@cleocode/core 2026.4.57 → 2026.4.59

package/dist/store/agent-registry-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-registry-accessor.js","sourceRoot":"","sources":["../../src/store/agent-registry-accessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAE7F,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhD,MAAM,EAAE,YAAY,EAAE,GAAG,QAAQ,CAAC,aAAa,CAE9C,CAAC;AAEF,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAE9E,6BAA6B;AAC7B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;GAOG;AACH,SAAS,cAAc;IACrB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;IAEnD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAC;QAC5C,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gCAAgC;IAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,iDAAiD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAC5F,uBAAuB,OAAO,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,kBAAkB,OAAO,+BAA+B,kBAAkB,eAAe,GAAG,CAAC,MAAM,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAqCD,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,GAAuB;IAC9C,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,oBAAoB,EAAE,GAAG,CAAC,qBAAqB;QAC/C,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,GAAe;IACtC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,iFAAiF;QACjF,iEAAiE;QACjE,iEAAiE;QACjE,MAAM,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACvF,UAAU,EAAE,GAAG,CAAC,YAAY;QAC5B,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,WAAW,EAAE,GAAG,CAAC,YAA8C;QAC/D,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAa;QACtD,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAa;QAC1C,aAAa,EAAE,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAqC;QACjF,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAoB;QACpE,QAAQ,EAAE,GAAG,CAAC,SAAS,KAAK,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC1F,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACxD,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,wBAAwB,CAC/B,QAAoB,EACpB,MAAiC;IAEjC,OAAO;QACL,GAAG,eAAe,CAAC,QAAQ,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;KACpD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E;;;;;;GAMG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,yBAAyB,EAAE,CAAC;IAC3C,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,EAAE,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACpC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CACzB,EAAgB,EAChB,SAAiB,EACjB,YAAsB,EACtB,MAAgB;IAEhB,EAAE,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/E,EAAE,CAAC,OAAO,CAAC,6CAA6C,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,GAAG,CAElE,CAAC;QACd,IAAI,MAAM,EAAE,CAAC;YACX,EAAE,CAAC,OAAO,CACR,kFAAkF,CACnF,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,KAAK,CAEhE,CAAC;QACd,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC,GAAG,CACrF,SAAS,EACT,QAAQ,CAAC,EAAE,CACZ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,WAAW,CACzB,WAAmB,EACnB,OAAe,EACf,IAAkC;IAElC,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC;IAEnD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,OAAO,CAE3E,CAAC;QAEd,MAAM,MAAM,GAAG,SAAS;aACrB,OAAO,CAAC,qDAAqD,CAAC;aAC9D,GAAG,CAAC,OAAO,CAAmC,CAAC;QAElD,4DAA4D;QAC5D,IAAI,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CACV,iFAAiF,OAAO,KAAK;gBAC3F,sEAAsE,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,+DAA+D;YAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjD,OAAO,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,mFAAmF;QACnF,MAAM,YAAY,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,OAAO,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,IAA6D;IAE7D,MAAM,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,KAAK,CAAC;IACnD,MAAM,eAAe,GAAG,IAAI,EAAE,eAAe,IAAI,KAAK,CAAC;IAEvD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,QAAQ;aACvB,OAAO,CAAC,wCAAwC,CAAC;aACjD,GAAG,EAA6B,CAAC;QAEpC,MAAM,OAAO,GAAG,SAAS;aACtB,OAAO,CAAC,kCAAkC,CAAC;aAC3C,GAAG,EAAqC,CAAC;QAE5C,iEAAiE;QACjE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;QACrD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,MAAM,GAA+B,EAAE,CAAC;QAE9C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