@kanadego/dsh-heartbeat 1.9.1 → 1.9.2

package/dist/{chunk-OYVNWB5G.js → chunk-CUOSICYJ.js}

@@ -3,7 +3,7 @@ import {
   readText,
   saveJson,
   writeText
-} from "./chunk-7TW6DD6Q.js";
+} from "./chunk-K5Y6JP2B.js";
 import {
   atomicWriteFileSync
 } from "./chunk-WRUTATW4.js";
@@ -477,4 +477,4 @@ export {
   verifyProfile,
   rebuildProfile
 };
-//# sourceMappingURL=chunk-OYVNWB5G.js.map
+//# sourceMappingURL=chunk-CUOSICYJ.js.map

package/dist/{chunk-WRJCINZ7.js → chunk-IG6YMUHW.js}

@@ -3,10 +3,10 @@ import {
   loadPool,
   normalizeCategory,
   seedsFilePath
-} from "./chunk-KOOQOMQY.js";
+} from "./chunk-JDH2LDFS.js";
 import {
   appendAuditLine
-} from "./chunk-OYVNWB5G.js";
+} from "./chunk-CUOSICYJ.js";
 import {
   loadEncryptedText,
   loadJson,
@@ -15,7 +15,7 @@ import {
   saveJson,
   workspace,
   writeText
-} from "./chunk-7TW6DD6Q.js";
+} from "./chunk-K5Y6JP2B.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-WRUTATW4.js";
@@ -566,4 +566,4 @@ export {
   buildWeeklyPrompt,
   renderTemplateReport
 };
-//# sourceMappingURL=chunk-WRJCINZ7.js.map
+//# sourceMappingURL=chunk-IG6YMUHW.js.map

package/dist/{chunk-KOOQOMQY.js → chunk-JDH2LDFS.js}

@@ -4,7 +4,7 @@ import {
 import {
   loadEncryptedText,
   saveEncryptedText
-} from "./chunk-7TW6DD6Q.js";
+} from "./chunk-K5Y6JP2B.js";
 
 // src/seeds/pool.ts
 import path from "path";
@@ -314,4 +314,4 @@ export {
   restoreSeed,
   deleteSeed
 };
-//# sourceMappingURL=chunk-KOOQOMQY.js.map
+//# sourceMappingURL=chunk-JDH2LDFS.js.map

