@wrongstack/plugins 0.284.0 → 0.285.0

package/dist/config-validator/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * config-validator plugin — instant syntax feedback after config-file
+ * writes.
+ *
+ * A broken `package.json` or malformed YAML often goes unnoticed
+ * until a later build fails with an unrelated-looking error. This
+ * plugin validates config files immediately: a `PostToolUse` hook on
+ * `write|edit` re-reads the target file from disk (what actually
+ * landed, not what the tool intended) and reports problems via
+ * `additionalContext` in the same turn:
+ *
+ *  - `.json` / `.jsonc`      → strict parse (JSONC comments stripped
+ *    first); parse errors include the line/column
+ *  - `package.json`          → parse + shape checks (name/version
+ *    present, `dependencies` is an object)
+ *  - `.yaml` / `.yml`        → structural lint: tab indentation
+ *    (illegal in YAML), duplicate keys at the same indent within a
+ *    block, unclosed quotes
+ *  - `.toml`                 → duplicate table headers, duplicate
+ *    keys within a table
+ *
+ * Valid files produce no output — zero noise on the happy path.
+ *
+ * Config (`config.extensions['config-validator']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "extensions": [".json", ".jsonc", ".yaml", ".yml", ".toml"],
+ *   "maxFileBytes": 1048576
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "config-validator", "enabled": false }`
+ * in `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export declare function validateJson(text: string, isJsonc: boolean, fileName: string): string[];
+export declare function validateYaml(text: string): string[];
+export declare function validateToml(text: string): string[];
+export declare function validateFile(path: string, text: string): string[];
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/config-validator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config-validator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA0H/C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CA2CvF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuDnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuCnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOjE;AAMD,QAAA,MAAM,MAAM,EAAE,MAqJb,CAAC;eAEa,MAAM"}

package/dist/config-validator.d.ts

@@ -1,48 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * config-validator plugin — instant syntax feedback after config-file
- * writes.
- *
- * A broken `package.json` or malformed YAML often goes unnoticed
- * until a later build fails with an unrelated-looking error. This
- * plugin validates config files immediately: a `PostToolUse` hook on
- * `write|edit` re-reads the target file from disk (what actually
- * landed, not what the tool intended) and reports problems via
- * `additionalContext` in the same turn:
- *
- *  - `.json` / `.jsonc`      → strict parse (JSONC comments stripped
- *    first); parse errors include the line/column
- *  - `package.json`          → parse + shape checks (name/version
- *    present, `dependencies` is an object)
- *  - `.yaml` / `.yml`        → structural lint: tab indentation
- *    (illegal in YAML), duplicate keys at the same indent within a
- *    block, unclosed quotes
- *  - `.toml`                 → duplicate table headers, duplicate
- *    keys within a table
- *
- * Valid files produce no output — zero noise on the happy path.
- *
- * Config (`config.extensions['config-validator']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "extensions": [".json", ".jsonc", ".yaml", ".yml", ".toml"],
- *   "maxFileBytes": 1048576
- * }
- * ```
- *
- * Toggle off with `{ "name": "config-validator", "enabled": false }`
- * in `config.plugins`, or `"enabled": false` in the options above.
- *
- * @public
- */
-
-declare function validateJson(text: string, isJsonc: boolean, fileName: string): string[];
-declare function validateYaml(text: string): string[];
-declare function validateToml(text: string): string[];
-declare function validateFile(path: string, text: string): string[];
-declare const plugin: Plugin;
-
-export { plugin as default, validateFile, validateJson, validateToml, validateYaml };
+export * from './config-validator/index.js';
+export { default } from './config-validator/index.js';

package/dist/config-validator.js

@@ -1,6 +1,5 @@
-import { statSync, readFileSync } from 'fs';
-
 // src/config-validator/index.ts
+import { readFileSync, statSync } from "node:fs";
 var state = {
   invocations: 0,
   filesChecked: 0,
@@ -343,5 +342,10 @@ var plugin = {
   }
 };
 var config_validator_default = plugin;
-
-export { config_validator_default as default, validateFile, validateJson, validateToml, validateYaml };
+export {
+  config_validator_default as default,
+  validateFile,
+  validateJson,
+  validateToml,
+  validateYaml
+};