,aAAa,EAAE,CAAC;gBAClB,uEAAuE;gBACvE,MAAM,YAAY,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;YAChE,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;oBAAE,SAAS;gBACpD,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,IAAsD;IAEtD,wBAAwB,EAAE,CAAC;IAC3B,eAAe,CAAC,WAAW,CAAC,CAAC;IAE7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpD,oCAAoC;IACpC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,YAAY,CAAC;QAC9B,UAAU;QACV,UAAU;QACV,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;IACH,8CAA8C;IAC9C,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEnD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ;aACtB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAA+B,CAAC;QAEnD,IAAI,SAAiB,CAAC;QAEtB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAChC,QAAQ;iBACL,OAAO,CACN;;;gFAGsE,CACvE;iBACA,GAAG,CACF,SAAS,EACT,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,IAAI,QAAQ,EAC/B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3B,IAAI,CAAC,aAAa,IAAI,MAAM,EAC5B,eAAe,EACf,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,cAAc,IAAI,IAAI,EAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,EACpC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACrB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/E,KAAK,EACL,KAAK,CACN,CAAC;YACJ,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;YACxB,wDAAwD;YACxD,QAAQ;iBACL,OAAO,CACN;;kFAEwE,CACzE;iBACA,GAAG,CACF,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,cAAc,IAAI,QAAQ,EAC/B,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,EACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAC3B,IAAI,CAAC,aAAa,IAAI,MAAM,EAC5B,eAAe,EACf,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,cAAc,IAAI,IAAI,EAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,EACpC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EACrB,KAAK,EACL,IAAI,CAAC,OAAO,CACb,CAAC;YACJ,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,sDAAsD;IACtD,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,SAAS;aAC1B,OAAO,CAAC,qEAAqE,CAAC;aAC9E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAsD,CAAC;QAE1E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;iBACN,OAAO,CACN;8CACoC,CACrC;iBACA,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,WAAW,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACrC,wCAAwC;YACxC,SAAS;iBACN,OAAO,CAAC,+EAA+E,CAAC;iBACxF,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,gEAAgE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,OAAe,EACf,IAAqE;IAErE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,SAAS;aAC1B,OAAO,CAAC,qEAAqE,CAAC;aAC9E,GAAG,CAAC,OAAO,CAAsD,CAAC;QAErE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,SAAS;iBACN,OAAO,CACN;wCAC8B,CAC/B;iBACA,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,CAAC,CAAC;QAClF,CAAC;aAAM,IAAI,WAAW,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACrC,SAAS;iBACN,OAAO,CACN,oHAAoH,CACrH;iBACA,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,oBAAoB,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;QAClF,CAAC;QACD,4BAA4B;IAC9B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB,EAAE,OAAe;IACzE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS;aAClB,OAAO,CAAC,4DAA4D,CAAC;aACrE,GAAG,CAAC,OAAO,CAAqC,CAAC;QAEpD,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAEvB,SAAS,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAe;IACrE,MAAM,SAAS,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS;aAClB,OAAO,CAAC,qDAAqD,CAAC;aAC9D,GAAG,CAAC,OAAO,CAAmC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,OAAO,qBAAqB;IAOH;IAN7B;;;;;OAKG;IACH,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IAEpD;;;;;OAKG;IACK,SAAS;QACf,wBAAwB,EAAE,CAAC;QAC3B,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,QAAQ,CACZ,UAA4D;QAE5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,IAAkC;QAC3D,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,MAAwB;QACvC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GACR,MAAM,EAAE,MAAM,KAAK,SAAS;gBAC1B,CAAC,CAAE,QAAQ;qBACN,OAAO,CAAC,4DAA4D,CAAC;qBACrE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAA6B;gBAC3