@remnic/core 1.1.31 → 9.3.515

package/dist/{chunk-3KW65B36.js → chunk-KILOTVIF.js}

@@ -229,17 +229,69 @@ function parseJsonObject(value) {
     return void 0;
   }
 }
+function resolveMemoryDirRoot(memoryDir) {
+  try {
+    return fs.realpathSync(memoryDir);
+  } catch {
+    return path.resolve(memoryDir);
+  }
+}
+function isPathInsideRoot(candidatePath, rootPath) {
+  const relative = path.relative(rootPath, candidatePath);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function resolveProjectedMemoryPath(memoryDir, pathRel) {
+  if (path.isAbsolute(pathRel)) return null;
+  const root = resolveMemoryDirRoot(memoryDir);
+  const candidate = path.resolve(root, pathRel);
+  if (!isPathInsideRoot(candidate, root)) return null;
+  try {
+    const realCandidate = fs.realpathSync(candidate);
+    if (!isPathInsideRoot(realCandidate, root)) return null;
+  } catch {
+  }
+  return candidate;
+}
+function projectedBrowseRowFromCurrentRow(memoryDir, row) {
+  if (typeof row.memory_id !== "string" || typeof row.path_rel !== "string" || typeof row.category !== "string" || typeof row.status !== "string") {
+    return null;
+  }
+  const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);
+  if (!filePath) return null;
+  return {
+    id: row.memory_id,
+    path: filePath,
+    category: row.category,
+    status: row.status,
+    created: typeof row.created_at === "string" ? row.created_at : void 0,
+    updated: typeof row.updated_at === "string" ? row.updated_at : void 0,
+    tags: parseStringArray(row.tags_json),
+    entityRef: typeof row.entity_ref === "string" ? row.entity_ref : void 0,
+    preview: typeof row.preview_text === "string" ? row.preview_text : ""
+  };
+}
+function projectedBrowsePathSqlClauses() {
+  return [
+    "path_rel <> ''",
+    "path_rel NOT LIKE '/%'",
+    "path_rel <> '..'",
+    "path_rel NOT LIKE '../%'",
+    "path_rel NOT LIKE '%/../%'"
+  ];
+}
 function parseCurrentRow(memoryDir, row) {
   if (!row) return null;
   if (typeof row.memory_id !== "string" || typeof row.category !== "string" || typeof row.status !== "string" || typeof row.path_rel !== "string" || typeof row.created_at !== "string" || typeof row.updated_at !== "string" || typeof row.source !== "string" || typeof row.confidence !== "number" || typeof row.confidence_tier !== "string") {
     return null;
   }
+  const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);
+  if (!filePath) return null;
   return {
     memoryId: row.memory_id,
     category: row.category,
     status: row.status,
     lifecycleState: typeof row.lifecycle_state === "string" ? row.lifecycle_state : void 0,
-    path: path.join(memoryDir, row.path_rel),
+    path: filePath,
     pathRel: row.path_rel,
     created: row.created_at,
     updated: row.updated_at,
@@ -392,6 +444,8 @@ function readProjectedMemoryBrowse(memoryDir, options) {
         `).all(...params);
       const filtered = allRows.filter((row) => {
         if (typeof row.memory_id !== "string" || typeof row.path_rel !== "string") return false;
+        const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);
+        if (!filePath) return false;
         const preview = typeof row.preview_text === "string" ? row.preview_text.toLowerCase() : "";
         const category = typeof row.category === "string" ? row.category.toLowerCase() : "";
         const entityRef = typeof row.entity_ref === "string" ? row.entity_ref.toLowerCase() : "";
@@ -400,63 +454,56 @@ function readProjectedMemoryBrowse(memoryDir, options) {
           return true;
         }
         try {
-          const filePath = path.join(memoryDir, row.path_rel);
           const content = fs.readFileSync(filePath, "utf-8").toLowerCase();
           return content.includes(normalizedQuery);
         } catch {
           return false;
         }
       });
-      const pageRows = filtered.slice(options.offset, options.offset + options.limit);
+      const pageRows2 = filtered.slice(options.offset, options.offset + options.limit);
       return {
         total: filtered.length,
-        memories: pageRows.filter(
-          (row) => typeof row.memory_id === "string" && typeof row.path_rel === "string" && typeof row.category === "string" && typeof row.status === "string"
-        ).map((row) => ({
-          id: row.memory_id,
-          path: path.join(memoryDir, row.path_rel),
-          category: row.category,
-          status: row.status,
-          created: typeof row.created_at === "string" ? row.created_at : void 0,
-          updated: typeof row.updated_at === "string" ? row.updated_at : void 0,
-          tags: parseStringArray(row.tags_json),
-          entityRef: typeof row.entity_ref === "string" ? row.entity_ref : void 0,
-          preview: typeof row.preview_text === "string" ? row.preview_text : ""
-        }))
+        memories: pageRows2.map((row) => projectedBrowseRowFromCurrentRow(memoryDir, row)).filter((row) => row !== null)
       };
     }
-    const totalRow = db.prepare(`SELECT COUNT(*) AS total FROM memory_current ${whereSql}`).get(...params);
-    const rows = db.prepare(`
-        SELECT
-          memory_id,
-          path_rel,
-          category,
-          status,
-          created_at,
-          updated_at,
-          entity_ref,
-          ${currentSelect.tagsJson},
-          ${currentSelect.previewText}
-        FROM memory_current
-        ${whereSql}
-        ORDER BY ${orderBySql}
-        LIMIT ? OFFSET ?
-      `).all(...params, options.limit, options.offset);
+    const browseWhereClauses = [...whereClauses, ...projectedBrowsePathSqlClauses()];
+    const browseWhereSql = `WHERE ${browseWhereClauses.join(" AND ")}`;
+    const pageRows = [];
+    const fetchSize = Math.max(options.limit * 2, 50);
+    let validRowsSeen = 0;
+    let scanOffset = 0;
+    while (true) {
+      const rows = db.prepare(`
+          SELECT
+            memory_id,
+            path_rel,
+            category,
+            status,
+            created_at,
+            updated_at,
+            entity_ref,
+            ${currentSelect.tagsJson},
+            ${currentSelect.previewText}
+          FROM memory_current
+          ${browseWhereSql}
+          ORDER BY ${orderBySql}
+          LIMIT ? OFFSET ?
+        `).all(...params, fetchSize, scanOffset);
+      if (rows.length === 0) break;
+      scanOffset += rows.length;
+      for (const row of rows) {
+        const browseRow = projectedBrowseRowFromCurrentRow(memoryDir, row);
+        if (!browseRow) continue;
+        if (validRowsSeen >= options.offset && pageRows.length < options.limit) {
+          pageRows.push(browseRow);
+        }
+        validRowsSeen += 1;
+      }
+      if (rows.length < fetchSize) break;
+    }
     return {
-      total: typeof totalRow?.total === "number" ? totalRow.total : 0,
-      memories: rows.filter(
-        (row) => typeof row.memory_id === "string" && typeof row.path_rel === "string" && typeof row.category === "string" && typeof row.status === "string"
-      ).map((row) => ({
-        id: row.memory_id,
-        path: path.join(memoryDir, row.path_rel),
-        category: row.category,
-        status: row.status,
-        created: typeof row.created_at === "string" ? row.created_at : void 0,
-        updated: typeof row.updated_at === "string" ? row.updated_at : void 0,
-        tags: parseStringArray(row.tags_json),
-        entityRef: typeof row.entity_ref === "string" ? row.entity_ref : void 0,
-        preview: typeof row.preview_text === "string" ? row.preview_text : ""
-      }))
+      total: validRowsSeen,
+      memories: pageRows
     };
   });
 }
@@ -678,4 +725,4 @@ export {
   readProjectedLatestReviewQueue,
   readProjectedGovernanceRecord
 };
-//# sourceMappingURL=chunk-3KW65B36.js.map
+//# sourceMappingURL=chunk-KILOTVIF.js.map

