@remnic/core 9.69.56 → 9.69.57

package/dist/secure-store/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secure-store/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,IAAI,EACJ,aAAa,EACb,IAAI,EACJ,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,GAClB,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,8BAA8B,EACnC,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,qBAAqB,EACrB,WAAW,EACX,yBAAyB,EACzB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,eAAe,EACf,cAAc,EACd,SAAS,EACT,WAAW,EACX,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAExC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAGhE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,oCAAoC,EACpC,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,eAAe,EACf,WAAW,EACX,eAAe,EACf,2BAA2B,EAC3B,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,8BAA8B,GACpC,MAAM,gBAAgB,CAAC"}

package/dist/secure-store/kdf.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Key-derivation functions for the secure-store module.
+ *
+ * Issue #690 (PR 1/4) — pure primitives, no I/O.
+ *
+ * Naming note
+ * -----------
+ * The directory is named `secure-store/` — NOT `vault/` — because
+ * `vault` is already a content-source concept in `native-knowledge.ts`
+ * (Obsidian vaults: `ObsidianVaultState`, `vaultId`, `obsidianVaults`
+ * config, etc.). Reusing the `vault` namespace for at-rest encryption
+ * would cause symbol collisions and reader confusion.
+ *
+ * KDF choice — Argon2id primary, scrypt compatibility
+ * ---------------------------------------------------
+ * Issue #690 specifies Argon2id (OWASP m=64 MiB, t=3, p=4) as the
+ * preferred KDF. We use `@node-rs/argon2` for the Argon2id runtime
+ * and keep scrypt as the compatibility path for stores initialized
+ * before Argon2id support landed.
+ *
+ * The algorithm name + params are persisted in the metadata file, so
+ * stores keep deriving with the same KDF they were initialized with.
+ *
+ * Trade-off summary:
+ *   - scrypt N=2^17, r=8, p=1 → ~128 MiB memory, ~150 ms on a modern
+ *     laptop. Memory-hard. Resists GPU/ASIC attacks meaningfully.
+ *   - Argon2id m=64 MiB, t=3, p=4 → ~64 MiB memory, similar wall
+ *     time. Considered the modern best-in-class but requires native
+ *     bindings.
+ *
+ * Both produce a 32-byte key suitable for AES-256-GCM.
+ */
+/** KDF algorithms supported by the secure-store metadata format. */
+export type KdfAlgorithm = "scrypt" | "argon2id";
+/** Parameters for the scrypt KDF (RFC 7914). */
+export interface ScryptParams {
+    /** CPU/memory cost. Must be a power of 2. Default 2^17 = 131072. */
+    N: number;
+    /** Block size. Default 8. */
+    r: number;
+    /** Parallelization. Default 1. */
+    p: number;
+    /** Output key length in bytes. Default 32 (AES-256). */
+    keyLength: number;
+    /** maxmem ceiling for scrypt; defaults to 256 MiB. */
+    maxmem: number;
+}
+/** Parameters for the Argon2id KDF. */
+export interface Argon2idParams {
+    /** Memory cost in KiB. OWASP default 65536 (64 MiB). */
+    memoryKiB: number;
+    /** Time cost (iterations). OWASP default 3. */
+    iterations: number;
+    /** Parallelism. OWASP default 4. */
+    parallelism: number;
+    /** Output key length in bytes. Default 32 (AES-256). */
+    keyLength: number;
+}
+/** Strong scrypt defaults (OWASP-acceptable for 2024+). */
+export declare const DEFAULT_SCRYPT_PARAMS: Readonly<ScryptParams>;
+/** OWASP Argon2id defaults. */
+export declare const DEFAULT_ARGON2ID_PARAMS: Readonly<Argon2idParams>;
+/** Salt length in bytes. 128 bits is the modern minimum. */
+export declare const KDF_SALT_LENGTH = 16;
+/** Required derived-key length for AES-256 (32 bytes). */
+export declare const KDF_KEY_LENGTH = 32;
+/**
+ * Validate that scrypt parameters are within sane bounds and that
+ * `N` is a power of 2 (required by RFC 7914).
+ */
+export declare function validateScryptParams(params: ScryptParams): void;
+/** Validate Argon2id parameters before invoking the native KDF binding. */
+export declare function validateArgon2idParams(params: Argon2idParams): void;
+/**
+ * Derive a key from a passphrase + salt using scrypt.
+ *
+ * Pure: no I/O, no global state, deterministic for a given
+ * (passphrase, salt, params) tuple.
+ *
+ * @throws if params are invalid.
+ */
+export declare function deriveKeyScrypt(passphrase: string, salt: Uint8Array, params?: ScryptParams): Buffer;
+/**
+ * Derive a key from a passphrase + salt using Argon2id.
+ *
+ * The returned raw hash is used directly as the AES-256-GCM master key.
+ * The same public KDF params are persisted in secure-store metadata so
+ * unlock can reproduce the exact key later.
+ */
+export declare function deriveKeyArgon2id(passphrase: string, salt: Uint8Array, params?: Argon2idParams): Buffer;
+/**
+ * Algorithm-dispatching KDF. The algorithm name is recorded in the
+ * metadata file so existing stores continue using their original KDF.
+ */
+export declare function deriveKey(algorithm: KdfAlgorithm, passphrase: string, salt: Uint8Array, params: ScryptParams | Argon2idParams): Buffer;
+/**
+ * Constant-time equality for two derived keys / MACs. Re-exported so
+ * callers don't reach into `node:crypto` directly for this primitive.
+ */
+export declare function constantTimeEqual(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=kdf.d.ts.map

