@wrongstack/core 0.313.0 → 0.313.1

package/dist/prompts/index.js

@@ -1,952 +1,18 @@
-// src/types/prompt-registry.ts
-var SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-var CHECKSUM_RE = /^[a-f0-9]{64}$/;
-var MAX_STR = 4096;
-function validateRegistryManifest(raw) {
-  const errors = [];
-  if (!raw || typeof raw !== "object") return { ok: false, errors: ["manifest is not an object"] };
-  const m = raw;
-  if (m["registryVersion"] !== 1) errors.push("registryVersion must be 1");
-  if (typeof m["source"] !== "string" || !m["source"])
-    errors.push("source must be a non-empty string");
-  if (typeof m["generatedAt"] !== "string") errors.push("generatedAt must be a string");
-  if (!Array.isArray(m["prompts"])) {
-    errors.push("prompts must be an array");
-    return { ok: false, errors };
-  }
-  const seen = /* @__PURE__ */ new Set();
-  const refs = [];
-  m["prompts"].forEach((p, i) => {
-    if (!p || typeof p !== "object") {
-      errors.push(`prompts[${i}] is not an object`);
-      return;
-    }
-    const r = p;
-    const slug = r["slug"];
-    if (typeof slug !== "string" || !SLUG_RE.test(slug)) {
-      errors.push(`prompts[${i}].slug invalid (must be kebab-case)`);
-      return;
-    }
-    if (seen.has(slug)) {
-      errors.push(`prompts[${i}].slug "${slug}" duplicated`);
-      return;
-    }
-    seen.add(slug);
-    if (typeof r["checksum"] !== "string" || !CHECKSUM_RE.test(r["checksum"])) {
-      errors.push(`prompts[${i}].checksum must be a 64-char sha256 hex`);
-      return;
-    }
-    for (const field of ["id", "title", "description", "category"]) {
-      const v = r[field];
-      if (typeof v !== "string" || v.length === 0 || v.length > MAX_STR) {
-        errors.push(`prompts[${i}].${field} must be a non-empty string under ${MAX_STR} chars`);
-        return;
-      }
-    }
-    const tags = Array.isArray(r["tags"]) ? r["tags"].filter((t) => typeof t === "string") : [];
-    refs.push({
-      id: r["id"],
-      slug,
-      title: r["title"],
-      description: r["description"],
-      category: r["category"],
-      tags,
-      checksum: r["checksum"],
-      version: typeof r["version"] === "string" ? r["version"] : void 0,
-      license: typeof r["license"] === "string" ? r["license"] : void 0,
-      url: typeof r["url"] === "string" ? r["url"] : void 0
-    });
-  });
-  if (errors.length > 0) return { ok: false, errors };
-  return {
-    ok: true,
-    manifest: {
-      registryVersion: 1,
-      source: m["source"],
-      generatedAt: m["generatedAt"],
-      prompts: refs
-    }
-  };
-}
-function diffRegistry(local, manifest) {
-  const localBySlug = new Map(local.map((e) => [e.slug, e.checksum]));
-  const diff = { added: [], updated: [], unchanged: [] };
-  for (const ref of manifest.prompts) {
-    if (!localBySlug.has(ref.slug)) diff.added.push(ref);
-    else if (localBySlug.get(ref.slug) !== ref.checksum) diff.updated.push(ref);
-    else diff.unchanged.push(ref);
-  }
-  return diff;
-}
-
-// src/types/errors.ts
-var ERROR_CODES = {
-  // Provider
-  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
-  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
-  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
-  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
-  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
-  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
-  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
-  // Tool
-  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
-  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
-  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
-  TOOL_TIMEOUT: "TOOL_TIMEOUT",
-  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
-  // Config
-  CONFIG_INVALID: "CONFIG_INVALID",
-  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
-  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
-  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
-  // Plugin
-  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
-  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
-  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
-  // Agent
-  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
-  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
-  AGENT_ABORTED: "AGENT_ABORTED",
-  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
-  // Session
-  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
-  SESSION_CORRUPTED: "SESSION_CORRUPTED",
-  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
-  // Container / Registry
-  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
-  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
-  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
-  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
-  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
-  REGISTRY_INVALID: "REGISTRY_INVALID",
-  // File system
-  FS_READ_FAILED: "FS_READ_FAILED",
-  FS_WRITE_FAILED: "FS_WRITE_FAILED",
-  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
-  FS_DELETE_FAILED: "FS_DELETE_FAILED",
-  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
-  // SDD (Spec-Driven Development)
-  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
-  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
-  SDD_INVALID_STATE: "SDD_INVALID_STATE",
-  SDD_NOT_READY: "SDD_NOT_READY",
-  // General
-  VALIDATION_ERROR: "VALIDATION_ERROR",
-  PARSE_FAILED: "PARSE_FAILED",
-  UNKNOWN: "UNKNOWN"
-};
-var WrongStackError = class extends Error {
-  code;
-  subsystem;
-  severity;
-  recoverable;
-  context;
-  constructor(opts) {
-    super(opts.message, { cause: opts.cause });
-    this.name = "WrongStackError";
-    this.code = opts.code;
-    this.subsystem = opts.subsystem;
-    this.severity = opts.severity ?? "error";
-    this.recoverable = opts.recoverable ?? false;
-    this.context = opts.context;
-  }
-  /**
-   * Render a one-line user-facing description.
