@wrongstack/cli 0.295.1 → 0.296.3

package/dist/chunk-OP47B3IX.js

@@ -0,0 +1,142 @@
+
+// src/hq-command-controller.ts
+function createHqCommandDispatcher(controller) {
+  return async (command) => {
+    const cmd = command;
+    try {
+      const result = await dispatch(controller, cmd.commandId, cmd.type, cmd.payload);
+      return result;
+    } catch (err) {
+      return {
+        commandId: command.commandId,
+        status: "failed",
+        message: err instanceof Error ? err.message : String(err)
+      };
+    }
+  };
+}
+async function dispatch(controller, commandId, type, payload) {
+  switch (type) {
+    case "steer": {
+      const mailbox = controller.steerMailbox;
+      if (mailbox === void 0) {
+        return { commandId, status: "rejected", message: "no mailbox available" };
+      }
+      const to = typeof payload["to"] === "string" ? payload["to"] : "leader";
+      const subject = typeof payload["subject"] === "string" ? payload["subject"] : "HQ steer";
+      const body = typeof payload["body"] === "string" ? payload["body"] : "";
+      const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
+      const from = `hq@${controller.sessionTag()}`;
+      await mailbox.send({ from, to, type: "steer", subject, body, priority });
+      return { commandId, status: "accepted", message: `steered ${to}` };
+    }
+    case "btw": {
+      const mailbox = controller.steerMailbox;
+      if (mailbox === void 0) {
+        return { commandId, status: "rejected", message: "no mailbox available" };
+      }
+      const to = typeof payload["to"] === "string" ? payload["to"] : "leader";
+      const subject = typeof payload["subject"] === "string" ? payload["subject"] : "HQ note";
+      const body = typeof payload["body"] === "string" ? payload["body"] : "";
+      const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
+      const from = `hq@${controller.sessionTag()}`;
+      await mailbox.send({ from, to, type: "btw", subject, body, priority });
+      return { commandId, status: "accepted", message: `noted ${to}` };
+    }
+    case "queue": {
+      const mailbox = controller.steerMailbox;
+      if (mailbox === void 0) {
+        return { commandId, status: "rejected", message: "no mailbox available" };
+      }
+      const to = typeof payload["to"] === "string" ? payload["to"] : "leader";
+      const subject = typeof payload["subject"] === "string" ? payload["subject"] : "HQ prompt";
+      const body = typeof payload["body"] === "string" ? payload["body"] : "";
+      const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
+      const from = `hq@${controller.sessionTag()}`;
+      await mailbox.send({ from, to, type: "note", subject, body, priority });
+      return { commandId, status: "accepted", message: `queued for ${to}` };
+    }
+    case "broadcast": {
+      const mailbox = controller.steerMailbox;
+      if (mailbox === void 0) {
+        return { commandId, status: "rejected", message: "no mailbox available" };
+      }
+      const subject = typeof payload["subject"] === "string" ? payload["subject"] : "HQ broadcast";
+      const body = typeof payload["body"] === "string" ? payload["body"] : "";
+      const priority = payload["priority"] === "high" ? "high" : payload["priority"] === "low" ? "low" : "normal";
+      const from = `hq@${controller.sessionTag()}`;
+      await mailbox.send({ from, to: "all", type: "broadcast", subject, body, priority });
+      return { commandId, status: "accepted", message: "broadcast sent" };
+    }
+    case "abort": {
+      const target = typeof payload["target"] === "string" ? payload["target"] : "leader";
+      if (target === "leader") {
+        const aborted = controller.interruptLeader();
+        return {
+          commandId,
+          status: aborted ? "completed" : "accepted",
+          message: aborted ? "leader aborted" : "no active leader run"
+        };
+      }
+      if (target === "fleet") {
+        const killed = await controller.killFleet?.() ?? 0;
+        return {
+          commandId,
+          status: "completed",
+          message: `fleet stopped (${killed} agents)`
+        };
+      }
+      const terminated = await controller.terminateAgent?.(target) ?? false;
+      return {
+        commandId,
+        status: terminated ? "completed" : "rejected",
+        message: terminated ? `agent ${target} terminated` : `agent ${target} not found`
+      };
+    }
+    case "spawn": {
+      const role = typeof payload["role"] === "string" ? payload["role"] : "";
+      const task = typeof payload["task"] === "string" ? payload["task"] : void 0;
+      const maxIterations = typeof payload["maxIterations"] === "number" ? payload["maxIterations"] : void 0;
+      if (controller.spawnAgent === void 0) {