package/dist/secure-store/kdf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../src/secure-store/kdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAuBH,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,CAAC;AAEjD,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,CAAC,EAAE,MAAM,CAAC;IACV,6BAA6B;IAC7B,CAAC,EAAE,MAAM,CAAC;IACV,kCAAkC;IAClC,CAAC,EAAE,MAAM,CAAC;IACV,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,YAAY,CAQvD,CAAC;AAEH,+BAA+B;AAC/B,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAK3D,CAAC;AAEH,4DAA4D;AAC5D,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,0DAA0D;AAC1D,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAgC/D;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAgBnE;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,EAChB,MAAM,GAAE,YAAoC,GAC3C,MAAM,CAmBR;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,EAChB,MAAM,GAAE,cAAwC,GAC/C,MAAM,CAuBR;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,YAAY,EACvB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,YAAY,GAAG,cAAc,GACpC,MAAM,CAQR;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAKvE"}

package/dist/secure-store/keyring.d.ts

@@ -0,0 +1,58 @@
+/**
+ * In-memory keyring for the secure-store module (issue #690 PR 2/4).
+ *
+ * Holds derived AES-256-GCM master keys for unlocked stores. The
+ * keyring is process-local: keys are NEVER persisted to disk, never
+ * logged, and never serialized. A daemon restart re-locks every
+ * registered store.
+ *
+ * Scoping
+ * -------
+ * Entries are keyed by a stable string id (typically the absolute
+ * path to the secure-store directory, after `~` expansion). This
+ * lets multiple memory roots share a single daemon process without
+ * one store's key bleeding into another (matches the per-`serviceId`
+ * scoping discipline called out in CLAUDE.md gotcha #11).
+ *
+ * Lifecycle
+ * ---------
+ *   - `unlock(id, key)` — register a derived key.
+ *   - `getKey(id)` — read a registered key (or `null`).
+ *   - `lock(id)` — clear a single entry, zeroing the key bytes.
+ *   - `lockAll()` — clear every entry, zeroing every key.
+ *   - `status(id)` — non-secret status snapshot for `secure-store
+ *     status`.
+ *
+ * Zeroization
+ * -----------
+ * `lock` and `lockAll` overwrite the key buffer with zeros before
+ * dropping the reference. The JS engine may keep additional copies
+ * outside our control; this is best-effort hygiene, not a defense
+ * against memory-dump attacks.
+ */
+/** Status snapshot — no secret material. */
+export interface KeyringStatus {
+    /** True iff a key is currently registered for this id. */
+    unlocked: boolean;
+    /** ISO-8601 timestamp the key was registered, or null when locked. */
+    unlockedAt: string | null;
+}
+/**
+ * Register a derived key for the given id. If an entry already
+ * exists, its old key is zeroed before being replaced.
+ *
+ * The caller MUST pass an exclusive 32-byte buffer; the keyring
+ * takes ownership and will zero it on lock.
+ */
+export declare function unlock(id: string, key: Buffer, now?: () => Date): void;
+/** Read the registered key for `id`, or `null` if locked. */
+export declare function getKey(id: string): Buffer | null;
+/** Clear a single entry. Zeros the underlying buffer. Returns true if cleared. */
+export declare function lock(id: string): boolean;
+/** Clear every registered key. Used on shutdown or for tests. */
+export declare function lockAll(): void;
+/** Non-secret status snapshot. */
+export declare function status(id: string): KeyringStatus;
+/** Test-only helper: how many entries are currently registered. */
+export declare function size(): number;
+//# sourceMappingURL=keyring.d.ts.map