package/dist/chunk-K5Y6JP2B.js

@@ -0,0 +1,399 @@
+import {
+  burnFileSync
+} from "./chunk-WRUTATW4.js";
+
+// src/core/paths.ts
+import fs2 from "fs";
+import os from "os";
+import path2 from "path";
+import { fileURLToPath } from "url";
+
+// src/core/data-relocate.ts
+import fs from "fs";
+import path from "path";
+import { createHash } from "crypto";
+var SKELETON_DIRS = ["settings", "logs", "tmp", "exports"];
+var SCRATCH_DIR = "tmp";
+var MAGIC = Buffer.from("KHBV1", "ascii");
+function hasPayload(dir) {
+  if (!fs.existsSync(dir)) return false;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) return true;
+    if (!SKELETON_DIRS.includes(entry.name)) return true;
+    if (entry.name === SCRATCH_DIR) continue;
+    if (fs.readdirSync(path.join(dir, entry.name)).length > 0) return true;
+  }
+  return false;
+}
+function walk(dir, prefix = "", out = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) {
+      if (!prefix && entry.name === SCRATCH_DIR) continue;
+      walk(path.join(dir, entry.name), rel, out);
+    } else if (entry.isFile()) {
+      out.push(rel);
+    }
+  }
+  return out.sort();
+}
+function copyTree(src, dst) {
+  const scratch = path.resolve(path.join(src, SCRATCH_DIR));
+  fs.cpSync(src, dst, {
+    recursive: true,
+    force: true,
+    preserveTimestamps: true,
+    filter: (from) => path.resolve(from) !== scratch
+  });
+}
+function removeTree(dir) {
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+function sha256(file) {
+  return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+function isEncryptedFile(file) {
+  const fd = fs.openSync(file, "r");
+  try {
+    const head = Buffer.alloc(MAGIC.length);
+    const read = fs.readSync(fd, head, 0, MAGIC.length, 0);
+    return read === MAGIC.length && head.equals(MAGIC);
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+function parsesAsJson(file) {
+  if (isEncryptedFile(file)) return true;
+  const text = fs.readFileSync(file, "utf8");
+  try {
+    if (file.endsWith(".jsonl")) {
+      for (const line of text.split("\n")) if (line.trim()) JSON.parse(line);
+      return true;
+    }
+    JSON.parse(text);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function verifyTrees(srcDir, dstDir) {
+  const problems = [];
+  const warnings = [];
+  let files = 0;
+  let bytes = 0;
+  if (!fs.existsSync(dstDir)) {
+    return { ok: false, files: 0, bytes: 0, problems: [`copy missing: ${dstDir}`], warnings };
+  }
+  const expected = walk(srcDir);
+  const actual = walk(dstDir);
+  const actualSet = new Set(actual);
+  const expectedSet = new Set(expected);
+  for (const rel of expected) if (!actualSet.has(rel)) problems.push(`missing: ${rel}`);
+  for (const rel of actual) if (!expectedSet.has(rel)) problems.push(`unexpected: ${rel}`);
+  for (const rel of expected) {
+    const from = path.join(srcDir, rel);
+    const to = path.join(dstDir, rel);
+    if (!fs.existsSync(to)) continue;
+    const sizeFrom = fs.statSync(from).size;
+    const sizeTo = fs.statSync(to).size;
+    files += 1;
+    bytes += sizeFrom;
+    if (sizeFrom !== sizeTo) {
+      problems.push(`size differs: ${rel} (${sizeFrom} -> ${sizeTo})`);
+      continue;
+    }
+    if (sha256(from) !== sha256(to)) {
+      problems.push(`content differs: ${rel}`);
+      continue;
+    }
+    if (/\.(json|jsonl)$/i.test(rel) && !parsesAsJson(to)) warnings.push(`unparseable: ${rel}`);
+  }
+  return { ok: problems.length === 0, files, bytes, problems, warnings };
+}
+function stamp(now) {
+  const d = new Date(now);
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;
+}
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function relocateDataDir(opts) {
+  const srcDir = path.resolve(opts.srcDir);
+  const dstDir = path.resolve(opts.dstDir);
+  if (!fs.existsSync(srcDir)) return { action: "skipped", reason: "source-missing" };
+  if (!hasPayload(srcDir)) return { action: "skipped", reason: "no-payload" };
+  if (hasPayload(dstDir)) return { action: "skipped", reason: "destination-exists" };
+  const suffix = stamp(opts.now ?? Date.now());
+  const backupDir = `${srcDir}.bak-relocate-${suffix}`;
+  const stagingDir = `${dstDir}.staging-${suffix}`;
+  try {
+    copyTree(srcDir, backupDir);
+  } catch (error) {
+    return { action: "failed", stage: "backup", problems: [errorText(error)], backupDir: null };
+  }
+  try {
+    copyTree(srcDir, stagingDir);
+  } catch (error) {
+    return { action: "failed", stage: "copy", problems: [errorText(error)], backupDir };
+  }
+  const verified = verifyTrees(srcDir, stagingDir);
+  if (!verified.ok) {
+    try {
+      removeTree(stagingDir);
+    } catch {
+    }
+    return { action: "failed", stage: "verify", problems: verified.problems, backupDir };
+  }
+  try {
+    if (fs.existsSync(dstDir)) removeTree(dstDir);
+    fs.renameSync(stagingDir, dstDir);
+  } catch (error) {
+    try {
+      removeTree(stagingDir);
+    } catch {
+    }
+    return { action: "failed", stage: "commit", problems: [errorText(error)], backupDir };
+  }
+  const leftovers = [];
+  try {
+    removeTree(srcDir);
+  } catch {
+    leftovers.push(srcDir);
+  }
+  try {
+    removeTree(backupDir);
+  } catch {
+    leftovers.push(backupDir);
+  }
+  return {
+    action: "relocated",
+    srcDir,
+    dstDir,
+    backupDir,
+    files: verified.files,
+    bytes: verified.bytes,
+    warnings: verified.warnings,
+    leftovers
+  };
+}
+
+// src/core/paths.ts
+var resolved = null;
+function findPackageRoot(startFile) {
+  let dir = path2.dirname(path2.resolve(startFile));
+  for (; ; ) {
+    if (fs2.existsSync(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir) throw new Error("package.json not found above " + startFile);
+    dir = parent;
+  }
+}
+function packageRoot() {
+  return findPackageRoot(fileURLToPath(import.meta.url));
+}
+function defaultDataDir(env = process.env, home = os.homedir()) {
+  const override = env.DSH_HOME?.trim();
+  const root = override && override.length > 0 ? override : path2.join(home, ".dsh");
+  return path2.join(root, "heartbeat-data");
+}
+function initWorkspace(config = {}) {
+  if (resolved) return resolved;
+  const root = packageRoot();
+  const explicit = process.env.HEARTBEAT_DATA_DIR || config.dataDir;
+  const homeDir = path2.resolve(defaultDataDir());
+  const legacyDir = path2.join(root, "data");
+  let dataDir;
+  let relocation;
+  if (explicit) {
+    dataDir = path2.resolve(explicit);
+  } else if (hasPayload(homeDir)) {
+    dataDir = homeDir;
+  } else if (hasPayload(legacyDir)) {
+    relocation = relocateDataDir({ srcDir: legacyDir, dstDir: homeDir });
+    dataDir = relocation.action === "relocated" ? homeDir : legacyDir;
+  } else {
+    dataDir = homeDir;
+  }
+  const paths = {
+    dataDir,
+    settingsDir: path2.join(dataDir, "settings"),
+    logsDir: path2.join(dataDir, "logs"),
+    tmpDir: path2.join(dataDir, "tmp"),
+    exportsDir: path2.join(dataDir, "exports"),
+    packageRoot: root,
+    configDir: path2.join(root, "config"),
+    assetsDir: path2.join(root, "assets"),
+    ...relocation ? { relocation } : {}
+  };
+  for (const dir of [
+    paths.dataDir,
+    paths.settingsDir,
+    paths.logsDir,
+    paths.tmpDir,
+    paths.exportsDir
+  ]) {
+    fs2.mkdirSync(dir, { recursive: true });
+  }
+  resolved = paths;
+  return paths;
+}
+function workspace() {
+  if (!resolved) throw new Error("workspace not initialized: call initWorkspace() first");
+  return resolved;
+}
+
+// src/vault/vault.ts
+import fs3 from "fs";
+import path3 from "path";
+import { spawnSync } from "child_process";
+import { randomUUID } from "crypto";
+var MAGIC2 = Buffer.from("KHBV1", "ascii");
+var VAULT_TIMEOUT_MS = 3e4;
+var cachedScriptPath = null;
+function vaultScriptPath() {
+  if (cachedScriptPath) return cachedScriptPath;
+  const script = path3.join(workspace().assetsDir, "vault.ps1");
+  if (!fs3.existsSync(script)) throw new Error(`vault script missing: ${script}`);
+  cachedScriptPath = script;
+  return script;
+}
+function tmpPlainName(target) {
+  return path3.join(workspace().tmpDir, `.${path3.basename(target)}.${randomUUID().slice(0, 8)}.plain`);
+}
+function tmpEncName(target) {
+  return path3.join(workspace().tmpDir, `.${path3.basename(target)}.${randomUUID().slice(0, 8)}.enc`);
+}
+function runVault(guard, args) {
+  const r = spawnSync(
+    "powershell.exe",
+    ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", vaultScriptPath(), ...args],
+    { timeout: VAULT_TIMEOUT_MS, encoding: "utf8" }
+  );
+  if (r.error) throw new Error(`vault spawn failed: ${String(r.error)}`);
+  if (r.status !== 0) {
+    const detail = (r.stderr || r.stdout || "").trim().split("\n").slice(-3).join("; ");
+    throw new Error(`vault ${args[0]} failed (exit ${r.status}): ${detail}`);
+  }
+}
+function isEncrypted(file) {
+  if (!fs3.existsSync(file)) return false;
+  const fd = fs3.openSync(file, "r");
+  try {
+    const hdr = Buffer.alloc(MAGIC2.length);
+    const read = fs3.readSync(fd, hdr, 0, hdr.length, 0);
+    return read === MAGIC2.length && hdr.equals(MAGIC2);
+  } finally {
+    fs3.closeSync(fd);
+  }
+}
+function loadJson(guard, file) {
+  const f = guard.assert(file);
+  if (!fs3.existsSync(f)) return null;
+  if (!isEncrypted(f)) {
+    try {
+      return JSON.parse(fs3.readFileSync(f, "utf8"));
+    } catch {
+      return null;
+    }
+  }
+  const tmp = tmpPlainName(f);
+  try {
+    runVault(guard, ["unprotect", "-InFile", f, "-OutFile", tmp]);
+    return JSON.parse(fs3.readFileSync(tmp, "utf8"));
+  } finally {
+    burnFileSync(tmp);
+  }
+}
+function saveJson(guard, file, value) {
+  const f = guard.assert(file);
+  fs3.mkdirSync(path3.dirname(f), { recursive: true });
+  const plain = tmpPlainName(f);
+  const enc = tmpEncName(f);
+  try {
+    fs3.writeFileSync(plain, JSON.stringify(value, null, 2), "utf8");
+    runVault(guard, ["protect", "-InFile", plain, "-OutFile", enc]);
+    fs3.renameSync(enc, f);
+  } finally {
+    burnFileSync(plain);
+    fs3.rmSync(enc, { force: true });
+  }
+}
+function readText(guard, file, fallback = "") {
+  const f = guard.assert(file);
+  try {
+    return fs3.readFileSync(f, "utf8");
+  } catch {
+    return fallback;
+  }
+}
+function writeText(guard, file, content) {
+  const f = guard.assert(file);
+  fs3.mkdirSync(path3.dirname(f), { recursive: true });
+  const tmp = tmpPlainName(f);
+  try {
+    fs3.writeFileSync(tmp, content, "utf8");
+    fs3.renameSync(tmp, f);
+  } finally {
+    burnFileSync(tmp);
+  }
+}
+function loadEncryptedText(guard, file) {
+  const f = guard.assert(file);
+  if (!fs3.existsSync(f)) return null;
+  if (!isEncrypted(f)) return fs3.readFileSync(f, "utf8");
+  const tmp = tmpPlainName(f);
+  try {
+    runVault(guard, ["unprotect", "-InFile", f, "-OutFile", tmp]);
+    return fs3.readFileSync(tmp, "utf8");
+  } finally {
+    burnFileSync(tmp);
+  }
+}
+function saveEncryptedText(guard, file, content) {
+  const f = guard.assert(file);
+  fs3.mkdirSync(path3.dirname(f), { recursive: true });
+  const plain = tmpPlainName(f);
+  const enc = tmpEncName(f);
+  try {
+    fs3.writeFileSync(plain, content, "utf8");
+    runVault(guard, ["protect", "-InFile", plain, "-OutFile", enc]);
+    fs3.renameSync(enc, f);
+  } finally {
+    burnFileSync(plain);
+    fs3.rmSync(enc, { force: true });
+  }
+}
+function encryptFile(guard, inFile, outFile) {
+  const inPath = guard.assert(inFile);
+  const outPath = guard.assert(outFile);
+  fs3.mkdirSync(path3.dirname(outPath), { recursive: true });
+  const enc = tmpEncName(outPath);
+  try {
+    runVault(guard, ["protect", "-InFile", inPath, "-OutFile", enc]);
+    fs3.renameSync(enc, outPath);
+  } finally {
+    fs3.rmSync(enc, { force: true });
+  }
+}
+function decryptFile(guard, inFile, outFile) {
+  const inPath = guard.assert(inFile);
+  const outPath = guard.assert(outFile);
+  fs3.mkdirSync(path3.dirname(outPath), { recursive: true });
+  runVault(guard, ["unprotect", "-InFile", inPath, "-OutFile", outPath]);
+}
+
+export {
+  initWorkspace,
+  workspace,
+  isEncrypted,
+  loadJson,
+  saveJson,
+  readText,
+  writeText,
+  loadEncryptedText,
+  saveEncryptedText,
+  encryptFile,
+  decryptFile
+};
+//# sourceMappingURL=chunk-K5Y6JP2B.js.map

