@remnic/core 1.1.2 → 1.1.3

package/dist/{chunk-FVA6TGI3.js → chunk-Y3WQ4ZWK.js}

@@ -4,7 +4,7 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-F5VP6YCB.js";
+} from "./chunk-DCE6SQLA.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-M62O4P4T.js";
@@ -84,10 +84,50 @@ function scoreAliasMatch(query, alias) {
   if (containsPhrase(normalizedQuery, normalizedAlias)) return 8 + Math.min(normalizedAlias.split(/\s+/).length, 3);
   const queryTokens = new Set(tokenize(normalizedQuery));
   const aliasTokens = tokenize(normalizedAlias);
+  if (aliasTokens.length === 0) return 0;
   const overlap = aliasTokens.filter((token) => queryTokens.has(token)).length;
   if (overlap === 0) return 0;
+  if (aliasTokens.length > 1) {
+    const nonAffixOverlap = aliasTokens.filter(
+      (token) => queryTokens.has(token) && !isAliasAffixToken(token)
+    ).length;
+    if (nonAffixOverlap === 0) return 0;
+  }
   return overlap;
 }
+var ALIAS_AFFIX_TOKENS = /* @__PURE__ */ new Set([
+  "person",
+  "people",
+  "user",
+  "users",
+  "team",
+  "teams",
+  "project",
+  "projects",
+  "topic",
+  "topics",
+  "org",
+  "orgs",
+  "organization",
+  "organizations",
+  "company",
+  "companies",
+  "place",
+  "places",
+  "tool",
+  "tools",
+  "service",
+  "services",
+  "system",
+  "systems",
+  "agent",
+  "agents",
+  "bot",
+  "bots"
+]);
+function isAliasAffixToken(token) {
+  return ALIAS_AFFIX_TOKENS.has(token);
+}
 function isLikelyInstructionLike(value) {
   return INSTRUCTION_LIKE_RE.test(value) || METADATA_WRAPPER_RE.test(value);
 }
@@ -553,4 +593,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-FVA6TGI3.js.map
+//# sourceMappingURL=chunk-Y3WQ4ZWK.js.map

package/dist/chunk-Y3WQ4ZWK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/entity-retrieval.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { sanitizeMemoryContent } from \"./sanitize.js\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { collectNativeKnowledgeChunks, type NativeKnowledgeChunk } from \"./native-knowledge.js\";\nimport { compareEntityTimestamps, normalizeEntityName, type StorageManager } from \"./storage.js\";\nimport { normalizeEntityText, resolveRequestedEntitySectionKeys } from \"./entity-schema.js\";\nimport type { EntityStructuredSection, MemoryFile, PluginConfig, TranscriptEntry } from \"./types.js\";\n\nconst ENTITY_INDEX_VERSION = 3;\nconst RECENT_TRANSCRIPT_LOOKBACK_HOURS = 24;\nconst INSTRUCTION_LIKE_RE = /\\b(always|never|must|should|remember to|do not|don't|process|workflow|template|checklist|instruction)\\b/i;\nconst METADATA_WRAPPER_RE = /^(source|context|metadata|notes?):/i;\nconst ENTITY_PRONOUN_RE = /\\b(he|him|his|she|her|they|them|their|it|its)\\b/i;\n\ntype EntityQueryMode = \"direct\" | \"timeline\" | \"follow_up\";\n\ntype EntityMentionIndexEntry = {\n  canonicalId: string;\n  name: string;\n  type: string;\n  aliases: string[];\n  summary?: string;\n  facts: string[];\n  timelineFacts: string[];\n  structuredSections: EntityStructuredSection[];\n  timeline: Array<{\n    timestamp: string;\n    text: string;\n    source?: string;\n    sessionKey?: string;\n    principal?: string;\n  }>;\n  relationships: Array<{ target: string; label: string }>;\n  activity: Array<{ date: string; note: string }>;\n  factCount: number;\n  memorySnippets: string[];\n  nativeChunks: Array<{\n    chunkId: string;\n    title: string;\n    sourceKind: NativeKnowledgeChunk[\"sourceKind\"];\n    sourcePath: string;\n    snippet: string;\n    derivedDate?: string;\n  }>;\n};\n\ntype EntityMentionIndex = {\n  version: number;\n  updatedAt: string;\n  entities: EntityMentionIndexEntry[];\n};\n\ntype EntityCandidate = {\n  entry: EntityMentionIndexEntry;\n  alias: string;\n  score: number;\n  source: \"query\" | \"recent_turn\";\n};\n\ntype EntityHintSnippet = {\n  text: string;\n  score: number;\n  kind: \"summary\" | \"fact\" | \"section\" | \"relationship\" | \"activity\" | \"memory\" | \"native\";\n};\n\nexport interface BuildEntityRecallSectionOptions {\n  config: PluginConfig;\n  storage: StorageManager;\n  query: string;\n  recallNamespaces?: string[];\n  recentTurns: number;\n  maxHints: number;\n  maxSupportingFacts: number;\n  maxRelatedEntities: number;\n  maxChars: number;\n  transcriptEntries: TranscriptEntry[];\n}\n\nfunction tokenize(value: string): string[] {\n  return normalizeEntityText(value).split(/\\s+/).filter((token) => token.length >= 2);\n}\n\nfunction uniqueStrings(values: string[]): string[] {\n  return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))];\n}\n\nfunction containsPhrase(haystack: string, needle: string): boolean {\n  if (!needle) return false;\n  const escaped = needle.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n  return new RegExp(`(^|\\\\b)${escaped}(\\\\b|$)`, \"i\").test(haystack);\n}\n\nfunction compactLine(value: string, maxLength: number = 220): string {\n  const normalized = value.replace(/\\s+/g, \" \").trim();\n  if (normalized.length <= maxLength) return normalized;\n  return `${normalized.slice(0, Math.max(0, maxLength - 1)).trimEnd()}…`;\n}\n\nfunction dedupeHintSnippetsByText(snippets: EntityHintSnippet[]): EntityHintSnippet[] {\n  const seen = new Set<string>();\n  const result: EntityHintSnippet[] = [];\n  for (const snippet of snippets) {\n    const key = normalizeEntityText(snippet.text);\n    if (seen.has(key)) continue;\n    seen.add(key);\n    result.push(snippet);\n  }\n  return result;\n}\n\nfunction relationLine(entry: EntityMentionIndexEntry, relationship: { target: string; label: string }): string {\n  const normalizedLabel = relationship.label.replace(/\\s+/g, \" \").trim();\n  if (normalizedLabel.length === 0) return `${entry.name} is connected to ${relationship.target}`;\n  return `${entry.name} ${normalizedLabel} ${relationship.target}`;\n}\n\nfunction detectEntityQueryMode(query: string): EntityQueryMode | null {\n  const normalized = normalizeEntityText(query);\n  if (!normalized) return null;\n  if (\n    /^(what about|and what about|how about|what happened (with|to) (he|him|his|she|her|they|them|their|it|its)|did (he|she|they|it)|is (he|she|they|it)|was (he|she|they|it))\\b/.test(normalized)\n  ) {\n    return \"follow_up\";\n  }\n  if (\n    /^(who is|who s|what do we know about|what does|tell me about|what can you tell me about|what s new with|what happened with|what happened to|status of|where is|how is)\\b/.test(normalized)\n  ) {\n    if (/^what does\\b/.test(normalized)) {\n      if (/^what does (?:this|that|it|the|a|an|my|our|your|their)\\b/.test(normalized)) {\n        return null;\n      }\n      if (\n        /^what does [a-z0-9-]+ (?:error|warning|exception|failure|stack|trace|code|message|log)\\b/.test(normalized)\n        && /\\b(mean|means|indicate|indicates|imply|implies)\\b/.test(normalized)\n      ) {\n        return null;\n      }\n    }\n    return /what happened|what s new|status of|how is|where is/.test(normalized) ? \"timeline\" : \"direct\";\n  }\n  if (ENTITY_PRONOUN_RE.test(normalized) && normalized.split(/\\s+/).length <= 8) {\n    return \"follow_up\";\n  }\n  return null;\n}\n\nfunction scoreAliasMatch(query: string, alias: string): number {\n  const normalizedQuery = normalizeEntityText(query);\n  const normalizedAlias = normalizeEntityText(alias);\n  if (!normalizedAlias) return 0;\n  if (normalizedQuery === normalizedAlias) return 10;\n  if (containsPhrase(normalizedQuery, normalizedAlias)) return 8 + Math.min(normalizedAlias.split(/\\s+/).length, 3);\n  const queryTokens = new Set(tokenize(normalizedQuery));\n  const aliasTokens = tokenize(normalizedAlias);\n  if (aliasTokens.length === 0) return 0;\n  const overlap = aliasTokens.filter((token) => queryTokens.has(token)).length;\n  if (overlap === 0) return 0;\n  // Cross-entity contamination guard (#682 PR 2/3 R-2). For multi-token\n  // aliases, partial-token overlap that hits ONLY shared common tokens\n  // (like \"person\" in \"Person-A1\" / \"Person-B1\") would surface every\n  // similarly-prefixed entity for a query that named only one. Require\n  // that the overlap include at least one DISTINCTIVE alias token —\n  // i.e. a token that does not also appear in any other entity's\n  // alias-token vocabulary. Since this function is pure / per-pair, we\n  // approximate \"distinctive\" by requiring the overlap to include at\n  // least one token that is not a substring-of common identifier\n  // affixes. The aliasTokens with length > 1 must contribute at least\n  // one non-affix overlap. \"Alice Example\" ([\"alice\", \"example\"])\n  // matched by query \"Tell me about Alice\" → overlap = 1 on \"alice\",\n  // and \"alice\" is not an affix → score = 1. \"Person-A1\" tokens\n  // [\"person\", \"a1\"] matched by query \"Who is Person-B1?