vigthoria-cli 1.13.20 → 1.13.23

package/dist/utils/release-policy.js

@@ -0,0 +1,293 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createPublicKey, verify as verifySignature } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { CliCommandError } from './command-contract.js';
+import { compareSemanticVersions } from './update-policy.js';
+const SHA256 = /^[a-f0-9]{64}$/;
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+const TOP_LEVEL_FIELDS = new Set(['schemaVersion', 'channels']);
+const ENTRY_FIELDS = new Set(['version', 'url', 'sha256', 'size', 'archiveFilename', 'packageName', 'packageVersion', 'publishedAt', 'signature', 'sbom', 'provenance', 'notes']);
+const SIGNATURE_FIELDS = new Set(['algorithm', 'keyId', 'url']);
+const EVIDENCE_FIELDS = new Set(['url', 'sha256']);
+function fail(message, code = 'RELEASE_MANIFEST_INVALID') {
+    throw new CliCommandError(message, { code, category: 'configuration' });
+}
+function policyPath() {
+    const moduleDirectory = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(moduleDirectory, '../../release-policy.json'),
+        path.resolve(moduleDirectory, '../release-policy.json'),
+        path.resolve(process.cwd(), 'release-policy.json'),
+    ];
+    const resolved = candidates.find((candidate) => fs.existsSync(candidate));
+    if (!resolved)
+        return fail('The packaged release-policy.json file is missing.', 'RELEASE_POLICY_MISSING');
+    return resolved;
+}
+let cachedPolicy = null;
+export function getReleasePolicy() {
+    if (cachedPolicy)
+        return cachedPolicy;
+    const raw = JSON.parse(fs.readFileSync(policyPath(), 'utf8'));
+    if (raw.schemaVersion !== 1 || raw.manifest?.schemaVersion !== 1 || raw.signature?.algorithm !== 'Ed25519') {
+        return fail('Unsupported release policy schema.', 'RELEASE_POLICY_UNSUPPORTED');
+    }
+    cachedPolicy = Object.freeze(raw);
+    return cachedPolicy;
+}
+function assertExactFields(value, allowed, label) {
+    for (const field of Object.keys(value)) {
+        if (!allowed.has(field))
+            fail(`${label} contains unknown field: ${field}`);
+    }
+}
+export function assertReleaseUrl(raw, kind = 'artifact') {
+    const policy = getReleasePolicy();
+    if (typeof raw !== 'string' || !raw || /[\\\u0000-\u001f\u007f]/.test(raw))
+        fail(`Invalid ${kind} URL.`);
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return fail(`Invalid ${kind} URL.`);
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || (url.port && Number(url.port) !== policy.origins.port)) {
+        fail(`${kind} URL must use HTTPS without credentials on the policy port.`);
+    }
+    if (!policy.origins.allowedHosts.includes(url.hostname.toLowerCase()))
+        fail(`${kind} URL host is not allowlisted.`);
+    if (kind === 'manifest' && url.toString() !== policy.origins.manifest)
+        fail('Manifest URL does not match the canonical release policy origin.');
+    return url;
+}
+function parseEvidence(raw, label) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return fail(`${label} metadata is required.`);
+    const record = raw;
+    assertExactFields(record, EVIDENCE_FIELDS, label);
+    const url = assertReleaseUrl(record.url, 'evidence').toString();
+    const sha256 = String(record.sha256 || '').toLowerCase();
+    if (!SHA256.test(sha256))
+        fail(`${label} SHA-256 is malformed.`);
+    return { url, sha256 };
+}
+export function parseReleaseManifest(input, channel = 'stable', serializedBytes) {
+    const policy = getReleasePolicy();
+    if (serializedBytes !== undefined && serializedBytes > policy.manifest.maximumBytes)
+        fail('Release manifest exceeds the policy size limit.');
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return fail('Release manifest must be a JSON object.');
+    const manifest = input;
+    assertExactFields(manifest, TOP_LEVEL_FIELDS, 'Release manifest');
+    if (manifest.schemaVersion !== policy.manifest.schemaVersion)