package/dist/chunk-K5Y6JP2B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/paths.ts","../src/core/data-relocate.ts","../src/vault/vault.ts"],"sourcesContent":["// Workspace/data directory resolution and package asset location.\n//\n// The data dir is the ONLY directory the plugin writes to at runtime\n// (requirement 8). Resolution order: env override > plugin config > default\n// (`$DSH_HOME/heartbeat-data`) — with a legacy fallback to `packageRoot()/data`\n// for installs that predate v1.9.2, which is relocated out of the package on\n// first sight (issue #2: a reinstall replaced the package dir and took the\n// user's data with it). All fs writes must go through the path guard created\n// from this dir (see core/path-guard.ts).\n\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { hasPayload, relocateDataDir, type RelocateResult } from './data-relocate.js';\n\nexport interface WorkspacePaths {\n  /** Guard boundary and the only writable tree at runtime. */\n  dataDir: string;\n  settingsDir: string;\n  logsDir: string;\n  tmpDir: string;\n  exportsDir: string;\n  /** Package root (where package.json lives). Read-only at runtime. */\n  packageRoot: string;\n  configDir: string;\n  assetsDir: string;\n  /**\n   * Set only when a legacy package-local data dir was found: the outcome of\n   * the one-time relocation. Absent for explicit dirs and fresh installs.\n   */\n  relocation?: RelocateResult;\n}\n\nexport interface WorkspaceConfigInput {\n  dataDir?: string | null;\n}\n\nlet resolved: WorkspacePaths | null = null;\n\n/** Walk up from a module file to the directory containing package.json. */\nexport function findPackageRoot(startFile: string): string {\n  let dir = path.dirname(path.resolve(startFile));\n  for (;;) {\n    if (fs.existsSync(path.join(dir, 'package.json'))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) throw new Error('package.json not found above ' + startFile);\n    dir = parent;\n  }\n}\n\nexport function packageRoot(): string {\n  return findPackageRoot(fileURLToPath(import.meta.url));\n}\n\n/**\n * Default data dir: `$DSH_HOME/heartbeat-data` (or `~/.dsh/heartbeat-data`).\n * Deliberately outside the package tree — reinstalling or upgrading the plugin\n * replaces that directory and must not touch user data (issue #2).\n */\nexport function defaultDataDir(\n  env: NodeJS.ProcessEnv = process.env,\n  home: string = os.homedir(),\n): string {\n  const override = env.DSH_HOME?.trim();\n  const root = override && override.length > 0 ? override : path.join(home, '.dsh');\n  return path.join(root, 'heartbeat-data');\n}\n\n/**\n * Resolve and create the workspace layout. Idempotent; must be called once\n * from the plugin entry before any fs write happens.\n */\nexport function initWorkspace(config: WorkspaceConfigInput = {}): WorkspacePaths {\n  if (resolved) return resolved;\n  const root = packageRoot();\n  const explicit = process.env.HEARTBEAT_DATA_DIR || config.dataDir;\n  const homeDir = path.resolve(defaultDataDir());\n  const legacyDir = path.join(root, 'data');\n  let dataDir: string;\n  let relocation: RelocateResult | undefined;\n  if (explicit) {\n    // Explicit configuration always wins, and never moves anything.\n    dataDir = path.resolve(explicit);\n  } else if (hasPayload(homeDir)) {\n    // Already on the new home (a previous run, or a reinstall that kept it).\n    dataDir = homeDir;\n  } else if (hasPayload(legacyDir)) {\n    // Pre-v1.9.2 install: the data lived inside the package. Move it out, and\n    // keep serving the legacy tree unless the move verified end to end.\n    relocation = relocateDataDir({ srcDir: legacyDir, dstDir: homeDir });\n    dataDir = relocation.action === 'relocated' ? homeDir : legacyDir;\n  } else {\n    dataDir = homeDir;\n  }\n  const paths: WorkspacePaths = {\n    dataDir,\n    settingsDir: path.join(dataDir, 'settings'),\n    logsDir: path.join(dataDir, 'logs'),\n    tmpDir: path.join(dataDir, 'tmp'),\n    exportsDir: path.join(dataDir, 'exports'),\n    packageRoot: root,\n    configDir: path.join(root, 'config'),\n    assetsDir: path.join(root, 'assets'),\n    ...(relocation ? { relocation } : {}),\n  };\n  // Bootstrap creation happens before the guard exists; creating exactly one\n  // directory tree at a known location is the safe window for this.\n  for (const dir of [\n    paths.dataDir,\n    paths.settingsDir,\n    paths.logsDir,\n    paths.tmpDir,\n    paths.exportsDir,\n  ]) {\n    fs.mkdirSync(dir, { recursive: true });\n  }\n  resolved = paths;\n  return paths;\n}\n\n/** Access already-initialized paths. Throws if initWorkspace was not called. */\nexport function workspace(): WorkspacePaths {\n  if (!resolved) throw new Error('workspace not initialized: call initWorkspace() first');\n  return resolved;\n}\n\n/** Test-only: forget the resolved singleton so a later init re-resolves. */\nexport function resetWorkspaceForTest(): void {\n  resolved = null;\n}\n","// One-time relocation of the data dir out of the package tree (issue #2).\n//\n// Installs created before v1.9.2 defaulted to `packageRoot()/data`, and every\n// `dsh plugin add` / upgrade replaces the package directory wholesale — so a\n// reinstall deleted the profile, the gate and the ledger, which the original\n// design meant to keep until an explicit CLI `burn`. The default now lives at\n// `$DSH_HOME/heartbeat-data`; this module moves an existing package-local tree\n// there.\n//\n// Safety order — a failure at any point leaves the original untouched:\n//   1. copy src -> backup (kept until the move is verified and committed)\n//   2. copy src -> dst.staging-<stamp>\n//   3. verify staging against src: same file list, same size + sha256, and\n//      every plaintext .json/.jsonl still parses\n//   4. rename staging -> dst (same volume, atomic)\n//   5. only then delete src and the backup\n// The caller keeps using `src` unless the result is `relocated`.