@vodmal/vdx-cli 0.26.0 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vodmal/vdx-cli",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "vdx — unified lifecycle interface (up/down/build/test/check/fix) + versioned maturity audit with drift detection. Pairs with the vdx Claude Code plugin.",
   "keywords": [
     "vdx",
@@ -34,6 +34,7 @@
     "LICENSE"
   ],
   "scripts": {
+    "prepare": "git config core.hooksPath .githooks || true",
     "vdx": "tsx src/index.ts",
     "vdx-mcp": "tsx src/mcp-server.ts",
     "audit": "tsx src/index.ts audit",
@@ -41,10 +42,13 @@
     "typecheck": "tsc --noEmit",
     "format:check": "prettier --check .",
     "lint": "eslint .",
-    "check": "npm run typecheck && npm run format:check && npm run lint",
+    "knip": "knip",
+    "check": "npm run typecheck && npm run format:check && npm run lint && npm run knip",
+    "check:code:security": "npm audit --omit=dev",
     "fix": "eslint --fix . && prettier --write .",
     "test": "vitest run",
     "test:unit": "vitest run tests/unit",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "coverage": "vitest run --coverage"
   },
   "dependencies": {
@@ -62,18 +66,19 @@
     "@types/js-yaml": "^4.0.9",
     "@types/marked-terminal": "^6.1.1",
     "@types/node": "^22.0.0",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^10.12.0",
     "eslint-config-prettier": "^10.1.8",
+    "knip": "^6.41.0",
     "prettier": "^3.9.10",
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.71.2",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.11"
   },
   "publishConfig": {
     "access": "public"
   },
   "engines": {
-    "node": ">=20.11"
+    "node": ">=22"
   }
 }

package/rubric/vdx-rubric.yaml

@@ -11,7 +11,7 @@ schema_version: "0.3"
 
 metadata:
   name: vdx-rubric-vodmal
-  version: "1.4.2"
+  version: "1.5.0"
   description: "Personal maturity rubric for multi-stack projects (vodmal)"
   owner: vodmal
   homepage: "https://github.com/vodmal/vdx-rubric"
@@ -470,6 +470,10 @@ axes:
 
   - id: observability
     class: supporting
+    # v1.5.0: логгер, Sentry и релиз в Sentry — у процесса, который работает и
+    # падает без человека. Библиотека и CLI (lib-intent) пишут в stderr и код
+    # выхода — у них ось excluded. Определение lib-intent — в lifecycle-interface.L3.
+    applies_when: { not: *lib_intent }
     storage: level
     default_target: L4
     fact_sources: [composer.json, package.json, .github/workflows/]
@@ -526,6 +530,9 @@ axes:
   - id: mock-infra
     class: supporting
     applies_to: [php, node, go, python]
+    # v1.5.0: mock-сервер и проверка, что моков нет в проде, — у сервиса с
+    # зависимостями. У библиотеки и CLI (lib-intent) ось excluded.
+    applies_when: { not: *lib_intent }
     storage: level
     default_target: L4
     fact_sources: [composer.json, package.json, docker-compose.yml, mock-server/]

package/src/ai.ts

@@ -49,12 +49,12 @@ import { at, errorMessage, isStringList, str } from './narrow.ts';
  */
 
 /** A prompt a conditional flag is known to cause, and the tmux keys that answer it. */
-export interface ConfirmRule {
+interface ConfirmRule {
   screen: string;
   keys: string[];
 }
 
-export interface WhenRule {
+interface WhenRule {
   id: string;
   description?: string;
   if: Predicate;
@@ -71,7 +71,7 @@ export interface AgentProfile {
   when?: WhenRule[];
 }
 
-export type Multiplexer = 'tmux' | 'none';
+type Multiplexer = 'tmux' | 'none';
 
 /** A place a project's short name may come from: a structured file and a dot path into it. */
 export interface NameSource {
@@ -80,7 +80,7 @@ export interface NameSource {
   jsonpath: string;
 }
 
