@wrongstack/webui-server 0.284.1 → 0.285.0

package/dist/server/pre-context-services.d.ts

@@ -0,0 +1,58 @@
+import type { Config, Logger, MemoryStore } from '@wrongstack/core';
+import { DefaultTokenCounter } from '@wrongstack/core/infrastructure';
+import { AgentStatusTracker, AnnotationsStore, DefaultModeStore, DefaultPromptLoader, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, EventBus, PromptUsageStore, ProviderRegistry, SkillInstaller, ToolRegistry, Context, type Container, type ConfigStore, type ModelsRegistry, type Provider, type SecretVault, type SessionStore } from '@wrongstack/core';
+import type { WstackPaths } from '@wrongstack/core/utils';
+import type { WebUIOptions } from './types.js';
+import type { CustomModeStore } from './custom-context-modes.js';
+export interface PreContextServicesInput {
+    config: Config;
+    wpaths: WstackPaths;
+    logger: Logger;
+    opts: WebUIOptions;
+    vault: SecretVault;
+    globalConfigPath: string;
+    projectRoot: string;
+    workingDir: string;
+    needsProvider: boolean;
+    /** Callback to register/refresh the project in the manifest. */
+    touchProject: (root: string, workDir?: string) => Promise<void>;
+}
+export interface PreContextServices {
+    modelsRegistry: ModelsRegistry;
+    container: Container;
+    configStore: ConfigStore;
+    providerRegistry: ProviderRegistry;
+    toolRegistry: ToolRegistry;
+    memoryStore: MemoryStore;
+    events: EventBus;
+    mcpRegistry: import('@wrongstack/mcp').MCPRegistry;
+    sessionStore: SessionStore;
+    sessionReader: DefaultSessionReader;
+    annotationsStore: AnnotationsStore;
+    session: Awaited<ReturnType<DefaultSessionStore['create']>>;
+    sessionStartedAt: number;
+    statusTracker: AgentStatusTracker | undefined;
+    tokenCounter: DefaultTokenCounter;
+    modeStore: DefaultModeStore;
+    modeId: string;
+    customModeStore: CustomModeStore;
+    skillLoader: DefaultSkillLoader | undefined;
+    skillInstaller: SkillInstaller | undefined;
+    promptsCtx: {
+        promptLoader: DefaultPromptLoader | undefined;
+        promptUsage: PromptUsageStore;
+    };
+    modelCapabilitiesRef: {
+        current: unknown;
+    };
+    provider: Provider;
+    context: Context;
+    needsSetup: boolean;
+}
+/**
+ * Build all pre-context services: registries, stores, session, system
+ * prompt, provider, and context. Returns everything `startWebUI` needs
+ * for `createAgentServices` (Phase 1c) + route/dispatcher wiring.
+ */
+export declare function createPreContextServices(input: PreContextServicesInput): Promise<PreContextServices>;
+//# sourceMappingURL=pre-context-services.d.ts.map

package/dist/server/pre-context-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-context-services.d.ts","sourceRoot":"","sources":["../../src/server/pre-context-services.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAGhB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAElB,QAAQ,EAGR,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EAEd,YAAY,EACZ,OAAO,EAUP,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAiB1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAUjE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,cAAc,CAAC;IAC/B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,WAAW,EAAE,OAAO,iBAAiB,EAAE,WAAW,CAAC;IACnD,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,oBAAoB,CAAC;IACpC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC9C,YAAY,EAAE,mBAAmB,CAAC;IAClC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5C,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;IAC3C,UAAU,EAAE;QAAE,YAAY,EAAE,mBAAmB,GAAG,SAAS,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,CAAC;IAC7F,oBAAoB,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAwV7B"}

