@wrongstack/core 0.148.0 → 0.155.0

package/dist/{secret-vault-DoISxaKO.d.ts → secret-vault-BJDY28ev.d.ts}

@@ -15,5 +15,11 @@ interface SecretVault {
     decrypt(value: string): string;
     isEncrypted(value: string): boolean;
 }
+/**
+ * No-op SecretVault that passes values through unchanged.
+ * Used in contexts where encryption is not needed — e.g. reading/writing
+ * config sections that contain no secret fields (models, settings, etc.).
+ */
+declare const noOpVault: SecretVault;
 
-export type { SecretVault as S };
+export { type SecretVault as S, noOpVault as n };

package/dist/{secret-vault-BTcC_T5v.d.ts → secret-vault-w8MbUe2Q.d.ts}

@@ -1,5 +1,5 @@
 import { S as SecretScrubber } from './permission-B7nKnEvQ.js';
-import { S as SecretVault } from './secret-vault-DoISxaKO.js';
+import { S as SecretVault } from './secret-vault-BJDY28ev.js';
 
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;

package/dist/security/index.d.ts

@@ -1,8 +1,8 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-BTcC_T5v.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-w8MbUe2Q.js';
 export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-8-6zBmfA.js';
 import '../permission-B7nKnEvQ.js';
 import '../context-C7G_MtLV.js';
-import '../secret-vault-DoISxaKO.js';
+import '../secret-vault-BJDY28ev.js';
 import '../input-reader-E-ffP2ee.js';
 
 /**

package/dist/security/index.js

@@ -174,6 +174,65 @@ async function renameWithRetry(from, to) {
   throw lastErr;
 }
 
+// src/utils/deep-merge.ts
+var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype",
+  "__defineGetter__",
+  "__defineSetter__",
+  "__lookupGetter__",
+  "__lookupSetter__"
+]);
+function isPrimitiveArray(a) {
+  return a.every((v) => v === null || typeof v !== "object" && typeof v !== "function");
+}
+function deepMerge(base, patch, options = {}) {
+  const {
+    conflictResolution = "prefer-patch",
+    arrayMode = "replace",
+    protectProto = true,
+    onNonPrimitiveArrayReplace
+  } = options;
+  if (typeof base !== "object" || base === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (typeof patch !== "object" || patch === null) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) && Array.isArray(patch)) {
+    if (arrayMode === "concat-primitives" && isPrimitiveArray(base) && isPrimitiveArray(patch)) {
+      return [.../* @__PURE__ */ new Set([...base, ...patch])];
+    }
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  if (Array.isArray(base) || Array.isArray(patch)) {
+    return conflictResolution === "prefer-patch" ? patch : base;
+  }
+  const baseObj = base;
+  const patchObj = patch;
+  const out = { ...baseObj };
+  for (const [k, v] of Object.entries(patchObj)) {
+    if (protectProto && FORBIDDEN_PROTO_KEYS.has(k)) continue;
+    const existing = out[k];
+    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
+      out[k] = deepMerge(existing, v, options);
+    } else if (Array.isArray(v) && Array.isArray(existing)) {
+      if (onNonPrimitiveArrayReplace && !isPrimitiveArray(v)) {
+        onNonPrimitiveArrayReplace(k, existing.length, v.length);
+      }
+      out[k] = deepMerge(existing, v, options);
+    } else if (v !== void 0) {
+      if (onNonPrimitiveArrayReplace && Array.isArray(v) && !isPrimitiveArray(v)) {
+        const existingLen = Array.isArray(existing) ? existing.length : 0;
+        onNonPrimitiveArrayReplace(k, existingLen, v.length);
+      }
+      out[k] = v;
+    }
+  }
+  return out;
+}
+
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -376,28 +435,6 @@ function walkCount(node, vault, counter) {
   }
   return out;
 }
-var FORBIDDEN_PROTO_KEYS = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype",
-  "__defineGetter__",
-  "__defineSetter__",
-  "__lookupGetter__",
-  "__lookupSetter__"
-]);
-function deepMerge(a, b) {
-  const out = { ...a };
-  for (const [k, v] of Object.entries(b)) {
-    if (FORBIDDEN_PROTO_KEYS.has(k)) continue;
-    const existing = out[k];
-    if (v !== null && typeof v === "object" && !Array.isArray(v) && existing !== null && typeof existing === "object" && !Array.isArray(existing)) {
-      out[k] = deepMerge(existing, v);
-    } else {
-      out[k] = v;
-    }
-  }
-  return out;
-}
 
 // src/security/capabilities.ts
 var ToolCapabilities = {