@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/types/cli/palette.d.ts

@@ -0,0 +1,11 @@
+interface PaletteItem {
+    command: string;
+    desc: string;
+}
+interface PaletteResult {
+    command: string;
+    args: string[];
+}
+export declare function showInlinePalette(items: PaletteItem[], _initialQuery: string): Promise<PaletteResult | null>;
+export {};
+//# sourceMappingURL=palette.d.ts.map

package/dist/types/cli/palette.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"palette.d.ts","sourceRoot":"","sources":["../../../src/cli/palette.ts"],"names":[],"mappings":"AAIA,UAAU,WAAW;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,aAAa;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAuBD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAAE,EACpB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoN/B"}

package/dist/types/cli/prompt.d.ts

@@ -0,0 +1,186 @@
+import * as readline from 'readline';
+export declare function setReplInterface(interface_: readline.Interface | null): void;
+export declare function setReplMode(mode: boolean): void;
+export declare function isReplMode(): boolean;
+export declare function getReplInterface(): readline.Interface | null;
+export declare function ask(question: string, defaultValue?: string): Promise<string>;
+export declare function askSecret(question: string): Promise<string>;
+export declare function askChoice(question: string, choices: string[], defaultValue?: string): Promise<string>;
+export declare function askConfirm(question: string, defaultValue: boolean): Promise<boolean>;
+export declare function closePrompts(): void;
+/**
+ * Where a resolved value came from.
+ *
+ * `'argv'` is reachable only for a value the caller proved carries no secret
+ * (see {@link ResolveSecretOptions.assertArgvValueSafe}); a secret is never
+ * sourced from argv. `'env'` means a value read from a named environment
+ * variable by the caller, which is a private channel on Linux because
+ * `/proc/<pid>/environ` is mode 0400 and owned by the process's own user.
+ */
+export type SecretSource = 'file' | 'stdin' | 'env' | 'argv' | 'prompt';
+export interface ResolvedSecret {
+    /** The secret, or undefined when no source supplied one. */
+    value?: string;
+    source?: SecretSource;
+}
+export interface ResolveSecretOptions {
+    args: string[];
+    /** Human name used in messages, e.g. "Database password". */
+    label: string;
+    /**
+     * Flags whose value would put the secret inline in `process.argv`.
+     *
+     * An argv value is REFUSED, not warned about: `/proc/<pid>/cmdline` is
+     * world-readable on Linux, so a warning still leaks the credential to every
+     * local UID for the lifetime of the process, and the value is already written
+     * to the shell history by the time the warning is printed. A warning that the
+     * deprecated flag "still works" is a credential leak with extra steps.
+     *
+     * The exception is a value that is only ARGUMENT-SAFE when it carries no
+     * secret — a connection URL without userinfo. `db add --url` passes such a
+     * value through `assertArgvValueSafe`, which is what decides; a URL with a
+     * password in it is refused by that assertion.
+     */
+    argvFlags: readonly string[];
+    /** Proves an argv value carries no credential. Omit to refuse every one. */
+    assertArgvValueSafe?: (value: string) => void;
+    /** Flags naming a file to read the secret from. */
+    fileFlags: readonly string[];
+    /** Flags that read the secret from stdin. */
+    stdinFlags: readonly string[];
+    /** Masked prompt to fall back to when nothing was supplied. */
+    promptWhenMissing?: boolean;
+    /** Stdin reader, injectable for tests. Defaults to reading fd 0. */
+    readStdin?: () => string;
+    /** Masked prompt, injectable for tests. Defaults to {@link askSecret}. */
+    prompt?: (label: string) => Promise<string>;
+    /**
+     * Accepted for source compatibility. A refusal no longer consults it: whether
+     * an argv value is acceptable is decided by `assertArgvValueSafe`, and the
+     * answer can no longer be downgraded to a warning.
+     */
+    shouldWarnOnArgv?: (value: string) => boolean;
+}
+/** True when both ends are a terminal, i.e. a human can answer a prompt. */
+export declare function isInteractive(): boolean;
+/**
+ * Machine-readable reasons a credential channel was refused. Printed in the
+ * refusal headline so an operator (and a CI gate) can grep for the code instead
+ * of parsing prose.
+ */
+export type SecretRefusalCode = 'password_in_argv_refused' | 'password_file_not_private';
+/**
+ * A credential channel was refused.
+ *
+ * `message` is the complete, self-contained operator explanation — including
+ * the code — because callers that do not know about this class (any command
+ * that catches and prints `err.message`) must still produce the full refusal
+ * text rather than a bare "refused". `lines` is the same text split for
+ * commanders that render it.
+ *
+ * Nothing in a `SecretRefusalError` may contain the rejected secret. The whole
+ * point of refusing is that the value does not reach the terminal, the shell
+ * history again, `errors.jsonl`, or `daemon.log`.
+ */
+export declare class SecretRefusalError extends Error {
+    readonly code: SecretRefusalCode;
+    /** The operator-facing explanation, one array entry per line. */