package/dist/server/pref-helpers.d.ts

@@ -0,0 +1,43 @@
+import type { SecretVault } from '@wrongstack/core';
+/** Pref keys exposed to the settings panel via prefs.get / prefs.updated. */
+export declare const PREF_KEYS: readonly ['autonomy', 'autonomyDelayMs', 'autoProceedMaxIterations', 'yolo', 'maxIterations', 'chime', 'confirmExit', 'streamFleet', 'nextPrediction', 'enhanceEnabled', 'enhanceDelayMs', 'enhanceLanguage', 'featureMcp', 'featurePlugins', 'featureMemory', 'featureSkills', 'featureModelsRegistry', 'indexOnStart', 'contextAutoCompact', 'contextStrategy', 'contextMode', 'tokenSavingTier', 'maxConcurrent', 'titleAnimation', 'uiLocale', 'logLevel', 'auditLevel', 'hqEnabled', 'hqUrl', 'hqToken', 'hqRawContent', 'tgConfigured', 'tgSessionEnd', 'tgDelegate', 'tgLongToolMs', 'reasoningMode', 'reasoningEffort', 'reasoningPreserve', 'cacheTtl', 'fallbackModels', 'fallbackProfiles', 'favoriteModels', 'favoriteModelsOnly', 'modelMatrix', 'fallbackAuto'];
+export interface PrefHelperDeps {
+    globalConfigPath: string;
+    vault: SecretVault;
+    logger: {
+        warn(msg: string): void;
+    };
+}
+/**
+ * Snapshot the pref keys currently present on `contextMeta`. Structural
+ * typing on the meta keeps this decoupled from the `Context` class.
+ */
+export declare function prefSnapshot(contextMeta: Record<string, unknown>): Record<string, unknown>;
+/** Mutable holder for the serialized-config-write lock. The helpers update
+ *  `lock` in place so callers keep a stable reference across writes (the
+ *  lock is non-poisoning: a failed write resolves the chain but logs).
+ *
+ *  We use a holder object rather than returning the new lock because
+ *  TypeScript flattens `Promise<Promise<void>>` into `Promise<void>`,
+ *  which would make `await helper(...)` yield `void` instead of the new
+ *  lock value. */
+export interface ConfigWriteLockHolder {
+    lock: Promise<void>;
+}
+/**
+ * Unified global config mutation: read → decrypt → mutate → encrypt → write.
+ * All config writes MUST go through this helper so encryption is always
+ * preserved and writes are serialized behind the holder's `lock`.
+ *
+ * Mutates `holder.lock` in place to the new (non-poisoning) chain value.
+ */
+export declare function updateGlobalConfig(deps: PrefHelperDeps, holder: ConfigWriteLockHolder, mutate: (config: Record<string, unknown>) => void, errorLabel: string): Promise<void>;
+/**
+ * Persist pref changes into the global config.json — the SAME keys the TUI
+ * settings picker writes — so a toggle made in the browser survives restarts
+ * and is visible to the CLI/TUI (and vice versa on next boot). Best-effort
+ * and serialized behind the holder's `lock`; failures log but never break
+ * the WS reply.
+ */
+export declare function persistPrefsToConfig(deps: PrefHelperDeps, holder: ConfigWriteLockHolder, payload: Record<string, unknown>): Promise<void>;
+//# sourceMappingURL=pref-helpers.d.ts.map

package/dist/server/pref-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pref-helpers.d.ts","sourceRoot":"","sources":["../../src/server/pref-helpers.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGpD,6EAA6E;AAC7E,eAAO,MAAM,SAAS,YACpB,UAAU,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,MAAM,EACN,eAAe,EACf,OAAO,EACP,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,OAAO,EACP,SAAS,EACT,cAAc,EACd,cAAc,EACd,cAAc,EACd,YAAY,EACZ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,cAAc,CACN,CAAC;AAEX,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM1F;AAED;;;;;;;kBAOkB;AAClB,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,qBAAqB,EAC7B,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EACjD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CA2Lf"}