package/dist/context-pins/index.d.ts

@@ -0,0 +1,43 @@
+/**
+ * context-pins plugin — pin durable facts into the system prompt.
+ *
+ * Long sessions lose important constraints to compaction ("the API
+ * base URL is X", "never touch the legacy folder", "the user prefers
+ * Turkish"). This plugin gives the agent (and the user) three tools:
+ *
+ *  - `pin_add`    — pin a short fact (optionally with a label)
+ *  - `pin_remove` — remove a pin by id or label
+ *  - `pin_list`   — list all pins
+ *
+ * Every pinned fact is injected into the system prompt on every
+ * request via a `SystemPromptContributor`, so pins survive context
+ * compaction by construction. Pins persist across sessions in a JSON
+ * file (default: `<projectDir>/context-pins.json`, seeded by the CLI
+ * host the same way `todo-tracker` gets its path).
+ *
+ * Config (`config.extensions['context-pins']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "filePath": "",        // where pins persist; empty = in-memory only
+ *   "maxPins": 20,          // hard cap so the prompt block stays small
+ *   "maxPinChars": 500      // per-pin length cap
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "context-pins", "enabled": false }` in
+ * `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export interface Pin {
+    id: string;
+    label: string | null;
+    text: string;
+    createdAt: string;
+}
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/context-pins/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/context-pins/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AA8GD,QAAA,MAAM,MAAM,EAAE,MA8Mb,CAAC;eAEa,MAAM"}

package/dist/context-pins.d.ts

@@ -1,45 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * context-pins plugin — pin durable facts into the system prompt.
- *
- * Long sessions lose important constraints to compaction ("the API
- * base URL is X", "never touch the legacy folder", "the user prefers
- * Turkish"). This plugin gives the agent (and the user) three tools:
- *
- *  - `pin_add`    — pin a short fact (optionally with a label)
- *  - `pin_remove` — remove a pin by id or label
- *  - `pin_list`   — list all pins
- *
- * Every pinned fact is injected into the system prompt on every
- * request via a `SystemPromptContributor`, so pins survive context
- * compaction by construction. Pins persist across sessions in a JSON
- * file (default: `<projectDir>/context-pins.json`, seeded by the CLI
- * host the same way `todo-tracker` gets its path).
- *
- * Config (`config.extensions['context-pins']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "filePath": "",        // where pins persist; empty = in-memory only
- *   "maxPins": 20,          // hard cap so the prompt block stays small
- *   "maxPinChars": 500      // per-pin length cap
- * }
- * ```
- *
- * Toggle off with `{ "name": "context-pins", "enabled": false }` in
- * `config.plugins`, or `"enabled": false` in the options above.
- *
- * @public
- */
-
-interface Pin {
-    id: string;
-    label: string | null;
-    text: string;
-    createdAt: string;
-}
-declare const plugin: Plugin;
-
-export { type Pin, plugin as default };
+export * from './context-pins/index.js';
+export { default } from './context-pins/index.js';

package/dist/context-pins.js

@@ -1,7 +1,6 @@
-import * as fs from 'fs';
-import { dirname, resolve, isAbsolute, relative } from 'path';
-
 // src/context-pins/index.ts
+import * as fs from "node:fs";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 var state = {
   pins: [],
   nextId: 1,
@@ -245,5 +244,6 @@ var plugin = {
   }
 };
 var context_pins_default = plugin;
-
-export { context_pins_default as default };
+export {
+  context_pins_default as default
+};

package/dist/cost-tracker/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * cost-tracker plugin — Tracks LLM token usage and cost per session.
+ *
+ * Config surface (`config.extensions['cost-tracker']`):
+ *
+ * ```jsonc
+ * {
+ *   "budgetLimit": 10,            // USD; 0 = no limit
+ *   "warningThreshold": 80,       // percent of budget before warning
+ *   "pricingOverrides": {         // user-supplied per-model rates (USD/1M tokens)
+ *     "gpt-4o":              { "input": 5.0,  "output": 15.0 },
+ *     "custom-model":        { "input": 3.0,  "output": 15.0 }
+ *   }
+ * }
+ * ```
+ *
+ * Pricing lookup chain (first match wins, all keys lowercased):
+ *
+ * | Priority | Source                              | Populated by                         |
+ * |----------|-------------------------------------|--------------------------------------|
+ * | 1        | `pricingOverrides[model]`           | User config (highest priority)       |
+ * | 2        | `bundledFromRegistry[model]`        | `api.modelsRegistry` (models.dev)    |
+ * | 3        | `PRICING[model]`                    | Bundled baseline (updated per release)|
+ * | 4        | `DEFAULT_PRICING`                   | Last-resort fallback for unknown models |
+ *
+ * Tools registered:
+ * - cost_summary: Show token usage breakdown by model
+ * - cost_reset: Reset tracking counters
+ * - cost_export: Export cost report as JSON or CSV
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+/**
+ * Per-model pricing in USD per 1 million tokens.
+ *
+ * Used by `pricingOverrides` (user config), `bundledFromRegistry`
+ * (models.dev), and the bundled `PRICING` table. All three share
+ * the same shape so the lookup chain can fall through uniformly.
+ *
+ * @public
+ */
+export interface ModelPricing {
+    /** Cost per 1M input (prompt) tokens in USD. */
+    input: number;
+    /** Cost per 1M output (completion) tokens in USD. */
+    output: number;
+}
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/cost-tracker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cost-tracker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAK/C;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AA8KD,QAAA,MAAM,MAAM,EAAE,MA8Zb,CAAC;eAEa,MAAM"}