package/dist/chunk-KILOTVIF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/memory-projection-store.ts"],"sourcesContent":["import path from \"node:path\";\nimport fs from \"node:fs\";\nimport type {\n  MemoryGovernanceAppliedAction,\n  MemoryGovernanceMetrics,\n  MemoryGovernanceReviewQueueEntry,\n  MemoryGovernanceSummary,\n} from \"./maintenance/memory-governance.js\";\nimport type {\n  MemoryCategory,\n  MemoryLifecycleEvent,\n  MemoryProjectionCurrentState,\n  MemoryStatus,\n} from \"./types.js\";\nimport {\n  openBetterSqlite3,\n  type BetterSqlite3Database,\n} from \"./runtime/better-sqlite.js\";\n\nexport const MEMORY_PROJECTION_SCHEMA_VERSION = 2;\n\nexport interface ProjectedMemoryBrowseOptions {\n  query?: string;\n  status?: string;\n  category?: string;\n  sort?: \"updated_desc\" | \"updated_asc\" | \"created_desc\" | \"created_asc\";\n  limit: number;\n  offset: number;\n}\n\nexport interface ProjectedMemoryBrowseRow {\n  id: string;\n  path: string;\n  category: MemoryCategory;\n  status: MemoryStatus;\n  created?: string;\n  updated?: string;\n  tags: string[];\n  entityRef?: string;\n  preview: string;\n}\n\nexport interface ProjectedMemoryBrowsePage {\n  total: number;\n  memories: ProjectedMemoryBrowseRow[];\n}\n\nexport interface ProjectedEntityMentionRow {\n  memoryId: string;\n  entityRef: string;\n  mentionSource: string;\n  created: string;\n  updated: string;\n}\n\nexport interface ProjectedNativeKnowledgeChunkRow {\n  chunkId: string;\n  sourcePath: string;\n  title: string;\n  sourceKind: string;\n  startLine: number;\n  endLine: number;\n  derivedDate?: string;\n  sessionKey?: string;\n  workflowKey?: string;\n  author?: string;\n  agent?: string;\n  namespace?: string;\n  privacyClass?: string;\n  sourceHash?: string;\n  preview: string;\n}\n\nexport interface MemoryProjectionGovernanceReviewQueueRow {\n  runId: string;\n  entryId: string;\n  memoryId: string;\n  path: string;\n  reasonCode: MemoryGovernanceReviewQueueEntry[\"reasonCode\"];\n  severity: MemoryGovernanceReviewQueueEntry[\"severity\"];\n  suggestedAction: MemoryGovernanceReviewQueueEntry[\"suggestedAction\"];\n  suggestedStatus?: MemoryGovernanceReviewQueueEntry[\"suggestedStatus\"];\n  relatedMemoryIds: string[];\n}\n\nexport interface MemoryProjectionGovernanceAppliedActionRow {\n  runId: string;\n  rowKey: string;\n  action: MemoryGovernanceAppliedAction[\"action\"];\n  memoryId: string;\n  reasonCode: MemoryGovernanceAppliedAction[\"reasonCode\"];\n  beforeStatus: MemoryGovernanceAppliedAction[\"beforeStatus\"];\n  afterStatus?: MemoryGovernanceAppliedAction[\"afterStatus\"];\n  originalPath: string;\n  currentPath: string;\n}\n\nexport interface ProjectedReviewQueueSnapshot {\n  found: boolean;\n  runId?: string;\n  summary?: MemoryGovernanceSummary;\n  metrics?: MemoryGovernanceMetrics;\n  reviewQueue?: MemoryGovernanceReviewQueueEntry[];\n  appliedActions?: MemoryGovernanceAppliedAction[];\n  report?: string;\n}\n\nexport function getMemoryProjectionPath(memoryDir: string): string {\n  return path.join(memoryDir, \"state\", \"memory-projection.sqlite\");\n}\n\nfunction listTableColumns(db: BetterSqlite3Database, tableName: string): Set<string> {\n  try {\n    const rows = db.prepare(`PRAGMA table_info(${tableName})`).all() as Array<{ name?: unknown }>;\n    return new Set(rows.map((row) => row.name).filter((name): name is string => typeof name === \"string\"));\n  } catch {\n    return new Set<string>();\n  }\n}\n\nfunction migrateMemoryCurrentTable(db: BetterSqlite3Database): void {\n  const columns = listTableColumns(db, \"memory_current\");\n  if (columns.size === 0) return;\n\n  if (!columns.has(\"tags_json\")) {\n    db.exec(`ALTER TABLE memory_current ADD COLUMN tags_json TEXT NOT NULL DEFAULT '[]'`);\n  }\n  if (!columns.has(\"preview_text\")) {\n    db.exec(`ALTER TABLE memory_current ADD COLUMN preview_text TEXT NOT NULL DEFAULT ''`);\n  }\n}\n\nfunction memoryCurrentRequiresMigration(db: BetterSqlite3Database): boolean {\n  const columns = listTableColumns(db, \"memory_current\");\n  return columns.size > 0 && (!columns.has(\"tags_json\") || !columns.has(\"preview_text\"));\n}\n\nfunction migrateProjectionSchemaIfNeeded(memoryDir: string): void {\n  const dbPath = getMemoryProjectionPath(memoryDir);\n  try {\n    const db = openBetterSqlite3(dbPath, { fileMustExist: true });\n    try {\n      if (!memoryCurrentRequiresMigration(db)) return;\n      initializeMemoryProjectionDb(db);\n    } finally {\n      db.close();\n    }\n  } catch {\n    // Fail open on migration attempts so readonly consumers can still use legacy rows.\n  }\n}\n\nexport function memoryCurrentSelectExpressions(db: BetterSqlite3Database): {\n  tagsJson: string;\n  previewText: string;\n} {\n  const columns = listTableColumns(db, \"memory_current\");\n  return {\n    tagsJson: columns.has(\"tags_json\") ? \"tags_json\" : `'[]' AS tags_json`,\n    previewText: columns.has(\"preview_text\") ? \"preview_text\" : `'' AS preview_text`,\n  };\n}\n\nexport function initializeMemoryProjectionDb(db: BetterSqlite3Database): void {\n  db.exec(`\n    CREATE TABLE IF NOT EXISTS meta (\n      key TEXT PRIMARY KEY,\n      value TEXT NOT NULL\n    );\n\n    CREATE TABLE IF NOT EXISTS memory_current (\n      memory_id TEXT PRIMARY KEY,\n      category TEXT NOT NULL,\n      status TEXT NOT NULL,\n      lifecycle_state TEXT,\n      path_rel TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      archived_at TEXT,\n      superseded_at TEXT,\n      entity_ref TEXT,\n      source TEXT NOT NULL,\n      confidence REAL NOT NULL,\n      confidence_tier TEXT NOT NULL,\n      memory_kind TEXT,\n      access_count INTEGER,\n      last_accessed TEXT,\n      tags_json TEXT NOT NULL DEFAULT '[]',\n      preview_text TEXT NOT NULL DEFAULT ''\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_current_status\n      ON memory_current(status);\n\n    CREATE INDEX IF NOT EXISTS idx_memory_current_category\n      ON memory_current(category);\n\n    CREATE INDEX IF NOT EXISTS idx_memory_current_updated\n      ON memory_current(updated_at DESC);\n\n    CREATE TABLE IF NOT EXISTS memory_timeline (\n      event_id TEXT PRIMARY KEY,\n      memory_id TEXT NOT NULL,\n      event_type TEXT NOT NULL,\n      timestamp TEXT NOT NULL,\n      event_order INTEGER NOT NULL,\n      actor TEXT NOT NULL,\n      reason_code TEXT,\n      rule_version TEXT NOT NULL,\n      related_memory_ids_json TEXT,\n      before_json TEXT,\n      after_json TEXT,\n      correlation_id TEXT\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_timeline_memory_ts\n      ON memory_timeline(memory_id, timestamp, event_order);\n\n    CREATE TABLE IF NOT EXISTS memory_entity_mentions (\n      memory_id TEXT NOT NULL,\n      entity_ref TEXT NOT NULL,\n      mention_source TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      PRIMARY KEY (memory_id, entity_ref, mention_source)\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_entity_mentions_entity\n      ON memory_entity_mentions(entity_ref, updated_at DESC);\n\n    CREATE TABLE IF NOT EXISTS native_knowledge_chunks (\n      chunk_id TEXT PRIMARY KEY,\n      source_path TEXT NOT NULL,\n      title TEXT NOT NULL,\n      source_kind TEXT NOT NULL,\n      start_line INTEGER NOT NULL,\n      end_line INTEGER NOT NULL,\n      derived_date TEXT,\n      session_key TEXT,\n      workflow_key TEXT,\n      author TEXT,\n      agent TEXT,\n      namespace TEXT,\n      privacy_class TEXT,\n      source_hash TEXT,\n      preview_text TEXT NOT NULL\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_native_knowledge_source_kind\n      ON native_knowledge_chunks(source_kind);\n\n    CREATE INDEX IF NOT EXISTS idx_native_knowledge_namespace\n      ON native_knowledge_chunks(namespace);\n\n    CREATE TABLE IF NOT EXISTS memory_review_runs (\n      run_id TEXT PRIMARY KEY,\n      created_at TEXT NOT NULL,\n      mode TEXT NOT NULL,\n      summary_json TEXT NOT NULL,\n      metrics_json TEXT NOT NULL,\n      applied_actions_json TEXT NOT NULL,\n      report_markdown TEXT NOT NULL\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_review_runs_created\n      ON memory_review_runs(created_at DESC);\n\n    CREATE TABLE IF NOT EXISTS memory_review_queue (\n      entry_id TEXT PRIMARY KEY,\n      run_id TEXT NOT NULL,\n      memory_id TEXT NOT NULL,\n      path TEXT NOT NULL,\n      reason_code TEXT NOT NULL,\n      severity TEXT NOT NULL,\n      suggested_action TEXT NOT NULL,\n      suggested_status TEXT,\n      related_memory_ids_json TEXT NOT NULL\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_review_queue_run\n      ON memory_review_queue(run_id, reason_code, memory_id);\n\n    CREATE TABLE IF NOT EXISTS memory_review_actions (\n      row_key TEXT PRIMARY KEY,\n      run_id TEXT NOT NULL,\n      action TEXT NOT NULL,\n      memory_id TEXT NOT NULL,\n      reason_code TEXT NOT NULL,\n      before_status TEXT NOT NULL,\n      after_status TEXT,\n      original_path TEXT NOT NULL,\n      current_path TEXT NOT NULL\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_memory_review_actions_run\n      ON memory_review_actions(run_id, memory_id);\n  `);\n\n  migrateMemoryCurrentTable(db);\n  db.prepare(\"INSERT OR REPLACE INTO meta(key, value) VALUES (?, ?)