\" → overlap =\n  // 1 on \"person\", and \"person\" IS an affix → score = 0.\n  if (aliasTokens.length > 1) {\n    const nonAffixOverlap = aliasTokens.filter(\n      (token) => queryTokens.has(token) && !isAliasAffixToken(token),\n    ).length;\n    if (nonAffixOverlap === 0) return 0;\n  }\n  return overlap;\n}\n\n/**\n * Tokens that look like type prefixes / generic role identifiers and\n * therefore should not, on their own, count as evidence that a\n * multi-token alias matches a query (#682 PR 2/3 R-2).\n *\n * Kept as a small explicit list rather than a regex so additions are\n * deliberate. The list mirrors the entity types listed in\n * `entity-schema.ts` plus the most common generic role identifiers\n * that frequently appear as the leading token of a display name.\n */\nconst ALIAS_AFFIX_TOKENS = new Set<string>([\n  \"person\", \"people\", \"user\", \"users\", \"team\", \"teams\",\n  \"project\", \"projects\", \"topic\", \"topics\",\n  \"org\", \"orgs\", \"organization\", \"organizations\", \"company\", \"companies\",\n  \"place\", \"places\", \"tool\", \"tools\", \"service\", \"services\",\n  \"system\", \"systems\", \"agent\", \"agents\", \"bot\", \"bots\",\n]);\n\nfunction isAliasAffixToken(token: string): boolean {\n  return ALIAS_AFFIX_TOKENS.has(token);\n}\n\nfunction isLikelyInstructionLike(value: string): boolean {\n  return INSTRUCTION_LIKE_RE.test(value) || METADATA_WRAPPER_RE.test(value);\n}\n\nfunction sanitizeEntityFact(fact: string): string {\n  const sanitized = sanitizeMemoryContent(fact);\n  const clean = sanitized.text.trim();\n  if (!clean) return \"\";\n  if (INSTRUCTION_LIKE_RE.test(clean) && clean.length > 100) return \"\";\n  return clean;\n}\n\nfunction scoreHintSnippet(snippet: EntityHintSnippet, queryTokens: string[]): EntityHintSnippet | null {\n  const normalized = normalizeEntityText(snippet.text);\n  if (!normalized) return null;\n  const scored = { ...snippet };\n  if (isLikelyInstructionLike(scored.text) && scored.kind !== \"summary\") {\n    scored.score -= 3;\n  }\n  const overlap = queryTokens.filter((token) => normalized.includes(token)).length;\n  scored.score += overlap * 2;\n  if (METADATA_WRAPPER_RE.test(scored.text)) scored.score -= 2;\n  if (scored.text.length <= 160) scored.score += 1;\n  return scored.score > 0 ? scored : null;\n}\n\nfunction sortTimelineEntriesDesc(\n  left: EntityMentionIndexEntry[\"timeline\"][number],\n  right: EntityMentionIndexEntry[\"timeline\"][number],\n): number {\n  const timestampOrder = compareEntityTimestamps(right.timestamp, left.timestamp);\n  if (timestampOrder !== 0) {\n    return timestampOrder;\n  }\n  return right.text.localeCompare(left.text);\n}\n\nfunction jaccardSimilarity(a: string, b: string): number {\n  const aTokens = new Set(tokenize(a));\n  const bTokens = new Set(tokenize(b));\n  if (aTokens.size === 0 || bTokens.size === 0) return 0;\n  let intersection = 0;\n  for (const token of aTokens) {\n    if (bTokens.has(token)) intersection += 1;\n  }\n  const union = new Set([...aTokens, ...bTokens]).size;\n  return union === 0 ? 0 : intersection / union;\n}\n\nfunction buildAliasIndex(entries: EntityMentionIndexEntry[]): Map<string, EntityMentionIndexEntry[]> {\n  const index = new Map<string, EntityMentionIndexEntry[]>();\n  for (const entry of entries) {\n    const aliases = uniqueStrings([entry.name, ...entry.aliases]).map(normalizeEntityText).filter(Boolean);\n    for (const alias of aliases) {\n      const existing = index.get(alias) ?? [];\n      existing.push(entry);\n      index.set(alias, existing);\n    }\n  }\n  return index;\n}\n\nasync function readNativeChunks(\n  config: PluginConfig,\n  recallNamespaces?: string[],\n): Promise<NativeKnowledgeChunk[]> {\n  if (!config.nativeKnowledge?.enabled) return [];\n  return collectNativeKnowledgeChunks({\n    workspaceDir: config.workspaceDir,\n    memoryDir: config.memoryDir,\n    config: config.nativeKnowledge,\n    recallNamespaces: config.namespacesEnabled ? recallNamespaces : undefined,\n    defaultNamespace: config.defaultNamespace,\n  }).catch(() => []);\n}\n\nfunction entityIndexStatePath(storage: StorageManager): string {\n  return path.join(storage.dir, \"state\", \"entity-mention-index.json\");\n}\n\nasync function readEntityIndexState(storage: StorageManager): Promise<EntityMentionIndex | null> {\n  const raw = await readFile(entityIndexStatePath(storage), \"utf-8\").catch(() => \"\");\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw) as Partial<EntityMentionIndex>;\n    if (parsed.version !== ENTITY_INDEX_VERSION || !Array.isArray(parsed.entities)) return null;\n    return parsed as EntityMentionIndex;\n  } catch {\n    return null;\n  }\n}\n\nasync function writeEntityIndexState(storage: StorageManager, index: EntityMentionIndex): Promise<void> {\n  const statePath = entityIndexStatePath(storage);\n  await mkdir(path.dirname(statePath), { recursive: true });\n  const nextContent = JSON.stringify(index, null, 2) + \"\\n\";\n  const currentContent = await readFile(statePath, \"utf-8\").catch(() => \"\");\n  if (currentContent === nextContent) return;\n  await writeFile(statePath, nextContent, \"utf-8\");\n}\n\nfunction nativePseudoCanonicalId(chunk: NativeKnowledgeChunk): string {\n  return `native:${createHash(\"sha256\").update(chunk.sourcePath).digest(\"hex\").slice(0, 12)}`;\n}\n\nfunction createPseudoNativeEntry(chunk: NativeKnowledgeChunk): EntityMentionIndexEntry {\n  const canonicalId = nativePseudoCanonicalId(chunk);\n  return {\n    canonicalId,\n    name: chunk.title,\n    type: chunk.sourceKind,\n    aliases: uniqueStrings(chunk.aliases ?? []),\n    facts: [],\n    structuredSections: [],\n    timelineFacts: [],\n    timeline: [],\n    relationships: [],\n    activity: [],\n    factCount: 0,\n    memorySnippets: [],\n    nativeChunks: [\n      {\n        chunkId: chunk.chunkId,\n        title: chunk.title,\n        sourceKind: chunk.sourceKind,\n        sourcePath: chunk.sourcePath,\n        snippet: compactLine(chunk.content, 180),\n        derivedDate: chunk.derivedDate,\n      },\n    ],\n  };\n}\n\nfunction mergeNativeChunk(entry: EntityMentionIndexEntry, chunk: NativeKnowledgeChunk): void {\n  const existing = entry.nativeChunks.find((item) => item.chunkId === chunk.chunkId);\n  if (existing) return;\n  entry.nativeChunks.push({\n    chunkId: chunk.chunkId,\n    title: chunk.title,\n    sourceKind: chunk.sourceKind,\n    sourcePath: chunk.sourcePath,\n    snippet: compactLine(chunk.content, 180),\n    derivedDate: chunk.derivedDate,\n  });\n  entry.aliases = uniqueStrings([...entry.aliases, ...