\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { createHash } from 'node:crypto';\n\n/** Directories the bootstrap always creates: their presence alone is no payload. */\nconst SKELETON_DIRS = ['settings', 'logs', 'tmp', 'exports'];\n/** Scratch space (decrypt windows, downloads): never copied, never verified. */\nconst SCRATCH_DIR = 'tmp';\nconst MAGIC = Buffer.from('KHBV1', 'ascii');\n\nexport interface RelocateOptions {\n  srcDir: string;\n  dstDir: string;\n  /** Injectable clock, so tests get deterministic backup/staging names. */\n  now?: number;\n}\n\nexport type RelocateResult =\n  | {\n      action: 'relocated';\n      /** Package-local tree the data came from (now deleted). */\n      srcDir: string;\n      dstDir: string;\n      backupDir: string;\n      files: number;\n      bytes: number;\n      /** Plaintext JSON/JSONL that does not parse (verified byte-identical). */\n      warnings: string[];\n      /** Paths that could not be deleted after the move (cosmetic leftovers). */\n      leftovers: string[];\n    }\n  | { action: 'skipped'; reason: 'source-missing' | 'no-payload' | 'destination-exists' }\n  | {\n      action: 'failed';\n      stage: 'backup' | 'copy' | 'verify' | 'commit';\n      problems: string[];\n      /** Null when the backup itself could not be created. */\n      backupDir: string | null;\n    };\n\nexport interface VerifyResult {\n  /** Byte-for-byte the same file list, sizes and contents. */\n  ok: boolean;\n  files: number;\n  bytes: number;\n  problems: string[];\n  /**\n   * Plaintext JSON/JSONL files that do not parse. They are reported but do not\n   * fail the move: an identical copy of a file that was already damaged is\n   * still byte-for-byte the user's data, and refusing to relocate would strand\n   * the data dir in the package forever.\n   */\n  warnings: string[];\n}\n\n/**\n * True when a data dir holds real user data. An empty bootstrap skeleton\n * (`settings/ logs/ tmp/ exports/`, all empty) does not count — otherwise a\n * freshly created default dir would shadow a legacy tree with actual data.\n */\nexport function hasPayload(dir: string): boolean {\n  if (!fs.existsSync(dir)) return false;\n  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n    if (!entry.isDirectory()) return true;\n    if (!SKELETON_DIRS.includes(entry.name)) return true;\n    if (entry.name === SCRATCH_DIR) continue;\n    if (fs.readdirSync(path.join(dir, entry.name)).length > 0) return true;\n  }\n  return false;\n}\n\n/** Every file under `dir` (relative, `/`-separated, sorted), excluding tmp/. */\nfunction walk(dir: string, prefix = '', out: string[] = []): string[] {\n  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n    const rel = prefix ? `${prefix}/${entry.name}` : entry.name;\n    if (entry.isDirectory()) {\n      if (!prefix && entry.name === SCRATCH_DIR) continue;\n      walk(path.join(dir, entry.name), rel, out);\n    } else if (entry.isFile()) {\n      out.push(rel);\n    }\n  }\n  return out.sort();\n}\n\nfunction copyTree(src: string, dst: string): void {\n  const scratch = path.resolve(path.join(src, SCRATCH_DIR));\n  fs.cpSync(src, dst, {\n    recursive: true,\n    force: true,\n    preserveTimestamps: true,\n    filter: (from) => path.resolve(from) !== scratch,\n  });\n}\n\nfunction removeTree(dir: string): void {\n  fs.rmSync(dir, { recursive: true, force: true });\n}\n\nfunction sha256(file: string): string {\n  return createHash('sha256').update(fs.readFileSync(file)).digest('hex');\n}\n\n/** KHBV1 header check (local copy: importing vault here would cycle through paths). */\nfunction isEncryptedFile(file: string): boolean {\n  const fd = fs.openSync(file, 'r');\n  try {\n    const head = Buffer.alloc(MAGIC.length);\n    const read = fs.readSync(fd, head, 0, MAGIC.length, 0);\n    return read === MAGIC.length && head.equals(MAGIC);\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n\n/**\n * Schema-free readability check: an encrypted container is opaque here (its\n * bytes were already compared by hash), a plaintext .json/.jsonl must still\n * parse — that is what catches a half-written or truncated copy.\n */\nfunction parsesAsJson(file: string): boolean {\n  if (isEncryptedFile(file)) return true;\n  const text = fs.readFileSync(file, 'utf8');\n  try {\n    if (file.endsWith('.jsonl')) {\n      for (const line of text.split('\\n')) if (line.trim()) JSON.parse(line);\n      return true;\n    }\n    JSON.parse(text);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Compare a copy against its source: identical file list, identical size and\n * content (the hard gate), plus a readability report on the plaintext\n * JSON/JSONL in the copy (warnings only — see VerifyResult).\n */\nexport function verifyTrees(srcDir: string, dstDir: string): VerifyResult {\n  const problems: string[] = [];\n  const warnings: string[] = [];\n  let files = 0;\n  let bytes = 0;\n  if (!fs.existsSync(dstDir)) {\n    return { ok: false, files: 0, bytes: 0, problems: [`copy missing: ${dstDir}`], warnings };\n  }\n  const expected = walk(srcDir);\n  const actual = walk(dstDir);\n  const actualSet = new Set(actual);\n  const expectedSet = new Set(expected);\n  for (const rel of expected) if (!actualSet.has(rel)) problems.push(`missing: ${rel}`);\n  for (const rel of actual) if (!expectedSet.has(rel)) problems.push(`unexpected: ${rel}`);\n  for (const rel of expected) {\n    const from = path.join(srcDir, rel);\n    const to = path.join(dstDir, rel);\n    if (!fs.existsSync(to)) continue; // already reported above\n    const sizeFrom = fs.statSync(from).size;\n    const sizeTo = fs.statSync(to).size;\n    files += 1;\n    bytes += sizeFrom;\n    if (sizeFrom !== sizeTo) {\n      problems.push(`size differs: ${rel} (${sizeFrom} -> ${sizeTo})`);\n      continue;\n    }\n    if (sha256(from) !== sha256(to)) {\n      problems.push(`content differs: ${rel}`);\n      continue;\n    }\n    if (/\\.(json|jsonl)$/i.test(rel) && !parsesAsJson(to)) warnings.push(`unparseable: ${rel}`);\n  }\n  return { ok: problems.length === 0, files, bytes, problems, warnings };\n}\n\nfunction stamp(now: number): string {\n  const d = new Date(now);\n  const pad = (n: number): string => String(n).padStart(2, '0');\n  return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`;\n}\n\nfunction errorText(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\n/**\n * Move a package-local data dir to its new home. Never throws: every failure\n * is reported as `failed` with the original tree left in place.