package/dist/secure-store/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../src/secure-store/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAUH,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,IAAuB,GAAG,IAAI,CAYxF;AAED,6DAA6D;AAC7D,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhD;AAED,kFAAkF;AAClF,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAMxC;AAED,iEAAiE;AACjE,wBAAgB,OAAO,IAAI,IAAI,CAK9B;AAED,kCAAkC;AAClC,wBAAgB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,CAMhD;AAED,mEAAmE;AACnE,wBAAgB,IAAI,IAAI,MAAM,CAE7B"}

package/dist/secure-store/metadata.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Secure-store metadata file format.
+ *
+ * Issue #690 (PR 1/4) — pure data structure + serialize/parse helpers.
+ * No I/O. The eventual `secure-store init` CLI (PR 2/4) will be the
+ * surface that actually writes a metadata file to disk.
+ *
+ * Purpose
+ * -------
+ * When at-rest encryption is enabled, the memory directory needs a
+ * stable record of:
+ *
+ *   - which KDF algorithm was used to derive the master key,
+ *   - the algorithm parameters (so changing OWASP defaults later
+ *     doesn't break existing stores),
+ *   - the canonical salt for the master key,
+ *   - the metadata format version (so we can evolve the file).
+ *
+ * Crucially, the metadata file does **not** contain the master key,
+ * the passphrase, or anything that would let an attacker decrypt
+ * memories. It contains only the public parameters needed to
+ * re-derive the same key from the same passphrase.
+ *
+ * On-disk shape
+ * -------------
+ * The file is JSON. All binary fields are encoded as lowercase hex
+ * strings (chosen over base64 for readability when the file is
+ * `cat`'d during incident response).
+ *
+ *   {
+ *     "format": "remnic.secure-store.metadata",
+ *     "formatVersion": 1,
+ *     "kdf": {
+ *       "algorithm": "argon2id",
+ *       "params": { "memoryKiB": 65536, "iterations": 3, "parallelism": 4, "keyLength": 32 },
+ *       "salt": "<32-hex-chars-for-16-bytes>"
+ *     },
+ *     "createdAt": "<ISO-8601 timestamp>",
+ *     "note": "<optional human-readable note>"
+ *   }
+ */
+import { type Argon2idParams, type KdfAlgorithm, type ScryptParams } from "./kdf.js";
+/** Stable identifier so we can sniff the file shape without parsing JSON. */
+export declare const METADATA_FORMAT: "remnic.secure-store.metadata";
+/** Current metadata format version. Bump on breaking schema changes. */
+export declare const METADATA_FORMAT_VERSION: 1;
+export interface SecureStoreMetadataKdfScrypt {
+    algorithm: "scrypt";
+    params: ScryptParams;
+    /** Hex-encoded salt. Length must match `KDF_SALT_LENGTH` after decode. */
+    salt: string;
+}
+export interface SecureStoreMetadataKdfArgon2id {
+    algorithm: "argon2id";
+    params: Argon2idParams;
+    salt: string;
+}
+export type SecureStoreMetadataKdf = SecureStoreMetadataKdfScrypt | SecureStoreMetadataKdfArgon2id;
+export interface SecureStoreMetadata {
+    format: typeof METADATA_FORMAT;
+    formatVersion: number;
+    kdf: SecureStoreMetadataKdf;
+    /** ISO-8601 timestamp recorded at init time. */
+    createdAt: string;
+    /** Optional human-readable note. Never persist secrets here. */
+    note?: string;
+}
+export interface BuildMetadataOptions {
+    algorithm: KdfAlgorithm;
+    salt: Uint8Array;
+    /** Optional override; defaults to `DEFAULT_SCRYPT_PARAMS` / `DEFAULT_ARGON2ID_PARAMS`. */
+    params?: ScryptParams | Argon2idParams;
+    /** Optional ISO timestamp. Defaults to `new Date().toISOString()`. */
+    createdAt?: string;
+    /** Optional human-readable note. */
+    note?: string;
+}
+/**
+ * Build an in-memory `SecureStoreMetadata` object from the given
+ * algorithm + salt. Pure: does not touch the filesystem or the clock
+ * unless `createdAt` is omitted (in which case `new Date()` is read).
+ */
+export declare function buildMetadata(options: BuildMetadataOptions): SecureStoreMetadata;
+/**
+ * Serialize metadata to a stable JSON string with sorted top-level
+ * keys. Stable ordering matters because hash-based integrity checks
+ * may eventually consume the serialized form.
+ */
+export declare function serializeMetadata(meta: SecureStoreMetadata): string;
+/**
+ * Parse a metadata JSON string. Throws on any structural problem.
+ * Callers that need to migrate older formats should branch on
+ * `formatVersion` *before* calling this; this function is strict
+ * about the current version.
+ */
+export declare function parseMetadata(json: string): SecureStoreMetadata;
+/** Validate a metadata object's invariants. Throws on the first problem. */
+export declare function validateMetadata(meta: SecureStoreMetadata): void;
+/**
+ * Decode the salt field of a metadata object back into bytes.
+ * Convenience helper so callers don't reach into the hex codec.
+ */
+export declare function decodeMetadataSalt(meta: SecureStoreMetadata): Buffer;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/secure-store/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../src/secure-store/metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,UAAU,CAAC;AAElB,6EAA6E;AAC7E,eAAO,MAAM,eAAe,EAAG,8BAAuC,CAAC;AAEvE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,EAAG,CAAU,CAAC;AAElD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,QAAQ,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,UAAU,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,sBAAsB,GAC9B,4BAA4B,GAC5B,8BAA8B,CAAC;AAEnC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,eAAe,CAAC;IAC/B,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,sBAAsB,CAAC;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAyBD,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,YAAY,CAAC;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC;IACvC,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAkChF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAenE;AA4BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CA4C/D;AA8DD,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAiEhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CAEpE"}

