@remnic/core 9.54.3 → 9.54.5

package/dist/{chunk-ZPJ4QSGP.js → chunk-VTU5IEKY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7T4TOGMS.js";
 import {
   defineOperation
-} from "./chunk-T2JHZWH6.js";
+} from "./chunk-3WGI7F4V.js";
 
 // src/external-wiki-access.ts
 import { z } from "zod";
@@ -26,4 +26,4 @@ var externalWikiSearchOperation = defineOperation({
 export {
   externalWikiSearchOperation
 };
-//# sourceMappingURL=chunk-ZPJ4QSGP.js.map
+//# sourceMappingURL=chunk-VTU5IEKY.js.map

package/dist/{chunk-RZ4XGKOJ.js → chunk-VYQ4URQB.js}

@@ -1,15 +1,10 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-WDBX6VER.js";
+} from "./chunk-VZRFGJCH.js";
 import {
   getConfiguredNamespaces
-} from "./chunk-YN6ASZUG.js";
-import {
-  namespaceIdentityFromToken,
-  namespaceIdentityToken,
-  normalizeNamespaceIdentity
-} from "./chunk-EGGE52UU.js";
+} from "./chunk-6QPI2ITJ.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
@@ -17,6 +12,11 @@ import {
   MutationSerializer,
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
+import {
+  namespaceIdentityFromToken,
+  namespaceIdentityToken,
+  normalizeNamespaceIdentity
+} from "./chunk-EGGE52UU.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -2204,4 +2204,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-RZ4XGKOJ.js.map
+//# sourceMappingURL=chunk-VYQ4URQB.js.map

package/dist/{chunk-WDBX6VER.js → chunk-VZRFGJCH.js}

@@ -1,17 +1,17 @@
 import {
   StorageManager
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
 import {
   keyring_exports,
   secureStoreDir
 } from "./chunk-BJMBJZ2Y.js";
+import {
+  MutationSerializer
+} from "./chunk-FFAZ2XFU.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
 } from "./chunk-EGGE52UU.js";
-import {
-  MutationSerializer
-} from "./chunk-FFAZ2XFU.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -388,4 +388,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-WDBX6VER.js.map
+//# sourceMappingURL=chunk-VZRFGJCH.js.map

package/dist/{chunk-IBKR2TFR.js → chunk-WM5LD6AT.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-RZRUV6N2.js";
 import {
   deriveSourceConnector
-} from "./chunk-ZMYDYNI4.js";
+} from "./chunk-N7CXQ5TA.js";
 import {
   resolvePipelineProcessingCapabilities
 } from "./chunk-2XRE6FLM.js";
@@ -108,4 +108,4 @@ export {
   renderExtractionConversation,
   applyGroundingWithConnector
 };
-//# sourceMappingURL=chunk-IBKR2TFR.js.map
+//# sourceMappingURL=chunk-WM5LD6AT.js.map

package/dist/{chunk-K4QS7LXU.js → chunk-WZWZRZ2V.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-CX5SW2EW.js";
 import {
   markProjectedMemoryPathInvalid
-} from "./chunk-3CSX3ETE.js";
+} from "./chunk-2LWQSV6A.js";
 import {
   withHeldFileLock
 } from "./chunk-FFAZ2XFU.js";
@@ -1374,4 +1374,4 @@ export {
   parseTombstoneBlockedOfflineSyncMemory,
   TombstoneBlockedCaptureIndexHost
 };
-//# sourceMappingURL=chunk-K4QS7LXU.js.map
+//# sourceMappingURL=chunk-WZWZRZ2V.js.map

package/dist/{chunk-G4T7L557.js → chunk-XKAR4RF6.js}

@@ -6,7 +6,7 @@ import {
   headerConnector,
   renderExtractionConversation,
   resolveSourceConnector
-} from "./chunk-IBKR2TFR.js";
+} from "./chunk-WM5LD6AT.js";
 import {
   ConsolidationResultSchema,
   DaySummaryResultSchema,
@@ -2442,4 +2442,4 @@ export {
   shouldEnableLocalExtractionThinking,
   ExtractionEngine
 };
-//# sourceMappingURL=chunk-G4T7L557.js.map
+//# sourceMappingURL=chunk-XKAR4RF6.js.map

package/dist/{chunk-DZD576ZU.js → chunk-XSV2YDCJ.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2DQ2XREU.js";
 import {
   compareEntityTimestamps
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -887,4 +887,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-DZD576ZU.js.map
+//# sourceMappingURL=chunk-XSV2YDCJ.js.map

package/dist/{chunk-G7Z6EENO.js → chunk-YDWPYDML.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-EQWEIIKQ.js";
 import {
   runContradictionScan
-} from "./chunk-UTRO5UJU.js";
+} from "./chunk-QPW3PAIH.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -28,10 +28,10 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-T2JHZWH6.js";
+} from "./chunk-3WGI7F4V.js";
 import {
   validateBriefingFormat
-} from "./chunk-JDZPNCMA.js";
+} from "./chunk-UYOXFFEY.js";
 import {
   enforceNamespaceAllowList,
   tokenCapabilityStore
@@ -494,4 +494,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-G7Z6EENO.js.map
+//# sourceMappingURL=chunk-YDWPYDML.js.map

package/dist/{chunk-6HPHEFXT.js → chunk-YKZLOPTC.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-6HPHEFXT.js.map
+//# sourceMappingURL=chunk-YKZLOPTC.js.map

package/dist/{chunk-NH5IR2WM.js → chunk-YR65W7BV.js}

@@ -4,7 +4,10 @@ import {
 } from "./chunk-KSXJOC4F.js";
 import {
   StorageManager
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
+import {
+  excludeSupportPassportPrivateMemories
+} from "./chunk-HNDIND7P.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -69,6 +72,7 @@ async function runCodexMaterialize(options) {
     const storage = new StorageManager(nsDir);
     memories = await storage.readAllMemories();
   }
+  memories = excludeSupportPassportPrivateMemories(memories);
   const result = materializeForNamespace(namespace, {
     memories,
     codexHome,
@@ -134,4 +138,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-NH5IR2WM.js.map
+//# sourceMappingURL=chunk-YR65W7BV.js.map