package/dist/server/prefs-routes.d.ts

@@ -0,0 +1,27 @@
+import type { WebSocket } from 'ws';
+import type { WSClientMessage } from './types.js';
+export interface PrefsRouteHandlers {
+    /** Respond to the WS client with the current pref snapshot. */
+    getPrefs: (ws: WebSocket) => Promise<void>;
+    /**
+     * Merge the supplied pref payload into context.meta, persist the durable
+     * keys to config.json, apply any runtime effects (YOLO toggle, feature-flag
+     * mutation, fallback chain update, AutoCompaction pipeline add/remove,
+     * logger.level), then broadcast the full current snapshot to all clients.
+     */
+    updatePrefs: (ws: WebSocket, payload: Record<string, unknown>) => Promise<void>;
+}
+/**
+ * Chain-of-responsibility dispatcher for the `prefs.*` WS message family.
+ * Returns `true` if the message was handled by this layer (so the caller's
+ * chain short-circuits), `false` if it should fall through to the next layer
+ * or the residual switch.
+ *
+ * Owned prefixes:
+ *   - `prefs.get`
+ *   - `prefs.update`
+ *
+ * Regression-tested by packages/webui/tests/server/dispatcher-routing.test.ts.
+ */
+export declare function handlePrefsRoute(ws: WebSocket, msg: WSClientMessage, handlers: PrefsRouteHandlers): Promise<boolean>;
+//# sourceMappingURL=prefs-routes.d.ts.map

package/dist/server/prefs-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prefs-routes.d.ts","sourceRoot":"","sources":["../../src/server/prefs-routes.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,QAAQ,EAAE,CAAC,EAAE,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,WAAW,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAalB"}

package/dist/server/process-handlers.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Process-registry WebSocket handlers for the WebUI server, extracted from the
+ * `handleMessage` switch in `index.ts` as part of splitting that file (#31).
+ *
+ *   case 'process.list':    return handleProcessList(ws);
+ *   case 'process.kill':    return handleProcessKill(ws, msg.payload);
+ *   case 'process.killAll': return handleProcessKillAll(ws);
+ *
+ * All three reach the registry via a dynamic `@wrongstack/tools` import so the
+ * server starts even when that package is unavailable, and never throw — a
+ * failure is reported back over the socket instead.
+ */
+import type { WebSocket } from 'ws';
+/** Broadcast the tracked-process list; an empty list on any registry failure. */
+export declare function handleProcessList(ws: WebSocket): Promise<void>;
+/** Kill one tracked PID. Rejects invalid payloads and protected processes. */
+export declare function handleProcessKill(ws: WebSocket, payload: unknown): Promise<void>;
+/** Kill every tracked process. */
+export declare function handleProcessKillAll(ws: WebSocket): Promise<void>;
+//# sourceMappingURL=process-handlers.d.ts.map

package/dist/server/process-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-handlers.d.ts","sourceRoot":"","sources":["../../src/server/process-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAIpC,iFAAiF;AACjF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBpE;AAED,8EAA8E;AAC9E,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBtF;AAED,kCAAkC;AAClC,wBAAsB,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAQvE"}

package/dist/server/project-handlers.d.ts

@@ -0,0 +1,53 @@
+import type { WebSocket } from 'ws';
+import type { Context, DefaultSessionStore, MemoryStore, DefaultModeStore, SkillLoader, ToolRegistry } from '@wrongstack/core';
+import type { DefaultTokenCounter } from '@wrongstack/core/infrastructure';
+import type { ConnectedClient } from './types.js';
+import type { ProjectRouteHandlers } from './project-routes.js';
+type Session = Awaited<ReturnType<DefaultSessionStore['create']>>;
+type SessionStartPayload = {
+    sessionId: string;
+    model: string;
+    provider: string;
+    maxContext: number;
+    inputCost: number;
+    outputCost: number;
+    cacheReadCost: number;
+    projectName: string;
+    projectRoot: string;
+    cwd: string;
+    mode: string;
+    contextMode: string;
+};
+type ModelCapabilities = unknown;
+export interface ProjectHandlersContext {
+    globalConfigPath: string;
+    wpaths: {
+        globalRoot: string;
+    };
+    clients: Map<WebSocket, ConnectedClient>;
+    context: Context;
+    modeStore: DefaultModeStore;
+    memoryStore: MemoryStore;
+    skillLoader: SkillLoader | undefined;
+    modelCapabilities: ModelCapabilities;
+    toolRegistry: ToolRegistry;
+    tokenCounter: DefaultTokenCounter;
+    config: {
+        provider: string;
+        model: string;
+    };
+    getModeId: () => string;
+    getProjectRoot: () => string;
+    getSession: () => Session;
+    setProjectRoot: (p: string) => void;
+    setWorkingDir: (p: string) => void;
+    setSession: (s: Session) => void;
+    setSessionStore: (s: DefaultSessionStore) => void;
+    setSessionStartedAt: (t: number) => void;
+    /** Abort + clear any in-flight runLock before switching projects. */
+    abortRunLock: () => void;
+    sessionStartPayload: () => Promise<SessionStartPayload>;
+}
+export declare function createProjectHandlers(ctx: ProjectHandlersContext): ProjectRouteHandlers;
+export {};
+//# sourceMappingURL=project-handlers.d.ts.map

