appduct 0.10.0 → 0.11.0

package/dist/commands/daemon/context.d.ts

@@ -0,0 +1,14 @@
+/** The context shared by the `appduct daemon <action>` handlers (`run.ts`, `start.ts`, `stop.ts`,
+ * `status.ts`). One file per action so the CLI's lazy router (`cli/router.ts`) can load `status`
+ * without evaluating `run`'s daemon implementation (ARCHITECTURE.md §10 "Startup cost"). */
+import type { Clock } from "../../cli/types.js";
+import type { SpawnFn } from "../../rpc/client.js";
+export type DaemonCommandContext = {
+    stateDir: string;
+    clock?: Clock;
+    spawn?: SpawnFn;
+    warn?: (message: string) => void;
+    /** Test seam: the version `daemon status` compares the daemon against; defaults to this
+     * package's own version. */
+    clientVersion?: string;
+};

package/dist/commands/daemon/run.d.ts

@@ -0,0 +1,11 @@
+/** `appduct daemon run` (ARCHITECTURE.md §4): host the daemon in this process. The only daemon
+ * action that loads the daemon implementation itself (`daemon/daemon.ts`, and with it `ws` and the
+ * certificate stack), which is why it lives in its own module. */
+import type { CliResult, DaemonRunCommandData } from "../../cli/result-types.js";
+import type { DaemonCommandContext } from "./context.js";
+export type DaemonRunHostedResult = {
+    result: CliResult<DaemonRunCommandData>;
+    completion: Promise<void>;
+    stop: () => void;
+};
+export declare const handleDaemonRunCommand: (context: DaemonCommandContext) => Promise<DaemonRunHostedResult>;

package/dist/commands/daemon/start.d.ts

@@ -0,0 +1,5 @@
+/** `appduct daemon start` (ARCHITECTURE.md §4): a `daemon.status` call with auto-spawn on, so a
+ * daemon that isn't running gets started as a detached process — never in-process. */
+import type { CliResult, DaemonStartCommandData } from "../../cli/result-types.js";
+import type { DaemonCommandContext } from "./context.js";
+export declare const handleDaemonStartCommand: (context: DaemonCommandContext) => Promise<CliResult<DaemonStartCommandData>>;

package/dist/commands/daemon/status.d.ts

@@ -0,0 +1,5 @@
+/** `appduct daemon status` (ARCHITECTURE.md §4): `daemon.status` passthrough plus the version-drift
+ * diagnosis. Warns instead of restarting, unlike the guarded commands (`cli/dispatch.ts`). */
+import type { CliResult, DaemonStatusCommandData } from "../../cli/result-types.js";
+import type { DaemonCommandContext } from "./context.js";
+export declare const handleDaemonStatusCommand: (context: DaemonCommandContext) => Promise<CliResult<DaemonStatusCommandData>>;

package/dist/commands/daemon/stop.d.ts

@@ -0,0 +1,5 @@
+/** `appduct daemon stop` (ARCHITECTURE.md §4): `daemon.shutdown` over RPC, falling back to a
+ * SIGTERM at the pidfile's process when the socket is not answering. */
+import type { CliResult, DaemonStopCommandData } from "../../cli/result-types.js";
+import type { DaemonCommandContext } from "./context.js";
+export declare const handleDaemonStopCommand: (context: DaemonCommandContext) => Promise<CliResult<DaemonStopCommandData>>;

package/dist/commands/doctor.d.ts

@@ -20,4 +20,3 @@ export type DoctorCommandContext = {
     exec?: ExecBufferFn;
 };
 export declare const handleDoctorCommand: (options: DoctorCommandOptions, context?: DoctorCommandContext) => Promise<CliResult<DoctorCommandData>>;
-//# sourceMappingURL=doctor.d.ts.map

package/dist/commands/events.d.ts

@@ -34,4 +34,3 @@ export type EventsHostedResult = {
     stop: () => void;
 };
 export declare const handleEventsCommand: (options: EventsCommandOptions, context: EventsCommandContext) => Promise<EventsHostedResult>;
-//# sourceMappingURL=events.d.ts.map

