@remnic/core 1.1.31 → 9.3.515

package/dist/chunk-XSQ4SGM5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contradiction/resolution.ts"],"sourcesContent":["/**\n * Resolution Verbs — executes user-chosen resolution actions on contradiction pairs (issue #520).\n *\n * All resolution paths delegate to StorageManager.supersedeMemory. Do not\n * reimplement supersession logic here (rule 22: deduplicate resolution).\n */\n\nimport type { StorageManager } from \"../storage.js\";\nimport type { MemoryCategory, MemoryFile } from \"../types.js\";\nimport type { ResolutionVerb } from \"./contradiction-review.js\";\nimport { resolvePair, readPair } from \"./contradiction-review.js\";\nimport { log } from \"../logger.js\";\n\nexport interface ResolutionResult {\n  pairId: string;\n  verb: ResolutionVerb;\n  /** Memory IDs affected by the resolution. */\n  affectedIds: string[];\n  /** Human-readable status. */\n  message: string;\n}\n\nexport interface ExecuteResolutionOptions {\n  /** Existing merged memory to supersede both source memories to. */\n  mergedMemoryId?: string;\n  /** Content for a new merged memory. Required for merge when mergedMemoryId is omitted. */\n  mergedContent?: string;\n  /** Category for a newly created merged memory. Defaults to the shared source category, or fact. */\n  mergedCategory?: MemoryCategory;\n  /** Resolve storage for the pair namespace, or the default namespace for legacy unscoped pairs. */\n  storageForNamespace?: (namespace: string | undefined) => StorageManager | Promise<StorageManager>;\n}\n\nconst VALID_VERBS: ResolutionVerb[] = [\"keep-a\", \"keep-b\", \"merge\", \"both-valid\", \"needs-more-context\"];\n\nexport function isValidResolutionVerb(value: string): value is ResolutionVerb {\n  return VALID_VERBS.includes(value as ResolutionVerb);\n}\n\n/**\n * Execute a resolution verb on a contradiction pair.\n *\n * - `keep-a`: Supersede B, keep A active.\n * - `keep-b`: Supersede A, keep B active.\n * - `merge`: Create or verify a real merged memory, then supersede both inputs.\n * - `both-valid`: Mark pair as reviewed; no memories are superseded.\n * - `needs-more-context`: Defer; no action, short cooldown.\n */\nexport async function executeResolution(\n  memoryDir: string,\n  storage: StorageManager,\n  pairId: string,\n  verb: ResolutionVerb,\n  options: ExecuteResolutionOptions = {},\n): Promise<ResolutionResult> {\n  if (typeof verb !== \"string\" || !isValidResolutionVerb(verb)) {\n    throw new Error(`Invalid contradiction resolution verb: ${String(verb)}`);\n  }\n\n  const pair = readPair(memoryDir, pairId);\n  if (!pair) {\n    return { pairId, verb, affectedIds: [], message: `Pair ${pairId} not found` };\n  }\n\n  if (pair.namespace && !options.storageForNamespace) {\n    throw new Error(\n      \"contradiction resolution requires storageForNamespace for namespaced pairs so callers resolve the correct namespace storage\",\n    );\n  }\n\n  const resolutionStorage = options.storageForNamespace\n    ? await options.storageForNamespace(pair.namespace)\n    : storage;\n\n  if (pair.resolution && pair.resolution !== \"needs-more-context\") {\n    return { pairId, verb, affectedIds: [], message: `Pair already resolved with verb \"${pair.resolution}\"` };\n  }\n\n  const [idA, idB] = pair.memoryIds;\n  const affectedIds: string[] = [];\n  let message = \"\";\n  let supersedeFailed = false;\n  let rollbackAfterResolveFailure: (() => Promise<boolean>) | null = null;\n\n  switch (verb) {\n    case \"keep-a\": {\n      const keepTarget = await validateKeepTarget(resolutionStorage, pairId, idA);\n      if (!keepTarget.ok) {\n        supersedeFailed = true;\n        message = keepTarget.message;\n        break;\n      }\n      const sourceB = await loadSourceSnapshot(resolutionStorage, idB);\n      const ok = sourceB\n        ? await supersedeSafe(resolutionStorage, idB, idA, \"contradiction-resolution:keep-a\")\n        : false;\n      if (ok) {\n        affectedIds.push(idB);\n        rollbackAfterResolveFailure = async () =>\n          restoreMemorySnapshot(resolutionStorage, sourceB!, \"contradiction-resolution:keep-a-rollback\");\n        message = `Kept ${idA}, superseded ${idB}`;\n      }\n      else {\n        supersedeFailed = true;\n        const rolledBack = sourceB\n          ? await restoreMemorySnapshot(resolutionStorage, sourceB, \"contradiction-resolution:keep-a-rollback\")\n          : false;\n        message = rolledBack\n          ? `Supersede failed for ${idB}; restored ${idB} and did not resolve`\n          : `Supersede failed for ${idB}; rollback incomplete for ${idB} and pair is not resolved`;\n      }\n      break;\n    }\n    case \"keep-b\": {\n      const keepTarget = await validateKeepTarget(resolutionStorage, pairId, idB);\n      if (!keepTarget.ok) {\n        supersedeFailed = true;\n        message = keepTarget.message;\n        break;\n      }\n      const sourceA = await loadSourceSnapshot(resolutionStorage, idA);\n      const ok = sourceA\n        ? await supersedeSafe(resolutionStorage, idA, idB, \"contradiction-resolution:keep-b\")\n        : false;\n      if (ok) {\n        affectedIds.push(idA);\n        rollbackAfterResolveFailure = async () =>\n          restoreMemorySnapshot(resolutionStorage, sourceA!, \"contradiction-resolution:keep-b-rollback\");\n        message = `Kept ${idB}, superseded ${idA}`;\n      }\n      else {\n        supersedeFailed = true;\n        const rolledBack = sourceA\n          ? await restoreMemorySnapshot(resolutionStorage, sourceA, \"contradiction-resolution:keep-b-rollback\")\n          : false;\n        message = rolledBack\n          ? `Supersede failed for ${idA}; restored ${idA} and did not resolve`\n          : `Supersede failed for ${idA}; rollback incomplete for ${idA} and pair is not resolved`;\n      }\n      break;\n    }\n    case \"merge\": {\n      const replacement = await prepareMergeReplacement(resolutionStorage, pairId, idA, idB, options);\n      if (!replacement.ok) {\n        supersedeFailed = true;\n        message = replacement.message;\n        break;\n      }\n\n      const okA = await supersedeSafe(resolutionStorage, idA, replacement.mergedId, \"contradiction-resolution:merge\");\n      if (!okA) {\n        supersedeFailed = true;\n        const rolledBackA = await restoreMemorySnapshot(resolutionStorage, replacement.sourceA);\n        message = rolledBackA\n          ? `Merge failed for ${idA}; restored ${idA} and did not resolve`\n          : `Merge failed for ${idA}; rollback incomplete for ${idA} and pair is not resolved`;\n        if (rolledBackA) {\n          await cleanupCreatedReplacement(resolutionStorage, replacement);\n        }\n        break;\n      }\n\n      const okB = await supersedeSafe(resolutionStorage, idB, replacement.mergedId, \"contradiction-resolution:merge\");\n      if (!okB) {\n        supersedeFailed = true;\n        const rolledBackA = await restoreMemorySnapshot(resolutionStorage, replacement.sourceA);\n        const rolledBackB = await restoreMemorySnapshot(resolutionStorage, replacement.sourceB);\n        message = rolledBackA && rolledBackB\n          ? `Merge failed for ${idB}; restored ${idA} and ${idB} and did not resolve`\n          : `Merge failed for ${idB}; rollback incomplete for ${[\n            rolledBackA ? undefined : idA,\n            rolledBackB ? undefined : idB,\n          ].filter(Boolean).join(\", \")} and pair is not resolved`;\n        if (rolledBackA && rolledBackB) {\n          await cleanupCreatedReplacement(resolutionStorage, replacement);\n        }\n        break;\n      }\n\n      affectedIds.push(idA, idB);\n      rollbackAfterResolveFailure = async () => {\n        const rolledBackA = await restoreMemorySnapshot(resolutionStorage, replacement.sourceA);\n        const rolledBackB = await restoreMemorySnapshot(resolutionStorage, replacement.sourceB);\n        if (rolledBackA && rolledBackB) {\n          await cleanupCreatedReplacement(resolutionStorage, replacement);\n        }\n        return rolledBackA && rolledBackB;\n      };\n      message = `Both memories superseded by merged ${replacement.mergedId}`;\n      break;\n    }\n    case \"both-valid\": {\n      message = \"Pair marked as both-valid; cooldown applied\";\n      break;\n    }\n    case \"needs-more-context\": {\n      message = \"Deferred; no action taken, short cooldown applied\";\n      break;\n    }\n  }\n\n  if (!supersedeFailed) {\n    let resolved = false;\n    try {\n      resolved = resolvePair(memoryDir, pairId, verb) !== null;\n    } catch (err) {\n      log.warn(\n        \"[contradiction-resolution] failed to persist pair=%s verb=%s: %s\",\n        pairId,\n        verb,\n        err instanceof Error ? err.message : err,\n      );\n    }\n    if (!resolved) {\n      if (rollbackAfterResolveFailure) {\n        const rolledBack = await rollbackAfterResolveFailure();\n        affectedIds.length = 0;\n        message = rolledBack\n          ? `Resolution persistence failed; rolled back memory changes and did not resolve ${pairId}`\n          : `Resolution persistence failed; rollback incomplete and pair is not resolved`;\n      } else {\n        message = `Resolution persistence failed; pair is not resolved`;\n      }\n    }\n  }\n  log.info(\"[contradiction-resolution] pair=%s verb=%s affected=%d\", pairId, verb, affectedIds.length);\n  return { pairId, verb, affectedIds, message };\n}\n\ntype MergeReplacement =\n  | {\n      ok: true;\n      mergedId: string;\n      sourceA: MemoryFile;\n      sourceB: MemoryFile;\n      created: boolean;\n    }\n  | {\n      ok: false;\n      message: string;\n    };\n\nasync function prepareMergeReplacement(\n  storage: StorageManager,\n  pairId: string,\n  idA: string,\n  idB: string,\n  options: ExecuteResolutionOptions,\n): Promise<MergeReplacement> {\n  const sourceA = await storage.getMemoryById(idA);\n  const sourceB = await storage.getMemoryById(idB);\n  if (!sourceA || !sourceB) {\n    return { ok: false, message: `Merge requires both source memories to exist; not resolving ${pairId}` };\n  }\n\n  const requestedMergedId = options.mergedMemoryId?.trim();\n  if (requestedMergedId) {\n    if (requestedMergedId === idA || requestedMergedId === idB) {\n      return { ok: false, message: \"Merge replacement must be distinct from both source memories; not resolving\" };\n    }\n    const replacement = await storage.getMemoryById(requestedMergedId);\n    if (!replacement) {\n      return { ok: false, message: `Merged memory ${requestedMergedId} not found; not resolving` };\n    }\n    const replacementStatus = replacement.frontmatter.status ?? \"active\";\n    if (replacementStatus !== \"active\") {\n      return {\n        ok: false,\n        message: `Merged memory ${requestedMergedId} is ${replacementStatus}; not resolving`,\n      };\n    }\n    return { ok: true, mergedId: requestedMergedId, sourceA, sourceB, created: false };\n  }\n\n  const mergedContent = options.mergedContent;\n  if (typeof mergedContent !== \"string\" || mergedContent.trim().length === 0) {\n    return {\n      ok: false,\n      message: \"Merge requires mergedMemoryId or mergedContent; no memories changed\",\n    };\n  }\n\n  const category = options.mergedCategory ?? mergedMemoryCategory(sourceA, sourceB);\n  let mergedId: string;\n  try {\n    mergedId = await storage.writeMemory(category, mergedContent, {\n      actor: \"contradiction-resolution\",\n      confidence: Math.min(sourceA.frontmatter.confidence ?? 0.8, sourceB.frontmatter.confidence ?? 