package/dist/secure-store/passphrase-reader.d.ts

@@ -0,0 +1,40 @@
+/**
+ * TTY passphrase reader (issue #690 PR 2/4).
+ *
+ * Reads a line from stdin without echoing it back to the terminal.
+ * Disables echo by setting raw mode + manually buffering input until
+ * Enter / EOT.
+ *
+ * Why not `readline.question`?
+ * ----------------------------
+ * `readline` echoes by default and has no clean "no-echo" toggle that
+ * survives across Node versions. The raw-mode loop is the canonical
+ * idiom for reading passwords on Node and matches what `npm` uses
+ * internally.
+ *
+ * Security
+ * --------
+ *   - Never log the passphrase (no `console.log`, no debug output).
+ *   - Never include it in a thrown error message.
+ *   - On Ctrl+C / Ctrl+D, abort with a clear error rather than
+ *     silently treating EOF as an empty submission.
+ *   - On non-TTY stdin (pipe, redirect), read a line via line-buffered
+ *     readline so automation (`echo "passphrase" | remnic ...`) works.
+ *     Operators are responsible for not piping plaintext passphrases
+ *     in shell history; we surface a stderr warning.
+ */
+import type { Readable, Writable } from "node:stream";
+import type { PassphraseReader } from "./cli-handlers.js";
+export interface CreatePassphraseReaderOptions {
+    input?: Readable;
+    output?: Writable;
+    /** Override stderr for warning surface; defaults to `process.stderr`. */
+    errorStream?: Writable;
+}
+/**
+ * Build a `PassphraseReader` bound to the given streams. Exported so
+ * tests can construct one against in-memory streams without touching
+ * the real TTY.
+ */
+export declare function createPassphraseReader(options?: CreatePassphraseReaderOptions): PassphraseReader;
+//# sourceMappingURL=passphrase-reader.d.ts.map