-   * Subclasses should override for domain-specific formatting.
-   */
-  describe() {
-    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
-    return `${this.code}: ${this.message}${ctx}`;
-  }
-};
-function formatContext(ctx) {
-  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
-  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
-}
-var FsError = class extends WrongStackError {
-  path;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: opts.code,
-      subsystem: "fs",
-      severity: "error",
-      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
-      context: { path: opts.path, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FsError";
-    this.path = opts.path;
-  }
-};
-var FetchError = class extends WrongStackError {
-  status;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.VALIDATION_ERROR,
-      subsystem: "general",
-      severity: "error",
-      recoverable: opts.status === 429 || opts.status >= 500,
-      context: { status: opts.status, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "FetchError";
-    this.status = opts.status;
-  }
-};
-var ParseError = class extends WrongStackError {
-  source;
-  constructor(opts) {
-    super({
-      message: opts.message,
-      code: ERROR_CODES.PARSE_FAILED,
-      subsystem: "general",
-      severity: "error",
-      recoverable: false,
-      context: { source: opts.source, ...opts.context },
-      cause: opts.cause
-    });
-    this.name = "ParseError";
-    this.source = opts.source;
-  }
-};
-
-// src/prompts/prompt-installer.ts
-var defaultFetcher = async (url) => {
-  const res = await fetch(url);
-  if (!res.ok) {
-    throw new FetchError({
-      message: `registry fetch failed: ${res.status} ${res.statusText}`,
-      status: res.status,
-      context: { op: "fetchManifest" }
-    });
-  }
-  return res.json();
-};
-var PromptInstaller = class {
-  fetcher;
-  constructor(opts = {}) {
-    this.fetcher = opts.fetcher ?? defaultFetcher;
-  }
-  /**
-   * Fetch + validate a manifest and report what a sync WOULD change. Read-only.
-   * @param manifestUrl URL to the registry's `registry.json`.
-   * @param local       The prompts the caller already has (slug + checksum).
-   */
-  async pull(manifestUrl, local) {
-    const raw = await this.fetcher(manifestUrl);
-    const validated = validateRegistryManifest(raw);
-    if (!validated.ok) {
-      throw new ParseError({
-        message: `Invalid prompt registry manifest:
-  - ${validated.errors.join("\n  - ")}`,
-        source: "prompt-registry-manifest"
-      });
-    }
-    const diff = diffRegistry(local, validated.manifest);
-    return { manifest: validated.manifest, diff, dryRun: true };
-  }
-  /**
-   * EXTENSION POINT (not yet wired): download the prompt bodies for the given
-   * registry refs and write them into the user layer as `source:'synced'`,
-   * recording each in the installed-prompts manifest. Intentionally unimplemented
-   * — pulling real content over the network is gated behind a future change so
-   * the format/diff path can ship and be reviewed first.
-   */
-  async install() {
-    throw new Error(
-      "Prompt sync is not implemented yet. `pull()` reports the diff; installing remote prompt bodies will land in a follow-up."