package/dist/commands/init.d.ts

@@ -2,9 +2,17 @@
  * `appduct init` (issue #29): the one command that takes an app root from "package installed"
  * to "an agent can connect".
  *
- * It writes a *project-level* `.appduct/config.json` holding the deep-link scheme, and returns
- * the two things that are not discoverable from the filesystem: the MCP server entry to paste into
- * an agent's config, and the `import "@appduct/react-native/auto"` reminder the app needs.
+ * It writes a *project-level* `.appduct/config.json` holding the deep-link scheme and, since issue
+ * #63, the installed app's id per platform (`appId.ios`/`appId.android` — needed to deliver a
+ * link with `--open ios-device`/`--open android` without an "Open with" chooser silently eating
+ * it), and returns the two things that are not discoverable from the filesystem: the MCP server
+ * entry to paste into an agent's config, and the `import "@appduct/react-native/auto"` reminder
+ * the app needs.
+ *
+ * Unlike `scheme`, an app id has no discovery tier: `--ios-app-id`/`--android-app-id` (or an
+ * already-recorded value) is the whole story, and the two are independent flags rather than one
+ * `--app-id` — the platforms' ids usually match but not always, and `init` never guesses one from
+ * the other (see `discoverNativeScheme`'s own refusal to guess when two probes disagree).
  *
  * What it deliberately does **not** do:
  *
@@ -38,6 +46,12 @@ import type { CliResult, InitCommandData } from "../cli/result-types.js";
 export type InitCommandOptions = {
     scheme?: string;
     force?: boolean;
+    /** Writes `appId.ios`. Optional and independent of `androidAppId` — the two ids usually match
+     * but not always, so `init` never guesses one from the other (issue #63; see
+     * `discoverNativeScheme`'s own refusal-to-guess for the same reasoning applied to a scheme). */
+    iosAppId?: string;
+    /** Writes `appId.android`. See {@link iosAppId}. */
+    androidAppId?: string;
 };
 export type InitCommandContext = {
     /** The app root to initialize. Defaults to `process.cwd()`. */
@@ -48,4 +62,3 @@ export type InitCommandContext = {
     homeDir?: string;
 };
 export declare const handleInitCommand: (options: InitCommandOptions, context?: InitCommandContext) => Promise<CliResult<InitCommandData>>;
-//# sourceMappingURL=init.d.ts.map

package/dist/commands/invoke.d.ts

@@ -19,4 +19,3 @@ export declare const handleInvokeCommand: (options: InvokeCommandOptions, contex
 /** Aborted on SIGINT (issue #9): closes the RPC connection that issued `tools.call`, which the
  * daemon treats as a mid-flight cancel and forwards to the app as `tool_cancel`. */
 signal?: AbortSignal) => Promise<CliResult<InvokeCommandData>>;
-//# sourceMappingURL=invoke.d.ts.map

package/dist/commands/keygen.d.ts

@@ -20,4 +20,3 @@ export type KeygenCommandContext = {
     stateDir: string;
 };
 export declare const handleKeygenCommand: (options: KeygenCommandOptions, context: KeygenCommandContext) => Promise<CliResult<KeygenCommandData>>;
-//# sourceMappingURL=keygen.d.ts.map

package/dist/commands/link.d.ts

@@ -11,7 +11,7 @@ export type LinkCommandOptions = {
     scheme?: string;
     open?: string;
     device?: string;
-    bundleId?: string;
+    appId?: string;
     relaunch?: boolean;
 };
 export type LinkCommandContext = {
@@ -27,4 +27,3 @@ export type LinkCommandContext = {
     schemeEnv?: NodeJS.ProcessEnv;
 };
 export declare const handleLinkCommand: (options: LinkCommandOptions, context: LinkCommandContext) => Promise<CliResult<LinkCommandData>>;
-//# sourceMappingURL=link.d.ts.map

package/dist/commands/ls.d.ts

@@ -6,4 +6,3 @@ export type LsCommandContext = {
     spawn?: SpawnFn;
 };
 export declare const handleLsCommand: (context: LsCommandContext) => Promise<CliResult<LsCommandData>>;
-//# sourceMappingURL=ls.d.ts.map