-export interface SessionProfile {
+interface SessionProfile {
   multiplexer?: Multiplexer;
   name?: string;
   /** Tried after `[_.vdx] name` (or the older `[vdx]`) in the project's mise.toml; the first non-empty string wins. */
@@ -107,7 +107,7 @@ export interface PersonalHook {
   description?: string;
 }
 
-export interface GitProfile {
+interface GitProfile {
   /** Directories whose repos are the neighbours an author is proposed from; default — the project's parent. */
   author_pool?: string[];
   hooks?: PersonalHook[];
@@ -121,19 +121,19 @@ export interface Environment {
   git?: GitProfile;
 }
 
-export const ENVIRONMENT_ENV_VAR = 'VDX_ENVIRONMENT';
-export const HOST_ENV_VAR = 'VDX_HOST';
+const ENVIRONMENT_ENV_VAR = 'VDX_ENVIRONMENT';
+const HOST_ENV_VAR = 'VDX_HOST';
 /** Set by `vdx ai@<host>` for the vdx it starts there: the machine the person sits at. */
-export const SEAT_ENV_VAR = 'VDX_AI_FROM';
+const SEAT_ENV_VAR = 'VDX_AI_FROM';
 /**
  * `1` in the environment of an agent started with `vdx ai --focused`, and so of
  * its hooks and MCP servers: nothing wakes this session or reads its inbox for it.
  */
-export const FOCUSED_ENV_VAR = 'VDX_FOCUSED';
-export const USER_ENVIRONMENT_FILE = '.vdx-environment.yaml';
+const FOCUSED_ENV_VAR = 'VDX_FOCUSED';
+const USER_ENVIRONMENT_FILE = '.vdx-environment.yaml';
 /** Tried in order when no profile names an agent. Started plain, with no flags. */
-export const FALLBACK_AGENTS = ['claude', 'codex'] as const;
-export const DEFAULT_SESSION_NAME = '{project}';
+const FALLBACK_AGENTS = ['claude', 'codex'] as const;
+const DEFAULT_SESSION_NAME = '{project}';
 
 export function resolveEnvironmentPath(
   env: NodeJS.ProcessEnv = process.env,
@@ -401,7 +401,7 @@ export interface ProcInfo {
   args: string;
 }
 
-export const PANE_FORMAT = '#{session_name}\t#{pane_id}\t#{pane_pid}\t#{pane_current_path}';
+const PANE_FORMAT = '#{session_name}\t#{pane_id}\t#{pane_pid}\t#{pane_current_path}';
 
 export function parsePanes(out: string): PaneInfo[] {
   const panes: PaneInfo[] = [];
@@ -462,7 +462,7 @@ function realpathOr(p: string): string {
   }
 }
 
-export function isInside(child: string, parent: string): boolean {
+function isInside(child: string, parent: string): boolean {
   return child === parent || child.startsWith(parent.endsWith(path.sep) ? parent : parent + path.sep);
 }
 
@@ -497,7 +497,7 @@ export function missingArgs(procArgs: string, required: string[]): string[] {
   return required.filter((a) => (/\s/.test(a) ? !procArgs.includes(a) : !tokens.has(a)));
 }
 
-export function resolveProjectRoot(p: string): string | null {
+function resolveProjectRoot(p: string): string | null {
   const abs = path.resolve(p);
   try {
     if (!fs.statSync(abs).isDirectory()) return null;
@@ -580,12 +580,12 @@ export function hostLabel(env: NodeJS.ProcessEnv = process.env): string {
 }
 
 /** The machine the person sits at: the one whose `vdx ai@<host>` started this vdx, else this one. */
-export function seatLabel(env: NodeJS.ProcessEnv = process.env): string {
+function seatLabel(env: NodeJS.ProcessEnv = process.env): string {
   return env[SEAT_ENV_VAR]?.trim() || hostLabel(env);
 }
 
 /** Machine labels compare without case: `M3` in the profile is `m3` in a transcript. */
-export function sameMachine(a: string | null, b: string | null): boolean {
+function sameMachine(a: string | null, b: string | null): boolean {
   return (a ?? '').toLowerCase() === (b ?? '').toLowerCase();
 }
 