package/dist/cost-tracker.d.ts

@@ -1,53 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * cost-tracker plugin — Tracks LLM token usage and cost per session.
- *
- * Config surface (`config.extensions['cost-tracker']`):
- *
- * ```jsonc
- * {
- *   "budgetLimit": 10,            // USD; 0 = no limit
- *   "warningThreshold": 80,       // percent of budget before warning
- *   "pricingOverrides": {         // user-supplied per-model rates (USD/1M tokens)
- *     "gpt-4o":              { "input": 5.0,  "output": 15.0 },
- *     "custom-model":        { "input": 3.0,  "output": 15.0 }
- *   }
- * }
- * ```
- *
- * Pricing lookup chain (first match wins, all keys lowercased):
- *
- * | Priority | Source                              | Populated by                         |
- * |----------|-------------------------------------|--------------------------------------|
- * | 1        | `pricingOverrides[model]`           | User config (highest priority)       |
- * | 2        | `bundledFromRegistry[model]`        | `api.modelsRegistry` (models.dev)    |
- * | 3        | `PRICING[model]`                    | Bundled baseline (updated per release)|
- * | 4        | `DEFAULT_PRICING`                   | Last-resort fallback for unknown models |
- *
- * Tools registered:
- * - cost_summary: Show token usage breakdown by model
- * - cost_reset: Reset tracking counters
- * - cost_export: Export cost report as JSON or CSV
- *
- * @public
- */
-
-/**
- * Per-model pricing in USD per 1 million tokens.
- *
- * Used by `pricingOverrides` (user config), `bundledFromRegistry`
- * (models.dev), and the bundled `PRICING` table. All three share
- * the same shape so the lookup chain can fall through uniformly.
- *
- * @public
- */
-interface ModelPricing {
-    /** Cost per 1M input (prompt) tokens in USD. */
-    input: number;
-    /** Cost per 1M output (completion) tokens in USD. */
-    output: number;
-}
-declare const plugin: Plugin;
-
-export { type ModelPricing, plugin as default };
+export * from './cost-tracker/index.js';
+export { default } from './cost-tracker/index.js';

package/dist/cost-tracker.js

@@ -1,6 +1,5 @@
-import { expectDefined } from '@wrongstack/core';
-
 // src/cost-tracker/index.ts
+import { expectDefined } from "@wrongstack/core";
 var API_VERSION = "^0.1.10";
 var PRICING = {
   "gpt-4o": { input: 5, output: 15 },
@@ -359,5 +358,6 @@ by model: ${top || "(none)"}`
   }
 };
 var cost_tracker_default = plugin;
-
-export { cost_tracker_default as default };
+export {
+  cost_tracker_default as default
+};

package/dist/cron/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * cron plugin — Schedules recurring tasks via beforeIteration extension hooks.
+ *
+ * Tools registered:
+ * - cron_schedule: Schedule a recurring action
+ * - cron_list: List all scheduled jobs
+ * - cron_cancel: Cancel a scheduled job
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/cron/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cron/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAoE/C,QAAA,MAAM,MAAM,EAAE,MA2Pb,CAAC;eAEa,MAAM"}

package/dist/cron.d.ts

@@ -1,14 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * cron plugin — Schedules recurring tasks via beforeIteration extension hooks.
- *
- * Tools registered:
- * - cron_schedule: Schedule a recurring action
- * - cron_list: List all scheduled jobs
- * - cron_cancel: Cancel a scheduled job
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './cron/index.js';
+export { default } from './cron/index.js';