0.8),\n      tags: [\"contradiction-resolution\", \"merge\"],\n      source: \"contradiction-resolution\",\n      lineage: [idA, idB],\n      derivedVia: \"merge\",\n    });\n  } catch (err) {\n    log.warn(\n      \"[contradiction-resolution] merged memory creation failed for %s: %s\",\n      pairId,\n      err instanceof Error ? err.message : err,\n    );\n    return { ok: false, message: `Merged memory could not be created; not resolving ${pairId}` };\n  }\n  const replacement = await storage.getMemoryById(mergedId);\n  if (!replacement) {\n    await cleanupMemoryId(storage, mergedId);\n    return { ok: false, message: `Merged memory ${mergedId} could not be verified; not resolving` };\n  }\n  return { ok: true, mergedId, sourceA, sourceB, created: true };\n}\n\nfunction mergedMemoryCategory(sourceA: MemoryFile, sourceB: MemoryFile): MemoryCategory {\n  return sourceA.frontmatter.category === sourceB.frontmatter.category\n    ? sourceA.frontmatter.category\n    : \"fact\";\n}\n\ntype KeepTargetValidation =\n  | { ok: true }\n  | { ok: false; message: string };\n\nasync function validateKeepTarget(\n  storage: StorageManager,\n  pairId: string,\n  keepId: string,\n): Promise<KeepTargetValidation> {\n  const target = await loadSourceSnapshot(storage, keepId);\n  if (!target) {\n    return { ok: false, message: `Kept memory ${keepId} not found; not resolving ${pairId}` };\n  }\n\n  const status = target.frontmatter.status ?? \"active\";\n  if (status !== \"active\") {\n    return { ok: false, message: `Kept memory ${keepId} is ${status}; not resolving ${pairId}` };\n  }\n\n  return { ok: true };\n}\n\nasync function loadSourceSnapshot(storage: StorageManager, memoryId: string): Promise<MemoryFile | null> {\n  try {\n    return await storage.getMemoryById(memoryId);\n  } catch (err) {\n    log.warn(\n      \"[contradiction-resolution] source snapshot failed for %s: %s\",\n      memoryId,\n      err instanceof Error ? err.message : err,\n    );\n    return null;\n  }\n}\n\nasync function restoreMemorySnapshot(\n  storage: StorageManager,\n  memory: MemoryFile,\n  reasonCode = \"contradiction-resolution:merge-rollback\",\n): Promise<boolean> {\n  try {\n    const current = await storage.getMemoryById(memory.frontmatter.id);\n    if (!current) return false;\n    const restoredFrontmatter: Partial<MemoryFile[\"frontmatter\"]> = {\n      ...memory.frontmatter,\n      status: memory.frontmatter.status,\n      supersededBy: memory.frontmatter.supersededBy,\n      supersededAt: memory.frontmatter.supersededAt,\n    };\n    return await storage.writeMemoryFrontmatter(current, restoredFrontmatter, {\n      actor: \"contradiction-resolution\",\n      reasonCode,\n    });\n  } catch (err) {\n    log.warn(\n      \"[contradiction-resolution] rollback failed for %s: %s\",\n      memory.frontmatter.id,\n      err instanceof Error ? err.message : err,\n    );\n    return false;\n  }\n}\n\nasync function cleanupCreatedReplacement(storage: StorageManager, replacement: Extract<MergeReplacement, { ok: true }>): Promise<void> {\n  if (!replacement.created) return;\n  await cleanupMemoryId(storage, replacement.mergedId);\n}\n\nasync function cleanupMemoryId(storage: StorageManager, memoryId: string): Promise<void> {\n  try {\n    const memory = await storage.getMemoryById(memoryId);\n    const invalidated = await storage.invalidateMemory(memoryId);\n    if (invalidated && memory?.frontmatter.category === \"fact\") {\n      await storage.removeFactContentHashesForMemories([memory]);\n    }\n  } catch (err) {\n    log.warn(\n      \"[contradiction-resolution] cleanup failed for merged memory %s: %s\",\n      memoryId,\n      err instanceof Error ? err.message : err,\n    );\n  }\n}\n\nasync function supersedeSafe(\n  storage: StorageManager,\n  oldId: string,\n  newId: string,\n  reason: string,\n): Promise<boolean> {\n  try {\n    const result = await storage.supersedeMemory(oldId, newId, reason);\n    if (result === false) {\n      log.warn(\"[contradiction-resolution] supersede returned false for %s → %s\", oldId, newId);\n      return false;\n    }\n    return true;\n  } catch (err) {\n    log.warn(\n      \"[contradiction-resolution] supersede failed %s → %s: %s\",\n      oldId,\n      newId,\n      err instanceof Error ? err.message : err,\n    );\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;AAiCA,IAAM,cAAgC,CAAC,UAAU,UAAU,SAAS,cAAc,oBAAoB;AAE/F,SAAS,sBAAsB,OAAwC;AAC5E,SAAO,YAAY,SAAS,KAAuB;AACrD;AAWA,eAAsB,kBACpB,WACA,SACA,QACA,MACA,UAAoC,CAAC,GACV;AAC3B,MAAI,OAAO,SAAS,YAAY,CAAC,sBAAsB,IAAI,GAAG;AAC5D,UAAM,IAAI,MAAM,0CAA0C,OAAO,IAAI,CAAC,EAAE;AAAA,EAC1E;AAEA,QAAM,OAAO,SAAS,WAAW,MAAM;AACvC,MAAI,CAAC,MAAM;AACT,WAAO,EAAE,QAAQ,MAAM,aAAa,CAAC,GAAG,SAAS,QAAQ,MAAM,aAAa;AAAA,EAC9E;AAEA,MAAI,KAAK,aAAa,CAAC,QAAQ,qBAAqB;AAClD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,oBAAoB,QAAQ,sBAC9B,MAAM,QAAQ,oBAAoB,KAAK,SAAS,IAChD;AAEJ,MAAI,KAAK,cAAc,KAAK,eAAe,sBAAsB;AAC/D,WAAO,EAAE,QAAQ,MAAM,aAAa,CAAC,GAAG,SAAS,oCAAoC,KAAK,UAAU,IAAI;AAAA,EAC1G;AAEA,QAAM,CAAC,KAAK,GAAG,IAAI,KAAK;AACxB,QAAM,cAAwB,CAAC;AAC/B,MAAI,UAAU;AACd,MAAI,kBAAkB;AACtB,MAAI,8BAA+D;AAEnE,UAAQ,MAAM;AAAA,IACZ,KAAK,UAAU;AACb,YAAM,aAAa,MAAM,mBAAmB,mBAAmB,QAAQ,GAAG;AAC1E,UAAI,CAAC,WAAW,IAAI;AAClB,0BAAkB;AAClB,kBAAU,WAAW;AACrB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,mBAAmB,mBAAmB,GAAG;AAC/D,YAAM,KAAK,UACP,MAAM,cAAc,mBAAmB,KAAK,KAAK,iCAAiC,IAClF;AACJ,UAAI,IAAI;AACN,oBAAY,KAAK,GAAG;AACpB,sCAA8B,YAC5B,sBAAsB,mBAAmB,SAAU,0CAA0C;AAC/F,kBAAU,QAAQ,GAAG,gBAAgB,GAAG;AAAA,MAC1C,OACK;AACH,0BAAkB;AAClB,cAAM,aAAa,UACf,MAAM,sBAAsB,mBAAmB,SAAS,0CAA0C,IAClG;AACJ,kBAAU,aACN,wBAAwB,GAAG,cAAc,GAAG,yBAC5C,wBAAwB,GAAG,6BAA6B,GAAG;AAAA,MACjE;AACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU;AACb,YAAM,aAAa,MAAM,mBAAmB,mBAAmB,QAAQ,GAAG;AAC1E,UAAI,CAAC,WAAW,IAAI;AAClB,0BAAkB;AAClB,kBAAU,WAAW;AACrB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,mBAAmB,mBAAmB,GAAG;AAC/D,YAAM,KAAK,UACP,MAAM,cAAc,mBAAmB,KAAK,KAAK,iCAAiC,IAClF;AACJ,UAAI,IAAI;AACN,oBAAY,KAAK,GAAG;AACpB,sCAA8B,YAC5B,sBAAsB,mBAAmB,SAAU,0CAA0C;AAC/F,kBAAU,QAAQ,GAAG,gBAAgB,GAAG;AAAA,MAC1C,OACK;AACH,0BAAkB;AAClB,cAAM,aAAa,UACf,MAAM,sBAAsB,mBAAmB,SAAS,0CAA0C,IAClG;AACJ,kBAAU,aACN,wBAAwB,GAAG,cAAc,GAAG,yBAC5C,wBAAwB,GAAG,6BAA6B,GAAG;AAAA,MACjE;AACA;AAAA,IACF;AAAA,IACA,KAAK,SAAS;AACZ,YAAM,cAAc,MAAM,wBAAwB,mBAAmB,QAAQ,KAAK,KAAK,OAAO;AAC9F,UAAI,CAAC,YAAY,IAAI;AACnB,0BAAkB;AAClB,kBAAU,YAAY;AACtB;AAAA,MACF;AAEA,YAAM,MAAM,MAAM,cAAc,mBAAmB,KAAK,YAAY,UAAU,gCAAgC;AAC9G,UAAI,CAAC,KAAK;AACR,0BAAkB;AAClB,cAAM,cAAc,MAAM,sBAAsB,mBAAmB,YAAY,OAAO;AACtF,kBAAU,cACN,oBAAoB,GAAG,cAAc,GAAG,yBACxC,oBAAoB,GAAG,6BAA6B,GAAG;AAC3D,YAAI,aAAa;AACf,gBAAM,0BAA0B,mBAAmB,WAAW;AAAA,QAChE;AACA;AAAA,MACF;AAEA,YAAM,MAAM,MAAM,cAAc,mBAAmB,KAAK,YAAY,UAAU,gCAAgC;AAC9G,UAAI,CAAC,KAAK;AACR,0BAAkB;AAClB,cAAM,cAAc,MAAM,sBAAsB,mBAAmB,YAAY,OAAO;AACtF,cAAM,cAAc,MAAM,sBAAsB,mBAAmB,YAAY,OAAO;AACtF,kBAAU,eAAe,cACrB,oBAAoB,GAAG,cAAc,GAAG,QAAQ,GAAG,yBACnD,oBAAoB,GAAG,6BAA6B;AAAA,UACpD,cAAc,SAAY;AAAA,UAC1B,cAAc,SAAY;AAAA,QAC5B,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAC9B,YAAI,eAAe,aAAa;AAC9B,gBAAM,0BAA0B,mBAAmB,WAAW;AAAA,QAChE;AACA;AAAA,MACF;AAEA,kBAAY,KAAK,KAAK,GAAG;AACzB,oCAA8B,YAAY;AACxC,cAAM,cAAc,MAAM,sBAAsB,mBAAmB,YAAY,OAAO;AACtF,cAAM,cAAc,MAAM,sBAAsB,mBAAmB,YAAY,OAAO;AACtF,YAAI,eAAe,aAAa;AAC9B,gBAAM,0BAA0B,mBAAmB,WAAW;AAAA,QAChE;AACA,eAAO,eAAe;AAAA,MACxB;AACA,gBAAU,sCAAsC,YAAY,QAAQ;AACpE;AAAA,IACF;AAAA,IACA,KAAK,cAAc;AACjB,gBAAU;AACV;AAAA,IACF;AAAA,IACA,KAAK,sBAAsB;AACzB,gBAAU;AACV;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,iBAAiB;AACpB,QAAI,WAAW;AACf,QAAI;AACF,iBAAW,YAAY,WAAW,QAAQ,IAAI,MAAM;AAAA,IACtD,SAAS,KAAK;AACZ,UAAI;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AAAA,IACF;AACA,QAAI,CAAC,UAAU;AACb,UAAI,6BAA6B;AAC/B,cAAM,aAAa,MAAM,4BAA4B;AACrD,oBAAY,SAAS;AACrB,kBAAU,aACN,iFAAiF,MAAM,KACvF;AAAA,MACN,OAAO;AACL,kBAAU;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,0DAA0D,QAAQ,MAAM,YAAY,MAAM;AACnG,SAAO,EAAE,QAAQ,MAAM,aAAa,QAAQ;AAC9C;AAeA,eAAe,wBACb,SACA,QACA,KACA,KACA,SAC2B;AAC3B,QAAM,UAAU,MAAM,QAAQ,cAAc,GAAG;AAC/C,QAAM,UAAU,MAAM,QAAQ,cAAc,GAAG;AAC/C,MAAI,CAAC,WAAW,CAAC,SAAS;AACxB,WAAO,EAAE,IAAI,OAAO,SAAS,+DAA+D,MAAM,GAAG;AAAA,EACvG;AAEA,QAAM,oBAAoB,QAAQ,gBAAgB,KAAK;AACvD,MAAI,mBAAmB;AACrB,QAAI,sBAAsB,OAAO,sBAAsB,KAAK;AAC1D,aAAO,EAAE,IAAI,OAAO,SAAS,8EAA8E;AAAA,IAC7G;AACA,UAAMA,eAAc,MAAM,QAAQ,cAAc,iBAAiB;AACjE,QAAI,CAACA,cAAa;AAChB,aAAO,EAAE,IAAI,OAAO,SAAS,iBAAiB,iBAAiB,4BAA4B;AAAA,IAC7F;AACA,UAAM,oBAAoBA,aAAY,YAAY,UAAU;AAC5D,QAAI,sBAAsB,UAAU;AAClC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,SAAS,iBAAiB,iBAAiB,OAAO,iBAAiB;AAAA,MACrE;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,UAAU,mBAAmB,SAAS,SAAS,SAAS,MAAM;AAAA,EACnF;AAEA,QAAM,gBAAgB,QAAQ;AAC9B,MAAI,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,WAAW,GAAG;AAC1E,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,kBAAkB,qBAAqB,SAAS,OAAO;AAChF,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,YAAY,UAAU,eAAe;AAAA,MAC5D,OAAO;AAAA,MACP,YAAY,KAAK,IAAI,QAAQ,YAAY,cAAc,KAAK,QAAQ,YAAY,cAAc,GAAG;AAAA,MACjG,MAAM,CAAC,4BAA4B,OAAO;AAAA,MAC1C,QAAQ;AAAA,MACR,SAAS,CAAC,KAAK,GAAG;AAAA,MAClB,YAAY;AAAA,IACd,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AACA,WAAO,EAAE,IAAI,OAAO,SAAS,qDAAqD,MAAM,GAAG;AAAA,EAC7F;AACA,QAAM,cAAc,MAAM,QAAQ,cAAc,QAAQ;AACxD,MAAI,CAAC,aAAa;AAChB,UAAM,gBAAgB,SAAS,QAAQ;AACvC,WAAO,EAAE,IAAI,OAAO,SAAS,iBAAiB,QAAQ,wCAAwC;AAAA,EAChG;AACA,SAAO,EAAE,IAAI,MAAM,UAAU,SAAS,SAAS,SAAS,KAAK;AAC/D;AAEA,SAAS,qBAAqB,SAAqB,SAAqC;AACtF,SAAO,QAAQ,YAAY,aAAa,QAAQ,YAAY,WACxD,QAAQ,YAAY,WACpB;AACN;AAMA,eAAe,mBACb,SACA,QACA,QAC+B;AAC/B,QAAM,SAAS,MAAM,mBAAmB,SAAS,MAAM;AACvD,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,SAAS,eAAe,MAAM,6BAA6B,MAAM,GAAG;AAAA,EAC1F;AAEA,QAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,MAAI,WAAW,UAAU;AACvB,WAAO,EAAE,IAAI,OAAO,SAAS,eAAe,MAAM,OAAO,MAAM,mBAAmB,MAAM,GAAG;AAAA,EAC7F;AAEA,SAAO,EAAE,IAAI,KAAK;AACpB;AAEA,eAAe,mBAAmB,SAAyB,UAA8C;AACvG,MAAI;AACF,WAAO,MAAM,QAAQ,cAAc,QAAQ;AAAA,EAC7C,SAAS,KAAK;AACZ,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAe,sBACb,SACA,QACA,aAAa,2CACK;AAClB,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,cAAc,OAAO,YAAY,EAAE;AACjE,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,sBAA0D;AAAA,MAC9D,GAAG,OAAO;AAAA,MACV,QAAQ,OAAO,YAAY;AAAA,MAC3B,cAAc,OAAO,YAAY;AAAA,MACjC,cAAc,OAAO,YAAY;AAAA,IACnC;AACA,WAAO,MAAM,QAAQ,uBAAuB,SAAS,qBAAqB;AAAA,MACxE,OAAO;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI;AAAA,MACF;AAAA,MACA,OAAO,YAAY;AAAA,MACnB,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAe,0BAA0B,SAAyB,aAAqE;AACrI,MAAI,CAAC,YAAY,QAAS;AAC1B,QAAM,gBAAgB,SAAS,YAAY,QAAQ;AACrD;AAEA,eAAe,gBAAgB,SAAyB,UAAiC;AACvF,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,cAAc,QAAQ;AACnD,UAAM,cAAc,MAAM,QAAQ,iBAAiB,QAAQ;AAC3D,QAAI,eAAe,QAAQ,YAAY,aAAa,QAAQ;AAC1D,YAAM,QAAQ,mCAAmC,CAAC,MAAM,CAAC;AAAA,IAC3D;AAAA,EACF,SAAS,KAAK;AACZ,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AAAA,EACF;AACF;AAEA,eAAe,cACb,SACA,OACA,OACA,QACkB;AAClB,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,gBAAgB,OAAO,OAAO,MAAM;AACjE,QAAI,WAAW,OAAO;AACpB,UAAI,KAAK,wEAAmE,OAAO,KAAK;AACxF,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,QAAQ,IAAI,UAAU;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AACF;","names":["replacement"]}

package/dist/{chunk-66DHUKLO.js → chunk-XSWKORGM.js}

@@ -8,12 +8,12 @@ import {
 import {
   computeTransferOutputRel,
   isTransferPathExcluded
-} from "./chunk-I6K5FBRQ.js";
+} from "./chunk-UI3NYK34.js";
 import {
   listFilesRecursive,
   readUtf8FileStrict,
   toPosixRelPath
-} from "./chunk-AGZQD76C.js";
+} from "./chunk-GCGJW34D.js";
 
 // src/transfer/export-sqlite.ts
 import path from "path";
@@ -23,28 +23,30 @@ async function exportSqlite(opts) {
   const outAbs = path.resolve(opts.outFile);
   const outputRelPosix = computeTransferOutputRel(memDirAbs, outAbs);
   const filesAbs = await listFilesRecursive(memDirAbs);
+  const rows = [];
+  for (const abs of filesAbs) {
+    const relPosix = toPosixRelPath(abs, memDirAbs);
+    if (isTransferPathExcluded(relPosix, { includeTranscripts, outputRelPosix })) continue;
+    const { content, sha256, bytes } = await readUtf8FileStrict(abs);
+    rows.push({ rel: relPosix, bytes, sha256, content });
+  }
   const db = openBetterSqlite3(outAbs);
   try {
     db.exec("PRAGMA journal_mode=WAL;");
     db.exec(SQLITE_TABLES_SQL);
     const insertMeta = db.prepare("INSERT OR REPLACE INTO meta(key,value) VALUES (?,?)");
-    insertMeta.run("schemaVersion", String(SQLITE_SCHEMA_VERSION));
-    insertMeta.run("createdAt", (/* @__PURE__ */ new Date()).toISOString());
-    insertMeta.run("pluginVersion", opts.pluginVersion);
-    insertMeta.run("includesTranscripts", includeTranscripts ? "true" : "false");
     const insertFile = db.prepare(
       "INSERT OR REPLACE INTO files(path_rel, bytes, sha256, content) VALUES (?,?,?,?)"
