@wrongstack/cli 1.0.19 → 1.0.26

package/dist/slash-commands/goal-refiner.d.ts

@@ -1,14 +1,11 @@
 import type { OneShotOrchestrator } from '@wrongstack/core/execution';
-import type { Config, Provider } from '@wrongstack/core/types';
+import { type RefinedMission } from '@wrongstack/core/goal';
+import type { Provider } from '@wrongstack/core/types';
+export { refineGoalHeuristic, resolveRefinerTarget } from '@wrongstack/core/goal';
 /**
  * Result of refining a user's raw goal into a clear, actionable mission.
  */
-interface RefinedGoal {
-    /** Unambiguous, detailed goal statement. */
-    refinedGoal: string;
-    /** Concrete, verifiable deliverables (one per entry). */
-    deliverables: string[];
-}
+type RefinedGoal = RefinedMission;
 /**
  * Options for goal refinement with fallback tiers.
  */
@@ -31,42 +28,6 @@ interface GoalRefinerOptions {
      */
     oneShotOrchestrator?: OneShotOrchestrator | undefined;
 }
-/**
- * Resolved refiner target after validating against available providers,
- * favorite models, and the currently active session model.
- * Both `provider` and `model` are defined when a viable dedicated refiner
- * is found; otherwise the caller should use the primary session defaults.
- */
-interface ResolvedRefinerTarget {
-    /** Resolved provider instance, ready for `provider.complete()`. */
-    provider: Provider;
-    /** Resolved model id on that provider. */
-    model: string;
-}
-/**
- * Validate and resolve a dedicated refiner provider+model from the user
- * config. Returns undefined when:
- *   - refinerFallbackProfile resolves to a valid profile entry (tried first)
- *   - Neither refinerProvider nor refinerModel is configured
- *   - The configured provider is unavailable (createProvider returns
- *     undefined, meaning the provider doesn't exist or has no credentials)
- *   - The configured model is not a favorite model AND is not the
- *     currently active session model
- *
- * Precedence (first wins):
- *   1. refinerFallbackProfile → first valid entry from the named profile chain
- *   2. refinerProvider + refinerModel  (both set)
- *   3. refinerModel on the active session provider
- *
- * When only `refinerModel` is set (no provider), the model is used on
- * the active session provider — validated against the same constraints.
- *
- * @param cfg          — live Config from configStore
- * @param createProvider— factory: providerId → Provider | undefined
- * @param activeProviderId — the session's active provider id (config.provider)
- * @param activeModel  — the session's active model (config.model)
- */
-export declare function resolveRefinerTarget(cfg: Config, createProvider: ((providerId: string) => Provider | undefined) | undefined, activeProviderId: string, activeModel: string): ResolvedRefinerTarget | undefined;
 /**
  * Refine a raw goal using the best available model/provider, with a
  * four-tier fallback chain:
@@ -85,10 +46,4 @@ export declare function refineGoalWithFallback(rawGoal: string, opts: GoalRefine
  * or the call fails.
  */
 export declare function refineGoal(rawGoal: string, provider: Provider, model: string, oneShotOrchestrator?: OneShotOrchestrator | undefined): Promise<RefinedGoal | null>;
-/**
- * Heuristic-only refinement — used when no LLM is available.
- * Produces a basic structure from the raw goal.
- */
-export declare function refineGoalHeuristic(rawGoal: string): RefinedGoal;
-export {};
 //# sourceMappingURL=goal-refiner.d.ts.map

package/dist/slash-commands/jev.d.ts

@@ -0,0 +1,4 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildJevCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=jev.d.ts.map

package/dist/slash-commands/mcp.d.ts

@@ -18,7 +18,8 @@ export { parseMcpArgs, runMcpManagementCommand } from '../services/mcp-managemen
  *   /mcp prompts <name> — discover cached/live prompts
  *   /mcp read <name> <uri> — explicitly insert a selected resource
  *   /mcp get <name> <prompt> [key=value...] — explicitly insert a selected prompt
- *   /mcp auth start <name> <client-id> <redirect-uri> [scopes...] — begin OAuth
+ *   /mcp auth login <name> [--client-id <id>] [--port <n>] [scopes...] — one-step OAuth
+ *   /mcp auth start <name> --redirect-uri <url> [--client-id <id>] [scopes...] — manual OAuth
  *   /mcp auth complete <name> <callback-url> — finish OAuth from a callback URL
  *   /mcp auth status <name> — show non-secret authorization state
  *   /mcp auth logout <name> — remove stored OAuth credentials