+        fail('Release manifest schemaVersion is missing or unsupported.');
+    if (!policy.manifest.allowedChannels.includes(channel))
+        fail(`Release channel is not allowed: ${channel}`);
+    if (!manifest.channels || typeof manifest.channels !== 'object' || Array.isArray(manifest.channels))
+        fail('Release manifest channels object is required.');
+    const channels = manifest.channels;
+    for (const name of Object.keys(channels))
+        if (!policy.manifest.allowedChannels.includes(name))
+            fail(`Release manifest contains unknown channel: ${name}`);
+    for (const name of policy.manifest.requiredChannels)
+        if (!(name in channels))
+            fail(`Release manifest is missing required channel: ${name}`);
+    const raw = channels[channel];
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        return fail(`Release manifest has no entry for channel ${channel}.`);
+    const entry = raw;
+    assertExactFields(entry, ENTRY_FIELDS, `Release channel ${channel}`);
+    const version = String(entry.version || '');
+    const packageVersion = String(entry.packageVersion || '');
+    const archiveFilename = String(entry.archiveFilename || '');
+    const packageName = String(entry.packageName || '');
+    const sha256 = String(entry.sha256 || '').toLowerCase();
+    const size = Number(entry.size);
+    if (!SEMVER.test(version) || compareSemanticVersions(version, version) !== 0)
+        fail('Release version is invalid.');
+    if (version !== packageVersion)
+        fail('Release version conflicts with packageVersion.');
+    if (packageName !== policy.packageName)
+        fail('Release packageName conflicts with policy.');
+    if (!SHA256.test(sha256))
+        fail('Release artifact SHA-256 is malformed.');
+    if (!Number.isSafeInteger(size) || size <= 0 || size > policy.artifact.maximumBytes)
+        fail('Release artifact size is invalid or exceeds policy.');
+    if (!new RegExp(policy.artifact.filenamePattern).test(archiveFilename) || archiveFilename !== `${policy.packageName}-${version}.tgz`)
+        fail('Release archive filename conflicts with version identity.');
+    const artifactUrl = assertReleaseUrl(entry.url, 'artifact');
+    if (path.posix.basename(artifactUrl.pathname) !== archiveFilename)
+        fail('Release URL filename conflicts with archiveFilename.');
+    if (!policy.channels[channel].allowPrerelease && version.includes('-'))
+        fail(`Prerelease versions are forbidden on channel ${channel}.`);
+    const publishedAt = String(entry.publishedAt || '');
+    if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/.test(publishedAt) || !Number.isFinite(Date.parse(publishedAt)))
+        fail('Release publishedAt is invalid.');
+    if (!entry.signature || typeof entry.signature !== 'object' || Array.isArray(entry.signature))
+        return fail('Detached signature metadata is required.');
+    const signature = entry.signature;
+    assertExactFields(signature, SIGNATURE_FIELDS, 'Release signature');
+    const algorithm = String(signature.algorithm || '');
+    const keyId = String(signature.keyId || '');
+    if (algorithm !== policy.signature.algorithm)
+        fail('Release signature algorithm conflicts with policy.');
+    if (!Object.hasOwn(policy.signature.trustedKeys, keyId))
+        fail('Release signature key is not trusted.');
+    const signatureUrl = assertReleaseUrl(signature.url, 'signature');
+    if (path.posix.basename(signatureUrl.pathname) !== `${archiveFilename}.sig`)
+        fail('Detached signature filename conflicts with archive identity.');
+    return {
+        version,
+        url: artifactUrl.toString(),
+        sha256,
+        size,
+        archiveFilename,
+        packageName,
+        packageVersion,
+        publishedAt,
+        signature: { algorithm: 'Ed25519', keyId, url: signatureUrl.toString() },
+        sbom: parseEvidence(entry.sbom, 'SBOM'),