     );
     const tx = db.transaction((rows2) => {
+      db.prepare("DELETE FROM meta").run();
+      db.prepare("DELETE FROM files").run();
+      insertMeta.run("schemaVersion", String(SQLITE_SCHEMA_VERSION));
+      insertMeta.run("createdAt", (/* @__PURE__ */ new Date()).toISOString());
+      insertMeta.run("pluginVersion", opts.pluginVersion);
+      insertMeta.run("includesTranscripts", includeTranscripts ? "true" : "false");
       for (const r of rows2) insertFile.run(r.rel, r.bytes, r.sha256, r.content);
     });
-    const rows = [];
-    for (const abs of filesAbs) {
-      const relPosix = toPosixRelPath(abs, memDirAbs);
-      if (isTransferPathExcluded(relPosix, { includeTranscripts, outputRelPosix })) continue;
-      const { content, sha256, bytes } = await readUtf8FileStrict(abs);
-      rows.push({ rel: relPosix, bytes, sha256, content });
-    }
     tx(rows);
   } finally {
     db.close();
@@ -54,4 +56,4 @@ async function exportSqlite(opts) {
 export {
   exportSqlite
 };
-//# sourceMappingURL=chunk-66DHUKLO.js.map
+//# sourceMappingURL=chunk-XSWKORGM.js.map

package/dist/chunk-XSWKORGM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/transfer/export-sqlite.ts"],"sourcesContent":["import path from \"node:path\";\nimport { SQLITE_SCHEMA_VERSION, SQLITE_TABLES_SQL } from \"./sqlite-schema.js\";\nimport { listFilesRecursive, readUtf8FileStrict, toPosixRelPath } from \"./fs-utils.js\";\nimport { openBetterSqlite3 } from \"../runtime/better-sqlite.js\";\nimport { computeTransferOutputRel, isTransferPathExcluded } from \"./exclusions.js\";\n\nexport interface ExportSqliteOptions {\n  memoryDir: string;\n  outFile: string;\n  includeTranscripts?: boolean;\n  pluginVersion: string;\n}\n\nexport async function exportSqlite(opts: ExportSqliteOptions): Promise<void> {\n  const includeTranscripts = opts.includeTranscripts === true;\n  const memDirAbs = path.resolve(opts.memoryDir);\n  const outAbs = path.resolve(opts.outFile);\n  const outputRelPosix = computeTransferOutputRel(memDirAbs, outAbs);\n\n  const filesAbs = await listFilesRecursive(memDirAbs);\n  const rows: Array<{ rel: string; bytes: number; sha256: string; content: string }> = [];\n  for (const abs of filesAbs) {\n    const relPosix = toPosixRelPath(abs, memDirAbs);\n    if (isTransferPathExcluded(relPosix, { includeTranscripts, outputRelPosix })) continue;\n    const { content, sha256, bytes } = await readUtf8FileStrict(abs);\n    rows.push({ rel: relPosix, bytes, sha256, content });\n  }\n\n  const db = openBetterSqlite3(outAbs);\n  try {\n    db.exec(\"PRAGMA journal_mode=WAL;\");\n    db.exec(SQLITE_TABLES_SQL);\n\n    const insertMeta = db.prepare(\"INSERT OR REPLACE INTO meta(key,value) VALUES (?,?)\");\n    const insertFile = db.prepare(\n      \"INSERT OR REPLACE INTO files(path_rel, bytes, sha256, content) VALUES (?,?,?,?)\",\n    );\n\n    const tx = db.transaction((rows: Array<{ rel: string; bytes: number; sha256: string; content: string }>) => {\n      db.prepare(\"DELETE FROM meta\").run();\n      db.prepare(\"DELETE FROM files\").run();\n      insertMeta.run(\"schemaVersion\", String(SQLITE_SCHEMA_VERSION));\n      insertMeta.run(\"createdAt\", new Date().toISOString());\n      insertMeta.run(\"pluginVersion\", opts.pluginVersion);\n      insertMeta.run(\"includesTranscripts\", includeTranscripts ? \"true\" : \"false\");\n      for (const r of rows) insertFile.run(r.rel, r.bytes, r.sha256, r.content);\n    });\n\n    tx(rows);\n  } finally {\n    db.close();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AAajB,eAAsB,aAAa,MAA0C;AAC3E,QAAM,qBAAqB,KAAK,uBAAuB;AACvD,QAAM,YAAY,KAAK,QAAQ,KAAK,SAAS;AAC7C,QAAM,SAAS,KAAK,QAAQ,KAAK,OAAO;AACxC,QAAM,iBAAiB,yBAAyB,WAAW,MAAM;AAEjE,QAAM,WAAW,MAAM,mBAAmB,SAAS;AACnD,QAAM,OAA+E,CAAC;AACtF,aAAW,OAAO,UAAU;AAC1B,UAAM,WAAW,eAAe,KAAK,SAAS;AAC9C,QAAI,uBAAuB,UAAU,EAAE,oBAAoB,eAAe,CAAC,EAAG;AAC9E,UAAM,EAAE,SAAS,QAAQ,MAAM,IAAI,MAAM,mBAAmB,GAAG;AAC/D,SAAK,KAAK,EAAE,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,EACrD;AAEA,QAAM,KAAK,kBAAkB,MAAM;AACnC,MAAI;AACF,OAAG,KAAK,0BAA0B;AAClC,OAAG,KAAK,iBAAiB;AAEzB,UAAM,aAAa,GAAG,QAAQ,qDAAqD;AACnF,UAAM,aAAa,GAAG;AAAA,MACpB;AAAA,IACF;AAEA,UAAM,KAAK,GAAG,YAAY,CAACA,UAAiF;AAC1G,SAAG,QAAQ,kBAAkB,EAAE,IAAI;AACnC,SAAG,QAAQ,mBAAmB,EAAE,IAAI;AACpC,iBAAW,IAAI,iBAAiB,OAAO,qBAAqB,CAAC;AAC7D,iBAAW,IAAI,cAAa,oBAAI,KAAK,GAAE,YAAY,CAAC;AACpD,iBAAW,IAAI,iBAAiB,KAAK,aAAa;AAClD,iBAAW,IAAI,uBAAuB,qBAAqB,SAAS,OAAO;AAC3E,iBAAW,KAAKA,MAAM,YAAW,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;AAAA,IAC1E,CAAC;AAED,OAAG,IAAI;AAAA,EACT,UAAE;AACA,OAAG,MAAM;AAAA,EACX;AACF;","names":["rows"]}

package/dist/{chunk-QR3C7BKQ.js → chunk-XZ4WBBB5.js}

@@ -177,25 +177,24 @@ var ModelRegistry = class {
    */
   calculateContextSizes(modelId, maxContextOverride) {
     const caps = this.getCapabilities(modelId);
-    const effectiveContextWindow = maxContextOverride ?? caps.contextWindow;
+    const sanitizedOverride = typeof maxContextOverride === "number" && Number.isFinite(maxContextOverride) && Number.isInteger(maxContextOverride) && maxContextOverride >= 1024 ? maxContextOverride : void 0;
+    const effectiveContextWindow = sanitizedOverride ?? Math.max(1024, Math.floor(caps.contextWindow));
     const overheadTokens = Math.min(1e3, Math.floor(effectiveContextWindow / 10));
     const minInputTokens = Math.min(512, Math.floor(effectiveContextWindow / 4));
-    const minOutputTokens = 256;
+    const minOutputTokens = Math.min(256, Math.max(1, effectiveContextWindow - overheadTokens - minInputTokens));
     let outputTokens = caps.typicalOutputTokens;
     if (effectiveContextWindow > 65536) {
       outputTokens = Math.min(Math.floor(effectiveContextWindow / 8), 16384);
     }
     outputTokens = Math.min(outputTokens, Math.floor(effectiveContextWindow / 4));
-    outputTokens = Math.max(
-      minOutputTokens,
-      Math.min(outputTokens, effectiveContextWindow - overheadTokens - minInputTokens)
-    );
+    const maxOutputTokens = Math.max(1, effectiveContextWindow - overheadTokens - minInputTokens);
+    outputTokens = Math.min(maxOutputTokens, Math.max(minOutputTokens, outputTokens));
     const availableForInput = Math.max(
       0,
       effectiveContextWindow - outputTokens - overheadTokens
     );
     const maxInputChars = Math.max(0, Math.floor(availableForInput * 3.5));
-    const source = maxContextOverride ? "user override" : caps.source;
+    const source = sanitizedOverride ? "user override" : caps.source;
     return {
       maxInputChars,
       maxOutputTokens: outputTokens,
@@ -237,4 +236,4 @@ var ModelRegistry = class {
 export {
   ModelRegistry
 };
-//# sourceMappingURL=chunk-QR3C7BKQ.js.map
+//# sourceMappingURL=chunk-XZ4WBBB5.js.map

package/dist/chunk-XZ4WBBB5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/model-registry.ts"],"sourcesContent":["/**\n * Model Registry - Stores and retrieves model capabilities\n * Avoids repeated external lookups by caching model info locally\n */\n\nimport { log } from \"./logger.js\";\nimport fs from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport interface ModelCapabilities {\n  modelId: string;\n  maxPositionEmbeddings: number;\n  contextWindow: number;\n  supportsExtendedContext: boolean;\n  ropeScaling?: {\n    type: string;\n    factor: number;\n    originalMaxPositionEmbeddings: number;\n  };\n  typicalOutputTokens: number;\n  source: \"huggingface\" | \"lmstudio\" | \"manual\" | \"default\";\n  fetchedAt: string;\n}\n\ninterface ModelRegistryData {\n  models: Record<string, ModelCapabilities>;\n  version: number;\n}\n\nconst DEFAULT_CAPABILITIES: ModelCapabilities = {\n  modelId: \"default\",\n  maxPositionEmbeddings: 32768,\n  contextWindow: 32768,\n  supportsExtendedContext: false,\n  typicalOutputTokens: 8192,\n  source: \"default\",\n  fetchedAt: new Date().toISOString(),\n};\n\n// Known model capabilities (fallback when offline)\n// NOTE: Context windows here are the MODEL's theoretical maximum. Local LLM servers\n// (LM Studio, Ollama, etc.) often load models with smaller default context windows.\n// If you get \"context length exceeded\" errors, either:\n// 1. Increase the context window in your LLM server UI (recommended)\n// 2. Set localLlmMaxContext in openclaw.json to limit prompts (fallback)\nconst KNOWN_MODELS: Record<string, Partial<ModelCapabilities>> = {\n  \"qwen3-30b-a3b-instruct\": {\n    maxPositionEmbeddings: 40960,\n    contextWindow: 131072, // 128K with YaRN - but LM Studio defaults to ~32K\n    supportsExtendedContext: true,\n    ropeScaling: {\n      type: \"yarn\",\n      factor: 4.0,\n      originalMaxPositionEmbeddings: 32768,\n    },\n    typicalOutputTokens: 8192,\n  },\n  \"qwen3-coder-30b-a3b-instruct\": {\n    maxPositionEmbeddings: 40960,\n    contextWindow: 131072, // 128K with YaRN - but LM Studio defaults to ~32K\n    supportsExtendedContext: true,\n    ropeScaling: {\n      type: \"yarn\",\n      factor: 4.0,\n      originalMaxPositionEmbeddings: 32768,\n    },\n    typicalOutputTokens: 8192,\n  },\n  \"qwen3-8b\": {\n    maxPositionEmbeddings: 40960,\n    contextWindow: 131072,\n    supportsExtendedContext: true,\n    typicalOutputTokens: 4096,\n  },\n  \"qwen3-14b\": {\n    maxPositionEmbeddings: 40960,\n    contextWindow: 131072,\n    supportsExtendedContext: true,\n    typicalOutputTokens: 4096,\n  },\n  \"qwen3-32b\": {\n    maxPositionEmbeddings: 40960,\n    contextWindow: 131072,\n    supportsExtendedContext: true,\n    typicalOutputTokens: 4096,\n  },\n  \"llama-3.1\": {\n    maxPositionEmbeddings: 131072,\n    contextWindow: 131072,\n    supportsExtendedContext: false,\n    typicalOutputTokens: 8192,\n  },\n  \"llama-3.2\": {\n    maxPositionEmbeddings: 131072,\n    contextWindow: 131072,\n    supportsExtendedContext: false,\n    typicalOutputTokens: 8192,\n  },\n  \"mistral-nemo\": {\n    maxPositionEmbeddings: 131072,\n    contextWindow: 131072,\n    supportsExtendedContext: false,\n    typicalOutputTokens: 8192,\n  },\n  \"gemma-2\": {\n    maxPositionEmbeddings: 8192,\n    contextWindow: 8192,\n    supportsExtendedContext: false,\n    typicalOutputTokens: 4096,\n  },\n};\n\nexport class ModelRegistry {\n  private registryPath: string;\n  private data: ModelRegistryData;\n  private readonly CACHE_TTL_DAYS = 7;\n\n  constructor(memoryDir: string) {\n    const registryDir = join(memoryDir, \".registry\");\n    if (!fs.existsSync(registryDir)) {\n      fs.mkdirSync(registryDir, { recursive: true });\n    }\n    this.registryPath = join(registryDir, \"model-capabilities.json\");\n    this.data = this.loadRegistry();\n  }\n\n  private loadRegistry(): ModelRegistryData {\n    try {\n      if (fs.existsSync(this.registryPath)) {\n        const content = fs.readFileSync(this.registryPath, \"utf-8\");\n        const data = JSON.parse(content) as ModelRegistryData;\n        log.info(`ModelRegistry: loaded ${Object.keys(data.models).length} cached models`);\n        return data;\n      }\n    } catch (err) {\n      log.warn(`ModelRegistry: failed to load registry: ${err}`);\n    }\n    return { models: {}, version: 1 };\n  }\n\n  private saveRegistry(): void {\n    try {\n      fs.