+        return { commandId, status: "rejected", message: "no director active" };
+      }
+      const subagentId = await controller.spawnAgent(role, task, maxIterations);
+      return { commandId, status: "completed", message: `spawned ${subagentId}` };
+    }
+    case "run-command": {
+      if (!controller.allowRunCommand()) {
+        return {
+          commandId,
+          status: "rejected",
+          message: "run-command requires operator opt-in (--hq-allow-exec)"
+        };
+      }
+      const mailbox = controller.steerMailbox;
+      const command = typeof payload["command"] === "string" ? payload["command"] : "";
+      if (mailbox !== void 0 && command.length > 0) {
+        const from = `hq@${controller.sessionTag()}`;
+        await mailbox.send({
+          from,
+          to: "leader",
+          type: "steer",
+          subject: "Run command (HQ)",
+          body: `Run the following shell command:
+
+\`\`\`
+${command}
+\`\`\``,
+          priority: "high"
+        });
+        return { commandId, status: "accepted", message: "run-command routed to leader as steer" };
+      }
+      return { commandId, status: "rejected", message: "cannot route run-command (no mailbox)" };
+    }
+    default:
+      return { commandId, status: "rejected", message: `unknown command type: ${type}` };
+  }
+}
+
+export {
+  createHqCommandDispatcher
+};
+//# sourceMappingURL=chunk-OP47B3IX.js.map

package/dist/chunk-OP47B3IX.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/hq-command-controller.ts"],
+  "sourcesContent": ["/**\n * HQ command controller \u2014 the client-side dispatch surface for Phase 4 of the\n * HQ command center. A mutable holder (mirroring the established\n * `interruptController` pattern in cli-main.ts) that the `onCommand` handler\n * on the HQ publisher reads lazily, because several of its targets\n * (`director`, the rebound `interruptLeader`) are not yet defined at HQ-connect\n * time.\n *\n * The five command types route through the agent's own decision loop or the\n * project mailbox, so they inherit existing guardrails. `run-command` (raw\n * shell) is deliberately NOT wired here \u2014 it requires a separately-audited\n * escalation policy (operator flag + per-token `control.execute` + allowlist)\n * and is left as a stub that rejects until that policy exists.\n *\n * @module hq-command-controller\n */\nimport type { HqPublisherCommandResult } from '@wrongstack/core/hq';\nimport type { RemoteMailbox } from '@wrongstack/core/coordination';\nimport type { HqCommand } from '@wrongstack/core/hq';\n\n/**\n * Mutable holder for the command dispatch targets. Each field is populated\n * lazily as the corresponding subsystem comes online (director on\n * `onDirectorReady`, interruptLeader rebound by the REPL/TUI, \u2026). The\n * `onCommand` handler reads these at dispatch time, not at construction.\n */\nexport interface HqCommandController {\n  /** Project mailbox used to deliver steer/broadcast messages. */\n  steerMailbox?: RemoteMailbox | undefined;\n  /** Abort the session leader's running Agent.run(). Returns true if a run was aborted. */\n  interruptLeader: () => boolean;\n  /** Terminate a specific subagent by id. Returns true if terminated. */\n  terminateAgent?: (subagentId: string) => boolean | Promise<boolean>;\n  /** Stop the entire fleet (all running/idle subagents). Returns kill count. */\n  killFleet?: () => number | Promise<number>;\n  /** Spawn a subagent of the given role. Returns the new subagentId. */\n  spawnAgent?: (role: string, task?: string, maxIterations?: number) => Promise<string>;\n  /** Derive the session-unique mailbox tag for addressing (e.g. `leader@<tag>`). */\n  sessionTag: () => string;\n  /** Whether raw shell execution is explicitly opted-in by the operator. */\n  allowRunCommand: () => boolean;\n}\n\n/**\n * Build the `onCommand` handler for an HQ publisher. The handler validates\n * the command, dispatches through the controller, and returns an ack result\n * (or throws to produce a `failed` ack \u2014 the publisher's `handleCommandBatch`\n * wraps it). Best-effort: a dispatch failure never breaks the host.