@kanadego/dsh-heartbeat 1.9.1 → 1.9.2

package/dist/{migrate-WDVFHUP7.js → migrate-D4VKAKYT.js}

@@ -6,8 +6,8 @@ import {
   collectMigrationEntries,
   decryptContainer,
   encryptContainer
-} from "./chunk-2NB4QILF.js";
-import "./chunk-7TW6DD6Q.js";
+} from "./chunk-XFNCTOW7.js";
+import "./chunk-K5Y6JP2B.js";
 import "./chunk-WRUTATW4.js";
 export {
   MIGRATE_FILES,
@@ -18,4 +18,4 @@ export {
   decryptContainer,
   encryptContainer
 };
-//# sourceMappingURL=migrate-WDVFHUP7.js.map
+//# sourceMappingURL=migrate-D4VKAKYT.js.map

package/dist/{orchestrator-2ZLU7RGE.js → orchestrator-EUTZ3KG6.js}

@@ -11,6 +11,7 @@ import {
   homeSessionId,
   isContextOverflowError,
   loadCursors,
+  looksPermanentResumeFailure,
   markHomeRotateIfOverflow,
   parseJsonBlock,
   pickSpokenLine,
@@ -22,15 +23,15 @@ import {
   shouldRotateHome,
   spokeTextSince,
   startOrchestrator
-} from "./chunk-HT57FOEF.js";
-import "./chunk-WRJCINZ7.js";
+} from "./chunk-AJ5HLAL7.js";
+import "./chunk-IG6YMUHW.js";
 import "./chunk-3QJJRXIR.js";
-import "./chunk-KOOQOMQY.js";
-import "./chunk-BQCXYE7N.js";
+import "./chunk-JDH2LDFS.js";
+import "./chunk-3MDBU6WY.js";
 import "./chunk-IV2ZWQA3.js";
-import "./chunk-QOQ7EPZZ.js";
-import "./chunk-OYVNWB5G.js";
-import "./chunk-7TW6DD6Q.js";
+import "./chunk-KB5SMG3F.js";
+import "./chunk-CUOSICYJ.js";
+import "./chunk-K5Y6JP2B.js";
 import "./chunk-WRUTATW4.js";
 export {
   ENGINE_ROOM_EXTRA_TOOLS,
@@ -45,6 +46,7 @@ export {
   homeSessionId,
   isContextOverflowError,
   loadCursors,
+  looksPermanentResumeFailure,
   markHomeRotateIfOverflow,
   parseJsonBlock,
   pickSpokenLine,
@@ -57,4 +59,4 @@ export {
   spokeTextSince,
   startOrchestrator
 };
-//# sourceMappingURL=orchestrator-2ZLU7RGE.js.map
+//# sourceMappingURL=orchestrator-EUTZ3KG6.js.map

package/dist/{pool-B34NTH6D.js → pool-UTXQJJ5C.js}

@@ -16,9 +16,9 @@ import {
   savePool,
   seedsFilePath,
   surfaceSeed
-} from "./chunk-KOOQOMQY.js";
+} from "./chunk-JDH2LDFS.js";
 import "./chunk-IV2ZWQA3.js";
-import "./chunk-7TW6DD6Q.js";
+import "./chunk-K5Y6JP2B.js";
 import "./chunk-WRUTATW4.js";
 export {
   SEED_CATEGORY_CAPS,
@@ -39,4 +39,4 @@ export {
   seedsFilePath,
   surfaceSeed
 };
-//# sourceMappingURL=pool-B34NTH6D.js.map
+//# sourceMappingURL=pool-UTXQJJ5C.js.map

package/dist/{snapshot-JQDJ346Z.js → snapshot-K5VHETTK.js}

@@ -3,9 +3,9 @@ import {
   snapshotDue,
   snapshotIfDue,
   snapshotProfile
-} from "./chunk-QOQ7EPZZ.js";
-import "./chunk-OYVNWB5G.js";
-import "./chunk-7TW6DD6Q.js";
+} from "./chunk-KB5SMG3F.js";
+import "./chunk-CUOSICYJ.js";
+import "./chunk-K5Y6JP2B.js";
 import "./chunk-WRUTATW4.js";
 export {
   SNAPSHOT_THRESHOLD,
@@ -13,4 +13,4 @@ export {
   snapshotIfDue,
   snapshotProfile
 };
-//# sourceMappingURL=snapshot-JQDJ346Z.js.map
+//# sourceMappingURL=snapshot-K5VHETTK.js.map

package/package.json

@@ -1,83 +1,83 @@
-{
-  "name": "@kanadego/dsh-heartbeat",
-  "version": "1.9.1",
-  "description": "Heartbeat plugin for DeepSeek Harness: scheduled autonomous reflection loop with user profile, material pool, pace gate, and gated proactive expression.",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Kanadego/dsh-heartbeat.git"
-  },
-  "homepage": "https://github.com/Kanadego/dsh-heartbeat",
-  "bugs": {
-    "url": "https://github.com/Kanadego/dsh-heartbeat/issues"
-  },