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));\n    } catch (err) {\n      log.warn(`ModelRegistry: failed to save registry: ${err}`);\n    }\n  }\n\n  private isCacheExpired(model: ModelCapabilities): boolean {\n    const fetched = new Date(model.fetchedAt);\n    const now = new Date();\n    const daysDiff = (now.getTime() - fetched.getTime()) / (1000 * 60 * 60 * 24);\n    return daysDiff > this.CACHE_TTL_DAYS;\n  }\n\n  private normalizeModelId(modelId: string): string {\n    // Remove common suffixes and prefixes for matching\n    return modelId\n      .toLowerCase()\n      .replace(/@\\d+bit$/, \"\") // Remove @4bit, @8bit\n      .replace(/-mlx$/, \"\")\n      .replace(/-awq$/, \"\")\n      .replace(/-gptq$/, \"\")\n      .replace(/-gguf$/, \"\")\n      .replace(/^mlx-community\\//, \"\")\n      .replace(/^models\\//, \"\")\n      .trim();\n  }\n\n  /**\n   * Get capabilities for a model, using cache if available\n   */\n  getCapabilities(modelId: string): ModelCapabilities {\n    const normalizedId = this.normalizeModelId(modelId);\n\n    // Check cache first\n    if (this.data.models[normalizedId]) {\n      const cached = this.data.models[normalizedId];\n      if (!this.isCacheExpired(cached)) {\n        log.info(`ModelRegistry: using cached capabilities for ${modelId}`);\n        return cached;\n      }\n      log.info(`ModelRegistry: cache expired for ${modelId}, will refresh`);\n    }\n\n    // Check known models\n    for (const [knownId, capabilities] of Object.entries(KNOWN_MODELS)) {\n      if (normalizedId.includes(knownId)) {\n        log.info(`ModelRegistry: using known capabilities for ${modelId}`);\n        const caps: ModelCapabilities = {\n          ...DEFAULT_CAPABILITIES,\n          ...capabilities,\n          modelId: normalizedId,\n          source: \"default\",\n          fetchedAt: new Date().toISOString(),\n        };\n        this.data.models[normalizedId] = caps;\n        this.saveRegistry();\n        return caps;\n      }\n    }\n\n    // Return defaults\n    log.info(`ModelRegistry: using default capabilities for ${modelId}`);\n    return {\n      ...DEFAULT_CAPABILITIES,\n      modelId: normalizedId,\n    };\n  }\n\n  /**\n   * Store capabilities for a model\n   */\n  setCapabilities(modelId: string, capabilities: Omit<ModelCapabilities, \"modelId\" | \"fetchedAt\">): void {\n    const normalizedId = this.normalizeModelId(modelId);\n    const caps: ModelCapabilities = {\n      ...capabilities,\n      modelId: normalizedId,\n      fetchedAt: new Date().toISOString(),\n    };\n    this.data.models[normalizedId] = caps;\n    this.saveRegistry();\n    log.info(`ModelRegistry: stored capabilities for ${modelId}`);\n  }\n\n  /**\n   * Calculate optimal input/output sizes for a model\n   * @param maxContextOverride - Optional override for max context (e.g., if LLM server defaults to smaller window)\n   */\n  calculateContextSizes(modelId: string, maxContextOverride?: number): {\n    maxInputChars: number;\n    maxOutputTokens: number;\n    description: string;\n  } {\n    const caps = this.getCapabilities(modelId);\n\n    // Use override if provided (e.g., user knows their LLM server limits), otherwise use detected caps\n    const sanitizedOverride =\n      typeof maxContextOverride === \"number\" &&\n      Number.isFinite(maxContextOverride) &&\n      Number.isInteger(maxContextOverride) &&\n      maxContextOverride >= 1024\n        ? maxContextOverride\n        : undefined;\n    const effectiveContextWindow = sanitizedOverride ?? Math.max(1024, Math.floor(caps.contextWindow));\n\n    // Guardrails: never allow output budget to exceed the model/server context window.\n    // If we do, input budget goes negative and we end up generating huge, invalid prompts.\n    const overheadTokens = Math.min(1000, Math.floor(effectiveContextWindow / 10)); // <=10% overhead, max 1k\n    const minInputTokens = Math.min(512, Math.floor(effectiveContextWindow / 4)); // keep some room even on small contexts\n    const minOutputTokens = Math.min(256, Math.max(1, effectiveContextWindow - overheadTokens - minInputTokens));\n\n    // Base output budget: typical output, but scaled down for small contexts.\n    let outputTokens = caps.typicalOutputTokens;\n\n    // For very large contexts, default to ~12.5% output (capped), which tends to be plenty for JSON extraction.\n    if (effectiveContextWindow > 65536) {\n      outputTokens = Math.min(Math.floor(effectiveContextWindow / 8), 16384);\n    }\n\n    // Never let output exceed 25% of context.\n    outputTokens = Math.min(outputTokens, Math.floor(effectiveContextWindow / 4));\n\n    // Clamp output so we always have positive input headroom.\n    const maxOutputTokens = Math.max(1, effectiveContextWindow - overheadTokens - minInputTokens);\n    outputTokens = Math.min(maxOutputTokens, Math.max(minOutputTokens, outputTokens));\n\n    const availableForInput = Math.max(\n      0,\n      effectiveContextWindow - outputTokens - overheadTokens,\n    );\n\n    // Convert to characters (rough estimate: 1 token ≈ 4 chars)\n    const maxInputChars = Math.max(0, Math.floor(availableForInput * 3.5)); // Conservative: 3.5 chars/token\n\n    const source = sanitizedOverride ? \"user override\" : caps.source;\n    return {\n      maxInputChars,\n      maxOutputTokens: outputTokens,\n      description: `${caps.modelId}: ${effectiveContextWindow.toLocaleString()} context (${source}), using ${maxInputChars.toLocaleString()} chars input / ${outputTokens} tokens output`,\n    };\n  }\n\n  /**\n   * Fetch capabilities from Hugging Face (if available)\n   * Returns true if successful\n   */\n  async fetchFromHuggingFace(modelId: string): Promise<boolean> {\n    // This would be implemented to fetch from HF Hub API\n    // For now, we rely on the known models and manual updates\n    log.info(`ModelRegistry: fetchFromHuggingFace not yet implemented for ${modelId}`);\n    return false;\n  }\n\n  /**\n   * List all cached models\n   */\n  listCached(): string[] {\n    return Object.keys(this.data.models);\n  }\n\n  /**\n   * Clear expired cache entries\n   */\n  cleanExpired(): number {\n    const before = Object.keys(this.data.models).length;\n    this.data.models = Object.fromEntries(\n      Object.entries(this.data.models).filter(([_, caps]) => !this.isCacheExpired(caps))\n    );\n    const after = Object.keys(this.data.models).length;\n    const removed = before - after;\n    if (removed > 0) {\n      this.saveRegistry();\n      log.info(`ModelRegistry: cleaned ${removed} expired entries`);\n    }\n    return removed;\n  }\n}\n"],"mappings":";;;;;AAMA,OAAO,QAAQ;AACf,SAAS,YAAY;AAsBrB,IAAM,uBAA0C;AAAA,EAC9C,SAAS;AAAA,EACT,uBAAuB;AAAA,EACvB,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,qBAAqB;AAAA,EACrB,QAAQ;AAAA,EACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AACpC;AAQA,IAAM,eAA2D;AAAA,EAC/D,0BAA0B;AAAA,IACxB,uBAAuB;AAAA,IACvB,eAAe;AAAA;AAAA,IACf,yBAAyB;AAAA,IACzB,aAAa;AAAA,MACX,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,+BAA+B;AAAA,IACjC;AAAA,IACA,qBAAqB;AAAA,EACvB;AAAA,EACA,gCAAgC;AAAA,IAC9B,uBAAuB;AAAA,IACvB,eAAe;AAAA;AAAA,IACf,yBAAyB;AAAA,IACzB,aAAa;AAAA,MACX,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,+BAA+B;AAAA,IACjC;AAAA,IACA,qBAAqB;AAAA,EACvB;AAAA,EACA,YAAY;AAAA,IACV,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,aAAa;AAAA,IACX,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,aAAa;AAAA,IACX,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,aAAa;AAAA,IACX,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,aAAa;AAAA,IACX,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,gBAAgB;AAAA,IACd,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AAAA,EACA,WAAW;AAAA,IACT,uBAAuB;AAAA,IACvB,eAAe;AAAA,IACf,yBAAyB;AAAA,IACzB,qBAAqB;AAAA,EACvB;AACF;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACjB;AAAA,EACA;AAAA,EACS,iBAAiB;AAAA,EAElC,YAAY,WAAmB;AAC7B,UAAM,cAAc,KAAK,WAAW,WAAW;AAC/C,QAAI,CAAC,GAAG,WAAW,WAAW,GAAG;AAC/B,SAAG,UAAU,aAAa,EAAE,WAAW,KAAK,CAAC;AAAA,IAC/C;AACA,SAAK,eAAe,KAAK,aAAa,yBAAyB;AAC/D,SAAK,OAAO,KAAK,aAAa;AAAA,EAChC;AAAA,EAEQ,eAAkC;AACxC,QAAI;AACF,UAAI,GAAG,WAAW,KAAK,YAAY,GAAG;AACpC,cAAM,UAAU,GAAG,aAAa,KAAK,cAAc,OAAO;AAC1D,cAAM,OAAO,KAAK,MAAM,OAAO;AAC/B,YAAI,KAAK,yBAAyB,OAAO,KAAK,KAAK,MAAM,EAAE,MAAM,gBAAgB;AACjF,eAAO;AAAA,MACT;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,KAAK,2CAA2C,GAAG,EAAE;AAAA,IAC3D;AACA,WAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,EAAE;AAAA,EAClC;AAAA,EAEQ,eAAqB;AAC3B,QAAI;AACF,SAAG,cAAc,KAAK,cAAc,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC,CAAC;AAAA,IACxE,SAAS,KAAK;AACZ,UAAI,KAAK,2CAA2C,GAAG,EAAE;AAAA,IAC3D;AAAA,EACF;AAAA,EAEQ,eAAe,OAAmC;AACxD,UAAM,UAAU,IAAI,KAAK,MAAM,SAAS;AACxC,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,QAAQ,MAAM,MAAO,KAAK,KAAK;AACzE,WAAO,WAAW,KAAK;AAAA,EACzB;AAAA,EAEQ,iBAAiB,SAAyB;AAEhD,WAAO,QACJ,YAAY,EACZ,QAAQ,YAAY,EAAE,EACtB,QAAQ,SAAS,EAAE,EACnB,QAAQ,SAAS,EAAE,EACnB,QAAQ,UAAU,EAAE,EACpB,QAAQ,UAAU,EAAE,EACpB,QAAQ,oBAAoB,EAAE,EAC9B,QAAQ,aAAa,EAAE,EACvB,KAAK;AAAA,EACV;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,SAAoC;AAClD,UAAM,eAAe,KAAK,iBAAiB,OAAO;AAGlD,QAAI,KAAK,KAAK,OAAO,YAAY,GAAG;AAClC,YAAM,SAAS,KAAK,KAAK,OAAO,YAAY;AAC5C,UAAI,CAAC,KAAK,eAAe,MAAM,GAAG;AAChC,YAAI,KAAK,gDAAgD,OAAO,EAAE;AAClE,eAAO;AAAA,MACT;AACA,UAAI,KAAK,oCAAoC,OAAO,gBAAgB;AAAA,IACtE;AAGA,eAAW,CAAC,SAAS,YAAY,KAAK,OAAO,QAAQ,YAAY,GAAG;AAClE,UAAI,aAAa,SAAS,OAAO,GAAG;AAClC,YAAI,KAAK,+CAA+C,OAAO,EAAE;AACjE,cAAM,OAA0B;AAAA,UAC9B,GAAG;AAAA,UACH,GAAG;AAAA,UACH,SAAS;AAAA,UACT,QAAQ;AAAA,UACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AACA,aAAK,KAAK,OAAO,YAAY,IAAI;AACjC,aAAK,aAAa;AAClB,eAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI,KAAK,iDAAiD,OAAO,EAAE;AACnE,WAAO;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,SAAiB,cAAsE;AACrG,UAAM,eAAe,KAAK,iBAAiB,OAAO;AAClD,UAAM,OAA0B;AAAA,MAC9B,GAAG;AAAA,MACH,SAAS;AAAA,MACT,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AACA,SAAK,KAAK,OAAO,YAAY,IAAI;AACjC,SAAK,aAAa;AAClB,QAAI,KAAK,0CAA0C,OAAO,EAAE;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAsB,SAAiB,oBAIrC;AACA,UAAM,OAAO,KAAK,gBAAgB,OAAO;AAGzC,UAAM,oBACJ,OAAO,uBAAuB,YAC9B,OAAO,SAAS,kBAAkB,KAClC,OAAO,UAAU,kBAAkB,KACnC,sBAAsB,OAClB,qBACA;AACN,UAAM,yBAAyB,qBAAqB,KAAK,IAAI,MAAM,KAAK,MAAM,KAAK,aAAa,CAAC;AAIjG,UAAM,iBAAiB,KAAK,IAAI,KAAM,KAAK,MAAM,yBAAyB,EAAE,CAAC;AAC7E,UAAM,iBAAiB,KAAK,IAAI,KAAK,KAAK,MAAM,yBAAyB,CAAC,CAAC;AAC3E,UAAM,kBAAkB,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,yBAAyB,iBAAiB,cAAc,CAAC;AAG3G,QAAI,eAAe,KAAK;AAGxB,QAAI,yBAAyB,OAAO;AAClC,qBAAe,KAAK,IAAI,KAAK,MAAM,yBAAyB,CAAC,GAAG,KAAK;AAAA,IACvE;AAGA,mBAAe,KAAK,IAAI,cAAc,KAAK,MAAM,yBAAyB,CAAC,CAAC;AAG5E,UAAM,kBAAkB,KAAK,IAAI,GAAG,yBAAyB,iBAAiB,cAAc;AAC5F,mBAAe,KAAK,IAAI,iBAAiB,KAAK,IAAI,iBAAiB,YAAY,CAAC;AAEhF,UAAM,oBAAoB,KAAK;AAAA,MAC7B;AAAA,MACA,yBAAyB,eAAe;AAAA,IAC1C;AAGA,UAAM,gBAAgB,KAAK,IAAI,GAAG,KAAK,MAAM,oBAAoB,GAAG,CAAC;AAErE,UAAM,SAAS,oBAAoB,kBAAkB,KAAK;AAC1D,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB;AAAA,MACjB,aAAa,GAAG,KAAK,OAAO,KAAK,uBAAuB,eAAe,CAAC,aAAa,MAAM,YAAY,cAAc,eAAe,CAAC,kBAAkB,YAAY;AAAA,IACrK;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,qBAAqB,SAAmC;AAG5D,QAAI,KAAK,+DAA+D,OAAO,EAAE;AACjF,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,aAAuB;AACrB,WAAO,OAAO,KAAK,KAAK,KAAK,MAAM;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA,EAKA,eAAuB;AACrB,UAAM,SAAS,OAAO,KAAK,KAAK,KAAK,MAAM,EAAE;AAC7C,SAAK,KAAK,SAAS,OAAO;AAAA,MACxB,OAAO,QAAQ,KAAK,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,eAAe,IAAI,CAAC;AAAA,IACnF;AACA,UAAM,QAAQ,OAAO,KAAK,KAAK,KAAK,MAAM,EAAE;AAC5C,UAAM,UAAU,SAAS;AACzB,QAAI,UAAU,GAAG;AACf,WAAK,aAAa;AAClB,UAAI,KAAK,0BAA0B,OAAO,kBAAkB;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-WNARATI3.js → chunk-Y2SXZ5KZ.js}

@@ -19,7 +19,7 @@ import {
 import {
   decryptMemoryDirToPlaintext,