package/dist/commands/mcp.d.ts

@@ -22,10 +22,9 @@ export type McpCommandContext = {
     checkVersion?: VersionCheckOptions;
     /** `--scheme`, the highest-precedence source in `scheme.ts`'s order. */
     scheme?: string;
-    /** Where scheme discovery starts; defaults to `process.cwd()`. */
+    /** Where scheme discovery starts, and where `appduct_connect` resolves an `appId` from on each
+     * call (`ConnectToolDeps.cwd`); defaults to `process.cwd()`. */
     cwd?: string;
-    /** Overrides `config.json`'s `iosBundleId`; test seam, same shape as `scheme`. */
-    iosBundleId?: string;
     exec?: ExecFn;
     /** Environment for `adb`/`simctl`, not for `APPDUCT_SCHEME` (see `schemeEnv`). */
     env?: NodeJS.ProcessEnv;
@@ -46,4 +45,3 @@ export type McpHostedResult = {
     handle: McpServerHandle;
 };
 export declare const handleMcpCommand: (context: McpCommandContext) => Promise<McpHostedResult>;
-//# sourceMappingURL=mcp.d.ts.map

package/dist/commands/revoke.d.ts

@@ -9,4 +9,3 @@ export type RevokeCommandContext = {
     spawn?: SpawnFn;
 };
 export declare const handleRevokeCommand: (options: RevokeCommandOptions, context: RevokeCommandContext) => Promise<CliResult<RevokeCommandData>>;
-//# sourceMappingURL=revoke.d.ts.map

package/dist/commands/tools.d.ts

@@ -1,6 +1,8 @@
 /**
- * `appduct tools` (ARCHITECTURE.md §10): `tools [selector] [--full]` lists tools for a session;
- * `tools [selector] <name>` shows one tool's full schema/annotations.
+ * `appduct tools` (ARCHITECTURE.md §10): `tools [selector] [--full] [--group <name>] [--filter
+ * <text>] [--limit <n>] [--offset <n>]` lists tools for a session; `tools [selector] --groups`
+ * lists only the session's groups with their tool counts; `tools [selector] <name>` shows one
+ * tool's full schema/annotations.
  *
  * The command table gives both forms a leading optional `[selector]`, which makes a single
  * positional argument inherently ambiguous (is it the selector, or the tool name in `tools <name>`
@@ -8,16 +10,30 @@
  * first try the arg as a tool name in the implicit-selector session's registry; if no such tool
  * exists there (or the implicit selector doesn't resolve, e.g. `ambiguous_session`), fall back to
  * treating it as a selector and list that session's tools instead.
+ *
+ * `--group`/`--filter`/`--limit`/`--offset` only ever reach the daemon on a *listing* request: the detail
+ * path (an explicit `<name>`, or the ambiguous single-arg probe above) always asks for the whole,
+ * unpaged registry, so a name lookup can never miss a tool that paging would have left off a page.
  */
 import type { CliResult, ToolsCommandData } from "../cli/result-types.js";
 import { type SpawnFn } from "../rpc/client.js";
 export type ToolsCommandOptions = {
     selector?: string;
     name?: string;
+    /** Only tools in this group (`checkout` includes `checkout/*`). Listing only. */
+    group?: string;
+    /** List the session's groups with tool counts instead of its tools. Listing only, and
+     * exclusive with every other listing flag. */
+    groups?: boolean;
+    /** Case-insensitive substring match against name and description. Listing only. */
+    filter?: string;
+    /** Page size. Listing only. */
+    limit?: number;
+    /** Zero-based start index into the sorted, filtered list. Listing only. */
+    offset?: number;
 };
 export type ToolsCommandContext = {
     stateDir: string;
     spawn?: SpawnFn;
 };
 export declare const handleToolsCommand: (options: ToolsCommandOptions, context: ToolsCommandContext) => Promise<CliResult<ToolsCommandData>>;
-//# sourceMappingURL=tools.d.ts.map