D,CAAC,CAAE,QAAQ;qBACN,OAAO,CAAC,wCAAwC,CAAC;qBACjD,GAAG,EAA8B,CAAC;YAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAM,CACV,OAAe,EACf,OAAgE;QAEhE,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAa,CAAC,gBAAgB,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAc,CAAC,KAAK,CAAC,CAAC;YAElC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACrC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,+BAA+B;gBAC/B,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;gBACnC,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,QAAQ;iBACL,OAAO,CAAC,qBAAqB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;iBAClE,GAAG,CAAC,GAAI,MAAwC,CAAC,CAAC;YAErD,yDAAyD;YACzD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvE,MAAM,QAAQ,GAAG,QAAQ;qBACtB,OAAO,CAAC,0CAA0C,CAAC;qBACnD,GAAG,CAAC,OAAO,CAA+B,CAAC;gBAC9C,IAAI,QAAQ,EAAE,CAAC;oBACb,kBAAkB,CAChB,QAAQ,EACR,QAAQ,CAAC,EAAE,EACX,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,EAC7C,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAClC,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe;QAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS;iBAClB,OAAO,CAAC,4DAA4D,CAAC;iBACrE,GAAG,CAAC,OAAO,CAAqC,CAAC;YACpD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,SAAS;iBACN,OAAO,CAAC,8DAA8D,CAAC;iBACvE,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,IAA0B;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,GAAG,CAAC,OAAO,CAE5E,CAAC;YACd,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACjB,yEAAyE;gBACzE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,SAAS;yBAClB,OAAO,CAAC,4EAA4E,CAAC;yBACrF,GAAG,CAAC,OAAO,CAAqC,CAAC;oBACpD,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,IAAI,KAAK,CACb,UAAU,OAAO,yDAAyD;4BACxE,2DAA2D,CAC9D,CAAC;oBACJ,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC;YACH,CAAC;YAED,QAAQ,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,CAAC,UAAU,WAAW,OAAO,aAAa,EAAE;YACpF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE;gBAC5C,YAAY,EAAE,OAAO;aACtB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACpC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAE1E,qCAAqC;QACrC,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ;iBACL,OAAO,CACN,iGAAiG,CAClG;iBACA,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,8EAA8E;YAC9E,MAAM,WAAW,GAAG,SAAS;iBAC1B,OAAO,CACN,oGAAoG,CACrG;iBACA,GAAG,EAAyE,CAAC;YAEhF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,QAAQ;qBACtB,OAAO,CAAC,2DAA2D,CAAC;qBACpE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAA2B,CAAC;gBAC/C,IAAI,QAAQ;oBAAE,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAED,yEAAyE;YACzE,MAAM,GAAG,GAAG,QAAQ;iBACjB,OAAO,CACN,8FAA8F,CAC/F;iBACA,GAAG,EAA4B,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEpD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ;iBACL,OAAO,CAAC,uEAAuE,CAAC;iBAChF,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,SAAS;iBACN,OAAO,CAAC,mEAAmE,CAAC;iBAC5E,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;CACF"}

package/dist/store/api-key-kdf.js

@@ -0,0 +1,84 @@
+/**
+ * API key derivation functions for the T310 conduit/signaldock separation.
+ *
+ * New KDF (T310):
+ *   HMAC-SHA256(machineKey || globalSalt, utf8(agentId)) → 32 bytes
+ *
+ * Legacy KDF (pre-T310, migration use only):
+ *   HMAC-SHA256(machineKey, utf8(projectPath)) → 32 bytes
+ *
+ * The new scheme binds each key to machine + per-machine salt + agent identity,
+ * replacing the project-path scheme that does not generalise to global-tier identity.
+ *
+ * T355 will compose these primitives with `getGlobalSalt()` (T348).
+ * This module has NO runtime dependency on global-salt.ts.
+ *
+ * @task T349
+ * @epic T310
+ * @see ADR-037 §5 — KDF contract
+ * @module store/api-key-kdf
+ */
+import { createHmac } from 'node:crypto';
+/**
+ * Derives a 32-byte API key using the new T310 KDF:
+ *
+ *   HMAC-SHA256(machineKey || globalSalt, utf8(agentId)) → 32 bytes
+ *
+ * Binds the key to machine + per-machine salt + agent identity. Replaces
+ * the pre-T310 `HMAC-SHA256(machineKey, projectPath)` scheme, which does
+ * not generalise to global-tier identity.
