@wrongstack/core 0.284.1 → 0.286.0

package/dist/infrastructure/logger.d.ts

@@ -0,0 +1,99 @@
+import type { LogLevel, Logger } from '../types/logger.js';
+export type LogFormat = 'pretty' | 'json';
+export interface DefaultLoggerOptions {
+    level?: LogLevel | undefined;
+    file?: string | undefined;
+    /**
+     * @deprecated Use `format: 'json'` instead. Kept for backward compat
+     * with existing callers but has no effect on output — the `format`
+     * option controls whether stderr receives pretty-printed or JSON lines.
+     */
+    pretty?: boolean | undefined;
+    /** Output format for stderr. `pretty` (colored, human-readable) or `json` (machine-parseable). Defaults to `WRONGSTACK_LOG_FORMAT` env var, falling back to `pretty`. */
+    format?: LogFormat | undefined;
+    bindings?: Record<string, unknown>;
+    /**
+     * When false, suppress stderr output entirely — only write to the log
+     * file (if configured). Use this in TUI mode so plugin/library log
+     * messages don't interleave with Ink's terminal rendering.
+     * Default: true (stderr output is enabled).
+     */
+    stderr?: boolean | undefined;
+    /**
+     * Rotate the log file once it exceeds this many bytes: the current file is
+     * renamed to `<file>.1` (replacing any previous one) and a fresh file
+     * starts. Bounds total disk to ~2× this value. Default 10 MB.
+     */
+    maxFileBytes?: number | undefined;
+}
+export declare class DefaultLogger implements Logger {
+    /** How many file writes between rotation size checks (statSync is not free). */
+    private static readonly ROTATE_CHECK_EVERY;
+    level: LogLevel;
+    private file?;
+    private bindings;
+    private format;
+    private stderr;
+    private maxFileBytes;
+    private writesSinceRotateCheck;
+    /**
+     * Serialized async tail for file writes. Every appendFile (and any
+     * chained rotation) is awaited through this promise so file I/O
+     * never overlaps itself — preserving the per-line ordering the
+     * sync version had, but without blocking the caller thread. Any
+     * rejection is swallowed (`catch(() => {})`) because logging must
+     * never crash the host.
+     *
+     * Children share the parent's tail: `child.tail === parent.tail`
+     * for the lifetime of the chain. Read/write access goes through
+     * `_tail` so that, when a child has been wired to a parent, both
+     * `enqueueRotate` and `log` always observe the parent's current tail
+     * rather than a stale snapshot taken at `child()` time.
+     */
+    private tail;
+    private parent;
+    /**
+     * Resolve the current tail. For the root logger this is the field;
+     * for a child logger we always read through the parent so that a
+     * child's appends land on the parent's most recent tail, and a
+     * parent's `flush()` waits for everything the child chained.
+     */
+    private get _tail();
+    private set _tail(value);
+    constructor(opts?: DefaultLoggerOptions);
+    error(msg: string, ctx?: unknown): void;
+    warn(msg: string, ctx?: unknown): void;
+    info(msg: string, ctx?: unknown): void;
+    debug(msg: string, ctx?: unknown): void;
+    trace(msg: string, ctx?: unknown): void;
+    child(bindings: Record<string, unknown>): Logger;
+    /**
+     * Wait until all queued file writes (and any pending rotation) have
+     * completed. `log()` is fire-and-forget by design — the caller never
+     * blocks on disk — so tests, shutdown handlers, and processes that
+     * need a deterministic "everything is on disk now" guarantee should
+     * `await logger.flush()` before reading the file or exiting.
+     */
+    flush(): Promise<void>;
+    /**
+     * Size-based rotation: when the file outgrows `maxFileBytes`, rename it to
+     * `<file>.1` (dropping the previous `.1`) so the live file restarts empty.
+     * Checked on the first write and every ROTATE_CHECK_EVERY writes after.
+     * Best-effort: a rename can fail on Windows while another process holds
+     * the file — the next check retries. Multiple processes appending to the
+     * same log all run this check; whoever crosses the threshold first wins.
+     *
+     * Async: the rotation runs on the file-write tail (so its writes don't
+     * interleave with the next append), and the caller never blocks on a
+     * statSync / renameSync syscall on the hot log path.
+     */
+    private enqueueRotate;
+    private log;
+}
+/**
+ * A logger that silently discards all messages. Used during boot before
+ * the real logger is configured, and in test contexts where logging
+ * would be noise.
+ */
+export declare const noOpLogger: Logger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/infrastructure/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/infrastructure/logger.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAuB3D,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,yKAAyK;IACzK,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,qBAAa,aAAc,YAAW,MAAM;IAC1C,gFAAgF;IAChF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAO;IAEjD,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,CAAqB;IAClC,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,sBAAsB,CAAK;IACnC;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,MAAM,CAA8B;IAE5C;;;;;OAKG;IACH,OAAO,KAAK,KAAK,GAEhB;IACD,OAAO,KAAK,KAAK,QAGhB;IAED,YAAY,IAAI,GAAE,oBAAyB,EAsB1C;IAED,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAEtC;IACD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAErC;IACD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAErC;IACD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAEtC;IACD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,CAEtC;IAED,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAkB/C;IAED;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAErB;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,GAAG;CAkCZ;AAoBD;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,MAUxB,CAAC"}