package/dist/daemon/address.d.ts

@@ -27,4 +27,3 @@ export type DetectAdvertisedAddressOptions = {
  * IPv6 address, finally falling back to loopback if nothing else is available.
  */
 export declare const detectAdvertisedAddress: (options?: DetectAdvertisedAddressOptions) => AdvertisedAddress;
-//# sourceMappingURL=address.d.ts.map

package/dist/daemon/audit.d.ts

@@ -43,17 +43,13 @@ export type AuditRecord = {
     /**
      * Set only when a `"prompt"`-policy call actually proceeded because the MCP server confirmed a
      * consent gate (ARCHITECTURE.md §12). Deliberately distinct from a plain `"ok"`: the daemon
-     * never observed either channel's client-side behavior itself, only that the call arrived
-     * carrying this marker. The value distinguishes which gate fired:
-     * - `"client"` (issue #14): the flag-based gate — the weaker of the two, evidence only that
-     *   `_meta["anthropic/requiresUserInteraction"]` was emitted and the client is one known to
-     *   enforce it, not that a human actually answered a prompt.
-     * - `"elicitation"` (issue #10): the client replied `action: "accept"` to a live
-     *   `elicitation/create` request sent for this call — an observed decision, not merely an armed
-     *   flag, though still not independently verifiable by the daemon (see the field-level trust
-     *   caveat on `ToolsCallParams.consent` in `@appduct/shared`).
+     * never observed the client-side prompt itself, only that the call arrived carrying this marker.
+     * The only value is `"elicitation"` (issue #10): the client replied `action: "accept"` to a live
+     * `elicitation/create` request sent for this call — not independently verifiable by the daemon
+     * (see the field-level trust caveat on `ToolsCallParams.consent` in `@appduct/shared`). Audit
+     * files written before the flag-based channel was removed may still contain `"client"`.
      */
-    consent?: "client" | "elicitation";
+    consent?: "elicitation";
 };
 /**
  * Audit directory footprint, surfaced by `daemon.status` so the growth is visible (issue #32).
@@ -104,4 +100,3 @@ export type AuditLoggerOptions = {
 export declare const canonicalArgsJson: (args: Record<string, unknown>) => string;
 export declare const argsSha256: (args: Record<string, unknown>) => string;
 export declare const createAuditLogger: (options: AuditLoggerOptions) => AuditLogger;
-//# sourceMappingURL=audit.d.ts.map

package/dist/daemon/calls.d.ts

@@ -81,4 +81,3 @@ export declare const clampTimeout: (timeoutMs: number | undefined) => number;
  * 32-bit timer range (~24.8 days), which silently fires the timer immediately. */
 export declare const deriveCallTransportTimeoutMs: (timeoutMs: number | undefined) => number;
 export declare const createCallsManager: (options: CallsManagerOptions) => CallsManager;
-//# sourceMappingURL=calls.d.ts.map