+ *
+ * @param input - The derivation input parameters.
+ * @returns A 32-byte Buffer containing the derived API key.
+ * @throws {Error} If machineKey is empty, globalSalt is not exactly 32 bytes,
+ *   or agentId is empty.
+ *
+ * @task T349
+ * @epic T310
+ */
+export function deriveApiKey(input) {
+    if (input.machineKey.length === 0) {
+        throw new Error('deriveApiKey: machineKey cannot be empty');
+    }
+    if (input.globalSalt.length !== 32) {
+        throw new Error(`deriveApiKey: globalSalt must be exactly 32 bytes, got ${input.globalSalt.length}`);
+    }
+    if (input.agentId.length === 0) {
+        throw new Error('deriveApiKey: agentId cannot be empty');
+    }
+    const key = Buffer.concat([input.machineKey, input.globalSalt]);
+    const hmac = createHmac('sha256', key);
+    hmac.update(input.agentId, 'utf8');
+    return hmac.digest();
+}
+/**
+ * Derives the LEGACY pre-T310 API key using the old project-path scheme:
+ *
+ *   HMAC-SHA256(machineKey, utf8(projectPath)) → 32 bytes
+ *
+ * Used ONLY by the migration executor (T358) to identify old keys that need
+ * invalidation. Not for ongoing use after T310.
+ *
+ * @param machineKey - Machine-local key from the existing machine-key mechanism.
+ * @param projectPath - Project path used as the HMAC message in the old scheme.
+ * @returns A 32-byte Buffer containing the derived legacy key.
+ * @throws {Error} If machineKey is empty or projectPath is empty.
+ *
+ * @deprecated Use deriveApiKey() for all new code. This exists for migration
+ *   identification only (T358). Any new caller is a bug.
+ *
+ * @task T349
+ * @epic T310
+ */
+export function deriveLegacyProjectKey(machineKey, projectPath) {
+    if (machineKey.length === 0) {
+        throw new Error('deriveLegacyProjectKey: machineKey cannot be empty');
+    }
+    if (projectPath.length === 0) {
+        throw new Error('deriveLegacyProjectKey: projectPath cannot be empty');
+    }
+    const hmac = createHmac('sha256', machineKey);
+    hmac.update(projectPath, 'utf8');
+    return hmac.digest();
+}
+//# sourceMappingURL=api-key-kdf.js.map

package/dist/store/api-key-kdf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-kdf.js","sourceRoot":"","sources":["../../src/store/api-key-kdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAiBzC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB;IACnD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,0DAA0D,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAkB,EAAE,WAAmB;IAC5E,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;AACvB,CAAC"}

package/dist/store/atomic.js

@@ -0,0 +1,167 @@
+/**
+ * Atomic file write operations using write-file-atomic.
+ * Ensures writes are crash-safe: temp file -> validate -> rename.
+ * @epic T4454
+ * @task T4457
+ * @task T4721 - Added atomic database operations
+ */
+import { existsSync } from 'node:fs';
+import { mkdir, readFile, rename, unlink } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { ExitCode } from '@cleocode/contracts';
+import writeFileAtomic from 'write-file-atomic';
+import { CleoError } from '../errors.js';
+/**
+ * Write data to a file atomically.
+ * Creates parent directories if they don't exist.
+ * Uses write-file-atomic for crash-safe writes (temp file -> rename).
+ */
+export async function atomicWrite(filePath, data, options) {
+    try {
+        await mkdir(dirname(filePath), { recursive: true });
+        await writeFileAtomic(filePath, data, {
+            encoding: options?.encoding ?? 'utf8',
+            mode: options?.mode,
+        });
+    }
+    catch (err) {
+        throw new CleoError(ExitCode.FILE_ERROR, `Atomic write failed: ${filePath}`, { cause: err });
+    }
+}
+/**
+ * Read a file and return its contents.