@@ -737,7 +737,7 @@ export interface AiDeps {
   liveHere?: () => LiveSession[];
 }
 
-export function runSsh(args: string[], capture: boolean): { status: number; stdout: string } | null {
+function runSsh(args: string[], capture: boolean): { status: number; stdout: string } | null {
   const res = spawnSync('ssh', args, { stdio: capture ? ['ignore', 'pipe', 'ignore'] : 'inherit', encoding: 'utf8' });
   if (at(res.error, 'code') === 'ENOENT') return null;
   return { status: res.status ?? 1, stdout: res.stdout ?? '' };
@@ -748,7 +748,7 @@ export function sleepSync(ms: number): void {
 }
 
 /** Read one line from the terminal, synchronously: the prompt runs before tmux takes it. */
-export function askLine(prompt: string): string | null {
+function askLine(prompt: string): string | null {
   process.stderr.write(prompt);
   const buf = Buffer.alloc(256);
   let text = '';
@@ -798,9 +798,9 @@ export const EXIT_LAUNCH_FAILED = 4;
  * a start with the resume args had nothing to resume (`claude --continue` exits
  * 1 at once); the window covers answering the channel prompt that comes first.
  */
-export const NOTHING_TO_RESUME_MS = 30_000;
+const NOTHING_TO_RESUME_MS = 30_000;
 
-export function renderPlan(
+function renderPlan(
   plan: LaunchPlan,
   multiplexer: Multiplexer,
   running: AgentPane[],
@@ -1083,7 +1083,7 @@ export function runAiRemote(opts: AiOptions, host: string, deps: AiDeps, from: s
  * The Claude Code sessions alive on `host` right now; null when it does not
  * answer over ssh (BatchMode: a password prompt counts as no answer).
  */
-export function askMachine(host: string, deps: AiDeps): MachineReport | null {
+function askMachine(host: string, deps: AiDeps): MachineReport | null {
   const res = (deps.ssh ?? runSsh)(
     ['-o', 'BatchMode=yes', '-o', 'ConnectTimeout=5', host, `sh -c ${shellQuote(LIVE_SESSIONS_SCRIPT)}`],
     true,
@@ -1092,7 +1092,7 @@ export function askMachine(host: string, deps: AiDeps): MachineReport | null {
 }
 
 /** What a start continues: resume args here, or a conversation on another machine. */
-export interface ConversationChoice {
+interface ConversationChoice {
   args: string[];
   /** Continue it on that machine (`vdx ai@<host>`); `reachable` — it answered over ssh just now. */
   remote?: { host: string; id: string; reachable: boolean };
@@ -1106,7 +1106,7 @@ export interface ConversationChoice {
   lines: string[];
 }
 
-export function isClaude(command: string): boolean {
+function isClaude(command: string): boolean {
   return path.basename(command) === 'claude';
 }
 
@@ -1136,7 +1136,7 @@ const resumeId = (id: string) => ['--resume', id];
  * takes the newest overall; without a terminal it is this machine's newest
  * idle one, never another's.
  */
-export function chooseConversation(plan: LaunchPlan, deps: AiDeps, canAsk: boolean): ConversationChoice {
+function chooseConversation(plan: LaunchPlan, deps: AiDeps, canAsk: boolean): ConversationChoice {
   if (!isClaude(plan.command)) return { args: plan.resumeArgs, lines: [] };
   const host = plan.host;
   const same = sameMachine;
@@ -1412,7 +1412,7 @@ export function processFocused(pid: number): boolean {
 }
 
 /** macOS guards these folders on their own; a tmux server can hold a denial for every session under it. */
-export const GUARDED_FOLDERS = ['Downloads', 'Desktop', 'Documents'];
+const GUARDED_FOLDERS = ['Downloads', 'Desktop', 'Documents'];
 
 /**
  * The guarded folders an agent started here could not read. Through the tmux server

package/src/author.ts

@@ -81,7 +81,7 @@ const GENERIC = new Set([
   'dmitry',
 ]);
 
