colorizeUnifiedDiff(patch: string, indent?: string): string;
+export {};

package/dist/lib/doctor-diff.d.ts

@@ -120,7 +120,7 @@ export declare function isCheckedOutSymlink(filePath: string): boolean;
  * when the mirror faithfully matches source.
  */
 export declare function describePluginDrift(central: DiscoveredPlugin, mirrorDir: string): string | null;
-export interface DiffOptions {
+interface DiffOptions {
     cwd?: string;
     /** Restrict to specific kinds; undefined = all. */
     kinds?: DoctorKind[];
@@ -134,3 +134,4 @@ export interface DiffOptions {
 }
 export declare function diffVersionResources(agent: AgentId, version: string, options?: DiffOptions): VersionResourceReport;
 export declare const DOCTOR_ALL_KINDS: DoctorKind[];
+export {};

package/dist/lib/drift-sync.d.ts

@@ -19,7 +19,7 @@
  */
 import { type VersionHealResult } from './heal.js';
 import { type UnifiedSyncStatus } from './sync-status.js';
-export interface DriftSyncOptions {
+interface DriftSyncOptions {
     cwd?: string;
     /** Reconcile everything detected with no prompts — the "kick it" path, also the
      * non-TTY / menu-bar-launched-with-flag behavior. Pulls `.system` if behind. */
@@ -29,7 +29,7 @@ export interface DriftSyncOptions {
     /** Skip the drift summary — set by callers that already printed their own. */
     quiet?: boolean;
 }
-export interface DriftSyncResult {
+interface DriftSyncResult {
     systemBehindBefore: number;
     systemPulled: boolean;
     healed: VersionHealResult[];
@@ -43,3 +43,4 @@ export interface DriftSyncResult {
  * callers (menu-bar, doctor) can report without re-scanning.
  */
 export declare function promptDriftSync(opts?: DriftSyncOptions): Promise<DriftSyncResult>;
+export {};

package/dist/lib/drift.d.ts

@@ -8,7 +8,7 @@
  * to an exit code. Neither reimplements the diagnostic — both call `computeDrift`.
  */
 import type { AgentId } from './types.js';
-import { type VersionResourceReport, type SourceLayerBehind } from './doctor-diff.js';
+import { type SourceLayerBehind } from './doctor-diff.js';
 export interface SyncStatusRow {
     agent: AgentId;
     version: string;
@@ -32,7 +32,6 @@ export interface OrphanRow {
     skills: number;
     hooks: number;
 }
-export declare function divergenceLines(report: VersionResourceReport): string[];
 export declare function checkSyncStatus(cwd: string): SyncStatusRow[];
 export declare function countOrphans(): OrphanRow[];
 /**
@@ -43,7 +42,7 @@ export declare function countOrphans(): OrphanRow[];
  * only the behind layers. Canonical home for both `agents doctor` and `agents doctor --check`.
  */
 export declare function computeSourceBehind(): SourceLayerBehind[];
-export interface DriftSummary {
+interface DriftSummary {
     syncRows: SyncStatusRow[];
     orphanRows: OrphanRow[];
     /** Versions whose sources changed since last sync. */
@@ -75,3 +74,4 @@ export interface DriftSummary {
  * maps to an exit code; the readout `agents doctor` renders in full.
  */
 export declare function computeDrift(cwd: string): DriftSummary;
+export {};

package/dist/lib/drift.js

@@ -12,7 +12,7 @@ import { getUserAgentsDir, getSystemAgentsDir, getEnabledExtraRepos } from './st
 // invalid manifest, or the bundled skills/commands missing from the mirror —
 // the system-repo plugin content that matters most). Other kinds collapse to
 // compact counts so the readout stays scannable.
-export function divergenceLines(report) {
+function divergenceLines(report) {
     const lines = [];
     for (const p of report.kinds.plugins) {
         if (p.status === 'missing')

package/dist/lib/event-families.d.ts

@@ -3,20 +3,14 @@
  * event reader. One vocabulary maps onto existing filters (includeActivity,
  * eventTypes, level) so the engine stays single-path.
  */
-import type { EventType } from './feed/events.js';
 import type { UnifiedQuery } from './event-stream.js';
 export declare const EVENT_FAMILIES: readonly ["ops", "activity", "commands", "runs", "security"];
 export type EventFamily = (typeof EVENT_FAMILIES)[number];
-export declare function isEventFamily(value: string): value is EventFamily;
 /**
  * Parse a comma-separated family list. Throws on unknown names or empty list
  * after split (same discipline as sessions role lists).
  */
 export declare function parseFamilyList(raw: string, flagName: string): EventFamily[];
-/** Command-churn event kinds. */
-export declare const COMMAND_EVENT_TYPES: readonly EventType[];
-/** Run-dispatch outcome kinds (replaces the separate audit/log.jsonl product). */
-export declare const RUN_EVENT_TYPES: readonly EventType[];
 /**
  * Fold family include/exclude into a UnifiedQuery.
  * Precedence: family narrows sources/types; field filters (module, event, …)

package/dist/lib/event-families.js

@@ -11,7 +11,7 @@ export const EVENT_FAMILIES = [
     'security',
 ];
 const FAMILY_SET = new Set(EVENT_FAMILIES);
-export function isEventFamily(value) {
+function isEventFamily(value) {
     return FAMILY_SET.has(value);
 }
 /**
@@ -34,9 +34,9 @@ export function parseFamilyList(raw, flagName) {
     return out;
 }
 /** Command-churn event kinds. */
-export const COMMAND_EVENT_TYPES = ['command.start', 'command.end'];
+const COMMAND_EVENT_TYPES = ['command.start', 'command.end'];
 /** Run-dispatch outcome kinds (replaces the separate audit/log.jsonl product). */
-export const RUN_EVENT_TYPES = ['run.dispatched', 'run.launch', 'agent.run.end'];
+const RUN_EVENT_TYPES = ['run.dispatched', 'run.launch', 'agent.run.end'];
 /**
  * Fold family include/exclude into a UnifiedQuery.
  * Precedence: family narrows sources/types; field filters (module, event, …)