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "heartbeat",
-    "proactive",
-    "agent"
-  ],
-  "publishConfig": {
-    "registry": "https://registry.npmjs.org"
-  },
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./cli": {
-      "types": "./dist/cli/index.d.ts",
-      "default": "./dist/cli/index.js"
-    },
-    "./client": "./client.js",
-    "./package.json": "./package.json",
-    "./cordis.patch.yml": "./cordis.patch.yml"
-  },
-  "files": [
-    "dist",
-    "config",
-    "assets",
-    "client.js",
-    "cordis.patch.yml",
-    "README.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=22.19.0"
-  },
-  "os": [
-    "win32"
-  ],
-  "dependencies": {
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2 || ^0.1.5-rc.2 || ^0.1.7-rc.1 || ^0.2.0-rc.1"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2 || ^0.1.5-rc.2 || ^0.1.7-rc.1 || ^0.2.0-rc.1"
-  },
-  "devDependencies": {
-    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@types/node": "^24.0.0",
-    "tsup": "^8.3.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.7.0"
-  },
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "test": "node --import tsx --test \"tests/*.test.ts\""
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    },
-    "client": {
-      "platform": "web"
-    }
-  }
-}
+{
+  "name": "@kanadego/dsh-heartbeat",
+  "version": "1.9.2",
+  "description": "Heartbeat plugin for DeepSeek Harness: scheduled autonomous reflection loop with user profile, material pool, pace gate, and gated proactive expression.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Kanadego/dsh-heartbeat.git"
+  },
+  "homepage": "https://github.com/Kanadego/dsh-heartbeat",
+  "bugs": {
+    "url": "https://github.com/Kanadego/dsh-heartbeat/issues"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "heartbeat",
+    "proactive",
+    "agent"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./cli": {
+      "types": "./dist/cli/index.d.ts",
+      "default": "./dist/cli/index.js"
+    },
+    "./client": "./client.js",
+    "./package.json": "./package.json",
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "dist",
+    "config",
+    "assets",
+    "client.js",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "os": [
+    "win32"
+  ],
+  "dependencies": {
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2 || ^0.1.5-rc.2 || ^0.1.7-rc.1 || ^0.2.0-rc.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2 || ^0.1.5-rc.2 || ^0.1.7-rc.1 || ^0.2.0-rc.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@types/node": "^24.0.0",
+    "tsup": "^8.3.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "node --import tsx --test \"tests/*.test.ts\""
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web"
+    }
+  }
+}

package/dist/chunk-7TW6DD6Q.js

@@ -1,208 +0,0 @@
-import {
-  burnFileSync
-} from "./chunk-WRUTATW4.js";
-
-// src/core/paths.ts
-import fs from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-var resolved = null;
-function findPackageRoot(startFile) {
-  let dir = path.dirname(path.resolve(startFile));
-  for (; ; ) {
-    if (fs.existsSync(path.join(dir, "package.json"))) return dir;
-    const parent = path.dirname(dir);
-    if (parent === dir) throw new Error("package.json not found above " + startFile);
-    dir = parent;
-  }
-}
-function packageRoot() {
-  return findPackageRoot(fileURLToPath(import.meta.url));