(chunk.aliases ?? [])]);\n}\n\nasync function buildEntityMentionIndex(\n  storage: StorageManager,\n  config: PluginConfig,\n  recallNamespaces?: string[],\n): Promise<EntityMentionIndex> {\n  const [previousIndex, entityFiles, memories, nativeChunks] = await Promise.all([\n    readEntityIndexState(storage),\n    storage.readAllEntityFiles(),\n    storage.readAllMemories(),\n    readNativeChunks(config, recallNamespaces),\n  ]);\n\n  const entities = new Map<string, EntityMentionIndexEntry>();\n  for (const entity of entityFiles) {\n    const canonicalId = normalizeEntityName(entity.name, entity.type);\n    const sanitizedFacts = entity.facts.map((fact) => sanitizeEntityFact(fact)).filter(Boolean).map((fact) => compactLine(fact, 180));\n    const sanitizedTimelineFacts = entity.timeline\n      .map((entry) => sanitizeEntityFact(entry.text))\n      .filter(Boolean)\n      .map((fact) => compactLine(fact, 180));\n    entities.set(canonicalId, {\n      canonicalId,\n      name: entity.name,\n      type: entity.type,\n      aliases: uniqueStrings(entity.aliases),\n      summary: entity.synthesis?.trim() || entity.summary?.trim() || undefined,\n      facts: sanitizedFacts,\n      timelineFacts: uniqueStrings(sanitizedTimelineFacts),\n      structuredSections: (entity.structuredSections ?? []).map((section) => ({\n        key: section.key,\n        title: section.title,\n        facts: section.facts\n          .map((fact) => sanitizeEntityFact(fact))\n          .filter(Boolean)\n          .map((fact) => compactLine(fact, 180)),\n      })).filter((section) => section.facts.length > 0),\n      timeline: entity.timeline.map((entry) => ({ ...entry })),\n      relationships: entity.relationships.map((relationship) => ({ ...relationship })),\n      activity: entity.activity.map((activity) => ({ ...activity })),\n      factCount: sanitizedFacts.length,\n      memorySnippets: [],\n      nativeChunks: [],\n    });\n  }\n\n  for (const memory of memories) {\n    const entityRef = typeof memory.frontmatter.entityRef === \"string\" ? memory.frontmatter.entityRef : \"\";\n    if (!entityRef) continue;\n    const entry = entities.get(entityRef);\n    if (!entry) continue;\n    const snippet = await readMemorySnippet(memory);\n    if (!entry.memorySnippets.includes(snippet)) {\n      entry.memorySnippets.push(snippet);\n    }\n  }\n\n  const aliasIndex = buildAliasIndex([...entities.values()]);\n  for (const chunk of nativeChunks) {\n    const existingPseudo = entities.get(nativePseudoCanonicalId(chunk));\n    if (existingPseudo) {\n      mergeNativeChunk(existingPseudo, chunk);\n      continue;\n    }\n    const candidateAliases = uniqueStrings([chunk.title, ...(chunk.aliases ?? [])]).map(normalizeEntityText).filter(Boolean);\n    let matched = false;\n    for (const alias of candidateAliases) {\n      for (const entry of aliasIndex.get(alias) ?? []) {\n        mergeNativeChunk(entry, chunk);\n        matched = true;\n      }\n    }\n    if (matched) continue;\n    const pseudoEntry = createPseudoNativeEntry(chunk);\n    entities.set(pseudoEntry.canonicalId, pseudoEntry);\n  }\n\n  const sortedEntities = [...entities.values()].sort((left, right) => left.name.localeCompare(right.name));\n  const previousEntities = previousIndex ? JSON.stringify(previousIndex.entities) : \"\";\n  const nextEntities = JSON.stringify(sortedEntities);\n  const index: EntityMentionIndex = {\n    version: ENTITY_INDEX_VERSION,\n    updatedAt:\n      previousIndex && previousEntities === nextEntities\n        ? previousIndex.updatedAt\n        : new Date().toISOString(),\n    entities: sortedEntities,\n  };\n  await writeEntityIndexState(storage, index);\n  return index;\n}\n\nfunction resolveExplicitCandidates(\n  index: EntityMentionIndex,\n  query: string,\n): EntityCandidate[] {\n  const candidates: EntityCandidate[] = [];\n  for (const entry of index.entities) {\n    const aliases = uniqueStrings([entry.name, ...entry.aliases]);\n    let bestAlias = \"\";\n    let bestScore = 0;\n    for (const alias of aliases) {\n      const score = scoreAliasMatch(query, alias);\n      if (score > bestScore) {\n        bestAlias = alias;\n        bestScore = score;\n      }\n    }\n    if (bestScore <= 0) continue;\n    candidates.push({ entry, alias: bestAlias, score: bestScore, source: \"query\" });\n  }\n  return candidates.sort((left, right) => right.score - left.score);\n}\n\nfunction resolveRecentTurnCandidates(\n  index: EntityMentionIndex,\n  transcriptEntries: TranscriptEntry[],\n  recentTurns: number,\n): EntityCandidate[] {\n  if (recentTurns <= 0 || transcriptEntries.length === 0) return [];\n  const recentEntries = transcriptEntries.slice(-recentTurns);\n  const candidates = new Map<string, EntityCandidate>();\n  for (let indexOffset = recentEntries.length - 1; indexOffset >= 0; indexOffset -= 1) {\n    const turn = recentEntries[indexOffset];\n    const recencyBoost = recentEntries.length - indexOffset;\n    const roleWeight = turn.role === \"user\" ? 2 : turn.role === \"assistant\" ? -1 : 0;\n    for (const entry of index.entities) {\n      const aliases = uniqueStrings([entry.name, ...entry.aliases]);\n      for (const alias of aliases) {\n        const score = scoreAliasMatch(turn.content, alias);\n        if (score <= 0) continue;\n        const current = candidates.get(entry.canonicalId);\n        const weightedScore = score + Math.max(0, 6 - recencyBoost) + roleWeight;\n        if (!current || weightedScore > current.score) {\n          candidates.set(entry.canonicalId, {\n            entry,\n            alias,\n            score: weightedScore,\n            source: \"recent_turn\",\n          });\n        }\n      }\n    }\n  }\n  return [...candidates.values()].sort((left, right) => right.score - left.score);\n}\n\nasync function readMemorySnippet(memory: MemoryFile): Promise<string> {\n  const content = memory.content.replace(/\\s+/g, \" \").trim();\n  return compactLine(content, 180);\n}\n\nasync function buildHintSnippets(\n  entry: EntityMentionIndexEntry,\n  queryTokens: string[],\n  mode: EntityQueryMode,\n  maxSupportingFacts: number,\n  requestedSectionKeys: Set<string>,\n): Promise<EntityHintSnippet[]> {\n  const snippets: EntityHintSnippet[] = [];\n  const aliasTokens = new Set(tokenize(uniqueStrings([entry.name, ...entry.aliases]).join(\" \")));\n  if (entry.summary) {\n    snippets.push({ text: compactLine(entry.summary, 180), score: 10, kind: \"summary\" });\n  }\n\n  if (requestedSectionKeys.size > 0) {\n    for (const section of entry.structuredSections) {\n      if (!requestedSectionKeys.has(normalizeEntityText(section.key).replace(/\\s+/g, \"_\"))) continue;\n      for (const fact of section.facts) {\n        snippets.push({ text: fact, score: mode === \"direct\" ? 8 : 9, kind: \"section\" });\n      }\n    }\n  } else {\n    for (const fact of entry.timelineFacts) {\n      snippets.push({ text: fact, score: mode === \"direct\" ? 6 : 7, kind: \"fact\" });\n    }\n    for (const section of entry.structuredSections) {\n      for (const fact of section.facts) {\n        const normalizedFact = normalizeEntityText(fact);\n        const hasNonAliasQueryOverlap = queryTokens.some((token) =>\n          !aliasTokens.has(token) && normalizedFact.includes(token)\n        );\n        if (entry.timelineFacts.length > 0 && !hasNonAliasQueryOverlap) {\n          continue;\n        }\n        snippets.push({ text: fact, score: mode === \"direct\" ? 6 : 7, kind: \"fact\" });\n      }\n    }\n    if (entry.timelineFacts.length === 0 && entry.structuredSections.length === 0) {\n      for (const fact of entry.facts) {\n        if (!fact.trim()) continue;\n        snippets.push({ text: fact, score: mode === \"direct\" ? 6 : 7, kind: \"fact\" });\n      }\n    }\n  }\n\n  if (requestedSectionKeys.size === 0) {\n    for (const relationship of entry.relationships) {\n      snippets.push({\n        text: compactLine(relationLine(entry, relationship), 180),\n        score: mode === \"direct\" && entry.type.toLowerCase() === \"person\" ? 