\")\n    .run(\"schemaVersion\", String(MEMORY_PROJECTION_SCHEMA_VERSION));\n}\n\nfunction openProjectionReadonly(memoryDir: string): BetterSqlite3Database | null {\n  const dbPath = getMemoryProjectionPath(memoryDir);\n  try {\n    return openBetterSqlite3(dbPath, { readonly: true, fileMustExist: true });\n  } catch {\n    return null;\n  }\n}\n\nfunction withProjectionReadonly<T>(\n  memoryDir: string,\n  reader: (db: BetterSqlite3Database) => T,\n): T | null {\n  const db = openProjectionReadonly(memoryDir);\n  if (!db) return null;\n\n  let needsMigration = false;\n  try {\n    needsMigration = memoryCurrentRequiresMigration(db);\n    return reader(db);\n  } catch {\n    return null;\n  } finally {\n    db.close();\n    if (needsMigration) {\n      migrateProjectionSchemaIfNeeded(memoryDir);\n    }\n  }\n}\n\nfunction parseStringArray(value: unknown): string[] {\n  if (typeof value !== \"string\" || value.length === 0) return [];\n  try {\n    const parsed = JSON.parse(value);\n    return Array.isArray(parsed) ? parsed.filter((entry): entry is string => typeof entry === \"string\") : [];\n  } catch {\n    return [];\n  }\n}\n\nfunction parseJsonObject<T>(value: unknown): T | undefined {\n  if (typeof value !== \"string\" || value.length === 0) return undefined;\n  try {\n    return JSON.parse(value) as T;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction resolveMemoryDirRoot(memoryDir: string): string {\n  try {\n    return fs.realpathSync(memoryDir);\n  } catch {\n    return path.resolve(memoryDir);\n  }\n}\n\nfunction isPathInsideRoot(candidatePath: string, rootPath: string): boolean {\n  const relative = path.relative(rootPath, candidatePath);\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\nfunction resolveProjectedMemoryPath(memoryDir: string, pathRel: string): string | null {\n  if (path.isAbsolute(pathRel)) return null;\n  const root = resolveMemoryDirRoot(memoryDir);\n  const candidate = path.resolve(root, pathRel);\n  if (!isPathInsideRoot(candidate, root)) return null;\n  try {\n    const realCandidate = fs.realpathSync(candidate);\n    if (!isPathInsideRoot(realCandidate, root)) return null;\n  } catch {\n    // Missing files are handled by callers. Still keep the lexical guard above.\n  }\n  return candidate;\n}\n\nfunction projectedBrowseRowFromCurrentRow(\n  memoryDir: string,\n  row: Record<string, unknown>,\n): ProjectedMemoryBrowseRow | null {\n  if (\n    typeof row.memory_id !== \"string\" ||\n    typeof row.path_rel !== \"string\" ||\n    typeof row.category !== \"string\" ||\n    typeof row.status !== \"string\"\n  ) {\n    return null;\n  }\n  const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);\n  if (!filePath) return null;\n  return {\n    id: row.memory_id,\n    path: filePath,\n    category: row.category as MemoryCategory,\n    status: row.status as MemoryStatus,\n    created: typeof row.created_at === \"string\" ? row.created_at : undefined,\n    updated: typeof row.updated_at === \"string\" ? row.updated_at : undefined,\n    tags: parseStringArray(row.tags_json),\n    entityRef: typeof row.entity_ref === \"string\" ? row.entity_ref : undefined,\n    preview: typeof row.preview_text === \"string\" ? row.preview_text : \"\",\n  };\n}\n\nfunction projectedBrowsePathSqlClauses(): string[] {\n  return [\n    \"path_rel <> ''\",\n    \"path_rel NOT LIKE '/%'\",\n    \"path_rel <> '..'\",\n    \"path_rel NOT LIKE '../%'\",\n    \"path_rel NOT LIKE '%/../%'\",\n  ];\n}\n\nexport function parseCurrentRow(\n  memoryDir: string,\n  row: Record<string, unknown> | undefined,\n): MemoryProjectionCurrentState | null {\n  if (!row) return null;\n  if (\n    typeof row.memory_id !== \"string\" ||\n    typeof row.category !== \"string\" ||\n    typeof row.status !== \"string\" ||\n    typeof row.path_rel !== \"string\" ||\n    typeof row.created_at !== \"string\" ||\n    typeof row.updated_at !== \"string\" ||\n    typeof row.source !== \"string\" ||\n    typeof row.confidence !== \"number\" ||\n    typeof row.confidence_tier !== \"string\"\n  ) {\n    return null;\n  }\n  const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);\n  if (!filePath) return null;\n\n  return {\n    memoryId: row.memory_id,\n    category: row.category as MemoryProjectionCurrentState[\"category\"],\n    status: row.status as MemoryStatus,\n    lifecycleState:\n      typeof row.lifecycle_state === \"string\"\n        ? (row.lifecycle_state as MemoryProjectionCurrentState[\"lifecycleState\"])\n        : undefined,\n    path: filePath,\n    pathRel: row.path_rel,\n    created: row.created_at,\n    updated: row.updated_at,\n    archivedAt: typeof row.archived_at === \"string\" ? row.archived_at : undefined,\n    supersededAt: typeof row.superseded_at === \"string\" ? row.superseded_at : undefined,\n    entityRef: typeof row.entity_ref === \"string\" ? row.entity_ref : undefined,\n    source: row.source,\n    confidence: row.confidence,\n    confidenceTier: row.confidence_tier as MemoryProjectionCurrentState[\"confidenceTier\"],\n    memoryKind:\n      typeof row.memory_kind === \"string\"\n        ? (row.memory_kind as MemoryProjectionCurrentState[\"memoryKind\"])\n        : undefined,\n    accessCount: typeof row.access_count === \"number\" ? row.access_count : undefined,\n    lastAccessed: typeof row.last_accessed === \"string\" ? row.last_accessed : undefined,\n    tags: parseStringArray(row.tags_json),\n    preview: typeof row.preview_text === \"string\" ? row.preview_text : \"\",\n  };\n}\n\nexport function parseTimelineRows(rows: Array<Record<string, unknown>>): MemoryLifecycleEvent[] {\n  const out: MemoryLifecycleEvent[] = [];\n  for (const row of rows) {\n    if (\n      typeof row.event_id !== \"string\" ||\n      typeof row.memory_id !== \"string\" ||\n      typeof row.event_type !== \"string\" ||\n      typeof row.timestamp !== \"string\" ||\n      typeof row.actor !== \"string\" ||\n      typeof row.rule_version !== \"string\"\n    ) {\n      continue;\n    }\n\n    out.push({\n      eventId: row.event_id,\n      memoryId: row.memory_id,\n      eventType: row.event_type as MemoryLifecycleEvent[\"eventType\"],\n      timestamp: row.timestamp,\n      actor: row.actor,\n      reasonCode: typeof row.reason_code === \"string\" ? row.reason_code : undefined,\n      ruleVersion: row.rule_version,\n      relatedMemoryIds: parseStringArray(row.related_memory_ids_json),\n      before: parseJsonObject<MemoryLifecycleEvent[\"before\"]>(row.before_json),\n      after: parseJsonObject<MemoryLifecycleEvent[\"after\"]>(row.after_json),\n      correlationId: typeof row.correlation_id === \"string\" ? row.correlation_id : undefined,\n    });\n  }\n\n  return out;\n}\n\nexport function readProjectedMemoryState(\n  memoryDir: string,\n  memoryId: string,\n): MemoryProjectionCurrentState | null {\n  return withProjectionReadonly(memoryDir, (db) => {\n    const currentSelect = memoryCurrentSelectExpressions(db);\n    const row = db\n      .prepare(\n        `\n          SELECT\n            memory_id,\n            category,\n            status,\n            lifecycle_state,\n            path_rel,\n            created_at,\n            updated_at,\n            archived_at,\n            superseded_at,\n            entity_ref,\n            source,\n            confidence,\n            confidence_tier,\n            memory_kind,\n            access_count,\n            last_accessed,\n            ${currentSelect.tagsJson},\n            ${currentSelect.previewText}\n          FROM memory_current\n          WHERE memory_id = ?\n        `,\n      )\n      .get(memoryId) as Record<string, unknown> | undefined;\n    return parseCurrentRow(memoryDir, row);\n  });\n}\n\nexport function readProjectedMemoryTimeline(\n  memoryDir: string,\n  memoryId: string,\n  limit: number,\n): MemoryLifecycleEvent[] | null {\n  const db = openProjectionReadonly(memoryDir);\n  if (!db) return null;\n\n  try {\n    const rows = db\n      .prepare(\n        `\n          SELECT * FROM (\n            SELECT\n              event_id,\n              memory_id,\n              event_type,\n              timestamp,\n              event_order,\n              actor,\n              reason_code,\n              rule_version,\n              related_memory_ids_json,\n              before_json,\n              after_json,\n              correlation_id\n            FROM memory_timeline\n            WHERE memory_id = ?\n            ORDER BY timestamp DESC, event_order DESC\n            LIMIT ?\n          )\n          ORDER BY timestamp ASC, event_order ASC\n        `,\n      )\n      .all(memoryId, limit) as Array<Record<string, unknown>>;\n    if (rows.length === 0) return null;\n    return parseTimelineRows(rows);\n  } catch {\n    return null;\n  } finally {\n    db.close();\n  }\n}\n\nexport function readProjectedMemoryBrowse(\n  memoryDir: string,\n  options: ProjectedMemoryBrowseOptions,\n): ProjectedMemoryBrowsePage | null {\n  return withProjectionReadonly(memoryDir, (db) => {\n    const normalizedQuery = options.query?.trim().toLowerCase() ?? \"\";\n\n    const currentSelect = memoryCurrentSelectExpressions(db);\n    const whereClauses: string[] = [];\n    const params: unknown[] = [];\n\n    if (options.status) {\n      whereClauses.push(\"status = ?