package/dist/server/project-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-handlers.d.ts","sourceRoot":"","sources":["../../src/server/project-handlers.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EACV,OAAO,EACP,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAMhE,KAAK,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClE,KAAK,mBAAmB,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AACF,KAAK,iBAAiB,GAAG,OAAO,CAAC;AAEjC,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,iBAAiB,EAAE,iBAAiB,CAAC;IACrC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5C,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,OAAO,CAAC;IAE1B,cAAc,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IACjC,eAAe,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAClD,mBAAmB,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,qEAAqE;IACrE,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,mBAAmB,EAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACzD;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,sBAAsB,GAAG,oBAAoB,CAiEvF"}

package/dist/server/project-routes.d.ts

@@ -0,0 +1,10 @@
+import type { WebSocket } from 'ws';
+import type { WSClientMessage } from './types.js';
+export interface ProjectRouteHandlers {
+    listProjects: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    addProject: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    selectProject: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    setWorkingDir: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+}
+export declare function handleProjectRoute(ws: WebSocket, msg: WSClientMessage, handlers: ProjectRouteHandlers): Promise<boolean>;
+//# sourceMappingURL=project-routes.d.ts.map

package/dist/server/project-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-routes.d.ts","sourceRoot":"","sources":["../../src/server/project-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,UAAU,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,aAAa,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,eAAe,EACpB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiBlB"}

package/dist/server/projects-manifest.d.ts

@@ -0,0 +1,18 @@
+export interface ProjectEntry {
+    name: string;
+    root: string;
+    slug: string;
+    lastSeen?: string | undefined;
+    createdAt?: string | undefined;
+    /** Working directory of the most recent session (may differ from root). */
+    lastWorkingDir?: string | undefined;
+}
+export interface ProjectsManifest {
+    projects: ProjectEntry[];
+}
+export declare function projectsJsonPath(globalConfigPath: string): string;
+export declare function loadManifest(globalConfigPath: string): Promise<ProjectsManifest>;
+export declare function saveManifest(manifest: ProjectsManifest, globalConfigPath: string): Promise<void>;
+export declare function generateProjectSlug(rootPath: string): string;
+export declare function ensureProjectDataDir(slug: string, globalConfigPath: string): Promise<string>;
+//# sourceMappingURL=projects-manifest.d.ts.map