6 : 4,\n        kind: \"relationship\",\n      });\n    }\n\n    for (const activity of entry.activity) {\n      snippets.push({\n        text: compactLine(`${activity.date}: ${activity.note}`, 180),\n        score: 4,\n        kind: \"activity\",\n      });\n    }\n\n    for (const memorySnippet of entry.memorySnippets.slice(0, Math.min(maxSupportingFacts, 4))) {\n      snippets.push({\n        text: memorySnippet,\n        score: 5,\n        kind: \"memory\",\n      });\n    }\n\n    for (const chunk of entry.nativeChunks) {\n      snippets.push({\n        text: compactLine(chunk.snippet, 180),\n        score: 3,\n        kind: \"native\",\n      });\n    }\n  }\n\n  const deduped = new Map<string, EntityHintSnippet>();\n  for (const snippet of snippets) {\n    const scored = scoreHintSnippet(snippet, queryTokens);\n    if (!scored) continue;\n    const normalized = normalizeEntityText(scored.text);\n    const existing = deduped.get(normalized);\n    if (!existing || scored.score > existing.score) deduped.set(normalized, scored);\n  }\n\n  return [...deduped.values()]\n    .filter((snippet) => snippet.score > 0)\n    .sort((left, right) => right.score - left.score)\n    .slice(0, maxSupportingFacts);\n}\n\nfunction summarizeUncertainty(snippets: EntityHintSnippet[]): string | null {\n  const direct = snippets.filter((snippet) =>\n    snippet.kind === \"summary\"\n    || snippet.kind === \"fact\"\n    || snippet.kind === \"section\"\n    || snippet.kind === \"memory\"\n  );\n  if (direct.length < 2) return null;\n  for (let index = 0; index < direct.length; index += 1) {\n    for (let compare = index + 1; compare < direct.length; compare += 1) {\n      if (jaccardSimilarity(direct[index].text, direct[compare].text) < 0.2) {\n        return \"Evidence is mixed across stored facts; treat the hints below as partial and verify before answering definitively.\";\n      }\n    }\n  }\n  return null;\n}\n\nfunction formatEntityHintSection(\n  candidates: Array<{\n    candidate: EntityCandidate;\n    snippets: EntityHintSnippet[];\n    uncertainty: string | null;\n  }>,\n  queryTokens: string[],\n  mode: EntityQueryMode,\n  maxRelatedEntities: number,\n  maxChars: number,\n): string | null {\n  if (candidates.length === 0) return null;\n  const lines: string[] = [\"## entity_answer_hints\", \"\"];\n  for (const { candidate, snippets, uncertainty } of candidates) {\n    const hasSummary = Boolean(candidate.entry.summary?.trim());\n    const preferredTopSnippets = hasSummary\n      ? snippets.filter((snippet) => snippet.kind !== \"fact\")\n      : snippets;\n    let topSnippets = (\n      preferredTopSnippets.length > 0 ? preferredTopSnippets : snippets\n    ).slice(0, 3);\n    const buildTimelineSnippets = (seedExcludedTexts: Set<string>): EntityHintSnippet[] => {\n      const explicitTimelinePool = dedupeHintSnippetsByText(\n        (candidate.entry.timeline ?? [])\n          .slice()\n          .sort(sortTimelineEntriesDesc)\n          .map((entry) => sanitizeEntityFact(entry.text))\n          .filter(Boolean)\n          .map((text) => scoreHintSnippet({\n            text: compactLine(text, 180),\n            score: 7,\n            kind: \"activity\" as const,\n          }, queryTokens))\n          .filter((snippet): snippet is EntityHintSnippet => snippet !== null)\n          .filter((snippet) => !seedExcludedTexts.has(normalizeEntityText(snippet.text))),\n      ).slice(0, 2);\n      const activityTimelinePool = dedupeHintSnippetsByText(\n        snippets\n          .filter((snippet) => (\n            snippet.kind === \"activity\" || snippet.kind === \"memory\"\n          ) && !seedExcludedTexts.has(normalizeEntityText(snippet.text))),\n      ).slice(0, 2);\n      return explicitTimelinePool.length > 0\n        ? explicitTimelinePool\n        : activityTimelinePool.length > 0\n          ? activityTimelinePool\n          : dedupeHintSnippetsByText(\n            snippets\n              .filter((snippet) => (\n                snippet.kind === \"fact\" || snippet.kind === \"summary\"\n              ) && !seedExcludedTexts.has(normalizeEntityText(snippet.text))),\n          ).slice(0, 2);\n    };\n    const baseTopSnippetTexts = new Set(topSnippets.map((snippet) => normalizeEntityText(snippet.text)));\n    const timelinePool = mode !== \"direct\" ? buildTimelineSnippets(baseTopSnippetTexts) : [];\n    if (mode !== \"direct\" && hasSummary && topSnippets.length < 2) {\n      if (timelinePool.length > 0) {\n        topSnippets = [...topSnippets, timelinePool[0]!].slice(0, 3);\n      }\n    }\n    const topSnippetTexts = new Set(topSnippets.map((snippet) => normalizeEntityText(snippet.text)));\n    lines.push(`- target: ${candidate.entry.name} (${candidate.entry.type})`);\n    if (candidate.source === \"recent_turn\") {\n      lines.push(`- resolution: carried forward from recent turns via alias \"${candidate.alias}\"`);\n    } else {\n      lines.push(`- resolution: matched alias \"${candidate.alias}\" in the query`);\n    }\n    if (uncertainty) lines.push(`- uncertainty: ${uncertainty}`);\n    if (topSnippets.length > 0) {\n      lines.push(\"- likely answer:\");\n      for (const snippet of topSnippets) {\n        lines.push(`  - ${snippet.text}`);\n      }\n    }\n    if (mode !== \"direct\") {\n      const fallbackTimeline = timelinePool.filter(\n        (snippet) => !topSnippetTexts.has(normalizeEntityText(snippet.text)),\n      );\n      if (fallbackTimeline.length > 0) {\n        lines.push(\"- recent timeline:\");\n        for (const snippet of fallbackTimeline) {\n          lines.push(`  - ${snippet.text}`);\n        }\n      }\n    }\n    const related = candidate.entry.relationships.slice(0, maxRelatedEntities).map((relationship) => relationship.target);\n    if (related.length > 0) {\n      lines.push(`- related entities: ${related.join(\", \")}`);\n    }\n    lines.push(`- support counts: facts=${candidate.entry.factCount}, memories=${candidate.entry.memorySnippets.length}, native=${candidate.entry.nativeChunks.length}`);\n    lines.push(\"\");\n  }\n\n  let result = lines.join(\"\\n\");\n  if (result.length > maxChars) {\n    result = `${result.slice(0, Math.max(0, maxChars - 15)).trimEnd()}\\n\\n...(trimmed)\\n`;\n  }\n  return result.trim().length > 0 ? result.trimEnd() : null;\n}\n\nexport async function buildEntityRecallSection(options: BuildEntityRecallSectionOptions): Promise<string | null> {\n  const mode = detectEntityQueryMode(options.query);\n  if (!mode) return null;\n\n  const index = await buildEntityMentionIndex(options.storage, options.config, options.recallNamespaces);\n  if (index.entities.length === 0) return null;\n\n  const explicitCandidates = resolveExplicitCandidates(index, options.query);\n  const candidates = explicitCandidates.length > 0\n    ? explicitCandidates\n    : resolveRecentTurnCandidates(index, options.transcriptEntries, options.recentTurns);\n\n  if (candidates.length === 0) return null;\n\n  const queryTokens = tokenize(options.query);\n  const candidateLimit = explicitCandidates.length === 0 && mode === \"follow_up\"\n    ? 