-    );
-  }
-};
-
-// src/prompts/prompt-manifest-store.ts
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-
-// src/utils/atomic-write.ts
 import {
-  createPersistencePrimitives
-} from "@wrongstack/persistence";
-var primitives = createPersistencePrimitives({
-  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
-    message: `Timed out waiting for file lock: ${targetPath}`,
-    code: "FS_ATOMIC_WRITE_FAILED",
-    path: targetPath,
-    context: { timeoutMs }
-  })
-});
-var atomicWrite = primitives.atomicWrite;
-var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
-var ensureDir = primitives.ensureDir;
-var withFileLock = primitives.withFileLock;
-
-// src/prompts/prompt-manifest-store.ts
-var PromptManifestStore = class {
-  constructor(manifestPath) {
-    this.manifestPath = manifestPath;
-  }
-  manifestPath;
-  async load() {
-    try {
-      const raw = JSON.parse(await fs.readFile(this.manifestPath, "utf8"));
-      if (raw && typeof raw === "object" && Array.isArray(raw.entries)) {
-        return { version: 1, entries: raw.entries };
-      }
-    } catch {
-    }
-    return { version: 1, entries: [] };
-  }
-  async save(data) {
-    await ensureDir(path.dirname(this.manifestPath));
-    await atomicWrite(this.manifestPath, JSON.stringify(data, null, 2));
-  }
-  /** Upsert one entry keyed by slug. */
-  async record(entry) {
-    const data = await this.load();
-    const idx = data.entries.findIndex((e) => e.slug === entry.slug);
-    if (idx === -1) data.entries.push(entry);
-    else data.entries[idx] = entry;
-    await this.save(data);
-  }
-  async remove(slug) {
-    const data = await this.load();
-    const next = data.entries.filter((e) => e.slug !== slug);
-    if (next.length === data.entries.length) return false;
-    await this.save({ version: 1, entries: next });
-    return true;
-  }
-  async list() {
-    return (await this.load()).entries;
-  }
-};
-
-// src/prompts/prompt-journal.ts
-import * as fs2 from "node:fs/promises";
-import * as path2 from "node:path";
-
-// src/security/secret-scrubber.ts
-var JSON_CREDENTIAL_KEY_ANCHORS = [
-  'Key"',
-  'key"',
-  'KEY"',
-  'token"',
-  'Token"',
-  'TOKEN"',
-  'secret"',
-  'Secret"',
-  'SECRET"',
-  'password"',
-  'Password"',
-  'PASSWORD"',
-  'authorization"',
-  'Authorization"',
-  'bearer"',
-  'Bearer"'
-];
-var PATTERNS = [
-  // Anchored at the start where possible so partial matches inside larger
-  // strings don't trigger false positives.
-  {
-    type: "anthropic_key",
-    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
-    anchor: "sk-ant-"
-  },
-  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
-  {
-    // `xai` is a first-class provider in this codebase, but its key shape was
-    // absent here — so the one credential format WrongStack itself hands users
-    // was the one the scrubber could not recognize (audit 2026-08-20).
-    type: "xai_key",
-    regex: /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}(?![A-Za-z0-9])/g,
-    anchor: "xai-"
-  },
-  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
-  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
-  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
-  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
-  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
-  {
-    type: "stripe_key",
-    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
-    anchor: "sk_"
-  },
-  {
-    type: "twilio_sid",
-    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "AC"
-  },
-  {
-    type: "telegram_bot_token",
-    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
-    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "/bot"
-  },
-  {
-    type: "jwt",
-    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
-    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
-    anchor: "eyJ"
-  },
-  {
-    type: "private_key",
-    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
-    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
-    anchor: "-----BEGIN"
-  },
-  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
-  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
-  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
-  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
-  // AI/ML provider keys — modern LLM services with well-known prefixes
-  {
-    type: "huggingface_token",
-    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
-    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
-    anchor: "hf_"
-  },
-  {
-    type: "replicate_token",
-    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "r8_"
-  },
-  {
-    type: "perplexity_key",
-    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "pplx-"
-  },
-  {
-    type: "groq_key",
-    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
-    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "gsk_"
-  },
-  {
-    type: "bearer_token",
-    // Anchored with alternation instead of negative lookahead — avoids V8
-    // backtracking risk on adversarial input. Bounded at 512 chars.
-    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
-    // chars). A 12-char base64 string has ~71 bits of entropy — above the
-    // threshold where random strings are unlikely to produce false matches.