-}
-function initWorkspace(config = {}) {
-  if (resolved) return resolved;
-  const root = packageRoot();
-  const dataDir = path.resolve(
-    process.env.HEARTBEAT_DATA_DIR || config.dataDir || path.join(root, "data")
-  );
-  const paths = {
-    dataDir,
-    settingsDir: path.join(dataDir, "settings"),
-    logsDir: path.join(dataDir, "logs"),
-    tmpDir: path.join(dataDir, "tmp"),
-    exportsDir: path.join(dataDir, "exports"),
-    packageRoot: root,
-    configDir: path.join(root, "config"),
-    assetsDir: path.join(root, "assets")
-  };
-  for (const dir of [
-    paths.dataDir,
-    paths.settingsDir,
-    paths.logsDir,
-    paths.tmpDir,
-    paths.exportsDir
-  ]) {
-    fs.mkdirSync(dir, { recursive: true });
-  }
-  resolved = paths;
-  return paths;
-}
-function workspace() {
-  if (!resolved) throw new Error("workspace not initialized: call initWorkspace() first");
-  return resolved;
-}
-
-// src/vault/vault.ts
-import fs2 from "fs";
-import path2 from "path";
-import { spawnSync } from "child_process";
-import { randomUUID } from "crypto";
-var MAGIC = Buffer.from("KHBV1", "ascii");
-var VAULT_TIMEOUT_MS = 3e4;
-var cachedScriptPath = null;
-function vaultScriptPath() {
-  if (cachedScriptPath) return cachedScriptPath;
-  const script = path2.join(workspace().assetsDir, "vault.ps1");
-  if (!fs2.existsSync(script)) throw new Error(`vault script missing: ${script}`);
-  cachedScriptPath = script;
-  return script;
-}
-function tmpPlainName(target) {
-  return path2.join(workspace().tmpDir, `.${path2.basename(target)}.${randomUUID().slice(0, 8)}.plain`);
-}
-function tmpEncName(target) {
-  return path2.join(workspace().tmpDir, `.${path2.basename(target)}.${randomUUID().slice(0, 8)}.enc`);
-}
-function runVault(guard, args) {
-  const r = spawnSync(
-    "powershell.exe",
-    ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", vaultScriptPath(), ...args],
-    { timeout: VAULT_TIMEOUT_MS, encoding: "utf8" }
-  );
-  if (r.error) throw new Error(`vault spawn failed: ${String(r.error)}`);
-  if (r.status !== 0) {
-    const detail = (r.stderr || r.stdout || "").trim().split("\n").slice(-3).join("; ");
-    throw new Error(`vault ${args[0]} failed (exit ${r.status}): ${detail}`);
-  }
-}
-function isEncrypted(file) {
-  if (!fs2.existsSync(file)) return false;
-  const fd = fs2.openSync(file, "r");
-  try {
-    const hdr = Buffer.alloc(MAGIC.length);
-    const read = fs2.readSync(fd, hdr, 0, hdr.length, 0);
-    return read === MAGIC.length && hdr.equals(MAGIC);
-  } finally {
-    fs2.closeSync(fd);
-  }
-}
-function loadJson(guard, file) {
-  const f = guard.assert(file);
-  if (!fs2.existsSync(f)) return null;
-  if (!isEncrypted(f)) {
-    try {
-      return JSON.parse(fs2.readFileSync(f, "utf8"));
-    } catch {
-      return null;
-    }
-  }
-  const tmp = tmpPlainName(f);
-  try {
-    runVault(guard, ["unprotect", "-InFile", f, "-OutFile", tmp]);
-    return JSON.parse(fs2.readFileSync(tmp, "utf8"));
-  } finally {
-    burnFileSync(tmp);
-  }
-}
-function saveJson(guard, file, value) {
-  const f = guard.assert(file);
-  fs2.mkdirSync(path2.dirname(f), { recursive: true });
-  const plain = tmpPlainName(f);
-  const enc = tmpEncName(f);
-  try {
-    fs2.writeFileSync(plain, JSON.stringify(value, null, 2), "utf8");
-    runVault(guard, ["protect", "-InFile", plain, "-OutFile", enc]);