1\n    : options.maxHints;\n  const rankedCandidates = candidates.slice(0, candidateLimit);\n  const enriched = await Promise.all(\n    rankedCandidates.map(async (candidate) => {\n      const requestedSectionKeys = new Set(\n        resolveRequestedEntitySectionKeys(\n          options.query,\n          candidate.entry.type,\n          candidate.entry.structuredSections,\n          options.config.entitySchemas,\n        ),\n      );\n      const snippets = await buildHintSnippets(\n        candidate.entry,\n        queryTokens,\n        mode,\n        options.maxSupportingFacts,\n        requestedSectionKeys,\n      );\n      return {\n        candidate,\n        snippets,\n        uncertainty: summarizeUncertainty(snippets),\n      };\n    }),\n  );\n\n  const section = formatEntityHintSection(enriched, queryTokens, mode, options.maxRelatedEntities, options.maxChars);\n  if (!section) return null;\n  return section;\n}\n\nexport async function readRecentEntityTranscriptEntries(\n  transcriptEntriesPromise: Promise<TranscriptEntry[]>,\n  recentTurns: number,\n): Promise<TranscriptEntry[]> {\n  if (recentTurns <= 0) return [];\n  const transcriptEntries = await transcriptEntriesPromise.catch(() => []);\n  if (transcriptEntries.length === 0) return [];\n  return transcriptEntries.slice(-Math.max(1, recentTurns * 2));\n}\n\nexport const entityIndexVersion = ENTITY_INDEX_VERSION;\nexport const entityRecentTranscriptLookbackHours = RECENT_TRANSCRIPT_LOOKBACK_HOURS;\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAE3B,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AAMjB,IAAM,uBAAuB;AAC7B,IAAM,mCAAmC;AACzC,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB;AAC5B,IAAM,oBAAoB;AAkE1B,SAAS,SAAS,OAAyB;AACzC,SAAO,oBAAoB,KAAK,EAAE,MAAM,KAAK,EAAE,OAAO,CAAC,UAAU,MAAM,UAAU,CAAC;AACpF;AAEA,SAAS,cAAc,QAA4B;AACjD,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC,CAAC;AAC7F;AAEA,SAAS,eAAe,UAAkB,QAAyB;AACjE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,OAAO,QAAQ,uBAAuB,MAAM;AAC5D,SAAO,IAAI,OAAO,UAAU,OAAO,WAAW,GAAG,EAAE,KAAK,QAAQ;AAClE;AAEA,SAAS,YAAY,OAAe,YAAoB,KAAa;AACnE,QAAM,aAAa,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACnD,MAAI,WAAW,UAAU,UAAW,QAAO;AAC3C,SAAO,GAAG,WAAW,MAAM,GAAG,KAAK,IAAI,GAAG,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC;AACrE;AAEA,SAAS,yBAAyB,UAAoD;AACpF,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,SAA8B,CAAC;AACrC,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAM,oBAAoB,QAAQ,IAAI;AAC5C,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,WAAO,KAAK,OAAO;AAAA,EACrB;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgC,cAAyD;AAC7G,QAAM,kBAAkB,aAAa,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACrE,MAAI,gBAAgB,WAAW,EAAG,QAAO,GAAG,MAAM,IAAI,oBAAoB,aAAa,MAAM;AAC7F,SAAO,GAAG,MAAM,IAAI,IAAI,eAAe,IAAI,aAAa,MAAM;AAChE;AAEA,SAAS,sBAAsB,OAAuC;AACpE,QAAM,aAAa,oBAAoB,KAAK;AAC5C,MAAI,CAAC,WAAY,QAAO;AACxB,MACE,6KAA6K,KAAK,UAAU,GAC5L;AACA,WAAO;AAAA,EACT;AACA,MACE,2KAA2K,KAAK,UAAU,GAC1L;AACA,QAAI,eAAe,KAAK,UAAU,GAAG;AACnC,UAAI,2DAA2D,KAAK,UAAU,GAAG;AAC/E,eAAO;AAAA,MACT;AACA,UACE,2FAA2F,KAAK,UAAU,KACvG,oDAAoD,KAAK,UAAU,GACtE;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,qDAAqD,KAAK,UAAU,IAAI,aAAa;AAAA,EAC9F;AACA,MAAI,kBAAkB,KAAK,UAAU,KAAK,WAAW,MAAM,KAAK,EAAE,UAAU,GAAG;AAC7E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,OAAuB;AAC7D,QAAM,kBAAkB,oBAAoB,KAAK;AACjD,QAAM,kBAAkB,oBAAoB,KAAK;AACjD,MAAI,CAAC,gBAAiB,QAAO;AAC7B,MAAI,oBAAoB,gBAAiB,QAAO;AAChD,MAAI,eAAe,iBAAiB,eAAe,EAAG,QAAO,IAAI,KAAK,IAAI,gBAAgB,MAAM,KAAK,EAAE,QAAQ,CAAC;AAChH,QAAM,cAAc,IAAI,IAAI,SAAS,eAAe,CAAC;AACrD,QAAM,cAAc,SAAS,eAAe;AAC5C,MAAI,YAAY,WAAW,EAAG,QAAO;AACrC,QAAM,UAAU,YAAY,OAAO,CAAC,UAAU,YAAY,IAAI,KAAK,CAAC,EAAE;AACtE,MAAI,YAAY,EAAG,QAAO;AAgB1B,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,kBAAkB,YAAY;AAAA,MAClC,CAAC,UAAU,YAAY,IAAI,KAAK,KAAK,CAAC,kBAAkB,KAAK;AAAA,IAC/D,EAAE;AACF,QAAI,oBAAoB,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAYA,IAAM,qBAAqB,oBAAI,IAAY;AAAA,EACzC;AAAA,EAAU;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAC7C;AAAA,EAAW;AAAA,EAAY;AAAA,EAAS;AAAA,EAChC;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAgB;AAAA,EAAiB;AAAA,EAAW;AAAA,EAC3D;AAAA,EAAS;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAW;AAAA,EAC/C;AAAA,EAAU;AAAA,EAAW;AAAA,EAAS;AAAA,EAAU;AAAA,EAAO;AACjD,CAAC;AAED,SAAS,kBAAkB,OAAwB;AACjD,SAAO,mBAAmB,IAAI,KAAK;AACrC;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,oBAAoB,KAAK,KAAK,KAAK,oBAAoB,KAAK,KAAK;AAC1E;AAEA,SAAS,mBAAmB,MAAsB;AAChD,QAAM,YAAY,sBAAsB,IAAI;AAC5C,QAAM,QAAQ,UAAU,KAAK,KAAK;AAClC,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,oBAAoB,KAAK,KAAK,KAAK,MAAM,SAAS,IAAK,QAAO;AAClE,SAAO;AACT;AAEA,SAAS,iBAAiB,SAA4B,aAAiD;AACrG,QAAM,aAAa,oBAAoB,QAAQ,IAAI;AACnD,MAAI,CAAC,WAAY,QAAO;AACxB,QAAM,SAAS,EAAE,GAAG,QAAQ;AAC5B,MAAI,wBAAwB,OAAO,IAAI,KAAK,OAAO,SAAS,WAAW;AACrE,WAAO,SAAS;AAAA,EAClB;AACA,QAAM,UAAU,YAAY,OAAO,CAAC,UAAU,WAAW,SAAS,KAAK,CAAC,EAAE;AAC1E,SAAO,SAAS,UAAU;AAC1B,MAAI,oBAAoB,KAAK,OAAO,IAAI,EAAG,QAAO,SAAS;AAC3D,MAAI,OAAO,KAAK,UAAU,IAAK,QAAO,SAAS;AAC/C,SAAO,OAAO,QAAQ,IAAI,SAAS;AACrC;AAEA,SAAS,wBACP,MACA,OACQ;AACR,QAAM,iBAAiB,wBAAwB,MAAM,WAAW,KAAK,SAAS;AAC9E,MAAI,mBAAmB,GAAG;AACxB,WAAO;AAAA,EACT;AACA,SAAO,MAAM,KAAK,cAAc,KAAK,IAAI;AAC3C;AAEA,SAAS,kBAAkB,GAAW,GAAmB;AACvD,QAAM,UAAU,IAAI,IAAI,SAAS,CAAC,CAAC;AACnC,QAAM,UAAU,IAAI,IAAI,SAAS,CAAC,CAAC;AACnC,MAAI,QAAQ,SAAS,KAAK,QAAQ,SAAS,EAAG,QAAO;AACrD,MAAI,eAAe;AACnB,aAAW,SAAS,SAAS;AAC3B,QAAI,QAAQ,IAAI,KAAK,EAAG,iBAAgB;AAAA,EAC1C;AACA,QAAM,SAAQ,oBAAI,IAAI,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,GAAE;AAChD,SAAO,UAAU,IAAI,IAAI,eAAe;AAC1C;AAEA,SAAS,gBAAgB,SAA4E;AACnG,QAAM,QAAQ,oBAAI,IAAuC;AACzD,aAAW,SAAS,SAAS;AAC3B,UAAM,UAAU,cAAc,CAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,IAAI,mBAAmB,EAAE,OAAO,OAAO;AACrG,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,MAAM,IAAI,KAAK,KAAK,CAAC;AACtC,eAAS,KAAK,KAAK;AACnB,YAAM,IAAI,OAAO,QAAQ;AAAA,IAC3B;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,iBACb,QACA,kBACiC;AACjC,MAAI,CAAC,OAAO,iBAAiB,QAAS,QAAO,CAAC;AAC9C,SAAO,6BAA6B;AAAA,IAClC,cAAc,OAAO;AAAA,IACrB,WAAW,OAAO;AAAA,IAClB,QAAQ,OAAO;AAAA,IACf,kBAAkB,OAAO,oBAAoB,mBAAmB;AAAA,IAChE,kBAAkB,OAAO;AAAA,EAC3B,CAAC,EAAE,MAAM,MAAM,CAAC,CAAC;AACnB;AAEA,SAAS,qBAAqB,SAAiC;AAC7D,SAAO,KAAK,KAAK,QAAQ,KAAK,SAAS,2BAA2B;AACpE;AAEA,eAAe,qBAAqB,SAA6D;AAC/F,QAAM,MAAM,MAAM,SAAS,qBAAqB,OAAO,GAAG,OAAO,EAAE,MAAM,MAAM,EAAE;AACjF,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,YAAY,wBAAwB,CAAC,MAAM,QAAQ,OAAO,QAAQ,EAAG,QAAO;AACvF,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,sBAAsB,SAAyB,OAA0C;AACtG,QAAM,YAAY,qBAAqB,OAAO;AAC9C,QAAM,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,QAAM,cAAc,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI;AACrD,QAAM,iBAAiB,MAAM,SAAS,WAAW,OAAO,EAAE,MAAM,MAAM,EAAE;AACxE,MAAI,mBAAmB,YAAa;AACpC,QAAM,UAAU,WAAW,aAAa,OAAO;AACjD;AAEA,SAAS,wBAAwB,OAAqC;AACpE,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,MAAM,UAAU,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3F;AAEA,SAAS,wBAAwB,OAAsD;AACrF,QAAM,cAAc,wBAAwB,KAAK;AACjD,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,IACZ,SAAS,cAAc,MAAM,WAAW,CAAC,CAAC;AAAA,IAC1C,OAAO,CAAC;AAAA,IACR,oBAAoB,CAAC;AAAA,IACrB,eAAe,CAAC;AAAA,IAChB,UAAU,CAAC;AAAA,IACX,eAAe,CAAC;AAAA,IAChB,UAAU,CAAC;AAAA,IACX,WAAW;AAAA,IACX,gBAAgB,CAAC;AAAA,IACjB,cAAc;AAAA,MACZ;AAAA,QACE,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,QACb,YAAY,MAAM;AAAA,QAClB,YAAY,MAAM;AAAA,QAClB,SAAS,YAAY,MAAM,SAAS,GAAG;AAAA,QACvC,aAAa,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,OAAgC,OAAmC;AAC3F,QAAM,WAAW,MAAM,aAAa,KAAK,CAAC,SAAS,KAAK,YAAY,MAAM,OAAO;AACjF,MAAI,SAAU;AACd,QAAM,aAAa,KAAK;AAAA,IACtB,SAAS,MAAM;AAAA,IACf,OAAO,MAAM;AAAA,IACb,YAAY,MAAM;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,SAAS,YAAY,MAAM,SAAS,GAAG;AAAA,IACvC,aAAa,MAAM;AAAA,EACrB,CAAC;AACD,QAAM,UAAU,cAAc,CAAC,GAAG,MAAM,SAAS,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC;AAC5E;AAEA,eAAe,wBACb,SACA,QACA,kBAC6B;AAC7B,QAAM,CAAC,eAAe,aAAa,UAAU,YAAY,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC7E,qBAAqB,OAAO;AAAA,IAC5B,QAAQ,mBAAmB;AAAA,IAC3B,QAAQ,gBAAgB;AAAA,IACxB,iBAAiB,QAAQ,gBAAgB;AAAA,EAC3C,CAAC;AAED,QAAM,WAAW,oBAAI,IAAqC;AAC1D,aAAW,UAAU,aAAa;AAChC,UAAM,cAAc,oBAAoB,OAAO,MAAM,OAAO,IAAI;AAChE,UAAM,iBAAiB,OAAO,MAAM,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAChI,UAAM,yBAAyB,OAAO,SACnC,IAAI,CAAC,UAAU,mBAAmB,MAAM,IAAI,CAAC,EAC7C,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AACvC,aAAS,IAAI,aAAa;AAAA,MACxB;AAAA,MACA,MAAM,OAAO;AAAA,MACb,MAAM,OAAO;AAAA,MACb,SAAS,cAAc,OAAO,OAAO;AAAA,MACrC,SAAS,OAAO,WAAW,KAAK,KAAK,OAAO,SAAS,KAAK,KAAK;AAAA,MAC/D,OAAO;AAAA,MACP,eAAe,cAAc,sBAAsB;AAAA,MACnD,qBAAqB,OAAO,sBAAsB,CAAC,GAAG,IAAI,CAAC,aAAa;AAAA,QACtE,KAAK,QAAQ;AAAA,QACb,OAAO,QAAQ;AAAA,QACf,OAAO,QAAQ,MACZ,IAAI,CAAC,SAAS,mBAAmB,IAAI,CAAC,EACtC,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