package/dist/secure-store/passphrase-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase-reader.d.ts","sourceRoot":"","sources":["../../src/secure-store/passphrase-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,6BAA6B;IAC5C,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,yEAAyE;IACzE,WAAW,CAAC,EAAE,QAAQ,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,6BAAkC,GAC1C,gBAAgB,CAuDlB"}

package/dist/secure-store/secure-fs.d.ts

@@ -0,0 +1,227 @@
+/**
+ * Transparent file-level encryption for the secure-store module.
+ *
+ * Issue #690 (PR 3/4) — storage.ts integration layer.
+ *
+ * This module sits between the raw filesystem and StorageManager.
+ * Every memory file is either:
+ *   - a plain UTF-8 text file (legacy, back-compat), or
+ *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).
+ *
+ * On-disk format
+ * --------------
+ * Encrypted files begin with a 9-byte magic header:
+ *
+ *   REMNIC-ENC  (7 ASCII bytes)
+ *   VER         (1 byte, currently 0x01)
+ *   FLAGS       (1 byte, reserved, must be 0x00)
+ *
+ * Followed immediately by a `seal()` envelope from `cipher.ts`:
+ *
+ *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]
+ *
+ * The magic header makes encrypted files sniffable without attempting
+ * a full `open()` call and gives operators a clear signal that the
+ * file cannot be read by opening it in an editor.
+ *
+ * AAD
+ * ---
+ * The file path relative to the memory root is bound as Associated
+ * Authenticated Data (AAD) on both encrypt and decrypt. This means
+ * moving or renaming an encrypted file without re-encrypting it will
+ * cause auth-tag failure on the next read — the file is tied to its
+ * path. Callers that move files must re-encrypt them.
+ *
+ * Back-compat
+ * -----------
+ * `readMaybeEncryptedFile` transparently handles both formats: if the
+ * file does NOT start with the magic bytes, it is returned as-is (plain
+ * text). This lets an operator migrate incrementally: newly-written
+ * files are encrypted while existing files continue to be read in plain
+ * form until `migrateMemoryDirToEncrypted` is run.
+ *
+ * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.
+ */
+/**
+ * Thrown when a read is attempted but the keyring entry for this
+ * store is absent (i.e. `secure-store unlock` has not been run
+ * since the last daemon start).
+ */
+export declare class SecureStoreLockedError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Thrown when `open()` fails because the auth tag does not validate.
+ * This covers both wrong-key and tampered-ciphertext scenarios —
+ * intentionally indistinguishable from the caller's perspective.
+ */
+export declare class SecureStoreDecryptError extends Error {
+    constructor(message?: string);
+}
+/** Magic bytes: the ASCII string "REMNIC-ENC" (10 bytes). */
+export declare const MAGIC_BYTES: Buffer<ArrayBuffer>;
+/** Current on-disk version byte. */
+export declare const FILE_FORMAT_VERSION = 1;
+/** Reserved flags byte — must be 0x00. */
+export declare const FILE_FORMAT_FLAGS = 0;
+/** Total size of the magic header prefix (magic + version + flags). */
+export declare const MAGIC_HEADER_SIZE: number;
+/**
+ * Exact, deterministic bytes `writeMaybeEncryptedFile` adds to an encrypted
+ * file beyond its plaintext body: the magic header prefix plus the fixed
+ * envelope header (version + salt + IV + auth tag). AES-256-GCM ciphertext
+ * matches the plaintext length and the state-file write path applies no
+ * compression, so an encrypted state file is exactly `plaintext +
+ * SECURE_STORE_ENVELOPE_OVERHEAD_BYTES` on disk. Compaction reserves this so an
+ * encrypted ledger lands strictly below the reader's whole-file decrypt cap
+ * (issue #2033).
+ */
+export declare const SECURE_STORE_ENVELOPE_OVERHEAD_BYTES: number;
+/**
+ * Return true iff `buf` begins with the REMNIC-ENC magic header.
+ * Does not validate the envelope; just identifies the format.
+ */
+export declare function isEncryptedFile(buf: Uint8Array): boolean;
+/**
+ * True when the REGULAR file at `probePath` is encrypted at rest (its first
+ * bytes are the REMNIC-ENC magic header). ENOENT resolves to false — an absent
+ * file has nothing to probe. A symlink, FIFO, device, or any other non-regular
+ * path is REFUSED with a throw rather than opened: opening a FIFO blocks until a
+ * writer appears and a symlink would redirect the probe outside our tree. The
+ * ledgers and per-event spills we manage are always regular files, so a
+ * non-regular path is an anomaly the caller must treat as unsafe, never follow
+ * (#2033). Shared by the CLI ledger recovery probe and the auto-compaction probe
+ * so both enforce identical open safety.
+ */
+export declare function probeEncryptedRegularFileHeader(probePath: string): Promise<boolean>;
+/**
+ * Encrypt `plain` (UTF-8 content of a memory file) and return a
+ * Buffer ready to write to disk.
+ *
+ * @param plain  Plain-text file content (UTF-8 string or Buffer).
+ * @param key    32-byte AES-256 key from the keyring.
+ * @param aad    Optional associated data — defaults to empty if omitted.
+ *               Callers should pass the file path relative to memoryDir
+ *               so the ciphertext is bound to its location.
+ */
+export declare function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer;
+/**
+ * Decrypt a buffer produced by `encryptFileBody` and return the
+ * original UTF-8 content.
+ *
+ * Throws `SecureStoreDecryptError` on auth failure (wrong key or