\n */\nexport function relocateDataDir(opts: RelocateOptions): RelocateResult {\n  const srcDir = path.resolve(opts.srcDir);\n  const dstDir = path.resolve(opts.dstDir);\n  if (!fs.existsSync(srcDir)) return { action: 'skipped', reason: 'source-missing' };\n  if (!hasPayload(srcDir)) return { action: 'skipped', reason: 'no-payload' };\n  if (hasPayload(dstDir)) return { action: 'skipped', reason: 'destination-exists' };\n\n  const suffix = stamp(opts.now ?? Date.now());\n  const backupDir = `${srcDir}.bak-relocate-${suffix}`;\n  const stagingDir = `${dstDir}.staging-${suffix}`;\n\n  // 1. backup first — the user asked for a copy that outlives a failed move.\n  try {\n    copyTree(srcDir, backupDir);\n  } catch (error) {\n    return { action: 'failed', stage: 'backup', problems: [errorText(error)], backupDir: null };\n  }\n\n  // 2. copy to a staging dir beside the destination (same volume → atomic rename).\n  try {\n    copyTree(srcDir, stagingDir);\n  } catch (error) {\n    return { action: 'failed', stage: 'copy', problems: [errorText(error)], backupDir };\n  }\n\n  // 3. verify before anything is deleted or published.\n  const verified = verifyTrees(srcDir, stagingDir);\n  if (!verified.ok) {\n    try {\n      removeTree(stagingDir);\n    } catch {\n      // A stranded staging dir is harmless: the next run overwrites it.\n    }\n    return { action: 'failed', stage: 'verify', problems: verified.problems, backupDir };\n  }\n\n  // 4. publish: the destination may hold an empty skeleton from an earlier\n  //    bootstrap, which is not payload (checked above), so clear it and rename.\n  try {\n    if (fs.existsSync(dstDir)) removeTree(dstDir);\n    fs.renameSync(stagingDir, dstDir);\n  } catch (error) {\n    try {\n      removeTree(stagingDir);\n    } catch {\n      // best effort\n    }\n    return { action: 'failed', stage: 'commit', problems: [errorText(error)], backupDir };\n  }\n\n  // 5. the new tree is live; the originals go last. A leftover only wastes\n  //    space — the destination already wins on the next resolve.\n  const leftovers: string[] = [];\n  try {\n    removeTree(srcDir);\n  } catch {\n    leftovers.push(srcDir);\n  }\n  try {\n    removeTree(backupDir);\n  } catch {\n    leftovers.push(backupDir);\n  }\n\n  return {\n    action: 'relocated',\n    srcDir,\n    dstDir,\n    backupDir,\n    files: verified.files,\n    bytes: verified.bytes,\n    warnings: verified.warnings,\n    leftovers,\n  };\n}\n","// Transparent encryption read/write layer (port of v1 lib/vault.mjs).\n//\n// Mechanism: Node <-> vault.ps1 hand off through temp files (plain text\n// windows are millisecond-scale). v2 hardening over v1:\n//   - plaintext temp files live ONLY under data/tmp (never beside targets);\n//   - every path passes the workspace guard before reaching PowerShell;\n//   - encrypted output lands via same-volume rename (atomic replace).\n// Encryption failure is fail-closed: throw, never fall back to plaintext.\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport type { PathGuard } from '../core/path-guard.js';\nimport { workspace } from '../core/paths.js';\nimport { burnFileSync } from '../core/atomic-fs.js';\n\nconst MAGIC = Buffer.from('KHBV1', 'ascii');\nconst VAULT_TIMEOUT_MS = 30_000;\n\nlet cachedScriptPath: string | null = null;\n\nfunction vaultScriptPath(): string {\n  if (cachedScriptPath) return cachedScriptPath;\n  const script = path.join(workspace().assetsDir, 'vault.ps1');\n  if (!fs.existsSync(script)) throw new Error(`vault script missing: ${script}`);\n  cachedScriptPath = script;\n  return script;\n}\n\nfunction tmpPlainName(target: string): string {\n  return path.join(workspace().tmpDir, `.${path.basename(target)}.${randomUUID().slice(0, 8)}.plain`);\n}\n\nfunction tmpEncName(target: string): string {\n  return path.join(workspace().tmpDir, `.${path.basename(target)}.${randomUUID().slice(0, 8)}.enc`);\n}\n\nfunction runVault(guard: PathGuard, args: string[]): void {\n  const r = spawnSync(\n    'powershell.exe',\n    ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', vaultScriptPath(), ...args],\n    { timeout: VAULT_TIMEOUT_MS, encoding: 'utf8' },\n  );\n  if (r.error) throw new Error(`vault spawn failed: ${String(r.error)}`);\n  if (r.status !== 0) {\n    const detail = (r.stderr || r.stdout || '').trim().split('\\n').slice(-3).join('; ');\n    throw new Error(`vault ${args[0]} failed (exit ${r.status}): ${detail}`);\n  }\n}\n\n/** KHBV1 header check without reading the whole file. */\nexport function isEncrypted(file: string): boolean {\n  if (!fs.existsSync(file)) return false;\n  const fd = fs.openSync(file, 'r');\n  try {\n    const hdr = Buffer.alloc(MAGIC.length);\n    const read = fs.readSync(fd, hdr, 0, hdr.length, 0);\n    return read === MAGIC.length && hdr.equals(MAGIC);\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n\n/**\n * Read JSON: encrypted files are decrypted to a data/tmp plaintext window\n * that is shredded immediately after parse; plaintext stays compatible.\n */\nexport function loadJson<T>(guard: PathGuard, file: string): T | null {\n  const f = guard.assert(file);\n  if (!fs.existsSync(f)) return null;\n  if (!isEncrypted(f)) {\n    try {\n      return JSON.parse(fs.readFileSync(f, 'utf8')) as T;\n    } catch {\n      return null;\n    }\n  }\n  const tmp = tmpPlainName(f);\n  try {\n    runVault(guard, ['unprotect', '-InFile', f, '-OutFile', tmp]);\n    return JSON.parse(fs.readFileSync(tmp, 'utf8')) as T;\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Write JSON: plaintext window in data/tmp -> DPAPI encrypt -> atomic rename into place. */\nexport function saveJson(guard: PathGuard, file: string, value: unknown): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const plain = tmpPlainName(f);\n  const enc = tmpEncName(f);\n  try {\n    fs.writeFileSync(plain, JSON.stringify(value, null, 2), 'utf8');\n    runVault(guard, ['protect', '-InFile', plain, '-OutFile', enc]);\n    fs.renameSync(enc, f);\n  } finally {\n    burnFileSync(plain);\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/** Read a plaintext UTF-8 text file (ledger etc.), with fallback. */\nexport function readText(guard: PathGuard, file: string, fallback = ''): string {\n  const f = guard.assert(file);\n  try {\n    return fs.readFileSync(f, 'utf8');\n  } catch {\n    return fallback;\n  }\n}\n\n/** Write a plaintext UTF-8 text file atomically (ledger etc.). */\nexport