package/dist/slash-commands/openai-quota.d.ts

@@ -28,4 +28,19 @@ import type { SlashCommand } from '@wrongstack/core/types';
  */
 export declare function renderQuotaSnapshot(snapshot: ProviderQuotaSnapshot): string[];
 export declare function buildOpenAIQuotaCommand(): SlashCommand;
+/**
+ * `/provider-quota` — every metered subscription this session has heard from.
+ *
+ * The narrow `/openai-quota` above stays because it answers one question
+ * without making the user read past other providers; this one exists because
+ * the reporters are no longer Codex-only. Claude Pro/Max and GitHub Copilot
+ * report into the same store, and a session that is signed into two metered
+ * plans has no other way to see which one is about to run out.
+ *
+ * The name says `provider` on purpose. A bare `/quota` would read as "what
+ * this project costs" — an account-wide spend view that does not exist here —
+ * and would occupy the name if one is ever built. What this shows is exactly
+ * the provider plane's readings, so that is what it is called.
+ */
+export declare function buildProviderQuotaCommand(): SlashCommand;
 //# sourceMappingURL=openai-quota.d.ts.map

package/dist/slash-commands/permissions.d.ts

@@ -0,0 +1,4 @@
+import type { SlashCommand } from '@wrongstack/core/types';
+import type { SlashCommandContext } from './command-context.js';
+export declare function buildPermissionsCommand(opts: SlashCommandContext): SlashCommand;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/slash-commands/sdd-task-mutations.d.ts

@@ -0,0 +1,4 @@
+export declare function executeSddTaskMutation(cmd: string, restJoined: string): {
+    message: string;
+};
+//# sourceMappingURL=sdd-task-mutations.d.ts.map

package/dist/slash-commands/settings-context-mutations.d.ts

@@ -0,0 +1,5 @@
+import { persistConfigSetting } from '../settings-menu.js';
+export declare function executeContextSettings(sub: string, rest: string[], persistDeps: Parameters<typeof persistConfigSetting>[0]): Promise<{
+    message: string;
+} | undefined>;
+//# sourceMappingURL=settings-context-mutations.d.ts.map

package/dist/slash-commands/settings-keys.d.ts

@@ -0,0 +1,2 @@
+export declare const ALL_SETTINGS_KEYS: string[];
+//# sourceMappingURL=settings-keys.d.ts.map

package/dist/slash-commands/settings-limits-mutations.d.ts

@@ -0,0 +1,12 @@
+import { type LimitsConfig } from '@wrongstack/core/types';
+import { persistConfigSetting } from '../settings-menu.js';
+/** Render `/settings limits` — every limit, whether the user set it, and its range. */
+export declare function renderLimitsView(limits: LimitsConfig | undefined): string;
+/**
+ * `/settings limits [<name> <n|off>]`. Limits are user config only (denied to
+ * in-project config), so writes always go to the active profile.
+ */
+export declare function executeLimitsSettings(sub: string, rest: string[], persistDeps: Parameters<typeof persistConfigSetting>[0], current: LimitsConfig | undefined): Promise<{
+    message: string;
+} | undefined>;
+//# sourceMappingURL=settings-limits-mutations.d.ts.map

package/dist/slash-commands/settings-reset.d.ts

@@ -0,0 +1,6 @@
+import { persistConfigSetting } from '../settings-menu.js';
+import type { SlashCommandContext } from './command-context.js';
+export declare function executeSettingsReset(rest: string[], persistDeps: Parameters<typeof persistConfigSetting>[0], opts: SlashCommandContext, profileName: string): Promise<{
+    message: string;
+}>;
+//# sourceMappingURL=settings-reset.d.ts.map

