@cleocode/core 2026.9.23 → 2026.9.24

package/dist/store/blob-keep.js

@@ -0,0 +1,283 @@
+/**
+ * Blob keep-links: attachment blobs outlive a stale-reading older build
+ * (T12535, mixed-version defence).
+ *
+ * ## Why
+ *
+ * After the twin collapse this build reads and writes `docs_attachments`,
+ * while the 2026.9.20 build still reads and writes the bare `attachments`
+ * table. Both keep blob bytes at the same content-addressed path
+ * (`.cleo/attachments/sha256/<aa>/<rest><ext>`). The older build deletes a blob
+ * when ITS last bare ref goes (and its janitor deletes blobs no BARE row
+ * names), unaware that this build's twin may still reference the content.
+ *
+ * ## How
+ *
+ * Every blob this build stores, references or carries in the collapse gets a
+ * hard link under `.cleo/attachments/keep/<aa>/<rest>` (a copy where hard
+ * links are not possible). The older build only ever unlinks the primary path,
+ * so the bytes survive in the keep-link, and this build restores the primary
+ * path from it on read, on every merge and in the repair.
+ *
+ * This build never deletes a blob straight away: its last deref leaves a
+ * tombstone (`<keep-link>.tomb`, holding the time). The repair (`cleo doctor`,
+ * the janitor) removes the primary file and the keep-link only after the grace
+ * period, and only when neither table names the content.
+ *
+ * @module
+ * @task T12535
+ */
+import { copyFileSync, existsSync, linkSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+/**
+ * Minimal MIME-to-extension map for common attachment types.
+ *
+ * Fallback for all unrecognised MIME types is `.bin`.
+ */
+const MIME_TO_EXT = {
+    'text/markdown': '.md',
+    'text/plain': '.txt',
+    'text/html': '.html',
+    'text/css': '.css',
+    'text/javascript': '.js',
+    'application/json': '.json',
+    'application/pdf': '.pdf',
+    'application/zip': '.zip',
+    'application/octet-stream': '.bin',
+    'image/png': '.png',
+    'image/jpeg': '.jpg',
+    'image/gif': '.gif',
+    'image/webp': '.webp',
+    'image/svg+xml': '.svg',
+    'audio/mpeg': '.mp3',
+    'video/mp4': '.mp4',
+};
+/**
+ * Resolve a file extension from a MIME type.
+ *
+ * @param mime - IANA MIME type string
+ * @returns Extension string including the leading dot (e.g., `".md"`)
+ */
+export function extFromMime(mime) {
+    // Normalise: strip parameters (e.g., "text/plain; charset=utf-8")
+    const base = mime.split(';')[0]?.trim() ?? mime;
+    return MIME_TO_EXT[base] ?? '.bin';
+}
+/**
+ * The primary on-disk path of a blob.
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ * @param mime - The blob's MIME type (gives the extension).
+ * @returns `.cleo/attachments/sha256/<aa>/<rest><ext>`.
+ */
+export function blobFilePath(cleoDir, sha256, mime) {
+    return join(cleoDir, 'attachments', 'sha256', sha256.slice(0, 2), `${sha256.slice(2)}${extFromMime(mime)}`);
+}
+/**
+ * The primary path of the blob an attachment row stores bytes for, or `null`
+ * for kinds kept by reference (url, llms-txt, llmtxt-doc) or malformed JSON.
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The row's content hash.
+ * @param attachmentJson - The row's `attachment_json`.
+ * @returns The primary blob path, or `null`.
+ */
+export function blobFileForRow(cleoDir, sha256, attachmentJson) {
+    let attachment;
+    try {
+        attachment = JSON.parse(attachmentJson);
+    }
+    catch {
+        return null;
+    }
+    if (attachment.kind !== 'blob' && attachment.kind !== 'local-file')
+        return null;
+    const mime = typeof attachment.mime === 'string' ? attachment.mime : 'application/octet-stream';
+    return blobFilePath(cleoDir, sha256, mime);
+}
+/** The keep-link of a blob. */
+function keepPath(cleoDir, sha256) {
+    return join(cleoDir, 'attachments', 'keep', sha256.slice(0, 2), sha256.slice(2));
+}
+/**
+ * Hard-link (or copy) a blob's primary file to its keep-link. Idempotent and
+ * best effort: a missing primary file or an unwritable keep directory is not
+ * an error (the blob is then simply not protected).
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ * @param primary - The blob's primary path.
+ */
+export function pinBlob(cleoDir, sha256, primary) {
+    const keep = keepPath(cleoDir, sha256);
+    try {
+        if (existsSync(keep) || !existsSync(primary))
+            return;
+        mkdirSync(dirname(keep), { recursive: true });
+        try {
+            linkSync(primary, keep);
+        }
+        catch {
+            copyFileSync(primary, keep);
+        }
+    }
+    catch {
+        // best effort
+    }
+}
+/**
+ * Put a blob's primary file back from its keep-link when the primary is
+ * missing (an older build unlinked it). Clears a pending tombstone: a restore
+ * means something still needs the bytes.
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ * @param primary - The blob's primary path.
+ * @returns Whether the primary file exists afterwards.
+ */
+export function restoreBlob(cleoDir, sha256, primary) {
+    if (existsSync(primary))
+        return true;
+    const keep = keepPath(cleoDir, sha256);
+    if (!existsSync(keep))
+        return false;
+    try {
+        mkdirSync(dirname(primary), { recursive: true });
+        try {
+            linkSync(keep, primary);
+        }
+        catch {
+            copyFileSync(keep, primary);
+        }
+        rmSync(`${keep}.tomb`, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Mark a blob this build no longer references: the repair deletes it after the
+ * grace period if neither table names the content then. The primary file and
+ * the keep-link stay until then.
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ * @param primary - The blob's primary path (pinned first, so the tombstone has
+ *   a keep-link to guard).
+ * @param now - The tombstone time (ms since the epoch).
+ */
+export function tombstoneBlob(cleoDir, sha256, primary, now) {
+    pinBlob(cleoDir, sha256, primary);
+    const keep = keepPath(cleoDir, sha256);
+    try {
+        mkdirSync(dirname(keep), { recursive: true });
+        writeFileSync(`${keep}.tomb`, JSON.stringify({ primary, at: now }));
+    }
+    catch {
+        // best effort: without a tombstone the blob is simply kept
+    }
+}
+/**
+ * Collect keep-links nobody needs. For each keep-link:
+ *
+ * - referenced by a row in either table: kept; a tombstone on it is dropped
+ *   and its primary file restored if it is gone;
+ * - not referenced, tombstoned (this build's last deref): the primary file
+ *   and the keep-link are deleted once the tombstone is older than the grace
+ *   period;
+ * - not referenced, no tombstone (an older build deleted the row): the
+ *   keep-link (and any primary file) is deleted once the file is older than
+ *   the grace period.
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param isReferenced - Whether a row in either table names the content.
+ * @param graceMs - How long a tombstone (or an unreferenced keep-link) must age.
+ * @param now - The current time (ms since the epoch).
+ * @param dryRun - Report only.
+ * @returns What was deleted, kept waiting, or revived.
+ */
+export function collectBlobGarbage(cleoDir, isReferenced, graceMs, now, dryRun) {
+    const root = join(cleoDir, 'attachments', 'keep');
+    const result = { deleted: [], waiting: 0, revived: 0 };
+    if (!existsSync(root))
+        return result;
+    for (const prefix of readdirSync(root)) {
+        let names;
+        try {
+            names = readdirSync(join(root, prefix));
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            if (name.endsWith('.tomb'))
+                continue;
+            const sha256 = `${prefix}${name}`;
+            const keep = join(root, prefix, name);
+            const tomb = `${keep}.tomb`;
+            let primary = '';
+            let at;
+            try {
+                if (existsSync(tomb)) {
+                    const parsed = JSON.parse(readFileSync(tomb, 'utf8'));
+                    primary = typeof parsed.primary === 'string' ? parsed.primary : '';
+                    at = typeof parsed.at === 'number' ? parsed.at : statSync(tomb).mtimeMs;
+                }
+                else {
+                    at = statSync(keep).mtimeMs;
+                }
+            }
+            catch {
+                continue;
+            }
+            if (isReferenced(sha256)) {
+                if (existsSync(tomb)) {
+                    result.revived++;
+                    if (!dryRun) {
+                        if (primary)
+                            restoreBlob(cleoDir, sha256, primary);
+                        rmSync(tomb, { force: true });
+                    }
+                }
+                continue;
+            }
+            if (now - at < graceMs) {
+                result.waiting++;
+                continue;
+            }
+            result.deleted.push(sha256);
+            if (!dryRun) {
+                if (primary)
+                    rmSync(primary, { force: true });
+                rmSync(keep, { force: true });
+                rmSync(tomb, { force: true });
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Whether a blob has a pending tombstone (its deletion waits for the grace
+ * period, so other sweeps leave it alone).
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ * @returns `true` when tombstoned.
+ */
+export function isTombstoned(cleoDir, sha256) {
+    return existsSync(`${keepPath(cleoDir, sha256)}.tomb`);
+}
+/**
+ * Delete a blob's keep-link (the primary file was deleted by a sweep that
+ * checked both tables).
+ *
+ * @param cleoDir - The project's `.cleo` directory.
+ * @param sha256 - The content hash.
+ */
+export function unpinBlob(cleoDir, sha256) {
+    rmSync(keepPath(cleoDir, sha256), { force: true });
+    rmSync(`${keepPath(cleoDir, sha256)}.tomb`, { force: true });
+}
+//# sourceMappingURL=blob-keep.js.map

package/dist/store/blob-keep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-keep.js","sourceRoot":"","sources":["../../src/store/blob-keep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,SAAS,EACT,WAAW,EACX,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C;;;;GAIG;AACH,MAAM,WAAW,GAA2B;IAC1C,eAAe,EAAE,KAAK;IACtB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,OAAO;IACpB,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,KAAK;IACxB,kBAAkB,EAAE,OAAO;IAC3B,iBAAiB,EAAE,MAAM;IACzB,iBAAiB,EAAE,MAAM;IACzB,0BAA0B,EAAE,MAAM;IAClC,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;IACnB,YAAY,EAAE,OAAO;IACrB,eAAe,EAAE,MAAM;IACvB,YAAY,EAAE,MAAM;IACpB,WAAW,EAAE,MAAM;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,kEAAkE;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,IAAY;IACxE,OAAO,IAAI,CACT,OAAO,EACP,aAAa,EACb,QAAQ,EACR,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAClB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,CACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,MAAc,EACd,cAAsB;IAEtB,IAAI,UAA8C,CAAC;IACnD,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAuC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAChG,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,+BAA+B;AAC/B,SAAS,QAAQ,CAAC,OAAe,EAAE,MAAc;IAC/C,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO;QACrD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IAC1E,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe,EAAE,GAAW;IACzF,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,GAAG,IAAI,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAAyC,EACzC,OAAe,EACf,GAAW,EACX,MAAe;IAEf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAc,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACrC,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC;YAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;YACjB,IAAI,EAAU,CAAC;YACf,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAGnD,CAAC;oBACF,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnE,EAAE,GAAG,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrB,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,IAAI,OAAO;4BAAE,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;wBACnD,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;gBACvB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,OAAO;oBAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9C,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,MAAc;IAC1D,OAAO,UAAU,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAc;IACvD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/store/converters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"converters.d.ts","sourceRoot":"","sources":["../../src/store/converters.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,OAAO,EAGP,IAAI,EAQL,MAAM,qBAAqB,CAAC;AAK7B,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAmBzE,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA4C5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CA4C1E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAOxD;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAqCrD"}
+{"version":3,"file":"converters.d.ts","sourceRoot":"","sources":["../../src/store/converters.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,OAAO,EAGP,IAAI,EAQL,MAAM,qBAAqB,CAAC;AAM7B,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAyBzE,0DAA0D;AAC1D,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CA+C5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CA4C1E;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,CAOxD;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAuCrD"}

package/dist/store/converters.js

@@ -7,6 +7,7 @@
 import { acceptanceItemSchema } from '@cleocode/contracts';
 import { z } from 'zod';
 import { safeParseJson, safeParseJsonArray } from './parsers.js';
+import { claimFromColumns } from './task-claim.js';
 // Validate with the canonical stored union, but retain the original values.
 // Parsing acceptanceItemSchema directly trims strings and strips object keys.
 const storedAcceptanceSchema = z.custom((value) => Array.isArray(value) && value.every((item) => acceptanceItemSchema.safeParse(item).success));
@@ -21,6 +22,11 @@ function readStoredAcceptance(row) {
         throw new Error(`Invalid stored acceptance for task ${row.id}`, { cause });
     }
 }
+/** The `claim` entry of a task record: `{ claim }` when leased, else `{}` (T12502). */
+function claimEntry(row) {
+    const claim = claimFromColumns(row);
+    return claim ? { claim } : {};
+}
 /** Convert a database TaskRow to a domain Task object. */
 export function rowToTask(row) {
     return {
@@ -60,6 +66,9 @@ export function rowToTask(row) {
             : undefined,
         pipelineStage: row.pipelineStage ?? undefined,
         assignee: row.assignee ?? undefined,
+        // T12502: the agent claim lease — read-only here; taskToRow never writes it.
+        // Present only when claimed, so an unclaimed task record is unchanged.
+        ...claimEntry(row),
         // T944/T9072: orthogonal axes — kind (intent, DB col 'role') and scope (granularity)
         kind: row.kind ?? undefined,
         scope: row.scope ?? undefined,
@@ -155,6 +164,8 @@ export function rowToSession(row) {
         nextSessionId: row.nextSessionId ?? null,
         // Fork-tree parent edge (T11639)
         parentSessionId: row.parentSessionId ?? null,
+        // Trusted spawn edge (T12502) — read-only: upsertSession never writes it.
+        spawnedBySessionId: row.spawnedBySessionId ?? null,
         agentIdentifier: row.agentIdentifier ?? null,
         handoffConsumedAt: row.handoffConsumedAt ?? null,
         handoffConsumedBy: row.handoffConsumedBy ?? null,

package/dist/store/converters.js.map

@@ -1 +1 @@
-{"version":3,"file":"converters.js","sourceRoot":"","sources":["../../src/store/converters.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAIjE,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAC9F,CAAC;AAEF,mFAAmF;AACnF,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAoB;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAwB;QACtC,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,SAAS;QACjD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1C,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,yEAAyE;QACzE,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACrC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,OAAO,EAAE,SAAS,EAAE,8CAA8C;QAClE,MAAM,EAAG,GAAG,CAAC,MAAyB,IAAI,SAAS;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACrC,aAAa,EAAG,GAAG,CAAC,aAAuC,IAAI,SAAS;QACxE,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACrC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,SAAS;QACvD,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;QACpF,UAAU,EACR,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS;YAC9C,CAAC,CAAC;gBACE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACjC;YACH,CAAC,CAAC,SAAS;QACf,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;QAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,qFAAqF;QACrF,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,KAAK,EAAG,GAAG,CAAC,KAAmB,IAAI,SAAS;QAC5C,QAAQ,EAAG,GAAG,CAAC,QAAyB,IAAI,SAAS;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,IAAI,aAAa,GAAkB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAC9D,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1D,IAAI,MAAM,KAAK,MAAM;YAAE,aAAa,GAAG,cAAc,CAAC;aACjD,IAAI,MAAM,KAAK,WAAW;YAAE,aAAa,GAAG,WAAW,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACnD,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9E,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI;QAC/C,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI;QAC7C,aAAa;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,oFAAoF;QACpF,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,IAAI,CAAE,GAA+B,CAAC,YAAY,CAAC,EAAE,CAAC;QACnD,GAA+B,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QAC/B,KAAK,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;KACjC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAuB;QACnC,KAAK,EAAE,CAAC,aAAa,CAAe,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAiB;QACzF,QAAQ;QACR,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC1D,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,+BAA+B;QAC/B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACxC,iCAAiC;QACjC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,uBAAuB;QACvB,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAe,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,6CAA6C;QAC7C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;KACvC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"converters.js","sourceRoot":"","sources":["../../src/store/converters.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAC9F,CAAC;AAEF,mFAAmF;AACnF,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAoB;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAwB;QACtC,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,SAAS;QACjD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;QAClC,MAAM,EAAE,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC;QAC1C,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,yEAAyE;QACzE,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC;QACrC,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,OAAO,EAAE,SAAS,EAAE,8CAA8C;QAClE,MAAM,EAAG,GAAG,CAAC,MAAyB,IAAI,SAAS;QACnD,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACrC,aAAa,EAAG,GAAG,CAAC,aAAuC,IAAI,SAAS;QACxE,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,SAAS;QAC/C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACrC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,SAAS;QACvD,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;QACpF,UAAU,EACR,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS;YAC9C,CAAC,CAAC;gBACE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;gBAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;aACjC;YACH,CAAC,CAAC,SAAS;QACf,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,SAAS;QAC7C,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,SAAS;QACnC,6EAA6E;QAC7E,uEAAuE;QACvE,GAAG,UAAU,CAAC,GAAG,CAAC;QAClB,qFAAqF;QACrF,IAAI,EAAG,GAAG,CAAC,IAAiB,IAAI,SAAS;QACzC,KAAK,EAAG,GAAG,CAAC,KAAmB,IAAI,SAAS;QAC5C,QAAQ,EAAG,GAAG,CAAC,QAAyB,IAAI,SAAS;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,IAAoC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;IACxC,IAAI,aAAa,GAAkB,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;IAC9D,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC1D,IAAI,MAAM,KAAK,MAAM;YAAE,aAAa,GAAG,cAAc,CAAC;aACjD,IAAI,MAAM,KAAK,WAAW;YAAE,aAAa,GAAG,WAAW,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,QAAQ;QACnC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC;QAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5D,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;QACxE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QACjC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;QACrC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACnD,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9E,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI;QAC7C,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,IAAI,IAAI;QAC/C,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,IAAI,IAAI;QAC7C,aAAa;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;QAC/B,oFAAoF;QACpF,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,SAAS;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS;QAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,GAAG,CAAC,MAAM,GAAG,UAAU,CAAC;IACxB,IAAI,CAAE,GAA+B,CAAC,YAAY,CAAC,EAAE,CAAC;QACnD,GAA+B,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,GAAe;IAC1C,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QAC/B,KAAK,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;KACjC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAuB;QACnC,KAAK,EAAE,CAAC,aAAa,CAAe,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAiB;QACzF,QAAQ;QACR,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,SAAS;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,SAAS;QAC7B,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,cAAc,EAAE,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC1D,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,+BAA+B;QAC/B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACxC,iCAAiC;QACjC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,0EAA0E;QAC1E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,IAAI;QAClD,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,IAAI,IAAI;QAChD,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,uBAAuB;QACvB,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAe,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7E,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS;QACzC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,6CAA6C;QAC7C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;QAChC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,IAAI;KACvC,CAAC;AACJ,CAAC"}

package/dist/store/credential-transfer.d.ts

@@ -57,6 +57,11 @@ export interface CredentialSources {
     readonly projectDbPath?: string;
     /** Project identity keying the project KDF. Required when the project store has rows. */
     readonly projectId?: string;
+    /**
+     * Ids the project was keyed by before a re-key (T12716); ciphertexts under
+     * them are opened and re-wrapped under {@link CredentialSources.projectId}.
+     */
+    readonly previousProjectIds?: readonly string[];
     /** Candidate paths for legacy path-bound project ciphertexts (usually the project root). */
     readonly legacyProjectPaths?: readonly string[];
     /** Global `cleo.db` (live, or a staged snapshot). */
@@ -219,7 +224,7 @@ export declare function unsealCredentials(sealed: Uint8Array, passphrase: string
  *   and `projectId` is missing.
  * @task T12326
  */
-export declare function migrateProjectCredentials(sources: Pick<CredentialSources, 'projectDbPath' | 'projectId' | 'legacyProjectPaths' | 'cleoHome'>, options?: {
+export declare function migrateProjectCredentials(sources: Pick<CredentialSources, 'projectDbPath' | 'projectId' | 'previousProjectIds' | 'legacyProjectPaths' | 'cleoHome'>, options?: {
     readonly dryRun?: boolean;
 }): Promise<ProjectCredentialMigrationResult>;
 /**
@@ -236,10 +241,37 @@ export interface ProjectRootCredentialMigration extends ProjectCredentialMigrati
     readonly dryRun: boolean;
 }
 /**
- * Migrate a project's stored credentials off the path-bound KDF, resolving
- * everything from the project root: the store is `<root>/.cleo/cleo.db`, the
- * identity is `projectId` from `.cleo/project-info.json`, and the legacy
- * candidates are the root as given and its real path.
+ * The id that keys a project's credentials, plus the ids it was keyed by
+ * before (T12716).
+ *
+ * The id is the declared one — tracked `.cleo/project.json` /
+ * `.cleo/project-id` first, then the `project-info.json` cache — the same
+ * order every identity reader uses. The previous ids are the cache when it
+ * disagrees (a conflict not yet resolved), the cache's `previousProjectIds`
+ * receipts (a conflict `cleo doctor project-identity --resolve` already
+ * re-keyed), and every id the global registry aliases to the declared one
+ * (`nexus_project_id_aliases`), so credentials sealed under any of them open.
+ * The alias read never creates the global store.
+ *
+ * @param projectRoot - Project root.
+ * @param cleoHome - Global CLEO home whose alias table is read (defaults to the current one).
+ * @returns The declared id (`null` when none) and the previous ids.
+ * @example
+ * ```ts
+ * const { projectId, previousProjectIds } = await readProjectCredentialIdentity(root);
+ * ```
+ * @task T12716
+ */
+export declare function readProjectCredentialIdentity(projectRoot: string, cleoHome?: string): Promise<{
+    projectId: string | null;
+    previousProjectIds: string[];
+}>;
+/**
+ * Migrate a project's stored credentials off the path-bound KDF (and off any
+ * id the project was re-keyed away from — T12716), resolving everything from
+ * the project root: the store is `<root>/.cleo/cleo.db`, the identity is
+ * {@link readProjectCredentialIdentity}, and the legacy candidates are the
+ * root as given and its real path.
  *
  * This is the trigger used by `cleo upgrade` and `cleo doctor credentials`.
  * It is idempotent and never deletes; unrecoverable rows come back in

package/dist/store/credential-transfer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-transfer.d.ts","sourceRoot":"","sources":["../../src/store/credential-transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gCAAgC,EAChC,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAgC7B;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4FAA4F;IAC5F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,2BAA2B,GACnC,yBAAyB,GACzB,sBAAsB,GACtB,yBAAyB,GACzB,yBAAyB,CAAC;AAE9B;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C;;;OAGG;gBACS,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE9F;AAyKD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,SAAiD,GACtD,iBAAiB,EAAE,CAErB;AA2BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CAuB3F;AA8CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAwFD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAiJlC;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,IAAI,CACX,iBAAiB,EACjB,eAAe,GAAG,WAAW,GAAG,oBAAoB,GAAG,UAAU,CAClE,EACD,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,OAAO,CAAC,gCAAgC,CAAC,CA0C3C;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA+B,SAAQ,gCAAgC;IACtF,8BAA8B;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,8BAA8B,CAAC,CA+BzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,qBAAqB,CAAC,CA4BhC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}
+{"version":3,"file":"credential-transfer.d.ts","sourceRoot":"","sources":["../../src/store/credential-transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAMH,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gCAAgC,EAChC,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAiC7B;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yFAAyF;IACzF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,4FAA4F;IAC5F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,qDAAqD;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,mGAAmG;IACnG,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,sGAAsG;IACtG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,kCAAkC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,2BAA2B,GACnC,yBAAyB,GACzB,sBAAsB,GACtB,yBAAyB,GACzB,yBAAyB,CAAC;AAE9B;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAE3C;;;OAGG;gBACS,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,MAAM;CAK/D;AAoCD;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAE9F;AAyKD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,SAAiD,GACtD,iBAAiB,EAAE,CAErB;AA2BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,CAuB3F;AA+CD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAmChC;AAwFD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,uBAAuB,CAAC,CAiJlC;AAMD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,IAAI,CACX,iBAAiB,EACjB,eAAe,GAAG,WAAW,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CACzF,EACD,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1C,OAAO,CAAC,gCAAgC,CAAC,CA2C3C;AAED;;;;GAIG;AACH,MAAM,WAAW,8BAA+B,SAAQ,gCAAgC;IACtF,8BAA8B;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,6BAA6B,CACjD,WAAW,EAAE,MAAM,EACnB,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC;IACT,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC,CAsCD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,+BAA+B,CACnD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,8BAA8B,CAAC,CAmBzC;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,qBAAqB,CAAC,CA4BhC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD"}

package/dist/store/credential-transfer.js

@@ -48,6 +48,7 @@
 import fs from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
+import { isValidPortableProjectId, readDeclaredProjectIdentity } from '@cleocode/paths';
 import { decryptGlobal, decryptProjectSecret, encryptGlobal, encryptProjectSecret, } from '../crypto/credentials.js';
 import { addCredential, credentialsStorePath, isStoredCredential, } from '../llm/credentials-store.js';
 import { getCleoHome } from '../paths.js';
@@ -338,6 +339,7 @@ async function openRow(row, sources) {
             const projectId = requireProjectId(sources.projectId, 'seal');
             const result = await decryptProjectSecret(row.material, {
                 projectId,
+                previousProjectIds: sources.previousProjectIds,
                 legacyProjectPaths: sources.legacyProjectPaths,
                 cleoHome: sources.cleoHome,
             });
@@ -653,6 +655,7 @@ export async function migrateProjectCredentials(sources, options = {}) {
         try {
             result = await decryptProjectSecret(row.material, {
                 projectId,
+                previousProjectIds: sources.previousProjectIds,
                 legacyProjectPaths: sources.legacyProjectPaths,
                 cleoHome: sources.cleoHome,
             });
@@ -676,10 +679,74 @@ export async function migrateProjectCredentials(sources, options = {}) {
     return { migrated, current, reentry };
 }
 /**
- * Migrate a project's stored credentials off the path-bound KDF, resolving
- * everything from the project root: the store is `<root>/.cleo/cleo.db`, the
- * identity is `projectId` from `.cleo/project-info.json`, and the legacy
- * candidates are the root as given and its real path.
+ * The id that keys a project's credentials, plus the ids it was keyed by
+ * before (T12716).
+ *
+ * The id is the declared one — tracked `.cleo/project.json` /
+ * `.cleo/project-id` first, then the `project-info.json` cache — the same
+ * order every identity reader uses. The previous ids are the cache when it
+ * disagrees (a conflict not yet resolved), the cache's `previousProjectIds`
+ * receipts (a conflict `cleo doctor project-identity --resolve` already
+ * re-keyed), and every id the global registry aliases to the declared one
+ * (`nexus_project_id_aliases`), so credentials sealed under any of them open.
+ * The alias read never creates the global store.
+ *
+ * @param projectRoot - Project root.
+ * @param cleoHome - Global CLEO home whose alias table is read (defaults to the current one).
+ * @returns The declared id (`null` when none) and the previous ids.
+ * @example
+ * ```ts
+ * const { projectId, previousProjectIds } = await readProjectCredentialIdentity(root);
+ * ```
+ * @task T12716
+ */
+export async function readProjectCredentialIdentity(projectRoot, cleoHome = getCleoHome()) {
+    const declared = readDeclaredProjectIdentity(projectRoot);
+    const previous = new Set();
+    if (declared?.infoProjectId !== undefined && declared.infoProjectId !== declared.projectId)
+        previous.add(declared.infoProjectId);
+    try {
+        const info = JSON.parse(fs.readFileSync(path.join(projectRoot, '.cleo', 'project-info.json'), 'utf-8'));
+        const receipts = info !== null && typeof info === 'object' && 'previousProjectIds' in info
+            ? info.previousProjectIds
+            : undefined;
+        if (Array.isArray(receipts))
+            for (const id of receipts)
+                if (typeof id === 'string' && id.length > 0)
+                    previous.add(id);
+    }
+    catch {
+        // No readable cache: no previous ids.
+    }
+    if (declared) {
+        try {
+            const { getNexusRegistryDb, getNexusRegistryDbPath } = await import('./nexus-sqlite.js');
+            if (fs.existsSync(getNexusRegistryDbPath(cleoHome))) {
+                const { projectIdAliases } = await import('./schema/nexus-schema.js');
+                const { eq } = await import('drizzle-orm');
+                const db = await getNexusRegistryDb(cleoHome);
+                for (const alias of db
+                    .select({ legacyId: projectIdAliases.legacyId })
+                    .from(projectIdAliases)
+                    .where(eq(projectIdAliases.canonicalId, declared.projectId))
+                    .all())
+                    if (isValidPortableProjectId(alias.legacyId))
+                        previous.add(alias.legacyId);
+            }
+        }
+        catch {
+            // Registry unreadable: the receipts above still apply.
+        }
+        previous.delete(declared.projectId);
+    }
+    return { projectId: declared?.projectId ?? null, previousProjectIds: [...previous] };
+}
+/**
+ * Migrate a project's stored credentials off the path-bound KDF (and off any
+ * id the project was re-keyed away from — T12716), resolving everything from
+ * the project root: the store is `<root>/.cleo/cleo.db`, the identity is
+ * {@link readProjectCredentialIdentity}, and the legacy candidates are the
+ * root as given and its real path.
  *
  * This is the trigger used by `cleo upgrade` and `cleo doctor credentials`.
  * It is idempotent and never deletes; unrecoverable rows come back in
@@ -697,23 +764,11 @@ export async function migrateProjectCredentialsAtRoot(projectRoot, options = {})
     const root = path.resolve(projectRoot);
     const cleoDir = path.join(root, '.cleo');
     const projectDbPath = path.join(cleoDir, 'cleo.db');
-    let projectId = null;
-    try {
-        const parsed = JSON.parse(fs.readFileSync(path.join(cleoDir, 'project-info.json'), 'utf-8'));
-        if (typeof parsed === 'object' &&
-            parsed !== null &&
-            'projectId' in parsed &&
-            typeof parsed.projectId === 'string' &&
-            parsed.projectId.length > 0) {
-            projectId = parsed.projectId;
-        }
-    }
-    catch {
-        projectId = null;
-    }
+    const { projectId, previousProjectIds } = await readProjectCredentialIdentity(root, options.cleoHome);
     const result = await migrateProjectCredentials({
         projectDbPath,
         ...(projectId !== null ? { projectId } : {}),
+        previousProjectIds,
         legacyProjectPaths: [root, canonicalPath(root)],
         ...(options.cleoHome !== undefined ? { cleoHome: options.cleoHome } : {}),
     }, { dryRun: options.dryRun === true });