+    readonly lines: readonly string[];
+    constructor(code: SecretRefusalCode, headline: string, detail: readonly string[]);
+}
+/** True when `err` is a refusal this module raised. */
+export declare function isSecretRefusalError(err: unknown): err is SecretRefusalError;
+/**
+ * Builds the refusal for a secret supplied inline on the command line.
+ *
+ * The rejected value is never echoed. The explanation names the flags, states
+ * why argv is not private, and lists the channels that are.
+ */
+export declare function refuseSecretInArgv(flags: readonly string[], label: string, alternatives: readonly string[]): SecretRefusalError;
+/** The placeholder a redacted password is replaced with. Matches `redactSecrets`. */
+export declare const REDACTED_PLACEHOLDER = "***";
+/**
+ * Replaces the password in a connection URL with a placeholder while keeping
+ * the URL recognisable, so a refusal can show the operator exactly what was
+ * rejected without the rejection itself becoming the leak.
+ *
+ * Percent-encoded passwords are handled by construction: `URL.password` keeps
+ * the encoding, so assigning over the field deletes the whole encoded value
+ * rather than a decoded fragment of it. The textual fallback covers a URL the
+ * WHATWG parser rejects, where the last `@` in the authority is treated as the
+ * userinfo separator.
+ */
+export declare function redactUrlPassword(raw: string): string;
+/**
+ * True when a connection URL carries userinfo, i.e. a credential.
+ *
+ * A URL the parser rejects counts as carrying one: refusing an unparseable URL
+ * is strictly safer than forwarding a value whose shape was never understood.
+ */
+export declare function urlCarriesCredentials(value: string): boolean;
+/**
+ * Asserts a connection URL taken from argv carries no password.
+ *
+ * The URL is the only argv value this CLI still accepts, and only because a URL
+ * without userinfo is not a credential. One WITH userinfo is refused and echoed
+ * back redacted, so the operator can see which URL was rejected without the
+ * rejection itself becoming the leak.
+ */
+export declare function assertUrlHasNoPassword(value: string): void;
+/**
+ * Refuses a credential file that any local user can read, or that is a symlink.
+ *
+ * Two separate attacks, so two separate refusals:
+ *
+ *  - Permissions. `fs.readFileSync` on a 0644 file hands the password to every
+ *    local UID. Accepting it would move the leak out of argv (where it is at
+ *    least momentary) and into a file that stays exposed for as long as it
+ *    exists. Owner-only (`0600`, `0400`) is the requirement.
+ *  - Symlink. A link planted by another local user makes the read return whatever
+ *    the link target holds, so the "password" the CLI stores is not necessarily
+ *    the one on disk, and the operator's real secret file can be aimed at a
+ *    process that will read it. `lstat`, never `stat`: `stat` follows the link
+ *    and reports the target's type, which is exactly the check that has to fail.
+ *
+ * POSIX modes are meaningless on Windows, so the permission check is POSIX-only.
+ */
+export declare function assertSecretFileIsPrivate(filePath: string, label: string): void;
+/**
+ * Reads a secret from a file. Refuses a group- or world-readable file and a
+ * symlink first — see {@link assertSecretFileIsPrivate} — then throws with a
+ * caller-facing message on failure.
+ */
+export declare function readSecretFromFile(filePath: string, label: string): string;
+/**
+ * Reads a secret from stdin (fd 0) to end-of-input, so the secret never
+ * appears in argv. Throws when the input is empty.
+ */
+export declare function readSecretFromStdin(label: string, reader?: () => string): string;
+/**
+ * The deprecation warning printed when a secret is taken from argv.
+ *
+ * Kept only so an operator who already scripted the old flag gets told what to
+ * use instead. Nothing calls it on the success path any more: `resolveSecret`
+ * REFUSES an argv secret, and only a refusal is printed.
+ */
+export declare function secretArgvExposureWarning(flags: readonly string[], label: string, alternatives: readonly string[]): string;
+/** Prints the refusal notice for an argv-supplied secret. */
+export declare function warnSecretExposedInArgv(flags: readonly string[], label: string, alternatives: readonly string[]): void;
+/**
+ * Resolves a secret from a channel that is not argv, in order: a private file,
+ * stdin, then a masked prompt.
+ *
+ * An argv value is never returned unless the caller supplied
+ * `assertArgvValueSafe` AND it accepted the value. Without that assertion
+ * (`db add --password`, `db edit --pw`, and every future caller that has not
+ * thought about it) the flag is refused with `password_in_argv_refused` and no
+ * value is ever read out of argv, so the secret cannot reach `ps`,
+ * `/proc/<pid>/cmdline`, the shell history, or any log this process writes.
+ *
+ * Refusal is checked BEFORE the safe channels on purpose. `db add --password x
+ * --password-file f` is refused rather than quietly honoured via the file: the
+ * value is already in argv whatever this command does next, so the operator
+ * needs to hear about it, and the shell history needs to be cleaned.
+ */
+export declare function resolveSecret(opts: ResolveSecretOptions): Promise<ResolvedSecret>;
+//# sourceMappingURL=prompt.d.ts.map