\n */\nexport function createHqCommandDispatcher(\n  controller: HqCommandController,\n): (command: { commandId: string; type: string; payload: unknown }) => Promise<HqPublisherCommandResult> {\n  return async (command) => {\n    const cmd = command as { commandId: string; type: string; payload: Record<string, unknown> };\n    try {\n      const result = await dispatch(controller, cmd.commandId, cmd.type as HqCommand['type'], cmd.payload);\n      return result;\n    } catch (err) {\n      return {\n        commandId: command.commandId,\n        status: 'failed',\n        message: err instanceof Error ? err.message : String(err),\n      };\n    }\n  };\n}\n\nasync function dispatch(\n  controller: HqCommandController,\n  commandId: string,\n  type: HqCommand['type'],\n  payload: Record<string, unknown>,\n): Promise<HqPublisherCommandResult> {\n  switch (type) {\n    case 'steer': {\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ steer';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'steer', subject, body, priority });\n      return { commandId, status: 'accepted', message: `steered ${to}` };\n    }\n\n    case 'btw': {\n      // Non-urgent FYI. Same targeting as steer, but delivered as a `btw`\n      // mailbox message so the receiving agent absorbs it as context instead\n      // of treating it as a course-correction. Lands in the mailbox file\n      // regardless of whether a loop is currently running.\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ note';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'btw', subject, body, priority });\n      return { commandId, status: 'accepted', message: `noted ${to}` };\n    }\n\n    case 'queue': {\n      // Queue a prompt/note for the target. Delivered as a plain `note` the\n      // agent picks up before its next step \u2014 used when the prompt should\n      // wait its turn rather than steer the current operation. Like steer/btw,\n      // this only writes to the mailbox; no live loop is required.\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const to = typeof payload['to'] === 'string' ? payload['to'] : 'leader';\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ prompt';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to, type: 'note', subject, body, priority });\n      return { commandId, status: 'accepted', message: `queued for ${to}` };\n    }\n\n    case 'broadcast': {\n      const mailbox = controller.steerMailbox;\n      if (mailbox === undefined) {\n        return { commandId, status: 'rejected', message: 'no mailbox available' };\n      }\n      const subject = typeof payload['subject'] === 'string' ? payload['subject'] : 'HQ broadcast';\n      const body = typeof payload['body'] === 'string' ? payload['body'] : '';\n      const priority = payload['priority'] === 'high' ? 'high' : payload['priority'] === 'low' ? 'low' : 'normal';\n      const from = `hq@${controller.sessionTag()}`;\n      await mailbox.send({ from, to: 'all', type: 'broadcast', subject, body, priority });\n      return { commandId, status: 'accepted', message: 'broadcast sent' };\n    }\n\n    case 'abort': {\n      const target = typeof payload['target'] === 'string' ? payload['target'] : 'leader';\n      if (target === 'leader') {\n        const aborted = controller.interruptLeader();\n        return {\n          commandId,\n          status: aborted ? 'completed' : 'accepted',\n          message: aborted ? 'leader aborted' : 'no active leader run',\n        };\n      }\n      if (target === 'fleet') {\n        const killed = (await controller.killFleet?.()) ?? 0;\n        return {\n          commandId,\n          status: 'completed',\n          message: `fleet stopped (${killed} agents)`,\n        };\n      }\n      // Specific subagent id.\n      const terminated = (await controller.terminateAgent?.(target)) ?? false;\n      return {\n        commandId,\n        status: terminated ? 'completed' : 'rejected',\n        message: terminated ? `agent ${target} terminated` : `agent ${target} not found`,\n      };\n    }\n\n    case 'spawn': {\n      const role = typeof payload['role'] === 'string' ? payload['role'] : '';\n      const task = typeof payload['task'] === 'string' ? payload['task'] : undefined;\n      const maxIterations = typeof payload['maxIterations'] === 'number' ? payload['maxIterations'] : undefined;\n      if (controller.spawnAgent === undefined) {\n        return { commandId, status: 'rejected', message: 'no director active' };\n      }\n      const subagentId = await controller.spawnAgent(role, task, maxIterations);\n      return { commandId, status: 'completed', message: `spawned ${subagentId}` };\n    }\n\n    case 'run-command': {\n      // RCE gate: require explicit operator opt-in. Without it, reject every\n      // run-command so a stolen client token can never gain shell access.\n      if (!controller.allowRunCommand()) {\n        return {\n          commandId,\n          status: 'rejected',\n          message: 'run-command requires operator opt-in (--hq-allow-exec)',\n        };\n      }\n      // Even with opt-in, we do NOT exec shell directly \u2014 we route through the\n      // agent as a steer so the agent's own permission policy still applies.\n      // A full direct-exec path is deferred until a separately-audited\n      // escalation policy + allowlist exists.\n      const mailbox = controller.steerMailbox;\n      const command = typeof payload['command'] === 'string' ? payload['command'] : '';\n      if (mailbox !== undefined && command.length > 0) {\n        const from = `hq@${controller.sessionTag()}`;\n        await mailbox.send({\n          from,\n          to: 'leader',\n          type: 'steer',\n          subject: 'Run command (HQ)',\n          body: `Run the following shell command:\\n\\n\\`\\`\\`\\n${command}\\n\\`\\`\\``,\n          priority: 'high',\n        });\n        return { commandId, status: 'accepted', message: 'run-command routed to leader as steer' };\n      }\n      return { commandId, status: 'rejected', message: 'cannot route run-command (no mailbox)' };\n    }\n\n    default:\n      return { commandId, status: 'rejected', message: `unknown command type: ${type}` };\n  }\n}\n"],