function writeText(guard: PathGuard, file: string, content: string): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const tmp = tmpPlainName(f);\n  try {\n    fs.writeFileSync(tmp, content, 'utf8');\n    fs.renameSync(tmp, f);\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Read an encrypted UTF-8 text file (e.g. seeds.jsonl). Missing -> null. */\nexport function loadEncryptedText(guard: PathGuard, file: string): string | null {\n  const f = guard.assert(file);\n  if (!fs.existsSync(f)) return null;\n  if (!isEncrypted(f)) return fs.readFileSync(f, 'utf8');\n  const tmp = tmpPlainName(f);\n  try {\n    runVault(guard, ['unprotect', '-InFile', f, '-OutFile', tmp]);\n    return fs.readFileSync(tmp, 'utf8');\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Write an encrypted UTF-8 text file atomically. */\nexport function saveEncryptedText(guard: PathGuard, file: string, content: string): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const plain = tmpPlainName(f);\n  const enc = tmpEncName(f);\n  try {\n    fs.writeFileSync(plain, content, 'utf8');\n    runVault(guard, ['protect', '-InFile', plain, '-OutFile', enc]);\n    fs.renameSync(enc, f);\n  } finally {\n    burnFileSync(plain);\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/** Encrypt any binary file (e.g. screenshot): inFile -> encrypted outFile. */\nexport function encryptFile(guard: PathGuard, inFile: string, outFile: string): void {\n  const inPath = guard.assert(inFile);\n  const outPath = guard.assert(outFile);\n  fs.mkdirSync(path.dirname(outPath), { recursive: true });\n  const enc = tmpEncName(outPath);\n  try {\n    runVault(guard, ['protect', '-InFile', inPath, '-OutFile', enc]);\n    fs.renameSync(enc, outPath);\n  } finally {\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/**\n * Decrypt an encrypted file to a plaintext output (caller must place the\n * output under data/tmp and delete it after use; \"use then burn\" discipline).\n */\nexport function decryptFile(guard: PathGuard, inFile: string, outFile: string): void {\n  const inPath = guard.assert(inFile);\n  const outPath = guard.assert(outFile);\n  fs.mkdirSync(path.dirname(outPath), { recursive: true });\n  runVault(guard, ['unprotect', '-InFile', inPath, '-OutFile', outPath]);\n}\n"],"mappings":";;;;;AAUA,OAAOA,SAAQ;AACf,OAAO,QAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,qBAAqB;;;ACK9B,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAG3B,IAAM,gBAAgB,CAAC,YAAY,QAAQ,OAAO,SAAS;AAE3D,IAAM,cAAc;AACpB,IAAM,QAAQ,OAAO,KAAK,SAAS,OAAO;AAoDnC,SAAS,WAAW,KAAsB;AAC/C,MAAI,CAAC,GAAG,WAAW,GAAG,EAAG,QAAO;AAChC,aAAW,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,QAAI,CAAC,cAAc,SAAS,MAAM,IAAI,EAAG,QAAO;AAChD,QAAI,MAAM,SAAS,YAAa;AAChC,QAAI,GAAG,YAAY,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC,EAAE,SAAS,EAAG,QAAO;AAAA,EACpE;AACA,SAAO;AACT;AAGA,SAAS,KAAK,KAAa,SAAS,IAAI,MAAgB,CAAC,GAAa;AACpE,aAAW,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;AAChE,UAAM,MAAM,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,KAAK,MAAM;AACvD,QAAI,MAAM,YAAY,GAAG;AACvB,UAAI,CAAC,UAAU,MAAM,SAAS,YAAa;AAC3C,WAAK,KAAK,KAAK,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;AAAA,IAC3C,WAAW,MAAM,OAAO,GAAG;AACzB,UAAI,KAAK,GAAG;AAAA,IACd;AAAA,EACF;AACA,SAAO,IAAI,KAAK;AAClB;AAEA,SAAS,SAAS,KAAa,KAAmB;AAChD,QAAM,UAAU,KAAK,QAAQ,KAAK,KAAK,KAAK,WAAW,CAAC;AACxD,KAAG,OAAO,KAAK,KAAK;AAAA,IAClB,WAAW;AAAA,IACX,OAAO;AAAA,IACP,oBAAoB;AAAA,IACpB,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM;AAAA,EAC3C,CAAC;AACH;AAEA,SAAS,WAAW,KAAmB;AACrC,KAAG,OAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACjD;AAEA,SAAS,OAAO,MAAsB;AACpC,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,aAAa,IAAI,CAAC,EAAE,OAAO,KAAK;AACxE;AAGA,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,KAAK,GAAG,SAAS,MAAM,GAAG;AAChC,MAAI;AACF,UAAM,OAAO,OAAO,MAAM,MAAM,MAAM;AACtC,UAAM,OAAO,GAAG,SAAS,IAAI,MAAM,GAAG,MAAM,QAAQ,CAAC;AACrD,WAAO,SAAS,MAAM,UAAU,KAAK,OAAO,KAAK;AAAA,EACnD,UAAE;AACA,OAAG,UAAU,EAAE;AAAA,EACjB;AACF;AAOA,SAAS,aAAa,MAAuB;AAC3C,MAAI,gBAAgB,IAAI,EAAG,QAAO;AAClC,QAAM,OAAO,GAAG,aAAa,MAAM,MAAM;AACzC,MAAI;AACF,QAAI,KAAK,SAAS,QAAQ,GAAG;AAC3B,iBAAW,QAAQ,KAAK,MAAM,IAAI,EAAG,KAAI,KAAK,KAAK,EAAG,MAAK,MAAM,IAAI;AACrE,aAAO;AAAA,IACT;AACA,SAAK,MAAM,IAAI;AACf,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOO,SAAS,YAAY,QAAgB,QAA8B;AACxE,QAAM,WAAqB,CAAC;AAC5B,QAAM,WAAqB,CAAC;AAC5B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,CAAC,GAAG,WAAW,MAAM,GAAG;AAC1B,WAAO,EAAE,IAAI,OAAO,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC,iBAAiB,MAAM,EAAE,GAAG,SAAS;AAAA,EAC1F;AACA,QAAM,WAAW,KAAK,MAAM;AAC5B,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,YAAY,IAAI,IAAI,MAAM;AAChC,QAAM,cAAc,IAAI,IAAI,QAAQ;AACpC,aAAW,OAAO,SAAU,KAAI,CAAC,UAAU,IAAI,GAAG,EAAG,UAAS,KAAK,YAAY,GAAG,EAAE;AACpF,aAAW,OAAO,OAAQ,KAAI,CAAC,YAAY,IAAI,GAAG,EAAG,UAAS,KAAK,eAAe,GAAG,EAAE;AACvF,aAAW,OAAO,UAAU;AAC1B,UAAM,OAAO,KAAK,KAAK,QAAQ,GAAG;AAClC,UAAM,KAAK,KAAK,KAAK,QAAQ,GAAG;AAChC,QAAI,CAAC,GAAG,WAAW,EAAE,EAAG;AACxB,UAAM,WAAW,GAAG,SAAS,IAAI,EAAE;AACnC,UAAM,SAAS,GAAG,SAAS,EAAE,EAAE;AAC/B,aAAS;AACT,aAAS;AACT,QAAI,aAAa,QAAQ;AACvB,eAAS,KAAK,iBAAiB,GAAG,KAAK,QAAQ,OAAO,MAAM,GAAG;AAC/D;AAAA,IACF;AACA,QAAI,OAAO,IAAI,MAAM,OAAO,EAAE,GAAG;AAC/B,eAAS,KAAK,oBAAoB,GAAG,EAAE;AACvC;AAAA,IACF;AACA,QAAI,mBAAmB,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,EAAG,UAAS,KAAK,gBAAgB,GAAG,EAAE;AAAA,EAC5F;AACA,SAAO,EAAE,IAAI,SAAS,WAAW,GAAG,OAAO,OAAO,UAAU,SAAS;AACvE;AAEA,SAAS,MAAM,KAAqB;AAClC,QAAM,IAAI,IAAI,KAAK,GAAG;AACtB,QAAM,MAAM,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC5D,SAAO,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;AACvI;AAEA,SAAS,UAAU,OAAwB;AACzC,SAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAMO,SAAS,gBAAgB,MAAuC;AACrE,QAAM,SAAS,KAAK,QAAQ,KAAK,MAAM;AACvC,QAAM,SAAS,KAAK,QAAQ,KAAK,MAAM;AACvC,MAAI,CAAC,GAAG,WAAW,MAAM,EAAG,QAAO,EAAE,QAAQ,WAAW,QAAQ,iBAAiB;AACjF,MAAI,CAAC,WAAW,MAAM,EAAG,QAAO,EAAE,QAAQ,WAAW,QAAQ,aAAa;AAC1E,MAAI,WAAW,MAAM,EAAG,QAAO,EAAE,QAAQ,WAAW,QAAQ,qBAAqB;AAEjF,QAAM,SAAS,MAAM,KAAK,OAAO,KAAK,IAAI,CAAC;AAC3C,QAAM,YAAY,GAAG,MAAM,iBAAiB,MAAM;AAClD,QAAM,aAAa,GAAG,MAAM,YAAY,MAAM;AAG9C,MAAI;AACF,aAAS,QAAQ,SAAS;AAAA,EAC5B,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,UAAU,OAAO,UAAU,UAAU,CAAC,UAAU,KAAK,CAAC,GAAG,WAAW,KAAK;AAAA,EAC5F;AAGA,MAAI;AACF,aAAS,QAAQ,UAAU;AAAA,EAC7B,SAAS,OAAO;AACd,WAAO,EAAE,QAAQ,UAAU,OAAO,QAAQ,UAAU,CAAC,UAAU,KAAK,CAAC,GAAG,UAAU;AAAA,EACpF;AAGA,QAAM,WAAW,YAAY,QAAQ,UAAU;AAC/C,MAAI,CAAC,SAAS,IAAI;AAChB,QAAI;AACF,iBAAW,UAAU;AAAA,IACvB,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,QAAQ,UAAU,OAAO,UAAU,UAAU,SAAS,UAAU,UAAU;AAAA,EACrF;AAIA,MAAI;AACF,QAAI,GAAG,WAAW,MAAM,EAAG,YAAW,MAAM;AAC5C,OAAG,WAAW,YAAY,MAAM;AAAA,EAClC,SAAS,OAAO;AACd,QAAI;AACF,iBAAW,UAAU;AAAA,IACvB,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,QAAQ,UAAU,OAAO,UAAU,UAAU,CAAC,UAAU,KAAK,CAAC,GAAG,UAAU;AAAA,EACtF;AAIA,QAAM,YAAsB,CAAC;AAC7B,MAAI;AACF,eAAW,MAAM;AAAA,EACnB,QAAQ;AACN,cAAU,KAAK,MAAM;AAAA,EACvB;AACA,MAAI;AACF,eAAW,SAAS;AAAA,EACtB,QAAQ;AACN,cAAU,KAAK,SAAS;AAAA,EAC1B;AAEA,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,OAAO,SAAS;AAAA,IAChB,UAAU,SAAS;AAAA,IACnB;AAAA,EACF;AACF;;;ADnPA,IAAI,WAAkC;AAG/B,SAAS,gBAAgB,WAA2B;AACzD,MAAI,MAAMC,MAAK,QAAQA,MAAK,QAAQ,SAAS,CAAC;AAC9C,aAAS;AACP,QAAIC,IAAG,WAAWD,MAAK,KAAK,KAAK,cAAc,CAAC,EAAG,QAAO;AAC1D,UAAM,SAASA,MAAK,QAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK,OAAM,IAAI,MAAM,kCAAkC,SAAS;AAC/E,UAAM;AAAA,EACR;AACF;AAEO,SAAS,cAAsB;AACpC,SAAO,gBAAgB,cAAc,YAAY,GAAG,CAAC;AACvD;AAOO,SAAS,eACd,MAAyB,QAAQ,KACjC,OAAe,GAAG,QAAQ,GAClB;AACR,QAAM,WAAW,IAAI,UAAU,KAAK;AACpC,QAAM,OAAO,YAAY,SAAS,SAAS,IAAI,WAAWA,MAAK,KAAK,MAAM,MAAM;AAChF,SAAOA,MAAK,KAAK,MAAM,gBAAgB;AACzC;AAMO,SAAS,cAAc,SAA+B,CAAC,GAAmB;AAC/E,MAAI,SAAU,QAAO;AACrB,QAAM,OAAO,YAAY;AACzB,QAAM,WAAW,QAAQ,IAAI,sBAAsB,OAAO;AAC1D,QAAM,UAAUA,MAAK,QAAQ,eAAe,CAAC;AAC7C,QAAM,YAAYA,MAAK,KAAK,MAAM,MAAM;AACxC,MAAI;AACJ,MAAI;AACJ,MAAI,UAAU;AAEZ,cAAUA,MAAK,QAAQ,QAAQ;AAAA,EACjC,WAAW,WAAW,OAAO,GAAG;AAE9B,cAAU;AAAA,EACZ,WAAW,WAAW,SAAS,GAAG;AAGhC,iBAAa,gBAAgB,EAAE,QAAQ,WAAW,QAAQ,QAAQ,CAAC;AACnE,cAAU,WAAW,WAAW,cAAc,UAAU;AAAA,EAC1D,OAAO;AACL,cAAU;AAAA,EACZ;AACA,QAAM,QAAwB;AAAA,IAC5B;AAAA,IACA,aAAaA,MAAK,KAAK,SAAS,UAAU;AAAA,IAC1C,SAASA,MAAK,KAAK,SAAS,MAAM;AAAA,IAClC,QAAQA,MAAK,KAAK,SAAS,KAAK;AAAA,IAChC,YAAYA,MAAK,KAAK,SAAS,SAAS;AAAA,IACxC,aAAa;AAAA,IACb,WAAWA,MAAK,KAAK,MAAM,QAAQ;AAAA,IACnC,WAAWA,MAAK,KAAK,MAAM,QAAQ;AAAA,IACnC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,EACrC;AAGA,aAAW,OAAO;AAAA,IAChB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,GAAG;AACD,IAAAC,IAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACvC;AACA,aAAW;AACX,SAAO;AACT;AAGO,SAAS,YAA4B;AAC1C,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uDAAuD;AACtF,SAAO;AACT;;;AEpHA,OAAOC,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAK3B,IAAMC,SAAQ,OAAO,KAAK,SAAS,OAAO;AAC1C,IAAM,mBAAmB;AAEzB,IAAI,mBAAkC;AAEtC,SAAS,kBAA0B;AACjC,MAAI,iBAAkB,QAAO;AAC7B,QAAM,SAASC,MAAK,KAAK,UAAU,EAAE,WAAW,WAAW;AAC3D,MAAI,CAACC,IAAG,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB,MAAM,EAAE;AAC7E,qBAAmB;AACnB,SAAO;AACT;AAEA,SAAS,aAAa,QAAwB;AAC5C,SAAOD,MAAK,KAAK,UAAU,EAAE,QAAQ,IAAIA,MAAK,SAAS,MAAM,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ;AACpG;AAEA,SAAS,WAAW,QAAwB;AAC1C,SAAOA,MAAK,KAAK,UAAU,EAAE,QAAQ,IAAIA,MAAK,SAAS,MAAM,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM;AAClG;AAEA,SAAS,SAAS,OAAkB,MAAsB;AACxD,QAAM,IAAI;AAAA,IACR;AAAA,IACA,CAAC,cAAc,oBAAoB,UAAU,SAAS,gBAAgB,GAAG,GAAG,IAAI;AAAA,IAChF,EAAE,SAAS,kBAAkB,UAAU,OAAO;AAAA,EAChD;AACA,MAAI,EAAE,MAAO,OAAM,IAAI,MAAM,uBAAuB,OAAO,EAAE,KAAK,CAAC,EAAE;AACrE,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI;AAClF,UAAM,IAAI,MAAM,SAAS,KAAK,CAAC,CAAC,iBAAiB,EAAE,MAAM,MAAM,MAAM,EAAE;AAAA,EACzE;AACF;AAGO,SAAS,YAAY,MAAuB;AACjD,MAAI,CAACC,IAAG,WAAW,IAAI,EAAG,QAAO;AACjC,QAAM,KAAKA,IAAG,SAAS,MAAM,GAAG;AAChC,MAAI;AACF,UAAM,MAAM,OAAO,MAAMF,OAAM,MAAM;AACrC,UAAM,OAAOE,IAAG,SAAS,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC;AAClD,WAAO,SAASF,OAAM,UAAU,IAAI,OAAOA,MAAK;AAAA,EAClD,UAAE;AACA,IAAAE,IAAG,UAAU,EAAE;AAAA,EACjB;AACF;AAMO,SAAS,SAAY,OAAkB,MAAwB;AACpE,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI,CAACA,IAAG,WAAW,CAAC,EAAG,QAAO;AAC9B,MAAI,CAAC,YAAY,CAAC,GAAG;AACnB,QAAI;AACF,aAAO,KAAK,MAAMA,IAAG,aAAa,GAAG,MAAM,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,aAAS,OAAO,CAAC,aAAa,WAAW,GAAG,YAAY,GAAG,CAAC;AAC5D,WAAO,KAAK,MAAMA,IAAG,aAAa,KAAK,MAAM,CAAC;AAAA,EAChD,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,SAAS,OAAkB,MAAc,OAAsB;AAC7E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,QAAQ,aAAa,CAAC;AAC5B,QAAM,MAAM,WAAW,CAAC;AACxB,MAAI;AACF,IAAAC,IAAG,cAAc,OAAO,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAC9D,aAAS,OAAO,CAAC,WAAW,WAAW,OAAO,YAAY,GAAG,CAAC;AAC9D,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,KAAK;AAClB,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,SAAS,OAAkB,MAAc,WAAW,IAAY;AAC9E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI;AACF,WAAOA,IAAG,aAAa,GAAG,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,UAAU,OAAkB,MAAc,SAAuB;AAC/E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,IAAAC,IAAG,cAAc,KAAK,SAAS,MAAM;AACrC,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,kBAAkB,OAAkB,MAA6B;AAC/E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI,CAACA,IAAG,WAAW,CAAC,EAAG,QAAO;AAC9B,MAAI,CAAC,YAAY,CAAC,EAAG,QAAOA,IAAG,aAAa,GAAG,MAAM;AACrD,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,aAAS,OAAO,CAAC,aAAa,WAAW,GAAG,YAAY,GAAG,CAAC;AAC5D,WAAOA,IAAG,aAAa,KAAK,MAAM;AAAA,EACpC,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,kBAAkB,OAAkB,MAAc,SAAuB;AACvF,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,QAAQ,aAAa,CAAC;AAC5B,QAAM,MAAM,WAAW,CAAC;AACxB,MAAI;AACF,IAAAC,IAAG,cAAc,OAAO,SAAS,MAAM;AACvC,aAAS,OAAO,CAAC,WAAW,WAAW,OAAO,YAAY,GAAG,CAAC;AAC9D,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,KAAK;AAClB,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,YAAY,OAAkB,QAAgB,SAAuB;AACnF,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,UAAU,MAAM,OAAO,OAAO;AACpC,EAAAA,IAAG,UAAUD,MAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,MAAM,WAAW,OAAO;AAC9B,MAAI;AACF,aAAS,OAAO,CAAC,WAAW,WAAW,QAAQ,YAAY,GAAG,CAAC;AAC/D,IAAAC,IAAG,WAAW,KAAK,OAAO;AAAA,EAC5B,UAAE;AACA,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAMO,SAAS,YAAY,OAAkB,QAAgB,SAAuB;AACnF,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,UAAU,MAAM,OAAO,OAAO;AACpC,EAAAA,IAAG,UAAUD,MAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,WAAS,OAAO,CAAC,aAAa,WAAW,QAAQ,YAAY,OAAO,CAAC;AACvE;","names":["fs","path","path","fs","fs","path","MAGIC","path","fs"]}