package/dist/chunk-YR65W7BV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connectors/codex-materialize-runner.ts","../src/namespaces/path.ts"],"sourcesContent":["/**\n * codex-materialize-runner.ts — Thin I/O bridge for the Codex materializer.\n *\n * The pure rendering logic lives in {@link ./codex-materialize.js}. This file\n * is the place callers (consolidation hooks, CLI, session-end hook) go when\n * they want the whole \"load memories from storage → render → write\" flow.\n *\n * Kept deliberately small so #378 never has to reach into orchestrator.ts /\n * importance.ts — the two files Wave 1 agents are editing concurrently.\n */\n\nimport { existsSync } from \"node:fs\";\n\nimport { log } from \"../logger.js\";\nimport { resolveNamespaceChildRoot } from \"../namespaces/path.js\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport { excludeSupportPassportPrivateMemories } from \"../support-passport/card-projection.js\";\nimport type { PluginConfig, MemoryFile } from \"../types.js\";\nimport {\n  hasCodexMaterializeSentinel,\n  materializeForNamespace,\n  type MaterializeResult,\n  type RolloutSummaryInput,\n} from \"./codex-materialize.js\";\n\n/** Options accepted by the shared post-consolidation materialize helper. */\nexport interface PostConsolidationMaterializeOptions {\n  config: PluginConfig;\n  namespace?: string;\n  memories?: MemoryFile[];\n  memoryDir?: string;\n  codexHome?: string;\n  rolloutSummaries?: RolloutSummaryInput[];\n  now?: Date;\n}\n\n/** Options accepted by the runner. */\nexport interface RunMaterializeOptions {\n  /** Remnic config — we only read the `codexMaterialize*` fields. */\n  config: PluginConfig;\n  /** Namespace to materialize. Overrides the config's `codexMaterializeNamespace`. */\n  namespace?: string;\n  /** Override the memory directory (defaults to `config.memoryDir`). */\n  memoryDir?: string;\n  /** Override `<codex_home>` (useful for tests). */\n  codexHome?: string;\n  /** Optional pre-loaded memories (bypasses disk read — used in tests). */\n  memories?: MemoryFile[];\n  /** Optional rollout summaries supplied by the caller. */\n  rolloutSummaries?: RolloutSummaryInput[];\n  /** Current time injection for deterministic runs. */\n  now?: Date;\n  /** Reason string — logged for observability. */\n  reason?: \"consolidation\" | \"session_end\" | \"manual\" | \"cli\";\n}\n\n/**\n * Run the Codex materialization end-to-end. Returns `null` when the feature\n * is disabled in config or when the user hasn't opted in via the sentinel.\n * Never throws for \"expected\" skips; only throws on schema validation or I/O\n * errors that callers actually need to surface.\n */\nexport async function runCodexMaterialize(\n  options: RunMaterializeOptions,\n): Promise<MaterializeResult | null> {\n  const cfg = options.config;\n  if (!cfg.codexMaterializeMemories) {\n    log.debug(`[codex-materialize] skipped — codexMaterializeMemories=false`);\n    return null;\n  }\n\n  // Per-trigger gate: session-end runs must honor codexMaterializeOnSessionEnd.