+ * Returns null if the file does not exist.
+ */
+export async function safeReadFile(filePath) {
+    try {
+        return await readFile(filePath, 'utf8');
+    }
+    catch (err) {
+        if (err instanceof Error && 'code' in err && err.code === 'ENOENT') {
+            return null;
+        }
+        throw new CleoError(ExitCode.FILE_ERROR, `Failed to read: ${filePath}`, { cause: err });
+    }
+}
+/**
+ * Write JSON data atomically with consistent formatting.
+ */
+export async function atomicWriteJson(filePath, data, options) {
+    const json = JSON.stringify(data, null, options?.indent ?? 2) + '\n';
+    await atomicWrite(filePath, json);
+}
+/**
+ * Perform atomic database migration using rename operations.
+ *
+ * Pattern:
+ *   1. Write new database to temp file (tasks.db.new)
+ *   2. Validate temp database integrity
+ *   3. Rename existing tasks.db → tasks.db.backup
+ *   4. Rename temp → tasks.db (atomic)
+ *   5. Only delete backup on success
+ *
+ * @param dbPath - Path to the database file (e.g., tasks.db)
+ * @param tempPath - Path to temporary database (e.g., tasks.db.new)
+ * @param validateFn - Async function to validate the temp database
+ * @returns Result with paths and success status
+ */
+export async function atomicDatabaseMigration(dbPath, tempPath, validateFn) {
+    const backupPath = `${dbPath}.backup`;
+    try {
+        // Step 1: Validate temp database exists
+        if (!existsSync(tempPath)) {
+            throw new Error(`Temp database not found: ${tempPath}`);
+        }
+        // Step 2: Validate the temp database integrity
+        const isValid = await validateFn(tempPath);
+        if (!isValid) {
+            throw new Error(`Temp database validation failed: ${tempPath}`);
+        }
+        // Step 3: If existing database exists, rename to backup
+        if (existsSync(dbPath)) {
+            await rename(dbPath, backupPath);
+        }
+        // Step 4: Atomically rename temp to final (atomic on POSIX systems)
+        await rename(tempPath, dbPath);
+        return {
+            success: true,
+            tempPath,
+            backupPath: existsSync(backupPath) ? backupPath : undefined,
+        };
+    }
+    catch (err) {
+        return {
+            success: false,
+            tempPath,
+            backupPath: existsSync(backupPath) ? backupPath : undefined,
+            error: String(err),
+        };
+    }
+}
+/**
+ * Restore database from backup after failed migration.
+ *
+ * @param dbPath - Path to the database file
+ * @param backupPath - Path to the backup file
+ * @returns true if restore succeeded
+ */
+export async function restoreDatabaseFromBackup(dbPath, backupPath) {
+    try {
+        if (!existsSync(backupPath)) {
+            return false;
+        }
+        // If a partial database exists, remove it
+        if (existsSync(dbPath)) {
+            await unlink(dbPath);
+        }
+        // Restore from backup
+        await rename(backupPath, dbPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Clean up migration artifacts after successful migration.
+ *
+ * @param backupPath - Path to backup file to delete
+ * @returns true if cleanup succeeded
+ */
+export async function cleanupMigrationArtifacts(backupPath) {
+    try {
+        if (existsSync(backupPath)) {
+            await unlink(backupPath);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate SQLite database integrity by attempting to open it.