-    fs2.renameSync(enc, f);
-  } finally {
-    burnFileSync(plain);
-    fs2.rmSync(enc, { force: true });
-  }
-}
-function readText(guard, file, fallback = "") {
-  const f = guard.assert(file);
-  try {
-    return fs2.readFileSync(f, "utf8");
-  } catch {
-    return fallback;
-  }
-}
-function writeText(guard, file, content) {
-  const f = guard.assert(file);
-  fs2.mkdirSync(path2.dirname(f), { recursive: true });
-  const tmp = tmpPlainName(f);
-  try {
-    fs2.writeFileSync(tmp, content, "utf8");
-    fs2.renameSync(tmp, f);
-  } finally {
-    burnFileSync(tmp);
-  }
-}
-function loadEncryptedText(guard, file) {
-  const f = guard.assert(file);
-  if (!fs2.existsSync(f)) return null;
-  if (!isEncrypted(f)) return fs2.readFileSync(f, "utf8");
-  const tmp = tmpPlainName(f);
-  try {
-    runVault(guard, ["unprotect", "-InFile", f, "-OutFile", tmp]);
-    return fs2.readFileSync(tmp, "utf8");
-  } finally {
-    burnFileSync(tmp);
-  }
-}
-function saveEncryptedText(guard, file, content) {
-  const f = guard.assert(file);
-  fs2.mkdirSync(path2.dirname(f), { recursive: true });
-  const plain = tmpPlainName(f);
-  const enc = tmpEncName(f);
-  try {
-    fs2.writeFileSync(plain, content, "utf8");
-    runVault(guard, ["protect", "-InFile", plain, "-OutFile", enc]);
-    fs2.renameSync(enc, f);
-  } finally {
-    burnFileSync(plain);
-    fs2.rmSync(enc, { force: true });
-  }
-}
-function encryptFile(guard, inFile, outFile) {
-  const inPath = guard.assert(inFile);
-  const outPath = guard.assert(outFile);
-  fs2.mkdirSync(path2.dirname(outPath), { recursive: true });
-  const enc = tmpEncName(outPath);
-  try {
-    runVault(guard, ["protect", "-InFile", inPath, "-OutFile", enc]);
-    fs2.renameSync(enc, outPath);
-  } finally {
-    fs2.rmSync(enc, { force: true });
-  }
-}
-function decryptFile(guard, inFile, outFile) {
-  const inPath = guard.assert(inFile);
-  const outPath = guard.assert(outFile);
-  fs2.mkdirSync(path2.dirname(outPath), { recursive: true });
-  runVault(guard, ["unprotect", "-InFile", inPath, "-OutFile", outPath]);
-}
-
-export {
-  initWorkspace,
-  workspace,
-  isEncrypted,
-  loadJson,
-  saveJson,
-  readText,
-  writeText,
-  loadEncryptedText,
-  saveEncryptedText,
-  encryptFile,
-  decryptFile
-};
-//# sourceMappingURL=chunk-7TW6DD6Q.js.map

package/dist/chunk-7TW6DD6Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core/paths.ts","../src/vault/vault.ts"],"sourcesContent":["// Workspace/data directory resolution and package asset location.\n//\n// The data dir is the ONLY directory the plugin writes to at runtime\n// (requirement 8). Resolution order: env override > plugin config > default\n// (packageRoot/data). All fs writes must go through the path guard created\n// from this dir (see core/path-guard.ts).\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nexport interface WorkspacePaths {\n  /** Guard boundary and the only writable tree at runtime. */\n  dataDir: string;\n  settingsDir: string;\n  logsDir: string;\n  tmpDir: string;\n  exportsDir: string;\n  /** Package root (where package.json lives). Read-only at runtime. */\n  packageRoot: string;\n  configDir: string;\n  assetsDir: string;\n}\n\nexport interface WorkspaceConfigInput {\n  dataDir?: string | null;\n}\n\nlet resolved: WorkspacePaths | null = null;\n\n/** Walk