+  "mappings": ";;;AAiDO,SAAS,0BACd,YACuG;AACvG,SAAO,OAAO,YAAY;AACxB,UAAM,MAAM;AACZ,QAAI;AACF,YAAM,SAAS,MAAM,SAAS,YAAY,IAAI,WAAW,IAAI,MAA2B,IAAI,OAAO;AACnG,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,WAAW,QAAQ;AAAA,QACnB,QAAQ;AAAA,QACR,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,SACb,YACA,WACA,MACA,SACmC;AACnC,UAAQ,MAAM;AAAA,IACZ,KAAK,SAAS;AACZ,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,SAAS,SAAS,MAAM,SAAS,CAAC;AACvE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,WAAW,EAAE,GAAG;AAAA,IACnE;AAAA,IAEA,KAAK,OAAO;AAKV,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,OAAO,SAAS,MAAM,SAAS,CAAC;AACrE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,SAAS,EAAE,GAAG;AAAA,IACjE;AAAA,IAEA,KAAK,SAAS;AAKZ,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,KAAK,OAAO,QAAQ,IAAI,MAAM,WAAW,QAAQ,IAAI,IAAI;AAC/D,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,SAAS,CAAC;AACtE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,cAAc,EAAE,GAAG;AAAA,IACtE;AAAA,IAEA,KAAK,aAAa;AAChB,YAAM,UAAU,WAAW;AAC3B,UAAI,YAAY,QAAW;AACzB,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,uBAAuB;AAAA,MAC1E;AACA,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,WAAW,QAAQ,UAAU,MAAM,SAAS,SAAS,QAAQ,UAAU,MAAM,QAAQ,QAAQ;AACnG,YAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,YAAM,QAAQ,KAAK,EAAE,MAAM,IAAI,OAAO,MAAM,aAAa,SAAS,MAAM,SAAS,CAAC;AAClF,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,iBAAiB;AAAA,IACpE;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,SAAS,OAAO,QAAQ,QAAQ,MAAM,WAAW,QAAQ,QAAQ,IAAI;AAC3E,UAAI,WAAW,UAAU;AACvB,cAAM,UAAU,WAAW,gBAAgB;AAC3C,eAAO;AAAA,UACL;AAAA,UACA,QAAQ,UAAU,cAAc;AAAA,UAChC,SAAS,UAAU,mBAAmB;AAAA,QACxC;AAAA,MACF;AACA,UAAI,WAAW,SAAS;AACtB,cAAM,SAAU,MAAM,WAAW,YAAY,KAAM;AACnD,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,UACR,SAAS,kBAAkB,MAAM;AAAA,QACnC;AAAA,MACF;AAEA,YAAM,aAAc,MAAM,WAAW,iBAAiB,MAAM,KAAM;AAClE,aAAO;AAAA,QACL;AAAA,QACA,QAAQ,aAAa,cAAc;AAAA,QACnC,SAAS,aAAa,SAAS,MAAM,gBAAgB,SAAS,MAAM;AAAA,MACtE;AAAA,IACF;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,OAAO,OAAO,QAAQ,MAAM,MAAM,WAAW,QAAQ,MAAM,IAAI;AACrE,YAAM,gBAAgB,OAAO,QAAQ,eAAe,MAAM,WAAW,QAAQ,eAAe,IAAI;AAChG,UAAI,WAAW,eAAe,QAAW;AACvC,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,qBAAqB;AAAA,MACxE;AACA,YAAM,aAAa,MAAM,WAAW,WAAW,MAAM,MAAM,aAAa;AACxE,aAAO,EAAE,WAAW,QAAQ,aAAa,SAAS,WAAW,UAAU,GAAG;AAAA,IAC5E;AAAA,IAEA,KAAK,eAAe;AAGlB,UAAI,CAAC,WAAW,gBAAgB,GAAG;AACjC,eAAO;AAAA,UACL;AAAA,UACA,QAAQ;AAAA,UACR,SAAS;AAAA,QACX;AAAA,MACF;AAKA,YAAM,UAAU,WAAW;AAC3B,YAAM,UAAU,OAAO,QAAQ,SAAS,MAAM,WAAW,QAAQ,SAAS,IAAI;AAC9E,UAAI,YAAY,UAAa,QAAQ,SAAS,GAAG;AAC/C,cAAM,OAAO,MAAM,WAAW,WAAW,CAAC;AAC1C,cAAM,QAAQ,KAAK;AAAA,UACjB;AAAA,UACA,IAAI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM;AAAA;AAAA;AAAA,EAA+C,OAAO;AAAA;AAAA,UAC5D,UAAU;AAAA,QACZ,CAAC;AACD,eAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,wCAAwC;AAAA,MAC3F;AACA,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,wCAAwC;AAAA,IAC3F;AAAA,IAEA;AACE,aAAO,EAAE,WAAW,QAAQ,YAAY,SAAS,yBAAyB,IAAI,GAAG;AAAA,EACrF;AACF;",
+  "names": []
+}

package/dist/chunk-PJHET45A.js

@@ -0,0 +1,158 @@
+
+// src/provider-config-utils.ts
+import { expectDefined } from "@wrongstack/core/utils";
+import { FsError } from "@wrongstack/core/types";
+import * as fs from "node:fs/promises";
+import { atomicWrite, color } from "@wrongstack/core/utils";
+import { decryptConfigSecrets, encryptConfigSecrets } from "@wrongstack/core/security";
+function normalizeKeys(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    return cfg.apiKeys.map((k) => ({ ...k }));
+  }
+  if (typeof cfg.apiKey === "string" && cfg.apiKey.length > 0) {
+    return [{ label: "default", apiKey: cfg.apiKey, createdAt: "" }];
+  }
+  return [];
+}
+function writeKeysBack(cfg, keys) {
+  if (keys.length === 0) {
+    delete cfg.apiKeys;
+    delete cfg.apiKey;
+    delete cfg.activeKey;
+    return;
+  }
+  cfg.apiKeys = keys;
+  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);
+  delete cfg.apiKey;
+  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {
+    cfg.activeKey = active.label;
+  }
+}