-export function nameTokens(dir: string, remotePath: string): Set<string> {
+function nameTokens(dir: string, remotePath: string): Set<string> {
   return new Set(
     `${path.basename(dir)} ${remotePath}`
       .toLowerCase()

package/src/conversations.ts

@@ -29,7 +29,7 @@ import { at, dict, str } from './narrow.ts';
  */
 
 /** The opening of `vdx ai --check`'s text; the label is an ssh destination from the other machines. */
-export const MACHINE_LINE_PREFIX = 'vdx ai: this machine is';
+const MACHINE_LINE_PREFIX = 'vdx ai: this machine is';
 const MACHINE_LINE_RE = /^vdx ai: this machine is `([^`]+)`/m;
 /** A label read from a synced file goes to ssh: it must not be able to read as an option. */
 const LABEL_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -112,7 +112,7 @@ export function readConversation(file: string, updated: Date): Conversation | nu
 }
 
 /** Which of `ids` had a prompt typed in them on this machine. */
-export function typedHere(env: NodeJS.ProcessEnv, home: string, ids: Set<string>): Set<string> {
+function typedHere(env: NodeJS.ProcessEnv, home: string, ids: Set<string>): Set<string> {
   const found = new Set<string>();
   let text: string;
   try {
@@ -235,7 +235,7 @@ export interface LiveSession {
 }
 
 /** Session files, one JSON object per line — a file read here, or the output of LIVE_SESSIONS_SCRIPT. */
-export function parseLiveSessions(text: string): LiveSession[] {
+function parseLiveSessions(text: string): LiveSession[] {
   const out: LiveSession[] = [];
   for (const line of text.split('\n')) {
     if (!line.trim().startsWith('{')) continue;

package/src/doctor.ts

@@ -99,24 +99,24 @@ function checkNode(): CheckResult {
       label: 'Node.js',
       status: 'missing',
       message: 'node binary not on PATH',
-      remedy: 'https://nodejs.org/en/download (LTS ≥ 20 recommended)',
+      remedy: 'https://nodejs.org/en/download (vdx needs 22 or newer)',
     };
   }
   const major = parseSemverMajor(v);
   if (major === null) {
     return { id: 'node', label: 'Node.js', status: 'warning', message: `unparseable version: ${v}` };
   }
-  if (major < 20) {
+  if (major < 22) {
     return {
       id: 'node',
       label: 'Node.js',
       status: 'warning',
       level: 1,
-      message: `${v} — below recommended (≥ 20 LTS)`,
-      remedy: 'mise use -g node@20 (or upgrade via nvm/brew)',
+      message: `${v} — vdx needs 22 or newer (engines in its package.json)`,
+      remedy: 'mise use -g node@24 (or upgrade via nvm/brew)',
     };
   }
-  return { id: 'node', label: 'Node.js', status: 'ok', level: major >= 22 ? 4 : 3, message: v };
+  return { id: 'node', label: 'Node.js', status: 'ok', level: major >= 24 ? 4 : 3, message: v };
 }
 
 function checkGit(): CheckResult {

package/src/evaluator.ts

@@ -3,7 +3,7 @@ import type { Ctx } from './facts.ts';
 import { REGISTRY, isUnknown, type Args, type Unknown, type Verdict } from './predicates.ts';
 import { at, isDict, list } from './narrow.ts';
 
-export { isUnknown, type Unknown, type Verdict };
+export { isUnknown, type Verdict };
 
 /**
  * Sugar shorthand: `{ has_task: "up" }` → `{ fn: "has_task", args: { task: "up" } }`