package/dist/types/cli/prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.d.ts","sourceRoot":"","sources":["../../../src/cli/prompt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAC;AAMrC,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAE5E;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE/C;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,gBAAgB,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAE5D;AAED,wBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C5E;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0E3D;AAED,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAgB1F;AAED,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,mDAAmD;IACnD,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,6CAA6C;IAC7C,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CAC/C;AAgBD,4EAA4E;AAC5E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAMD;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,GAAG,2BAA2B,CAAC;AAEzF;;;;;;;;;;;;GAYG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;gBAEtB,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE;CAOjF;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,kBAAkB,CAE5E;AAgCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,kBAAkB,CAOpB;AAKD,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAerD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAO5D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAkB1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA2C/E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAe1E;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM,GAAG,MAAM,CAchF;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,CAOR;AAED,6DAA6D;AAC7D,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,IAAI,CAEN;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAwCvF"}

package/dist/types/cli/ui/box.d.ts

@@ -0,0 +1,21 @@
+interface BoxOptions {
+    width?: number;
+    padding?: number;
+    title?: string;
+    titleStyle?: (s: string) => string;
+    style?: 'single' | 'double' | 'thin';
+    borderColor?: (s: string) => string;
+    align?: 'left' | 'center' | 'right';
+}
+export declare function box(content: string, opts?: BoxOptions): string;
+export declare function divider(width: number, color?: (s: string) => string): string;
+export declare function separator(label?: string, width?: number): string;
+export declare function indent(text: string, spaces?: number): string;
+export declare function bullet(text: string, color?: (s: string) => string): string;
+export declare function check(text: string): string;
+export declare function cross(text: string): string;
+export declare function warn(text: string): string;
+export declare function info(text: string): string;
+export declare function arrow(text: string, color?: (s: string) => string): string;
+export {};
+//# sourceMappingURL=box.d.ts.map