+        provenance: parseEvidence(entry.provenance, 'Provenance'),
+        ...(typeof entry.notes === 'string' ? { notes: entry.notes } : {}),
+    };
+}
+export function parseReleaseManifestText(text, channel = 'stable') {
+    const bytes = Buffer.byteLength(text, 'utf8');
+    if (bytes > getReleasePolicy().manifest.maximumBytes)
+        fail('Release manifest exceeds the policy size limit.');
+    let index = 0;
+    const whitespace = () => { while (/\s/.test(text[index] || ''))
+        index += 1; };
+    const parseString = () => {
+        whitespace();
+        if (text[index] !== '"')
+            fail('Release manifest JSON is malformed.');
+        const start = index++;
+        let escaped = false;
+        while (index < text.length) {
+            const character = text[index++];
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (character === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (character === '"') {
+                try {
+                    return JSON.parse(text.slice(start, index));
+                }
+                catch {
+                    return fail('Release manifest JSON string is malformed.');
+                }
+            }
+            if (character.charCodeAt(0) < 0x20)
+                fail('Release manifest JSON string contains a control character.');
+        }
+        return fail('Release manifest JSON string is unterminated.');
+    };
+    const parseValue = () => {
+        whitespace();
+        if (text[index] === '{') {
+            index += 1;
+            const keys = new Set();
+            whitespace();
+            if (text[index] === '}') {
+                index += 1;
+                return;
+            }
+            while (index < text.length) {
+                const key = parseString();
+                if (keys.has(key))
+                    fail(`Release manifest contains duplicate field: ${key}`);
+                keys.add(key);
+                whitespace();
+                if (text[index++] !== ':')
+                    fail('Release manifest JSON object is malformed.');
+                parseValue();
+                whitespace();
+                const separator = text[index++];
+                if (separator === '}')
+                    return;
+                if (separator !== ',')
+                    fail('Release manifest JSON object is malformed.');
+            }
+            fail('Release manifest JSON object is unterminated.');
+        }
+        if (text[index] === '[') {
+            index += 1;
+            whitespace();
+            if (text[index] === ']') {
+                index += 1;
+                return;
+            }
+            while (index < text.length) {
+                parseValue();
+                whitespace();
+                const separator = text[index++];
+                if (separator === ']')
+                    return;
+                if (separator !== ',')
+                    fail('Release manifest JSON array is malformed.');
+            }
+            fail('Release manifest JSON array is unterminated.');
+        }
+        if (text[index] === '"') {
+            parseString();
+            return;
+        }
+        const remainder = text.slice(index);
+        const primitive = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(remainder);
+        if (!primitive)
+            fail('Release manifest JSON value is malformed.');
+        index += primitive[0].length;
+    };
+    parseValue();
+    whitespace();
+    if (index !== text.length)
+        fail('Release manifest JSON has trailing content.');
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return fail('Release manifest JSON is malformed.');
+    }
+    return parseReleaseManifest(parsed, channel, bytes);
+}
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalize).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+export function releaseSignaturePayload(channel, entry) {