package/dist/daemon/config.d.ts

@@ -9,13 +9,10 @@ export type PolicyDecision = "allow" | "deny" | "prompt";
  * `config.json`'s `policy` shape (ARCHITECTURE.md §12): `default` applies to tools whose
  * descriptor has no `annotations.destructiveHint`; `destructive` applies when it is `true`;
  * `tools["<alias>/<name>"]` overrides both for one specific tool on one specific session alias.
- * `"prompt"` means "a human gate is required; if one cannot be guaranteed, deny" — today there are
- * two such gates, both MCP-only (ARCHITECTURE.md §9/§12): an MCP client that declares the
- * `elicitation` capability at `initialize` (issue #10, preferred whenever available) and an MCP
- * client that honors `_meta["anthropic/requiresUserInteraction"]` (issue #14, Claude Code ≥
- * v2.1.199, used only as a fallback for a client that doesn't declare elicitation). Every other
- * caller (CLI, an MCP client on neither channel) gets `policy_denied` with reason
- * `no_consent_channel`.
+ * `"prompt"` means "a human gate is required; if one cannot be guaranteed, deny" — today the only
+ * such gate is an MCP client that declares the `elicitation` capability at `initialize`
+ * (ARCHITECTURE.md §9/§12, issue #10). Every other caller (CLI, an MCP client without
+ * elicitation) gets `policy_denied` with reason `no_consent_channel`.
  */
 export type AppductPolicyConfig = {
     default: PolicyDecision;
@@ -23,6 +20,15 @@ export type AppductPolicyConfig = {
     tools?: Record<string, PolicyDecision>;
 };
 export type AppductConfig = {
+    /**
+     * TCP port for the pinned-wss listener (ARCHITECTURE.md §3). `0` is special and means
+     * "let the OS assign a free ephemeral port": the listener binds `0`, and everything that
+     * reports or advertises the port afterwards (`daemon.status`'s `wssPort`, a minted link's
+     * `endpoint.port`) reports the *bound* port instead. That is the only way several daemons can
+     * coexist on one machine without the operator hand-picking ports for each — which is exactly
+     * what the test suite needs when several vitest processes run concurrently. Every other value
+     * must be a positive integer.
+     */
     wssPort: number;
     keyPath: string;
     graceSeconds: number;
@@ -55,14 +61,6 @@ export type AppductConfig = {
      * CLI-side setting an operator wants to set once rather than pass with every `link` invocation.
      */
     scheme?: string;
-    /**
-     * The app's iOS bundle id, used only by the experimental `--open ios-device` /
-     * `appduct_connect` `target: "ios-device"` delivery path (issue #31): `xcrun devicectl device
-     * process launch` needs to be told which installed app to hand the URL to, and there is nothing
-     * in the deep link itself that says so. Overridable per invocation by `--bundle-id` (CLI) or
-     * `bundleId` (MCP). CLI-side like `scheme`, not a daemon setting.
-     */
-    iosBundleId?: string;
 };
 export declare const DEFAULT_AUDIT_RETENTION_DAYS = 30;
 export declare const DEFAULT_DAEMON_LOG_MAX_BYTES: number;
@@ -76,4 +74,3 @@ export type ConfigWarnFn = (message: string) => void;
 export declare const loadConfig: (paths: StateDirPaths, options?: {
     warn?: ConfigWarnFn;
 }) => Promise<AppductConfig>;
-//# sourceMappingURL=config.d.ts.map

package/dist/daemon/daemon.d.ts

@@ -40,4 +40,3 @@ export type RunningDaemon = {
     shutdown: () => Promise<void>;
 };
 export declare const startDaemon: (options: DaemonOptions) => Promise<RunningDaemon>;
-//# sourceMappingURL=daemon.d.ts.map

package/dist/daemon/event-bus.d.ts

@@ -46,4 +46,3 @@ export type CreateEventBusOptions = {
     bufferSize?: number;
 };
 export declare const createEventBus: (options?: CreateEventBusOptions) => EventBus;
-//# sourceMappingURL=event-bus.d.ts.map

package/dist/daemon/links.d.ts

@@ -51,4 +51,3 @@ export type PendingLinkRegistry = {
     disposeAll: () => void;
 };
 export declare const createPendingLinkRegistry: (options: PendingLinkRegistryOptions) => PendingLinkRegistry;
-//# sourceMappingURL=links.d.ts.map

package/dist/daemon/listener.d.ts

@@ -31,4 +31,3 @@ export type DaemonListener = {
     close: () => Promise<void>;
 };
 export declare const startListener: (options: ListenerOptions) => Promise<DaemonListener>;
-//# sourceMappingURL=listener.d.ts.map

package/dist/daemon/log-rotation.d.ts

@@ -79,4 +79,3 @@ export declare const ensureDaemonLogMode: (logFilePath: string, warn?: (message:
  * with it the spawn) with a duplicate error.
  */
 export declare const resolveDaemonLogMaxBytes: (stateDir: string) => Promise<number>;
-//# sourceMappingURL=log-rotation.d.ts.map