package/dist/types/cli/ui/box.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"box.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/box.ts"],"names":[],"mappings":"AAIA,UAAU,UAAU;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACnC,KAAK,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;IACrC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;CACrC;AAED,wBAAgB,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,UAAe,GAAG,MAAM,CA4BlE;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAc,GAAG,MAAM,CAEnF;AAED,wBAAgB,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,MAAM,CAO5D;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,MAAM,CAEvD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAe,GAAG,MAAM,CAElF;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAe,GAAG,MAAM,CAEjF"}

package/dist/types/cli/ui/clipboard.d.ts

@@ -0,0 +1,6 @@
+export interface ClipboardResult {
+    copied: boolean;
+    method: string | null;
+}
+export declare function copyToClipboard(text: string): ClipboardResult;
+//# sourceMappingURL=clipboard.d.ts.map

package/dist/types/cli/ui/clipboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/clipboard.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAuC7D"}

package/dist/types/cli/ui/colors.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Modern UI color palette for SW Agent CLI.
+ * Inspired by modern CLI tools (Vite, Claude Code, Cargo, etc.)
+ */
+export declare const C: {
+    reset: string;
+    green: (s: string) => string;
+    brightGreen: (s: string) => string;
+    cyan: (s: string) => string;
+    brightCyan: (s: string) => string;
+    yellow: (s: string) => string;
+    brightYellow: (s: string) => string;
+    red: (s: string) => string;
+    brightRed: (s: string) => string;
+    blue: (s: string) => string;
+    brightBlue: (s: string) => string;
+    magenta: (s: string) => string;
+    brightMagenta: (s: string) => string;
+    gray: (s: string) => string;
+    white: (s: string) => string;
+    brightWhite: (s: string) => string;
+    dim: (s: string) => string;
+    bold: (s: string) => string;
+    italic: (s: string) => string;
+    underline: (s: string) => string;
+    strikethrough: (s: string) => string;
+    bgGreen: (s: string) => string;
+    bgCyan: (s: string) => string;
+    bgYellow: (s: string) => string;
+    bgRed: (s: string) => string;
+    bgGray: (s: string) => string;
+    brand: (s: string) => string;
+    accent: (s: string) => string;
+};
+export declare function bold(text: string): string;
+export declare function dim(text: string): string;
+export declare function green(text: string): string;
+export declare function brightGreen(text: string): string;
+export declare function cyan(text: string): string;
+export declare function brightCyan(text: string): string;
+export declare function yellow(text: string): string;
+export declare function brightYellow(text: string): string;
+export declare function red(text: string): string;
+export declare function brightRed(text: string): string;
+export declare function blue(text: string): string;
+export declare function gray(text: string): string;
+export declare function white(text: string): string;
+export declare function brightWhite(text: string): string;
+export declare function magenta(text: string): string;
+export declare function brand(text: string): string;
+export declare function accent(text: string): string;
+export declare function stripAnsi(str: string): string;
+export declare function visibleLength(str: string): number;
+export declare function padAnsi(str: string, totalWidth: number): string;
+export declare function alignAnsi(str: string, totalWidth: number, align?: 'left' | 'right' | 'center'): string;
+export declare function truncateAnsi(str: string, maxWidth: number, suffix?: string): string;
+//# sourceMappingURL=colors.d.ts.map