-    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
-    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
-    // redacted. A consuming trailing delimiter would eat the separator the
-    // next match needs for its leading anchor, leaking the second token.
-    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
-    anchor: "Bearer"
-  },
-  {
-    type: "high_entropy_env",
-    // Anchored with alternation instead of lookbehind to avoid backtracking.
-    // Value bounded at 512 chars.
-    // The trailing boundary is a NON-consuming lookahead so two secrets
-    // separated by a single delimiter (one space OR one newline, e.g.
-    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
-    // redacted. A consuming trailing `\s` would swallow the separator the
-    // next match needs for its leading anchor, so every other secret would
-    // leak in plaintext.
-    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
-    // replacement so the separator between adjacent secrets is preserved
-    // rather than collapsed. Capture groups are therefore: 1=leading
-    // delimiter, 2=key name, 3=value.
-    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD|PASSPHRASE))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
-    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD", "PASSPHRASE"]
-  },
-  {
-    type: "json_credential_key",
-    // The JSON counterpart to `high_entropy_env`, and the pattern that the
-    // now-deleted `JSON_KEY_ANCHORS` list was written for. Without it those
-    // anchors only widened the cheap pre-scan — `hasCredentialAnchors` said
-    // "this text may hold a secret", every pattern then declined to match, and
-    // the value went out verbatim. `high_entropy_env` cannot cover these: it
-    // requires an UPPERCASE unquoted key (`API_KEY=…`), so `{"apiKey":"…"}`
-    // never matched.
-    //
-    // Tool results are routinely serialised as JSON, and a credential with no
-    // recognisable prefix (Azure, self-hosted gateways, Anthropic/Codex OAuth)
-    // has no other pattern that can catch it — this is the only thing standing
-    // between such a value and the session JSONL, chronicle, HQ broadcast and
-    // the model's own context.
-    //
-    // The key may carry a prefix (`"anthropicApiKey"`), but the credential word
-    // must END the key: `"tokenCount"` and `"maxTokens"` do not match, because
-    // the closing quote has to follow the word immediately.
-    // Value floor of 8 chars keeps enum-ish values (`"authorization":"none"`)
-    // out. Capture groups: 1=key + punctuation, 2=value, 3=closing quote.
-    regex: /("[A-Za-z0-9_]*(?:apiKey|api_key|token|secret|password|authorization|bearer|private_key|access_token|refresh_token|client_secret)"\s*:\s*")([^"\\]{8,512})(")/gi,
-    anchor: JSON_CREDENTIAL_KEY_ANCHORS
-  },
-  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
-  // The plugin runtime carried 37 patterns while this scrubber — the one that
-  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
-  // audit — carried 22. The plugin side already had a parity test; it just did
-  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
-  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
-  {
-    type: "github_oauth_token",
-    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
-    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
-  },
-  {
-    type: "gitlab_pat",
-    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glpat-"
-  },
-  {
-    type: "gitlab_runner_token",
-    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "glrt-"
-  },
-  {
-    type: "npm_token",
-    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
-    anchor: "npm_"
-  },
-  {
-    type: "slack_app_token",
-    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
-    anchor: "xapp-"
-  },
-  {
-    type: "slack_webhook",
-    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
-    anchor: "hooks.slack.com"
-  },
-  {
-    type: "sendgrid_key",
-    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "SG."
-  },
-  {
-    type: "digitalocean_token",
-    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
-    anchor: "dop_v1_"
-  },
-  {
-    type: "doppler_token",
-    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "dp."