package/dist/server/projects-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects-manifest.d.ts","sourceRoot":"","sources":["../../src/server/projects-manifest.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAGjE;AAED,wBAAsB,YAAY,CAAC,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQtF;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/server/prompts-handlers.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared prompt-library WebSocket handlers for BOTH the standalone WebUI server
+ * (`packages/webui/src/server/index.ts`) and the CLI's `--webui` embedded server
+ * (`packages/cli/src/webui-server.ts`). One source of truth so the two servers
+ * never drift (the lesson from skills-handlers).
+ *
+ * Each function handles one request→response cycle; callers drop them into their
+ * switch:
+ *
+ *   case 'prompts.search': return handlePromptsSearch(ws, promptsCtx, msg);
+ *
+ * The prompt library is read across three layers (builtin + user + project) by
+ * the injected `PromptLoader`; writes (create/favorite) go to the user layer
+ * with copy-on-write for builtins. Treat synced/builtin content as DATA — these
+ * handlers never execute it; the client inserts a chosen prompt into the chat
+ * input as an ordinary user turn.
+ */
+import type { PromptLoader, PromptUsageStore } from '@wrongstack/core';
+import { send } from './ws-utils.js';
+export interface PromptsContext {
+    /** Backs all prompt ops. Absent ⇒ feature unavailable. */
+    promptLoader: PromptLoader | undefined;
+    /** Records per-slug insert counts (shared with CLI `/prompt recent`). */
+    promptUsage?: PromptUsageStore | undefined;
+}
+export declare function handlePromptsList(ws: WSLike, ctx: PromptsContext): Promise<void>;
+export declare function handlePromptsSearch(ws: WSLike, ctx: PromptsContext, msg: unknown): Promise<void>;
+export declare function handlePromptsContent(ws: WSLike, ctx: PromptsContext, msg: unknown): Promise<void>;
+export declare function handlePromptsFavorite(ws: WSLike, ctx: PromptsContext, msg: unknown): Promise<void>;
+export declare function handlePromptsCreate(ws: WSLike, ctx: PromptsContext, msg: unknown): Promise<void>;
+/** Record that a prompt was inserted (best-effort; feeds CLI `/prompt recent`). */
+export declare function handlePromptsUsed(ws: WSLike, ctx: PromptsContext, msg: unknown): Promise<void>;
+/** Return recently-inserted prompt slugs (most-recent first) for the modal's Recent view. */
+export declare function handlePromptsRecent(ws: WSLike, ctx: PromptsContext): Promise<void>;
+/** Minimal structural type for the ws.send sink (matches `ws` WebSocket). */
+type WSLike = Parameters<typeof send>[0];
+export {};
+//# sourceMappingURL=prompts-handlers.d.ts.map

package/dist/server/prompts-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts-handlers.d.ts","sourceRoot":"","sources":["../../src/server/prompts-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAe,YAAY,EAAE,gBAAgB,EAAkB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAc,IAAI,EAAE,MAAM,eAAe,CAAC;AA+BjD,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC,yEAAyE;IACzE,WAAW,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAC5C;AAiBD,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtF;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAyBf;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpG;AAED,6FAA6F;AAC7F,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAWxF;AAED,6EAA6E;AAC7E,KAAK,MAAM,GAAG,UAAU,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/server/provider-config-io.d.ts

@@ -0,0 +1,15 @@
+import { type ProviderConfig, type SecretVault } from '@wrongstack/core';
+/**
+ * Read the `providers` section from the global config, decrypting
+ * secret-bearing fields. Returns an empty record when the config file
+ * doesn't exist or has no `providers` key.
+ */
+export declare function loadSavedProviders(configPath: string, vault: SecretVault): Promise<Record<string, ProviderConfig>>;
+/**
+ * Write `providers` back into the global config, encrypting secrets first.
+ * Refuses to overwrite a corrupt-but-existing config file (the operator
+ * should fix it manually). When the config file is missing (ENOENT), starts
+ * from an empty object.
+ */
+export declare function saveProviders(configPath: string, vault: SecretVault, providers: Record<string, ProviderConfig>): Promise<void>;
+//# sourceMappingURL=provider-config-io.d.ts.map

package/dist/server/provider-config-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config-io.d.ts","sourceRoot":"","sources":["../../src/server/provider-config-io.ts"],"names":[],"mappings":"AAUA,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAGnG;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAezC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GACxC,OAAO,CAAC,IAAI,CAAC,CAoCf"}

package/dist/server/provider-config-standalone.d.ts

@@ -0,0 +1,13 @@
+import { type ProviderConfig } from '@wrongstack/core';
+/**
+ * Small helper for the standalone WebUI entry point: create a
+ * `{ load, save }` pair from a config path alone (uses the
+ * config-directory-relative `.key` file for the vault). The `--webui`
+ * CLI mode and the standalone server both need to read/write the
+ * `providers` map identically.
+ */
+export declare function createProviderConfigIO(configPath: string): {
+    load: () => Promise<Record<string, ProviderConfig>>;
+    save: (providers: Record<string, ProviderConfig>) => Promise<void>;
+};
+//# sourceMappingURL=provider-config-standalone.d.ts.map