+function resolveActiveApiKey(cfg) {
+  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {
+    const active = cfg.activeKey ? cfg.apiKeys.find((k) => k.label === cfg.activeKey) : void 0;
+    return (active ?? cfg.apiKeys[0])?.apiKey;
+  }
+  return cfg.apiKey && cfg.apiKey.length > 0 ? cfg.apiKey : void 0;
+}
+function isLoopbackBaseUrl(baseUrl) {
+  if (!baseUrl) return false;
+  try {
+    let host = new URL(baseUrl).hostname.toLowerCase();
+    host = host.replace(/^\[|\]$/g, "");
+    return host === "localhost" || host === "::1" || host === "0.0.0.0" || /^127\./.test(host);
+  } catch {
+    return false;
+  }
+}
+function providerCanRunWithoutSavedKey(cfg) {
+  return isLoopbackBaseUrl(cfg.baseUrl) && (!cfg.envVars || cfg.envVars.length === 0);
+}
+function hasUsableSavedProvider(cfg) {
+  return resolveActiveApiKey(cfg) !== void 0 || providerCanRunWithoutSavedKey(cfg);
+}
+function clearStaleProviderDefaults(config) {
+  const providerId = typeof config["provider"] === "string" ? config["provider"] : void 0;
+  if (!providerId) return;
+  const providers = config["providers"];
+  const provider = providers?.[providerId];
+  if (!provider || !hasUsableSavedProvider(provider)) {
+    delete config["provider"];
+    delete config["model"];
+    return;
+  }
+  const modelId = typeof config["model"] === "string" ? config["model"] : void 0;
+  if (modelId && Array.isArray(provider.models) && provider.models.length > 0 && !provider.models.includes(modelId)) {
+    delete config["model"];
+  }
+}
+function activeLabel(cfg, keys) {
+  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;
+  return keys[0]?.label;
+}
+function maskedKey(key) {
+  if (!key) return color.dim("\u2014");
+  if (key.length <= 8) return color.dim("\u2022".repeat(key.length));
+  const head = key.slice(0, 4);
+  const tail = key.slice(-4);
+  return `${color.dim(head + "\u2026")}${tail}`;
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+async function loadConfigProviders(configPath, vault, opts) {
+  const warn = opts?.warn;
+  const targetPath = opts?.profileConfigPath ?? configPath;
+  let raw;
+  try {
+    raw = await fs.readFile(targetPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      warn?.(`Could not read ${targetPath}: ${err.message}. Treating as empty.`);
+    }
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    warn?.(`Config at ${targetPath} is not valid JSON: ${err.message}`);
+    return {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  return decrypted.providers ?? {};
+}
+async function mutateConfigProviders(configPath, vault, mutator, profileConfigPath) {
+  const targetPath = profileConfigPath ?? configPath;
+  let raw;
+  let fileExists = true;
+  try {
+    raw = await fs.readFile(targetPath, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") {
+      throw new FsError({
+        message: `Refusing to mutate ${configPath}: ${err.message}`,
+        code: "FS_READ_FAILED",
+        path: targetPath,
+        context: { operation: "mutateConfigProviders", phase: "read" },
+        cause: err
+      });
+    }
+    fileExists = false;
+    raw = "{}";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    if (fileExists) {
+      throw new FsError({
+        message: `Refusing to overwrite corrupt config at ${targetPath} (${err.message}). Fix or move the file aside before retrying.`,
+        code: "FS_READ_FAILED",
+        path: targetPath,
+        context: { operation: "mutateConfigProviders", phase: "parse" },
+        cause: err
+      });
+    }
+    parsed = {};
+  }
+  const decrypted = decryptConfigSecrets(parsed, vault);
+  const providers = decrypted.providers ?? {};
+  mutator(providers);
+  decrypted.providers = providers;
+  clearStaleProviderDefaults(decrypted);
+  const encrypted = encryptConfigSecrets(decrypted, vault);
+  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 384 });
+}
+
+export {
+  normalizeKeys,
+  writeKeysBack,
+  resolveActiveApiKey,
+  activeLabel,
+  maskedKey,
+  nowIso,
+  loadConfigProviders,
+  mutateConfigProviders
+};
+//# sourceMappingURL=chunk-PJHET45A.js.map

package/dist/chunk-PJHET45A.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/provider-config-utils.ts"],