+ * tampered ciphertext). Throws a plain `Error` for structural problems
+ * (truncated buffer, wrong magic, unsupported version).
+ */
+export declare function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer;
+/**
+ * Build the AAD buffer for a file at `filePath` relative to
+ * `memoryDir`. The AAD binds the ciphertext to its path so a
+ * file cannot be silently relocated without re-encryption.
+ *
+ * When `memoryDir` is supplied and `filePath` is absolute, the
+ * relative sub-path is used. Otherwise `filePath` is used verbatim.
+ */
+export declare function filePathAad(filePath: string, memoryDir?: string): Buffer;
+/**
+ * Read a file from `filePath`.
+ *
+ * - If the file is plaintext (no magic header), return its content
+ *   as-is — back-compat with unencrypted stores.
+ * - If the file is encrypted AND `key` is provided, decrypt and return
+ *   the plaintext content.
+ * - If the file is encrypted AND `key` is null, throw
+ *   `SecureStoreLockedError`.
+ *
+ * @param filePath  Absolute path to the file.
+ * @param key       32-byte AES-256 key, or null when the store is locked.
+ * @param memoryDir Memory root for path-bound AAD.  Should be absolute.
+ */
+export declare function readMaybeEncryptedFileBuffer(filePath: string, key: Buffer | null, memoryDir?: string): Promise<Buffer>;
+export declare function readMaybeEncryptedFile(filePath: string, key: Buffer | null, memoryDir?: string): Promise<string>;
+export interface WriteMaybeEncryptedFileOptions {
+    /**
+     * File mode bits. Default 0o600 (owner read/write only).
+     * Applied only on create; existing files inherit their existing mode.
+     */
+    mode?: number;
+    /**
+     * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).
+     * Default true.
+     */
+    atomic?: boolean;
+}
+/**
+ * Write `content` to `filePath`.
+ *
+ * - If `key` is provided and non-null, encrypt the content first.
+ * - If `key` is null, write the content as plain UTF-8 (unencrypted store).
+ *
+ * Writes atomically: content is written to a unique temp file
+ * first, then renamed into place (CLAUDE.md gotcha #54 — never delete
+ * before write).
+ */
+export declare function writeMaybeEncryptedFile(filePath: string, content: string | Buffer, key: Buffer | null, options?: WriteMaybeEncryptedFileOptions, memoryDir?: string): Promise<void>;
+export declare function writeMaybeEncryptedFileFromChunks(filePath: string, chunks: AsyncIterable<Buffer>, key: Buffer | null, options?: WriteMaybeEncryptedFileOptions, memoryDir?: string): Promise<void>;
+/**
+ * Stream a file through the secure-store reader without buffering the whole
+ * payload. Plaintext files are passed through unchanged; encrypted files are
+ * authenticated and decrypted incrementally.
+ */
+export declare function readMaybeEncryptedFileFromChunks(filePath: string, key: Buffer | null, memoryDir?: string, chunkSize?: number): AsyncIterable<Buffer>;
+export interface MigrateResult {
+    /** Number of files successfully encrypted. */
+    encrypted: number;
+    /** Number of files already encrypted (skipped). */
+    skipped: number;
+    /** Files that failed to encrypt (path → error message). */
+    errors: Array<{
+        filePath: string;
+        error: string;
+    }>;
+}
+export interface DecryptResult {
+    /** Number of files successfully decrypted back to plaintext. */
+    decrypted: number;
+    /** Number of files already plaintext (skipped). */
+    skipped: number;
+    /** Files that failed to decrypt (path → error message). */
+    errors: Array<{
+        filePath: string;
+        error: string;
+    }>;
+}
+/**
+ * Walk `dir` recursively, find encryptable storage-managed files that are not
+ * yet encrypted, and re-write them as encrypted files under `key`.
+ *
+ * Safety rules per CLAUDE.md gotchas #54 and #25:
+ *   1. A page-version snapshot is taken (via `createVersion`) BEFORE
+ *      each overwrite so the plaintext version is preserved in history.
+ *      Since this module has no direct access to `page-versioning.ts`
+ *      internals, callers who have page-versioning configured should
+ *      pass `onBeforeEncrypt` to take the snapshot.
+ *   2. The new encrypted content is written to a temp file first,
+ *      then renamed atomically — never deleted before written.
+ *   3. If encryption of any file fails, the error is recorded and the
+ *      original file is left intact (partial migration is safe).
+ *
+ * @param dir              Absolute path to the memory directory.
+ * @param key              32-byte AES-256 key.
+ * @param onBeforeEncrypt  Optional callback invoked before encrypting
+ *                         each file. Can be used to take page-version
+ *                         snapshots. Errors here are non-fatal.
+ */
+export declare function migrateMemoryDirToEncrypted(dir: string, key: Buffer, onBeforeEncrypt?: (filePath: string) => Promise<void>): Promise<MigrateResult>;
+/**
+ * Walk `dir` recursively, find storage-managed encrypted files, and
+ * re-write them as plaintext under the same paths.
+ *
+ * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.
+ * It only touches files under the same storage-managed roots, skips
+ * plaintext files, skips symlinks, excludes `.secure-store/`, and writes
+ * each plaintext replacement via temp-file + rename so a per-file failure
+ * leaves the ciphertext intact.
+ */
+export declare function decryptMemoryDirToPlaintext(dir: string, key: Buffer): Promise<DecryptResult>;
+//# sourceMappingURL=secure-fs.d.ts.map