-  },
-  {
-    type: "shopify_token",
-    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
-    anchor: "shp"
-  },
-  {
-    type: "docker_pat",
-    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "dckr_pat_"
-  },
-  {
-    type: "linear_key",
-    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
-    anchor: "lin_api_"
-  },
-  {
-    type: "atlassian_token",
-    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
-    anchor: "ATATT3"
-  },
-  {
-    type: "square_token",
-    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
-  },
-  {
-    type: "google_oauth_client_secret",
-    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
-    anchor: "GOCSPX-"
-  }
-];
-var SIMPLE_PATTERNS = PATTERNS.filter(
-  (p) => p.type !== "high_entropy_env" && p.type !== "json_credential_key"
-);
-var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
-var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
-var JSON_CREDENTIAL_REGEX = PATTERNS.find((p) => p.type === "json_credential_key").regex;
-var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
-var SCRUB_CHUNK_BYTES = 64 * 1024;
-var SCRUB_OVERLAP_BYTES = 1024;
-var PEM_PRIVATE_KEY_BEGIN_RE = /-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----/;
-var PEM_END_MARKER = "-----END";
-var MAX_PEM_BLOCK_BYTES = 64 * 1024;
-var PEM_END_LINE_TOLERANCE = 64;
-function extendChunkBoundaryPastPem(text, chunkStart, proposedEnd) {
-  const head = text.slice(chunkStart, proposedEnd);
-  const lastBegin = head.lastIndexOf("-----BEGIN ");
-  if (lastBegin === -1) return proposedEnd;
-  const fromBegin = text.slice(chunkStart + lastBegin);
-  const marker = PEM_PRIVATE_KEY_BEGIN_RE.exec(fromBegin);
-  if (!marker || marker.index !== 0) return proposedEnd;
-  const bodyStart = marker[0].length;
-  const cap = Math.min(text.length, chunkStart + lastBegin + MAX_PEM_BLOCK_BYTES);
-  const closeIdx = fromBegin.indexOf(PEM_END_MARKER, bodyStart);
-  if (closeIdx === -1 || chunkStart + lastBegin + closeIdx >= cap + PEM_END_LINE_TOLERANCE) {
-    return proposedEnd;
-  }
-  const lineEnd = fromBegin.indexOf("\n", closeIdx);
-  const end = lineEnd === -1 ? text.length : chunkStart + lastBegin + lineEnd + 1;
-  return Math.max(proposedEnd, end);
-}
-var PATTERN_ANCHORS = [
-  ...new Set(
-    PATTERNS.flatMap(
-      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
-    )
-  )
-];
-var ALL_ANCHORS = PATTERN_ANCHORS;
-function hasCredentialAnchors(text) {
-  for (const anchor of ALL_ANCHORS) {
-    if (text.includes(anchor)) return true;
-  }
-  return false;
-}
-var DefaultSecretScrubber = class {
-  scrub(text) {
-    if (!text) return text;
-    if (!hasCredentialAnchors(text)) return text;
-    if (text.length <= SCRUB_CHUNK_BYTES) {
-      return this.scrubOne(text);
-    }
-    const out = [];
-    let i = 0;
-    while (i < text.length) {
-      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
-      if (end < text.length) {
-        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
-        let safe = -1;
-        for (let j = end; j < limit; j++) {
-          const ch = text.charCodeAt(j);
-          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
-            safe = j;
-            break;
-          }
-        }
-        end = safe === -1 ? end : safe + 1;
-        end = extendChunkBoundaryPastPem(text, i, end);
-      }
-      out.push(this.scrubOne(text.slice(i, end)));
-      i = end;
-    }
-    return out.join("");
-  }
-  scrubOne(text) {
-    if (!hasCredentialAnchors(text)) return text;
-    let out = text.replace(
-      COMBINED_REGEX,
-      (match, ...groups) => {
-        const idx = groups.findIndex((g) => g !== void 0);
-        if (idx < 0) return match;
-        const replacement = COMBINED_REPLACEMENTS[idx];
-        return replacement !== void 0 ? replacement : match;
-      }
-    );
-    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
-      return `${lead}${key}=[REDACTED:high_entropy_env]`;
-    });
-    out = out.replace(JSON_CREDENTIAL_REGEX, (_match, keyPrefix, _value, closingQuote) => {
-      return `${keyPrefix}[REDACTED:json_credential_key]${closingQuote}`;
-    });
-    return out;
-  }
-  /**
-   * Recursively scrub every string value in an object/array graph. Secrets can
-   * appear under any key — a URL query param, an `authorization` header, an
-   * arbitrarily-named nested field — so we don't gate recursion on key names.
-   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
-   * value without a credential anchor returns immediately without regex work.