   migrateMemoryDirToEncrypted
-} from "./chunk-MXFBBHJU.js";
+} from "./chunk-KJMYHC7K.js";
 import {
   generateSalt
 } from "./chunk-A6XUJE5D.js";
@@ -102,7 +102,13 @@ async function runSecureStoreMigrate(options) {
     };
   }
   const id = options.keyringId ?? secureStoreDir(memoryDir);
-  const key = getKey(id);
+  const key = getKey(id) ?? await unlockForThisProcess({
+    memoryDir,
+    header,
+    keyringId: id,
+    readPassphrase: options.readPassphrase,
+    now: options.now
+  });
   if (key === null) {
     return {
       ok: false,
@@ -112,6 +118,15 @@ async function runSecureStoreMigrate(options) {
       errors: []
     };
   }
+  if (key === "wrong-passphrase") {
+    return {
+      ok: false,
+      reason: "wrong-passphrase",
+      encrypted: 0,
+      skipped: 0,
+      errors: []
+    };
+  }
   const result = await migrateMemoryDirToEncrypted(memoryDir, key);
   if (result.errors.length > 0) {
     return { ok: false, reason: "file-errors", ...result };
@@ -131,7 +146,13 @@ async function runSecureStoreDisable(options) {
     };
   }
   const id = options.keyringId ?? secureStoreDir(memoryDir);
-  const key = getKey(id);
+  const key = getKey(id) ?? await unlockForThisProcess({
+    memoryDir,
+    header,
+    keyringId: id,
+    readPassphrase: options.readPassphrase,
+    now: options.now
+  });
   if (key === null) {
     return {
       ok: false,
@@ -141,6 +162,15 @@ async function runSecureStoreDisable(options) {
       errors: []
     };
   }
+  if (key === "wrong-passphrase") {
+    return {
+      ok: false,
+      reason: "wrong-passphrase",
+      decrypted: 0,
+      skipped: 0,
+      errors: []
+    };
+  }
   const result = await decryptMemoryDirToPlaintext(memoryDir, key);
   if (result.errors.length > 0) {
     return { ok: false, reason: "file-errors", ...result };
@@ -189,6 +219,18 @@ function resolveParams(algorithm, override) {
   if (algorithm === "scrypt") return { ...DEFAULT_SCRYPT_PARAMS };
   return { ...DEFAULT_ARGON2ID_PARAMS };
 }
+async function unlockForThisProcess(options) {
+  if (!options.readPassphrase) return null;
+  const passphrase = await options.readPassphrase("Enter passphrase: ");
+  validatePassphrase(passphrase);
+  const candidateKey = deriveKeyFromHeader(options.header, passphrase);
+  if (!verifyKey(options.header, candidateKey)) {
+    candidateKey.fill(0);
+    return "wrong-passphrase";
+  }
+  unlock(options.keyringId, candidateKey, options.now ?? (() => /* @__PURE__ */ new Date()));
+  return candidateKey;
+}
 
 // src/secure-store/cli-renderer.ts
 function renderInitReport(report) {
@@ -201,12 +243,12 @@ function renderInitReport(report) {
   lines.push("");
   lines.push("Note: init does NOT auto-unlock the store. Run");
   lines.push("  remnic engram secure-store unlock");
-  lines.push("to register the master key with the running daemon.");
+  lines.push("to register the master key in the current Remnic process.");
   return lines.join("\n");
 }
 function renderUnlockReport(report) {
   if (report.ok) {
-    return `OK \u2014 secure-store unlocked at ${report.unlockedAt} (algorithm=${report.algorithm}).`;
+    return `OK \u2014 secure-store unlocked in this process at ${report.unlockedAt} (algorithm=${report.algorithm}).`;
   }
   if (report.reason === "not-initialized") {
     return "ERR \u2014 secure-store is not initialized. Run 'remnic engram secure-store init' first.";
@@ -215,16 +257,19 @@ function renderUnlockReport(report) {
 }
 function renderLockReport(report) {
   if (report.cleared) {
-    return "OK \u2014 secure-store key cleared from in-memory keyring.";
+    return "OK \u2014 secure-store key cleared from this process's in-memory keyring.";
   }
-  return "OK \u2014 secure-store was already locked (no in-memory key to clear).";
+  return "OK \u2014 secure-store was already locked in this process (no in-memory key to clear).";
 }
 function renderMigrateReport(report) {
   if (!report.ok && report.reason === "not-initialized") {
     return "ERR \u2014 secure-store is not initialized. Run 'remnic engram secure-store init' first.";
   }
   if (!report.ok && report.reason === "locked") {
-    return "ERR \u2014 secure-store is locked. Run 'remnic engram secure-store unlock' before migrate.";
+    return "ERR \u2014 secure-store is locked in this process. Run migrate from an interactive CLI so it can prompt for the passphrase, or unlock inside the daemon process that will perform the migration.";
+  }
+  if (!report.ok && report.reason === "wrong-passphrase") {
+    return "ERR \u2014 wrong passphrase.";
   }
   const lines = [];
   lines.push(report.ok ? "OK \u2014 secure-store migration complete." : "ERR \u2014 secure-store migration completed with file errors.");
@@ -244,7 +289,10 @@ function renderDisableReport(report) {
     return "ERR \u2014 secure-store is not initialized. Run 'remnic engram secure-store init' first.";
   }
   if (!report.ok && report.reason === "locked") {
-    return "ERR \u2014 secure-store is locked. Run 'remnic engram secure-store unlock' before disable.";
+    return "ERR \u2014 secure-store is locked in this process. Run disable from an interactive CLI so it can prompt for the passphrase, or unlock inside the daemon process that will decrypt files.";
+  }
+  if (!report.ok && report.reason === "wrong-passphrase") {
+    return "ERR \u2014 wrong passphrase.";
   }
   const lines = [];
   lines.push(report.ok ? "OK \u2014 secure-store disable complete." : "ERR \u2014 secure-store disable completed with file errors.");
@@ -272,7 +320,7 @@ function renderStatusReport(report) {
     return lines.join("\n");
   }
   lines.push(`createdAt: ${report.createdAt ?? "n/a"}`);
-  lines.push(`locked: ${report.locked ? "yes" : "no"}`);
+  lines.push(`lockedInThisProcess: ${report.locked ? "yes" : "no"}`);
   if (!report.locked) {
     lines.push(`lastUnlockAt: ${report.unlockedAt ?? "n/a"}`);
   }
@@ -451,4 +499,4 @@ export {
   renderStatusReport,
   createPassphraseReader
 };
-//# sourceMappingURL=chunk-WNARATI3.js.map
+//# sourceMappingURL=chunk-Y2SXZ5KZ.js.map

package/dist/chunk-Y2SXZ5KZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/cli-handlers.ts","../src/secure-store/cli-renderer.ts","../src/secure-store/passphrase-reader.ts"],"sourcesContent":["/**\n * Pure handlers behind the `remnic secure-store {init,unlock,lock,\n * status,migrate,disable}` CLI surface (issue #690 PR 2/4 + #779/#780).\n *\n * Each handler:\n *   - takes an explicit `memoryDir` (already `~`-expanded by the CLI),\n *   - takes an injectable passphrase reader (so tests don't need a\n *     real TTY and never touch real readline state),\n *   - returns a structured report (no `console.log` inside),\n *   - never logs the passphrase or any secret material.\n *\n * The actual `console.log` formatting lives in `cli-renderer.ts` so\n * tests can assert on the report shape without parsing text.\n */\n\nimport { generateSalt as generateEnvelopeSalt } from \"./cipher.js\";\nimport {\n  buildHeaderFromPassphrase,\n  deriveKeyFromHeader,\n  headerPath,\n  readHeader,\n  secureStoreDir,\n  verifyKey,\n  writeHeader,\n  type SecureStoreHeader,\n} from \"./header.js\";\nimport * as keyring from \"./keyring.js\";\nimport {\n  DEFAULT_ARGON2ID_PARAMS,\n  DEFAULT_SCRYPT_PARAMS,\n  KDF_SALT_LENGTH,\n  type Argon2idParams,\n  type KdfAlgorithm,\n  type ScryptParams,\n} from \"./kdf.js\";\nimport {\n  decryptMemoryDirToPlaintext,\n  migrateMemoryDirToEncrypted,\n  type DecryptResult,\n  type MigrateResult,\n} from \"./secure-fs.js\";\n\n/** Passphrase source — async so callers can read from a TTY without echo. */\nexport type PassphraseReader = (\n  prompt: string,\n  options?: { confirm?: boolean },\n) => Promise<string>;\n\n/** Common options accepted by every handler. */\nexport interface SecureStoreHandlerCommon {\n  memoryDir: string;\n  /**\n   * Stable identifier for the in-memory keyring entry. Defaults to\n   * the secure-store directory under `memoryDir`. Tests override\n   * this to keep entries from leaking across cases.\n   */\n  keyringId?: string;\n  /** Optional clock injection for deterministic tests. */\n  now?: () => Date;\n}\n\n// ─── init ─────────────────────────────────────────────────────────────\n\nexport interface SecureStoreInitOptions extends SecureStoreHandlerCommon {\n  /** Passphrase reader — called twice (entry + confirmation). */\n  readPassphrase: PassphraseReader;\n  /**\n   * KDF algorithm. Defaults to `\"argon2id\"` for new stores.\n   * `\"scrypt\"` remains supported for explicit compatibility cases.\n   */\n  algorithm?: KdfAlgorithm;\n  /** KDF parameter override; defaults to OWASP-acceptable params for the selected KDF. */\n  params?: ScryptParams | Argon2idParams;\n  /** Pre-generated salt for tests; production callers should omit. */\n  salt?: Buffer;\n  /** Optional human-readable note recorded in metadata. Never persist secrets. */\n  note?: string;\n}\n\nexport interface SecureStoreInitReport {\n  ok: true;\n  /** Absolute path of the header file that was written. */\n  headerPath: string;\n  /** Algorithm + params used for the master key derivation. */\n  kdf: SecureStoreHeader[\"metadata\"][\"kdf\"];\n  /** ISO-8601 timestamp recorded in the header. */\n  createdAt: string;\n}\n\n/**\n * Initialize a new secure-store header. Refuses to overwrite an\n * existing header (use `header.ts:writeHeader` directly with explicit\n * intent if you need to reinitialize a destroyed store).\n */\nexport async function runSecureStoreInit(\n  options: SecureStoreInitOptions,\n): Promise<SecureStoreInitReport> {\n  const { memoryDir, readPassphrase } = options;\n  if (typeof memoryDir !== \"string\" || memoryDir.length === 0) {\n    throw new Error(\"secure-store init: memoryDir is required\");\n  }\n  // Fail fast if a header already exists, before we waste KDF time.\n  const existing = await readHeader(memoryDir);\n  if (existing !== null) {\n    throw new Error(\n      `secure-store header already exists at ${headerPath(memoryDir)}. Run 'remnic secure-store status' to inspect, or remove the .secure-store directory explicitly to reinitialize.`,\n    );\n  }\n  const passphrase = await readPassphrase(\"Enter new passphrase: \", { confirm: true });\n  validatePassphrase(passphrase);\n\n  const algorithm: KdfAlgorithm = options.algorithm ?? \"argon2id\";\n  const params = resolveParams(algorithm, options.params);\n  const salt = options.salt ?? generateEnvelopeSalt();\n  if (salt.length !== KDF_SALT_LENGTH) {\n    throw new Error(`salt must be ${KDF_SALT_LENGTH} bytes, got ${salt.length}`);\n  }\n\n  const built = buildHeaderFromPassphrase({\n    passphrase,\n    salt,\n    algorithm,\n    params,\n    ...(options.note !== undefined ? { note: options.note } : {}),\n    ...(options.now ? { createdAt: options.now().toISOString() } : {}),\n  });\n  // Zero the derived key — init does NOT auto-unlock; the operator\n  // must run `unlock` separately. This mirrors GnuPG-style hygiene\n  // and keeps `init` safe to run from automation that should never\n  // hold the master key in memory.