+    return Buffer.from(canonicalize({ channel, entry }), 'utf8');
+}
+export function verifyReleaseSignature(channel, entry, detachedBase64, trustedKeys) {
+    const keys = trustedKeys || getReleasePolicy().signature.trustedKeys;
+    const publicKey = keys[entry.signature.keyId];
+    if (!publicKey)
+        fail('Detached signature key is not trusted.', 'RELEASE_SIGNATURE_UNTRUSTED');
+    const encoded = String(detachedBase64 || '').trim();
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded))
+        fail('Detached signature encoding is malformed.', 'RELEASE_SIGNATURE_INVALID');
+    const signature = Buffer.from(encoded, 'base64');
+    if (signature.length !== 64 || !verifySignature(null, releaseSignaturePayload(channel, entry), createPublicKey(publicKey), signature)) {
+        fail('Detached release signature verification failed.', 'RELEASE_SIGNATURE_INVALID');
+    }
+}
+export function assertReleaseTransition(currentVersion, entry, channel, allowDowngrade = false) {
+    const channelPolicy = getReleasePolicy().channels[channel];
+    if (!channelPolicy)
+        fail(`Release channel is not allowed: ${channel}`);
+    if (compareSemanticVersions(entry.version, currentVersion) < 0 && !(allowDowngrade && channelPolicy.allowDowngrade)) {
+        fail(`Downgrade from ${currentVersion} to ${entry.version} is prohibited.`, 'RELEASE_DOWNGRADE_PROHIBITED');
+    }
+}

package/dist/utils/requestIntent.js

@@ -4,12 +4,13 @@
  */
 const CLI_SHAPING_BLOCK = /(?:^|\n\n)Platform:\s*(?:Windows|macOS|Linux)\.[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
 const READONLY_SHAPING_BLOCK = /(?:^|\n\n)(?:Read-only analysis mode is active\.|Diagnostic mode is active\.)[\s\S]*?(?=\n\n[A-Z][^\n]{0,40}:|\s*$)/i;
-const BUILD_VERBS = /\b(build|create|make|implement|complete|redesign|overhaul|rebuild|transform|polish|art-direct|fix|repair|edit|modify|write|generate|add|finish|scaffold|develop|update|change|refactor|want|need|require|looking for|let's|let us|we need|we should|erstelle|erstellen|schreib|schreibe|bearbeite)\b/i;
+const BUILD_VERBS = /\b(build|create|make|implement|complete|redesign|overhaul|rebuild|transform|polish|refine|art-direct|fix|repair|correct|edit|modify|write|generate|add|finish|scaffold|develop|update|change|refactor|want|need|require|looking for|let's|let us|we need|we should|erstelle|erstellen|schreib|schreibe|bearbeite)\b/i;
 const ARTIFACT_NOUNS = /\b(file|files|project|game|spiel|app|website|html5|frontend|component|feature|code|workspace|repo|clone|replica|remake|page|site|design|showcase|screen|button|popup|modal|alert|canvas|sprite|level|levels|enemy|enemies|character|npc|world|scene|script|module|api|database|config|landing|dashboard|platformer|arcade|playable|collectible|scoreboard|leaderboard|pitfall|pacman|rogue|html|css|javascript|typescript)\b/i;
 /** Canvas/playable games only — bare "html5" or "website" must NOT match. */
 const GAME_INTENT = /\b(game|spiel|playable|babylon(?:\.js|js)?|vge|webgl|3d\s+(?:game|runner|prototype|world|experience)|html5\s+(?:game|canvas)|html5\s+game|canvas\s+game|game\s+canvas|arcade|platformer|side[- ]?scroller|pitfall|pac[- ]?man|tetris|snake|breakout|pong|roguelike|metroidvania|tower\s+defense|clone\s+of\s+(?:a\s+)?(?:game|pitfall|pac|mario|zelda|arcade)|gameplay|collectible|boss\s+fight|level\s+design|sprite\s+sheet|wild\s+(?:boar|pig|forest)|forest\s+pig)\b/i;
 const WEB_PAGE_INTENT = /\b(website|web\s*site|webpage|web\s*page|landing\s+page|home\s*page|index\.html|html\s+page|static\s+page|single\s+page|popup|alert|modal|hello\s+world)\b/i;
 const WEB_SHOWCASE_INTENT = /\b(web[- ]?design\s+showcase|frontend|marketing\s+site|dashboard|saas)\b/i;
+const COMPREHENSIVE_WEB_BUILD = /\b(?:redesign|overhaul|rebuild|transform|art[- ]direct|enterprise[- ]grade|premium\s+(?:website|web|design)|showcase\s+templates?|five\s+(?:distinct\s+)?(?:pages?|templates?))\b/i;
 const CLONE_BUILD = /\bclone\s+of\b|\b(build|create|make)\s+(?:a|an|the|us|me)?\s*(?:clone|replica|remake|port)\b/i;