-   */
-  scrubObject(obj) {
-    const seen = /* @__PURE__ */ new WeakSet();
-    const visit = (v) => {
-      if (typeof v === "string") return this.scrub(v);
-      if (v === null || typeof v !== "object") return v;
-      if (seen.has(v)) return v;
-      seen.add(v);
-      if (Array.isArray(v)) return v.map(visit);
-      const out = {};
-      for (const [k, val] of Object.entries(v)) {
-        out[k] = visit(val);
-      }
-      return out;
-    };
-    return visit(obj);
-  }
-};
-
-// src/prompts/prompt-journal.ts
-var defaultScrubber = new DefaultSecretScrubber();
-var PROMPT_JOURNAL_RAW_MARKER = "promptJournal.raw";
-async function ensureGitignore(projectRoot) {
-  const gitignorePath = path2.join(projectRoot, ".gitignore");
-  try {
-    let content = "";
-    try {
-      content = await fs2.readFile(gitignorePath, "utf8");
-    } catch {
-      content = "";
-    }
-    if (!content.includes(".wrongstack") && !content.includes(".wrongstack/")) {
-      const addition = content.endsWith("\n") || content.length === 0 ? ".wrongstack/\n" : "\n.wrongstack/\n";
-      await fs2.writeFile(gitignorePath, content + addition, "utf8");
-    }
-  } catch {
-  }
-}
-function sessionFileId(sessionId) {
-  const leaf = sessionId.split(/[\\/]/u).pop();
-  return leaf && leaf.trim().length > 0 ? leaf : "general";
-}
-async function recordPromptJournalEntry(opts) {
-  const now = /* @__PURE__ */ new Date();
-  const timestamp = now.toISOString();
-  const dateStr = timestamp.slice(0, 10);
-  const monthStr = dateStr.slice(0, 7);
-  const sessionId = opts.sessionId && opts.sessionId.trim() ? opts.sessionId.trim() : "general";
-  const id = `pmt_${Date.now()}_${Math.random().toString(36).slice(2, 9)}`;
-  const content = defaultScrubber.scrub(opts.content ?? "");
-  const rawContent = typeof opts.rawContent === "string" && opts.rawContent.length > 0 ? defaultScrubber.scrub(opts.rawContent) : opts.rawContent;
-  const decisionReason = typeof opts.decisionReason === "string" && opts.decisionReason.length > 0 ? defaultScrubber.scrub(opts.decisionReason) : opts.decisionReason;
-  const lines = content.split("\n");
-  const characterCount = content.length;
-  const lineCount = lines.length;
-  const tokenEstimate = Math.ceil(characterCount / 4);
-  const entry = {
-    id,
-    timestamp,
-    sessionId,
-    projectRoot: opts.projectRoot,
-    role: opts.role ?? (opts.category === "system_prompt" ? "system" : "user"),
-    category: opts.category,
-    content,
-    rawContent,
-    metadata: {
-      model: opts.model,
-      provider: opts.provider,
-      iterationIndex: opts.iterationIndex,
-      tokenEstimate,
-      characterCount,
-      lineCount,
-      activeTools: opts.activeTools,
-      contextFiles: opts.contextFiles,
-      durationMs: opts.durationMs,
-      decisionReason,
-      tags: opts.tags
-    }
-  };
-  const basePromptsDir = path2.join(opts.projectRoot, ".wrongstack", "prompts");
-  const dayDir = path2.join(basePromptsDir, monthStr, dateStr);
-  try {
-    await fs2.mkdir(dayDir, { recursive: true });
-    await ensureGitignore(opts.projectRoot);
-    const sessionJsonlFile = path2.join(dayDir, `session-${sessionFileId(sessionId)}.jsonl`);
-    await fs2.appendFile(sessionJsonlFile, JSON.stringify(entry) + "\n", "utf8");
-    const sessionMdFile = path2.join(dayDir, `session-${sessionFileId(sessionId)}.md`);
-    const mdSection = formatEntryMarkdown(entry);
-    await fs2.appendFile(sessionMdFile, mdSection, "utf8");
-    const dailySummaryFile = path2.join(dayDir, "daily-summary.md");
-    await updateDailySummary(dailySummaryFile, dateStr, entry);
-    await updateRootCatalog(basePromptsDir, monthStr, dateStr, sessionId, entry);