package/dist/{chunk-QOQ7EPZZ.js → chunk-KB5SMG3F.js}

@@ -4,10 +4,10 @@ import {
   journalFilePath,
   replayJournal,
   snapshotFilePath
-} from "./chunk-OYVNWB5G.js";
+} from "./chunk-CUOSICYJ.js";
 import {
   saveJson
-} from "./chunk-7TW6DD6Q.js";
+} from "./chunk-K5Y6JP2B.js";
 
 // src/profile/snapshot.ts
 import fs from "fs";
@@ -84,4 +84,4 @@ export {
   snapshotProfile,
   snapshotIfDue
 };
-//# sourceMappingURL=chunk-QOQ7EPZZ.js.map
+//# sourceMappingURL=chunk-KB5SMG3F.js.map

package/dist/{chunk-2NB4QILF.js → chunk-XFNCTOW7.js}

@@ -2,7 +2,7 @@ import {
   isEncrypted,
   loadEncryptedText,
   saveEncryptedText
-} from "./chunk-7TW6DD6Q.js";
+} from "./chunk-K5Y6JP2B.js";
 
 // src/vault/migrate.ts
 import fs from "fs";
@@ -212,4 +212,4 @@ export {
   decryptContainer,
   applyMigrationEntries
 };
-//# sourceMappingURL=chunk-2NB4QILF.js.map
+//# sourceMappingURL=chunk-XFNCTOW7.js.map

package/dist/cli/index.js

@@ -3,7 +3,7 @@ import {
   collectMigrationEntries,
   decryptContainer,
   encryptContainer
-} from "../chunk-2NB4QILF.js";
+} from "../chunk-XFNCTOW7.js";
 import {
   BUNDLED_PRESET_ID,
   conventionalUserPresetRoot,
@@ -28,7 +28,7 @@ import {
   scanPending,
   sendNewMessageHint,
   weeklyDirPath
-} from "../chunk-WRJCINZ7.js";
+} from "../chunk-IG6YMUHW.js";
 import {
   activeSeeds,
   addSeed,
@@ -38,7 +38,7 @@ import {
   loadPool,
   seedsFilePath,
   surfaceSeed
-} from "../chunk-KOOQOMQY.js";
+} from "../chunk-JDH2LDFS.js";
 import "../chunk-IV2ZWQA3.js";
 import {
   appendAuditLine,
@@ -47,11 +47,11 @@ import {
   pruneAuditFile,
   rebuildProfile,
   verifyProfile
-} from "../chunk-OYVNWB5G.js";
+} from "../chunk-CUOSICYJ.js";
 import {
   initWorkspace,
   writeText
-} from "../chunk-7TW6DD6Q.js";
+} from "../chunk-K5Y6JP2B.js";
 import {
   atomicWriteFileSync,
   shredFileSync
@@ -532,7 +532,7 @@ async function verbProfile(c) {
       return 0;
     }
     case "snapshot": {
-      const { snapshotDue, snapshotProfile, SNAPSHOT_THRESHOLD } = await import("../snapshot-JQDJ346Z.js");
+      const { snapshotDue, snapshotProfile, SNAPSHOT_THRESHOLD } = await import("../snapshot-K5VHETTK.js");
       const { needed, lines } = snapshotDue(guard, paths.dataDir);
       console.log(`journal ${lines} \u6761\uFF08\u9608\u503C ${SNAPSHOT_THRESHOLD}\uFF09`);
       if (!needed && !rest.includes("--force")) {
@@ -637,7 +637,7 @@ async function verbSessions(c) {
   const root = path2.join(os.homedir(), ".dsh", "sessions");
   let found = 0;
   if (fs2.existsSync(root)) {
-    const { homeSessionId } = await import("../orchestrator-2ZLU7RGE.js");
+    const { homeSessionId } = await import("../orchestrator-EUTZ3KG6.js");
     const own = homeSessionId(guard, paths);
     for (const slug of fs2.readdirSync(root)) {
       for (const id of fs2.readdirSync(path2.join(root, slug))) {
@@ -656,7 +656,7 @@ async function verbBind(c) {
   switch (sub) {
     case "list": {
       const data = loadBindings(guard, paths.settingsDir);
-      const { homeSessionId } = await import("../orchestrator-2ZLU7RGE.js");
+      const { homeSessionId } = await import("../orchestrator-EUTZ3KG6.js");
       const own = homeSessionId(guard, paths);
       if (own) console.log(`\u5FC3\u8DF3\u6B63\u8EAB: ${own}\uFF08\u51B3\u7B56\u8F6E\u6B21\u53D1\u751F\u5730\uFF1Bbind remove \u5B83 = \u91CD\u7F6E\u6B63\u8EAB\uFF09`);
       for (const b of data.bindings) {
@@ -684,7 +684,7 @@ async function verbBind(c) {
         return 1;
       }
       console.log(removeBinding(guard, paths.settingsDir, id) ? `UNBOUND ${id}` : "NOT_FOUND");
-      const { resetHomeSession } = await import("../orchestrator-2ZLU7RGE.js");
+      const { resetHomeSession } = await import("../orchestrator-EUTZ3KG6.js");
       if (resetHomeSession(guard, paths, id)) {
         console.log("\u6CE8\u610F\uFF1A\u8FD9\u662F\u5FC3\u8DF3\u6B63\u8EAB\u4F1A\u8BDD\u3002\u5DF2\u91CD\u7F6E\u2014\u2014\u4E0B\u6B21\u5FC3\u8DF3\u5C06\u521B\u5EFA\u65B0\u7684\u6B63\u8EAB\u4F1A\u8BDD\uFF08\u65E7\u4F1A\u8BDD\u4E0D\u518D\u6709\u5FC3\u8DF3\uFF09");
       }

package/dist/{inbox-JLT5G7TL.js → inbox-P26DDMWC.js}

@@ -7,9 +7,9 @@ import {
   inboxFileExists,
   inboxFilePath,
   inboxHealthCheck
-} from "./chunk-BQCXYE7N.js";
+} from "./chunk-3MDBU6WY.js";
 import "./chunk-IV2ZWQA3.js";
-import "./chunk-7TW6DD6Q.js";
+import "./chunk-K5Y6JP2B.js";
 import "./chunk-WRUTATW4.js";
 export {
   dedupeItems,
@@ -21,4 +21,4 @@ export {
   inboxFilePath,
   inboxHealthCheck
 };
-//# sourceMappingURL=inbox-JLT5G7TL.js.map
+//# sourceMappingURL=inbox-P26DDMWC.js.map