package/dist/cron.js

@@ -235,5 +235,6 @@ var plugin = {
   }
 };
 var cron_default = plugin;
-
-export { cron_default as default };
+export {
+  cron_default as default
+};

package/dist/dead-code-detector/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * dead-code-detector plugin — lightweight regex-based scan for exported
+ * identifiers that appear unused anywhere in the project.
+ *
+ * The plugin registers one tool:
+ *  - `dead_code_scan` — scan a path for suspicious exported symbols.
+ *
+ * And one hook:
+ *  - `PostToolUse` matcher `write|edit` — auto-scan changed source files and
+ *    inject a short warning when newly exported symbols look unused.
+ *
+ * No external AST parser is used; all detection is regex-based and
+ * deterministic. Expect false positives on re-exports, public API surface,
+ * and test-only exports.
+ *
+ * Config (`config.extensions['dead-code-detector']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "extensions": [".ts", ".tsx", ".js", ".jsx"],
+ *   "defaultDepth": 3,
+ *   "excludeDirs": ["node_modules", "dist", ".git", "coverage"]
+ * }
+ * ```
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/dead-code-detector/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dead-code-detector/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2Q/C,QAAA,MAAM,MAAM,EAAE,MAkOb,CAAC;eAEa,MAAM"}

package/dist/dead-code-detector.d.ts

@@ -1,34 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * dead-code-detector plugin — lightweight regex-based scan for exported
- * identifiers that appear unused anywhere in the project.
- *
- * The plugin registers one tool:
- *  - `dead_code_scan` — scan a path for suspicious exported symbols.
- *
- * And one hook:
- *  - `PostToolUse` matcher `write|edit` — auto-scan changed source files and
- *    inject a short warning when newly exported symbols look unused.
- *
- * No external AST parser is used; all detection is regex-based and
- * deterministic. Expect false positives on re-exports, public API surface,
- * and test-only exports.
- *
- * Config (`config.extensions['dead-code-detector']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "extensions": [".ts", ".tsx", ".js", ".jsx"],
- *   "defaultDepth": 3,
- *   "excludeDirs": ["node_modules", "dist", ".git", "coverage"]
- * }
- * ```
- *
- * @public
- */
-
-declare const plugin: Plugin;
-
-export { plugin as default };
+export * from './dead-code-detector/index.js';
+export { default } from './dead-code-detector/index.js';

package/dist/dead-code-detector.js

@@ -1,7 +1,6 @@
-import { statSync, readFileSync, readdirSync } from 'fs';
-import { resolve, isAbsolute, relative, join, extname } from 'path';
-
 // src/dead-code-detector/index.ts
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 var API_VERSION = "^0.1.10";
 var state = {
   scanCount: 0,
@@ -350,5 +349,6 @@ Consider removing the export if it is not part of the public API.`;
   }
 };
 var dead_code_detector_default = plugin;
-
-export { dead_code_detector_default as default };
+export {
+  dead_code_detector_default as default
+};

package/dist/dep-guard/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * dep-guard plugin — supervises dependency-install commands.
+ *
+ * Supply-chain safety at the point of no return: a `PreToolUse` hook
+ * on `bash|exec` parses package-manager install commands
+ * (`npm i`, `pnpm add`, `yarn add`, `bun add`, `pip install`,
+ * `cargo add`) and extracts the package names being added:
+ *
+ *  - packages on the `deny` list        → blocked (or warned in
+ *    warn mode) with the configured reason
+ *  - typosquat lookalikes of `popular`  → warned ("did you mean
+ *    react? you typed raect") via Levenshtein distance 1
+ *  - unpinned installs (no version)     → optional warning when
+ *    `warnOnUnpinned` is set
+ *  - every install                      → a compact context note so
+ *    the model consciously confirms new dependencies
+ *
+ * Non-install commands pass through untouched.
+ *
+ * Config (`config.extensions['dep-guard']`):
+ *
+ * ```jsonc
+ * {
+ *   "enabled": true,
+ *   "mode": "block",           // "block" | "warn" (deny-list handling)
+ *   "deny": [],                 // exact names or prefix globs ("left-pad", "@evil/*")
+ *   "allow": [],                // exemptions from deny
+ *   "warnOnUnpinned": false,    // warn when no version is specified
+ *   "typosquatCheck": true      // warn on 1-edit lookalikes of popular packages
+ * }
+ * ```
+ *
+ * Toggle off with `{ "name": "dep-guard", "enabled": false }` in
+ * `config.plugins`, or `"enabled": false` in the options above.
+ *
+ * @public
+ */
+import type { Plugin } from '@wrongstack/core';
+export interface ParsedInstall {
+    manager: string;
+    packages: Array<{
+        name: string;
+        version: string | null;
+    }>;
+}
+/**
+ * Parse a shell command for dependency installs. Returns one entry
+ * per install segment found (compound commands can contain several).
+ * Bare `npm install` (restore from lockfile, no packages) yields an
+ * empty package list and is NOT treated as adding dependencies.
+ */
+export declare function parseInstallCommands(command: string): ParsedInstall[];
+/**
+ * Optimal-string-alignment distance (Levenshtein + adjacent
+ * transposition). Transpositions count as ONE edit because they are
+ * the classic typosquat vector: `lodahs` → `lodash`, `raect` → `react`.
+ * Package names are short, so the full matrix is cheap.
+ */
+export declare function editDistance(a: string, b: string): number;
+export declare function typosquatOf(name: string): string | null;
+declare const plugin: Plugin;
+export default plugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/dep-guard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dep-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAmF/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3D;AAKD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAmCrE;AA0CD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAyBzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOvD;AAMD,QAAA,MAAM,MAAM,EAAE,MAwPb,CAAC;eAEa,MAAM"}