package/dist/daemon/pidfile.d.ts

@@ -1,7 +1,7 @@
 /**
  * Pidfile single-instancing (ARCHITECTURE.md §4). Acquired with `O_EXCL`; on conflict, liveness
- * is checked with `process.kill(pid, 0)` and the pidfile is only taken over if the owning
- * process is dead.
+ * is checked with `process.kill(pid, 0)` — plus, on Linux, a `/proc/<pid>/status` read that treats
+ * a zombie as dead — and the pidfile is only taken over if the owning process is dead.
  */
 export declare class DaemonAlreadyRunningError extends Error {
     readonly pid: number;
@@ -12,14 +12,21 @@ export type PidfileHandle = {
     /** Idempotent: safe to call more than once. */
     release: () => Promise<void>;
 };
+/**
+ * Reads `/proc/<pid>/status`. Injectable purely so the zombie branch below can be tested without
+ * arranging a real unreaped child, which needs a process that outlives its parent *and* an init
+ * that does not reap — neither of which a test can rely on across platforms.
+ */
+export type ProcStatusReader = (pid: number) => string | undefined;
 /**
  * Liveness probe for a pid this process does not own (ARCHITECTURE.md §4's `process.kill(pid, 0)`
- * check). Exported because every "is a daemon still there?" decision in the codebase must answer
- * it the same way — pidfile takeover, the auto-spawn path's stale-socket unlink, and log rotation
- * all hinge on it, and a second implementation that disagreed about `EPERM` would mean one of
- * them quietly clobbering a live daemon's state.
+ * check, refined by the zombie check above). Exported because every "is a daemon still there?"
+ * decision in the codebase must answer it the same way — pidfile takeover, the auto-spawn path's
+ * stale-socket unlink, and log rotation all hinge on it, and a second implementation that
+ * disagreed about `EPERM` (or about zombies) would mean one of them quietly clobbering a live
+ * daemon's state.
  */
-export declare const isProcessAlive: (pid: number) => boolean;
+export declare const isProcessAlive: (pid: number, readStatus?: ProcStatusReader) => boolean;
 export declare const readPidFromFile: (pidFilePath: string) => Promise<number | undefined>;
 export type AcquirePidfileOptions = {
     pid?: number;
@@ -35,4 +42,3 @@ export type AcquirePidfileOptions = {
  * unparseable) but throwing {@link DaemonAlreadyRunningError} when a live daemon holds it.
  */
 export declare const acquirePidfile: (pidFilePath: string, options?: AcquirePidfileOptions) => Promise<PidfileHandle>;
-//# sourceMappingURL=pidfile.d.ts.map

package/dist/daemon/policy.d.ts

@@ -19,4 +19,3 @@ export type PolicySession = {
 };
 export declare const policyOverrideKey: (alias: string, toolName: string) => string;
 export declare const evaluate: (descriptor: ToolDescriptor, session: PolicySession, policy: AppductPolicyConfig) => PolicyDecision;
-//# sourceMappingURL=policy.d.ts.map

package/dist/daemon/registry.d.ts

@@ -16,4 +16,3 @@ export type ToolRegistry = {
 };
 /** `onChange` fires after every mutation (snapshot/upsert/remove) — used to emit `tools_changed`. */
 export declare const createToolRegistry: (onChange?: () => void) => ToolRegistry;
-//# sourceMappingURL=registry.d.ts.map

package/dist/daemon/rpc-errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The error the daemon's RPC handlers throw to answer a request with a typed wire error
+ * (ARCHITECTURE.md §5). It lives apart from `rpc-server.ts` so the modules that *raise* it — the
+ * session engine, the call engine — don't drag the socket server itself into every bundle that
+ * needs, say, a call-timeout constant from `calls.ts` (the CLI's `invoke` route does).
+ */
+import type { ErrorType } from "@appduct/shared";
+export declare class RpcApplicationError extends Error {
+    readonly type: ErrorType;
+    /** JSON-RPC error code; defaults to the shared "server error" range. */
+    readonly code: number;
+    readonly details?: unknown | undefined;
+    constructor(type: ErrorType, message: string, 
+    /** JSON-RPC error code; defaults to the shared "server error" range. */
+    code?: number, details?: unknown | undefined);
+}