package/dist/server/provider-config-standalone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-config-standalone.d.ts","sourceRoot":"","sources":["../../src/server/provider-config-standalone.ts"],"names":[],"mappings":"AAMA,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAG3E;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM;IAKrD,IAAI;IACJ,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC;EAGnD"}

package/dist/server/provider-handlers.d.ts

@@ -0,0 +1,74 @@
+import type { WebSocket } from 'ws';
+import type { ModelsRegistry, ProviderConfig } from '@wrongstack/core';
+import { type OAuthKind } from '@wrongstack/providers/oauth';
+import type { ConnectedClient, WSServerMessage } from './types.js';
+/**
+ * Wire shape of one saved provider as broadcast over `providers.saved`.
+ * The WebUI's `<ProviderModelsPanel>` consumes this — when
+ * `pickedModelId` / `models` is missing, the panel renders the empty
+ * state.
+ */
+export interface SavedProviderView {
+    id: string;
+    family?: string | undefined;
+    baseUrl?: string | undefined;
+    /** Saved model allowlist, verbatim (undefined / [] both possible). */
+    models?: string[] | undefined;
+    /** First entry of `models`, or undefined when the list is empty/unset. */
+    pickedModelId?: string | undefined;
+    apiKeys: Array<{
+        label: string;
+        maskedKey: string;
+        isActive: boolean;
+        createdAt: string;
+    }>;
+}
+/**
+ * Canonical projection from in-memory `ProviderConfig` to the
+ * `providers.saved` wire shape. Pure (no I/O) so it's unit-tested in
+ * isolation — see `tests/server/provider-handlers-projection.test.ts`.
+ *
+ * Secrets never leave: every key is run through `maskedKey` before it
+ * reaches the wire.
+ */
+export declare function projectSavedProviders(providers: Record<string, ProviderConfig>): SavedProviderView[];
+export interface ProviderHandlerDeps {
+    globalConfigPath: string;
+    vault: import('@wrongstack/core').SecretVault;
+    /** Shared config write lock — serialized via chained promises */
+    setConfigWriteLock: (lock: Promise<void>) => void;
+    getConfigWriteLock: () => Promise<void>;
+    /** Broadcast a message to all connected WebUI clients */
+    broadcast: (clients: Map<WebSocket, ConnectedClient>, msg: WSServerMessage) => void;
+    /** Connected WebUI clients map */
+    clients: Map<WebSocket, ConnectedClient>;
+    /** Used by the ChatGPT OAuth flow's tier-2 model lookup (best-effort). */
+    modelsRegistry?: ModelsRegistry | undefined;
+}
+export declare function createProviderHandlers(deps: ProviderHandlerDeps): {
+    handleKeyUpsert: (ws: WebSocket, providerId: string, label: string, apiKey: string) => Promise<void>;
+    handleKeyDelete: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
+    handleKeySetActive: (ws: WebSocket, providerId: string, label: string) => Promise<void>;
+    handleProviderAdd: (ws: WebSocket, payload: {
+        id: string;
+        family: string;
+        baseUrl?: string | undefined;
+        apiKey?: string | undefined;
+    }) => Promise<void>;
+    handleProviderRemove: (ws: WebSocket, providerId: string) => Promise<void>;
+    handleProviderClearModels: (ws: WebSocket, providerId: string) => Promise<void>;
+    handleProviderUndoClear: (ws: WebSocket, providerId: string, previousModels: string[]) => Promise<void>;
+    handleProviderUpdate: (ws: WebSocket, payload: {
+        id: string;
+        family?: string | undefined;
+        baseUrl?: string | undefined;
+        envVars?: string[] | undefined;
+        models?: string[] | undefined;
+    }) => Promise<void>;
+    handleProviderProbe: (ws: WebSocket, providerId: string, timeoutMs?: number) => Promise<void>;
+    handleOAuthStart: (ws: WebSocket, kind: OAuthKind) => Promise<void>;
+    handleOAuthCode: (ws: WebSocket, kind: OAuthKind, input: string) => Promise<void>;
+    handleOAuthCancel: (ws: WebSocket, kind: OAuthKind) => void;
+    loadConfigProviders: () => Promise<Record<string, ProviderConfig>>;
+};
+//# sourceMappingURL=provider-handlers.d.ts.map