package/dist/dep-guard.d.ts

@@ -1,65 +1,2 @@
-import { Plugin } from '@wrongstack/core';
-
-/**
- * dep-guard plugin — supervises dependency-install commands.
- *
- * Supply-chain safety at the point of no return: a `PreToolUse` hook
- * on `bash|exec` parses package-manager install commands
- * (`npm i`, `pnpm add`, `yarn add`, `bun add`, `pip install`,
- * `cargo add`) and extracts the package names being added:
- *
- *  - packages on the `deny` list        → blocked (or warned in
- *    warn mode) with the configured reason
- *  - typosquat lookalikes of `popular`  → warned ("did you mean
- *    react? you typed raect") via Levenshtein distance 1
- *  - unpinned installs (no version)     → optional warning when
- *    `warnOnUnpinned` is set
- *  - every install                      → a compact context note so
- *    the model consciously confirms new dependencies
- *
- * Non-install commands pass through untouched.
- *
- * Config (`config.extensions['dep-guard']`):
- *
- * ```jsonc
- * {
- *   "enabled": true,
- *   "mode": "block",           // "block" | "warn" (deny-list handling)
- *   "deny": [],                 // exact names or prefix globs ("left-pad", "@evil/*")
- *   "allow": [],                // exemptions from deny
- *   "warnOnUnpinned": false,    // warn when no version is specified
- *   "typosquatCheck": true      // warn on 1-edit lookalikes of popular packages
- * }
- * ```
- *
- * Toggle off with `{ "name": "dep-guard", "enabled": false }` in
- * `config.plugins`, or `"enabled": false` in the options above.
- *
- * @public
- */
-
-interface ParsedInstall {
-    manager: string;
-    packages: Array<{
-        name: string;
-        version: string | null;
-    }>;
-}
-/**
- * Parse a shell command for dependency installs. Returns one entry
- * per install segment found (compound commands can contain several).
- * Bare `npm install` (restore from lockfile, no packages) yields an
- * empty package list and is NOT treated as adding dependencies.
- */
-declare function parseInstallCommands(command: string): ParsedInstall[];
-/**
- * Optimal-string-alignment distance (Levenshtein + adjacent
- * transposition). Transpositions count as ONE edit because they are
- * the classic typosquat vector: `lodahs` → `lodash`, `raect` → `react`.
- * Package names are short, so the full matrix is cheap.
- */
-declare function editDistance(a: string, b: string): number;
-declare function typosquatOf(name: string): string | null;
-declare const plugin: Plugin;
-
-export { type ParsedInstall, plugin as default, editDistance, parseInstallCommands, typosquatOf };
+export * from './dep-guard/index.js';
+export { default } from './dep-guard/index.js';

package/dist/dep-guard.js

@@ -358,5 +358,9 @@ ${notes.map((n) => `  - ${n}`).join("\n")}`
   }
 };
 var dep_guard_default = plugin;
-
-export { dep_guard_default as default, editDistance, parseInstallCommands, typosquatOf };
+export {
+  dep_guard_default as default,
+  editDistance,
+  parseInstallCommands,
+  typosquatOf
+};