package/dist/types/cli/ui/colors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"colors.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/colors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,eAAO,MAAM,CAAC;;eAJgB,MAAM,KAAK,MAAM;qBAAjB,MAAM,KAAK,MAAM;cAAjB,MAAM,KAAK,MAAM;oBAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;sBAAjB,MAAM,KAAK,MAAM;aAAjB,MAAM,KAAK,MAAM;mBAAjB,MAAM,KAAK,MAAM;cAAjB,MAAM,KAAK,MAAM;oBAAjB,MAAM,KAAK,MAAM;iBAAjB,MAAM,KAAK,MAAM;uBAAjB,MAAM,KAAK,MAAM;cAAjB,MAAM,KAAK,MAAM;eAAjB,MAAM,KAAK,MAAM;qBAAjB,MAAM,KAAK,MAAM;aAAjB,MAAM,KAAK,MAAM;cAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;mBAAjB,MAAM,KAAK,MAAM;uBAAjB,MAAM,KAAK,MAAM;iBAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;kBAAjB,MAAM,KAAK,MAAM;eAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;eAAjB,MAAM,KAAK,MAAM;gBAAjB,MAAM,KAAK,MAAM;CA0C9C,CAAC;AAEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAyB;AACnE,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAwB;AACjE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA0B;AACrE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAgC;AACjF,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAyB;AACnE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA+B;AAC/E,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA2B;AACvE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAiC;AACnF,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAwB;AACjE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA8B;AAC7E,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAyB;AACnE,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAyB;AACnE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA0B;AACrE,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAgC;AACjF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA4B;AACzE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA0B;AACrE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAA2B;AAEvE,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI/D;AAED,wBAAgB,SAAS,CACvB,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,EAClB,KAAK,GAAE,MAAM,GAAG,OAAO,GAAG,QAAiB,GAC1C,MAAM,CAUR;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAQ,GAAG,MAAM,CAoClF"}

package/dist/types/cli/ui/index.d.ts

@@ -0,0 +1,9 @@
+export { C, bold, dim, green, brightGreen, cyan, brightCyan, yellow, brightYellow, red, brightRed, blue, gray, white, brightWhite, magenta, brand, accent, stripAnsi, visibleLength, padAnsi, alignAnsi, truncateAnsi } from './colors';
+export { S, HAS_UNICODE } from './symbols';
+export { box, divider, separator, indent, bullet, check, cross, warn, info, arrow } from './box';
+export { renderTable, renderSimpleTable } from './table';
+export { createSpinner, withSpinner } from './spinner';
+export { terminalWidth, clampWidth, clearScreen, clearLine, fitLine, indentLines } from './terminal';
+export type { TableColumn, TableOptions } from './table';
+export type { Spinner } from './spinner';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/cli/ui/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxO,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrG,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACzD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}

package/dist/types/cli/ui/spinner.d.ts

@@ -0,0 +1,12 @@
+export interface Spinner {
+    start(text: string): void;
+    succeed(text?: string): void;
+    fail(text?: string): void;
+    warn(text?: string): void;
+    info(text?: string): void;
+    stop(): void;
+    update(text: string): void;
+}
+export declare function createSpinner(): Spinner;
+export declare function withSpinner<T>(text: string, fn: (spinner: Spinner) => Promise<T>): Promise<T>;
+//# sourceMappingURL=spinner.d.ts.map

package/dist/types/cli/ui/spinner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spinner.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/spinner.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,IAAI,IAAI,CAAC;IACb,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA2ED,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAI7F"}

package/dist/types/cli/ui/symbols.d.ts

@@ -0,0 +1,47 @@
+export declare const S: {
+    check: string;
+    cross: string;
+    arrow: string;
+    dot: string;
+    bullet: string;
+    dash: string;
+    dotSmall: string;
+    h: string;
+    v: string;
+    tl: string;
+    tr: string;
+    bl: string;
+    br: string;
+    t: string;
+    b: string;
+    l: string;
+    r: string;
+    crossBox: string;
+    dh: string;
+    dv: string;
+    dtl: string;
+    dtr: string;
+    dbl: string;
+    dbr: string;
+    dt: string;
+    db: string;
+    dl: string;
+    dr: string;
+    right: string;
+    left: string;
+    up: string;
+    down: string;
+    rightThin: string;
+    leftThin: string;
+    ellipsis: string;
+    info: string;
+    warning: string;
+    gear: string;
+    link: string;
+    play: string;
+    stop: string;
+    pause: string;
+    spinner: string[];
+};
+export declare const HAS_UNICODE: boolean;
+//# sourceMappingURL=symbols.d.ts.map