+  "sourcesContent": ["import { expectDefined } from '@wrongstack/core/utils';\nimport { FsError } from '@wrongstack/core/types';\n\nexport { expectDefined };\n\n/**\n * Pure helpers for ProviderConfig shape normalisation, key masking, and\n * timestamp generation \u2014 plus config file I/O (load/mutate providers).\n * Shared between auth-menu.ts, webui-server.ts, and any future code that\n * touches the config `providers` map.\n */\nimport * as fs from 'node:fs/promises';\nimport type { ProviderApiKey, ProviderConfig, SecretVault } from '@wrongstack/core/types';\nimport { atomicWrite, color } from '@wrongstack/core/utils';\nimport { decryptConfigSecrets, encryptConfigSecrets } from '@wrongstack/core/security';\n/**\n * Normalize a ProviderConfig to the canonical `apiKeys[]` form.\n * Migrates the legacy single-key `apiKey` field on the fly so every\n * consumer sees a uniform shape. Does NOT mutate the input.\n */\nexport function normalizeKeys(cfg: ProviderConfig): ProviderApiKey[] {\n  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {\n    return cfg.apiKeys.map((k) => ({ ...k }));\n  }\n  if (typeof cfg.apiKey === 'string' && cfg.apiKey.length > 0) {\n    return [{ label: 'default', apiKey: cfg.apiKey, createdAt: '' }];\n  }\n  return [];\n}\n\n/**\n * Write a normalized key list back into a ProviderConfig. Does NOT mirror\n * the plaintext key to the legacy `apiKey` field \u2014 that would leak the\n * secret on any accidental JSON.stringify of the config. Consumers that\n * need the real key must call {@link resolveActiveApiKey}.\n */\nexport function writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[]): void {\n  if (keys.length === 0) {\n    delete cfg.apiKeys;\n    delete cfg.apiKey;\n    delete cfg.activeKey;\n    return;\n  }\n  cfg.apiKeys = keys;\n  const active = keys.find((k) => k.label === cfg.activeKey) ?? expectDefined(keys[0]);\n  // Do NOT mirror plaintext to cfg.apiKey \u2014 the legacy field is cleared so\n  // that accidental serialization (logging, error messages, WS payloads)\n  // cannot leak the active key. Use resolveActiveApiKey() to read the real key.\n  delete cfg.apiKey;\n  if (!cfg.activeKey || !keys.some((k) => k.label === cfg.activeKey)) {\n    cfg.activeKey = active.label;\n  }\n}\n\n/**\n * Extract the active (decrypted) API key from a ProviderConfig.\n *\n * Resolution order:\n *   1. `apiKeys[]` \u2014 pick the entry matching `activeKey`, or the first one\n *   2. Legacy `apiKey` field \u2014 only for configs not yet migrated to multi-key\n *\n * This is the **preferred** way to read the API key. Never read `cfg.apiKey`\n * directly in new code \u2014 after {@link writeKeysBack} it is cleared, and even\n * when present on a freshly-loaded config it may contain a masked value.\n */\nexport function resolveActiveApiKey(cfg: ProviderConfig): string | undefined {\n  if (Array.isArray(cfg.apiKeys) && cfg.apiKeys.length > 0) {\n    const active = cfg.activeKey\n      ? cfg.apiKeys.find((k) => k.label === cfg.activeKey)\n      : undefined;\n    return (active ?? cfg.apiKeys[0])?.apiKey;\n  }\n  return cfg.apiKey && cfg.apiKey.length > 0 ? cfg.apiKey : undefined;\n}\n\nfunction isLoopbackBaseUrl(baseUrl: string | undefined): boolean {\n  if (!baseUrl) return false;\n  try {\n    let host = new URL(baseUrl).hostname.toLowerCase();\n    host = host.replace(/^\\[|\\]$/g, '');\n    return host === 'localhost' || host === '::1' || host === '0.0.0.0' || /^127\\./.test(host);\n  } catch {\n    return false;\n  }\n}\n\nfunction providerCanRunWithoutSavedKey(cfg: ProviderConfig): boolean {\n  return isLoopbackBaseUrl(cfg.baseUrl) && (!cfg.envVars || cfg.envVars.length === 0);\n}\n\nfunction hasUsableSavedProvider(cfg: ProviderConfig): boolean {\n  return resolveActiveApiKey(cfg) !== undefined || providerCanRunWithoutSavedKey(cfg);\n}\n\n/**\n * Clear top-level provider/model defaults when provider mutations make them\n * stale. This prevents a removed provider, deleted final key, or edited model\n * allowlist from being accepted on the next boot and crashing provider setup.\n */\nexport function clearStaleProviderDefaults(config: Record<string, unknown>): void {\n  const providerId = typeof config['provider'] === 'string' ? config['provider'] : undefined;\n  if (!providerId) return;\n  const providers = config['providers'] as Record<string, ProviderConfig> | undefined;\n  const provider = providers?.[providerId];\n  if (!provider || !hasUsableSavedProvider(provider)) {\n    delete config['provider'];\n    delete config['model'];\n    return;\n  }\n  const modelId = typeof config['model'] === 'string' ? config['model'] : undefined;\n  if (modelId && Array.isArray(provider.models) && provider.models.length > 0 && !provider.models.includes(modelId)) {\n    delete config['model'];\n  }\n}\n\n/**\n * Return the label of the active key, or the first key's label if no\n * active is pinned. Returns `undefined` when there are no keys at all.