+ *
+ * @param dbPath - Path to database file
+ * @returns true if database is valid
+ */
+export async function validateSqliteDatabase(dbPath) {
+    try {
+        const { createRequire } = await import('node:module');
+        const _req = createRequire(import.meta.url);
+        const { DatabaseSync } = _req('node:sqlite');
+        const db = new DatabaseSync(dbPath, { readOnly: true });
+        const integrityRow = db.prepare('PRAGMA integrity_check').get();
+        const isOk = integrityRow?.integrity_check === 'ok';
+        const tableRow = db
+            .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='tasks'")
+            .get();
+        const hasTasksTable = !!tableRow;
+        db.close();
+        return isOk && hasTasksTable;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=atomic.js.map

package/dist/store/atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic.js","sourceRoot":"","sources":["../../src/store/atomic.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,IAAY,EACZ,OAAsD;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE;YACpC,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,MAAM;YACrC,IAAI,EAAE,OAAO,EAAE,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,IAAa,EACb,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACrE,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,QAAgB,EAChB,UAA8C;IAE9C,MAAM,UAAU,GAAG,GAAG,MAAM,SAAS,CAAC;IAEtC,IAAI,CAAC;QACH,wCAAwC;QACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,+CAA+C;QAC/C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,wDAAwD;QACxD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC;QAED,oEAAoE;QACpE,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE/B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ;YACR,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YAC3D,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,UAAkB;IAElB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,0CAA0C;QAC1C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;QAED,sBAAsB;QACtB,MAAM,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,UAAkB;IAChE,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAAc;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,aAAa,CAAiC,CAAC;QAC7E,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,GAAG,EAEhD,CAAC;QACd,MAAM,IAAI,GAAG,YAAY,EAAE,eAAe,KAAK,IAAI,CAAC;QACpD,MAAM,QAAQ,GAAG,EAAE;aAChB,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,EAAE,CAAC;QACT,MAAM,aAAa,GAAG,CAAC,CAAC,QAAQ,CAAC;QACjC,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,IAAI,aAAa,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/store/backup-crypto.js

@@ -0,0 +1,184 @@
+/**
+ * Encryption/decryption helpers for `.enc.cleobundle.tar.gz` bundles.
+ *
+ * Uses AES-256-GCM with a scrypt-derived key (Node built-in `node:crypto` only;
+ * no native bindings). scrypt is memory-hard and NIST-approved. Argon2id (PHC
+ * winner, spec §7.1) was the original target but adds a native binding
+ * dependency that violates ADR-010. This module documents the trade-off:
+ * scrypt with N=2^15 provides equivalent interactive-session security and full
+ * cross-platform portability.
+ *
+ * Binary layout of an encrypted bundle:
+ *   [8]  magic bytes "CLEOENC1" (0x43 0x4C 0x45 0x4F 0x45 0x4E 0x43 0x31)
+ *   [1]  format version (0x01)
+ *   [7]  reserved (zero-filled)
+ *   [32] scrypt salt (random, per-bundle)
+ *   [12] AES-256-GCM nonce (random, per-bundle)
+ *   [N]  ciphertext (the tar.gz bytes)
+ *   [16] AES-256-GCM authentication tag
+ *
+ * Total fixed overhead: 76 bytes header + 16 bytes auth tag = 92 bytes.
+ *
+ * @task T345
+ * @epic T311
+ * @see ADR-038 §5 — opt-in encrypted backups for portable export/import
+ * @module store/backup-crypto
+ */
+import crypto from 'node:crypto';
+/** Magic bytes that identify a CLEO encrypted bundle: ASCII "CLEOENC1". */
+const MAGIC = Buffer.from('CLEOENC1', 'utf8'); // 8 bytes
+/** Current format version byte written at offset 8. */
+const VERSION = 0x01; // 1 byte
+/** Reserved bytes at offsets 9–15 (zero-filled). */
+const RESERVED = Buffer.alloc(7); // 7 bytes
+/** Byte length of the per-bundle scrypt salt (offset 16). */
+const SALT_SIZE = 32;
+/** Byte length of the AES-256-GCM nonce (offset 48). */
+const NONCE_SIZE = 12;
+/** AES key length in bytes (AES-256). */
+const KEY_SIZE = 32;
+/** AES-256-GCM authentication tag length in bytes. */
+const AUTH_TAG_SIZE = 16;
+/**
+ * scrypt CPU/memory cost parameter (N = 2^15 = 32768).