package/dist/types/cli/ui/symbols.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbols.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/symbols.ts"],"names":[],"mappings":"AAqHA,eAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA0C,CAAC;AACzD,eAAO,MAAM,WAAW,SAAU,CAAC"}

package/dist/types/cli/ui/table.d.ts

@@ -0,0 +1,23 @@
+export interface TableColumn<T> {
+    key: string;
+    header: string;
+    align?: 'left' | 'right' | 'center';
+    width?: number;
+    minWidth?: number;
+    maxWidth?: number;
+    priority?: number;
+    color?: (value: string, row: T) => string;
+    formatter?: (value: unknown, row: T) => string;
+    truncate?: boolean;
+}
+export interface TableOptions<T> {
+    columns: TableColumn<T>[];
+    headerStyle?: (s: string) => string;
+    borderColor?: (s: string) => string;
+    compact?: boolean;
+    maxWidth?: number;
+    cardWhenNarrow?: boolean;
+}
+export declare function renderTable<T extends Record<string, unknown>>(rows: T[], opts: TableOptions<T>): string;
+export declare function renderSimpleTable(rows: string[][], headers?: string[]): string;
+//# sourceMappingURL=table.d.ts.map

package/dist/types/cli/ui/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/table.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;IAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAUD,wBAAgB,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAkBvG;AAwJD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAkB9E"}

package/dist/types/cli/ui/terminal.d.ts

@@ -0,0 +1,7 @@
+export declare function terminalWidth(fallback?: number): number;
+export declare function clampWidth(width: number, min: number, max?: number): number;
+export declare function clearScreen(): void;
+export declare function clearLine(): void;
+export declare function fitLine(line: string, width?: number): string;
+export declare function indentLines(text: string, spaces?: number): string;
+//# sourceMappingURL=terminal.d.ts.map

package/dist/types/cli/ui/terminal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal.d.ts","sourceRoot":"","sources":["../../../../src/cli/ui/terminal.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,QAAQ,SAAK,GAAG,MAAM,CAUnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,SAAkB,GAAG,MAAM,CAEpF;AAED,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,wBAAgB,SAAS,IAAI,IAAI,CAEhC;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAkB,GAAG,MAAM,CAKrE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,MAAM,CAG5D"}