package/dist/daemon/rpc-server.d.ts

@@ -4,21 +4,11 @@
  * {@link notify} on a targeted connection — this module only exposes the primitive.
  */
 import { type Server, type Socket } from "node:net";
-import type { ErrorType } from "@appduct/shared";
 /** 1 MiB — lines beyond this are dropped by destroying the connection (ARCHITECTURE.md task notes). */
 export declare const MAX_LINE_BYTES: number;
 /** 4 MiB — a subscriber connection (`events.subscribe`) whose outbound buffer grows past this
  * (slow/dead reader) is dropped outright rather than left to back up the daemon indefinitely. */
 export declare const MAX_NOTIFY_BUFFERED_BYTES: number;
-export declare class RpcApplicationError extends Error {
-    readonly type: ErrorType;
-    /** JSON-RPC error code; defaults to the shared "server error" range. */
-    readonly code: number;
-    readonly details?: unknown | undefined;
-    constructor(type: ErrorType, message: string, 
-    /** JSON-RPC error code; defaults to the shared "server error" range. */
-    code?: number, details?: unknown | undefined);
-}
 export type RpcConnection = {
     readonly id: number;
     readonly socket: Socket;
@@ -51,4 +41,3 @@ export type RpcServer = {
     close: () => Promise<void>;
 };
 export declare const startRpcServer: (options: RpcServerOptions) => Promise<RpcServer>;
-//# sourceMappingURL=rpc-server.d.ts.map

package/dist/daemon/sessions.d.ts

@@ -83,4 +83,3 @@ export type SessionManager = {
     disposeAll: (code: number, reason: string) => void;
 };
 export declare const createSessionManager: (options: SessionManagerOptions) => SessionManager;
-//# sourceMappingURL=sessions.d.ts.map

package/dist/daemon/socket-probe.d.ts

@@ -13,4 +13,3 @@
  * moment later.
  */
 export declare const isSocketConnectable: (socketPath: string) => Promise<boolean>;
-//# sourceMappingURL=socket-probe.d.ts.map

package/dist/daemon/state-dir.d.ts

@@ -28,4 +28,3 @@ export declare const getStateDirPaths: (stateDir: string) => StateDirPaths;
 export declare const getSocketPath: (paths: StateDirPaths) => string;
 /** Creates the state dir (and `audit/`) with mode `0700` if missing; tightens the mode if it exists. */
 export declare const ensureStateDir: (stateDir: string) => Promise<StateDirPaths>;
-//# sourceMappingURL=state-dir.d.ts.map

package/dist/daemon/timers.d.ts

@@ -13,4 +13,3 @@ export type TimerFns = {
     clearInterval: (handle: IntervalHandle) => void;
 };
 export declare const systemTimers: TimerFns;
-//# sourceMappingURL=timers.d.ts.map

package/dist/daemon/tls.d.ts

@@ -55,4 +55,3 @@ export type CreateTlsManagerOptions = {
 };
 export declare const createTlsManager: (options: CreateTlsManagerOptions) => Promise<TlsManager>;
 export declare const toAgentEndpoint: (address: AdvertisedAddress, port: number) => AgentEndpoint;
-//# sourceMappingURL=tls.d.ts.map

package/dist/errors.d.ts

@@ -25,4 +25,3 @@ export declare const toCliError: (error: unknown) => CliError;
 /** Computes the process exit code for the *original* thrown error (not the rendered `CliError`) so
  * that the sysexits classification never depends on — or leaks into — the rendered `type` field. */
 export declare const getExitCodeForError: (error: unknown) => number;
-//# sourceMappingURL=errors.d.ts.map

package/dist/host-certificate.d.ts

@@ -5,4 +5,3 @@ type GeneratedHostCertificate = {
 };
 export declare const generateHostCertificate: (keyPem: string, advertisedIp: string) => Promise<GeneratedHostCertificate>;
 export {};
-//# sourceMappingURL=host-certificate.d.ts.map

package/dist/index.d.ts

@@ -1,4 +1,3 @@
 export * from "./cli.js";
 export * from "./errors.js";
 export * from "./output.js";
-//# sourceMappingURL=index.d.ts.map