,YAAY,MAAM,GAAG,CAAC;AAAA,MACzC,EAAE,EAAE,OAAO,CAAC,YAAY,QAAQ,MAAM,SAAS,CAAC;AAAA,MAChD,UAAU,OAAO,SAAS,IAAI,CAAC,WAAW,EAAE,GAAG,MAAM,EAAE;AAAA,MACvD,eAAe,OAAO,cAAc,IAAI,CAAC,kBAAkB,EAAE,GAAG,aAAa,EAAE;AAAA,MAC/E,UAAU,OAAO,SAAS,IAAI,CAAC,cAAc,EAAE,GAAG,SAAS,EAAE;AAAA,MAC7D,WAAW,eAAe;AAAA,MAC1B,gBAAgB,CAAC;AAAA,MACjB,cAAc,CAAC;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,aAAW,UAAU,UAAU;AAC7B,UAAM,YAAY,OAAO,OAAO,YAAY,cAAc,WAAW,OAAO,YAAY,YAAY;AACpG,QAAI,CAAC,UAAW;AAChB,UAAM,QAAQ,SAAS,IAAI,SAAS;AACpC,QAAI,CAAC,MAAO;AACZ,UAAM,UAAU,MAAM,kBAAkB,MAAM;AAC9C,QAAI,CAAC,MAAM,eAAe,SAAS,OAAO,GAAG;AAC3C,YAAM,eAAe,KAAK,OAAO;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,aAAa,gBAAgB,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC;AACzD,aAAW,SAAS,cAAc;AAChC,UAAM,iBAAiB,SAAS,IAAI,wBAAwB,KAAK,CAAC;AAClE,QAAI,gBAAgB;AAClB,uBAAiB,gBAAgB,KAAK;AACtC;AAAA,IACF;AACA,UAAM,mBAAmB,cAAc,CAAC,MAAM,OAAO,GAAI,MAAM,WAAW,CAAC,CAAE,CAAC,EAAE,IAAI,mBAAmB,EAAE,OAAO,OAAO;AACvH,QAAI,UAAU;AACd,eAAW,SAAS,kBAAkB;AACpC,iBAAW,SAAS,WAAW,IAAI,KAAK,KAAK,CAAC,GAAG;AAC/C,yBAAiB,OAAO,KAAK;AAC7B,kBAAU;AAAA,MACZ;AAAA,IACF;AACA,QAAI,QAAS;AACb,UAAM,cAAc,wBAAwB,KAAK;AACjD,aAAS,IAAI,YAAY,aAAa,WAAW;AAAA,EACnD;AAEA,QAAM,iBAAiB,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC;AACvG,QAAM,mBAAmB,gBAAgB,KAAK,UAAU,cAAc,QAAQ,IAAI;AAClF,QAAM,eAAe,KAAK,UAAU,cAAc;AAClD,QAAM,QAA4B;AAAA,IAChC,SAAS;AAAA,IACT,WACE,iBAAiB,qBAAqB,eAClC,cAAc,aACd,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC7B,UAAU;AAAA,EACZ;AACA,QAAM,sBAAsB,SAAS,KAAK;AAC1C,SAAO;AACT;AAEA,SAAS,0BACP,OACA,OACmB;AACnB,QAAM,aAAgC,CAAC;AACvC,aAAW,SAAS,MAAM,UAAU;AAClC,UAAM,UAAU,cAAc,CAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;AAC5D,QAAI,YAAY;AAChB,QAAI,YAAY;AAChB,eAAW,SAAS,SAAS;AAC3B,YAAM,QAAQ,gBAAgB,OAAO,KAAK;AAC1C,UAAI,QAAQ,WAAW;AACrB,oBAAY;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,aAAa,EAAG;AACpB,eAAW,KAAK,EAAE,OAAO,OAAO,WAAW,OAAO,WAAW,QAAQ,QAAQ,CAAC;AAAA,EAChF;AACA,SAAO,WAAW,KAAK,CAAC,MAAM,UAAU,MAAM,QAAQ,KAAK,KAAK;AAClE;AAEA,SAAS,4BACP,OACA,mBACA,aACmB;AACnB,MAAI,eAAe,KAAK,kBAAkB,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,gBAAgB,kBAAkB,MAAM,CAAC,WAAW;AAC1D,QAAM,aAAa,oBAAI,IAA6B;AACpD,WAAS,cAAc,cAAc,SAAS,GAAG,eAAe,GAAG,eAAe,GAAG;AACnF,UAAM,OAAO,cAAc,WAAW;AACtC,UAAM,eAAe,cAAc,SAAS;AAC5C,UAAM,aAAa,KAAK,SAAS,SAAS,IAAI,KAAK,SAAS,cAAc,KAAK;AAC/E,eAAW,SAAS,MAAM,UAAU;AAClC,YAAM,UAAU,cAAc,CAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;AAC5D,iBAAW,SAAS,SAAS;AAC3B,cAAM,QAAQ,gBAAgB,KAAK,SAAS,KAAK;AACjD,YAAI,SAAS,EAAG;AAChB,cAAM,UAAU,WAAW,IAAI,MAAM,WAAW;AAChD,cAAM,gBAAgB,QAAQ,KAAK,IAAI,GAAG,IAAI,YAAY,IAAI;AAC9D,YAAI,CAAC,WAAW,gBAAgB,QAAQ,OAAO;AAC7C,qBAAW,IAAI,MAAM,aAAa;AAAA,YAChC;AAAA,YACA;AAAA,YACA,OAAO;AAAA,YACP,QAAQ;AAAA,UACV,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW,OAAO,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,MAAM,QAAQ,KAAK,KAAK;AAChF;AAEA,eAAe,kBAAkB,QAAqC;AACpE,QAAM,UAAU,OAAO,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACzD,SAAO,YAAY,SAAS,GAAG;AACjC;AAEA,eAAe,kBACb,OACA,aACA,MACA,oBACA,sBAC8B;AAC9B,QAAM,WAAgC,CAAC;AACvC,QAAM,cAAc,IAAI,IAAI,SAAS,cAAc,CAAC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;AAC7F,MAAI,MAAM,SAAS;AACjB,aAAS,KAAK,EAAE,MAAM,YAAY,MAAM,SAAS,GAAG,GAAG,OAAO,IAAI,MAAM,UAAU,CAAC;AAAA,EACrF;AAEA,MAAI,qBAAqB,OAAO,GAAG;AACjC,eAAW,WAAW,MAAM,oBAAoB;AAC9C,UAAI,CAAC,qBAAqB,IAAI,oBAAoB,QAAQ,GAAG,EAAE,QAAQ,QAAQ,GAAG,CAAC,EAAG;AACtF,iBAAW,QAAQ,QAAQ,OAAO;AAChC,iBAAS,KAAK,EAAE,MAAM,MAAM,OAAO,SAAS,WAAW,IAAI,GAAG,MAAM,UAAU,CAAC;AAAA,MACjF;AAAA,IACF;AAAA,EACF,OAAO;AACL,eAAW,QAAQ,MAAM,eAAe;AACtC,eAAS,KAAK,EAAE,MAAM,MAAM,OAAO,SAAS,WAAW,IAAI,GAAG,MAAM,OAAO,CAAC;AAAA,IAC9E;AACA,eAAW,WAAW,MAAM,oBAAoB;AAC9C,iBAAW,QAAQ,QAAQ,OAAO;AAChC,cAAM,iBAAiB,oBAAoB,IAAI;AAC/C,cAAM,0BAA0B,YAAY;AAAA,UAAK,CAAC,UAChD,CAAC,YAAY,IAAI,KAAK,KAAK,eAAe,SAAS,KAAK;AAAA,QAC1D;AACA,YAAI,MAAM,cAAc,SAAS,KAAK,CAAC,yBAAyB;AAC9D;AAAA,QACF;AACA,iBAAS,KAAK,EAAE,MAAM,MAAM,OAAO,SAAS,WAAW,IAAI,GAAG,MAAM,OAAO,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,QAAI,MAAM,cAAc,WAAW,KAAK,MAAM,mBAAmB,WAAW,GAAG;AAC7E,iBAAW,QAAQ,MAAM,OAAO;AAC9B,YAAI,CAAC,KAAK,KAAK,EAAG;AAClB,iBAAS,KAAK,EAAE,MAAM,MAAM,OAAO,SAAS,WAAW,IAAI,GAAG,MAAM,OAAO,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAEA,MAAI,qBAAqB,SAAS,GAAG;AACnC,eAAW,gBAAgB,MAAM,eAAe;AAC9C,eAAS,KAAK;AAAA,QACZ,MAAM,YAAY,aAAa,OAAO,YAAY,GAAG,GAAG;AAAA,QACxD,OAAO,SAAS,YAAY,MAAM,KAAK,YAAY,MAAM,WAAW,IAAI;AAAA,QACxE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,eAAW,YAAY,MAAM,UAAU;AACrC,eAAS,KAAK;AAAA,QACZ,MAAM,YAAY,GAAG,SAAS,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG;AAAA,QAC3D,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,eAAW,iBAAiB,MAAM,eAAe,MAAM,GAAG,KAAK,IAAI,oBAAoB,CAAC,CAAC,GAAG;AAC1F,eAAS,KAAK;AAAA,QACZ,MAAM;AAAA,QACN,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAEA,eAAW,SAAS,MAAM,cAAc;AACtC,eAAS,KAAK;AAAA,QACZ,MAAM,YAAY,MAAM,SAAS,GAAG;AAAA,QACpC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAU,oBAAI,IAA+B;AACnD,aAAW,WAAW,UAAU;AAC9B,UAAM,SAAS,iBAAiB,SAAS,WAAW;AACpD,QAAI,CAAC,OAAQ;AACb,UAAM,aAAa,oBAAoB,OAAO,IAAI;AAClD,UAAM,WAAW,QAAQ,IAAI,UAAU;AACvC,QAAI,CAAC,YAAY,OAAO,QAAQ,SAAS,MAAO,SAAQ,IAAI,YAAY,MAAM;AAAA,EAChF;AAEA,SAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,EACxB,OAAO,CAAC,YAAY,QAAQ,QAAQ,CAAC,EACrC,KAAK,CAAC,MAAM,UAAU,MAAM,QAAQ,KAAK,KAAK,EAC9C,MAAM,GAAG,kBAAkB;AAChC;AAEA,SAAS,qBAAqB,UAA8C;AAC1E,QAAM,SAAS,SAAS;AAAA,IAAO,CAAC,YAC9B,QAAQ,SAAS,aACd,QAAQ,SAAS,UACjB,QAAQ,SAAS,aACjB,QAAQ,SAAS;AAAA,EACtB;AACA,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACrD,aAAS,UAAU,QAAQ,GAAG,UAAU,OAAO,QAAQ,WAAW,GAAG;AACnE,UAAI,kBAAkB,OAAO,KAAK,EAAE,MAAM,OAAO,OAAO,EAAE,IAAI,IAAI,KAAK;AACrE,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,wBACP,YAKA,aACA,MACA,oBACA,UACe;AACf,MAAI,WAAW,WAAW,EAAG,QAAO;AACpC,QAAM,QAAkB,CAAC,0BAA0B,EAAE;AACrD,aAAW,EAAE,WAAW,UAAU,YAAY,KAAK,YAAY;AAC7D,UAAM,aAAa,QAAQ,UAAU,MAAM,SAAS,KAAK,CAAC;AAC1D,UAAM,uBAAuB,aACzB,SAAS,OAAO,CAAC,YAAY,QAAQ,SAAS,MAAM,IACpD;AACJ,QAAI,eACF,qBAAqB,SAAS,IAAI,uBAAuB,UACzD,MAAM,GAAG,CAAC;AACZ,UAAM,wBAAwB,CAAC,sBAAwD;AACrF,YAAM,uBAAuB;AAAA,SAC1B,UAAU,MAAM,YAAY,CAAC,GAC3B,MAAM,EACN,KAAK,uBAAuB,EAC5B,IAAI,CAAC,UAAU,mBAAmB,MAAM,IAAI,CAAC,EAC7C,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,iBAAiB;AAAA,UAC9B,MAAM,YAAY,MAAM,GAAG;AAAA,UAC3B,OAAO;AAAA,UACP,MAAM;AAAA,QACR,GAAG,WAAW,CAAC,EACd,OAAO,CAAC,YAA0C,YAAY,IAAI,EAClE,OAAO,CAAC,YAAY,CAAC,kBAAkB,IAAI,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,MAClF,EAAE,MAAM,GAAG,CAAC;AACZ,YAAM,uBAAuB;AAAA,QAC3B,SACG,OAAO,CAAC,aACP,QAAQ,SAAS,cAAc,QAAQ,SAAS,aAC7C,CAAC,kBAAkB,IAAI,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,MAClE,EAAE,MAAM,GAAG,CAAC;AACZ,aAAO,qBAAqB,SAAS,IACjC,uBACA,qBAAqB,SAAS,IAC5B,uBACA;AAAA,QACA,SACG,OAAO,CAAC,aACP,QAAQ,SAAS,UAAU,QAAQ,SAAS,cACzC,CAAC,kBAAkB,IAAI,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,MAClE,EAAE,MAAM,GAAG,CAAC;AAAA,IAClB;AACA,UAAM,sBAAsB,IAAI,IAAI,YAAY,IAAI,CAAC,YAAY,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AACnG,UAAM,eAAe,SAAS,WAAW,sBAAsB,mBAAmB,IAAI,CAAC;AACvF,QAAI,SAAS,YAAY,cAAc,YAAY,SAAS,GAAG;AAC7D,UAAI,aAAa,SAAS,GAAG;AAC3B,sBAAc,CAAC,GAAG,aAAa,aAAa,CAAC,CAAE,EAAE,MAAM,GAAG,CAAC;AAAA,MAC7D;AAAA,IACF;AACA,UAAM,kBAAkB,IAAI,IAAI,YAAY,IAAI,CAAC,YAAY,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAC/F,UAAM,KAAK,aAAa,UAAU,MAAM,IAAI,KAAK,UAAU,MAAM,IAAI,GAAG;AACxE,QAAI,UAAU,WAAW,eAAe;AACtC,YAAM,KAAK,8DAA8D,UAAU,KAAK,GAAG;AAAA,IAC7F,OAAO;AACL,YAAM,KAAK,gCAAgC,UAAU,KAAK,gBAAgB;AAAA,IAC5E;AACA,QAAI,YAAa,OAAM,KAAK,kBAAkB,WAAW,EAAE;AAC3D,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,KAAK,kBAAkB;AAC7B,iBAAW,WAAW,aAAa;AACjC,cAAM,KAAK,OAAO,QAAQ,IAAI,EAAE;AAAA,MAClC;AAAA,IACF;AACA,QAAI,SAAS,UAAU;AACrB,YAAM,mBAAmB,aAAa;AAAA,QACpC,CAAC,YAAY,CAAC,gBAAgB,IAAI,oBAAoB,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,UAAI,iBAAiB,SAAS,GAAG;AAC/B,cAAM,KAAK,oBAAoB;AAC/B,mBAAW,WAAW,kBAAkB;AACtC,gBAAM,KAAK,OAAO,QAAQ,IAAI,EAAE;AAAA,QAClC;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,UAAU,MAAM,cAAc,MAAM,GAAG,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,aAAa,MAAM;AACpH,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,KAAK,uBAAuB,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,IACxD;AACA,UAAM,KAAK,2BAA2B,UAAU,MAAM,SAAS,cAAc,UAAU,MAAM,eAAe,MAAM,YAAY,UAAU,MAAM,aAAa,MAAM,EAAE;AACnK,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,MAAI,SAAS,MAAM,KAAK,IAAI;AAC5B,MAAI,OAAO,SAAS,UAAU;AAC5B,aAAS,GAAG,OAAO,MAAM,GAAG,KAAK,IAAI,GAAG,WAAW,EAAE,CAAC,EAAE,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,EACnE;AACA,SAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,QAAQ,IAAI;AACvD;AAEA,eAAsB,yBAAyB,SAAkE;AAC/G,QAAM,OAAO,sBAAsB,QAAQ,KAAK;AAChD,MAAI,CAAC,KAAM,QAAO;AAElB,QAAM,QAAQ,MAAM,wBAAwB,QAAQ,SAAS,QAAQ,QAAQ,QAAQ,gBAAgB;AACrG,MAAI,MAAM,SAAS,WAAW,EAAG,QAAO;AAExC,QAAM,qBAAqB,0BAA0B,OAAO,QAAQ,KAAK;AACzE,QAAM,aAAa,mBAAmB,SAAS,IAC3C,qBACA,4BAA4B,OAAO,QAAQ,mBAAmB,QAAQ,WAAW;AAErF,MAAI,WAAW,WAAW,EAAG,QAAO;AAEpC,QAAM,cAAc,SAAS,QAAQ,KAAK;AAC1C,QAAM,iBAAiB,mBAAmB,WAAW,KAAK,SAAS,cAC/D,IACA,QAAQ;AACZ,QAAM,mBAAmB,WAAW,MAAM,GAAG,cAAc;AAC3D,QAAM,WAAW,MAAM,QAAQ;AAAA,IAC7B,iBAAiB,IAAI,OAAO,cAAc;AACxC,YAAM,uBAAuB,IAAI;AAAA,QAC/B;AAAA,UACE,QAAQ;AAAA,UACR,UAAU,MAAM;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF;AACA,YAAM,WAAW,MAAM;AAAA,QACrB,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,QACR;AAAA,MACF;AACA,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,aAAa,qBAAqB,QAAQ;AAAA,MAC5C;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,wBAAwB,UAAU,aAAa,MAAM,QAAQ,oBAAoB,QAAQ,QAAQ;AACjH,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO;AACT;AAEA,eAAsB,kCACpB,0BACA,aAC4B;AAC5B,MAAI,eAAe,EAAG,QAAO,CAAC;AAC9B,QAAM,oBAAoB,MAAM,yBAAyB,MAAM,MAAM,CAAC,CAAC;AACvE,MAAI,kBAAkB,WAAW,EAAG,QAAO,CAAC;AAC5C,SAAO,kBAAkB,MAAM,CAAC,KAAK,IAAI,GAAG,cAAc,CAAC,CAAC;AAC9D;AAEO,IAAM,qBAAqB;AAC3B,IAAM,sCAAsC;","names":[]}

package/dist/chunk-YNJHCGDT.js

@@ -0,0 +1,309 @@
+import {
+  generateSalt,
+  open,
+  seal
+} from "./chunk-A6XUJE5D.js";
+
+// src/secure-store/secure-fs.ts
+import { lstat, mkdir, readFile, readdir, rename, unlink, writeFile } from "fs/promises";
+import path from "path";
+var SecureStoreLockedError = class extends Error {
+  constructor(message = "secure-store is locked \u2014 run `remnic secure-store unlock` to decrypt") {
+    super(message);
+    this.name = "SecureStoreLockedError";
+  }
+};
+var SecureStoreDecryptError = class extends Error {
+  constructor(message = "secure-store decryption failed \u2014 wrong key or tampered ciphertext") {
+    super(message);
+    this.name = "SecureStoreDecryptError";
+  }
+};
+var MAGIC_BYTES = Buffer.from("REMNIC-ENC", "ascii");
+var FILE_FORMAT_VERSION = 1;
+var FILE_FORMAT_FLAGS = 0;
+var MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2;
+function isEncryptedFile(buf) {
+  if (buf.length < MAGIC_HEADER_SIZE) return false;
+  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);
+  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);
+}
+function encryptFileBody(plain, key, aad) {
+  const plainBuf = typeof plain === "string" ? Buffer.from(plain, "utf8") : plain;
+  const salt = generateSalt();
+  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});
+  const header = Buffer.alloc(MAGIC_HEADER_SIZE);
+  MAGIC_BYTES.copy(header, 0);
+  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);
+  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);
+  return Buffer.concat([header, envelope]);
+}
+function decryptFileBody(buf, key, aad) {
+  if (!isEncryptedFile(buf)) {
+    throw new Error("decryptFileBody: buffer does not start with REMNIC-ENC magic header");
+  }
+  const version = buf.readUInt8(MAGIC_BYTES.length);
+  if (version !== FILE_FORMAT_VERSION) {
+    throw new Error(
+      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`
+    );
+  }
+  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);
+  if (flags !== FILE_FORMAT_FLAGS) {
+    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, "0")}`);
+  }
+  const envelope = buf.subarray(MAGIC_HEADER_SIZE);
+  try {
+    return open(key, envelope, aad ? { aad } : {});
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new SecureStoreDecryptError(
+      `secure-store decryption failed: ${msg}`
+    );
+  }
+}
+function filePathAad(filePath, memoryDir) {
+  let rel = filePath;
+  if (memoryDir && path.isAbsolute(filePath)) {
+    rel = path.relative(memoryDir, filePath);
+  }
+  return Buffer.from(rel, "utf8");
+}
+async function readMaybeEncryptedFile(filePath, key, memoryDir) {
+  const buf = await readFile(filePath);
+  if (!isEncryptedFile(buf)) {
+    return buf.toString("utf8");
+  }
+  if (key === null) {
+    throw new SecureStoreLockedError(
+      `secure-store is locked \u2014 cannot read encrypted file at ${filePath}. Run \`remnic secure-store unlock\` to decrypt.`
+    );
+  }
+  const aad = filePathAad(filePath, memoryDir);
+  const plain = decryptFileBody(buf, key, aad);
+  return plain.toString("utf8");
+}
+async function writeMaybeEncryptedFile(filePath, content, key, options = {}, memoryDir) {
+  const { mode = 384, atomic = true } = options;
+  await mkdir(path.dirname(filePath), { recursive: true });
+  let data;
+  if (key !== null) {
+    const aad = filePathAad(filePath, memoryDir);
+    data = encryptFileBody(content, key, aad);
+  } else {
+    data = content;
+  }
+  if (atomic) {
+    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    try {
+      await writeFile(tempPath, data, { mode });
+      await rename(tempPath, filePath);
+    } catch (err) {
+      try {
+        await unlink(tempPath);
+      } catch {
+      }
+      throw err;
+    }
+  } else {
+    await writeFile(filePath, data, { mode });
+  }
+}
+async function migrateMemoryDirToEncrypted(dir, key, onBeforeEncrypt) {
+  const result = { encrypted: 0, skipped: 0, errors: [] };
+  const files = await collectEncryptableStorageFiles(dir);
+  for (const filePath of files) {
+    try {
+      const buf = await readFile(filePath);
+      if (isEncryptedFile(buf)) {
+        result.skipped++;
+        continue;
+      }
+      if (onBeforeEncrypt) {
+        try {
+          await onBeforeEncrypt(filePath);
+        } catch {
+        }
+      }
+      const content = buf.toString("utf8");
+      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));
+      const encrypted = encryptFileBody(content, key, aad);
+      const tempPath = `${filePath}.enc-tmp-${process.pid}-${Date.now()}`;
+      try {
+        await writeFile(tempPath, encrypted, { mode: 384 });
+        await rename(tempPath, filePath);
+        result.encrypted++;
+      } catch (writeErr) {
+        try {
+          const { unlink: unlink2 } = await import("fs/promises");
+          await unlink2(tempPath);
+        } catch {
+        }
+        throw writeErr;
+      }
+    } catch (err) {
+      result.errors.push({
+        filePath,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return result;
+}
+async function decryptMemoryDirToPlaintext(dir, key) {
+  const result = { decrypted: 0, skipped: 0, errors: [] };
+  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);
+  for (const filePath of files) {
+    try {
+      const buf = await readFile(filePath);
+      if (!isEncryptedFile(buf)) {
+        result.skipped++;
+        continue;
+      }
+      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));
+      const plaintext = decryptFileBody(buf, key, aad);
+      const tempPath = `${filePath}.dec-tmp-${process.pid}-${Date.now()}`;
+      try {
+        await writeFile(tempPath, plaintext, { mode: 384 });
+        await rename(tempPath, filePath);
+        result.decrypted++;
+      } catch (writeErr) {
+        try {
+          await unlink(tempPath);
+        } catch {
