@wrongstack/core 0.280.0 → 0.281.0

package/dist/path-resolver-XfZ9eLxG.d.ts

@@ -1,67 +0,0 @@
-import { E as EventBus } from './events-Bs2fmldo.js';
-import { M as ModelsRegistry, b as ResolvedModel } from './config-Cr3312zc.js';
-import { f as TokenCounter, U as Usage, g as CacheStats } from './tool-BkOgs_KL.js';
-import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
-
-/**
- * Token counter that derives pricing from the ModelsRegistry instead of a
- * hardcoded table. If a model is unknown to the registry (or the registry is
- * unavailable) the counter still tracks token totals but reports zero cost.
- */
-declare class DefaultTokenCounter implements TokenCounter {
-    private input;
-    private output;
-    private cacheRead;
-    private cacheWrite;
-    private costInput;
-    private costOutput;
-    private readonly registry?;
-    private readonly providerId?;
-    private readonly events?;
-    private sessionId?;
-    private priceCache;
-    /** Most recently accounted request's tokens. Used for per-request context pressure. */
-    private lastInput;
-    private lastCacheRead;
-    constructor(opts?: {
-        registry?: ModelsRegistry | undefined;
-        providerId?: string | undefined;
-        events?: EventBus | undefined;
-        sessionId?: string | (() => string | undefined) | undefined;
-    });
-    setSessionId(sessionId: string | (() => string | undefined) | undefined): void;
-    account(usage: Usage, model?: string): void;
-    /** Synchronous variant for code paths that have already resolved the model. */
-    accountWithModel(usage: Usage, resolved: ResolvedModel): void;
-    total(): Usage;
-    currentRequestTokens(): {
-        input: number;
-        cacheRead: number;
-    };
-    setCurrentRequestTokens(input: number, cacheRead?: number): void;
-    estimateCost(): {
-        input: number;
-        output: number;
-        total: number;
-        currency: 'USD';
-    };
-    cacheStats(): CacheStats;
-    /** Invalidate cached prices so the next account() call fetches fresh data. */
-    invalidateCache(): void;
-    private emitAccounted;
-    private currentSessionId;
-    reset(): void;
-    private applyPrice;
-}
-
-declare class DefaultPathResolver implements PathResolver {
-    readonly projectRoot: string;
-    readonly cwd: string;
-    constructor(cwd?: string);
-    detectProjectRoot(start: string): string;
-    resolve(input: string): string;
-    isInsideRoot(absPath: string): boolean;
-    ensureInsideRoot(absPath: string): string;
-}
-
-export { DefaultPathResolver as D, DefaultTokenCounter as a };

package/dist/secret-vault-CImt2XrR.d.ts

@@ -1,118 +0,0 @@
-import { S as SecretScrubber } from './secret-scrubber-3MHDDAtm.js';
-import { L as Logger } from './logger-B63L5bTg.js';
-import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
-
-declare class DefaultSecretScrubber implements SecretScrubber {
-    scrub(text: string): string;
-    private scrubOne;
-    /**
-     * Recursively scrub every string value in an object/array graph. Secrets can
-     * appear under any key — a URL query param, an `authorization` header, an
-     * arbitrarily-named nested field — so we don't gate recursion on key names.
-     * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
-     * value without a credential anchor returns immediately without regex work.
-     */
-    scrubObject<T>(obj: T): T;
-}
-
-interface SecretVaultOptions {
-    /** Absolute path to the key file. Created with mode 0o600 if missing. */
-    keyFile: string;
-}
-/**
- * Default vault: AES-256-GCM with a key stored at `keyFile` (mode 0o600).
- * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
- * a fresh one is generated. Decryption of plaintext values is a no-op so
- * legacy configs continue to work.
- *
- * Key file format:
- *   - Legacy (v1): exactly 32 raw bytes
- *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
- *
- * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
- * key version. After rotation, encrypt() emits the new version prefix.
- */
-declare class DefaultSecretVault implements RotatableSecretVault {
-    private readonly keyFile;
-    private key?;
-    private _keyVersion;
-    constructor(opts: SecretVaultOptions);
-    /** Current key version. Starts at 1; incremented by rotateKey(). */
-    get keyVersion(): number;
-    isEncrypted(value: string): boolean;
-    encrypt(plaintext: string): string;
-    decrypt(value: string): string;
-    /**
-     * Generate a new encryption key, write it to disk, and increment the key version.
-     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
-     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
-     */
-    rotateKey(): {
-        oldVersion: number;
-        newVersion: number;
-    };
-    /**
-     * If WRONGSTACK_VAULT_PASSPHRASE is set but the key on disk is still stored
-     * unwrapped (legacy v1 / versioned v2), re-write it in passphrase-wrapped (v3)
-     * form. The data key is preserved, so all existing ciphertext keeps
-     * decrypting. Best-effort: a write failure leaves the working unwrapped file
-     * in place and is not fatal to load.
-     */
-    private migrateToWrappedIfPassphrase;
-    private loadOrCreateKey;
-}
-/**
- * Walk a Config-shaped object and decrypt any apiKey-like fields in place,
- * returning a new object. Used by the config loader so the rest of the
- * system never has to know about the wire format.
- *
- * @param warn — callback for decryption warnings. Defaults to `console.warn`
- *   for backward compatibility; pass `logger.warn` when a structured logger
- *   is available (preferred in long-running/server contexts).
- */
-declare function decryptConfigSecrets<T>(cfg: T, vault: SecretVault, opts?: {
-    warn?: (msg: string) => void;
-}): T;
-declare function encryptConfigSecrets<T>(cfg: T, vault: SecretVault, _opts?: {
-    warn?: (msg: string) => void;
-}): T;
-declare function isSecretField(name: string): boolean;
-/**
- * Re-write `~/.wrongstack/config.json` (or any path) with all secret-bearing
- * fields encrypted. Used by the `wstack auth` subcommand.
- */
-declare function rewriteConfigEncrypted(configPath: string, vault: SecretVault, patch?: Record<string, unknown>): Promise<void>;
-/**
- * Scan a config file on disk for plaintext secret-bearing fields and
- * rewrite the file with them encrypted in place. Returns a count of how
- * many fields were migrated. Idempotent — calling on a fully-encrypted
- * file is a no-op and writes nothing. Used by the CLI on every boot so
- * users who had plaintext keys before the vault landed are upgraded
- * transparently.
- */
-declare function migratePlaintextSecrets(configPath: string, vault: SecretVault, logger?: Pick<Logger, 'warn'>): Promise<{
-    migrated: number;
-    file: string;
-}>;
-/**
- * Rotate the vault's encryption key and re-encrypt all secret-bearing
- * fields in a config file. This is the atomic key rotation operation:
- *
- * 1. Read the config file
- * 2. Decrypt all encrypted values with the old key
- * 3. Generate a new key (vault.rotateKey())
- * 4. Re-encrypt all values with the new key (new version prefix)
- * 5. Write the config file atomically
- *
- * Returns the number of fields re-encrypted and the version transition.
- * If the config file doesn't exist or has no encrypted fields, returns
- * { rotated: 0 } without modifying the key.
- */
-declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
-    rotated: number;
-    oldVersion: number;
-    newVersion: number;
-    file: string;
-}>;
-
-export { DefaultSecretVault as D, type SecretVaultOptions as S, DefaultSecretScrubber as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };