@hasna/mementos 0.14.88 → 0.16.0

package/dist/project-registration.js

@@ -72,16 +72,7 @@ function serverDataBackendEnvKeys(name) {
     databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`]
   };
 }
-function legacyModeKeys(name) {
-  const token = envToken(name);
-  return [
-    `HASNA_${token}_STORAGE_MODE`,
-    `HASNA_${token}_MODE`,
-    `${token}_STORAGE_MODE`,
-    `${token}_MODE`
-  ];
-}
-function firstEnv(env, keys) {
+function firstDatabaseUrl(env, keys) {
   for (const key of keys) {
     const value = ownString(env, key)?.trim();
     if (value)
@@ -89,23 +80,8 @@ function firstEnv(env, keys) {
   }
   return null;
 }
-function firstDefinedEnvKey(env, keys) {
-  for (const key of keys) {
-    if (Object.hasOwn(env, key) && env[key] !== undefined)
-      return key;
-  }
-  return null;
-}
-function assertNoLegacyStorageMode(name, env = process.env) {
-  const legacyKey = firstDefinedEnvKey(env, legacyModeKeys(name));
-  if (!legacyKey)
-    return;
-  const canonicalDatabaseUrl = serverDataBackendEnvKeys(name).databaseUrlKeys[0];
-  throw new Error(`${legacyKey} was removed. Delete the storage-mode variable; ` + `set ${canonicalDatabaseUrl} to select the postgresql server backend, ` + `or leave it unset for sqlite.`);
-}
 function resolveServerDataBackend(name, env = process.env) {
-  assertNoLegacyStorageMode(name, env);
-  const databaseUrl = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
+  const databaseUrl = firstDatabaseUrl(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
   if (!databaseUrl) {
     return {
       backend: "sqlite",
@@ -122,113 +98,69 @@ function resolveServerDataBackend(name, env = process.env) {
   };
 }
 function resolveDatabaseUrl(name, env = process.env) {
-  assertNoLegacyStorageMode(name, env);
-  const hit = firstEnv(env, serverDataBackendEnvKeys(name).databaseUrlKeys);
-  return hit?.value ?? null;
+  return firstDatabaseUrl(env, serverDataBackendEnvKeys(name).databaseUrlKeys)?.value ?? null;
 }
 var init_backend = () => {};
 
-// src/lib/retired-storage-mode.ts
-function firstDefinedEnvKey2(env, keys) {
-  for (const key of keys) {
-    if (Object.hasOwn(env, key) && env[key] !== undefined)
-      return key;
-  }
-  return null;
-}
-function assertNoLegacyStorageMode2(env = process.env) {
-  const legacyKey = firstDefinedEnvKey2(env, LEGACY_STORAGE_MODE_KEYS);
-  if (!legacyKey)
-    return;
-  throw new Error(`${legacyKey} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the local SQLite store, or the HTTP API selected by ` + `HASNA_MEMENTOS_API_URL + HASNA_MEMENTOS_API_KEY. ` + `On the server, set HASNA_MEMENTOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
-}
-var LEGACY_STORAGE_MODE_KEYS;
-var init_retired_storage_mode = __esm(() => {
-  LEGACY_STORAGE_MODE_KEYS = [
-    "HASNA_MEMENTOS_STORAGE_MODE",
-    "HASNA_MEMENTOS_MODE",
-    "MEMENTOS_STORAGE_MODE",
-    "MEMENTOS_MODE"
-  ];
-});
-
-// ../../node_modules/.bun/@hasna+paths@0.1.0/node_modules/@hasna/paths/dist/index.js
+// src/lib/paths.ts
+import { existsSync } from "fs";
 import { homedir } from "os";
-import { join } from "path";
-function assertApp(app) {
+import { join, resolve } from "path";
+import { homedir as pathsResolverHomedir } from "os";
+import { join as pathsResolverJoin } from "path";
+function pathsResolverAssertApp(app) {
   if (typeof app !== "string" || app.length === 0) {
     throw new TypeError("paths: app must be a non-empty string");
   }
-  if (!APP_SLUG_RE.test(app)) {
+  if (!PATHS_RESOLVER_APP_SLUG_RE.test(app)) {
     throw new TypeError(`paths: invalid app slug "${app}" \u2014 expected lowercase kebab-case ([a-z0-9]+(-[a-z0-9]+)*)`);
   }
 }
-function envOf(options) {
-  return options.env ?? process.env;
-}
-function envValue(options, kind) {
-  const value = envOf(options)[KIND_ENV[kind]];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
-}
-function isMacOS(platform) {
-  return platform === "darwin";
+function pathsResolverAssertKind(kind) {
+  if (!Object.keys(PATHS_RESOLVER_KIND_ENV).includes(kind)) {
+    throw new TypeError(`paths: invalid path kind "${kind}" \u2014 expected one of ${Object.keys(PATHS_RESOLVER_KIND_ENV).join(", ")}`);
+  }
 }
-function baseDir(kind, options) {
-  const override = envValue(options, kind);
-  if (override)
+function pathsResolverBaseDir(kind, options) {
+  pathsResolverAssertKind(kind);
+  const env = options.env ?? process.env;
+  const override = env[PATHS_RESOLVER_KIND_ENV[kind]];
+  if (typeof override === "string" && override.length > 0)
     return override;
-  const home = options.home ?? homedir();
+  const home = options.home ?? pathsResolverHomedir();
   const platform = options.platform ?? process.platform;
-  if (isMacOS(platform)) {
+  if (platform === "darwin") {
     switch (kind) {
-      case "config":
       case "data":
-        return join(home, "Library", "Application Support", "Hasna");
+        return pathsResolverJoin(home, "Library", "Application Support", "Hasna");
       case "cache":
-        return join(home, "Library", "Caches", "Hasna");
+        return pathsResolverJoin(home, "Library", "Caches", "Hasna");
       case "state":
-        return join(home, "Library", "Logs", "Hasna");
+        return pathsResolverJoin(home, "Library", "Logs", "Hasna");
     }
   }
   switch (kind) {
-    case "config":
-      return join(home, ".config", "hasna");
     case "data":
-      return join(home, ".local", "share", "hasna");
+      return pathsResolverJoin(home, ".local", "share", "hasna");
     case "state":
-      return join(home, ".local", "state", "hasna");
+      return pathsResolverJoin(home, ".local", "state", "hasna");
     case "cache":
-      return join(home, ".cache", "hasna");
+      return pathsResolverJoin(home, ".cache", "hasna");
   }
 }
-function resolvePath(kind, options) {
-  assertApp(options.app);
-  const appSegment = options.internal === true ? join("internal", options.app) : options.app;
-  return join(baseDir(kind, options), appSegment);
+function pathsResolverResolve(kind, options) {
+  pathsResolverAssertApp(options.app);
+  const appSegment = options.internal === true ? pathsResolverJoin("internal", options.app) : options.app;
+  return pathsResolverJoin(pathsResolverBaseDir(kind, options), appSegment);
 }
 function dataDir(options) {
-  return resolvePath("data", options);
+  return pathsResolverResolve("data", options);
 }
-var KIND_ENV, APP_SLUG_RE;
-var init_dist = __esm(() => {
-  KIND_ENV = {
-    config: "HASNA_CONFIG_HOME",
-    data: "HASNA_DATA_HOME",
-    state: "HASNA_STATE_HOME",
-    cache: "HASNA_CACHE_HOME"
-  };
-  APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-});
-
-// src/lib/paths.ts
-import { existsSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2, resolve } from "path";
 function effectiveHome() {
-  return process.env["HOME"] || process.env["USERPROFILE"] || homedir2() || "/tmp";
+  return process.env["HOME"] || process.env["USERPROFILE"] || homedir() || "/tmp";
 }
 function legacyDataRoot() {
-  return join2(effectiveHome(), ".hasna", "mementos");
+  return join(effectiveHome(), ".hasna", "mementos");
 }
 function resolverDataRoot() {
   return dataDir({
@@ -240,7 +172,7 @@ function adoptResolverDataRoot(resolved, env = process.env) {
   const dataOverride = env.HASNA_DATA_HOME;
   if (typeof dataOverride === "string" && dataOverride.trim().length > 0)
     return true;
-  return existsSync(join2(resolved, "mementos.db"));
+  return existsSync(join(resolved, "mementos.db"));
 }
 function exactDataRoot() {
   for (const key of ["HASNA_MEMENTOS_HOME", "MEMENTOS_HOME"]) {
@@ -257,14 +189,34 @@ function getDataRoot() {
   const resolved = resolverDataRoot();
   return adoptResolverDataRoot(resolved) ? resolve(resolved) : resolve(legacyDataRoot());
 }
+var PATHS_RESOLVER_KIND_ENV, PATHS_RESOLVER_APP_SLUG_RE;
 var init_paths = __esm(() => {
-  init_dist();
+  PATHS_RESOLVER_KIND_ENV = {
+    data: "HASNA_DATA_HOME",
+    state: "HASNA_STATE_HOME",
+    cache: "HASNA_CACHE_HOME"
+  };
+  PATHS_RESOLVER_APP_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+});
+
+// src/lib/env.ts
+var alias = (canonical, legacy) => process.env[canonical] ?? process.env[legacy], env;
+var init_env = __esm(() => {
+  env = {
+    apiKey: () => alias("HASNA_MEMENTOS_API_KEY", "MEMENTOS_API_KEY"),
+    defaultScope: () => alias("HASNA_MEMENTOS_DEFAULT_SCOPE", "MEMENTOS_DEFAULT_SCOPE"),
+    defaultCategory: () => alias("HASNA_MEMENTOS_DEFAULT_CATEGORY", "MEMENTOS_DEFAULT_CATEGORY"),
+    defaultImportance: () => alias("HASNA_MEMENTOS_DEFAULT_IMPORTANCE", "MEMENTOS_DEFAULT_IMPORTANCE"),
+    pgsyncQueryTimeoutMs: () => alias("HASNA_MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS", "MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS"),
+    reflectProvider: () => alias("HASNA_MEMENTOS_REFLECT_PROVIDER", "MEMENTOS_REFLECT_PROVIDER"),
+    reflectModel: () => alias("HASNA_MEMENTOS_REFLECT_MODEL", "MEMENTOS_REFLECT_MODEL")
+  };
 });
 
 // src/storage.ts
 import { Database } from "bun:sqlite";
 import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 import { fileURLToPath } from "url";
 import { Worker } from "worker_threads";
 import pg from "pg";
@@ -289,6 +241,7 @@ class SqliteAdapter {
   db;
   constructor(path) {
     this.db = new Database(path, { create: true });
+    this.db.exec("PRAGMA busy_timeout = 5000");
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
   }
@@ -539,9 +492,9 @@ function getConfigPath() {
   return STORAGE_CONFIG_PATH;
 }
 function getStorageDatabaseEnv() {
-  for (const env of DATABASE_ENV_NAMES) {
-    if (readEnv(env.name))
-      return env;
+  for (const env2 of DATABASE_ENV_NAMES) {
+    if (readEnv(env2.name))
+      return env2;
   }
   return null;
 }
@@ -551,20 +504,19 @@ function getStorageEnvName(key) {
   return readEnv(canonical) || !readEnv(fallback) ? canonical : fallback;
 }
 function getStorageDatabaseUrl() {
-  const env = getStorageDatabaseEnv();
-  return env ? readEnv(env.name) : null;
+  const env2 = getStorageDatabaseEnv();
+  return env2 ? readEnv(env2.name) : null;
 }
 function getStorageDatabaseEnvName() {
   return getStorageEnvName("databaseUrl");
 }
-function getStorageBackend(env = process.env) {
-  return resolveServerDataBackend("mementos", env).backend;
+function getStorageBackend(env2 = process.env) {
+  return resolveServerDataBackend("mementos", env2).backend;
 }
-function getStorageBackendDatabaseUrl(env = process.env) {
-  return resolveDatabaseUrl("mementos", env);
+function getStorageBackendDatabaseUrl(env2 = process.env) {
+  return resolveDatabaseUrl("mementos", env2);
 }
 function getStorageConfig() {
-  assertNoLegacyStorageMode2();
   const fileConfig = readConfigFile();
   const merged = {
     ...DEFAULT_STORAGE_CONFIG,
@@ -651,14 +603,14 @@ function storageEnvStatus(key) {
   };
 }
 function postgresBackendStatus(config) {
-  const env = getStorageDatabaseEnv();
-  const envUrl = env ? readEnv(env.name) : null;
-  if (env && envUrl) {
+  const env2 = getStorageDatabaseEnv();
+  const envUrl = env2 ? readEnv(env2.name) : null;
+  if (env2 && envUrl) {
     const validation = validatePostgresConnectionString(envUrl);
     return {
       configured: validation.ok,
       source: "env",
-      env_name: env.name,
+      env_name: env2.name,
       redacted_url: validation.redacted_url,
       missing: [],
       issues: validation.issues,
@@ -704,7 +656,6 @@ function getSafeStorageConfigSummary(config = getStorageConfig()) {
   };
 }
 function getStorageStatus() {
-  assertNoLegacyStorageMode2();
   const config = getStorageConfig();
   const backend = getStorageBackend();
   const postgresRequested = backend === "postgresql";
@@ -814,14 +765,12 @@ function resolveConfiguredConnectionString(dbName) {
   return `postgres://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbName}${sslParam}`;
 }
 function getStorageConnectionString(dbName = "mementos") {
-  assertNoLegacyStorageMode2();
   if (!isServerContext()) {
     throw new Error("Refusing to construct an RDS Postgres DSN outside the mementos-serve server. " + "The raw database DSN is NEVER distributed to client machines. " + "Clients must use the HTTP API: set HASNA_MEMENTOS_API_URL and " + "HASNA_MEMENTOS_API_KEY (and unset HASNA_MEMENTOS_DATABASE_URL).");
   }
   return resolveConfiguredConnectionString(dbName);
 }
 function getStorageConnectionStringForOperator(dbName = "mementos") {
-  assertNoLegacyStorageMode2();
   return resolveConfiguredConnectionString(dbName);
 }
 function isSyncExcludedTable(table) {
@@ -992,8 +941,8 @@ CREATE TABLE IF NOT EXISTS _sync_meta (
 )`;
 var init_storage = __esm(() => {
   init_backend();
-  init_retired_storage_mode();
   init_paths();
+  init_env();
   PgSyncPool = class PgSyncPool {
     worker;
     status;
@@ -1003,7 +952,7 @@ var init_storage = __esm(() => {
     generation = 0;
     static DATA_BYTES = 128 * 1024 * 1024;
     static queryTimeoutMs() {
-      const raw = process.env["MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS"]?.trim();
+      const raw = env.pgsyncQueryTimeoutMs()?.trim();
       const parsed = raw ? Number(raw) : Number.NaN;
       return Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
     }
@@ -1011,9 +960,9 @@ var init_storage = __esm(() => {
       const ext = import.meta.url.endsWith(".ts") ? ".ts" : ".js";
       const here = fileURLToPath(new URL(".", import.meta.url));
       const candidates = [
-        join3(here, `pg-sync-worker${ext}`),
-        join3(here, "..", `pg-sync-worker${ext}`),
-        join3(here, "..", "..", `pg-sync-worker${ext}`)
+        join2(here, `pg-sync-worker${ext}`),
+        join2(here, "..", `pg-sync-worker${ext}`),
+        join2(here, "..", "..", `pg-sync-worker${ext}`)
       ];
       for (const candidate of candidates) {
         if (existsSync2(candidate))
@@ -1119,8 +1068,8 @@ var init_storage = __esm(() => {
       schedule_minutes: 0
     }
   };
-  STORAGE_CONFIG_DIR = join3(LOCAL_DATA_DIR, "storage");
-  STORAGE_CONFIG_PATH = join3(STORAGE_CONFIG_DIR, "config.json");
+  STORAGE_CONFIG_DIR = join2(LOCAL_DATA_DIR, "storage");
+  STORAGE_CONFIG_PATH = join2(STORAGE_CONFIG_DIR, "config.json");
   DATABASE_ENV_NAMES = [
     { name: MEMENTOS_STORAGE_ENV.databaseUrl, deprecated: false },
     { name: MEMENTOS_STORAGE_FALLBACK_ENV.databaseUrl, deprecated: false }
@@ -1144,28 +1093,96 @@ var init_storage = __esm(() => {
   ];
 });
 
+// src/lib/local-opt-in.ts
+import {
+  clientTransportEnvKeys,
+  credentialOverrideEnvKey,
+  credentialPointerEnvKey,
+  CREDENTIAL_PROFILE_ENV_KEY
+} from "@hasna/contracts/client";
+function isMementosLocalOptIn(env2 = process.env) {
+  return MEMENTOS_LOCAL_OPT_IN_ENV_KEYS.some((key) => (env2[key] ?? "").trim() !== "");
+}
+function hasExplicitLocalDbPath(env2 = process.env) {
+  return MEMENTOS_DB_PATH_ENV_KEYS.some((key) => (env2[key] ?? "").trim() !== "");
+}
+function mementosAuthorityEnvKeys() {
+  const keys = clientTransportEnvKeys("mementos");
+  return [
+    ...keys.apiUrlKeys,
+    ...keys.apiKeyKeys,
+    credentialOverrideEnvKey("mementos"),
+    credentialPointerEnvKey("mementos"),
+    CREDENTIAL_PROFILE_ENV_KEY
+  ];
+}
+function hasMementosEnvAuthorityIntent(env2 = process.env) {
+  return mementosAuthorityEnvKeys().some((key) => (env2[key] ?? "").trim() !== "");
+}
+function selectsMementosLocalStore(env2 = process.env) {
+  if (hasExplicitLocalDbPath(env2))
+    return true;
+  return !hasMementosEnvAuthorityIntent(env2) && isMementosLocalOptIn(env2);
+}
+function mementosResolverEnv(env2) {
+  const blanks = mementosAuthorityEnvKeys().filter((key) => (key in env2) && (env2[key] ?? "").trim() === "");
+  if (blanks.length === 0)
+    return env2;
+  const next = { ...env2 };
+  for (const key of blanks)
+    delete next[key];
+  return next;
+}
+function isAmbientMementosEnv(env2) {
+  if (typeof process !== "undefined" && env2 === process.env)
+    return true;
+  return env2[CONTRACTS_AMBIENT_ENVIRONMENT] === true;
+}
+function mementosResolverInputs(env2, credentials = {}) {
+  const normalised = mementosResolverEnv(env2);
+  if (normalised === env2)
+    return { env: normalised, credentials };
+  const keychain = { ...credentials.keychain };
+  if (keychain.enabled === undefined && keychain.run === undefined) {
+    keychain.enabled = isAmbientMementosEnv(env2);
+  }
+  return { env: normalised, credentials: { ...credentials, keychain } };
+}
+var MEMENTOS_LOCAL_OPT_IN_ENV_KEYS, MEMENTOS_DB_PATH_ENV_KEYS, CONTRACTS_AMBIENT_ENVIRONMENT;
+var init_local_opt_in = __esm(() => {
+  MEMENTOS_LOCAL_OPT_IN_ENV_KEYS = ["HASNA_MEMENTOS_LOCAL", "MEMENTOS_LOCAL"];
+  MEMENTOS_DB_PATH_ENV_KEYS = ["HASNA_MEMENTOS_DB_PATH", "MEMENTOS_DB_PATH"];
+  CONTRACTS_AMBIENT_ENVIRONMENT = Symbol.for("hasna:contracts:ambientClientEnvironment");
+});
+
 // src/db/api-mode.ts
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 import { writeFileSync as writeFileSync2, unlinkSync } from "fs";
 import { randomUUID } from "crypto";
-function firstEnv2(keys) {
+import {
+  clientTransportEnvKeys as clientTransportEnvKeys2,
+  resolveClientTransport,
+  resolveCredential,
+  toV1BaseUrl,
+  ClientTransportConfigurationError
+} from "@hasna/contracts/client";
+function firstEnv(keys, env2 = process.env) {
   for (const k of keys) {
-    const v = process.env[k]?.trim();
+    const v = env2[k]?.trim();
     if (v)
       return v;
   }
   return;
 }
-function firstEnvKey(keys) {
-  for (const k of keys) {
-    if (process.env[k]?.trim())
-      return k;
-  }
-  return null;
+function hasDatabaseUrl(env2 = process.env) {
+  return Boolean(firstEnv(DATABASE_URL_ENV_KEYS, env2));
 }
-function hasDatabaseUrl() {
-  return Boolean(firstEnv2(DATABASE_URL_ENV_KEYS));
+function assertCleanResolvedBase(baseUrl) {
+  if (/[?#]/.test(baseUrl)) {
+    throw new Error("mementos base URL must not contain userinfo, query, or fragment data");
+  }
+  return baseUrl;
 }
 function isLoopbackHost(rawHost) {
   const host = rawHost.replace(/^\[/, "").replace(/\]$/, "").toLowerCase();
@@ -1186,50 +1203,63 @@ function assertRequestAllowedUnderTest(baseUrl) {
     return;
   throw new Error("api-mode: REFUSING to make a cloud request from a test process \u2014 this would write to or read " + "from the SHARED PRODUCTION memory store, where test fixtures are indistinguishable from real " + `memories.
 ` + `  host           : ${host || "(unparseable base URL)"}
-` + `  how this happens: a selector set at module scope (after the bun test preload ran), or \`bun test\` ` + `invoked from a directory with no bunfig.toml so the preload never loaded.
+` + "  how this happens: a selector set at module scope (after the bun test preload ran), or `bun test` " + `invoked from a directory with no bunfig.toml so the preload never loaded.
 ` + "  fix            : build the child/process env via src/test-support/store-isolation.ts, or point the " + `suite at a loopback stub.
 ` + `  override       : set ${ALLOW_REMOTE_API_IN_TESTS_ENV}=1 only for a test that must reach a remote endpoint.`);
 }
-function normalizeBase(raw) {
-  let base = raw.trim().replace(/\/+$/, "");
-  if (/\/(v1|api)$/.test(base))
-    return base;
-  return `${base}/v1`;
+function toStoreConfigError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return new MementosStoreConfigError(`${message} Local SQLite is opt-in only (${DB_PATH_ENV_KEYS[0]}, or ${MEMENTOS_LOCAL_OPT_IN_ENV_KEYS[0]} = 1) and is disabled by default \u2014 failing closed`);
 }
-function assertUnambiguousStoreEnv(env = process.env) {
-  assertNoLegacyStorageMode2(env);
-  if (firstEnvKey(DB_PATH_ENV_KEYS))
-    return;
-  if (hasDatabaseUrl())
-    return;
-  const urlKey = firstEnvKey(API_URL_ENV_KEYS);
-  const keyKey = firstEnvKey(API_KEY_ENV_KEYS);
-  if (urlKey && !keyKey) {
-    throw new MementosStoreConfigError(`${urlKey} points at the cloud memory store but ${API_KEY_ENV_KEYS[0]} is not set. ` + `Refusing to serve the on-box SQLite store in its place, because it holds a different ` + `dataset. Set ${API_KEY_ENV_KEYS[0]} to reach the cloud store. If you meant to use the ` + `on-box SQLite store, unset ${urlKey} or set ${DB_PATH_ENV_KEYS[0]} explicitly.`);
-  }
-  if (keyKey && !urlKey) {
-    throw new MementosStoreConfigError(`${keyKey} is set but ${API_URL_ENV_KEYS[0]} is not, so the cloud memory store cannot be ` + `reached. Refusing to serve the on-box SQLite store in its place, because it holds a ` + `different dataset. Set ${API_URL_ENV_KEYS[0]} to reach the cloud store. If you meant to ` + `use the on-box SQLite store, unset ${keyKey} or set ${DB_PATH_ENV_KEYS[0]} explicitly.`);
-  }
-}
-function getApiConfig() {
-  assertUnambiguousStoreEnv();
-  if (firstEnvKey(DB_PATH_ENV_KEYS))
+function getApiConfig(env2 = process.env, options = {}) {
+  if (hasDatabaseUrl(env2))
     return null;
-  const rawBase = firstEnv2(API_URL_ENV_KEYS);
-  const apiKey = firstEnv2(API_KEY_ENV_KEYS);
-  if (!rawBase || !apiKey)
+  if (selectsMementosLocalStore(env2))
     return null;
-  return { baseUrl: normalizeBase(rawBase), apiKey };
+  const inputs = mementosResolverInputs(env2, options.credentials);
+  let credential;
+  try {
+    credential = resolveCredential("mementos", inputs.env, inputs.credentials);
+  } catch (error) {
+    throw toStoreConfigError(error);
+  }
+  let resolution;
+  try {
+    resolution = resolveClientTransport("mementos", inputs.env, {
+      credentials: credential ? { ...inputs.credentials, apiKey: credential.apiKey } : inputs.credentials
+    });
+  } catch (error) {
+    if (error instanceof ClientTransportConfigurationError && credential === null && /is not set and no API key could be resolved/.test(error.message)) {
+      return null;
+    }
+    throw toStoreConfigError(error);
+  }
+  return { baseUrl: assertCleanResolvedBase(resolution.baseUrl), apiKey: credential.apiKey };
 }
 function isApiMode() {
   if (hasDatabaseUrl())
     return false;
+  if (isServerContext())
+    return false;
   return getApiConfig() !== null;
 }
+function assertClientStoreConfigured(env2 = process.env, options = {}) {
+  if (selectsMementosLocalStore(env2))
+    return;
+  if (hasDatabaseUrl(env2))
+    return;
+  const config = getApiConfig(env2, options);
+  if (config !== null)
+    return;
+  throw new MementosStoreConfigError(unconfiguredStoreMessage());
+}
+function unconfiguredStoreMessage() {
+  return "mementos is not configured to reach any memory store, and will NOT fall back to the " + "on-box SQLite store (~/.hasna/mementos/mementos.db). " + "No credential could be resolved from the Keychain item hasna.credentials.mementos.api-key " + "(macOS only), ~/.hasna/mementos/config/credentials, or " + `${API_KEY_ENV_KEYS[0]}; the authority would be the fleet gateway ${"https://api.hasna.com/mementos"} ` + `(or ${API_URL_ENV_KEYS[0]} if set). ` + `Set ${API_URL_ENV_KEYS[0]} and ${API_KEY_ENV_KEYS[0]} (the resolver also accepts the legacy ` + `${API_URL_ENV_KEYS[1]} / ${API_KEY_ENV_KEYS[1]} aliases for one release) to use the fleet memory ` + `API, or opt into an explicit local SQLite file with ${DB_PATH_ENV_KEYS[0]} / ` + `${DB_PATH_ENV_KEYS[1]} (or ${MEMENTOS_LOCAL_OPT_IN_ENV_KEYS[0]}=1).`;
+}
 function apiRequestRaw(method, path, body) {
   const cfg = getApiConfig();
   if (!cfg)
-    throw new Error("api-mode: not configured (HASNA_MEMENTOS_API_URL / HASNA_MEMENTOS_API_KEY)");
+    throw new Error("api-mode: not configured (no Hasna mementos credential resolved)");
   assertRequestAllowedUnderTest(cfg.baseUrl);
   const url = `${cfg.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
   const hasBody = body !== undefined && body !== null;
@@ -1256,8 +1286,15 @@ x-api-key: ${cfg.apiKey}
   ];
   let bodyFile;
   if (hasBody) {
-    bodyFile = join4(tmpdir(), `mem-req-${process.pid}-${randomUUID()}.json`);
-    writeFileSync2(bodyFile, JSON.stringify(body), { mode: 384 });
+    bodyFile = join3(tmpdir(), `mem-req-${process.pid}-${randomUUID()}.json`);
+    try {
+      writeFileSync2(bodyFile, JSON.stringify(body), { mode: 384 });
+    } catch (error) {
+      try {
+        unlinkSync(bodyFile);
+      } catch {}
+      throw error;
+    }
     args.push("--data-binary", `@${bodyFile}`);
   }
   args.push(url);
@@ -1305,7 +1342,7 @@ function apiJson(method, path, body, options) {
       try {
         data = JSON.parse(raw.body);
       } catch (e) {
-        throw new ApiRequestError(`mementos cloud ${method} ${path} returned status ${raw.status} with a body that is not valid JSON (${e instanceof Error ? e.message : String(e)}) \u2014 the response is truncated or the server is unhealthy`, raw.status, raw.body.slice(0, 500));
+        throw new ApiRequestError(`mementos cloud ${method} ${path} returned status ${raw.status} with a body that is not valid JSON (${e instanceof Error ? e.message : String(e)}) \u2014 the response is truncated or the server is unhealthy`, raw.status, "");
       }
     } else {
       data = undefined;
@@ -1344,13 +1381,14 @@ function toQuery(params) {
   const s = sp.toString();
   return s ? `?${s}` : "";
 }
-var API_URL_ENV_KEYS, API_KEY_ENV_KEYS, DATABASE_URL_ENV_KEYS, ALLOW_REMOTE_API_IN_TESTS_ENV = "MEMENTOS_ALLOW_REMOTE_API_IN_TESTS", DB_PATH_ENV_KEYS, MementosStoreConfigError, ApiRequestError, DEFAULT_TIMEOUT_S = "45";
+var API_URL_ENV_KEYS, API_KEY_ENV_KEYS, DATABASE_URL_ENV_KEYS, DB_PATH_ENV_KEYS, ALLOW_REMOTE_API_IN_TESTS_ENV = "MEMENTOS_ALLOW_REMOTE_API_IN_TESTS", MementosStoreConfigError, ApiRequestError, DEFAULT_TIMEOUT_S = "45";
 var init_api_mode = __esm(() => {
-  init_retired_storage_mode();
-  API_URL_ENV_KEYS = ["HASNA_MEMENTOS_API_URL", "MEMENTOS_API_URL"];
-  API_KEY_ENV_KEYS = ["HASNA_MEMENTOS_API_KEY", "MEMENTOS_API_KEY"];
+  init_local_opt_in();
+  init_storage();
+  API_URL_ENV_KEYS = clientTransportEnvKeys2("mementos").apiUrlKeys;
+  API_KEY_ENV_KEYS = clientTransportEnvKeys2("mementos").apiKeyKeys;
   DATABASE_URL_ENV_KEYS = ["HASNA_MEMENTOS_DATABASE_URL", "MEMENTOS_DATABASE_URL"];
-  DB_PATH_ENV_KEYS = ["HASNA_MEMENTOS_DB_PATH", "MEMENTOS_DB_PATH"];
+  DB_PATH_ENV_KEYS = MEMENTOS_DB_PATH_ENV_KEYS;
   MementosStoreConfigError = class MementosStoreConfigError extends Error {
     code = "MEMENTOS_STORE_CONFIG";
     constructor(message) {
@@ -2759,6 +2797,220 @@ INSERT OR IGNORE INTO _migrations (id) VALUES (38);
     `
 ${sqliteMementosMemoryProjectLinkSchemaSql()}
 INSERT OR IGNORE INTO _migrations (id) VALUES (40);
+`,
+    `
+DROP TABLE IF EXISTS temp.mementos_m41_machine_preflight;
+CREATE TEMP TABLE mementos_m41_machine_preflight (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL CHECK(
+    length(name) BETWEEN 1 AND 128
+    AND instr(name, char(0)) = 0
+    AND instr(name, char(1)) = 0
+    AND instr(name, char(2)) = 0
+    AND instr(name, char(3)) = 0
+    AND instr(name, char(4)) = 0
+    AND instr(name, char(5)) = 0
+    AND instr(name, char(6)) = 0
+    AND instr(name, char(7)) = 0
+    AND instr(name, char(8)) = 0
+    AND instr(name, char(9)) = 0
+    AND instr(name, char(10)) = 0
+    AND instr(name, char(11)) = 0
+    AND instr(name, char(12)) = 0
+    AND instr(name, char(13)) = 0
+    AND instr(name, char(14)) = 0
+    AND instr(name, char(15)) = 0
+    AND instr(name, char(16)) = 0
+    AND instr(name, char(17)) = 0
+    AND instr(name, char(18)) = 0
+    AND instr(name, char(19)) = 0
+    AND instr(name, char(20)) = 0
+    AND instr(name, char(21)) = 0
+    AND instr(name, char(22)) = 0
+    AND instr(name, char(23)) = 0
+    AND instr(name, char(24)) = 0
+    AND instr(name, char(25)) = 0
+    AND instr(name, char(26)) = 0
+    AND instr(name, char(27)) = 0
+    AND instr(name, char(28)) = 0
+    AND instr(name, char(29)) = 0
+    AND instr(name, char(30)) = 0
+    AND instr(name, char(31)) = 0
+    AND instr(name, char(127)) = 0
+  ),
+  hostname TEXT NOT NULL UNIQUE CHECK(
+    length(hostname) BETWEEN 1 AND 253
+    AND hostname = lower(rtrim(trim(hostname), '.'))
+    AND instr(hostname, ' ') = 0
+    AND instr(hostname, char(9)) = 0
+    AND instr(hostname, char(10)) = 0
+    AND instr(hostname, char(13)) = 0
+    AND instr(hostname, '/') = 0
+    AND instr(hostname, char(92)) = 0
+  ),
+  platform TEXT NOT NULL CHECK(
+    length(platform) BETWEEN 1 AND 64
+    AND platform = lower(trim(platform))
+    AND platform NOT GLOB '*[^a-z0-9._-]*'
+  ),
+  is_primary INTEGER NOT NULL CHECK(is_primary IN (0, 1)),
+  created_at TEXT NOT NULL CHECK(julianday(created_at) IS NOT NULL),
+  last_seen_at TEXT NOT NULL CHECK(
+    julianday(last_seen_at) IS NOT NULL
+    AND julianday(last_seen_at) >= julianday(created_at)
+  )
+);
+INSERT INTO mementos_m41_machine_preflight
+  (id, name, hostname, platform, is_primary, created_at, last_seen_at)
+SELECT
+  id,
+  name,
+  lower(rtrim(trim(hostname), '.')),
+  platform,
+  is_primary,
+  created_at,
+  last_seen_at
+FROM machines;
+
+UPDATE machines
+SET hostname = (
+  SELECT preflight.hostname
+  FROM mementos_m41_machine_preflight preflight
+  WHERE preflight.id = machines.id
+);
+
+DROP TABLE mementos_m41_machine_preflight;
+DROP TRIGGER IF EXISTS machines_single_primary_insert;
+DROP TRIGGER IF EXISTS machines_single_primary_update;
+DROP INDEX IF EXISTS idx_machines_hostname;
+CREATE UNIQUE INDEX idx_machines_hostname ON machines(hostname);
+DROP INDEX IF EXISTS idx_machines_single_primary;
+CREATE UNIQUE INDEX idx_machines_single_primary
+  ON machines(is_primary) WHERE is_primary = 1;
+
+CREATE TRIGGER IF NOT EXISTS machines_hostname_canonical_insert
+BEFORE INSERT ON machines
+WHEN NEW.hostname != lower(rtrim(trim(NEW.hostname), '.'))
+  OR length(NEW.hostname) NOT BETWEEN 1 AND 253
+  OR instr(NEW.hostname, ' ') > 0
+  OR instr(NEW.hostname, char(9)) > 0
+  OR instr(NEW.hostname, char(10)) > 0
+  OR instr(NEW.hostname, char(13)) > 0
+  OR instr(NEW.hostname, '/') > 0
+  OR instr(NEW.hostname, char(92)) > 0
+BEGIN
+  SELECT RAISE(ABORT, 'machines.hostname must be canonical');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_hostname_canonical_update
+BEFORE UPDATE OF hostname ON machines
+WHEN NEW.hostname != lower(rtrim(trim(NEW.hostname), '.'))
+  OR length(NEW.hostname) NOT BETWEEN 1 AND 253
+  OR instr(NEW.hostname, ' ') > 0
+  OR instr(NEW.hostname, char(9)) > 0
+  OR instr(NEW.hostname, char(10)) > 0
+  OR instr(NEW.hostname, char(13)) > 0
+  OR instr(NEW.hostname, '/') > 0
+  OR instr(NEW.hostname, char(92)) > 0
+BEGIN
+  SELECT RAISE(ABORT, 'machines.hostname must be canonical');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_runtime_contract_insert
+BEFORE INSERT ON machines
+WHEN length(NEW.name) NOT BETWEEN 1 AND 128
+  OR instr(NEW.name, char(0)) > 0
+  OR instr(NEW.name, char(1)) > 0
+  OR instr(NEW.name, char(2)) > 0
+  OR instr(NEW.name, char(3)) > 0
+  OR instr(NEW.name, char(4)) > 0
+  OR instr(NEW.name, char(5)) > 0
+  OR instr(NEW.name, char(6)) > 0
+  OR instr(NEW.name, char(7)) > 0
+  OR instr(NEW.name, char(8)) > 0
+  OR instr(NEW.name, char(9)) > 0
+  OR instr(NEW.name, char(10)) > 0
+  OR instr(NEW.name, char(11)) > 0
+  OR instr(NEW.name, char(12)) > 0
+  OR instr(NEW.name, char(13)) > 0
+  OR instr(NEW.name, char(14)) > 0
+  OR instr(NEW.name, char(15)) > 0
+  OR instr(NEW.name, char(16)) > 0
+  OR instr(NEW.name, char(17)) > 0
+  OR instr(NEW.name, char(18)) > 0
+  OR instr(NEW.name, char(19)) > 0
+  OR instr(NEW.name, char(20)) > 0
+  OR instr(NEW.name, char(21)) > 0
+  OR instr(NEW.name, char(22)) > 0
+  OR instr(NEW.name, char(23)) > 0
+  OR instr(NEW.name, char(24)) > 0
+  OR instr(NEW.name, char(25)) > 0
+  OR instr(NEW.name, char(26)) > 0
+  OR instr(NEW.name, char(27)) > 0
+  OR instr(NEW.name, char(28)) > 0
+  OR instr(NEW.name, char(29)) > 0
+  OR instr(NEW.name, char(30)) > 0
+  OR instr(NEW.name, char(31)) > 0
+  OR instr(NEW.name, char(127)) > 0
+  OR length(NEW.platform) NOT BETWEEN 1 AND 64
+  OR NEW.platform != lower(trim(NEW.platform))
+  OR NEW.platform GLOB '*[^a-z0-9._-]*'
+  OR NEW.is_primary NOT IN (0, 1)
+  OR julianday(NEW.created_at) IS NULL
+  OR julianday(NEW.last_seen_at) IS NULL
+  OR julianday(NEW.last_seen_at) < julianday(NEW.created_at)
+BEGIN
+  SELECT RAISE(ABORT, 'machines row violates the persisted runtime contract');
+END;
+
+CREATE TRIGGER IF NOT EXISTS machines_runtime_contract_update
+BEFORE UPDATE OF name, platform, is_primary, created_at, last_seen_at ON machines
+WHEN length(NEW.name) NOT BETWEEN 1 AND 128
+  OR instr(NEW.name, char(0)) > 0
+  OR instr(NEW.name, char(1)) > 0
+  OR instr(NEW.name, char(2)) > 0
+  OR instr(NEW.name, char(3)) > 0
+  OR instr(NEW.name, char(4)) > 0
+  OR instr(NEW.name, char(5)) > 0
+  OR instr(NEW.name, char(6)) > 0
+  OR instr(NEW.name, char(7)) > 0
+  OR instr(NEW.name, char(8)) > 0
+  OR instr(NEW.name, char(9)) > 0
+  OR instr(NEW.name, char(10)) > 0
+  OR instr(NEW.name, char(11)) > 0
+  OR instr(NEW.name, char(12)) > 0
+  OR instr(NEW.name, char(13)) > 0
+  OR instr(NEW.name, char(14)) > 0
+  OR instr(NEW.name, char(15)) > 0
+  OR instr(NEW.name, char(16)) > 0
+  OR instr(NEW.name, char(17)) > 0
+  OR instr(NEW.name, char(18)) > 0
+  OR instr(NEW.name, char(19)) > 0
+  OR instr(NEW.name, char(20)) > 0
+  OR instr(NEW.name, char(21)) > 0
+  OR instr(NEW.name, char(22)) > 0
+  OR instr(NEW.name, char(23)) > 0
+  OR instr(NEW.name, char(24)) > 0
+  OR instr(NEW.name, char(25)) > 0
+  OR instr(NEW.name, char(26)) > 0
+  OR instr(NEW.name, char(27)) > 0
+  OR instr(NEW.name, char(28)) > 0
+  OR instr(NEW.name, char(29)) > 0
+  OR instr(NEW.name, char(30)) > 0
+  OR instr(NEW.name, char(31)) > 0
+  OR instr(NEW.name, char(127)) > 0
+  OR length(NEW.platform) NOT BETWEEN 1 AND 64
+  OR NEW.platform != lower(trim(NEW.platform))
+  OR NEW.platform GLOB '*[^a-z0-9._-]*'
+  OR NEW.is_primary NOT IN (0, 1)
+  OR julianday(NEW.created_at) IS NULL
+  OR julianday(NEW.last_seen_at) IS NULL
+  OR julianday(NEW.last_seen_at) < julianday(NEW.created_at)
+BEGIN
+  SELECT RAISE(ABORT, 'machines row violates the persisted runtime contract');
+END;
+
+INSERT OR IGNORE INTO _migrations (id) VALUES (41);
 `
   ];
 });
@@ -2774,10 +3026,11 @@ __export(exports_database, {
   getDbPath: () => getDbPath,
   getDatabase: () => getDatabase,
   escapeLikePrefix: () => escapeLikePrefix,
-  closeDatabase: () => closeDatabase
+  closeDatabase: () => closeDatabase,
+  applyMachineIdentityMigration: () => applyMachineIdentityMigration
 });
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, cpSync } from "fs";
-import { dirname, join as join5, resolve as resolve2 } from "path";
+import { dirname, join as join4, resolve as resolve2 } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -2786,7 +3039,7 @@ function findNearestMementosDb(startDir) {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
   const legacyHomeDb = resolve2(home, ".mementos", "mementos.db");
   while (true) {
-    const candidate = join5(dir, ".mementos", "mementos.db");
+    const candidate = join4(dir, ".mementos", "mementos.db");
     if (existsSync3(candidate) && resolve2(candidate) !== legacyHomeDb)
       return candidate;
     const parent = dirname(dir);
@@ -2799,7 +3052,7 @@ function findNearestMementosDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve2(startDir);
   while (true) {
-    if (existsSync3(join5(dir, ".git")))
+    if (existsSync3(join4(dir, ".git")))
       return dir;
     const parent = dirname(dir);
     if (parent === dir)
@@ -2809,9 +3062,11 @@ function findGitRoot(startDir) {
   return null;
 }
 function migrateGlobalDir() {
+  if (!selectsMementosLocalStore())
+    return;
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
   const newDir = getDataRoot();
-  const oldDir = join5(home, ".mementos");
+  const oldDir = join4(home, ".mementos");
   if (!existsSync3(newDir) && existsSync3(oldDir)) {
     mkdirSync2(dirname(newDir), { recursive: true });
     cpSync(oldDir, newDir, { recursive: true });
@@ -2830,11 +3085,11 @@ function getDbPath() {
   if (process.env["MEMENTOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join5(gitRoot, ".mementos", "mementos.db");
+      return join4(gitRoot, ".mementos", "mementos.db");
     }
   }
   migrateGlobalDir();
-  return join5(getDataRoot(), "mementos.db");
+  return join4(getDataRoot(), "mementos.db");
 }
 function ensureDir(filePath) {
   if (isInMemoryDb(filePath))
@@ -2870,6 +3125,9 @@ function getDatabase(dbPath) {
         throw new Error("REFUSING-UNPINNED-TEST-OPEN: a test process tried to open the default local " + `SQLite store (${getDbPath()}) with no explicit dbPath argument and no ` + `${DB_PATH_ENV_KEYS.join("/")} set. Pass an explicit dbPath (e.g. ":memory:" ` + "or a scratch file), or set one of those env keys to a scratch path, before " + "calling getDatabase(). This guard exists because an unpinned test process " + "would otherwise silently read and write the real, shared, on-disk memory " + "store (todos 57b8b8c5).");
       }
     }
+    if (process.env["NODE_ENV"] !== "test" && !isServerContext()) {
+      assertClientStoreConfigured();
+    }
   }
   const path = dbPath || getDbPath();
   if (_db) {
@@ -2882,7 +3140,6 @@ function getDatabase(dbPath) {
   ensureDir(path);
   _db = new SqliteAdapter(path);
   _db.run("PRAGMA journal_mode = WAL");
-  _db.run("PRAGMA busy_timeout = 5000");
   _db.run("PRAGMA foreign_keys = ON");
   _db.run("PRAGMA wal_autocheckpoint = 100");
   runMigrations(_db);
@@ -2898,32 +3155,62 @@ function getDatabase(dbPath) {
   return _db;
 }
 function runMigrations(db) {
+  let currentLevel = 0;
   try {
     const result = db.query("SELECT MAX(id) as max_id FROM _migrations").get();
-    const currentLevel = result?.max_id ?? 0;
-    for (let i = currentLevel;i < MIGRATIONS.length; i++) {
-      try {
-        applyMigration(db, i);
-      } catch (e) {
-        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
-      }
-    }
-  } catch {
-    for (let i = 0;i < MIGRATIONS.length; i++) {
-      try {
-        applyMigration(db, i);
-      } catch (e) {
-        console.warn(`[mementos] Migration ${i + 1} failed: ${e instanceof Error ? e.message : String(e)}`);
+    currentLevel = result?.max_id ?? 0;
+  } catch {}
+  for (let i = currentLevel;i < MIGRATIONS.length; i++) {
+    try {
+      applyMigration(db, i);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (i === 40) {
+        throw new Error(`Mementos migration 41 refused unsafe machine identity data: ${message}`);
       }
+      console.warn(`[mementos] Migration ${i + 1} failed: ${message}`);
     }
   }
 }
 function applyMigration(db, index) {
-  if (index === 32) {
+  if (index === 32)
     ensureMachinePrimaryColumn(db);
+  if (index === 40) {
+    applyMachineIdentityMigration(db);
+    return;
   }
   db.exec(MIGRATIONS[index]);
 }
+function applyMachineIdentityMigration(db) {
+  db.transaction(() => {
+    const rows = db.query("SELECT id, name, hostname, platform, is_primary, created_at, last_seen_at FROM machines").all();
+    const identities = new Map;
+    let primaryCount = 0;
+    for (const row of rows) {
+      const canonical = row.hostname.trim().replace(/\.+$/, "").toLowerCase();
+      const createdAt = new Date(row.created_at).getTime();
+      const lastSeenAt = new Date(row.last_seen_at).getTime();
+      const primaryValueValid = row.is_primary === 0 || row.is_primary === 1 || row.is_primary === false || row.is_primary === true;
+      if (!row.id || !row.name || row.name.length > 128 || /[\u0000-\u001f\u007f]/.test(row.name) || !canonical || canonical.length > 253 || /[\u0000-\u001f\u007f/\\\s]/.test(canonical) || !row.platform || row.platform.length > 64 || row.platform !== row.platform.trim().toLowerCase() || !/^[a-z0-9._-]+$/.test(row.platform) || !primaryValueValid || !Number.isFinite(createdAt) || !Number.isFinite(lastSeenAt) || lastSeenAt < createdAt) {