\");\n      params.push(options.status);\n    }\n    if (options.category) {\n      whereClauses.push(\"category = ?\");\n      params.push(options.category);\n    }\n    const sort = options.sort ?? \"updated_desc\";\n    const orderBySql = (() => {\n      switch (sort) {\n        case \"updated_asc\":\n          return \"updated_at ASC, created_at ASC, memory_id ASC\";\n        case \"created_desc\":\n          return \"created_at DESC, updated_at DESC, memory_id ASC\";\n        case \"created_asc\":\n          return \"created_at ASC, updated_at ASC, memory_id ASC\";\n        case \"updated_desc\":\n        default:\n          return \"updated_at DESC, created_at DESC, memory_id ASC\";\n      }\n    })();\n    const whereSql = whereClauses.length > 0 ? `WHERE ${whereClauses.join(\" AND \")}` : \"\";\n\n    if (normalizedQuery) {\n      // Query-based browse: fetch all matching rows, filter by full file content, then paginate in JS\n      const allRows = db\n        .prepare(`\n          SELECT\n            memory_id,\n            path_rel,\n            category,\n            status,\n            created_at,\n            updated_at,\n            entity_ref,\n            ${currentSelect.tagsJson},\n            ${currentSelect.previewText}\n          FROM memory_current\n          ${whereSql}\n          ORDER BY ${orderBySql}\n        `)\n        .all(...params) as Array<Record<string, unknown>>;\n\n      const filtered = allRows.filter((row) => {\n        if (typeof row.memory_id !== \"string\" || typeof row.path_rel !== \"string\") return false;\n        const filePath = resolveProjectedMemoryPath(memoryDir, row.path_rel);\n        if (!filePath) return false;\n        // Check preview, category, entity_ref, tags first (fast)\n        const preview = typeof row.preview_text === \"string\" ? row.preview_text.toLowerCase() : \"\";\n        const category = typeof row.category === \"string\" ? row.category.toLowerCase() : \"\";\n        const entityRef = typeof row.entity_ref === \"string\" ? row.entity_ref.toLowerCase() : \"\";\n        const tags = typeof row.tags_json === \"string\" ? row.tags_json.toLowerCase() : \"\";\n        if (preview.includes(normalizedQuery) || category.includes(normalizedQuery) ||\n            entityRef.includes(normalizedQuery) || tags.includes(normalizedQuery)) {\n          return true;\n        }\n        // Fall back to reading full file content from disk\n        try {\n          const content = fs.readFileSync(filePath, \"utf-8\").toLowerCase();\n          return content.includes(normalizedQuery);\n        } catch {\n          return false;\n        }\n      });\n\n      const pageRows = filtered.slice(options.offset, options.offset + options.limit);\n      return {\n        total: filtered.length,\n        memories: pageRows\n          .map((row) => projectedBrowseRowFromCurrentRow(memoryDir, row))\n          .filter((row): row is ProjectedMemoryBrowseRow => row !== null),\n      };\n    }\n\n    // No query: push lexical path safety into SQL, then count through the same\n    // realpath-aware row parser used for returned rows so symlink escapes do not\n    // inflate totals.\n    const browseWhereClauses = [...whereClauses, ...projectedBrowsePathSqlClauses()];\n    const browseWhereSql = `WHERE ${browseWhereClauses.join(\" AND \")}`;\n    const pageRows: ProjectedMemoryBrowseRow[] = [];\n    const fetchSize = Math.max(options.limit * 2, 50);\n    let validRowsSeen = 0;\n    let scanOffset = 0;\n\n    while (true) {\n      const rows = db\n        .prepare(`\n          SELECT\n            memory_id,\n            path_rel,\n            category,\n            status,\n            created_at,\n            updated_at,\n            entity_ref,\n            ${currentSelect.tagsJson},\n            ${currentSelect.previewText}\n          FROM memory_current\n          ${browseWhereSql}\n          ORDER BY ${orderBySql}\n          LIMIT ? OFFSET ?\n        `)\n        .all(...params, fetchSize, scanOffset) as Array<Record<string, unknown>>;\n      if (rows.length === 0) break;\n      scanOffset += rows.length;\n      for (const row of rows) {\n        const browseRow = projectedBrowseRowFromCurrentRow(memoryDir, row);\n        if (!browseRow) continue;\n        if (validRowsSeen >= options.offset && pageRows.length < options.limit) {\n          pageRows.push(browseRow);\n        }\n        validRowsSeen += 1;\n      }\n      if (rows.length < fetchSize) break;\n    }\n\n    return {\n      total: validRowsSeen,\n      memories: pageRows,\n    };\n  });\n}\n\nexport function readProjectedEntityMentions(\n  memoryDir: string,\n  memoryIds?: Set<string>,\n): ProjectedEntityMentionRow[] | null {\n  const db = openProjectionReadonly(memoryDir);\n  if (!db) return null;\n\n  try {\n    const rows = db\n      .prepare(`\n        SELECT\n          memory_id,\n          entity_ref,\n          mention_source,\n          created_at,\n          updated_at\n        FROM memory_entity_mentions\n        ORDER BY entity_ref ASC, updated_at DESC, memory_id ASC\n      `)\n      .all() as Array<Record<string, unknown>>;\n\n    return rows\n      .filter(\n        (row) =>\n          typeof row.memory_id === \"string\" &&\n          typeof row.entity_ref === \"string\" &&\n          typeof row.mention_source === \"string\" &&\n          typeof row.created_at === \"string\" &&\n          typeof row.updated_at === \"string\" &&\n          (!memoryIds || memoryIds.has(row.memory_id)),\n      )\n      .map((row) => ({\n        memoryId: row.memory_id as string,\n        entityRef: row.entity_ref as string,\n        mentionSource: row.mention_source as string,\n        created: row.created_at as string,\n        updated: row.updated_at as string,\n      }));\n  } catch {\n    return null;\n  } finally {\n    db.close();\n  }\n}\n\nexport function readProjectedNativeKnowledgeChunks(\n  memoryDir: string,\n): ProjectedNativeKnowledgeChunkRow[] | null {\n  const db = openProjectionReadonly(memoryDir);\n  if (!db) return null;\n\n  try {\n    const rows = db\n      .prepare(`\n        SELECT\n          chunk_id,\n          source_path,\n          title,\n          source_kind,\n          start_line,\n          end_line,\n          derived_date,\n          session_key,\n          workflow_key,\n          author,\n          agent,\n          namespace,\n          privacy_class,\n          source_hash,\n          preview_text\n        FROM native_knowledge_chunks\n        ORDER BY source_kind ASC, source_path ASC, start_line ASC\n      `)\n      .all() as Array<Record<string, unknown>>;\n\n    return rows\n      .filter(\n        (row) =>\n          typeof row.chunk_id === \"string\" &&\n          typeof row.source_path === \"string\" &&\n          typeof row.title === \"string\" &&\n          typeof row.source_kind === \"string\" &&\n          typeof row.start_line === \"number\" &&\n          typeof row.end_line === \"number\" &&\n          typeof row.preview_text === \"string\",\n      )\n      .map((row) => ({\n        chunkId: row.chunk_id as string,\n        sourcePath: row.source_path as string,\n        title: row.title as string,\n        sourceKind: row.source_kind as string,\n        startLine: row.start_line as number,\n        endLine: row.end_line as number,\n        derivedDate: typeof row.derived_date === \"string\" ? row.derived_date : undefined,\n        sessionKey: typeof row.session_key === \"string\" ? row.session_key : undefined,\n        workflowKey: typeof row.workflow_key === \"string\" ? row.workflow_key : undefined,\n        author: typeof row.author === \"string\" ? row.author : undefined,\n        agent: typeof row.agent === \"string\" ? row.agent : undefined,\n        namespace: typeof row.namespace === \"string\" ? row.namespace : undefined,\n        privacyClass: typeof row.privacy_class === \"string\" ? row.privacy_class : undefined,\n        sourceHash: typeof row.source_hash === \"string\" ? row.source_hash : undefined,\n        preview: row.preview_text as string,\n      }));\n  } catch {\n    return null;\n  } finally {\n    db.close();\n  }\n}\n\nexport function readProjectedLatestReviewQueue(\n  memoryDir: string,\n): ProjectedReviewQueueSnapshot | null {\n  const db = openProjectionReadonly(memoryDir);\n  if (!db) return null;\n\n  try {\n    const latestRunId =\n      (db.prepare(`SELECT value FROM meta WHERE key = 'latestGovernanceRunId'`).get() as { value?: string } | undefined)\n        ?.value\n      ?? (db.prepare(`SELECT run_id AS value FROM memory_review_runs ORDER BY created_at DESC LIMIT 1`).get() as {\n        value?: string;\n      } | undefined)?.value;\n    if (!latestRunId) {\n      return { found: false };\n    }\n\n    const runRow = db\n      .prepare(`\n        SELECT\n          run_id,\n          summary_json,\n          metrics_json,\n          applied_actions_json,\n          report_markdown\n        FROM memory_review_runs\n        WHERE run_id = ?