up from a module file to the directory containing package.json. */\nexport function findPackageRoot(startFile: string): string {\n  let dir = path.dirname(path.resolve(startFile));\n  for (;;) {\n    if (fs.existsSync(path.join(dir, 'package.json'))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) throw new Error('package.json not found above ' + startFile);\n    dir = parent;\n  }\n}\n\nexport function packageRoot(): string {\n  return findPackageRoot(fileURLToPath(import.meta.url));\n}\n\n/**\n * Resolve and create the workspace layout. Idempotent; must be called once\n * from the plugin entry before any fs write happens.\n */\nexport function initWorkspace(config: WorkspaceConfigInput = {}): WorkspacePaths {\n  if (resolved) return resolved;\n  const root = packageRoot();\n  const dataDir = path.resolve(\n    process.env.HEARTBEAT_DATA_DIR || config.dataDir || path.join(root, 'data'),\n  );\n  const paths: WorkspacePaths = {\n    dataDir,\n    settingsDir: path.join(dataDir, 'settings'),\n    logsDir: path.join(dataDir, 'logs'),\n    tmpDir: path.join(dataDir, 'tmp'),\n    exportsDir: path.join(dataDir, 'exports'),\n    packageRoot: root,\n    configDir: path.join(root, 'config'),\n    assetsDir: path.join(root, 'assets'),\n  };\n  // Bootstrap creation happens before the guard exists; creating exactly one\n  // directory tree at a known location is the safe window for this.\n  for (const dir of [\n    paths.dataDir,\n    paths.settingsDir,\n    paths.logsDir,\n    paths.tmpDir,\n    paths.exportsDir,\n  ]) {\n    fs.mkdirSync(dir, { recursive: true });\n  }\n  resolved = paths;\n  return paths;\n}\n\n/** Access already-initialized paths. Throws if initWorkspace was not called. */\nexport function workspace(): WorkspacePaths {\n  if (!resolved) throw new Error('workspace not initialized: call initWorkspace() first');\n  return resolved;\n}\n\n/** Test-only: forget the resolved singleton so a later init re-resolves. */\nexport function resetWorkspaceForTest(): void {\n  resolved = null;\n}\n","// Transparent encryption read/write layer (port of v1 lib/vault.mjs).\n//\n// Mechanism: Node <-> vault.ps1 hand off through temp files (plain text\n// windows are millisecond-scale). v2 hardening over v1:\n//   - plaintext temp files live ONLY under data/tmp (never beside targets);\n//   - every path passes the workspace guard before reaching PowerShell;\n//   - encrypted output lands via same-volume rename (atomic replace).\n// Encryption failure is fail-closed: throw, never fall back to plaintext.\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { spawnSync } from 'node:child_process';\nimport { randomUUID } from 'node:crypto';\nimport type { PathGuard } from '../core/path-guard.js';\nimport { workspace } from '../core/paths.js';\nimport { burnFileSync } from '../core/atomic-fs.js';\n\nconst MAGIC = Buffer.from('KHBV1', 'ascii');\nconst VAULT_TIMEOUT_MS = 30_000;\n\nlet cachedScriptPath: string | null = null;\n\nfunction vaultScriptPath(): string {\n  if (cachedScriptPath) return cachedScriptPath;\n  const script = path.join(workspace().assetsDir, 'vault.ps1');\n  if (!fs.existsSync(script)) throw new Error(`vault script missing: ${script}`);\n  cachedScriptPath = script;\n  return script;\n}\n\nfunction tmpPlainName(target: string): string {\n  return path.join(workspace().tmpDir, `.${path.basename(target)}.