\n  // The Codex Stop hook (remnic-codex-hook.cjs, session-end event) passes\n  // reason=\"session_end\"; when the user has turned off the session-end trigger\n  // we short-circuit here without touching disk.\n  if (options.reason === \"session_end\" && cfg.codexMaterializeOnSessionEnd === false) {\n    log.debug(\n      `[codex-materialize] skipped — session-end disabled via codexMaterializeOnSessionEnd=false`,\n    );\n    return null;\n  }\n\n  const namespace = resolveNamespace(options.namespace, cfg);\n  const memoryDir = options.memoryDir ?? cfg.memoryDir;\n  const codexHome = options.codexHome ?? cfg.codex?.codexHome ?? undefined;\n  if (!memoryDir) {\n    log.warn(`[codex-materialize] skipped — no memoryDir available`);\n    return null;\n  }\n\n  let memories: MemoryFile[];\n  if (options.memories) {\n    memories = options.memories;\n  } else {\n    if (!hasCodexMaterializeSentinel(codexHome)) {\n      return materializeForNamespace(namespace, {\n        memories: [],\n        codexHome,\n        maxSummaryTokens: cfg.codexMaterializeMaxSummaryTokens,\n        rolloutRetentionDays: cfg.codexMaterializeRolloutRetentionDays,\n        rolloutSummaries: options.rolloutSummaries,\n        now: options.now,\n      });\n    }\n    const nsDir = resolveNamespaceDir(memoryDir, namespace, cfg);\n    const storage = new StorageManager(nsDir);\n    memories = await storage.readAllMemories();\n  }\n  memories = excludeSupportPassportPrivateMemories(memories);\n\n  // Intentionally NOT catching here: per the JSDoc contract above,\n  // schema-validation and I/O errors from `materializeForNamespace` must\n  // surface to callers so they can exit non-zero (CLI) or log + recover\n  // (consolidation post-hook, which has its own narrower try/catch).\n  // Catching everything would make a broken MEMORY.md render look like a\n  // successful skip, and invisible failures are strictly worse than loud\n  // ones for a feature that writes to `~/.codex/memories`.\n  const result = materializeForNamespace(namespace, {\n    memories,\n    codexHome,\n    maxSummaryTokens: cfg.codexMaterializeMaxSummaryTokens,\n    rolloutRetentionDays: cfg.codexMaterializeRolloutRetentionDays,\n    rolloutSummaries: options.rolloutSummaries,\n    now: options.now,\n  });\n  if (options.reason) {\n    log.debug(\n      `[codex-materialize] ran reason=${options.reason} wrote=${result.wrote} files=${result.filesWritten.length}`,\n    );\n  }\n  return result;\n}\n\n/**\n * Shared helper for post-consolidation materialize hooks.\n *\n * `materializeAfterSemanticConsolidation` and `materializeAfterCausalConsolidation`\n * used to be two nearly-identical copies of this logic; keeping the actual\n * body here means any future guard/logging change happens in one place.\n *\n * The only per-caller knob is `logPrefix`, which is used to tag the\n * non-fatal warning emitted when the materializer throws.