\n  built.derivedKey.fill(0);\n\n  const writtenPath = await writeHeader(memoryDir, built.header);\n  return {\n    ok: true,\n    headerPath: writtenPath,\n    kdf: built.header.metadata.kdf,\n    createdAt: built.header.createdAt,\n  };\n}\n\n// ─── unlock ───────────────────────────────────────────────────────────\n\nexport interface SecureStoreUnlockOptions extends SecureStoreHandlerCommon {\n  readPassphrase: PassphraseReader;\n}\n\nexport type SecureStoreUnlockReport =\n  | { ok: true; unlockedAt: string; algorithm: KdfAlgorithm }\n  | { ok: false; reason: \"not-initialized\" | \"wrong-passphrase\" };\n\nexport async function runSecureStoreUnlock(\n  options: SecureStoreUnlockOptions,\n): Promise<SecureStoreUnlockReport> {\n  const { memoryDir, readPassphrase } = options;\n  const header = await readHeader(memoryDir);\n  if (!header) {\n    return { ok: false, reason: \"not-initialized\" };\n  }\n  const passphrase = await readPassphrase(\"Enter passphrase: \");\n  validatePassphrase(passphrase);\n  const candidateKey = deriveKeyFromHeader(header, passphrase);\n  if (!verifyKey(header, candidateKey)) {\n    candidateKey.fill(0);\n    return { ok: false, reason: \"wrong-passphrase\" };\n  }\n  const id = options.keyringId ?? secureStoreDir(memoryDir);\n  const now = options.now ?? (() => new Date());\n  keyring.unlock(id, candidateKey, now);\n  const status = keyring.status(id);\n  return {\n    ok: true,\n    unlockedAt: status.unlockedAt ?? now().toISOString(),\n    algorithm: header.metadata.kdf.algorithm,\n  };\n}\n\n// ─── lock ─────────────────────────────────────────────────────────────\n\nexport interface SecureStoreLockOptions extends SecureStoreHandlerCommon {}\n\nexport interface SecureStoreLockReport {\n  ok: true;\n  /** True if a key was registered and is now cleared; false if it was already locked. */\n  cleared: boolean;\n}\n\nexport function runSecureStoreLock(options: SecureStoreLockOptions): SecureStoreLockReport {\n  const id = options.keyringId ?? secureStoreDir(options.memoryDir);\n  const cleared = keyring.lock(id);\n  return { ok: true, cleared };\n}\n\n// ─── migrate ─────────────────────────────────────────────────────────\n\nexport interface SecureStoreMigrateOptions extends SecureStoreHandlerCommon {\n  /**\n   * Optional passphrase reader for standalone CLI migration. A prior\n   * `secure-store unlock` command only unlocks that process-local keyring, so\n   * standalone migrate can prompt and install the key in this process instead\n   * of pretending another process still has it.\n   */\n  readPassphrase?: PassphraseReader;\n}\n\nexport type SecureStoreMigrateReport =\n  | ({ ok: true } & MigrateResult)\n  | ({\n      ok: false;\n      reason: \"not-initialized\" | \"locked\" | \"wrong-passphrase\" | \"file-errors\";\n    } & MigrateResult);\n\nexport async function runSecureStoreMigrate(\n  options: SecureStoreMigrateOptions,\n): Promise<SecureStoreMigrateReport> {\n  const { memoryDir } = options;\n  const header = await readHeader(memoryDir);\n  if (!header) {\n    return {\n      ok: false,\n      reason: \"not-initialized\",\n      encrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n\n  const id = options.keyringId ?? secureStoreDir(memoryDir);\n  const key = keyring.getKey(id) ?? await unlockForThisProcess({\n    memoryDir,\n    header,\n    keyringId: id,\n    readPassphrase: options.readPassphrase,\n    now: options.now,\n  });\n  if (key === null) {\n    return {\n      ok: false,\n      reason: \"locked\",\n      encrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n  if (key === \"wrong-passphrase\") {\n    return {\n      ok: false,\n      reason: \"wrong-passphrase\",\n      encrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n\n  const result = await migrateMemoryDirToEncrypted(memoryDir, key);\n  if (result.errors.length > 0) {\n    return { ok: false, reason: \"file-errors\", ...result };\n  }\n  return { ok: true, ...result };\n}\n\n// ─── disable/decrypt ─────────────────────────────────────────────────\n\nexport interface SecureStoreDisableOptions extends SecureStoreHandlerCommon {\n  /**\n   * Optional passphrase reader for standalone CLI decrypt/disable. See\n   * SecureStoreMigrateOptions.readPassphrase for the process-local keyring\n   * contract.\n   */\n  readPassphrase?: PassphraseReader;\n}\n\nexport type SecureStoreDisableReport =\n  | ({ ok: true } & DecryptResult)\n  | ({\n      ok: false;\n      reason: \"not-initialized\" | \"locked\" | \"wrong-passphrase\" | \"file-errors\";\n    } & DecryptResult);\n\nexport async function runSecureStoreDisable(\n  options: SecureStoreDisableOptions,\n): Promise<SecureStoreDisableReport> {\n  const { memoryDir } = options;\n  const header = await readHeader(memoryDir);\n  if (!header) {\n    return {\n      ok: false,\n      reason: \"not-initialized\",\n      decrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n\n  const id = options.keyringId ?? secureStoreDir(memoryDir);\n  const key = keyring.getKey(id) ?? await unlockForThisProcess({\n    memoryDir,\n    header,\n    keyringId: id,\n    readPassphrase: options.readPassphrase,\n    now: options.now,\n  });\n  if (key === null) {\n    return {\n      ok: false,\n      reason: \"locked\",\n      decrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n  if (key === \"wrong-passphrase\") {\n    return {\n      ok: false,\n      reason: \"wrong-passphrase\",\n      decrypted: 0,\n      skipped: 0,\n      errors: [],\n    };\n  }\n\n  const result = await decryptMemoryDirToPlaintext(memoryDir, key);\n  if (result.errors.length > 0) {\n    return { ok: false, reason: \"file-errors\", ...result };\n  }\n  return { ok: true, ...result };\n}\n\n// ─── status ───────────────────────────────────────────────────────────\n\nexport interface SecureStoreStatusOptions extends SecureStoreHandlerCommon {}\n\nexport interface SecureStoreStatusReport {\n  /** True iff a header file exists in `<memoryDir>/.secure-store/`. */\n  initialized: boolean;\n  /** Path the status check probed. Useful for operators. */\n  headerPath: string;\n  /** Locked/unlocked state of the in-memory keyring entry. */\n  locked: boolean;\n  /** ISO-8601 timestamp of the most recent unlock, or null when locked. */\n  unlockedAt: string | null;\n  /** Header metadata (algorithm + params + salt hex), or null when uninitialized. */\n  kdf: SecureStoreHeader[\"metadata\"][\"kdf\"] | null;\n  /** Header `createdAt`, or null when uninitialized. */\n  createdAt: string | null;\n}\n\nexport async function runSecureStoreStatus(\n  options: SecureStoreStatusOptions,\n): Promise<SecureStoreStatusReport> {\n  const { memoryDir } = options;\n  const id = options.keyringId ?? secureStoreDir(memoryDir);\n  const header = await readHeader(memoryDir);\n  const ks = keyring.status(id);\n  const target = headerPath(memoryDir);\n  if (!header) {\n    return {\n      initialized: false,\n      headerPath: target,\n      locked: !ks.unlocked,\n      unlockedAt: ks.unlockedAt,\n      kdf: null,\n      createdAt: null,\n    };\n  }\n  return {\n    initialized: true,\n    headerPath: target,\n    locked: !ks.unlocked,\n    unlockedAt: ks.unlockedAt,\n    kdf: header.metadata.kdf,\n    createdAt: header.createdAt,\n  };\n}\n\n// ─── helpers ──────────────────────────────────────────────────────────\n\n/** Minimum passphrase length. 8 chars is intentionally permissive — operators may use phrase managers. */\nexport const MIN_PASSPHRASE_LENGTH = 8;\n\nfunction validatePassphrase(passphrase: string): void {\n  if (typeof passphrase !== \"string\") {\n    throw new Error(\"passphrase must be a string\");\n  }\n  if (passphrase.length === 0) {\n    throw new Error(\"passphrase must not be empty\");\n  }\n  if (passphrase.length < MIN_PASSPHRASE_LENGTH) {\n    throw new Error(`passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters`);\n  }\n}\n\nfunction resolveParams(\n  algorithm: KdfAlgorithm,\n  override: ScryptParams | Argon2idParams | undefined,\n): ScryptParams | Argon2idParams {\n  if (override !== undefined) return override;\n  if (algorithm === \"scrypt\") return { ...DEFAULT_SCRYPT_PARAMS };\n  return { ...DEFAULT_ARGON2ID_PARAMS };\n}\n\nasync function unlockForThisProcess(options: {\n  memoryDir: string;\n  header: SecureStoreHeader;\n  keyringId: string;\n  readPassphrase?: PassphraseReader;\n  now?: () => Date;\n}): Promise<Buffer | null | \"wrong-passphrase\"> {\n  if (!options.readPassphrase) return null;\n  const passphrase = await options.readPassphrase(\"Enter passphrase: \");\n  validatePassphrase(passphrase);\n  const candidateKey = deriveKeyFromHeader(options.header, passphrase);\n  if (!verifyKey(options.header, candidateKey)) {\n    candidateKey.fill(0);\n    return \"wrong-passphrase\";\n  }\n  keyring.unlock(options.keyringId, candidateKey, options.now ?? (() => new Date()));\n  return candidateKey;\n}\n","/**\n * Console-text renderers for the `remnic engram secure-store {init,unlock,\n * lock,status,migrate,disable}` CLI surface (issue #690 PR 2/4 + #779/#780).\n *\n * Pure: each `render*` function takes a typed report and returns a\n * string. CLI handlers do the `console.log`. Tests assert on the\n * returned text directly so behavior stays decoupled from stdout.\n */\n\nimport type {\n  SecureStoreInitReport,\n  SecureStoreLockReport,\n  SecureStoreDisableReport,\n  SecureStoreMigrateReport,\n  SecureStoreStatusReport,\n  SecureStoreUnlockReport,\n} from \"./cli-handlers.js\";\nimport type { SecureStoreHeader } from \"./header.js\";\n\nexport function renderInitReport(report: SecureStoreInitReport): string {\n  const lines: string[] = [];\n  lines.push(\"=== Remnic secure-store initialized ===\");\n  lines.push(\"\");\n  lines.push(`header: ${report.headerPath}`);\n  lines.push(`createdAt: ${report.createdAt}`);\n  lines.push(...renderKdfLines(report.kdf));\n  lines.push(\"\");\n  lines.push(\"Note: init does NOT auto-unlock the store. Run\");\n  lines.push(\"  remnic engram secure-store unlock\");\n  lines.push(\"to register the master key in the current Remnic process.\");\n  return lines.join(\"\\n\");\n}\n\nexport function renderUnlockReport(report: SecureStoreUnlockReport): string {\n  if (report.ok) {\n    return `OK — secure-store unlocked in this process at ${report.unlockedAt} (algorithm=${report.algorithm}).`;\n  }\n  if (report.reason === \"not-initialized\") {\n    return \"ERR — secure-store is not initialized. Run 'remnic engram secure-store init' first.\";\n  }\n  return \"ERR — wrong passphrase.\";\n}\n\nexport function renderLockReport(report: SecureStoreLockReport): string {\n  if (report.cleared) {\n    return \"OK — secure-store key cleared from this process's in-memory keyring.\";\n  }\n  return \"OK — secure-store was already locked in this process (no in-memory key to clear).\";\n}\n\nexport function renderMigrateReport(report: SecureStoreMigrateReport): string {\n  if (!report.ok && report.reason === \"not-initialized\") {\n    return \"ERR — secure-store is not initialized. Run 'remnic engram secure-store init' first.\";\n  }\n  if (!report.ok && report.reason === \"locked\") {\n    return \"ERR — secure-store is locked in this process. Run migrate from an interactive CLI so it can prompt for the passphrase, or unlock inside the daemon process that will perform the migration.\";\n  }\n  if (!report.ok && report.reason === \"wrong-passphrase\") {\n    return \"ERR — wrong passphrase.\";\n  }\n\n  const lines: string[] = [];\n  lines.push(report.ok ? \"OK — secure-store migration complete.\" : \"ERR — secure-store migration completed with file errors.