package/src/facts.ts

@@ -16,12 +16,43 @@ export interface Ctx {
   fallbackRoot?: string;
 }
 
-/** Absolute path of `rel`: here, else in `fallbackRoot` when it is there. */
-function locate(ctx: Ctx, rel: string): string {
-  const here = path.join(ctx.projectRoot, rel);
-  if (ctx.fallbackRoot === undefined || fs.existsSync(here)) return here;
-  const there = path.join(ctx.fallbackRoot, rel);
-  return fs.existsSync(there) ? there : here;
+/** Names in `dir`, read once per context; none when it cannot be read. */
+function entries(ctx: Ctx, dir: string): string[] {
+  const key = `dir:${dir}`;
+  let names = ctx.cache.get(key) as string[] | undefined;
+  if (!names) {
+    try {
+      names = fs.readdirSync(dir);
+    } catch {
+      names = [];
+    }
+    ctx.cache.set(key, names);
+  }
+  return names;
+}
+
+/**
+ * `rel` under `root`, each segment in the case it is written. APFS and NTFS find a file
+ * under any case and ext4 does not: `tests/Fixtures` was there on a Mac that has only
+ * `tests/fixtures`, and the same project got another level on Linux.
+ */
+function existsAsWritten(ctx: Ctx, root: string, rel: string): boolean {
+  let dir = root;
+  for (const name of path.normalize(rel).split(path.sep)) {
+    if (name === '' || name === '.') continue;
+    if (name !== '..' && !entries(ctx, dir).includes(name)) return false;
+    dir = path.join(dir, name);
+  }
+  return fs.existsSync(dir);
+}
+
+/** Absolute path of `rel`: here, else in `fallbackRoot`; null when in neither. */
+function locate(ctx: Ctx, rel: string): string | null {
+  if (existsAsWritten(ctx, ctx.projectRoot, rel)) return path.join(ctx.projectRoot, rel);
+  if (ctx.fallbackRoot !== undefined && existsAsWritten(ctx, ctx.fallbackRoot, rel)) {
+    return path.join(ctx.fallbackRoot, rel);
+  }
+  return null;
 }
 
 /** The same directory without the fallback: a project's tasks are the ones its own runner sees. */
@@ -36,13 +67,17 @@ function ownCtx(ctx: Ctx): Ctx {
 }
 
 export function fileExists(ctx: Ctx, rel: string): boolean {
-  return fs.existsSync(locate(ctx, rel));
+  return locate(ctx, rel) !== null;
 }
 
 export function readText(ctx: Ctx, rel: string): string | null {
   const key = `file:${rel}`;
   if (ctx.cache.has(key)) return ctx.cache.get(key) as string | null;
   const abs = locate(ctx, rel);
+  if (abs === null) {
+    ctx.cache.set(key, null);
+    return null;
+  }
   try {
     const t = fs.readFileSync(abs, 'utf8');
     ctx.cache.set(key, t);
@@ -89,7 +124,7 @@ export function readToml(ctx: Ctx, rel: string): unknown {
   }
 }
 
-export function readYaml(ctx: Ctx, rel: string): unknown {
+function readYaml(ctx: Ctx, rel: string): unknown {
   const key = `yaml:${rel}`;
   if (ctx.cache.has(key)) return ctx.cache.get(key);
   const text = readText(ctx, rel);
@@ -183,13 +218,9 @@ export function expandPaths(paths: string[], ctx: Ctx): string[] {
         const dir = m[1];
         const ext = m[2];
         const abs = locate(ctx, dir);
-        try {
-          const files = fs.readdirSync(abs);
-          for (const f of files) {
-            if (f.endsWith('.' + ext)) out.push(path.join(dir, f));
-          }
-        } catch {
-          /* dir missing — silent */
+        // A missing dir lists nothing.
+        for (const f of abs === null ? [] : entries(ctx, abs)) {
+          if (f.endsWith('.' + ext)) out.push(path.join(dir, f));
         }
       }
     } else {

package/src/gha.ts

@@ -83,7 +83,7 @@ function truthy(v: unknown): boolean {
   return v === true || v === 'true';
 }
 
-export function parseWorkflow(file: string, text: string): GhaWorkflow | null {
+function parseWorkflow(file: string, text: string): GhaWorkflow | null {
   let data: unknown;
   try {
     data = YAML.load(text);
@@ -162,7 +162,7 @@ export function ciSystems(ctx: Ctx): string[] {
 /** `|| true` and its relatives: the step reports success whatever the command did. */
 const MASK_RE = /\|\|\s*(true|:|exit\s+0)\b/;
 