 const READ_ONLY_INTENT = /\b(analy[sz]e|analyse|analysis|audit|review|inspect|proof|understand|summari[sz]e|scan|read[\s-]?only|where we left|what is|how does|show me|tell me|identify\s+gaps?|gap\s+analysis|production\s+blockers?)\b/i;
 const EXPLICIT_WRITE_VERBS = /\b(implement|write|edit|modify|update|redesign|overhaul|rebuild|transform|polish|art-direct|fix|repair|create|build|generate|scaffold|deploy|refactor|develop|integrate|correct|apply|patch)\b/i;
@@ -17,7 +18,7 @@ const TRIVIAL_HTML_PAGE = /\b(hello\s*world|simple\s+(?:html|web|page|site)|html
 /** User explicitly grants write permission after an analysis or confirmation gate. */
 const WRITE_PERMISSION_GRANT = /\b(?:hereby\s+confirm|i\s+confirm|confirm(?:ed)?\s+that|give\s+(?:you|permission)|granting\s+permission|allow\s+(?:you|me\s+to)|you\s+(?:may|can|have\s+permission\s+to)|permission\s+to|authorized?\s+to|approve(?:d)?\s+(?:the\s+)?(?:changes?|writes?|edits?)|go\s+ahead\s+and(?:\s+write|\s+apply|\s+make|\s+do)?|do\s+all\s+the\s+changes|apply\s+(?:the\s+)?(?:changes?|fixes?|fix)|proceed\s+with\s+(?:the\s+)?(?:changes?|fixes?|implementation|writes?)|make\s+(?:the\s+)?changes|please\s+write)\b/i;
 /** Fix/correct/repair syntax or errors — write path without requiring artifact nouns. */
-const FIX_CORRECT_INTENT = /\b(correct|fix|repair|resolve|patch|address|remedy)\b[\s\S]{0,48}\b(syntax|errors?|bugs?|issues?|mistakes?|typos?)\b|\b(syntax|errors?|bugs?|issues?)\b[\s\S]{0,48}\b(correct|fix|repair|resolve|patch)\b/i;
+const FIX_CORRECT_INTENT = /\b(correct|fix|repair|resolve|patch|address|remedy)\b[\s\S]{0,48}\b(syntax|errors?|bugs?|issues?|defects?|mistakes?|typos?)\b|\b(syntax|errors?|bugs?|issues?|defects?)\b[\s\S]{0,48}\b(correct|fix|repair|resolve|patch)\b/i;
 /** Read-only audit: check/review/find issues without an paired fix/implement verb nearby. */
 const READ_ONLY_CHECK = /\b(check|verify|audit|inspect|review|investigate|look\s+for|find|scan|validate|examine)\b[\s\S]{0,60}\b(syntax|errors?|bugs?|issues?|missing|gaps?|functionality)\b/i;
 /** Strip CLI-appended platform / mode shaping so it cannot flip quality profiles. */
@@ -77,6 +78,14 @@ export function isAgentContinuePrompt(prompt) {
     if (isBuiltContinuePrompt(text) || isBuiltRetryPrompt(text)) {
         return false;
     }
+    const concreteFileScope = /(?<![A-Za-z0-9_.-])[A-Za-z0-9_./\\-]+\.[A-Za-z0-9]{1,16}(?![A-Za-z0-9_.-])/.test(text);
+    const detailedMutationFollowUp = EXPLICIT_WRITE_VERBS.test(text) && (concreteFileScope || text.split(/\s+/).length > 20);
+    if (detailedMutationFollowUp) {
+        // A user may naturally say "continue" while also supplying new defect
+        // evidence, exact file ownership, or revised acceptance criteria.  That is
+        // a new scoped follow-up, not shorthand for replaying the stored prompt.
+        return false;
+    }
     if (/^\/(?:continue|contiune|contiunue)$/i.test(text)) {
         return true;
     }
@@ -128,7 +137,7 @@ export function isTrivialHtmlPageRequest(prompt) {
     if (text.length > 420) {
         return false;
     }
-    if (/\b(multi[- ]?page|full\s+saas|dashboard|e[\s-]?commerce|auth|database|backend|api|microservice)\b/i.test(text)) {
+    if (/\b(multi[- ]?page|five\s+pages?|showcase|enterprise(?:[- ]grade)?|animated?|motion|redesign|overhaul|existing\s+(?:site|website|project)|full\s+saas|dashboard|e[\s-]?commerce|auth|database|backend|api|microservice)\b/i.test(text)) {
         return false;
     }
     return TRIVIAL_HTML_PAGE.test(text)
@@ -247,6 +256,16 @@ export function inferAgentTaskType(prompt) {
         }
         return 'implementation';
     }
+    // A comprehensive website redesign remains a web-build even when the brief
+    // also says to fix/repair defects found during the audit. Treating the repair
+    // verb as globally dominant collapses the required markup/style/interaction
+    // decomposition into a narrow three-step bug-fix workflow.