\n      `)\n      .get(latestRunId) as Record<string, unknown> | undefined;\n    if (!runRow || typeof runRow.run_id !== \"string\") {\n      return { found: false };\n    }\n\n    const queueRows = db\n      .prepare(`\n        SELECT\n          entry_id,\n          memory_id,\n          path,\n          reason_code,\n          severity,\n          suggested_action,\n          suggested_status,\n          related_memory_ids_json\n        FROM memory_review_queue\n        WHERE run_id = ?\n        ORDER BY reason_code ASC, memory_id ASC\n      `)\n      .all(latestRunId) as Array<Record<string, unknown>>;\n\n    const actionRows = db\n      .prepare(`\n        SELECT\n          row_key,\n          action,\n          memory_id,\n          reason_code,\n          before_status,\n          after_status,\n          original_path,\n          current_path\n        FROM memory_review_actions\n        WHERE run_id = ?\n        ORDER BY memory_id ASC, action ASC\n      `)\n      .all(latestRunId) as Array<Record<string, unknown>>;\n\n    const reviewQueue: MemoryGovernanceReviewQueueEntry[] = queueRows\n      .filter(\n        (row) =>\n          typeof row.entry_id === \"string\" &&\n          typeof row.memory_id === \"string\" &&\n          typeof row.path === \"string\" &&\n          typeof row.reason_code === \"string\" &&\n          typeof row.severity === \"string\" &&\n          typeof row.suggested_action === \"string\",\n      )\n      .map((row) => ({\n        entryId: row.entry_id as string,\n        memoryId: row.memory_id as string,\n        path: row.path as string,\n        reasonCode: row.reason_code as MemoryGovernanceReviewQueueEntry[\"reasonCode\"],\n        severity: row.severity as MemoryGovernanceReviewQueueEntry[\"severity\"],\n        suggestedAction: row.suggested_action as MemoryGovernanceReviewQueueEntry[\"suggestedAction\"],\n        suggestedStatus:\n          typeof row.suggested_status === \"string\"\n            ? (row.suggested_status as MemoryGovernanceReviewQueueEntry[\"suggestedStatus\"])\n            : undefined,\n        relatedMemoryIds: parseStringArray(row.related_memory_ids_json),\n      }));\n\n    return {\n      found: true,\n      runId: latestRunId,\n      summary: parseJsonObject<MemoryGovernanceSummary>(runRow.summary_json),\n      metrics: parseJsonObject<MemoryGovernanceMetrics>(runRow.metrics_json),\n      reviewQueue,\n      appliedActions:\n        actionRows.length > 0\n          ? actionRows\n            .filter(\n              (row) =>\n                typeof row.action === \"string\" &&\n                typeof row.memory_id === \"string\" &&\n                typeof row.reason_code === \"string\" &&\n                typeof row.before_status === \"string\" &&\n                typeof row.original_path === \"string\" &&\n                typeof row.current_path === \"string\",\n            )\n            .map((row) => ({\n              action: row.action as MemoryGovernanceAppliedAction[\"action\"],\n              memoryId: row.memory_id as string,\n              reasonCode: row.reason_code as MemoryGovernanceAppliedAction[\"reasonCode\"],\n              beforeStatus: row.before_status as MemoryGovernanceAppliedAction[\"beforeStatus\"],\n              afterStatus:\n                typeof row.after_status === \"string\"\n                  ? (row.after_status as MemoryGovernanceAppliedAction[\"afterStatus\"])\n                  : undefined,\n              originalPath: row.original_path as string,\n              currentPath: row.current_path as string,\n            }))\n          : (parseJsonObject<MemoryGovernanceAppliedAction[]>(runRow.applied_actions_json) ?? []),\n      report: typeof runRow.report_markdown === \"string\" ? runRow.report_markdown : undefined,\n    };\n  } catch {\n    return null;\n  } finally {\n    db.close();\n  }\n}\n\nexport function readProjectedGovernanceRecord(\n  memoryDir: string,\n): {\n  runId: string;\n  summary: unknown;\n  metrics: unknown;\n  reviewQueueRows: MemoryProjectionGovernanceReviewQueueRow[];\n  appliedActionRows: MemoryProjectionGovernanceAppliedActionRow[];\n  report: string;\n} | null {\n  const snapshot = readProjectedLatestReviewQueue(memoryDir);\n  if (!snapshot?.found || !snapshot.runId) return null;\n\n  return {\n    runId: snapshot.runId,\n    summary: snapshot.summary ?? {},\n    metrics: snapshot.metrics ?? {},\n    reviewQueueRows: (snapshot.reviewQueue ?? []).map((entry) => ({\n      runId: snapshot.runId as string,\n      entryId: entry.entryId,\n      memoryId: entry.memoryId,\n      path: entry.path,\n      reasonCode: entry.reasonCode,\n      severity: entry.severity,\n      suggestedAction: entry.suggestedAction,\n      suggestedStatus: entry.suggestedStatus,\n      relatedMemoryIds: [...entry.relatedMemoryIds],\n    })),\n    appliedActionRows: (snapshot.appliedActions ?? []).map((action) => ({\n      runId: snapshot.runId as string,\n      rowKey: [\n        action.action,\n        action.memoryId,\n        action.reasonCode,\n        action.originalPath,\n        action.currentPath,\n      ].join(\"::\"),\n      action: action.action,\n      memoryId: action.memoryId,\n      reasonCode: action.reasonCode,\n      beforeStatus: action.beforeStatus,\n      afterStatus: action.afterStatus,\n      originalPath: action.originalPath,\n      currentPath: action.currentPath,\n    })),\n    report: snapshot.report ?? \"\",\n  };\n}\n"],"mappings":";;;;;AAAA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAkBR,IAAM,mCAAmC;AAwFzC,SAAS,wBAAwB,WAA2B;AACjE,SAAO,KAAK,KAAK,WAAW,SAAS,0BAA0B;AACjE;AAEA,SAAS,iBAAiB,IAA2B,WAAgC;AACnF,MAAI;AACF,UAAM,OAAO,GAAG,QAAQ,qBAAqB,SAAS,GAAG,EAAE,IAAI;AAC/D,WAAO,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ,CAAC;AAAA,EACvG,QAAQ;AACN,WAAO,oBAAI,IAAY;AAAA,EACzB;AACF;AAEA,SAAS,0BAA0B,IAAiC;AAClE,QAAM,UAAU,iBAAiB,IAAI,gBAAgB;AACrD,MAAI,QAAQ,SAAS,EAAG;AAExB,MAAI,CAAC,QAAQ,IAAI,WAAW,GAAG;AAC7B,OAAG,KAAK,4EAA4E;AAAA,EACtF;AACA,MAAI,CAAC,QAAQ,IAAI,cAAc,GAAG;AAChC,OAAG,KAAK,6EAA6E;AAAA,EACvF;AACF;AAEA,SAAS,+BAA+B,IAAoC;AAC1E,QAAM,UAAU,iBAAiB,IAAI,gBAAgB;AACrD,SAAO,QAAQ,OAAO,MAAM,CAAC,QAAQ,IAAI,WAAW,KAAK,CAAC,QAAQ,IAAI,cAAc;AACtF;AAEA,SAAS,gCAAgC,WAAyB;AAChE,QAAM,SAAS,wBAAwB,SAAS;AAChD,MAAI;AACF,UAAM,KAAK,kBAAkB,QAAQ,EAAE,eAAe,KAAK,CAAC;AAC5D,QAAI;AACF,UAAI,CAAC,+BAA+B,EAAE,EAAG;AACzC,mCAA6B,EAAE;AAAA,IACjC,UAAE;AACA,SAAG,MAAM;AAAA,IACX;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,+BAA+B,IAG7C;AACA,QAAM,UAAU,iBAAiB,IAAI,gBAAgB;AACrD,SAAO;AAAA,IACL,UAAU,QAAQ,IAAI,WAAW,IAAI,cAAc;AAAA,IACnD,aAAa,QAAQ,IAAI,cAAc,IAAI,iBAAiB;AAAA,EAC9D;AACF;AAEO,SAAS,6BAA6B,IAAiC;AAC5E,KAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAoIP;AAED,4BAA0B,EAAE;AAC5B,KAAG,QAAQ,uDAAuD,EAC/D,IAAI,iBAAiB,OAAO,gCAAgC,CAAC;AAClE;AAEA,SAAS,uBAAuB,WAAiD;AAC/E,QAAM,SAAS,wBAAwB,SAAS;AAChD,MAAI;AACF,WAAO,kBAAkB,QAAQ,EAAE,UAAU,MAAM,eAAe,KAAK,CAAC;AAAA,EAC1E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,uBACP,WACA,QACU;AACV,QAAM,KAAK,uBAAuB,SAAS;AAC3C,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI,iBAAiB;AACrB,MAAI;AACF,qBAAiB,+BAA+B,EAAE;AAClD,WAAO,OAAO,EAAE;AAAA,EAClB,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AACT,QAAI,gBAAgB;AAClB,sCAAgC,SAAS;AAAA,IAC3C;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,OAA0B;AAClD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO,CAAC;AAC7D,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,KAAK;AAC/B,WAAO,MAAM,QAAQ,MAAM,IAAI,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAAI,CAAC;AAAA,EACzG,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,gBAAmB,OAA+B;AACzD,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,MAAI;AACF,WAAO,KAAK,MAAM,KAAK;AAAA,EACzB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,WAA2B;AACvD,MAAI;AACF,WAAO,GAAG,aAAa,SAAS;AAAA,EAClC,QAAQ;AACN,WAAO,KAAK,QAAQ,SAAS;AAAA,EAC/B;AACF;AAEA,SAAS,iBAAiB,eAAuB,UAA2B;AAC1E,QAAM,WAAW,KAAK,SAAS,UAAU,aAAa;AACtD,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;AAEA,SAAS,2BAA2B,WAAmB,SAAgC;AACrF,MAAI,KAAK,WAAW,OAAO,EAAG,QAAO;AACrC,QAAM,OAAO,qBAAqB,SAAS;AAC3C,QAAM,YAAY,KAAK,QAAQ,MAAM,OAAO;AAC5C,MAAI,CAAC,iBAAiB,WAAW,IAAI,EAAG,QAAO;AAC/C,MAAI;AACF,UAAM,gBAAgB,GAAG,aAAa,SAAS;AAC/C,QAAI,CAAC,iBAAiB,eAAe,IAAI,EAAG,QAAO;AAAA,EACrD,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,iCACP,WACA,KACiC;AACjC,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,WAAW,UACtB;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,2BAA2B,WAAW,IAAI,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM;AAAA,IACN,UAAU,IAAI;AAAA,IACd,QAAQ,IAAI;AAAA,IACZ,SAAS,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IAC/D,SAAS,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IAC/D,MAAM,iBAAiB,IAAI,SAAS;AAAA,IACpC,WAAW,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IACjE,SAAS,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,EACrE;AACF;AAEA,SAAS,gCAA0C;AACjD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,gBACd,WACA,KACqC;AACrC,MAAI,CAAC,IAAK,QAAO;AACjB,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,WAAW,YACtB,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,WAAW,YACtB,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,oBAAoB,UAC/B;AACA,WAAO;AAAA,EACT;AACA,QAAM,WAAW,2BAA2B,WAAW,IAAI,QAAQ;AACnE,MAAI,CAAC,SAAU,QAAO;AAEtB,SAAO;AAAA,IACL,UAAU,IAAI;AAAA,IACd,UAAU,IAAI;AAAA,IACd,QAAQ,IAAI;AAAA,IACZ,gBACE,OAAO,IAAI,oBAAoB,WAC1B,IAAI,kBACL;AAAA,IACN,MAAM;AAAA,IACN,SAAS,IAAI;AAAA,IACb,SAAS,IAAI;AAAA,IACb,SAAS,IAAI;AAAA,IACb,YAAY,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,IACpE,cAAc,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;AAAA,IAC1E,WAAW,OAAO,IAAI,eAAe,WAAW,IAAI,aAAa;AAAA,IACjE,QAAQ,IAAI;AAAA,IACZ,YAAY,IAAI;AAAA,IAChB,gBAAgB,IAAI;AAAA,IACpB,YACE,OAAO,IAAI,gBAAgB,WACtB,IAAI,cACL;AAAA,IACN,aAAa,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,IACvE,cAAc,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;AAAA,IAC1E,MAAM,iBAAiB,IAAI,SAAS;AAAA,IACpC,SAAS,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,EACrE;AACF;AAEO,SAAS,kBAAkB,MAA8D;AAC9F,QAAM,MAA8B,CAAC;AACrC,aAAW,OAAO,MAAM;AACtB,QACE,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,iBAAiB,UAC5B;AACA;AAAA,IACF;AAEA,QAAI,KAAK;AAAA,MACP,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,OAAO,IAAI;AAAA,MACX,YAAY,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACpE,aAAa,IAAI;AAAA,MACjB,kBAAkB,iBAAiB,IAAI,uBAAuB;AAAA,MAC9D,QAAQ,gBAAgD,IAAI,WAAW;AAAA,MACvE,OAAO,gBAA+C,IAAI,UAAU;AAAA,MACpE,eAAe,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB;AAAA,IAC/E,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEO,SAAS,yBACd,WACA,UACqC;AACrC,SAAO,uBAAuB,WAAW,CAAC,OAAO;AAC/C,UAAM,gBAAgB,+BAA+B,EAAE;AACvD,UAAM,MAAM,GACT;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAkBM,cAAc,QAAQ;AAAA,cACtB,cAAc,WAAW;AAAA;AAAA;AAAA;AAAA,IAIjC,EACC,IAAI,QAAQ;AACf,WAAO,gBAAgB,WAAW,GAAG;AAAA,EACvC,CAAC;AACH;AAEO,SAAS,4BACd,WACA,UACA,OAC+B;AAC/B,QAAM,KAAK,uBAAuB,SAAS;AAC3C,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI;AACF,UAAM,OAAO,GACV;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAsBF,EACC,IAAI,UAAU,KAAK;AACtB,QAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,WAAO,kBAAkB,IAAI;AAAA,EAC/B,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAEO,SAAS,0BACd,WACA,SACkC;AAClC,SAAO,uBAAuB,WAAW,CAAC,OAAO;AAC/C,UAAM,kBAAkB,QAAQ,OAAO,KAAK,EAAE,YAAY,KAAK;AAE/D,UAAM,gBAAgB,+BAA+B,EAAE;AACvD,UAAM,eAAyB,CAAC;AAChC,UAAM,SAAoB,CAAC;AAE3B,QAAI,QAAQ,QAAQ;AAClB,mBAAa,KAAK,YAAY;AAC9B,aAAO,KAAK,QAAQ,MAAM;AAAA,IAC5B;AACA,QAAI,QAAQ,UAAU;AACpB,mBAAa,KAAK,cAAc;AAChC,aAAO,KAAK,QAAQ,QAAQ;AAAA,IAC9B;AACA,UAAM,OAAO,QAAQ,QAAQ;AAC7B,UAAM,cAAc,MAAM;AACxB,cAAQ,MAAM;AAAA,QACZ,KAAK;AACH,iBAAO;AAAA,QACT,KAAK;AACH,iBAAO;AAAA,QACT,KAAK;AACH,iBAAO;AAAA,QACT,KAAK;AAAA,QACL;AACE,iBAAO;AAAA,MACX;AAAA,IACF,GAAG;AACH,UAAM,WAAW,aAAa,SAAS,IAAI,SAAS,aAAa,KAAK,OAAO,CAAC,KAAK;AAEnF,QAAI,iBAAiB;AAEnB,YAAM,UAAU,GACb,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cASH,cAAc,QAAQ;AAAA,cACtB,cAAc,WAAW;AAAA;AAAA,YAE3B,QAAQ;AAAA,qBACC,UAAU;AAAA,SACtB,EACA,IAAI,GAAG,MAAM;AAEhB,YAAM,WAAW,QAAQ,OAAO,CAAC,QAAQ;AACvC,YAAI,OAAO,IAAI,cAAc,YAAY,OAAO,IAAI,aAAa,SAAU,QAAO;AAClF,cAAM,WAAW,2BAA2B,WAAW,IAAI,QAAQ;AACnE,YAAI,CAAC,SAAU,QAAO;AAEtB,cAAM,UAAU,OAAO,IAAI,iBAAiB,WAAW,IAAI,aAAa,YAAY,IAAI;AACxF,cAAM,WAAW,OAAO,IAAI,aAAa,WAAW,IAAI,SAAS,YAAY,IAAI;AACjF,cAAM,YAAY,OAAO,IAAI,eAAe,WAAW,IAAI,WAAW,YAAY,IAAI;AACtF,cAAM,OAAO,OAAO,IAAI,cAAc,WAAW,IAAI,UAAU,YAAY,IAAI;AAC/E,YAAI,QAAQ,SAAS,eAAe,KAAK,SAAS,SAAS,eAAe,KACtE,UAAU,SAAS,eAAe,KAAK,KAAK,SAAS,eAAe,GAAG;AACzE,iBAAO;AAAA,QACT;AAEA,YAAI;AACF,gBAAM,UAAU,GAAG,aAAa,UAAU,OAAO,EAAE,YAAY;AAC/D,iBAAO,QAAQ,SAAS,eAAe;AAAA,QACzC,QAAQ;AACN,iBAAO;AAAA,QACT;AAAA,MACF,CAAC;AAED,YAAMA,YAAW,SAAS,MAAM,QAAQ,QAAQ,QAAQ,SAAS,QAAQ,KAAK;AAC9E,aAAO;AAAA,QACL,OAAO,SAAS;AAAA,QAChB,UAAUA,UACP,IAAI,CAAC,QAAQ,iCAAiC,WAAW,GAAG,CAAC,EAC7D,OAAO,CAAC,QAAyC,QAAQ,IAAI;AAAA,MAClE;AAAA,IACF;AAKA,UAAM,qBAAqB,CAAC,GAAG,cAAc,GAAG,8BAA8B,CAAC;AAC/E,UAAM,iBAAiB,SAAS,mBAAmB,KAAK,OAAO,CAAC;AAChE,UAAM,WAAuC,CAAC;AAC9C,UAAM,YAAY,KAAK,IAAI,QAAQ,QAAQ,GAAG,EAAE;AAChD,QAAI,gBAAgB;AACpB,QAAI,aAAa;AAEjB,WAAO,MAAM;AACX,YAAM,OAAO,GACV,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cASH,cAAc,QAAQ;AAAA,cACtB,cAAc,WAAW;AAAA;AAAA,YAE3B,cAAc;AAAA,qBACL,UAAU;AAAA;AAAA,SAEtB,EACA,IAAI,GAAG,QAAQ,WAAW,UAAU;AACvC,UAAI,KAAK,WAAW,EAAG;AACvB,oBAAc,KAAK;AACnB,iBAAW,OAAO,MAAM;AACtB,cAAM,YAAY,iCAAiC,WAAW,GAAG;AACjE,YAAI,CAAC,UAAW;AAChB,YAAI,iBAAiB,QAAQ,UAAU,SAAS,SAAS,QAAQ,OAAO;AACtE,mBAAS,KAAK,SAAS;AAAA,QACzB;AACA,yBAAiB;AAAA,MACnB;AACA,UAAI,KAAK,SAAS,UAAW;AAAA,IAC/B;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,IACZ;AAAA,EACF,CAAC;AACH;AAEO,SAAS,4BACd,WACA,WACoC;AACpC,QAAM,KAAK,uBAAuB,SAAS;AAC3C,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI;AACF,UAAM,OAAO,GACV,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OASR,EACA,IAAI;AAEP,WAAO,KACJ;AAAA,MACC,CAAC,QACC,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,mBAAmB,YAC9B,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,eAAe,aACzB,CAAC,aAAa,UAAU,IAAI,IAAI,SAAS;AAAA,IAC9C,EACC,IAAI,CAAC,SAAS;AAAA,MACb,UAAU,IAAI;AAAA,MACd,WAAW,IAAI;AAAA,MACf,eAAe,IAAI;AAAA,MACnB,SAAS,IAAI;AAAA,MACb,SAAS,IAAI;AAAA,IACf,EAAE;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAEO,SAAS,mCACd,WAC2C;AAC3C,QAAM,KAAK,uBAAuB,SAAS;AAC3C,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI;AACF,UAAM,OAAO,GACV,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAmBR,EACA,IAAI;AAEP,WAAO,KACJ;AAAA,MACC,CAAC,QACC,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,iBAAiB;AAAA,IAChC,EACC,IAAI,CAAC,SAAS;AAAA,MACb,SAAS,IAAI;AAAA,MACb,YAAY,IAAI;AAAA,MAChB,OAAO,IAAI;AAAA,MACX,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA,MACf,SAAS,IAAI;AAAA,MACb,aAAa,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,MACvE,YAAY,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACpE,aAAa,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,MACvE,QAAQ,OAAO,IAAI,WAAW,WAAW,IAAI,SAAS;AAAA,MACtD,OAAO,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ;AAAA,MACnD,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;AAAA,MAC/D,cAAc,OAAO,IAAI,kBAAkB,WAAW,IAAI,gBAAgB;AAAA,MAC1E,YAAY,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACpE,SAAS,IAAI;AAAA,IACf,EAAE;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAEO,SAAS,+BACd,WACqC;AACrC,QAAM,KAAK,uBAAuB,SAAS;AAC3C,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI;AACF,UAAM,cACH,GAAG,QAAQ,4DAA4D,EAAE,IAAI,GAC1E,SACA,GAAG,QAAQ,iFAAiF,EAAE,IAAI,GAEtF;AAClB,QAAI,CAAC,aAAa;AAChB,aAAO,EAAE,OAAO,MAAM;AAAA,IACxB;AAEA,UAAM,SAAS,GACZ,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OASR,EACA,IAAI,WAAW;AAClB,QAAI,CAAC,UAAU,OAAO,OAAO,WAAW,UAAU;AAChD,aAAO,EAAE,OAAO,MAAM;AAAA,IACxB;AAEA,UAAM,YAAY,GACf,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaR,EACA,IAAI,WAAW;AAElB,UAAM,aAAa,GAChB,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,OAaR,EACA,IAAI,WAAW;AAElB,UAAM,cAAkD,UACrD;AAAA,MACC,CAAC,QACC,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,SAAS,YACpB,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,aAAa,YACxB,OAAO,IAAI,qBAAqB;AAAA,IACpC,EACC,IAAI,CAAC,SAAS;AAAA,MACb,SAAS,IAAI;AAAA,MACb,UAAU,IAAI;AAAA,MACd,MAAM,IAAI;AAAA,MACV,YAAY,IAAI;AAAA,MAChB,UAAU,IAAI;AAAA,MACd,iBAAiB,IAAI;AAAA,MACrB,iBACE,OAAO,IAAI,qBAAqB,WAC3B,IAAI,mBACL;AAAA,MACN,kBAAkB,iBAAiB,IAAI,uBAAuB;AAAA,IAChE,EAAE;AAEJ,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO;AAAA,MACP,SAAS,gBAAyC,OAAO,YAAY;AAAA,MACrE,SAAS,gBAAyC,OAAO,YAAY;AAAA,MACrE;AAAA,MACA,gBACE,WAAW,SAAS,IAChB,WACC;AAAA,QACC,CAAC,QACC,OAAO,IAAI,WAAW,YACtB,OAAO,IAAI,cAAc,YACzB,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,kBAAkB,YAC7B,OAAO,IAAI,kBAAkB,YAC7B,OAAO,IAAI,iBAAiB;AAAA,MAChC,EACC,IAAI,CAAC,SAAS;AAAA,QACb,QAAQ,IAAI;AAAA,QACZ,UAAU,IAAI;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,cAAc,IAAI;AAAA,QAClB,aACE,OAAO,IAAI,iBAAiB,WACvB,IAAI,eACL;AAAA,QACN,cAAc,IAAI;AAAA,QAClB,aAAa,IAAI;AAAA,MACnB,EAAE,IACD,gBAAiD,OAAO,oBAAoB,KAAK,CAAC;AAAA,MACzF,QAAQ,OAAO,OAAO,oBAAoB,WAAW,OAAO,kBAAkB;AAAA,IAChF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;AAEO,SAAS,8BACd,WAQO;AACP,QAAM,WAAW,+BAA+B,SAAS;AACzD,MAAI,CAAC,UAAU,SAAS,CAAC,SAAS,MAAO,QAAO;AAEhD,SAAO;AAAA,IACL,OAAO,SAAS;AAAA,IAChB,SAAS,SAAS,WAAW,CAAC;AAAA,IAC9B,SAAS,SAAS,WAAW,CAAC;AAAA,IAC9B,kBAAkB,SAAS,eAAe,CAAC,GAAG,IAAI,CAAC,WAAW;AAAA,MAC5D,OAAO,SAAS;AAAA,MAChB,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,MAAM,MAAM;AAAA,MACZ,YAAY,MAAM;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,iBAAiB,MAAM;AAAA,MACvB,iBAAiB,MAAM;AAAA,MACvB,kBAAkB,CAAC,GAAG,MAAM,gBAAgB;AAAA,IAC9C,EAAE;AAAA,IACF,oBAAoB,SAAS,kBAAkB,CAAC,GAAG,IAAI,CAAC,YAAY;AAAA,MAClE,OAAO,SAAS;AAAA,MAChB,QAAQ;AAAA,QACN,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,MACT,EAAE,KAAK,IAAI;AAAA,MACX,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,IACtB,EAAE;AAAA,IACF,QAAQ,SAAS,UAAU;AAAA,EAC7B;AACF;","names":["pageRows"]}