package/dist/standalone-auto-update-TOTRGCSA.js

@@ -0,0 +1,249 @@
+import {
+  MAX_BINARY_BYTES,
+  downloadReleaseAssetToFile,
+  findStandaloneRelease,
+  installExecutableFrom,
+  verifyStandaloneDigest
+} from "./chunk-X756ZS72.js";
+import {
+  isNewer
+} from "./chunk-RZ4ZDRYA.js";
+import {
+  CLI_VERSION,
+  STANDALONE_TARGET
+} from "./chunk-F5DCFAKI.js";
+
+// src/standalone-auto-update.ts
+import { randomBytes } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { isStandaloneBinary, wstackGlobalRoot } from "@wrongstack/core/utils";
+var PENDING_FILE = "pending.json";
+var APPLIED_FILE = "last-applied.json";
+var LOCK_FILE = "update.lock";
+var LOCK_STALE_MS = 45 * 6e4;
+var DOWNLOAD_TIMEOUT_MS = 30 * 6e4;
+function updatesDir(root = wstackGlobalRoot()) {
+  return path.join(root, "updates");
+}
+function autoUpdateEnabled(config, env = process.env) {
+  const off = env["WRONGSTACK_NO_AUTO_UPDATE"];
+  if (off !== void 0 && off !== "" && off !== "0") return false;
+  return config?.update?.autoDownload !== false;
+}
+function readPendingUpdate(dir = updatesDir()) {
+  let raw;
+  try {
+    raw = JSON.parse(fs.readFileSync(path.join(dir, PENDING_FILE), "utf8"));
+  } catch {
+    return void 0;
+  }
+  const p = raw;
+  if (!p || typeof p.version !== "string" || typeof p.file !== "string" || typeof p.sha256 !== "string" || !/^[0-9a-f]{64}$/.test(p.sha256) || typeof p.target !== "string" || typeof p.executable !== "string" || // Only ever install from the staging directory itself.
+  path.dirname(path.resolve(p.file)) !== path.resolve(dir) || !fs.existsSync(p.file)) {
+    return void 0;
+  }
+  return {
+    version: p.version,
+    file: p.file,
+    sha256: p.sha256,
+    target: p.target,
+    executable: p.executable,
+    stagedAt: typeof p.stagedAt === "string" ? p.stagedAt : ""
+  };
+}
+function discardPending(dir, pending) {
+  fs.rmSync(path.join(dir, PENDING_FILE), { force: true });
+  if (pending) fs.rmSync(pending.file, { force: true });
+}
+function writeJsonAtomic(file, value) {
+  const tmp = `${file}.${randomBytes(6).toString("hex")}.tmp`;
+  fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384, flag: "wx" });
+  fs.renameSync(tmp, file);
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function acquireLock(dir) {
+  const lock = path.join(dir, LOCK_FILE);
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      fs.writeFileSync(lock, JSON.stringify({ pid: process.pid, at: Date.now() }), { flag: "wx" });
+      return () => fs.rmSync(lock, { force: true });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      let owner = {};
+      try {
+        owner = JSON.parse(fs.readFileSync(lock, "utf8"));
+      } catch {
+      }
+      const fresh = typeof owner.pid === "number" && pidAlive(owner.pid) && typeof owner.at === "number" && Date.now() - owner.at < LOCK_STALE_MS;
+      if (fresh) return void 0;
+      fs.rmSync(lock, { force: true });
+    }
+  }
+  return void 0;
+}
+function applyPending(install, platform) {
+  const { dir, current, executable } = install;
+  const pending = readPendingUpdate(dir);
+  if (!pending) return void 0;
+  if (!isNewer(pending.version, current)) {
+    discardPending(dir, pending);
+    return void 0;
+  }
+  if (pending.executable !== executable) return void 0;
+  const release = acquireLock(dir);
+  if (!release) return void 0;
+  try {
+    try {
+      installExecutableFrom(executable, pending.file, pending.sha256, platform);
+    } catch (err) {
+      if (/does not match its digest/.test(String(err))) discardPending(dir, pending);
+      throw err;
+    }
+    discardPending(dir, pending);
+    writeJsonAtomic(path.join(dir, APPLIED_FILE), {
+      from: current,
+      to: pending.version,
+      at: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return pending.version;
+  } finally {
+    release();
+  }
+}
+function takeAppliedUpdate(dir = updatesDir()) {
+  const file = path.join(dir, APPLIED_FILE);
+  try {
+    const raw = JSON.parse(fs.readFileSync(file, "utf8"));
+    fs.rmSync(file, { force: true });