package/dist/lib/event-provenance.d.ts

@@ -1,5 +1,5 @@
 import { type ActorKind } from './actor.js';
-export interface EventProvenance {
+interface EventProvenance {
     osUser: string;
     transport: 'local' | 'ssh';
     sshClientIp?: string;
@@ -19,3 +19,4 @@ export interface EventProvenance {
  */
 export declare function stampProvenance(env?: NodeJS.ProcessEnv): EventProvenance;
 export declare function resetEventProvenanceForTest(): void;
+export {};

package/dist/lib/events-ingest.d.ts

@@ -1,9 +1,9 @@
-export interface IngestReject {
+interface IngestReject {
     /** 1-based index of the offending line within the batch. */
     line: number;
     reason: string;
 }
-export interface IngestResult {
+interface IngestResult {
     written: number;
     rejected: IngestReject[];
     /** Per-store counts, so a caller/test can assert routing without reading files. */
@@ -12,7 +12,7 @@ export interface IngestResult {
         activity: number;
     };
 }
-export interface IngestOptions {
+interface IngestOptions {
     /**
      * Producer name, stamped as `module` on operational records so
      * `agents events --module <source>` filters to this producer. Required: an
@@ -44,3 +44,4 @@ export declare function routeFor(event: string, sessionId: unknown): 'activity'
  * events, and the caller still learns exactly which line failed and why.
  */
 export declare function ingestBatch(input: string, opts: IngestOptions): IngestResult;
+export {};

package/dist/lib/exec-account-home.d.ts

@@ -3,8 +3,8 @@ import { isSymlinkAdoptedHarness } from './installations/shims.js';
 import type { AgentId, DeviceAccountSlot, Meta } from './types.js';
 export { isAccountSlotDir } from './agents.js';
 export { isSymlinkAdoptedHarness };
-export type SpawnHomeSource = 'slot' | 'legacy-home' | 'provisioned';
-export interface NativeSpawnHome {
+type SpawnHomeSource = 'slot' | 'legacy-home' | 'provisioned';
+interface NativeSpawnHome {
     execHome: string;
     source: SpawnHomeSource;
     slot?: DeviceAccountSlot;
@@ -32,8 +32,6 @@ export declare function durableSlotEnv(agent: AgentId, account: {
 export declare function missingSlotHint(agent: AgentId, name: string): string;
 export declare function symlinkAdoptedAccountError(agent: AgentId, name: string, defaultName: string | undefined): string;
 export declare function adoptedSymlinkMismatchError(agent: AgentId, name: string, execHome: string): string;
-/** The adopted `~/.<config>` symlink's resolved target, or null when missing / not a symlink. */
-export declare function adoptedConfigTarget(agent: AgentId): string | null;
 export declare function adoptedConfigPointsAtHome(agent: AgentId, home: string): boolean;
 /**
  * For a symlink-adopted harness, point `~/.<config>` at this account's slot

package/dist/lib/exec-account-home.js

@@ -80,7 +80,7 @@ export function adoptedSymlinkMismatchError(agent, name, execHome) {
         + `Switch with: agents accounts default ${agent} ${name}`;
 }
 /** The adopted `~/.<config>` symlink's resolved target, or null when missing / not a symlink. */
-export function adoptedConfigTarget(agent) {
+function adoptedConfigTarget(agent) {
     const configPath = getAgentConfigPath(agent);
     try {
         const stat = fs.lstatSync(configPath);

package/dist/lib/exec-bounded.d.ts

@@ -25,9 +25,7 @@
  * is reported in the returned {@link BoundedExecResult} so a caller on a tick
  * path can branch on it instead of wrapping every call in try/catch.
  */
-/** Grace between SIGTERM and SIGKILL for a child that overran its deadline. */
-export declare const KILL_GRACE_MS = 250;
-export interface ExecFileBoundedOptions {
+interface ExecFileBoundedOptions {
     /** Hard wall-clock cap. On expiry the child's process group is SIGTERMed, then SIGKILLed after {@link KILL_GRACE_MS}. Required — an unbounded tick-path spawn is the bug this helper exists to prevent. */
     timeoutMs: number;
     /** Working directory for the child. */
@@ -37,7 +35,7 @@ export interface ExecFileBoundedOptions {
     /** Optional stdin to write to the child. */
     input?: string;
 }
-export interface BoundedExecResult {
+interface BoundedExecResult {
     stdout: string;
     stderr: string;
     /** Exit code, or null when the process was killed by a signal (including our timeout kill) or never spawned. */
@@ -50,3 +48,4 @@ export interface BoundedExecResult {
  * timeout. Resolves (never rejects) with the captured output and outcome.
  */
 export declare function execFileBounded(file: string, args: string[], opts: ExecFileBoundedOptions): Promise<BoundedExecResult>;
+export {};

package/dist/lib/exec-bounded.js

@@ -27,7 +27,7 @@
  */
 import { spawn } from 'child_process';
 /** Grace between SIGTERM and SIGKILL for a child that overran its deadline. */
-export const KILL_GRACE_MS = 250;
+const KILL_GRACE_MS = 250;
 /**
  * Run `file args` with a hard deadline, killing the whole process group on
  * timeout. Resolves (never rejects) with the captured output and outcome.