package/dist/types/config/atomic-write.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Atomic, symlink-refusing, permission-repairing file writes plus the advisory
+ * lock used to serialise read-modify-write sequences over config files.
+ *
+ * Every config file that can hold the agent token or a database password must
+ * go through {@link atomicWriteFile}: a plain `writeFileSync` applies `mode`
+ * only on create (so a pre-existing 0o644 file stays world-readable), follows
+ * symlinks planted by a local attacker, and can truncate the file — which for
+ * the machine config means permanent loss of the agent token.
+ */
+/** Mode every credential-bearing config file is written and repaired to. */
+export declare const ATOMIC_WRITE_FILE_MODE = 384;
+/** Mode the containing directory is created and repaired to. */
+export declare const ATOMIC_WRITE_DIR_MODE = 448;
+export type AtomicWriteErrorCode = 'symlink_refused' | 'write_failed' | 'lock_timeout';
+/** Raised when a config write is refused or cannot be completed. */
+export declare class AtomicWriteError extends Error {
+    readonly code: AtomicWriteErrorCode;
+    constructor(message: string, code?: AtomicWriteErrorCode);
+}
+export interface FileLockOptions {
+    /** Age after which an abandoned lock is reaped. Default 30s. */
+    staleMs?: number;
+    /** How long to wait for a contended lock before failing. Default 5s. */
+    timeoutMs?: number;
+    /** Lock acquisition poll interval. Default 25ms. */
+    retryMs?: number;
+}
+/**
+ * Fails when `target` is a symlink. A missing file is not a symlink, so the
+ * check is safe to run before every create. Use `lstat`, never `stat`: `stat`
+ * follows the link and reports the target's type, which is exactly the check
+ * that has to fail here.
+ */
+export declare function assertNotSymlink(target: string): void;
+/** Creates the containing directory if missing; leaves an existing one alone. */
+export declare function ensureDir(dir: string): void;
+/**
+ * Creates the containing directory and repairs the mode of a pre-existing one
+ * that is group- or world-accessible. Used for the agent home, which holds the
+ * token: a 0o755 home is a failed control, not a cosmetic detail.
+ */
+export declare function ensureSecureDir(dir: string): void;
+/**
+ * Writes `data` to `filePath` atomically:
+ * create a private temp file, fsync it, rename it over the target, then fsync
+ * the directory. A reader therefore only ever sees the complete old file or the
+ * complete new one, and a crash cannot truncate the config.
+ *
+ * The temp file is created with O_EXCL|O_NOFOLLOW, so it can never be
+ * pre-created (or symlinked) by another process, and is chmod'ed to `mode`
+ * unconditionally: `mode` passed to `open` is masked by the umask, so it alone
+ * cannot guarantee 0o600.
+ */
+export declare function atomicWriteFile(filePath: string, data: string | Buffer, mode?: number): void;
+/** `atomicWriteFile` for a JSON document, pretty-printed with a trailing newline. */
+export declare function atomicWriteJson(filePath: string, value: unknown, mode?: number): void;
+/**
+ * Runs `fn` while holding an exclusive advisory lock on `targetPath`. Use it
+ * around every load → mutate → save sequence so two concurrent CLI
+ * invocations cannot lose one another's update. The lock is an `O_EXCL` lock
+ * file, so it is released by the kernel even if the process is killed; a lock
+ * whose holder died is reaped after `staleMs`.
+ *
+ * Re-entrant within one process: a nested call for the same target runs `fn`
+ * directly instead of deadlocking against itself.
+ */
+export declare function withFileLock<T>(targetPath: string, fn: () => T, opts?: FileLockOptions): T;
+//# sourceMappingURL=atomic-write.d.ts.map

package/dist/types/config/atomic-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-write.d.ts","sourceRoot":"","sources":["../../../src/config/atomic-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,MAAQ,CAAC;AAE5C,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,MAAQ,CAAC;AAE3C,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,cAAc,GAAG,cAAc,CAAC;AAEvF,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;gBAExB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAqC;CAKzE;AAED,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+CD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAcrD;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAQ3C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGjD;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,IAAI,GAAE,MAA+B,GACpC,IAAI,CA4BN;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,MAA+B,GACpC,IAAI,CAEN;AAmED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,CAAC,EACX,IAAI,GAAE,eAAoB,GACzB,CAAC,CAkBH"}