package/dist/server/provider-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-handlers.d.ts","sourceRoot":"","sources":["../../src/server/provider-handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvE,OAAO,EAEL,KAAK,SAAS,EAGf,MAAM,6BAA6B,CAAC;AAcrC,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGnE;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,OAAO,EAAE,KAAK,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GACxC,iBAAiB,EAAE,CAoBrB;AAKD,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,OAAO,kBAAkB,EAAE,WAAW,CAAC;IAC9C,iEAAiE;IACjE,kBAAkB,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClD,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,yDAAyD;IACzD,SAAS,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,eAAe,KAAK,IAAI,CAAC;IACpF,kCAAkC;IAClC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACzC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB;0BAyB3B,SAAS,cAAc,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;0BAc5E,SAAS,cAAc,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;6BAczD,SAAS,cAAc,MAAM,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;4BAc7D,SAAS,WAAW;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,KAAG,OAAO,CAAC,IAAI,CAAC;+BAiB1H,SAAS,cAAc,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;oCAuBxC,SAAS,cAAc,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;kCAmBpF,SAAS,cACD,MAAM,kBACF,MAAM,EAAE,KACvB,OAAO,CAAC,IAAI,CAAC;+BAmBV,SAAS,WACJ;QACP,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;KAC/B,KACA,OAAO,CAAC,IAAI,CAAC;8BA0BV,SAAS,cACD,MAAM,cACN,MAAM,KACjB,OAAO,CAAC,IAAI,CAAC;2BAgFoB,SAAS,QAAQ,SAAS,KAAG,OAAO,CAAC,IAAI,CAAC;0BA4C3C,SAAS,QAAQ,SAAS,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;4BAoB7D,SAAS,QAAQ,SAAS,KAAG,IAAI;+BArU1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;EA0V9E"}

package/dist/server/provider-keys.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pure provider/API-key record transforms for the WebUI server's `key.*` and
+ * `provider.*` WebSocket handlers.
+ *
+ * These operate on an in-memory `providers` record (the decrypted
+ * `config.providers` map) and return a `{ ok, message }` result mirroring the
+ * status string the handler sends back to the client. All persistence
+ * (load/decrypt, encrypt/atomic-write) and WS messaging stays in `index.ts` —
+ * keeping this layer pure means the security-sensitive key bookkeeping (which
+ * key is active, when a provider is dropped, how legacy single-key configs are
+ * normalized) is unit-testable without a vault or a socket.
+ *
+ * Extracted from `index.ts`; transforms mutate the passed record in place, the
+ * same way the original handlers did before calling `saveProviders`.
+ */
+import type { ProviderApiKey, ProviderConfig } from '@wrongstack/core';
+export type ProvidersRecord = Record<string, ProviderConfig>;
+export interface KeyOpResult {
+    ok: boolean;
+    message: string;
+}
+/**
+ * Normalize a provider's keys to the array form, upgrading a legacy single
+ * `apiKey` string to a one-element `[{ label: 'default', ... }]` list. Returns
+ * fresh copies so callers can mutate without aliasing the stored config.
+ */
+export declare function normalizeKeys(cfg: ProviderConfig): ProviderApiKey[];
+/**
+ * Write a normalized key list back onto a provider config: drop all key fields
+ * when empty, otherwise sync `apiKeys` and re-point `activeKey` if it no longer
+ * names a present key. Does NOT mirror the plaintext key to the legacy `apiKey`
+ * field — that would leak the secret on accidental serialization. Consumers
+ * that need the real key should read from `apiKeys[]` directly.
+ */
+export declare function writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[]): void;
+/** Mask a secret for display: `••••` for short keys, `abcd…wxyz` otherwise. */
+export declare function maskedKey(key: string | undefined): string;
+/** Add or replace a labeled key for a provider, creating the provider if new. */
+export declare function upsertKey(providers: ProvidersRecord, providerId: string, label: string, apiKey: string, nowIso: string): KeyOpResult;
+/** Remove a labeled key; drops the provider entirely when its last key goes. */
+export declare function deleteKey(providers: ProvidersRecord, providerId: string, label: string): KeyOpResult;
+/** Point a provider's active key at the given label. */
+export declare function setActiveKey(providers: ProvidersRecord, providerId: string, label: string): KeyOpResult;
+/** Register a brand-new provider (optionally with an initial `default` key). */
+export declare function addProvider(providers: ProvidersRecord, payload: {
+    id: string;
+    family: string;
+    baseUrl?: string | undefined;
+    apiKey?: string | undefined;
+}, nowIso: string): KeyOpResult;
+/** Remove an entire provider and all its keys. */
+export declare function removeProvider(providers: ProvidersRecord, providerId: string): KeyOpResult;
+//# sourceMappingURL=provider-keys.d.ts.map