+        }
+        throw writeErr;
+      }
+    } catch (err) {
+      result.errors.push({
+        filePath,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  return result;
+}
+async function collectEncryptableStorageFiles(dir, rootDir = dir) {
+  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);
+}
+async function collectStorageManagedFiles(dir, includeFile, rootDir = dir) {
+  const results = [];
+  let names;
+  try {
+    names = await readdir(dir, { encoding: "utf8" });
+  } catch {
+    return results;
+  }
+  for (const name of names) {
+    if (name.startsWith(".secure-store")) continue;
+    const full = path.join(dir, name);
+    let isDir = false;
+    let isFile = false;
+    try {
+      const s = await lstat(full);
+      if (s.isSymbolicLink()) continue;
+      isDir = s.isDirectory();
+      isFile = s.isFile();
+    } catch {
+      continue;
+    }
+    if (isDir) {
+      const sub = await collectStorageManagedFiles(full, includeFile, rootDir);
+      results.push(...sub);
+    } else if (isFile && includeFile(full, rootDir)) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+function isEncryptableStoragePath(filePath, rootDir) {
+  const rel = path.relative(rootDir, filePath);
+  if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) return false;
+  const normalized = normalizeStorageRelativePath(rel);
+  if (normalized === "profile.md") return true;
+  if (isEncryptableStateSidecar(normalized)) return true;
+  if (isEncryptableSummarySidecar(normalized)) return true;
+  const firstSegment = normalized.split("/", 1)[0];
+  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(".md");
+}
+function isDecryptableStoragePath(filePath, rootDir) {
+  if (isEncryptableStoragePath(filePath, rootDir)) return true;
+  const rel = path.relative(rootDir, filePath);
+  if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) return false;
+  const normalized = normalizeStorageRelativePath(rel);
+  const firstSegment = normalized.split("/", 1)[0];
+  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);
+}
+function normalizeStorageRelativePath(rel) {
+  const normalized = rel.split(path.sep).join("/");
+  const parts = normalized.split("/");
+  if (parts[0] === "namespaces" && parts.length >= 3) {
+    return parts.slice(2).join("/");
+  }
+  return normalized;
+}
+function storageAadRootForFile(filePath, rootDir) {
+  const rel = path.relative(rootDir, filePath);
+  if (rel === "" || rel.startsWith("..") || path.isAbsolute(rel)) return rootDir;
+  const parts = rel.split(path.sep);
+  if (parts[0] === "namespaces" && parts.length >= 3 && parts[1]) {
+    return path.join(rootDir, "namespaces", parts[1]);
+  }
+  return rootDir;
+}
+var ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = /* @__PURE__ */ new Set([
+  "facts",
+  "corrections",
+  "procedures",
+  "reasoning-traces",
+  "artifacts",
+  "archive",
+  "entities",
+  "identity"
+]);
+var ENCRYPTABLE_STATE_SIDECARS = /* @__PURE__ */ new Set([
+  "state/behavior-signals.jsonl",
+  "state/buffer-surprise-ledger.jsonl",
+  "state/buffer.json",
+  "state/compression-guideline-draft-state.json",
+  "state/compression-guideline-state.json",
+  "state/compression-guidelines.draft.md",
+  "state/compression-guidelines.md",
+  "state/entity-synthesis-queue.json",
+  "state/fact-hashes.txt",
+  "state/memory-actions.jsonl",
+  "state/memory-lifecycle-ledger.jsonl",
+  "state/meta.json",
+  "state/reextract-jobs.jsonl",
+  "state/topics.json"
+]);
+function isEncryptableStateSidecar(normalized) {
+  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);
+}
+function isEncryptableSummarySidecar(normalized) {
+  return normalized.startsWith("summaries/") && normalized.endsWith(".json");
+}
+var DECRYPTABLE_SIDECAR_ROOTS = /* @__PURE__ */ new Set([
+  "state",
+  "indexes",
+  "index",
+  "provenance"
+]);
+
+export {
+  SecureStoreLockedError,
+  SecureStoreDecryptError,
+  MAGIC_BYTES,
+  FILE_FORMAT_VERSION,
+  FILE_FORMAT_FLAGS,
+  MAGIC_HEADER_SIZE,
+  isEncryptedFile,
+  encryptFileBody,
+  decryptFileBody,
+  filePathAad,
+  readMaybeEncryptedFile,
+  writeMaybeEncryptedFile,
+  migrateMemoryDirToEncrypted,
+  decryptMemoryDirToPlaintext
+};
+//# sourceMappingURL=chunk-YNJHCGDT.js.map

package/dist/chunk-YNJHCGDT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { lstat, mkdir, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { generateSalt, open, seal } from \"./cipher.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`,\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  try {\n    return open(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(\n      `secure-store decryption failed: ${msg}`,\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<string> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain UTF-8 file — legacy or unencrypted store.\n    return buf.toString(\"utf8\");\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. ` +\n        \"Run `remnic secure-store unlock` to decrypt.\",\n    );\n  }\n  const aad = filePathAad(filePath, memoryDir);\n  const plain = decryptFileBody(buf, key, aad);\n  return plain.toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a `.tmp-<pid>-<ts>` file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>,\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = `${filePath}.enc-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(\n  dir: string,\n  key: Buffer,\n): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const plaintext = decryptFileBody(buf, key, aad);\n      const tempPath = `${filePath}.dec-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir,\n): Promise<string[]> {\n  const results: string[] = [];\n  let names: string[];\n  try {\n    names = await readdir(dir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(dir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, rootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, rootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\nfunction storageAadRootForFile(filePath: string, rootDir: string): string {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return rootDir;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(rootDir, \"namespaces\", parts[1]);\n  }\n  return rootDir;\n}\n\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set([\n  \"facts\",\n  \"corrections\",\n  \"procedures\",\n  \"reasoning-traces\",\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\n  \"state\",\n  \"indexes\",\n  \"index\",\n  \"provenance\",\n]);\n"],"mappings":";;;;;;;AA6CA,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC3E,OAAO,UAAU;AAaV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAU/C,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,MAAI;AACF,WAAO,KAAK,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG;AAAA,IACxC;AAAA,EACF;AACF;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO,IAAI,SAAS,MAAM;AAAA,EAC5B;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IAEpE;AAAA,EACF;AACA,QAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,QAAM,QAAQ,gBAAgB,KAAK,KAAK,GAAG;AAC3C,SAAO,MAAM,SAAS,MAAM;AAC9B;AAyBA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC7D,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAA,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BACpB,KACA,KACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,KAAK,KAAK,GAAG;AAC/C,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAWA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,EAAE,UAAU,OAAO,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,KAAK,IAAI;AAChC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,OAAO;AACvE,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,OAAO,GAAG;AAC/C,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,SAAyB;AACxE,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,SAAS,cAAc,MAAM,CAAC,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":["unlink"]}