package/dist/types/config/db-config.d.ts

@@ -0,0 +1,134 @@
+import { PermissionLevel } from '../permissions/checker';
+/**
+ * Database-level config: databases.config.json
+ * Array of DB entries. Each entry binds one DB to one project.
+ * One project = one DB (schema weaver constraint).
+ */
+export interface DbEntry {
+    project_name: string;
+    db_alias: string;
+    host: string;
+    port: number;
+    database: string;
+    user: string;
+    password_env?: string;
+    /**
+     * Password in cleartext. Present only in memory: the on-disk form is an
+     * {@link EncryptedPassword} envelope (see `sealDbConfig`). A plain string is
+     * still accepted on read so configs written by earlier versions load, and is
+     * re-encrypted on the next write.
+     */
+    password_stored?: string;
+    ssl_mode: 'disable' | 'require' | 'verify-ca' | 'verify-full';
+    ssl_root_cert?: string | null;
+    permission_override: PermissionLevel | null;
+    created_at: string;
+}
+export type DbConfig = DbEntry[];
+/**
+ * Envelope written to disk in place of a cleartext password.
+ * The plaintext never leaves the process; `ct` is AES-256-GCM output whose
+ * authentication tag also covers the entry identity (AAD), so a ciphertext
+ * cannot be moved between entries.
+ */
+export interface EncryptedPassword {
+    v: 1;
+    kdf: 'scrypt';
+    iv: string;
+    tag: string;
+    ct: string;
+}
+/** Entry identity an encrypted password is bound to. */
+export interface PasswordBinding {
+    db_alias: string;
+    host: string;
+    port: number;
+    database: string;
+    user: string;
+}
+/**
+ * Builds the additional authenticated data for a stored password: the entry
+ * identity. Serialised as a JSON array so no field value can shift the
+ * boundaries of another one.
+ */
+export declare function buildPasswordAad(binding: PasswordBinding): string;
+/**
+ * True when a value is an encrypted-password envelope rather than cleartext.
+ */
+export declare function isEncryptedPassword(value: unknown): value is EncryptedPassword;
+/**
+ * Loads the key file, creating it on first use. The derived key is cached for
+ * the life of the process so repeated config reads cost one KDF run.
+ */
+export declare function loadCredentialKey(): Buffer;
+/**
+ * Encrypts a database password for storage. Generates a fresh random 96-bit
+ * IV and authenticates the entry identity as AAD.
+ */
+export declare function encryptDbPassword(binding: PasswordBinding, plaintext: string): EncryptedPassword;
+/**
+ * Decrypts a stored database password. Throws when the envelope fails
+ * authentication, which includes a ciphertext copied from another entry.
+ */
+export declare function decryptDbPassword(binding: PasswordBinding, env: EncryptedPassword): string;
+/**
+ * Encrypts every cleartext password in the config for storage.
+ * Entries that already hold an envelope are passed through unchanged, so a
+ * load/save round trip never double-encrypts.
+ */
+export declare function sealDbConfig(config: DbConfig): unknown[];
+/**
+ * Checks if the databases.config.json file exists.
+ */
+export declare function dbConfigExists(): boolean;
+/**
+ * Validates the database config.
+ * Accepts a cleartext `password_stored` (pre-encryption on-disk shape) or an
+ * encrypted envelope; both are narrowed to cleartext in memory by
+ * {@link loadDbConfig} and re-sealed by {@link saveDbConfig}.
+ */
+export declare function validateDbConfig(raw: unknown): DbConfig;
+/**
+ * Loads the database config. Returns empty array if file does not exist.
+ * Encrypted `password_stored` envelopes are decrypted in memory; a config
+ * written by an earlier version (cleartext) is returned as-is and is upgraded
+ * on the next save.
+ */
+export declare function loadDbConfig(): DbConfig;
+/**
+ * Saves the database config to disk with 0o600 permissions on POSIX.
+ * Every cleartext `password_stored` is replaced by an encrypted envelope bound
+ * to that entry's identity before anything is written.
+ */
+export declare function saveDbConfig(config: DbConfig): void;
+/**
+ * Runs a load → mutate → save cycle over databases.config.json under an
+ * advisory lock, so two concurrent CLI invocations cannot lose one another's
+ * update. `mutate` edits the array in place; its return value is passed back.
+ */
+export declare function mutateDbConfig<T>(mutate: (config: DbConfig) => T): T;
+/**
+ * Adds a database entry to config and saves it. Enforces one DB per project.
+ */
+export declare function addDbEntry(entry: Omit<DbEntry, 'created_at'>): DbEntry;
+/**
+ * Removes a database entry by its alias. Returns true if removed, false if not found.
+ */
+export declare function removeDbEntry(dbAlias: string): boolean;
+/**
+ * Finds a database entry by its alias.
+ */
+export declare function findDbEntry(dbAlias: string): DbEntry | null;
+/**
+ * Finds a database entry by its project name.
+ */
+export declare function findDbByProject(projectName: string): DbEntry | null;
+/**
+ * Lists unique project names across all configured databases, sorted alphabetically.
+ */
+export declare function listProjects(): string[];
+export interface DatabasesConfig {
+    databases: DbEntry[];
+}
+export declare function loadDatabasesConfig(): DatabasesConfig;
+//# sourceMappingURL=db-config.d.ts.map