\n */\nexport function activeLabel(cfg: ProviderConfig, keys: ProviderApiKey[]): string | undefined {\n  if (cfg.activeKey && keys.some((k) => k.label === cfg.activeKey)) return cfg.activeKey;\n  return keys[0]?.label;\n}\n\n/** Mask an API key for display: show first 4 + last 4 chars. */\nexport function maskedKey(key: string): string {\n  if (!key) return color.dim('\u2014');\n  if (key.length <= 8) return color.dim('\u2022'.repeat(key.length));\n  const head = key.slice(0, 4);\n  const tail = key.slice(-4);\n  return `${color.dim(head + '\u2026')}${tail}`;\n}\n\n/** ISO-8601 timestamp for key `createdAt` fields. */\nexport function nowIso(): string {\n  return new Date().toISOString();\n}\n\n/* ------------------------------------------------------------------ */\n/*  Config file I/O \u2014 load / mutate `providers` atomically            */\n/* ------------------------------------------------------------------ */\n\n/**\n * Read the on-disk config file and return its `providers` map, fully\n * decrypted. Returns `{}` on ENOENT or corrupt JSON (surfacing the error\n * via the optional `warn` callback when provided).\n */\nexport async function loadConfigProviders(\n  configPath: string,\n  vault: SecretVault,\n  opts?: { warn?: (msg: string) => void; profileConfigPath?: string },\n): Promise<Record<string, ProviderConfig>> {\n  const warn = opts?.warn;\n  const targetPath = opts?.profileConfigPath ?? configPath;\n  let raw: string;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      warn?.(`Could not read ${targetPath}: ${(err as Error).message}. Treating as empty.`);\n    }\n    return {};\n  }\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    warn?.(`Config at ${targetPath} is not valid JSON: ${(err as Error).message}`);\n    return {};\n  }\n  const decrypted = decryptConfigSecrets(parsed, vault);\n  return (decrypted as { providers?: Record<string, ProviderConfig> }).providers ?? {};\n}\n\n/**\n * Load \u2192 mutate \u2192 encrypt \u2192 atomic-write. Operates on the FULL config file\n * so non-provider keys are preserved. Refuses to overwrite a corrupt-but-\n * existing config (the user may still have salvageable data).\n */\nexport async function mutateConfigProviders(\n  configPath: string,\n  vault: SecretVault,\n  mutator: (providers: Record<string, ProviderConfig>) => void,\n  profileConfigPath?: string,\n): Promise<void> {\n  const targetPath = profileConfigPath ?? configPath;\n  let raw: string;\n  let fileExists = true;\n  try {\n    raw = await fs.readFile(targetPath, 'utf8');\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== 'ENOENT') {\n      throw new FsError({\n        message: `Refusing to mutate ${configPath}: ${(err as Error).message}`,\n        code: 'FS_READ_FAILED',\n        path: targetPath,\n        context: { operation: 'mutateConfigProviders', phase: 'read' },\n        cause: err,\n      });\n    }\n    fileExists = false;\n    raw = '{}';\n  }\n  let parsed: Record<string, unknown>;\n  try {\n    parsed = JSON.parse(raw) as Record<string, unknown>;\n  } catch (err) {\n    if (fileExists) {\n      throw new FsError({\n        message:\n          `Refusing to overwrite corrupt config at ${targetPath} ` +\n          `(${(err as Error).message}). Fix or move the file aside before retrying.`,\n        code: 'FS_READ_FAILED',\n        path: targetPath,\n        context: { operation: 'mutateConfigProviders', phase: 'parse' },\n        cause: err,\n      });\n    }\n    parsed = {};\n  }\n  const decrypted = decryptConfigSecrets(parsed, vault) as Record<string, unknown>;\n  const providers = (decrypted.providers as Record<string, ProviderConfig>) ?? {};\n  mutator(providers);\n  decrypted.providers = providers;\n  clearStaleProviderDefaults(decrypted);\n  const encrypted = encryptConfigSecrets(decrypted, vault);\n  await atomicWrite(targetPath, JSON.stringify(encrypted, null, 2), { mode: 0o600 });\n}\n"],
+  "mappings": ";;;AAAA,SAAS,qBAAqB;AAC9B,SAAS,eAAe;AAUxB,YAAY,QAAQ;AAEpB,SAAS,aAAa,aAAa;AACnC,SAAS,sBAAsB,4BAA4B;AAMpD,SAAS,cAAc,KAAuC;AACnE,MAAI,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,GAAG;AACxD,WAAO,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;AAAA,EAC1C;AACA,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,SAAS,GAAG;AAC3D,WAAO,CAAC,EAAE,OAAO,WAAW,QAAQ,IAAI,QAAQ,WAAW,GAAG,CAAC;AAAA,EACjE;AACA,SAAO,CAAC;AACV;AAQO,SAAS,cAAc,KAAqB,MAA8B;AAC/E,MAAI,KAAK,WAAW,GAAG;AACrB,WAAO,IAAI;AACX,WAAO,IAAI;AACX,WAAO,IAAI;AACX;AAAA,EACF;AACA,MAAI,UAAU;AACd,QAAM,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,KAAK,cAAc,KAAK,CAAC,CAAC;AAInF,SAAO,IAAI;AACX,MAAI,CAAC,IAAI,aAAa,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,GAAG;AAClE,QAAI,YAAY,OAAO;AAAA,EACzB;AACF;AAaO,SAAS,oBAAoB,KAAyC;AAC3E,MAAI,MAAM,QAAQ,IAAI,OAAO,KAAK,IAAI,QAAQ,SAAS,GAAG;AACxD,UAAM,SAAS,IAAI,YACf,IAAI,QAAQ,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,IACjD;AACJ,YAAQ,UAAU,IAAI,QAAQ,CAAC,IAAI;AAAA,EACrC;AACA,SAAO,IAAI,UAAU,IAAI,OAAO,SAAS,IAAI,IAAI,SAAS;AAC5D;AAEA,SAAS,kBAAkB,SAAsC;AAC/D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACF,QAAI,OAAO,IAAI,IAAI,OAAO,EAAE,SAAS,YAAY;AACjD,WAAO,KAAK,QAAQ,YAAY,EAAE;AAClC,WAAO,SAAS,eAAe,SAAS,SAAS,SAAS,aAAa,SAAS,KAAK,IAAI;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,8BAA8B,KAA8B;AACnE,SAAO,kBAAkB,IAAI,OAAO,MAAM,CAAC,IAAI,WAAW,IAAI,QAAQ,WAAW;AACnF;AAEA,SAAS,uBAAuB,KAA8B;AAC5D,SAAO,oBAAoB,GAAG,MAAM,UAAa,8BAA8B,GAAG;AACpF;AAOO,SAAS,2BAA2B,QAAuC;AAChF,QAAM,aAAa,OAAO,OAAO,UAAU,MAAM,WAAW,OAAO,UAAU,IAAI;AACjF,MAAI,CAAC,WAAY;AACjB,QAAM,YAAY,OAAO,WAAW;AACpC,QAAM,WAAW,YAAY,UAAU;AACvC,MAAI,CAAC,YAAY,CAAC,uBAAuB,QAAQ,GAAG;AAClD,WAAO,OAAO,UAAU;AACxB,WAAO,OAAO,OAAO;AACrB;AAAA,EACF;AACA,QAAM,UAAU,OAAO,OAAO,OAAO,MAAM,WAAW,OAAO,OAAO,IAAI;AACxE,MAAI,WAAW,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,OAAO,SAAS,KAAK,CAAC,SAAS,OAAO,SAAS,OAAO,GAAG;AACjH,WAAO,OAAO,OAAO;AAAA,EACvB;AACF;AAMO,SAAS,YAAY,KAAqB,MAA4C;AAC3F,MAAI,IAAI,aAAa,KAAK,KAAK,CAAC,MAAM,EAAE,UAAU,IAAI,SAAS,EAAG,QAAO,IAAI;AAC7E,SAAO,KAAK,CAAC,GAAG;AAClB;AAGO,SAAS,UAAU,KAAqB;AAC7C,MAAI,CAAC,IAAK,QAAO,MAAM,IAAI,QAAG;AAC9B,MAAI,IAAI,UAAU,EAAG,QAAO,MAAM,IAAI,SAAI,OAAO,IAAI,MAAM,CAAC;AAC5D,QAAM,OAAO,IAAI,MAAM,GAAG,CAAC;AAC3B,QAAM,OAAO,IAAI,MAAM,EAAE;AACzB,SAAO,GAAG,MAAM,IAAI,OAAO,QAAG,CAAC,GAAG,IAAI;AACxC;AAGO,SAAS,SAAiB;AAC/B,UAAO,oBAAI,KAAK,GAAE,YAAY;AAChC;AAWA,eAAsB,oBACpB,YACA,OACA,MACyC;AACzC,QAAM,OAAO,MAAM;AACnB,QAAM,aAAa,MAAM,qBAAqB;AAC9C,MAAI;AACJ,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,aAAO,kBAAkB,UAAU,KAAM,IAAc,OAAO,sBAAsB;AAAA,IACtF;AACA,WAAO,CAAC;AAAA,EACV;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,WAAO,aAAa,UAAU,uBAAwB,IAAc,OAAO,EAAE;AAC7E,WAAO,CAAC;AAAA,EACV;AACA,QAAM,YAAY,qBAAqB,QAAQ,KAAK;AACpD,SAAQ,UAA6D,aAAa,CAAC;AACrF;AAOA,eAAsB,sBACpB,YACA,OACA,SACA,mBACe;AACf,QAAM,aAAa,qBAAqB;AACxC,MAAI;AACJ,MAAI,aAAa;AACjB,MAAI;AACF,UAAM,MAAS,YAAS,YAAY,MAAM;AAAA,EAC5C,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,YAAM,IAAI,QAAQ;AAAA,QAChB,SAAS,sBAAsB,UAAU,KAAM,IAAc,OAAO;AAAA,QACpE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,EAAE,WAAW,yBAAyB,OAAO,OAAO;AAAA,QAC7D,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,iBAAa;AACb,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,QAAI,YAAY;AACd,YAAM,IAAI,QAAQ;AAAA,QAChB,SACE,2CAA2C,UAAU,KAChD,IAAc,OAAO;AAAA,QAC5B,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS,EAAE,WAAW,yBAAyB,OAAO,QAAQ;AAAA,QAC9D,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,aAAS,CAAC;AAAA,EACZ;AACA,QAAM,YAAY,qBAAqB,QAAQ,KAAK;AACpD,QAAM,YAAa,UAAU,aAAgD,CAAC;AAC9E,UAAQ,SAAS;AACjB,YAAU,YAAY;AACtB,6BAA2B,SAAS;AACpC,QAAM,YAAY,qBAAqB,WAAW,KAAK;AACvD,QAAM,YAAY,YAAY,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACnF;",
+  "names": []
+}

package/dist/chunk-Q5GTM25S.js

@@ -0,0 +1,17 @@
+
+// src/hq-server/audit-actor.ts
+import * as os from "node:os";
+function resolveAuditActor() {
+  const user = (process.env.USERNAME ?? process.env.USER ?? "").toString();
+  try {
+    const host = os.hostname();
+    return user ? `${user}@${host}` : `cli@${host}`;
+  } catch {
+    return user ? `${user}@unknown` : "cli";
+  }
+}
+
+export {
+  resolveAuditActor
+};
+//# sourceMappingURL=chunk-Q5GTM25S.js.map

package/dist/chunk-Q5GTM25S.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/hq-server/audit-actor.ts"],
+  "sourcesContent": ["import * as os from 'node:os';\n\n/** Build the non-secret actor label used by HQ authentication audit entries. */\nexport function resolveAuditActor(): string {\n  const user = (process.env.USERNAME ?? process.env.USER ?? '').toString();\n  try {\n    const host = os.hostname();\n    return user ? `${user}@${host}` : `cli@${host}`;\n  } catch {\n    return user ? `${user}@unknown` : 'cli';\n  }\n}\n"],
+  "mappings": ";;;AAAA,YAAY,QAAQ;AAGb,SAAS,oBAA4B;AAC1C,QAAM,QAAQ,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,IAAI,SAAS;AACvE,MAAI;AACF,UAAM,OAAU,YAAS;AACzB,WAAO,OAAO,GAAG,IAAI,IAAI,IAAI,KAAK,OAAO,IAAI;AAAA,EAC/C,QAAQ;AACN,WAAO,OAAO,GAAG,IAAI,aAAa;AAAA,EACpC;AACF;",
+  "names": []
+}

package/dist/chunk-QD544J2B.js

@@ -0,0 +1,19 @@
+
+// src/theme.ts
+import { color } from "@wrongstack/core/utils";
+var theme = {
+  primary: color.amber,
+  accent: color.pink,
+  muted: color.dim,
+  success: color.green,
+  warn: color.yellow,
+  error: color.red,
+  info: color.cyan,
+  bold: color.bold,
+  underline: color.underline
+};
+
+export {
+  theme
+};
+//# sourceMappingURL=chunk-QD544J2B.js.map

package/dist/chunk-QD544J2B.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/theme.ts"],
+  "sourcesContent": ["import { color } from '@wrongstack/core/utils';\n\nexport const theme = {\n  primary: color.amber,\n  accent: color.pink,\n  muted: color.dim,\n  success: color.green,\n  warn: color.yellow,\n  error: color.red,\n  info: color.cyan,\n  bold: color.bold,\n  underline: color.underline,\n};\n"],
+  "mappings": ";;;AAAA,SAAS,aAAa;AAEf,IAAM,QAAQ;AAAA,EACnB,SAAS,MAAM;AAAA,EACf,QAAQ,MAAM;AAAA,EACd,OAAO,MAAM;AAAA,EACb,SAAS,MAAM;AAAA,EACf,MAAM,MAAM;AAAA,EACZ,OAAO,MAAM;AAAA,EACb,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AAAA,EACZ,WAAW,MAAM;AACnB;",
+  "names": []
+}