package/dist/server/provider-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-keys.d.ts","sourceRoot":"","sources":["../../src/server/provider-keys.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,EAAE,CAQnE;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAc/E;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAIzD;AAED,iFAAiF;AACjF,wBAAgB,SAAS,CACvB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,WAAW,CAab;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CACvB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,WAAW,CAcb;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAC1B,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,GACZ,WAAW,CASb;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAClG,MAAM,EAAE,MAAM,GACb,WAAW,CAkBb;AAED,kDAAkD;AAClD,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,WAAW,CAM1F"}

package/dist/server/provider-routes.d.ts

@@ -0,0 +1,13 @@
+import type { WebSocket } from 'ws';
+import type { createProviderHandlers } from './provider-handlers.js';
+import type { WSClientMessage } from './types.js';
+export interface ProviderRouteHandlers {
+    listProviders: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    listSavedProviders: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    listProviderModels: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    switchModel: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    refineModel: (ws: WebSocket, msg: WSClientMessage) => Promise<void>;
+    providerHandlers: ReturnType<typeof createProviderHandlers>;
+}
+export declare function handleProviderRoute(ws: WebSocket, msg: WSClientMessage, routes: ProviderRouteHandlers): Promise<boolean>;
+//# sourceMappingURL=provider-routes.d.ts.map

package/dist/server/provider-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-routes.d.ts","sourceRoot":"","sources":["../../src/server/provider-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAGlD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,kBAAkB,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,WAAW,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,WAAW,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,gBAAgB,EAAE,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAC;CAC7D;AAuCD,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,qBAAqB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAgJlB"}

package/dist/server/provider-store.d.ts

@@ -0,0 +1,26 @@
+import type { DefaultSecretVault } from '@wrongstack/core';
+import type { ProviderApiKey, ProviderConfig } from '@wrongstack/core';
+export interface ProviderStoreDeps {
+    globalConfigPath: string;
+    vault: DefaultSecretVault;
+}
+/**
+ * Serializes concurrent config writes to prevent races between model.switch
+ * and key.add/key.update handlers that both read-modify-write globalConfigPath.
+ */
+export declare function createConfigWriteLock(): {
+    readonly current: Promise<void>;
+    acquire(): {
+        prev: Promise<void>;
+        release: () => void;
+    };
+};
+export interface ProviderStore {
+    load(): Promise<Record<string, ProviderConfig>>;
+    save(providers: Record<string, ProviderConfig>): Promise<void>;
+    normalizeKeys(cfg: ProviderConfig): ProviderApiKey[];
+    writeKeysBack(cfg: ProviderConfig, keys: ProviderApiKey[]): void;
+    maskedKey(key: string | undefined): string;
+}
+export declare function createProviderStore(deps: ProviderStoreDeps): ProviderStore;
+//# sourceMappingURL=provider-store.d.ts.map

package/dist/server/provider-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-store.d.ts","sourceRoot":"","sources":["../../src/server/provider-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB;;;;uBAMZ,IAAI;;EAK5B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC;IACrD,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACjE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;CAC5C;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CAyE1E"}