-export function stepMasked(step: GhaStep, job: GhaJob): boolean {
+function stepMasked(step: GhaStep, job: GhaJob): boolean {
   if (job.continueOnError || step.continueOnError) return true;
   return step.run !== undefined && MASK_RE.test(step.run);
 }

package/src/hooks.ts

@@ -18,7 +18,7 @@ import YAML from 'js-yaml';
 import { fileExists, isPackagePresent, readJson, readText, readToml, type Ctx } from './facts.ts';
 import { at, dict, isDict, list } from './narrow.ts';
 
-export type FrameworkId = 'husky' | 'lefthook' | 'simple-git-hooks' | 'cghooks' | 'githooks';
+type FrameworkId = 'husky' | 'lefthook' | 'simple-git-hooks' | 'cghooks' | 'githooks';
 
 export interface HookFramework {
   id: FrameworkId;
@@ -69,7 +69,7 @@ interface InstallStep {
 }
 
 /** Yarn 2+ does not run a project's `prepare` (husky docs, How To → Yarn). */
-export function yarnBerry(ctx: Ctx): boolean {
+function yarnBerry(ctx: Ctx): boolean {
   const pm = at(readJson(ctx, 'package.json'), 'packageManager');
   if (typeof pm === 'string') {
     const m = pm.match(/^yarn@(\d+)/);
@@ -297,7 +297,7 @@ export function detectHookFrameworks(ctx: Ctx): HookFramework[] {
 }
 
 /** What a clone runs to switch hooks on: the install step of the project's package manager. */
-export function installCommand(fw: HookFramework, ctx: Ctx): string {
+function installCommand(fw: HookFramework, ctx: Ctx): string {
   if (fw.installedBy === null) return fw.manualInstall;
   if (fw.installedBy.startsWith('composer')) return 'composer install';
   if (fw.installedBy === 'mise task up') return 'vdx up';

package/src/init.ts

@@ -6,7 +6,7 @@ import { at } from './narrow.ts';
 export const STANDARD_VERBS = ['up', 'down', 'build', 'test', 'check', 'fix'] as const;
 export type Verb = (typeof STANDARD_VERBS)[number];
 
-export const DEFAULT_BASELINE = 'github.com/VoDmAl/vdx-rubric-vodmal@v1.4.2';
+export const DEFAULT_BASELINE = 'github.com/VoDmAl/vdx-rubric-vodmal@v1.5.0';
 
 const VERB_ALIASES: Record<Verb, string[]> = {
   up: ['docker:up', 'docker-up', 'docker:up:detached', 'start', 'dev', 'serve'],
@@ -78,9 +78,9 @@ const VERB_SUFFIX_GROUPS: Record<Verb, string[]> = {
   fix: [':fix', '-fix', ':format'],
 };
 
-export type MatchReason = 'exact' | 'alias' | 'prefix-group' | 'suffix-group' | 'not-found';
+type MatchReason = 'exact' | 'alias' | 'prefix-group' | 'suffix-group' | 'not-found';
 
-export interface VerbMapping {
+interface VerbMapping {
   verb: Verb;
   nativeTask: string | null;
   runCommand: string | null;
@@ -219,11 +219,6 @@ export function selectVerbTask(verb: Verb, tasks: Set<string>): VerbMatch {
   return { task: null, reason: 'not-found', alternatives: [] };
 }
 
-/** Kept for back-compat with potential external callers; prefer `selectVerbTask`. */
-export function mapVerb(verb: Verb, tasks: Set<string>): string | null {
-  return selectVerbTask(verb, tasks).task;
-}
-
 function collectTools(ctx: Ctx): Record<string, string> {
   const tools: Record<string, string> = {};
   const php = at(readJson(ctx, 'composer.json'), 'require', 'php');
@@ -253,7 +248,7 @@ function quoteToml(s: string): string {
   return '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
 
-export function renderMiseToml(
+function renderMiseToml(
   tools: Record<string, string>,
   mappings: VerbMapping[],
   stack: string,

package/src/personal-hooks.ts

@@ -9,14 +9,13 @@
  */
 import * as fs from 'node:fs';
 import * as os from 'node:os';
-import * as path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import type { CheckResult } from './doctor.ts';
 import { loadEnvironment, resolveEnvironmentPath, type PersonalHook } from './ai.ts';
 import { missingMachinePaths } from './hooks.ts';
 