package/dist/{chunk-MXFBBHJU.js → chunk-KJMYHC7K.js}

@@ -7,11 +7,12 @@ import {
   IV_LENGTH,
   generateSalt,
   open,
+  parseEnvelope,
   seal
 } from "./chunk-A6XUJE5D.js";
 
 // src/secure-store/secure-fs.ts
-import { createCipheriv, randomBytes } from "crypto";
+import { createCipheriv, randomBytes, randomUUID } from "crypto";
 import { lstat, mkdir, open as openFile, readFile, readdir, rename, unlink, writeFile } from "fs/promises";
 import path from "path";
 var SecureStoreLockedError = class extends Error {
@@ -60,6 +61,7 @@ function decryptFileBody(buf, key, aad) {
     throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, "0")}`);
   }
   const envelope = buf.subarray(MAGIC_HEADER_SIZE);
+  parseEnvelope(envelope);
   try {
     return open(key, envelope, aad ? { aad } : {});
   } catch (err) {
@@ -109,7 +111,7 @@ async function writeMaybeEncryptedFile(filePath, content, key, options = {}, mem
     data = content;
   }
   if (atomic) {
-    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+    const tempPath = uniqueAtomicTempPath(filePath, "tmp");
     try {
       await writeFile(tempPath, data, { mode });
       await rename(tempPath, filePath);
@@ -199,7 +201,7 @@ async function migrateMemoryDirToEncrypted(dir, key, onBeforeEncrypt) {
       const content = buf.toString("utf8");
       const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));
       const encrypted = encryptFileBody(content, key, aad);
-      const tempPath = `${filePath}.enc-tmp-${process.pid}-${Date.now()}`;
+      const tempPath = uniqueAtomicTempPath(filePath, "enc-tmp");
       try {
         await writeFile(tempPath, encrypted, { mode: 384 });
         await rename(tempPath, filePath);
@@ -233,7 +235,7 @@ async function decryptMemoryDirToPlaintext(dir, key) {
       }
       const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));
       const plaintext = decryptFileBody(buf, key, aad);
-      const tempPath = `${filePath}.dec-tmp-${process.pid}-${Date.now()}`;
+      const tempPath = uniqueAtomicTempPath(filePath, "dec-tmp");
       try {
         await writeFile(tempPath, plaintext, { mode: 384 });
         await rename(tempPath, filePath);
@@ -254,6 +256,9 @@ async function decryptMemoryDirToPlaintext(dir, key) {
   }
   return result;
 }
+function uniqueAtomicTempPath(filePath, label) {
+  return `${filePath}.${label}-${process.pid}-${Date.now()}-${randomUUID()}`;
+}
 async function collectEncryptableStorageFiles(dir, rootDir = dir) {
   return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);
 }
@@ -379,4 +384,4 @@ export {
   migrateMemoryDirToEncrypted,
   decryptMemoryDirToPlaintext
 };
-//# sourceMappingURL=chunk-MXFBBHJU.js.map
+//# sourceMappingURL=chunk-KJMYHC7K.js.map

package/dist/chunk-KJMYHC7K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { createCipheriv, randomBytes, randomUUID } from \"node:crypto\";\nimport { lstat, mkdir, open as openFile, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  AUTH_TAG_LENGTH,\n  ENVELOPE_HEADER_SIZE,\n  ENVELOPE_LAYOUT,\n  ENVELOPE_SALT_LENGTH,\n  ENVELOPE_VERSION,\n  IV_LENGTH,\n  generateSalt,\n  open as openEnvelope,\n  parseEnvelope,\n  seal,\n} from \"./cipher.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`,\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  parseEnvelope(envelope);\n  try {\n    return openEnvelope(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(\n      `secure-store decryption failed: ${msg}`,\n    );\n  }\n}\n\nfunction buildHeaderAad(salt: Uint8Array): Buffer {\n  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);\n  out.writeUInt8(ENVELOPE_VERSION, 0);\n  Buffer.from(salt).copy(out, 1);\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFileBuffer(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<Buffer> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain file — legacy or unencrypted store.\n    return buf;\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. ` +\n        \"Run `remnic secure-store unlock` to decrypt.\",\n    );\n  }\n  const aad = filePathAad(filePath, memoryDir);\n  return decryptFileBody(buf, key, aad);\n}\n\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<string> {\n  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a unique temp file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string | Buffer,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = uniqueAtomicTempPath(filePath, \"tmp\");\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\nexport async function writeMaybeEncryptedFileFromChunks(\n  filePath: string,\n  chunks: AsyncIterable<Buffer>,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n  const writePath = atomic ? `${filePath}.tmp-${process.pid}-${Date.now()}` : filePath;\n  let completed = false;\n  try {\n    const handle = await openFile(writePath, \"w\", mode);\n    try {\n      if (key !== null) {\n        const salt = generateSalt();\n        const iv = randomBytes(IV_LENGTH);\n        const header = Buffer.alloc(MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);\n        MAGIC_BYTES.copy(header, 0);\n        header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n        header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n        const envelopeOffset = MAGIC_HEADER_SIZE;\n        header.writeUInt8(ENVELOPE_VERSION, envelopeOffset + ENVELOPE_LAYOUT.version);\n        salt.copy(header, envelopeOffset + ENVELOPE_LAYOUT.salt);\n        iv.copy(header, envelopeOffset + ENVELOPE_LAYOUT.iv);\n        await handle.write(header);\n\n        const cipher = createCipheriv(\"aes-256-gcm\", key, iv, { authTagLength: AUTH_TAG_LENGTH });\n        const aad = filePathAad(filePath, memoryDir);\n        cipher.setAAD(Buffer.concat([buildHeaderAad(salt), aad]));\n        for await (const chunk of chunks) {\n          if (chunk.length === 0) continue;\n          const encrypted = cipher.update(chunk);\n          if (encrypted.length > 0) await handle.write(encrypted);\n        }\n        const final = cipher.final();\n        if (final.length > 0) await handle.write(final);\n        const authTag = cipher.getAuthTag();\n        await handle.write(\n          authTag,\n          0,\n          authTag.length,\n          MAGIC_HEADER_SIZE + ENVELOPE_LAYOUT.authTag,\n        );\n      } else {\n        for await (const chunk of chunks) {\n          if (chunk.length > 0) await handle.write(chunk);\n        }\n      }\n    } finally {\n      await handle.close();\n    }\n    if (atomic) {\n      await rename(writePath, filePath);\n    }\n    completed = true;\n  } finally {\n    if (!completed && atomic) {\n      await unlink(writePath).catch(() => {});\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>,\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = uniqueAtomicTempPath(filePath, \"enc-tmp\");\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(\n  dir: string,\n  key: Buffer,\n): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const plaintext = decryptFileBody(buf, key, aad);\n      const tempPath = uniqueAtomicTempPath(filePath, \"dec-tmp\");\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction uniqueAtomicTempPath(filePath: string, label: string): string {\n  return `${filePath}.