\n */\nexport async function runPostConsolidationMaterialize(\n  logPrefix: string,\n  options: PostConsolidationMaterializeOptions,\n): Promise<MaterializeResult | null> {\n  if (!options.config.codexMaterializeMemories) return null;\n  if (!options.config.codexMaterializeOnConsolidation) return null;\n  try {\n    return await runCodexMaterialize({\n      config: options.config,\n      namespace: options.namespace,\n      memories: options.memories,\n      memoryDir: options.memoryDir,\n      codexHome: options.codexHome,\n      rolloutSummaries: options.rolloutSummaries,\n      now: options.now,\n      reason: \"consolidation\",\n    });\n  } catch (error) {\n    log.warn(\n      `${logPrefix} Codex materialize post-hook failed (non-fatal): ${\n        error instanceof Error ? error.message : String(error)\n      }`,\n    );\n    return null;\n  }\n}\n\nfunction resolveNamespace(override: string | undefined, cfg: PluginConfig): string {\n  const requested = (override ?? cfg.codexMaterializeNamespace ?? \"auto\").trim();\n  const defaultNamespace = (cfg.defaultNamespace ?? \"\").trim();\n  const namespace =\n    requested.length === 0 || requested === \"auto\"\n      ? (defaultNamespace.length > 0 ? defaultNamespace : \"default\")\n      : requested;\n  if (!isSafeRouteNamespace(namespace)) {\n    throw new Error(`invalid materialize namespace: ${namespace}`);\n  }\n  return namespace;\n}\n\n/**\n * Resolve the on-disk storage root for a namespace, matching\n * `NamespaceStorageRouter` in `packages/remnic-core/src/namespaces/storage.ts`.\n *\n * Contract:\n *  - When namespaces are disabled, every namespace maps to `memoryDir` itself.\n *  - When namespaces are enabled, non-default namespaces always live under\n *    `memoryDir/namespaces/<namespace>`.\n *  - The default namespace prefers `memoryDir/namespaces/<defaultNamespace>`\n *    when that directory already exists (migrated install); otherwise it\n *    falls back to the legacy `memoryDir` root so materialization does not\n *    silently switch directories out from under an existing install.\n */\nfunction resolveNamespaceDir(\n  memoryDir: string,\n  namespace: string,\n  cfg: PluginConfig,\n): string {\n  if (!cfg.namespacesEnabled) return memoryDir;\n\n  const configuredDefaultNamespace = (cfg.defaultNamespace ?? \"\").trim();\n  const defaultNamespace =\n    configuredDefaultNamespace.length > 0 ? configuredDefaultNamespace : \"default\";\n  const ns = (namespace || defaultNamespace).trim();\n  if (!isSafeRouteNamespace(ns)) {\n    throw new Error(`invalid materialize namespace: ${ns}`);\n  }\n  const namespacedRoot = resolveNamespaceChildRoot(memoryDir, ns, \"materialize namespace path\");\n\n  if (ns === defaultNamespace) {\n    return existsSync(namespacedRoot) ? namespacedRoot : memoryDir;\n  }\n  return namespacedRoot;\n}\n","import path from \"node:path\";\n\nexport function assertNamespacePathInsideRoot(\n  root: string,\n  candidate: string,\n  namespace: string,\n  label = \"namespace path\",\n): void {\n  const relative = path.relative(root, candidate);\n  if (relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative))) {\n    return;\n  }\n  throw new Error(`invalid ${label}: ${namespace}`);\n}\n\nexport function