+        throw new Error(`invalid legacy machine row ${row.id || "(missing id)"}`);
+      }
+      const owner = identities.get(canonical);
+      if (owner && owner !== row.id) {
+        throw new Error(`ambiguous normalized hostname '${canonical}' belongs to both ${owner} and ${row.id}`);
+      }
+      identities.set(canonical, row.id);
+      if (Boolean(row.is_primary))
+        primaryCount += 1;
+    }
+    if (primaryCount > 1) {
+      throw new Error(`legacy machine registry contains ${primaryCount} primary rows`);
+    }
+    db.exec(MIGRATIONS[40]);
+    const receipt = db.query("SELECT id FROM _migrations WHERE id = 41").get();
+    if (receipt?.id !== 41)
+      throw new Error("machine identity migration did not record completion");
+  });
+}
 function ensureMachinePrimaryColumn(db) {
   const columns = db.query("PRAGMA table_info(machines)").all();
   if (columns.length === 0 || columns.some((column) => column.name === "is_primary")) {
@@ -2979,6 +3266,7 @@ var init_database = __esm(() => {
   init_api_mode();
   init_migrations();
   init_paths();
+  init_local_opt_in();
   ALLOWED_TABLES = new Set([
     "memories",
     "agents",
@@ -3007,13 +3295,13 @@ import { createHash } from "crypto";
 
 // src/lib/package-version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, join as join6 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getMementosPackageVersion() {
   const here = dirname2(fileURLToPath2(import.meta.url));
   for (const candidate of [
-    join6(here, "..", "..", "package.json"),
-    join6(here, "..", "package.json")
+    join5(here, "..", "..", "package.json"),
+    join5(here, "..", "package.json")
   ]) {
     try {
       const parsed = JSON.parse(readFileSync2(candidate, "utf8"));
@@ -5200,6 +5488,17 @@ var SECRET_PATTERNS = [
   { name: "jwt", pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g },
   { name: "hex_secret", pattern: /(?<=(?:key|token|secret|password|hash)\s*[:=]\s*["']?)[0-9a-f]{32,}(?=["']?)/gi }
 ];
+var KEY_TAG_SECRET_PATTERNS = SECRET_PATTERNS.filter((p) => new Set([
+  "openai_key",
+  "anthropic_key",
+  "aws_key",
+  "github_token",
+  "github_oauth",
+  "npm_token",
+  "stripe_key",
+  "slack_token",
+  "jwt"
+]).has(p.name));
 function redactSecrets(text) {
   let result = text;
   for (const { pattern } of SECRET_PATTERNS) {
@@ -5208,6 +5507,14 @@ function redactSecrets(text) {
   }
   return result;
 }
+function redactCredentialKey(text) {
+  let result = text;
+  for (const { pattern } of KEY_TAG_SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, REDACTED);
+  }
+  return result;
+}
 function containsSecrets(text) {
   for (const { pattern } of SECRET_PATTERNS) {
     pattern.lastIndex = 0;
@@ -5216,6 +5523,40 @@ function containsSecrets(text) {
   }
   return false;
 }
+function redactValueTree(value) {
+  if (typeof value === "string")
+    return redactSecrets(value);
+  if (Array.isArray(value))
+    return value.map(redactValueTree);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactValueTree(v);
+    }
+    return out;
+  }
+  return value;
+}
+function redactMemoryWriteInput(input) {
+  const out = { ...input };
+  if (typeof out.key === "string")
+    out.key = redactCredentialKey(out.key);
+  if (typeof out.value === "string")
+    out.value = redactSecrets(out.value);
+  if (out.summary !== undefined && out.summary !== null) {
+    out.summary = redactSecrets(String(out.summary));
+  }
+  if (Array.isArray(out.tags)) {
+    out.tags = out.tags.map((t) => redactCredentialKey(String(t)));
+  }
+  if (typeof out.when_to_use === "string") {
+    out.when_to_use = redactSecrets(out.when_to_use);
+  }
+  if (out.metadata !== undefined) {
+    out.metadata = redactValueTree(out.metadata);
+  }
+  return out;
+}
 
 // src/lib/hooks.ts
 var _idCounter = 0;
@@ -5528,6 +5869,7 @@ function createMemory(input, dedupeMode = "merge", db) {
   if (reservedViolation) {
     throw new Error(reservedViolation);
   }
+  input = redactMemoryWriteInput(input);
   if (!db && isApiMode()) {
     const { status, data } = apiJson("POST", "/memories", { ...input, dedupe: dedupeMode });
     if (!data || !data.id) {
@@ -5820,7 +6162,7 @@ function buildMemoryListConditions(filter) {
       conditions.push("status = 'active'");
     }
     if (filter.project_id) {
-      conditions.push("project_id = ?");
+      conditions.push(filter.include_unassigned_project === true ? "(project_id = ? OR project_id IS NULL)" : "project_id = ?");
       params.push(filter.project_id);
     }
     if (filter.agent_id) {
@@ -5900,6 +6242,7 @@ function listMemoriesPage(filter, db) {
       pinned: f.pinned,
       agent_id: f.agent_id,
       project_id: f.project_id,
+      include_unassigned_project: f.project_id && f.include_unassigned_project === true ? true : undefined,
       session_id: f.session_id,
       machine_id: f.machine_id,
       visible_to_machine_id: f.visible_to_machine_id,
@@ -5924,7 +6267,7 @@ function listMemoriesPage(filter, db) {
   if (conditions.length > 0) {
     sql += ` WHERE ${conditions.join(" AND ")}`;
   }
-  sql += " ORDER BY importance DESC, created_at DESC";
+  sql += " ORDER BY importance DESC, created_at DESC, id DESC";
   if (f.limit) {
     sql += " LIMIT ?";
     params.push(f.limit);
@@ -5985,6 +6328,7 @@ function listMemoriesBounded(filter = {}, target, db) {
   };
 }
 function updateMemory(id, input, db) {
+  input = redactMemoryWriteInput(input);
   if (!db && isApiMode()) {
     const { status, data } = apiJson("PATCH", `/memories/${encodeURIComponent(id)}`, input, { allow404: true });
     if (status === 404)