${label}-${process.pid}-${Date.now()}-${randomUUID()}`;\n}\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir,\n): Promise<string[]> {\n  const results: string[] = [];\n  let names: string[];\n  try {\n    names = await readdir(dir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(dir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, rootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, rootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\nfunction storageAadRootForFile(filePath: string, rootDir: string): string {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return rootDir;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(rootDir, \"namespaces\", parts[1]);\n  }\n  return rootDir;\n}\n\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set([\n  \"facts\",\n  \"corrections\",\n  \"procedures\",\n  \"reasoning-traces\",\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\n  \"state\",\n  \"indexes\",\n  \"index\",\n  \"provenance\",\n]);\n"],"mappings":";;;;;;;;;;;;;;AA6CA,SAAS,gBAAgB,aAAa,kBAAkB;AACxD,SAAS,OAAO,OAAO,QAAQ,UAAU,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC7F,OAAO,UAAU;AAwBV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAU/C,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,gBAAc,QAAQ;AACtB,MAAI;AACF,WAAO,KAAa,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,MAA0B;AAChD,QAAM,MAAM,OAAO,MAAM,IAAI,oBAAoB;AACjD,MAAI,WAAW,kBAAkB,CAAC;AAClC,SAAO,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAC7B,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,6BACpB,UACA,KACA,WACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IAEpE;AAAA,EACF;AACA,QAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,SAAO,gBAAgB,KAAK,KAAK,GAAG;AACtC;AAEA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,UAAQ,MAAM,6BAA6B,UAAU,KAAK,SAAS,GAAG,SAAS,MAAM;AACvF;AAyBA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,qBAAqB,UAAU,KAAK;AACrD,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AAEA,eAAsB,kCACpB,UACA,QACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,YAAY,SAAS,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK;AAC5E,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,WAAW,KAAK,IAAI;AAClD,QAAI;AACF,UAAI,QAAQ,MAAM;AAChB,cAAM,OAAO,aAAa;AAC1B,cAAM,KAAK,YAAY,SAAS;AAChC,cAAM,SAAS,OAAO,MAAM,oBAAoB,oBAAoB;AACpE,oBAAY,KAAK,QAAQ,CAAC;AAC1B,eAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,eAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAC3D,cAAM,iBAAiB;AACvB,eAAO,WAAW,kBAAkB,iBAAiB,gBAAgB,OAAO;AAC5E,aAAK,KAAK,QAAQ,iBAAiB,gBAAgB,IAAI;AACvD,WAAG,KAAK,QAAQ,iBAAiB,gBAAgB,EAAE;AACnD,cAAM,OAAO,MAAM,MAAM;AAEzB,cAAM,SAAS,eAAe,eAAe,KAAK,IAAI,EAAE,eAAe,gBAAgB,CAAC;AACxF,cAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,eAAO,OAAO,OAAO,OAAO,CAAC,eAAe,IAAI,GAAG,GAAG,CAAC,CAAC;AACxD,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,WAAW,EAAG;AACxB,gBAAM,YAAY,OAAO,OAAO,KAAK;AACrC,cAAI,UAAU,SAAS,EAAG,OAAM,OAAO,MAAM,SAAS;AAAA,QACxD;AACA,cAAM,QAAQ,OAAO,MAAM;AAC3B,YAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAC9C,cAAM,UAAU,OAAO,WAAW;AAClC,cAAM,OAAO;AAAA,UACX;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,oBAAoB,gBAAgB;AAAA,QACtC;AAAA,MACF,OAAO;AACL,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAAA,QAChD;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,QAAI,QAAQ;AACV,YAAM,OAAO,WAAW,QAAQ;AAAA,IAClC;AACA,gBAAY;AAAA,EACd,UAAE;AACA,QAAI,CAAC,aAAa,QAAQ;AACxB,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAA,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BACpB,KACA,KACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,KAAK,KAAK,GAAG;AAC/C,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,qBAAqB,UAAkB,OAAuB;AACrE,SAAO,GAAG,QAAQ,IAAI,KAAK,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC;AAC1E;AAOA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,EAAE,UAAU,OAAO,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,KAAK,IAAI;AAChC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,OAAO;AACvE,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,OAAO,GAAG;AAC/C,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,SAAyB;AACxE,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,SAAS,cAAc,MAAM,CAAC,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":["unlink"]}

package/dist/{chunk-W3LR522O.js → chunk-KM2A35EO.js}

@@ -9,27 +9,28 @@ import {
   ProactiveExtractionResultSchema,
   ProactiveQuestionsResultSchema,
   buildProfileConsolidationResultSchema
-} from "./chunk-WW3QQF4H.js";
+} from "./chunk-ROZJACKP.js";
 import {
   normalizeReasoningTrace
 } from "./chunk-54V4BZWP.js";
 import {
   ModelRegistry
-} from "./chunk-QR3C7BKQ.js";
+} from "./chunk-XZ4WBBB5.js";
 import {
   LocalLlmClient
-} from "./chunk-EDTHC6UD.js";
+} from "./chunk-77NAFXUD.js";
 import {
   buildExtensionsFooterForSummary,
   formatDaySummaryMemories,
   loadDaySummaryPrompt
-} from "./chunk-3IQ2TR4N.js";
+} from "./chunk-WLEB7WCG.js";
 import {
   delinearize
 } from "./chunk-VEWZZM3H.js";
 import {
-  FallbackLlmClient
-} from "./chunk-DINWEURR.js";
+  FallbackLlmClient,
+  fallbackLlmRuntimeContextFromConfig
+} from "./chunk-CSKLPDN6.js";
 import {
   buildChatCompletionTokenLimit,
   shouldAssumeOpenAiChatCompletions
@@ -39,10 +40,10 @@ import {
 } from "./chunk-UZB5KHKX.js";
 import {
   applyWorkExtractionBoundary
-} from "./chunk-RRF5UOBJ.js";
+} from "./chunk-EI6V5UXY.js";
 import {
   ProfilingCollector
-} from "./chunk-NBNN5GOB.js";
+} from "./chunk-QY7YA7OL.js";
 import {
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
@@ -106,9 +107,10 @@ var ExtractionEngine = class {
       log.warn("no OpenAI API key \u2014 direct OpenAI client disabled; local and gateway fallback paths remain available");
     }
     this.localLlm = localLlm ?? new LocalLlmClient(config, modelRegistry);
-    this.fallbackLlm = new FallbackLlmClient(gatewayConfig, {
-      workspaceDir: config.workspaceDir
-    });
+    this.fallbackLlm = new FallbackLlmClient(
+      gatewayConfig,
+      fallbackLlmRuntimeContextFromConfig(config)
+    );
     this.modelRegistry = modelRegistry ?? new ModelRegistry(config.memoryDir);
     if (config.modelSource === "gateway") {
       log.debug(
@@ -180,6 +182,9 @@ var ExtractionEngine = class {
   hasExtractionOutputs(result) {
     return result.facts.length > 0 || result.entities.length > 0 || result.questions.length > 0 || result.profileUpdates.length > 0 || (result.relationships?.length ?? 0) > 0;
   }
+  looksLikeExtractionResultPayload(parsed) {
+    return !!parsed && typeof parsed === "object" && !Array.isArray(parsed) && ("facts" in parsed || "entities" in parsed || "profileUpdates" in parsed || "questions" in parsed || "relationships" in parsed || "identityReflection" in parsed);
+  }
   normalizeExtractionResultPayload(parsed) {
     const entities = Array.isArray(parsed?.entities) ? parsed.entities.map((e) => this.normalizeEntityUpdate(e)).filter((e) => e.name.length > 0) : [];
     const facts = Array.isArray(parsed?.facts) ? parsed.facts.map((f) => ({
@@ -1010,33 +1015,30 @@ ${truncatedConversation}`;
     }
     const content = response.content.trim();
     log.debug(`extractWithLocalLlm: got response content, length=${content.length}`);
-    try {
-      for (const candidate of extractJsonCandidates(content)) {
-        try {
-          log.debug(`extractWithLocalLlm: attempting JSON parse, candidate length=${candidate.length}`);
-          const parsed = JSON.parse(candidate);
-          const result = this.normalizeExtractionResultPayload(parsed);
-          log.debug(
-            `extractWithLocalLlm: successfully parsed response, facts=${result.facts.length}, entities=${result.entities.length}, profileUpdates=${result.profileUpdates.length}, questions=${result.questions.length}`
-          );
-          return result;
-        } catch {
+    for (const candidate of extractJsonCandidates(content)) {
+      try {
+        log.debug(`extractWithLocalLlm: attempting JSON parse, candidate length=${candidate.length}`);
+        const parsed = JSON.parse(candidate);
+        if (!this.looksLikeExtractionResultPayload(parsed)) {
+          continue;
         }
-      }
-      return null;
-    } catch (err) {
-      log.debug("extractWithLocalLlm: JSON parse failed, attempting partial extraction...");
-      const partial = this.extractPartialFacts(content);
-      if (partial.facts.length > 0 || partial.entities.length > 0) {
+        const result = this.normalizeExtractionResultPayload(parsed);
         log.debug(
-          `extractWithLocalLlm: extracted ${partial.facts.length} partial facts from truncated JSON`
+          `extractWithLocalLlm: successfully parsed response, facts=${result.facts.length}, entities=${result.entities.length}, profileUpdates=${result.profileUpdates.length}, questions=${result.questions.length}`
         );
-        return partial;
+        return result;
+      } catch {
       }
-      const errMsg = err instanceof Error ? err.message : String(err);
-      log.debug(`extractWithLocalLlm: JSON parse error: ${errMsg}`);
-      return null;
     }
+    log.debug("extractWithLocalLlm: JSON parse failed, attempting partial extraction...");
+    const partial = this.extractPartialFacts(content);
+    if (partial.facts.length > 0 || partial.entities.length > 0) {
+      log.debug(
+        `extractWithLocalLlm: extracted ${partial.facts.length} partial facts from truncated JSON`
+      );
+      return partial;
+    }
+    return null;
   }
   /**
    * Extract memories using direct OpenAI-compatible client (Chat Completions API).
@@ -2293,4 +2295,4 @@ ${memoryList}` }
 export {
   ExtractionEngine
 };
-//# sourceMappingURL=chunk-W3LR522O.js.map
+//# sourceMappingURL=chunk-KM2A35EO.js.map