package/dist/infrastructure/mcp-servers.d.ts

@@ -0,0 +1,83 @@
+import type { MCPServerConfig } from '../types/config.js';
+/**
+ * Built-in MCP server presets available to all WrongStack users out of the box.
+ * These servers must be explicitly enabled in config (disabled by default).
+ *
+ * To enable: set `mcpServers: { serverName: { enabled: true } }` in your config.
+ *
+ * Some servers require environment variables or additional config — see notes below.
+ *
+ * Transport types:
+ *   stdio       — spawns a local npm package binary via child_process
+ *   sse         — HTTP SSE endpoint (client POSTs requests)
+ *   streamable-http — session-based HTTP with NDJSON responses
+ */
+/** Filesystem access: read, write, list, search, tree. Good for exploring projects. */
+export declare const filesystemServer: () => MCPServerConfig;
+/** GitHub API: issues, PRs, repos, search, file operations. Requires GITHUB_PERSONAL_ACCESS_TOKEN. */
+export declare const githubServer: () => MCPServerConfig;
+/**
+ * Context7 — codebase-aware documentation and Q&A using context from your code.
+ * Live documentation for any library, grounded in your actual versions.
+ */
+export declare const context7Server: () => MCPServerConfig;
+/**
+ * Brave Search — web search via Brave Browser's API.
+ * Requires BRAVE_SEARCH_API_KEY. Free tier: 2,000 queries/month.
+ * Sign up at https://api.search.brave.com/
+ */
+export declare const braveSearchServer: () => MCPServerConfig;
+/**
+ * Block (Block, Inc.) — Postgres database access via SQL.
+ * Useful for running queries against a connected database during development.
+ */
+export declare const blockServer: () => MCPServerConfig;
+/**
+ * EverArt — AI image generation via various providers.
+ * Requires EVERART_API_KEY.
+ */
+export declare const everArtServer: () => MCPServerConfig;
+/**
+ * Slack — messaging, channels, search.
+ * Requires SLACK_BOT_TOKEN and either SLACK_TEAM_ID or SLACK_USER_TOKEN.
+ */
+export declare const slackServer: () => MCPServerConfig;
+/**
+ * AWS knowledge base — EC2, S3, Lambda, IAM, CloudFormation, cost management.
+ * Requires AWS access key + secret in environment.
+ */
+export declare const awsServer: () => MCPServerConfig;
+/**
+ * Google Maps — directions, distance matrix, geocoding, places.
+ * Requires GOOGLE_MAPS_API_KEY.
+ */
+export declare const googleMapsServer: () => MCPServerConfig;
+/** Sentinel — security vulnerability scanning (sentinel-labs). */
+export declare const sentinelServer: () => MCPServerConfig;
+/**
+ * Z.AI Vision MCP — image understanding fallback for text-only models.
+ * Requires Z_AI_API_KEY. Tools are read-only and safe to run automatically.
+ */
+export declare const zaiVisionServer: () => MCPServerConfig;
+/**
+ * Playwright — browser automation: navigate, click, type, screenshot, evaluate JS.
+ * Spawns a headless Chromium browser via @modelcontextprotocol/server-playwright.
+ * Tools can read and interact with live web pages — permission defaults to
+ * `confirm` because form submission / DOM mutation is possible.
+ */
+export declare const playwrightServer: () => MCPServerConfig;
+/**
+ * MiniMax Token Plan MCP — search + understand_image.
+ * This preset exposes only the read-only image understanding tool by default.
+ * Requires MINIMAX_API_KEY and uvx on PATH.
+ */
+export declare const miniMaxVisionServer: () => MCPServerConfig;
+/**
+ * SSH Manager — remote SSH execution, file transfer, tunnels, health checks, and deployment ops.
+ * Server credentials are intentionally NOT embedded here. Configure hosts via mcp-ssh-manager's
+ * env/TOML config (for example SSH_SERVER_<NAME>_HOST, USER, KEYPATH/PASSWORD) or ssh-agent.
+ */
+export declare const sshManagerServer: () => MCPServerConfig;
+/** Everything bundled — full set of built-in servers. Useful for `wstack mcp add --all`. */
+export declare const allServers: () => Record<string, MCPServerConfig>;
+//# sourceMappingURL=mcp-servers.d.ts.map