 /** Git reads hooks from config since 2.54; older git skips the keys without a word. */
-export const CONFIG_HOOKS_SINCE: [number, number] = [2, 54];
+const CONFIG_HOOKS_SINCE: [number, number] = [2, 54];
 
 export interface PersonalHookDeps {
   env: NodeJS.ProcessEnv;
@@ -62,7 +61,7 @@ function events(h: PersonalHook): string[] {
 }
 
 /** The hooks of the profile that apply on this machine; null — no profile, or none declared. */
-export function applicableHooks(deps: PersonalHookDeps): PersonalHook[] | null {
+function applicableHooks(deps: PersonalHookDeps): PersonalHook[] | null {
   const file = resolveEnvironmentPath(deps.env, deps.home);
   if (!file) return null;
   let hooks: PersonalHook[];
@@ -185,8 +184,3 @@ export function fixPersonalHooks(deps: PersonalHookDeps = defaultPersonalHookDep
   }
   return done;
 }
-
-/** For messages: where the user config lives. */
-export function userGitConfigPath(deps: PersonalHookDeps): string {
-  return deps.env['GIT_CONFIG_GLOBAL'] ?? path.join(deps.home, '.gitconfig');
-}

package/src/publish.ts

@@ -383,7 +383,7 @@ export function preflightFixable(plan: PublishPlan): boolean {
 }
 
 /** Runs a command on this terminal (stdio inherited); throws on a non-zero exit. */
-export type CommandRunner = (cmd: string, args: string[], cwd: string) => void;
+type CommandRunner = (cmd: string, args: string[], cwd: string) => void;
 
 export interface PublishDeps {
   run: CommandRunner;

package/src/rubric.ts

@@ -4,20 +4,20 @@ import { COMBINATORS, predicateNames } from './evaluator.ts';
 import { REGISTRY, REMOVED_IN_0_3 } from './predicates.ts';
 
 export type LevelName = 'L0' | 'L1' | 'L2' | 'L3' | 'L4';
-export type AxisClass = 'critical' | 'supporting';
-export type Storage = 'level' | 'flags';
+type AxisClass = 'critical' | 'supporting';
+type Storage = 'level' | 'flags';
 
 // Predicate структура динамическая — оставляем any для дешёвого парсинга
 // со сахаром. Валидация — отдельная история v0.2.
 export type Predicate = unknown;
 
-export interface Flag {
+interface Flag {
   id: string;
   weight: number;
   predicate: Predicate;
 }
 
-export interface StackImpl {
+interface StackImpl {
   flags?: Flag[];
   level_thresholds?: Partial<Record<LevelName, number>>;
 }

package/src/vocabulary.ts

@@ -7,7 +7,7 @@
 import { listAllTasks, readJson, readToml, type Ctx } from './facts.ts';
 import { at, dict, list } from './narrow.ts';
 
-export const LIFECYCLE_VOCABULARY = ['up', 'down', 'build', 'test', 'check', 'fix'] as const;
+const LIFECYCLE_VOCABULARY = ['up', 'down', 'build', 'test', 'check', 'fix'] as const;
 
 /** npm-family options that take a value; their value is not the script name. */
 const VALUE_OPTIONS = new Set(['--prefix', '-C', '--dir', '-w', '--workspace', '--filter', '--cwd']);
@@ -98,7 +98,7 @@ export function isVocabularyTask(name: string, words: readonly string[] = ['test
 }
 
 /** Tasks a task's definition calls: composer `@refs`, `npm run X` inside a script, mise `depends`/`run`. */
-export function taskChildren(ctx: Ctx, name: string): string[] {
+function taskChildren(ctx: Ctx, name: string): string[] {
   const out: string[] = [];
   const entry = at(readJson(ctx, 'composer.json'), 'scripts', name);
   if (entry !== undefined) {