${randomUUID().slice(0, 8)}.plain`);\n}\n\nfunction tmpEncName(target: string): string {\n  return path.join(workspace().tmpDir, `.${path.basename(target)}.${randomUUID().slice(0, 8)}.enc`);\n}\n\nfunction runVault(guard: PathGuard, args: string[]): void {\n  const r = spawnSync(\n    'powershell.exe',\n    ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', vaultScriptPath(), ...args],\n    { timeout: VAULT_TIMEOUT_MS, encoding: 'utf8' },\n  );\n  if (r.error) throw new Error(`vault spawn failed: ${String(r.error)}`);\n  if (r.status !== 0) {\n    const detail = (r.stderr || r.stdout || '').trim().split('\\n').slice(-3).join('; ');\n    throw new Error(`vault ${args[0]} failed (exit ${r.status}): ${detail}`);\n  }\n}\n\n/** KHBV1 header check without reading the whole file. */\nexport function isEncrypted(file: string): boolean {\n  if (!fs.existsSync(file)) return false;\n  const fd = fs.openSync(file, 'r');\n  try {\n    const hdr = Buffer.alloc(MAGIC.length);\n    const read = fs.readSync(fd, hdr, 0, hdr.length, 0);\n    return read === MAGIC.length && hdr.equals(MAGIC);\n  } finally {\n    fs.closeSync(fd);\n  }\n}\n\n/**\n * Read JSON: encrypted files are decrypted to a data/tmp plaintext window\n * that is shredded immediately after parse; plaintext stays compatible.\n */\nexport function loadJson<T>(guard: PathGuard, file: string): T | null {\n  const f = guard.assert(file);\n  if (!fs.existsSync(f)) return null;\n  if (!isEncrypted(f)) {\n    try {\n      return JSON.parse(fs.readFileSync(f, 'utf8')) as T;\n    } catch {\n      return null;\n    }\n  }\n  const tmp = tmpPlainName(f);\n  try {\n    runVault(guard, ['unprotect', '-InFile', f, '-OutFile', tmp]);\n    return JSON.parse(fs.readFileSync(tmp, 'utf8')) as T;\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Write JSON: plaintext window in data/tmp -> DPAPI encrypt -> atomic rename into place. */\nexport function saveJson(guard: PathGuard, file: string, value: unknown): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const plain = tmpPlainName(f);\n  const enc = tmpEncName(f);\n  try {\n    fs.writeFileSync(plain, JSON.stringify(value, null, 2), 'utf8');\n    runVault(guard, ['protect', '-InFile', plain, '-OutFile', enc]);\n    fs.renameSync(enc, f);\n  } finally {\n    burnFileSync(plain);\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/** Read a plaintext UTF-8 text file (ledger etc.), with fallback. */\nexport function readText(guard: PathGuard, file: string, fallback = ''): string {\n  const f = guard.assert(file);\n  try {\n    return fs.readFileSync(f, 'utf8');\n  } catch {\n    return fallback;\n  }\n}\n\n/** Write a plaintext UTF-8 text file atomically (ledger etc.). */\nexport function writeText(guard: PathGuard, file: string, content: string): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const tmp = tmpPlainName(f);\n  try {\n    fs.writeFileSync(tmp, content, 'utf8');\n    fs.renameSync(tmp, f);\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Read an encrypted UTF-8 text file (e.g. seeds.jsonl). Missing -> null. */\nexport function loadEncryptedText(guard: PathGuard, file: string): string | null {\n  const f = guard.assert(file);\n  if (!fs.existsSync(f)) return null;\n  if (!isEncrypted(f)) return fs.readFileSync(f, 'utf8');\n  const tmp = tmpPlainName(f);\n  try {\n    