\");\n  lines.push(`encrypted: ${report.encrypted}`);\n  lines.push(`skipped: ${report.skipped}`);\n  lines.push(`errors: ${report.errors.length}`);\n  for (const entry of report.errors.slice(0, 10)) {\n    lines.push(`- ${entry.filePath}: ${entry.error}`);\n  }\n  if (report.errors.length > 10) {\n    lines.push(`- ... ${report.errors.length - 10} more error(s)`);\n  }\n  return lines.join(\"\\n\");\n}\n\nexport function renderDisableReport(report: SecureStoreDisableReport): string {\n  if (!report.ok && report.reason === \"not-initialized\") {\n    return \"ERR — secure-store is not initialized. Run 'remnic engram secure-store init' first.\";\n  }\n  if (!report.ok && report.reason === \"locked\") {\n    return \"ERR — secure-store is locked in this process. Run disable from an interactive CLI so it can prompt for the passphrase, or unlock inside the daemon process that will decrypt files.\";\n  }\n  if (!report.ok && report.reason === \"wrong-passphrase\") {\n    return \"ERR — wrong passphrase.\";\n  }\n\n  const lines: string[] = [];\n  lines.push(report.ok ? \"OK — secure-store disable complete.\" : \"ERR — secure-store disable completed with file errors.\");\n  lines.push(`decrypted: ${report.decrypted}`);\n  lines.push(`skipped: ${report.skipped}`);\n  lines.push(`errors: ${report.errors.length}`);\n  for (const entry of report.errors.slice(0, 10)) {\n    lines.push(`- ${entry.filePath}: ${entry.error}`);\n  }\n  if (report.errors.length > 10) {\n    lines.push(`- ... ${report.errors.length - 10} more error(s)`);\n  }\n  lines.push(\"header: kept\");\n  return lines.join(\"\\n\");\n}\n\nexport function renderStatusReport(report: SecureStoreStatusReport): string {\n  const lines: string[] = [];\n  lines.push(\"=== Remnic secure-store status ===\");\n  lines.push(\"\");\n  lines.push(`header: ${report.headerPath}`);\n  lines.push(`initialized: ${report.initialized ? \"yes\" : \"no\"}`);\n  if (!report.initialized) {\n    lines.push(\"\");\n    lines.push(\"Run 'remnic engram secure-store init' to initialize a new store.\");\n    return lines.join(\"\\n\");\n  }\n  lines.push(`createdAt: ${report.createdAt ?? \"n/a\"}`);\n  lines.push(`lockedInThisProcess: ${report.locked ? \"yes\" : \"no\"}`);\n  if (!report.locked) {\n    lines.push(`lastUnlockAt: ${report.unlockedAt ?? \"n/a\"}`);\n  }\n  if (report.kdf) {\n    lines.push(...renderKdfLines(report.kdf));\n  }\n  return lines.join(\"\\n\");\n}\n\nfunction renderKdfLines(kdf: SecureStoreHeader[\"metadata\"][\"kdf\"]): string[] {\n  const lines: string[] = [];\n  lines.push(`kdf.algorithm: ${kdf.algorithm}`);\n  if (kdf.algorithm === \"scrypt\") {\n    const { N, r, p, keyLength, maxmem } = kdf.params;\n    lines.push(`kdf.params: N=${N} r=${r} p=${p} keyLength=${keyLength} maxmem=${maxmem}`);\n  } else {\n    const { memoryKiB, iterations, parallelism, keyLength } = kdf.params;\n    lines.push(\n      `kdf.params: memoryKiB=${memoryKiB} iterations=${iterations} parallelism=${parallelism} keyLength=${keyLength}`,\n    );\n  }\n  return lines;\n}\n","/**\n * TTY passphrase reader (issue #690 PR 2/4).\n *\n * Reads a line from stdin without echoing it back to the terminal.\n * Disables echo by setting raw mode + manually buffering input until\n * Enter / EOT.\n *\n * Why not `readline.question`?\n * ----------------------------\n * `readline` echoes by default and has no clean \"no-echo\" toggle that\n * survives across Node versions. The raw-mode loop is the canonical\n * idiom for reading passwords on Node and matches what `npm` uses\n * internally.\n *\n * Security\n * --------\n *   - Never log the passphrase (no `console.log`, no debug output).\n *   - Never include it in a thrown error message.\n *   - On Ctrl+C / Ctrl+D, abort with a clear error rather than\n *     silently treating EOF as an empty submission.\n *   - On non-TTY stdin (pipe, redirect), read a line via line-buffered\n *     readline so automation (`echo \"passphrase\" | remnic ...`) works.\n *     Operators are responsible for not piping plaintext passphrases\n *     in shell history; we surface a stderr warning.\n */\n\nimport { createInterface } from \"node:readline\";\nimport type { Readable, Writable } from \"node:stream\";\nimport { StringDecoder } from \"node:string_decoder\";\n\nimport type { PassphraseReader } from \"./cli-handlers.js\";\n\nexport interface CreatePassphraseReaderOptions {\n  input?: Readable;\n  output?: Writable;\n  /** Override stderr for warning surface; defaults to `process.stderr`. */\n  errorStream?: Writable;\n}\n\n/**\n * Build a `PassphraseReader` bound to the given streams. Exported so\n * tests can construct one against in-memory streams without touching\n * the real TTY.\n */\nexport function createPassphraseReader(\n  options: CreatePassphraseReaderOptions = {},\n): PassphraseReader {\n  const input = options.input ?? process.stdin;\n  const output = options.output ?? process.stdout;\n  const errorStream = options.errorStream ?? process.stderr;\n  // Codex/Cursor on PR #737: a fresh readline interface per call\n  // breaks confirm-mode on piped non-TTY input — the first\n  // `createInterface` consumes the entire prebuffered stream\n  // (including the second line), so the second `createInterface`\n  // sees an already-ended stream and resolves to \"\". Fix: maintain\n  // ONE non-TTY line reader across both reads of a confirm-mode\n  // session and pull lines on demand from a buffered queue.\n  let nonTtyReader: NonTtyLineReader | null = null;\n  let nonTtyWarned = false;\n  return async function readPassphrase(\n    prompt: string,\n    readerOptions?: { confirm?: boolean },\n  ): Promise<string> {\n    const first = await readSinglePassphrase(prompt);\n    if (readerOptions?.confirm) {\n      const second = await readSinglePassphrase(\"Confirm passphrase: \");\n      if (first !== second) {\n        throw new Error(\"passphrases did not match\");\n      }\n    }\n    return first;\n  };\n\n  async function readSinglePassphrase(prompt: string): Promise<string> {\n    const inputAsAny = input as Readable & {\n      isTTY?: boolean;\n      setRawMode?: (raw: boolean) => Readable;\n    };\n    if (inputAsAny.isTTY && typeof inputAsAny.setRawMode === \"function\") {\n      return readNoEcho(prompt, inputAsAny, output);\n    }\n    // Non-TTY: line-buffered fallback. Warn once per reader so\n    // operators piping plaintext passphrases in shell pipelines are\n    // aware their history may contain the secret.\n    if (!nonTtyWarned) {\n      errorStream.write(\n        \"[remnic secure-store] warning: stdin is not a TTY; reading passphrase as a plain line. \" +\n          \"Take care that the passphrase is not exposed in shell history.\\n\",\n      );\n      nonTtyWarned = true;\n    }\n    // Codex P1 on PR #737: write the prompt to stderr, not stdout.\n    // When the surrounding command outputs JSON to stdout (e.g.\n    // `remnic secure-store status --json`), injecting prompt text on\n    // stdout corrupts the JSON output and breaks machine consumers.\n    // The prompt is UI noise — it belongs on the error/diagnostics\n    // stream regardless of whether we're in a TTY.\n    errorStream.write(prompt);\n    if (!nonTtyReader) nonTtyReader = createNonTtyLineReader(input);\n    return nonTtyReader.next();\n  }\n}\n\nfunction readNoEcho(\n  prompt: string,\n  input: Readable & { setRawMode?: (raw: boolean) => Readable },\n  output: Writable,\n): Promise<string> {\n  return new Promise((resolve, reject) => {\n    output.write(prompt);\n    let buffer = \"\";\n    let settled = false;\n    const wasRaw = (input as Readable & { isRaw?: boolean }).isRaw === true;\n    // Codex P2 on PR #737: per-chunk `chunk.toString(\"utf8\")` corrupts\n    // multibyte characters that straddle a chunk boundary (Node inserts\n    // U+FFFD replacement characters for incomplete sequences). Use a\n    // StringDecoder, which buffers partial sequences across chunks so\n    // non-ASCII passphrases survive intact.\n    const decoder = new StringDecoder(\"utf8\");\n    if (input.setRawMode) input.setRawMode(true);\n    input.resume();\n    const cleanup = (): void => {\n      input.pause();\n      input.removeListener(\"data\", onData);\n      // Flush any remaining bytes the decoder is holding so trailing\n      // partial sequences are surfaced rather than silently swallowed.\n      decoder.end();\n      // Restore the prior raw-mode state so we don't strand the parent shell\n      // in an unexpected configuration.\n      if (input.setRawMode) input.setRawMode(wasRaw);\n      output.write(\"\\n\");\n    };\n    const onData = (chunk: Buffer): void => {\n      const str = decoder.write(chunk);\n      for (const ch of str) {\n        if (settled) return;\n        const code = ch.charCodeAt(0);\n        // Enter / newline: submit.\n        if (ch === \"\\n\" || ch === \"\\r\") {\n          settled = true;\n          cleanup();\n          resolve(buffer);\n          return;\n        }\n        // Ctrl+C: abort.\n        if (code === 0x03) {\n          settled = true;\n          cleanup();\n          reject(new Error(\"passphrase entry aborted (Ctrl+C)\"));\n          return;\n        }\n        // Ctrl+D / EOT: treat as abort if buffer is empty, else submit.\n        if (code === 0x04) {\n          settled = true;\n          cleanup();\n          if (buffer.length === 0) {\n            reject(new Error(\"passphrase entry aborted (EOF)\"));\n          } else {\n            resolve(buffer);\n          }\n          return;\n        }\n        // Backspace / DEL.\n        // Cursor on PR #737: `buffer.slice(0, -1)` deletes one UTF-16\n        // code unit, which splits a surrogate pair when the last\n        // character is a non-BMP code point (emoji, etc.). Fix: count\n        // code points with `Array.from` and remove the last one. This\n        // correctly handles both BMP (single code unit) and non-BMP\n        // (surrogate pair) characters atomically.\n        if (code === 0x08 || code === 0x7f) {\n          if (buffer.length > 0) {\n            const codePoints = Array.from(buffer);\n            buffer = codePoints.slice(0, -1).join(\"\");\n          }\n          continue;\n        }\n        // Ignore other control bytes (escape sequences, etc.).\n        if (code < 0x20) {\n          continue;\n        }\n        buffer += ch;\n      }\n    };\n    input.on(\"data\", onData);\n  });\n}\n\n/**\n * One-shot line reader bound to a non-TTY input stream.\n *\n * Cursor medium on PR #737: a previous version constructed a fresh\n * `readline.createInterface` per `next()` call. On piped non-TTY\n * input, the first interface consumed the entire prebuffered stream\n * (including any subsequent lines) into its internal buffer. The\n * second interface saw an already-`end()`'d input and resolved to \"\".\n * Fix: construct ONE readline interface, queue every emitted `line`,\n * and let `next()` either return a queued line or wait for the next\n * one. Pending waiters at `close` time are resolved with \"\" (so an\n * abandoned-stream caller still sees a clean empty response).\n */\ninterface NonTtyLineReader {\n  next(): Promise<string>;\n}\n\nfunction createNonTtyLineReader(input: Readable): NonTtyLineReader {\n  const rl = createInterface({ input, terminal: false });\n  const lineQueue: string[] = [];\n  const waiterQueue: Array<(value: string) => void> = [];\n  const errorQueue: Array<(err: Error) => void> = [];\n  let closed = false;\n  let error: Error | null = null;\n\n  rl.on(\"line\", (line: string) => {\n    const waiter = waiterQueue.shift();\n    if (waiter) {\n      waiter(line);\n    } else {\n      lineQueue.push(line);\n    }\n  });\n  rl.on(\"close\", () => {\n    closed = true;\n    while (waiterQueue.length > 0) {\n      const w = waiterQueue.shift()!;\n      // Drop the matching error slot since we're settling cleanly.