-  } catch (err) {
-    console.error?.(`Failed to write hierarchical prompt journal: ${err}`);
-  }
-  return entry;
-}
-function formatEntryMarkdown(entry) {
-  const tagList = [
-    `**Category:** \`${entry.category}\``,
-    `**Role:** \`${entry.role}\``,
-    entry.metadata.model ? `**Model:** \`${entry.metadata.model}\`` : null,
-    `**Tokens (est):** ~${entry.metadata.tokenEstimate}`,
-    entry.metadata.iterationIndex !== void 0 ? `**Iteration:** #${entry.metadata.iterationIndex}` : null,
-    `**Session:** \`${entry.sessionId}\``
-  ].filter(Boolean).join(" | ");
-  let md = `
-### \u{1F4DD} [${entry.timestamp}] \`${entry.id}\`
-${tagList}
-
-`;
-  if (entry.metadata.decisionReason) {
-    md += `> **Rationale:** ${entry.metadata.decisionReason}
-
-`;
-  }
-  if (entry.metadata.activeTools && entry.metadata.activeTools.length > 0) {
-    md += `*Active Tools:* \`${entry.metadata.activeTools.join("`, `")}\`
-
-`;
-  }
-  if (entry.rawContent && entry.rawContent !== entry.content) {
-    md += `**Raw Input:**
-\`\`\`text
-${entry.rawContent.trim()}
-\`\`\`
-
-`;
-    md += `**Refined / Injected Prompt:**
-\`\`\`text
-${entry.content.trim()}
-\`\`\`
-
-`;
-  } else {
-    md += `**Prompt Content:**
-\`\`\`text
-${entry.content.trim()}
-\`\`\`
-
-`;
-  }
-  md += `---
-`;
-  return md;
-}
-async function updateDailySummary(summaryFile, dateStr, entry) {
-  try {
-    let content = "";
-    try {
-      content = await fs2.readFile(summaryFile, "utf8");
-    } catch {
-      content = `# \u{1F4C5} Daily Prompt Summary \u2014 ${dateStr}
-
-| Time | ID | Session | Category | Model | Tokens | Rationale |
-| :--- | :--- | :--- | :--- | :--- | :--- | :--- |
-`;
-    }
-    const time = entry.timestamp.slice(11, 19);
-    const model = entry.metadata.model ?? "-";
-    const reason = entry.metadata.decisionReason ? entry.metadata.decisionReason.slice(0, 40) : "-";
-    const row = `| ${time} | [\`${entry.id}\`](session-${sessionFileId(entry.sessionId)}.md) | \`${entry.sessionId}\` | \`${entry.category}\` | ${model} | ~${entry.metadata.tokenEstimate} | ${reason} |
-`;
-    await fs2.writeFile(summaryFile, content + row, "utf8");
-  } catch {
-  }
-}
-async function updateRootCatalog(baseDir, monthStr, dateStr, sessionId, entry) {
-  const indexJsonFile = path2.join(baseDir, "index.json");
-  const indexMdFile = path2.join(baseDir, "index.md");
-  let catalog;
-  try {
-    const raw = await fs2.readFile(indexJsonFile, "utf8");
-    catalog = JSON.parse(raw);
-  } catch {
-    catalog = {
-      updatedAt: entry.timestamp,
-      totalPrompts: 0,
-      totalTokensEstimated: 0,
-      months: {}
-    };
-  }
-  catalog.updatedAt = entry.timestamp;
-  catalog.totalPrompts += 1;
-  catalog.totalTokensEstimated += entry.metadata.tokenEstimate;
-  if (!catalog.months[monthStr]) {
-    catalog.months[monthStr] = { days: {} };
-  }
-  const monthData = catalog.months[monthStr];
-  if (!monthData.days[dateStr]) {
-    monthData.days[dateStr] = { sessions: {} };
-  }
-  const dayData = monthData.days[dateStr];
-  if (!dayData.sessions[sessionId]) {
-    dayData.sessions[sessionId] = {
-      promptCount: 0,
-      tokenEstimate: 0,
-      lastTimestamp: entry.timestamp,
-      categories: {}
-    };
-  }
-  const sessionData = dayData.sessions[sessionId];
-  sessionData.promptCount += 1;
-  sessionData.tokenEstimate += entry.metadata.tokenEstimate;
-  sessionData.lastTimestamp = entry.timestamp;
-  sessionData.categories[entry.category] = (sessionData.categories[entry.category] ?? 0) + 1;
-  try {
-    await fs2.writeFile(indexJsonFile, JSON.stringify(catalog, null, 2), "utf8");