runVault(guard, ['unprotect', '-InFile', f, '-OutFile', tmp]);\n    return fs.readFileSync(tmp, 'utf8');\n  } finally {\n    burnFileSync(tmp);\n  }\n}\n\n/** Write an encrypted UTF-8 text file atomically. */\nexport function saveEncryptedText(guard: PathGuard, file: string, content: string): void {\n  const f = guard.assert(file);\n  fs.mkdirSync(path.dirname(f), { recursive: true });\n  const plain = tmpPlainName(f);\n  const enc = tmpEncName(f);\n  try {\n    fs.writeFileSync(plain, content, 'utf8');\n    runVault(guard, ['protect', '-InFile', plain, '-OutFile', enc]);\n    fs.renameSync(enc, f);\n  } finally {\n    burnFileSync(plain);\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/** Encrypt any binary file (e.g. screenshot): inFile -> encrypted outFile. */\nexport function encryptFile(guard: PathGuard, inFile: string, outFile: string): void {\n  const inPath = guard.assert(inFile);\n  const outPath = guard.assert(outFile);\n  fs.mkdirSync(path.dirname(outPath), { recursive: true });\n  const enc = tmpEncName(outPath);\n  try {\n    runVault(guard, ['protect', '-InFile', inPath, '-OutFile', enc]);\n    fs.renameSync(enc, outPath);\n  } finally {\n    fs.rmSync(enc, { force: true });\n  }\n}\n\n/**\n * Decrypt an encrypted file to a plaintext output (caller must place the\n * output under data/tmp and delete it after use; \"use then burn\" discipline).\n */\nexport function decryptFile(guard: PathGuard, inFile: string, outFile: string): void {\n  const inPath = guard.assert(inFile);\n  const outPath = guard.assert(outFile);\n  fs.mkdirSync(path.dirname(outPath), { recursive: true });\n  runVault(guard, ['unprotect', '-InFile', inPath, '-OutFile', outPath]);\n}\n"],"mappings":";;;;;AAOA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAmB9B,IAAI,WAAkC;AAG/B,SAAS,gBAAgB,WAA2B;AACzD,MAAI,MAAM,KAAK,QAAQ,KAAK,QAAQ,SAAS,CAAC;AAC9C,aAAS;AACP,QAAI,GAAG,WAAW,KAAK,KAAK,KAAK,cAAc,CAAC,EAAG,QAAO;AAC1D,UAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK,OAAM,IAAI,MAAM,kCAAkC,SAAS;AAC/E,UAAM;AAAA,EACR;AACF;AAEO,SAAS,cAAsB;AACpC,SAAO,gBAAgB,cAAc,YAAY,GAAG,CAAC;AACvD;AAMO,SAAS,cAAc,SAA+B,CAAC,GAAmB;AAC/E,MAAI,SAAU,QAAO;AACrB,QAAM,OAAO,YAAY;AACzB,QAAM,UAAU,KAAK;AAAA,IACnB,QAAQ,IAAI,sBAAsB,OAAO,WAAW,KAAK,KAAK,MAAM,MAAM;AAAA,EAC5E;AACA,QAAM,QAAwB;AAAA,IAC5B;AAAA,IACA,aAAa,KAAK,KAAK,SAAS,UAAU;AAAA,IAC1C,SAAS,KAAK,KAAK,SAAS,MAAM;AAAA,IAClC,QAAQ,KAAK,KAAK,SAAS,KAAK;AAAA,IAChC,YAAY,KAAK,KAAK,SAAS,SAAS;AAAA,IACxC,aAAa;AAAA,IACb,WAAW,KAAK,KAAK,MAAM,QAAQ;AAAA,IACnC,WAAW,KAAK,KAAK,MAAM,QAAQ;AAAA,EACrC;AAGA,aAAW,OAAO;AAAA,IAChB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,IACN,MAAM;AAAA,EACR,GAAG;AACD,OAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAAA,EACvC;AACA,aAAW;AACX,SAAO;AACT;AAGO,SAAS,YAA4B;AAC1C,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,uDAAuD;AACtF,SAAO;AACT;;;AC3EA,OAAOA,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAK3B,IAAM,QAAQ,OAAO,KAAK,SAAS,OAAO;AAC1C,IAAM,mBAAmB;AAEzB,IAAI,mBAAkC;AAEtC,SAAS,kBAA0B;AACjC,MAAI,iBAAkB,QAAO;AAC7B,QAAM,SAASC,MAAK,KAAK,UAAU,EAAE,WAAW,WAAW;AAC3D,MAAI,CAACC,IAAG,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,yBAAyB,MAAM,EAAE;AAC7E,qBAAmB;AACnB,SAAO;AACT;AAEA,SAAS,aAAa,QAAwB;AAC5C,SAAOD,MAAK,KAAK,UAAU,EAAE,QAAQ,IAAIA,MAAK,SAAS,MAAM,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,QAAQ;AACpG;AAEA,SAAS,WAAW,QAAwB;AAC1C,SAAOA,MAAK,KAAK,UAAU,EAAE,QAAQ,IAAIA,MAAK,SAAS,MAAM,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC,MAAM;AAClG;AAEA,SAAS,SAAS,OAAkB,MAAsB;AACxD,QAAM,IAAI;AAAA,IACR;AAAA,IACA,CAAC,cAAc,oBAAoB,UAAU,SAAS,gBAAgB,GAAG,GAAG,IAAI;AAAA,IAChF,EAAE,SAAS,kBAAkB,UAAU,OAAO;AAAA,EAChD;AACA,MAAI,EAAE,MAAO,OAAM,IAAI,MAAM,uBAAuB,OAAO,EAAE,KAAK,CAAC,EAAE;AACrE,MAAI,EAAE,WAAW,GAAG;AAClB,UAAM,UAAU,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI;AAClF,UAAM,IAAI,MAAM,SAAS,KAAK,CAAC,CAAC,iBAAiB,EAAE,MAAM,MAAM,MAAM,EAAE;AAAA,EACzE;AACF;AAGO,SAAS,YAAY,MAAuB;AACjD,MAAI,CAACC,IAAG,WAAW,IAAI,EAAG,QAAO;AACjC,QAAM,KAAKA,IAAG,SAAS,MAAM,GAAG;AAChC,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,MAAM,MAAM;AACrC,UAAM,OAAOA,IAAG,SAAS,IAAI,KAAK,GAAG,IAAI,QAAQ,CAAC;AAClD,WAAO,SAAS,MAAM,UAAU,IAAI,OAAO,KAAK;AAAA,EAClD,UAAE;AACA,IAAAA,IAAG,UAAU,EAAE;AAAA,EACjB;AACF;AAMO,SAAS,SAAY,OAAkB,MAAwB;AACpE,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI,CAACA,IAAG,WAAW,CAAC,EAAG,QAAO;AAC9B,MAAI,CAAC,YAAY,CAAC,GAAG;AACnB,QAAI;AACF,aAAO,KAAK,MAAMA,IAAG,aAAa,GAAG,MAAM,CAAC;AAAA,IAC9C,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,aAAS,OAAO,CAAC,aAAa,WAAW,GAAG,YAAY,GAAG,CAAC;AAC5D,WAAO,KAAK,MAAMA,IAAG,aAAa,KAAK,MAAM,CAAC;AAAA,EAChD,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,SAAS,OAAkB,MAAc,OAAsB;AAC7E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,QAAQ,aAAa,CAAC;AAC5B,QAAM,MAAM,WAAW,CAAC;AACxB,MAAI;AACF,IAAAC,IAAG,cAAc,OAAO,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAC9D,aAAS,OAAO,CAAC,WAAW,WAAW,OAAO,YAAY,GAAG,CAAC;AAC9D,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,KAAK;AAClB,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,SAAS,OAAkB,MAAc,WAAW,IAAY;AAC9E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI;AACF,WAAOA,IAAG,aAAa,GAAG,MAAM;AAAA,EAClC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,UAAU,OAAkB,MAAc,SAAuB;AAC/E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,IAAAC,IAAG,cAAc,KAAK,SAAS,MAAM;AACrC,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,kBAAkB,OAAkB,MAA6B;AAC/E,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,MAAI,CAACA,IAAG,WAAW,CAAC,EAAG,QAAO;AAC9B,MAAI,CAAC,YAAY,CAAC,EAAG,QAAOA,IAAG,aAAa,GAAG,MAAM;AACrD,QAAM,MAAM,aAAa,CAAC;AAC1B,MAAI;AACF,aAAS,OAAO,CAAC,aAAa,WAAW,GAAG,YAAY,GAAG,CAAC;AAC5D,WAAOA,IAAG,aAAa,KAAK,MAAM;AAAA,EACpC,UAAE;AACA,iBAAa,GAAG;AAAA,EAClB;AACF;AAGO,SAAS,kBAAkB,OAAkB,MAAc,SAAuB;AACvF,QAAM,IAAI,MAAM,OAAO,IAAI;AAC3B,EAAAA,IAAG,UAAUD,MAAK,QAAQ,CAAC,GAAG,EAAE,WAAW,KAAK,CAAC;AACjD,QAAM,QAAQ,aAAa,CAAC;AAC5B,QAAM,MAAM,WAAW,CAAC;AACxB,MAAI;AACF,IAAAC,IAAG,cAAc,OAAO,SAAS,MAAM;AACvC,aAAS,OAAO,CAAC,WAAW,WAAW,OAAO,YAAY,GAAG,CAAC;AAC9D,IAAAA,IAAG,WAAW,KAAK,CAAC;AAAA,EACtB,UAAE;AACA,iBAAa,KAAK;AAClB,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAGO,SAAS,YAAY,OAAkB,QAAgB,SAAuB;AACnF,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,UAAU,MAAM,OAAO,OAAO;AACpC,EAAAA,IAAG,UAAUD,MAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,MAAM,WAAW,OAAO;AAC9B,MAAI;AACF,aAAS,OAAO,CAAC,WAAW,WAAW,QAAQ,YAAY,GAAG,CAAC;AAC/D,IAAAC,IAAG,WAAW,KAAK,OAAO;AAAA,EAC5B,UAAE;AACA,IAAAA,IAAG,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACF;AAMO,SAAS,YAAY,OAAkB,QAAgB,SAAuB;AACnF,QAAM,SAAS,MAAM,OAAO,MAAM;AAClC,QAAM,UAAU,MAAM,OAAO,OAAO;AACpC,EAAAA,IAAG,UAAUD,MAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,WAAS,OAAO,CAAC,aAAa,WAAW,QAAQ,YAAY,OAAO,CAAC;AACvE;","names":["fs","path","path","fs"]}