\n      errorQueue.shift();\n      w(\"\");\n    }\n  });\n  rl.on(\"error\", (err: Error) => {\n    error = err;\n    while (errorQueue.length > 0) {\n      const r = errorQueue.shift()!;\n      // Drop the matching value slot.\n      waiterQueue.shift();\n      r(err);\n    }\n  });\n\n  return {\n    next(): Promise<string> {\n      if (error) return Promise.reject(error);\n      const queued = lineQueue.shift();\n      if (queued !== undefined) return Promise.resolve(queued);\n      if (closed) return Promise.resolve(\"\");\n      return new Promise<string>((resolve, reject) => {\n        waiterQueue.push(resolve);\n        errorQueue.push(reject);\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FA,eAAsB,mBACpB,SACgC;AAChC,QAAM,EAAE,WAAW,eAAe,IAAI;AACtC,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS;AAC3C,MAAI,aAAa,MAAM;AACrB,UAAM,IAAI;AAAA,MACR,yCAAyC,WAAW,SAAS,CAAC;AAAA,IAChE;AAAA,EACF;AACA,QAAM,aAAa,MAAM,eAAe,0BAA0B,EAAE,SAAS,KAAK,CAAC;AACnF,qBAAmB,UAAU;AAE7B,QAAM,YAA0B,QAAQ,aAAa;AACrD,QAAM,SAAS,cAAc,WAAW,QAAQ,MAAM;AACtD,QAAM,OAAO,QAAQ,QAAQ,aAAqB;AAClD,MAAI,KAAK,WAAW,iBAAiB;AACnC,UAAM,IAAI,MAAM,gBAAgB,eAAe,eAAe,KAAK,MAAM,EAAE;AAAA,EAC7E;AAEA,QAAM,QAAQ,0BAA0B;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ,SAAS,SAAY,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC3D,GAAI,QAAQ,MAAM,EAAE,WAAW,QAAQ,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC;AAAA,EAClE,CAAC;AAKD,QAAM,WAAW,KAAK,CAAC;AAEvB,QAAM,cAAc,MAAM,YAAY,WAAW,MAAM,MAAM;AAC7D,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,KAAK,MAAM,OAAO,SAAS;AAAA,IAC3B,WAAW,MAAM,OAAO;AAAA,EAC1B;AACF;AAYA,eAAsB,qBACpB,SACkC;AAClC,QAAM,EAAE,WAAW,eAAe,IAAI;AACtC,QAAM,SAAS,MAAM,WAAW,SAAS;AACzC,MAAI,CAAC,QAAQ;AACX,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;AAAA,EAChD;AACA,QAAM,aAAa,MAAM,eAAe,oBAAoB;AAC5D,qBAAmB,UAAU;AAC7B,QAAM,eAAe,oBAAoB,QAAQ,UAAU;AAC3D,MAAI,CAAC,UAAU,QAAQ,YAAY,GAAG;AACpC,iBAAa,KAAK,CAAC;AACnB,WAAO,EAAE,IAAI,OAAO,QAAQ,mBAAmB;AAAA,EACjD;AACA,QAAM,KAAK,QAAQ,aAAa,eAAe,SAAS;AACxD,QAAM,MAAM,QAAQ,QAAQ,MAAM,oBAAI,KAAK;AAC3C,EAAQ,OAAO,IAAI,cAAc,GAAG;AACpC,QAAMA,UAAiB,OAAO,EAAE;AAChC,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,YAAYA,QAAO,cAAc,IAAI,EAAE,YAAY;AAAA,IACnD,WAAW,OAAO,SAAS,IAAI;AAAA,EACjC;AACF;AAYO,SAAS,mBAAmB,SAAwD;AACzF,QAAM,KAAK,QAAQ,aAAa,eAAe,QAAQ,SAAS;AAChE,QAAM,UAAkB,KAAK,EAAE;AAC/B,SAAO,EAAE,IAAI,MAAM,QAAQ;AAC7B;AAqBA,eAAsB,sBACpB,SACmC;AACnC,QAAM,EAAE,UAAU,IAAI;AACtB,QAAM,SAAS,MAAM,WAAW,SAAS;AACzC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AAEA,QAAM,KAAK,QAAQ,aAAa,eAAe,SAAS;AACxD,QAAM,MAAc,OAAO,EAAE,KAAK,MAAM,qBAAqB;AAAA,IAC3D;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB,QAAQ;AAAA,IACxB,KAAK,QAAQ;AAAA,EACf,CAAC;AACD,MAAI,QAAQ,MAAM;AAChB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AACA,MAAI,QAAQ,oBAAoB;AAC9B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,4BAA4B,WAAW,GAAG;AAC/D,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,GAAG,OAAO;AAAA,EACvD;AACA,SAAO,EAAE,IAAI,MAAM,GAAG,OAAO;AAC/B;AAoBA,eAAsB,sBACpB,SACmC;AACnC,QAAM,EAAE,UAAU,IAAI;AACtB,QAAM,SAAS,MAAM,WAAW,SAAS;AACzC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AAEA,QAAM,KAAK,QAAQ,aAAa,eAAe,SAAS;AACxD,QAAM,MAAc,OAAO,EAAE,KAAK,MAAM,qBAAqB;AAAA,IAC3D;AAAA,IACA;AAAA,IACA,WAAW;AAAA,IACX,gBAAgB,QAAQ;AAAA,IACxB,KAAK,QAAQ;AAAA,EACf,CAAC;AACD,MAAI,QAAQ,MAAM;AAChB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AACA,MAAI,QAAQ,oBAAoB;AAC9B,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,SAAS;AAAA,MACT,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,4BAA4B,WAAW,GAAG;AAC/D,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,WAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,GAAG,OAAO;AAAA,EACvD;AACA,SAAO,EAAE,IAAI,MAAM,GAAG,OAAO;AAC/B;AAqBA,eAAsB,qBACpB,SACkC;AAClC,QAAM,EAAE,UAAU,IAAI;AACtB,QAAM,KAAK,QAAQ,aAAa,eAAe,SAAS;AACxD,QAAM,SAAS,MAAM,WAAW,SAAS;AACzC,QAAM,KAAa,OAAO,EAAE;AAC5B,QAAM,SAAS,WAAW,SAAS;AACnC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,QAAQ,CAAC,GAAG;AAAA,MACZ,YAAY,GAAG;AAAA,MACf,KAAK;AAAA,MACL,WAAW;AAAA,IACb;AAAA,EACF;AACA,SAAO;AAAA,IACL,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,QAAQ,CAAC,GAAG;AAAA,IACZ,YAAY,GAAG;AAAA,IACf,KAAK,OAAO,SAAS;AAAA,IACrB,WAAW,OAAO;AAAA,EACpB;AACF;AAKO,IAAM,wBAAwB;AAErC,SAAS,mBAAmB,YAA0B;AACpD,MAAI,OAAO,eAAe,UAAU;AAClC,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACA,MAAI,WAAW,SAAS,uBAAuB;AAC7C,UAAM,IAAI,MAAM,+BAA+B,qBAAqB,aAAa;AAAA,EACnF;AACF;AAEA,SAAS,cACP,WACA,UAC+B;AAC/B,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,cAAc,SAAU,QAAO,EAAE,GAAG,sBAAsB;AAC9D,SAAO,EAAE,GAAG,wBAAwB;AACtC;AAEA,eAAe,qBAAqB,SAMY;AAC9C,MAAI,CAAC,QAAQ,eAAgB,QAAO;AACpC,QAAM,aAAa,MAAM,QAAQ,eAAe,oBAAoB;AACpE,qBAAmB,UAAU;AAC7B,QAAM,eAAe,oBAAoB,QAAQ,QAAQ,UAAU;AACnE,MAAI,CAAC,UAAU,QAAQ,QAAQ,YAAY,GAAG;AAC5C,iBAAa,KAAK,CAAC;AACnB,WAAO;AAAA,EACT;AACA,EAAQ,OAAO,QAAQ,WAAW,cAAc,QAAQ,QAAQ,MAAM,oBAAI,KAAK,EAAE;AACjF,SAAO;AACT;;;AC/YO,SAAS,iBAAiB,QAAuC;AACtE,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,yCAAyC;AACpD,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,WAAW,OAAO,UAAU,EAAE;AACzC,QAAM,KAAK,cAAc,OAAO,SAAS,EAAE;AAC3C,QAAM,KAAK,GAAG,eAAe,OAAO,GAAG,CAAC;AACxC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,gDAAgD;AAC3D,QAAM,KAAK,qCAAqC;AAChD,QAAM,KAAK,2DAA2D;AACtE,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,mBAAmB,QAAyC;AAC1E,MAAI,OAAO,IAAI;AACb,WAAO,sDAAiD,OAAO,UAAU,eAAe,OAAO,SAAS;AAAA,EAC1G;AACA,MAAI,OAAO,WAAW,mBAAmB;AACvC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,QAAuC;AACtE,MAAI,OAAO,SAAS;AAClB,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,QAA0C;AAC5E,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,mBAAmB;AACrD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,UAAU;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,oBAAoB;AACtD,WAAO;AAAA,EACT;AAEA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,OAAO,KAAK,+CAA0C,+DAA0D;AAC3H,QAAM,KAAK,cAAc,OAAO,SAAS,EAAE;AAC3C,QAAM,KAAK,YAAY,OAAO,OAAO,EAAE;AACvC,QAAM,KAAK,WAAW,OAAO,OAAO,MAAM,EAAE;AAC5C,aAAW,SAAS,OAAO,OAAO,MAAM,GAAG,EAAE,GAAG;AAC9C,UAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE;AAAA,EAClD;AACA,MAAI,OAAO,OAAO,SAAS,IAAI;AAC7B,UAAM,KAAK,SAAS,OAAO,OAAO,SAAS,EAAE,gBAAgB;AAAA,EAC/D;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,oBAAoB,QAA0C;AAC5E,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,mBAAmB;AACrD,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,UAAU;AAC5C,WAAO;AAAA,EACT;AACA,MAAI,CAAC,OAAO,MAAM,OAAO,WAAW,oBAAoB;AACtD,WAAO;AAAA,EACT;AAEA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,OAAO,KAAK,6CAAwC,6DAAwD;AACvH,QAAM,KAAK,cAAc,OAAO,SAAS,EAAE;AAC3C,QAAM,KAAK,YAAY,OAAO,OAAO,EAAE;AACvC,QAAM,KAAK,WAAW,OAAO,OAAO,MAAM,EAAE;AAC5C,aAAW,SAAS,OAAO,OAAO,MAAM,GAAG,EAAE,GAAG;AAC9C,UAAM,KAAK,KAAK,MAAM,QAAQ,KAAK,MAAM,KAAK,EAAE;AAAA,EAClD;AACA,MAAI,OAAO,OAAO,SAAS,IAAI;AAC7B,UAAM,KAAK,SAAS,OAAO,OAAO,SAAS,EAAE,gBAAgB;AAAA,EAC/D;AACA,QAAM,KAAK,cAAc;AACzB,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,mBAAmB,QAAyC;AAC1E,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,oCAAoC;AAC/C,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,WAAW,OAAO,UAAU,EAAE;AACzC,QAAM,KAAK,gBAAgB,OAAO,cAAc,QAAQ,IAAI,EAAE;AAC9D,MAAI,CAAC,OAAO,aAAa;AACvB,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,kEAAkE;AAC7E,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACA,QAAM,KAAK,cAAc,OAAO,aAAa,KAAK,EAAE;AACpD,QAAM,KAAK,wBAAwB,OAAO,SAAS,QAAQ,IAAI,EAAE;AACjE,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,KAAK,iBAAiB,OAAO,cAAc,KAAK,EAAE;AAAA,EAC1D;AACA,MAAI,OAAO,KAAK;AACd,UAAM,KAAK,GAAG,eAAe,OAAO,GAAG,CAAC;AAAA,EAC1C;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,eAAe,KAAqD;AAC3E,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,kBAAkB,IAAI,SAAS,EAAE;AAC5C,MAAI,IAAI,cAAc,UAAU;AAC9B,UAAM,EAAE,GAAG,GAAG,GAAG,WAAW,OAAO,IAAI,IAAI;AAC3C,UAAM,KAAK,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,SAAS,WAAW,MAAM,EAAE;AAAA,EACvF,OAAO;AACL,UAAM,EAAE,WAAW,YAAY,aAAa,UAAU,IAAI,IAAI;AAC9D,UAAM;AAAA,MACJ,yBAAyB,SAAS,eAAe,UAAU,gBAAgB,WAAW,cAAc,SAAS;AAAA,IAC/G;AAAA,EACF;AACA,SAAO;AACT;;;AC9GA,SAAS,uBAAuB;AAEhC,SAAS,qBAAqB;AAgBvB,SAAS,uBACd,UAAyC,CAAC,GACxB;AAClB,QAAM,QAAQ,QAAQ,SAAS,QAAQ;AACvC,QAAM,SAAS,QAAQ,UAAU,QAAQ;AACzC,QAAM,cAAc,QAAQ,eAAe,QAAQ;AAQnD,MAAI,eAAwC;AAC5C,MAAI,eAAe;AACnB,SAAO,eAAe,eACpB,QACA,eACiB;AACjB,UAAM,QAAQ,MAAM,qBAAqB,MAAM;AAC/C,QAAI,eAAe,SAAS;AAC1B,YAAM,SAAS,MAAM,qBAAqB,sBAAsB;AAChE,UAAI,UAAU,QAAQ;AACpB,cAAM,IAAI,MAAM,2BAA2B;AAAA,MAC7C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,qBAAqB,QAAiC;AACnE,UAAM,aAAa;AAInB,QAAI,WAAW,SAAS,OAAO,WAAW,eAAe,YAAY;AACnE,aAAO,WAAW,QAAQ,YAAY,MAAM;AAAA,IAC9C;AAIA,QAAI,CAAC,cAAc;AACjB,kBAAY;AAAA,QACV;AAAA,MAEF;AACA,qBAAe;AAAA,IACjB;AAOA,gBAAY,MAAM,MAAM;AACxB,QAAI,CAAC,aAAc,gBAAe,uBAAuB,KAAK;AAC9D,WAAO,aAAa,KAAK;AAAA,EAC3B;AACF;AAEA,SAAS,WACP,QACA,OACA,QACiB;AACjB,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,WAAO,MAAM,MAAM;AACnB,QAAI,SAAS;AACb,QAAI,UAAU;AACd,UAAM,SAAU,MAAyC,UAAU;AAMnE,UAAM,UAAU,IAAI,cAAc,MAAM;AACxC,QAAI,MAAM,WAAY,OAAM,WAAW,IAAI;AAC3C,UAAM,OAAO;AACb,UAAM,UAAU,MAAY;AAC1B,YAAM,MAAM;AACZ,YAAM,eAAe,QAAQ,MAAM;AAGnC,cAAQ,IAAI;AAGZ,UAAI,MAAM,WAAY,OAAM,WAAW,MAAM;AAC7C,aAAO,MAAM,IAAI;AAAA,IACnB;AACA,UAAM,SAAS,CAAC,UAAwB;AACtC,YAAM,MAAM,QAAQ,MAAM,KAAK;AAC/B,iBAAW,MAAM,KAAK;AACpB,YAAI,QAAS;AACb,cAAM,OAAO,GAAG,WAAW,CAAC;AAE5B,YAAI,OAAO,QAAQ,OAAO,MAAM;AAC9B,oBAAU;AACV,kBAAQ;AACR,kBAAQ,MAAM;AACd;AAAA,QACF;AAEA,YAAI,SAAS,GAAM;AACjB,oBAAU;AACV,kBAAQ;AACR,iBAAO,IAAI,MAAM,mCAAmC,CAAC;AACrD;AAAA,QACF;AAEA,YAAI,SAAS,GAAM;AACjB,oBAAU;AACV,kBAAQ;AACR,cAAI,OAAO,WAAW,GAAG;AACvB,mBAAO,IAAI,MAAM,gCAAgC,CAAC;AAAA,UACpD,OAAO;AACL,oBAAQ,MAAM;AAAA,UAChB;AACA;AAAA,QACF;AAQA,YAAI,SAAS,KAAQ,SAAS,KAAM;AAClC,cAAI,OAAO,SAAS,GAAG;AACrB,kBAAM,aAAa,MAAM,KAAK,MAAM;AACpC,qBAAS,WAAW,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE;AAAA,UAC1C;AACA;AAAA,QACF;AAEA,YAAI,OAAO,IAAM;AACf;AAAA,QACF;AACA,kBAAU;AAAA,MACZ;AAAA,IACF;AACA,UAAM,GAAG,QAAQ,MAAM;AAAA,EACzB,CAAC;AACH;AAmBA,SAAS,uBAAuB,OAAmC;AACjE,QAAM,KAAK,gBAAgB,EAAE,OAAO,UAAU,MAAM,CAAC;AACrD,QAAM,YAAsB,CAAC;AAC7B,QAAM,cAA8C,CAAC;AACrD,QAAM,aAA0C,CAAC;AACjD,MAAI,SAAS;AACb,MAAI,QAAsB;AAE1B,KAAG,GAAG,QAAQ,CAAC,SAAiB;AAC9B,UAAM,SAAS,YAAY,MAAM;AACjC,QAAI,QAAQ;AACV,aAAO,IAAI;AAAA,IACb,OAAO;AACL,gBAAU,KAAK,IAAI;AAAA,IACrB;AAAA,EACF,CAAC;AACD,KAAG,GAAG,SAAS,MAAM;AACnB,aAAS;AACT,WAAO,YAAY,SAAS,GAAG;AAC7B,YAAM,IAAI,YAAY,MAAM;AAE5B,iBAAW,MAAM;AACjB,QAAE,EAAE;AAAA,IACN;AAAA,EACF,CAAC;AACD,KAAG,GAAG,SAAS,CAAC,QAAe;AAC7B,YAAQ;AACR,WAAO,WAAW,SAAS,GAAG;AAC5B,YAAM,IAAI,WAAW,MAAM;AAE3B,kBAAY,MAAM;AAClB,QAAE,GAAG;AAAA,IACP;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,OAAwB;AACtB,UAAI,MAAO,QAAO,QAAQ,OAAO,KAAK;AACtC,YAAM,SAAS,UAAU,MAAM;AAC/B,UAAI,WAAW,OAAW,QAAO,QAAQ,QAAQ,MAAM;AACvD,UAAI,OAAQ,QAAO,QAAQ,QAAQ,EAAE;AACrC,aAAO,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9C,oBAAY,KAAK,OAAO;AACxB,mBAAW,KAAK,MAAM;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":["status"]}

package/dist/{chunk-SIC6U3GZ.js → chunk-YHV3KRKS.js}

@@ -1,11 +1,11 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-VBJ7V5SK.js";
+} from "./chunk-UIPDNLXA.js";
 import {
   readEnvVar,
   resolveHomeDir
-} from "./chunk-XIG5PDM7.js";
+} from "./chunk-JUC24CTX.js";
 import {
   log
 } from "./chunk-2ODBA7MQ.js";
@@ -824,4 +824,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-SIC6U3GZ.js.map
+//# sourceMappingURL=chunk-YHV3KRKS.js.map