+    if (typeof raw.from === "string" && typeof raw.to === "string") {
+      return { from: raw.from, to: raw.to };
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function stageLatest(install, signal) {
+  const { dir } = install;
+  const release = await findStandaloneRelease(install.target, signal);
+  if (!isNewer(release.version, install.current)) return void 0;
+  const already = readPendingUpdate(dir);
+  if (already?.version === release.version && already.target === install.target && already.executable === install.executable) {
+    return already;
+  }
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  const unlock = acquireLock(dir);
+  if (!unlock) return void 0;
+  const partial = path.join(dir, `.partial-${randomBytes(9).toString("hex")}`);
+  try {
+    const sha256 = await downloadReleaseAssetToFile(release.asset.browser_download_url, partial, {
+      timeoutMs: DOWNLOAD_TIMEOUT_MS,
+      maxBytes: MAX_BINARY_BYTES,
+      signal
+    });
+    await verifyStandaloneDigest(release, sha256, signal);
+    const file = path.join(dir, `${release.version}-${release.assetName}`);
+    fs.rmSync(file, { force: true });
+    fs.renameSync(partial, file);
+    const pending = {
+      version: release.version,
+      file,
+      sha256,
+      target: install.target,
+      executable: install.executable,
+      stagedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    writeJsonAtomic(path.join(dir, PENDING_FILE), pending);
+    for (const name of fs.readdirSync(dir)) {
+      const keep = [PENDING_FILE, APPLIED_FILE, LOCK_FILE, path.basename(file)];
+      if (!keep.includes(name)) fs.rmSync(path.join(dir, name), { force: true, recursive: true });
+    }
+    return pending;
+  } finally {
+    fs.rmSync(partial, { force: true });
+    unlock();
+  }
+}
+function standaloneUpdater(install) {
+  const bound = { ...install, dir: install.dir ?? updatesDir() };
+  const pending = () => {
+    const found = readPendingUpdate(bound.dir);
+    return found?.executable === bound.executable ? found : void 0;
+  };
+  return {
+    pending,
+    stage: (signal) => stageLatest(bound, signal),
+    apply: (platform) => applyPending(bound, platform),
+    clear: () => {
+      const found = pending();
+      if (found) discardPending(bound.dir, found);
+    }
+  };
+}
+function startStandaloneAutoUpdate(options) {
+  if (!isStandaloneBinary() || !STANDALONE_TARGET) return void 0;
+  if (!autoUpdateEnabled(options.getConfig())) return void 0;
+  let updater;
+  try {
+    updater = standaloneUpdater({
+      executable: fs.realpathSync(process.execPath),
+      target: STANDALONE_TARGET,
+      current: CLI_VERSION
+    });
+  } catch {
+    return void 0;
+  }
+  const listeners = /* @__PURE__ */ new Set();
+  let ready;
+  const markReady = (version) => {
+    ready = version;
+    for (const listener of listeners) listener(version);
+  };
+  process.once("exit", () => {
+    if (!autoUpdateEnabled(options.getConfig())) return;
+    try {
+      updater.apply();
+    } catch {
+    }
+  });
+  const found = updater.pending();
+  const pending = found && isNewer(found.version, CLI_VERSION) ? found : void 0;
+  const latest = options.updateInfo?.outdated ? options.updateInfo.latest : void 0;
+  const controller = new AbortController();
+  if (pending && (latest === void 0 || !isNewer(latest, pending.version))) {
+    ready = pending.version;
+  } else if (latest !== void 0) {
+    void updater.stage(controller.signal).then((staged) => {
+      if (staged) markReady(staged.version);
+    }).catch((err) => {
+      if (controller.signal.aborted) return;
+      options.onError?.(err instanceof Error ? err.message : String(err));
+    });
+  }
+  return {
+    subscribe(listener) {
+      listeners.add(listener);
+      if (ready) listener(ready);
+      return () => listeners.delete(listener);
+    },
+    dispose() {
+      controller.abort();
+      listeners.clear();
+    }
+  };
+}
+export {
+  autoUpdateEnabled,
+  standaloneUpdater,
+  startStandaloneAutoUpdate,
+  takeAppliedUpdate
+};
+//# sourceMappingURL=standalone-auto-update-TOTRGCSA.js.map