resolveNamespaceChildRoot(\n  memoryDir: string,\n  namespace: string,\n  label = \"namespace path\",\n): string {\n  const namespaceRoot = path.resolve(memoryDir, \"namespaces\");\n  const candidate = path.resolve(namespaceRoot, namespace);\n  assertNamespacePathInsideRoot(namespaceRoot, candidate, namespace, label);\n  return candidate;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAWA,SAAS,kBAAkB;;;ACX3B,OAAO,UAAU;AAEV,SAAS,8BACd,MACA,WACA,WACA,QAAQ,kBACF;AACN,QAAM,WAAW,KAAK,SAAS,MAAM,SAAS;AAC9C,MAAI,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ,GAAI;AACjF;AAAA,EACF;AACA,QAAM,IAAI,MAAM,WAAW,KAAK,KAAK,SAAS,EAAE;AAClD;AAEO,SAAS,0BACd,WACA,WACA,QAAQ,kBACA;AACR,QAAM,gBAAgB,KAAK,QAAQ,WAAW,YAAY;AAC1D,QAAM,YAAY,KAAK,QAAQ,eAAe,SAAS;AACvD,gCAA8B,eAAe,WAAW,WAAW,KAAK;AACxE,SAAO;AACT;;;ADuCA,eAAsB,oBACpB,SACmC;AACnC,QAAM,MAAM,QAAQ;AACpB,MAAI,CAAC,IAAI,0BAA0B;AACjC,QAAI,MAAM,mEAA8D;AACxE,WAAO;AAAA,EACT;AAMA,MAAI,QAAQ,WAAW,iBAAiB,IAAI,iCAAiC,OAAO;AAClF,QAAI;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,YAAY,iBAAiB,QAAQ,WAAW,GAAG;AACzD,QAAM,YAAY,QAAQ,aAAa,IAAI;AAC3C,QAAM,YAAY,QAAQ,aAAa,IAAI,OAAO,aAAa;AAC/D,MAAI,CAAC,WAAW;AACd,QAAI,KAAK,2DAAsD;AAC/D,WAAO;AAAA,EACT;AAEA,MAAI;AACJ,MAAI,QAAQ,UAAU;AACpB,eAAW,QAAQ;AAAA,EACrB,OAAO;AACL,QAAI,CAAC,4BAA4B,SAAS,GAAG;AAC3C,aAAO,wBAAwB,WAAW;AAAA,QACxC,UAAU,CAAC;AAAA,QACX;AAAA,QACA,kBAAkB,IAAI;AAAA,QACtB,sBAAsB,IAAI;AAAA,QAC1B,kBAAkB,QAAQ;AAAA,QAC1B,KAAK,QAAQ;AAAA,MACf,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,oBAAoB,WAAW,WAAW,GAAG;AAC3D,UAAM,UAAU,IAAI,eAAe,KAAK;AACxC,eAAW,MAAM,QAAQ,gBAAgB;AAAA,EAC3C;AACA,aAAW,sCAAsC,QAAQ;AASzD,QAAM,SAAS,wBAAwB,WAAW;AAAA,IAChD;AAAA,IACA;AAAA,IACA,kBAAkB,IAAI;AAAA,IACtB,sBAAsB,IAAI;AAAA,IAC1B,kBAAkB,QAAQ;AAAA,IAC1B,KAAK,QAAQ;AAAA,EACf,CAAC;AACD,MAAI,QAAQ,QAAQ;AAClB,QAAI;AAAA,MACF,kCAAkC,QAAQ,MAAM,UAAU,OAAO,KAAK,UAAU,OAAO,aAAa,MAAM;AAAA,IAC5G;AAAA,EACF;AACA,SAAO;AACT;AAYA,eAAsB,gCACpB,WACA,SACmC;AACnC,MAAI,CAAC,QAAQ,OAAO,yBAA0B,QAAO;AACrD,MAAI,CAAC,QAAQ,OAAO,gCAAiC,QAAO;AAC5D,MAAI;AACF,WAAO,MAAM,oBAAoB;AAAA,MAC/B,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,kBAAkB,QAAQ;AAAA,MAC1B,KAAK,QAAQ;AAAA,MACb,QAAQ;AAAA,IACV,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI;AAAA,MACF,GAAG,SAAS,oDACV,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CACvD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,iBAAiB,UAA8B,KAA2B;AACjF,QAAM,aAAa,YAAY,IAAI,6BAA6B,QAAQ,KAAK;AAC7E,QAAM,oBAAoB,IAAI,oBAAoB,IAAI,KAAK;AAC3D,QAAM,YACJ,UAAU,WAAW,KAAK,cAAc,SACnC,iBAAiB,SAAS,IAAI,mBAAmB,YAClD;AACN,MAAI,CAAC,qBAAqB,SAAS,GAAG;AACpC,UAAM,IAAI,MAAM,kCAAkC,SAAS,EAAE;AAAA,EAC/D;AACA,SAAO;AACT;AAeA,SAAS,oBACP,WACA,WACA,KACQ;AACR,MAAI,CAAC,IAAI,kBAAmB,QAAO;AAEnC,QAAM,8BAA8B,IAAI,oBAAoB,IAAI,KAAK;AACrE,QAAM,mBACJ,2BAA2B,SAAS,IAAI,6BAA6B;AACvE,QAAM,MAAM,aAAa,kBAAkB,KAAK;AAChD,MAAI,CAAC,qBAAqB,EAAE,GAAG;AAC7B,UAAM,IAAI,MAAM,kCAAkC,EAAE,EAAE;AAAA,EACxD;AACA,QAAM,iBAAiB,0BAA0B,WAAW,IAAI,4BAA4B;AAE5F,MAAI,OAAO,kBAAkB;AAC3B,WAAO,WAAW,cAAc,IAAI,iBAAiB;AAAA,EACvD;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-GYPQL6XN.js → chunk-Z4N7SVVF.js}