+ * Provides ~64 MB memory hardness per derivation — equivalent to OWASP
+ * interactive-login recommendation when Argon2id is unavailable.
+ */
+const SCRYPT_N = 2 ** 15;
+/** scrypt block size parameter. */
+const SCRYPT_R = 8;
+/** scrypt parallelism parameter. */
+const SCRYPT_P = 1;
+/** Derived key length in bytes — must equal KEY_SIZE. */
+const SCRYPT_KEY_LEN = KEY_SIZE;
+/**
+ * Minimum valid byte length of an encrypted bundle.
+ * = magic(8) + version(1) + reserved(7) + salt(32) + nonce(12) + auth-tag(16)
+ */
+const MIN_ENCRYPTED_LENGTH = 8 + 1 + 7 + SALT_SIZE + NONCE_SIZE + AUTH_TAG_SIZE;
+/**
+ * Derives a 32-byte AES key from a user passphrase and a per-bundle salt
+ * using Node's built-in scrypt (RFC 7914).
+ *
+ * Parameters are chosen to match OWASP Argon2id interactive-login guidance
+ * adapted for scrypt: ~64 MB memory, single-threaded, ~100 ms on a 2024 laptop.
+ *
+ * @param passphrase - UTF-8 user passphrase (must be non-empty).
+ * @param salt - 32-byte random per-bundle salt.
+ * @returns 32-byte Buffer suitable for AES-256-GCM.
+ *
+ * @task T345
+ * @epic T311
+ */
+function deriveKey(passphrase, salt) {
+    return crypto.scryptSync(passphrase, salt, SCRYPT_KEY_LEN, {
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+        // maxmem guard: 128 * N * r * 2 bytes — prevents accidental OOM
+        maxmem: 128 * SCRYPT_N * SCRYPT_R * 2,
+    });
+}
+/**
+ * Encrypts a plaintext tarball buffer with AES-256-GCM.
+ *
+ * A fresh random 32-byte salt and 12-byte nonce are generated for every call,
+ * so two encryptions of the same plaintext produce different ciphertexts.
+ *
+ * Output binary layout:
+ * ```
+ * Offset  Length  Field
+ * 0        8      Magic bytes "CLEOENC1"
+ * 8        1      Format version 0x01
+ * 9        7      Reserved (zeros)
+ * 16       32     scrypt salt
+ * 48       12     GCM nonce
+ * 60       N      Ciphertext
+ * 60+N     16     GCM auth tag
+ * ```
+ *
+ * @param plaintext  - Raw `.cleobundle.tar.gz` bytes to encrypt.
+ * @param passphrase - User-supplied passphrase (must be non-empty).
+ * @returns Encrypted bundle bytes ready to write as `.enc.cleobundle.tar.gz`.
+ * @throws {Error} If `passphrase` is empty.
+ *
+ * @task T345
+ * @epic T311
+ */
+export function encryptBundle(plaintext, passphrase) {
+    if (passphrase.length === 0) {
+        throw new Error('encryptBundle: passphrase cannot be empty');
+    }
+    const salt = crypto.randomBytes(SALT_SIZE);
+    const nonce = crypto.randomBytes(NONCE_SIZE);
+    const key = deriveKey(passphrase, salt);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([MAGIC, Buffer.from([VERSION]), RESERVED, salt, nonce, ciphertext, authTag]);
+}
+/**
+ * Decrypts an `.enc.cleobundle.tar.gz` payload back to its original tar.gz bytes.
+ *
+ * Validates magic bytes, format version, and the AES-256-GCM authentication
+ * tag. Any mismatch throws descriptively so callers can map to the correct
+ * exit code (E_BUNDLE_DECRYPT = 70).
+ *
+ * @param encrypted  - Full encrypted bundle bytes (as read from disk).
+ * @param passphrase - User-supplied passphrase.
+ * @returns Decrypted tar.gz bytes.