package/dist/standalone-auto-update.d.ts

@@ -0,0 +1,65 @@
+import type { Config } from '@wrongstack/core/types';
+import { type StagedStandaloneUpdate } from './standalone-update.js';
+import { type UpdateInfo } from './update-check.js';
+/** A verified build waiting to be swapped in. */
+export interface PendingUpdate extends StagedStandaloneUpdate {
+    /** `bun build --target` it was built for. */
+    target: string;
+    /** Real path of the executable it replaces. */
+    executable: string;
+    stagedAt: string;
+}
+/** `update.autoDownload` (default on) and the `WRONGSTACK_NO_AUTO_UPDATE` switch. */
+export declare function autoUpdateEnabled(config: Config | undefined, env?: NodeJS.ProcessEnv): boolean;
+/** The swap a previous session made, reported once. */
+export declare function takeAppliedUpdate(dir?: string): {
+    from: string;
+    to: string;
+} | undefined;
+/** The updates of one install of the executable. */
+export interface StandaloneUpdater {
+    /** Its verified build waiting to be swapped in, if any. */
+    pending(): PendingUpdate | undefined;
+    /**
+     * Download, verify and stage the latest release when it is newer. Returns
+     * the pending update (possibly one staged earlier), or undefined when there
+     * is nothing newer or another session is downloading.
+     */
+    stage(signal?: AbortSignal): Promise<PendingUpdate | undefined>;
+    /**
+     * Swap the pending build in over the executable. Synchronous (it runs from
+     * the process `exit` handler); returns the installed version, or undefined
+     * when there was nothing to install. A pending build that is not newer, or
+     * whose file no longer matches its digest, is thrown away.
+     */
+    apply(platform?: NodeJS.Platform): string | undefined;
+    /**
+     * Drop the pending build after `wstack update` brought the executable to
+     * the latest release: it is either the build just installed or an older one.
+     */
+    clear(): void;
+}
+export declare function standaloneUpdater(install: {
+    executable: string;
+    target: string;
+    current: string;
+    dir?: string | undefined;
+}): StandaloneUpdater;
+/** What an interactive session sees of the background update. */
+export interface StandaloneAutoUpdate {
+    /** Called once the update is ready (immediately, when it already is). */
+    subscribe(listener: (version: string) => void): () => void;
+    /** Stop a download in progress. The exit swap stays armed. */
+    dispose(): void;
+}
+/**
+ * Start the background update for an interactive session: arm the exit swap,
+ * and download the latest release when `updateInfo` says one is newer.
+ * Undefined for the npm install or when switched off.
+ */
+export declare function startStandaloneAutoUpdate(options: {
+    getConfig: () => Config | undefined;
+    updateInfo: UpdateInfo | undefined;
+    onError?: ((message: string) => void) | undefined;
+}): StandaloneAutoUpdate | undefined;
+//# sourceMappingURL=standalone-auto-update.d.ts.map

package/dist/standalone-update-LZO3MNLH.js

@@ -0,0 +1,24 @@
+import {
+  MAX_BINARY_BYTES,
+  fetchLatestStandaloneVersion,
+  findStandaloneRelease,
+  installExecutableFrom,
+  parseSha256Sums,
+  replaceExecutable,
+  standaloneAssetName,
+  updateStandaloneBinary,
+  verifyStandaloneDigest
+} from "./chunk-X756ZS72.js";
+import "./chunk-F5DCFAKI.js";
+export {
+  MAX_BINARY_BYTES,
+  fetchLatestStandaloneVersion,
+  findStandaloneRelease,
+  installExecutableFrom,
+  parseSha256Sums,
+  replaceExecutable,
+  standaloneAssetName,
+  updateStandaloneBinary,
+  verifyStandaloneDigest
+};
+//# sourceMappingURL=standalone-update-LZO3MNLH.js.map