package/dist/infrastructure/mcp-servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../../src/infrastructure/mcp-servers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;GAYG;AAEH,uFAAuF;AACvF,eAAO,MAAM,gBAAgB,QAAO,eAOlC,CAAC;AAEH,sGAAsG;AACtG,eAAO,MAAM,YAAY,QAAO,eAS9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAO,eAMhC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAO,eAQnC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAO,eAO7B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,QAAO,eAQ/B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW,QAAO,eAQ7B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,SAAS,QAAO,eAQ3B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAO,eAQlC,CAAC;AAEH,kEAAkE;AAClE,eAAO,MAAM,cAAc,QAAO,eAMhC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,eAiBjC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAAO,eAQlC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,QAAO,eAcrC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,eAalC,CAAC;AAEH,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAO,MAAM,CAAC,MAAM,EAAE,eAAe,CAe1D,CAAC"}

package/dist/{path-resolver-CMS5307d.d.ts → infrastructure/path-resolver.d.ts}

@@ -1,6 +1,5 @@
-import { P as PathResolver } from './path-resolver-CPRj4bFY.js';
-
-declare class DefaultPathResolver implements PathResolver {
+import type { PathResolver } from '../types/path-resolver.js';
+export declare class DefaultPathResolver implements PathResolver {
     readonly projectRoot: string;
     readonly cwd: string;
     constructor(cwd?: string);
@@ -9,5 +8,4 @@ declare class DefaultPathResolver implements PathResolver {
     isInsideRoot(absPath: string): boolean;
     ensureInsideRoot(absPath: string): string;
 }
-
-export { DefaultPathResolver as D };
+//# sourceMappingURL=path-resolver.d.ts.map

package/dist/infrastructure/path-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/path-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAgB9D,qBAAa,mBAAoB,YAAW,YAAY;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,YAAY,GAAG,GAAE,MAAsB,EAGtC;IAED,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CA2BvC;IAED,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7B;IAED,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAMrC;IAED,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAexC;CACF"}

package/dist/infrastructure/token-counter.d.ts

@@ -0,0 +1,57 @@
+import type { EventBus } from '../kernel/events.js';
+import type { ModelsRegistry, ResolvedModel } from '../types/models-registry.js';
+import type { Usage } from '../types/provider.js';
+import type { CacheStats, TokenCounter } from '../types/token-counter.js';
+/**
+ * Token counter that derives pricing from the ModelsRegistry instead of a
+ * hardcoded table. If a model is unknown to the registry (or the registry is
+ * unavailable) the counter still tracks token totals but reports zero cost.
+ */
+export declare class DefaultTokenCounter implements TokenCounter {
+    private input;
+    private output;
+    private cacheRead;
+    private cacheWrite;
+    private costInput;
+    private costOutput;
+    private readonly registry?;
+    private readonly providerId?;
+    private readonly events?;
+    private sessionId?;
+    private priceCache;
+    /** Most recently accounted request's tokens. Used for per-request context pressure. */
+    private lastInput;
+    private lastCacheRead;
+    private lastCacheWrite;
+    constructor(opts?: {
+        registry?: ModelsRegistry | undefined;
+        providerId?: string | undefined;
+        events?: EventBus | undefined;
+        sessionId?: string | (() => string | undefined) | undefined;
+    });
+    setSessionId(sessionId: string | (() => string | undefined) | undefined): void;
+    account(usage: Usage, model?: string): void;
+    /** Synchronous variant for code paths that have already resolved the model. */
+    accountWithModel(usage: Usage, resolved: ResolvedModel): void;
+    total(): Usage;
+    currentRequestTokens(): {
+        input: number;
+        cacheRead: number;
+        cacheWrite: number;
+    };
+    setCurrentRequestTokens(input: number, cacheRead?: number, cacheWrite?: number): void;
+    estimateCost(): {
+        input: number;
+        output: number;
+        total: number;
+        currency: 'USD';
+    };
+    cacheStats(): CacheStats;
+    /** Invalidate cached prices so the next account() call fetches fresh data. */
+    invalidateCache(): void;
+    private emitAccounted;
+    private currentSessionId;
+    reset(): void;
+    private applyPrice;
+}
+//# sourceMappingURL=token-counter.d.ts.map