+    if (hasWebPageIntent(prompt)
+        && hasBuildVerb(prompt)
+        && COMPREHENSIVE_WEB_BUILD.test(text)
+        && !hasGameIntent(prompt)) {
+        return 'web-build';
+    }
     if (hasFixOrCorrectIntent(prompt)) {
         if (hasGameIntent(prompt)) {
             return 'game-build';

package/dist/utils/runtime-capability.d.ts

@@ -0,0 +1,8 @@
+export type RuntimeCapabilities = {
+    loopbackServices: boolean;
+    localV3Agent: boolean;
+};
+/** Explicit operator grants only; never infer trust from hostname, cwd, OS, or container state. */
+export declare function resolveRuntimeCapabilities(environment?: NodeJS.ProcessEnv): RuntimeCapabilities;
+export declare function hasLoopbackServiceCapability(environment?: NodeJS.ProcessEnv): boolean;
+export declare function hasLocalV3AgentCapability(environment?: NodeJS.ProcessEnv): boolean;

package/dist/utils/runtime-capability.js

@@ -0,0 +1,16 @@
+/** Explicit operator grants only; never infer trust from hostname, cwd, OS, or container state. */
+export function resolveRuntimeCapabilities(environment = process.env) {
+    const loopbackServices = environment.VIGTHORIA_ALLOW_LOCAL_SERVICES === '1'
+        || environment.VIGTHORIA_ALLOW_LOOPBACK === '1'
+        || environment.VIGTHORIA_LOCAL_TEST_MODE === '1';
+    return {
+        loopbackServices,
+        localV3Agent: loopbackServices && environment.VIGTHORIA_ALLOW_LOCAL_V3_AGENT === '1',
+    };
+}
+export function hasLoopbackServiceCapability(environment = process.env) {
+    return resolveRuntimeCapabilities(environment).loopbackServices;
+}
+export function hasLocalV3AgentCapability(environment = process.env) {
+    return resolveRuntimeCapabilities(environment).localV3Agent;
+}

package/dist/utils/runtime-temp.d.ts

@@ -0,0 +1,76 @@
+export interface RuntimeTempOptions {
+    homeDirectory?: string;
+    environment?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+    now?: () => number;
+    pid?: number;
+    isProcessAlive?: (pid: number) => boolean;
+    systemTempDirectory?: string;
+}
+export interface RuntimeTempCleanupResult {
+    removedEntries: number;
+    removedBytes: number;
+    skippedActiveEntries: number;
+    legacyRemovedEntries: number;
+    legacyRemovedBytes: number;
+}
+export interface RuntimeTempStatus extends RuntimeTempCleanupResult {
+    root: string;
+    source: 'per-user-default' | 'explicit-override';
+    writable: boolean;
+    sharedSystemTemp: boolean;
+    maxBytes: number;
+    minimumFreeBytes: number;
+    ttlHours: number;
+    usedBytes: number;
+    entryCount: number;
+    freeBytes: number | null;
+    error: string | null;
+}
+export declare class RuntimeTempError extends Error {
+    readonly code: string;
+    readonly details: Record<string, unknown>;
+    constructor(message: string, code: string, details?: Record<string, unknown>);
+}
+export declare function resolveRuntimeTempRoot(options?: RuntimeTempOptions): {
+    root: string;
+    source: RuntimeTempStatus['source'];
+};
+export declare class RuntimeTempManager {
+    private readonly environment;
+    private readonly platform;
+    private readonly homeDirectory;
+    private readonly now;
+    private readonly pid;
+    private readonly isProcessAlive;
+    private readonly systemTempRoot;
+    private readonly configuredRoot;
+    private readonly source;
+    private readonly maxBytes;
+    private readonly minimumFreeBytes;
+    private readonly ttlMs;
+    private initializedRoot;
+    private initializedIdentity;
+    private initializationError;
+    private lastCleanup;
+    constructor(options?: RuntimeTempOptions);
+    initialize(): RuntimeTempStatus;
+    createDirectory(prefix?: string): string;
+    removeDirectory(directory: string): void;
+    scavenge(options?: {
+        includeLegacy?: boolean;
+    }): RuntimeTempCleanupResult;
+    status(): RuntimeTempStatus;
+    private requireRoot;
+    private readEntries;
+    private entrySize;
+    private freeBytes;
+    private measure;
+    private removeEntry;
+    private cleanupLegacySystemTemp;
+}
+export declare function getRuntimeTempManager(): RuntimeTempManager;
+export declare function initializeRuntimeTempStorage(): RuntimeTempStatus;
+export declare function runtimeTempStatus(): RuntimeTempStatus;
+export declare function createRuntimeTempDirectory(prefix: string): string;
+export declare function removeRuntimeTempDirectory(directory: string): void;