-    let md = `# \u{1F5C2}\uFE0F Prompt Journal Navigation Index
-
-`;
-    md += `* **Total Prompts Logged:** ${catalog.totalPrompts}
-`;
-    md += `* **Total Tokens (est):** ~${catalog.totalTokensEstimated.toLocaleString()}
-`;
-    md += `* **Last Recorded Activity:** ${catalog.updatedAt}
-
-`;
-    md += `## \u{1F4C5} Recorded Dates & Sessions
-
-`;
-    md += `| Date | Session | Prompts | Tokens (est) | Daily Log | Session Log |
-`;
-    md += `| :--- | :--- | :--- | :--- | :--- | :--- |
-`;
-    for (const [m, mObj] of Object.entries(catalog.months).sort().reverse()) {
-      for (const [d, dObj] of Object.entries(mObj.days).sort().reverse()) {
-        for (const [sId, sData] of Object.entries(dObj.sessions)) {
-          const dailyLink = `[daily-summary.md](./${m}/${d}/daily-summary.md)`;
-          const sessionLink = `[session-${sessionFileId(sId)}.md](./${m}/${d}/session-${sessionFileId(sId)}.md)`;
-          md += `| **${d}** | \`${sId}\` | ${sData.promptCount} | ~${sData.tokenEstimate.toLocaleString()} | ${dailyLink} | ${sessionLink} |
-`;
-        }
-      }
-    }
-    await fs2.writeFile(indexMdFile, md, "utf8");
-  } catch {
-  }
-}
-async function getPromptJournalEntries(projectRoot, filter = {}) {
-  const basePromptsDir = path2.join(projectRoot, ".wrongstack", "prompts");
-  const results = [];
-  try {
-    const months = await fs2.readdir(basePromptsDir);
-    for (const month of months) {
-      if (!/^\d{4}-\d{2}$/.test(month)) continue;
-      if (filter.month && filter.month !== month) continue;
-      const monthDir = path2.join(basePromptsDir, month);
-      const days = await fs2.readdir(monthDir);
-      for (const day of days) {
-        if (!/^\d{4}-\d{2}-\d{2}$/.test(day)) continue;
-        if (filter.date && filter.date !== day) continue;
-        const dayDir = path2.join(monthDir, day);
-        const files = await fs2.readdir(dayDir);
-        const jsonlFiles = files.filter((f) => f.startsWith("session-") && f.endsWith(".jsonl"));
-        for (const jsonlFile of jsonlFiles) {
-          const sessionMatch = jsonlFile.match(/^session-(.+)\.jsonl$/);
-          const sId = sessionMatch ? sessionMatch[1] : void 0;
-          if (filter.sessionId && sId !== sessionFileId(filter.sessionId)) continue;
-          const filePath = path2.join(dayDir, jsonlFile);
-          const content = await fs2.readFile(filePath, "utf8");
-          const lines = content.split("\n");
-          for (const line of lines) {
-            if (!line.trim()) continue;
-            try {
-              const entry = JSON.parse(line);
-              if (filter.sessionId && sessionFileId(entry.sessionId) !== sessionFileId(filter.sessionId)) {
-                continue;
-              }
-              if (filter.category && entry.category !== filter.category) continue;
-              if (filter.since && entry.timestamp < filter.since) continue;
-              results.push(entry);
-            } catch {
-            }
-          }
-        }
-      }
-    }
-  } catch {
-    return [];
-  }
-  results.sort((a, b) => a.timestamp.localeCompare(b.timestamp));
-  if (filter.limit && results.length > filter.limit) {
-    return results.slice(-filter.limit);
-  }
-  return results;
-}
+  PromptInstaller,
+  PromptManifestStore
+} from "../chunk-JJPMWPB6.js";
+import {
+  PROMPT_JOURNAL_RAW_MARKER,
+  ensureGitignore,
+  getPromptJournalEntries,
+  recordPromptJournalEntry
+} from "../chunk-YUPMXOGP.js";
+import "../chunk-3E244UDA.js";
+import "../chunk-IYFBFX34.js";
+import "../chunk-7ZHZE5EO.js";
+import "../chunk-WOEZV3Q4.js";
+import "../chunk-TBRL2RCC.js";
 export {
   PROMPT_JOURNAL_RAW_MARKER,
   PromptInstaller,