+ * @throws {Error} `"decryptBundle: payload too short"` — buffer smaller than minimum.
+ * @throws {Error} `"decryptBundle: magic mismatch (not a cleo encrypted bundle)"` — invalid magic.
+ * @throws {Error} `"decryptBundle: unsupported version <n>, expected 1"` — unknown version byte.
+ * @throws {Error} `"decryptBundle: authentication failed (wrong passphrase or corrupted bundle)"` — GCM tag invalid.
+ *
+ * @task T345
+ * @epic T311
+ */
+export function decryptBundle(encrypted, passphrase) {
+    if (encrypted.length < MIN_ENCRYPTED_LENGTH) {
+        throw new Error('decryptBundle: payload too short');
+    }
+    if (!encrypted.subarray(0, 8).equals(MAGIC)) {
+        throw new Error('decryptBundle: magic mismatch (not a cleo encrypted bundle)');
+    }
+    const version = encrypted[8];
+    if (version !== VERSION) {
+        throw new Error(`decryptBundle: unsupported version ${version}, expected ${VERSION}`);
+    }
+    // Bytes 9–15 are reserved — ignored.
+    const salt = encrypted.subarray(16, 16 + SALT_SIZE);
+    const nonce = encrypted.subarray(16 + SALT_SIZE, 16 + SALT_SIZE + NONCE_SIZE);
+    const ciphertext = encrypted.subarray(16 + SALT_SIZE + NONCE_SIZE, encrypted.length - AUTH_TAG_SIZE);
+    const authTag = encrypted.subarray(encrypted.length - AUTH_TAG_SIZE);
+    const key = deriveKey(passphrase, salt);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+    decipher.setAuthTag(authTag);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch {
+        throw new Error('decryptBundle: authentication failed (wrong passphrase or corrupted bundle)');
+    }
+}
+/**
+ * Tests whether a buffer starts with the CLEO encrypted bundle magic bytes
+ * `"CLEOENC1"`. Reads only the first 8 bytes; does not validate any other
+ * part of the header.
+ *
+ * Useful for detecting encrypted bundles before attempting decryption, e.g.
+ * when deciding whether to prompt for a passphrase.
+ *
+ * @param header - At least 8 bytes from the start of the file (may be longer).
+ * @returns `true` if the magic bytes match; `false` if the buffer is too short
+ *   or the magic does not match.
+ *
+ * @task T345
+ * @epic T311
+ */
+export function isEncryptedBundle(header) {
+    if (header.length < 8)
+        return false;
+    return header.subarray(0, 8).equals(MAGIC);
+}
+//# sourceMappingURL=backup-crypto.js.map

package/dist/store/backup-crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-crypto.js","sourceRoot":"","sources":["../../src/store/backup-crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,2EAA2E;AAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU;AAEzD,uDAAuD;AACvD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,SAAS;AAE/B,oDAAoD;AACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU;AAE5C,6DAA6D;AAC7D,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,wDAAwD;AACxD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,yCAAyC;AACzC,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,sDAAsD;AACtD,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;GAIG;AACH,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;AAEzB,mCAAmC;AACnC,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB,oCAAoC;AACpC,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB,yDAAyD;AACzD,MAAM,cAAc,GAAoB,QAAQ,CAAC;AAEjD;;;GAGG;AACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,UAAU,GAAG,aAAa,CAAC;AAEhF;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE;QACzD,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,gEAAgE;QAChE,MAAM,EAAE,GAAG,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC;KACtC,CAAW,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAkB;IACjE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,UAAkB;IACjE,IAAI,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,cAAc,OAAO,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,qCAAqC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,SAAS,EAAE,EAAE,GAAG,SAAS,GAAG,UAAU,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CACnC,EAAE,GAAG,SAAS,GAAG,UAAU,EAC3B,SAAS,CAAC,MAAM,GAAG,aAAa,CACjC,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACpE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC"}