package/dist/infrastructure/token-counter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-counter.d.ts","sourceRoot":"","sources":["../../src/infrastructure/token-counter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAa1E;;;;GAIG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IACtD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAuB;IAC/C,OAAO,CAAC,SAAS,CAAC,CAAkD;IACpE,OAAO,CAAC,UAAU,CAAiC;IACnD,uFAAuF;IACvF,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,cAAc,CAAK;IAE3B,YACE,IAAI,GAAE;QACJ,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;QACtC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;QAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;KACxD,EAMP;IAED,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,GAAG,IAAI,CAE7E;IAED,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAqD1C;IAED,+EAA+E;IAC/E,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,aAAa,GAAG,IAAI,CAkB5D;IAED,KAAK,IAAI,KAAK,CAOb;IAED,oBAAoB,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAE/E;IAED,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAIpF;IAED,YAAY,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAA;KAAE,CAOhF;IAED,UAAU,IAAI,UAAU,CAUvB;IAED,8EAA8E;IAC9E,eAAe,IAAI,IAAI,CAEtB;IAED,OAAO,CAAC,aAAa;IAQrB,OAAO,CAAC,gBAAgB;IAKxB,KAAK,IAAI,IAAI,CAWZ;IAED,OAAO,CAAC,UAAU;CAgBnB"}

package/dist/kernel/container.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Container — dependency injection with explicit bind / override / decorate.
+ *
+ * Invariants:
+ *   bind()     — throws if token already bound
+ *   override() — throws if nothing to replace
+ *   decorate() — stacks; cached value cleared on register
+ */
+export type Token<T> = symbol & {
+    readonly __type?: T;
+};
+export type Factory<T> = (c: Container) => T;
+export type Decorator<T> = (inner: T, c: Container) => T;
+export interface BindOptions {
+    singleton?: boolean | undefined;
+    owner?: string | undefined;
+}
+export declare class Container {
+    private readonly entries;
+    /**
+     * Tokens currently mid-resolve. Tracked so we can detect circular
+     * dependencies (A → B → A) and throw a structured error instead of
+     * overflowing the call stack with "Maximum call stack size exceeded".
+     *
+     * Not a memoization cache — the per-entry `cache` field is the source
+     * of truth for "have I built this before?". This set only lives for
+     * the duration of a single resolve call.
+     */
+    private readonly resolving;
+    bind<T>(token: Token<T>, factory: Factory<T>, opts?: BindOptions): void;
+    override<T>(token: Token<T>, factory: Factory<T>, opts?: BindOptions): void;
+    decorate<T>(token: Token<T>, decorator: Decorator<T>, owner?: string): void;
+    resolve<T>(token: Token<T>): T;
+    /**
+     * Build a human-readable description of the dependency cycle that
+     * caused the resolution to re-enter. Lists the tokens in the order
+     * they were entered, then appends the re-entered token to close the
+     * loop. Falls back to a generic message if the resolving set is
+     * somehow empty (shouldn't happen, but defensive).
+     */
+    private describeCycle;
+    has<T>(token: Token<T>): boolean;
+    /**
+     * Resolve a token if it is bound, otherwise return undefined.
+     * Unlike `resolve()`, this does not throw if the token is unbound.
+     *
+     * Single map lookup — `has()` + `resolve()` would walk the entries
+     * map twice. The bound check is folded into the resolve path so a
+     * non-existent token can never enter the `resolving` cycle-detection
+     * set.
+     */
+    safeResolve<T>(token: Token<T>): T | undefined;
+    ownerOf<T>(token: Token<T>): string | undefined;
+    /**
+     * Remove a token's binding (along with any decorators stacked on it).
+     * Returns true if the token existed. Use this to withdraw temporary
+     * bindings installed by a short-lived run or plugin — without it, the
+     * entry persists in the map forever.
+     */
+    unbind<T>(token: Token<T>): boolean;
+    /**
+     * Drop every binding. Intended for tests and short-lived CLI invocations
+     * that rebuild the container from scratch. Production code should prefer
+     * `unbind` on the specific tokens it owns.
+     */
+    clear(): void;
+    list(): Array<{
+        token: symbol;
+        owner: string;
+    }>;
+    /**
+     * Inspect a binding's full shape, including decorator count and whether
+     * a singleton value is cached. Returns null if the token is unbound.
+     * Decorator and factory function references are not exposed — only counts
+     * and metadata, to keep internal state hidden.
+     */
+    inspect<T>(token: Token<T>): {
+        owner: string;
+        singleton: boolean;
+        decoratorCount: number;
+        cached: boolean;
+    } | null;
+}
+//# sourceMappingURL=container.d.ts.map

package/dist/kernel/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../src/kernel/container.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;CAAE,CAAC;AACxD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC;AAC7C,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,SAAS,KAAK,CAAC,CAAC;AAiBzD,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAE/C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CAgB1E;IAED,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI,CAiB9E;IAED,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,GAAG,IAAI,CAc1E;IAED,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAoC7B;IAED;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAYrB,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAE/B;IAED;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAG7C;IAED,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,SAAS,CAE9C;IAED;;;;;OAKG;IACH,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAElC;IAED;;;;OAIG;IACH,KAAK,IAAI,IAAI,CAEZ;IAED,IAAI,IAAI,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAK9C;IAED;;;;;OAKG;IACH,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,OAAO,CAAC;QACnB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC;KACjB,GAAG,IAAI,CASP;CACF"}