package/dist/standalone-update.d.ts

@@ -0,0 +1,55 @@
+import type { TerminalRenderer } from './renderer.js';
+export declare const MAX_BINARY_BYTES: number;
+interface ReleaseAsset {
+    name: string;
+    browser_download_url: string;
+    /** `sha256:<hex>`, computed by GitHub when the asset was uploaded. */
+    digest?: string | null | undefined;
+}
+/** Asset name a build target publishes under (mirrors build-binaries.mjs `outputName`). */
+export declare function standaloneAssetName(target: string): string;
+/** The latest release's executable for `target`, with its SHA256SUMS. */
+export interface StandaloneRelease {
+    version: string;
+    assetName: string;
+    asset: ReleaseAsset;
+    sums: ReleaseAsset;
+}
+/** Throws when the latest release has no build for `target`. */
+export declare function findStandaloneRelease(target: string, signal?: AbortSignal): Promise<StandaloneRelease>;
+/**
+ * Throws unless `sha256` is the release's own build of the asset: listed in
+ * its SHA256SUMS, equal to the digest GitHub computed at upload, and vouched
+ * for by the release workflow's build attestation.
+ */
+export declare function verifyStandaloneDigest(release: StandaloneRelease, sha256: string, signal?: AbortSignal): Promise<void>;
+/** Latest released version, for the update check. */
+export declare function fetchLatestStandaloneVersion(timeoutMs?: number, signal?: AbortSignal): Promise<string>;
+/** `<sha256>  <name>` lines → map. */
+export declare function parseSha256Sums(text: string): Map<string, string>;
+/**
+ * Replace `target` with `bytes`. Staged next to the target so the final step
+ * is a same-filesystem rename.
+ */
+export declare function replaceExecutable(target: string, bytes: Buffer, platform?: NodeJS.Platform): void;
+/**
+ * Replace `target` with the file at `source` (a downloaded update), refusing
+ * unless the copy that is about to become the executable hashes to `sha256`.
+ * Synchronous: it runs from the process `exit` handler.
+ */
+export declare function installExecutableFrom(target: string, source: string, sha256: string, platform?: NodeJS.Platform): void;
+/** A verified download the background updater left waiting (standalone-auto-update.ts). */
+export interface StagedStandaloneUpdate {
+    version: string;
+    file: string;
+    sha256: string;
+}
+/** `wstack update` for the standalone binary. Returns the process exit code. */
+export declare function updateStandaloneBinary(options: {
+    current: string;
+    renderer: Pick<TerminalRenderer, 'write'>;
+    /** Installed instead of downloading again when it is the latest release. */
+    staged?: StagedStandaloneUpdate | undefined;
+}): Promise<number>;
+export {};
+//# sourceMappingURL=standalone-update.d.ts.map

package/dist/subcommands/handlers/hq-alerts.d.ts

@@ -0,0 +1,3 @@
+import type { SubcommandDeps } from '../contracts.js';
+export declare function hqAlertsCmd(args: string[], deps: SubcommandDeps): Promise<number>;
+//# sourceMappingURL=hq-alerts.d.ts.map

package/dist/subcommands/handlers/hq-audit.d.ts

@@ -0,0 +1,46 @@
+import type { SubcommandDeps } from '../contracts.js';
+/**
+ * `wstack hq audit verify` — re-derive the contentHash from the current
+ * on-disk `auth.json` and print it so an operator can compare against a
+ * `contentHash` field in an audit entry. This closes the forensic
+ * tie-back loop without requiring the operator to write a script: copy
+ * the hash from the audit log, run this command, eyeball (or `diff`)
+ * the two values.
+ *
+ * Prints:
+ *   - the resolved `auth.json` path (so the operator knows which file
+ *     was hashed)
+ *   - the SHA-256 contentHash, or `(unavailable)` if the file is
+ *     missing/unreadable
+ *   - the `auth-audit.jsonl` path (so the operator knows where to look
+ *     for entries to compare against)
+ *
+ * Exit codes:
+ *   0 — hash computed and printed
+ *   1 — `auth.json` missing or unreadable (hash unavailable); the
+ *       audit-log path is still printed so the operator can inspect
+ *       historical entries
+ */
+export declare function hqAuditCmd(args: string[], deps: SubcommandDeps): Promise<number>;
+/**
+ * Re-read the persisted `auth.json` and return a conditional
+ * `contentHash` field for embedding in an audit entry. This closes the
+ * forensic tie-back loop: an operator reviewing `auth-audit.jsonl` can
+ * compare the `contentHash` against the current on-disk file via
+ * `wstack hq audit verify`.
+ *
+ * Re-reads rather than hashing the in-memory post-mutation snapshot
+ * because `writeHqAuthFile` re-stamps `updatedAt` on the persisted
+ * payload — hashing the in-memory `next` would diverge from what
+ * `verify` computes. Matches the pattern established by the `first-run`
+ * and `expired-prune` emitters in `auth-store.ts` / `hq-server.ts`.
+ *
+ * Returns `{}` (no `contentHash` key) when the file is unreadable, so
+ * the audit entry still records the event without a tie-back — the
+ * absence itself is meaningful. Conditional spread preserves
+ * `exactOptionalPropertyTypes`.
+ */
+export declare function computeAuditHashField(dataDir: string, warn: (msg: string) => void): Promise<{
+    contentHash?: string;
+}>;
+//# sourceMappingURL=hq-audit.d.ts.map

package/dist/subcommands/handlers/hq-data-dir.d.ts

@@ -0,0 +1,13 @@
+import type { SubcommandDeps } from '../contracts.js';
+/**
+ * Build a free-form actor string for the auth audit log. Combines the OS
+ * username (best-effort) with the hostname so an operator reviewing the
+ * log can see "who minted this token" without parsing environment
+ * variables. Never includes the token string.
+ *
+ * Shared by the `wstack hq token` create/revoke handlers and by
+ * `startHqServer`'s first-run bootstrap so every audit entry point
+ * produces the same actor shape.
+ */
+export declare function resolveDataDir(deps: SubcommandDeps): string;
+//# sourceMappingURL=hq-data-dir.d.ts.map

package/dist/subcommands/handlers/import-claude-code.d.ts

@@ -0,0 +1,42 @@
+import type { MCPServerConfig } from '@wrongstack/core/types';
+import type { SubcommandHandler } from '../contracts.js';
+export type McpImportSource = 'claude-user' | 'claude-project-local' | 'repository';
+export interface McpImportCandidate {
+    name: string;
+    source: McpImportSource;
+    config: Partial<MCPServerConfig>;
+    action: 'add' | 'overwrite' | 'skip-exists' | 'skip-invalid';
+    enabled: boolean;
+    note?: string | undefined;
+}
+export interface ClaudeCodeImportPlan {
+    mcp: McpImportCandidate[];
+    notes: string[];
+}
+export interface ClaudeCodeSources {
+    /** Parsed `~/.claude.json`, or undefined when absent. */
+    userState?: Record<string, unknown> | undefined;
+    /** Parsed `<project>/.mcp.json`, or undefined when absent. */
+    projectMcp?: Record<string, unknown> | undefined;
+    /** Settings files that exist, with their parsed content. */
+    settings: Array<{
+        file: string;
+        content: Record<string, unknown>;
+    }>;
+    /** CLAUDE.md files that exist. */
+    instructionFiles: string[];
+    /** Skill directories that exist. */
+    skillDirs: string[];
+}
+/** Decide what an import would do. Pure: no reads, no writes. */
+export declare function planClaudeCodeImport(opts: {
+    sources: ClaudeCodeSources;
+    projectRoot: string;
+    existingServers: Readonly<Record<string, unknown>>;
+    overwrite: boolean;
+    enableProjectServers: boolean;
+}): ClaudeCodeImportPlan;
+/** Read everything the importer looks at. Missing files are simply absent. */
+export declare function readClaudeCodeSources(projectRoot: string, userHome?: string): Promise<ClaudeCodeSources>;
+export declare const importClaudeCodeCmd: SubcommandHandler;
+//# sourceMappingURL=import-claude-code.d.ts.map