@@ -10,17 +10,18 @@ import {
 import {
   DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS
 } from "./chunk-AREGMX2J.js";
+import {
+  isEncryptedOfflineSyncFile,
+  readPlainOfflineSyncFileChunk,
+  sha256OfflineSyncFile,
+  shouldExcludeOfflineSyncFile
+} from "./chunk-LC2BDILZ.js";
 import {
   parseFlexibleIsoTimestamp
 } from "./chunk-P7FMDTKL.js";
-import {
-  MAGIC_HEADER_SIZE,
-  isEncryptedFile
-} from "./chunk-XQ3HXAQH.js";
 
 // src/offline-sync.ts
 import { createHash, randomUUID } from "crypto";
-import { createReadStream } from "fs";
 import {
   lstat,
   mkdir,
@@ -502,7 +503,7 @@ async function readOfflineSyncFileRecord(options) {
     digest = sha256Buffer(content);
     content = null;
   } else {
-    digest = await sha256File(options.filePath, options.signal);
+    digest = await sha256OfflineSyncFile(options.filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   const st = await stat(options.filePath);
@@ -514,43 +515,6 @@ async function readOfflineSyncFileRecord(options) {
     ...content ? { contentBase64: content.toString("base64") } : {}
   };
 }
-async function sha256File(filePath, signal) {
-  const hash = createHash("sha256");
-  let bytes = 0;
-  for await (const chunk of createReadStream(filePath)) {
-    throwIfOfflineSyncAborted(signal);
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    hash.update(buffer);
-    bytes += buffer.length;
-  }
-  throwIfOfflineSyncAborted(signal);
-  return {
-    sha256: hash.digest("hex"),
-    bytes
-  };
-}
-async function fileIsSecureStoreEncrypted(filePath) {
-  const handle = await open(filePath, "r");
-  try {
-    const header = Buffer.alloc(MAGIC_HEADER_SIZE);
-    const { bytesRead } = await handle.read(header, 0, header.length, 0);
-    return bytesRead >= MAGIC_HEADER_SIZE && isEncryptedFile(header);
-  } finally {
-    await handle.close();
-  }
-}
-async function readPlainFileContentChunk(options) {
-  const chunkBytes = Math.min(options.length, options.bytes - options.offset);
-  const chunk = Buffer.alloc(chunkBytes);
-  if (chunkBytes === 0) return chunk;
-  const handle = await open(options.filePath, "r");
-  try {
-    const { bytesRead } = await handle.read(chunk, 0, chunk.length, options.offset);
-    return bytesRead === chunk.length ? chunk : chunk.subarray(0, bytesRead);
-  } finally {
-    await handle.close();
-  }
-}
 async function* iterateOfflineSyncSnapshotFileRecords(options) {
   throwIfOfflineSyncAborted(options.signal);
   const rootAbs = path.resolve(options.root);
@@ -570,6 +534,11 @@ async function* iterateOfflineSyncSnapshotFileRecords(options) {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs
+      })) continue;
       yield await readOfflineSyncFileRecord({
         root,
         relPath: relPosix,
@@ -634,6 +603,11 @@ async function buildOfflineSyncSnapshotFromBase(options) {
         continue;
       }
       if (!entry.isFile()) continue;
+      if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+        root: root.abs,
+        path: relPosix,
+        filePath: abs
+      })) continue;
       const st = await stat(abs);
       const baseEntry = base.get(relPosix);
       if (options.includeContent !== true && baseEntry && baseCapturedAtMs !== null && await canReuseFastBaseFileStateFromDisk(baseEntry, st, baseCapturedAtMs)) {
@@ -692,6 +666,13 @@ async function buildOfflineSyncSnapshotForPaths(options) {
       throw error;
     });
     if (!st || st.isSymbolicLink() || !st.isFile()) continue;
+    if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+      root: root.abs,
+      path: relPath,
+      filePath
+    })) {
+      throw new Error(`offline sync snapshot path is excluded: ${relPath}`);
+    }
     files.push(await readOfflineSyncFileRecord({
       root,
       relPath,
@@ -745,12 +726,19 @@ async function readOfflineSyncFileContentChunk(options) {
   if (!st || st.isSymbolicLink() || !st.isFile()) {
     throw new Error(`offline sync file content path not found: ${relPath}`);
   }
-  const encrypted = await fileIsSecureStoreEncrypted(filePath);
+  if (await shouldExcludeOfflineSyncFile(options.excludeFile, {
+    root: root.abs,
+    path: relPath,
+    filePath
+  })) {
+    throw new Error(`offline sync file content path is excluded: ${relPath}`);
+  }
+  const encrypted = await isEncryptedOfflineSyncFile(filePath);
   if (!encrypted) {
     if (offset > st.size) {
       throw new Error(`offset must be <= file size for ${relPath}`);
     }
-    const chunk2 = await readPlainFileContentChunk({
+    const chunk2 = await readPlainOfflineSyncFileChunk({
       filePath,
       offset,
       length: requestedLength,
@@ -1373,7 +1361,7 @@ async function readLocalFileState(options) {
     const content = await options.readFile({ root: options.rootAbs, path: options.relPath, filePath });
     digest = sha256Buffer(content);
   } else {
-    digest = await sha256File(filePath, options.signal);
+    digest = await sha256OfflineSyncFile(filePath, options.signal);
   }
   throwIfOfflineSyncAborted(options.signal);
   return {
@@ -1901,4 +1889,4 @@ export {
   normalizeOfflineSyncState,
   fileStatesFromSnapshot
 };
-//# sourceMappingURL=chunk-GYPQL6XN.js.map
+//# sourceMappingURL=chunk-Z4N7SVVF.js.map