package/dist/secure-store/secure-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-fs.d.ts","sourceRoot":"","sources":["../../src/secure-store/secure-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAyBH;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAAyE;CAI7F;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,SAAsE;CAI1F;AAMD,6DAA6D;AAC7D,eAAO,MAAM,WAAW,qBAAqC,CAAC;AAE9D,oCAAoC;AACpC,eAAO,MAAM,mBAAmB,IAAO,CAAC;AAExC,0CAA0C;AAC1C,eAAO,MAAM,iBAAiB,IAAO,CAAC;AAEtC,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAAyB,CAAC;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,oCAAoC,QAA2C,CAAC;AAM7F;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAIxD;AAgBD;;;;;;;;;;GAUG;AACH,wBAAsB,+BAA+B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBzF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAWzF;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAsB9E;AAaD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAMxE;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,OAAO,GAAE,8BAAmC,EAC5C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,OAAO,GAAE,8BAAmC,EAC5C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,wBAAuB,gCAAgC,CACrD,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,SAAY,GACpB,aAAa,CAAC,MAAM,CAAC,CA2DvB;AAMD,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GACpD,OAAO,CAAC,aAAa,CAAC,CAgDxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAmClG"}

package/dist/security/audit-memory-cli.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Security command group extracted from cli.ts (#1955).
+ *
+ * Behaviour is identical to the inline registration it replaces.
+ */
+import type { CliCommand } from "../cli.js";
+import type { Orchestrator } from "../orchestrator.js";
+export declare function registerSecurityCommands(cmd: CliCommand, orchestrator: Orchestrator): void;
+//# sourceMappingURL=audit-memory-cli.d.ts.map

package/dist/security/audit-memory-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-memory-cli.d.ts","sourceRoot":"","sources":["../../src/security/audit-memory-cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,UAAU,EACf,YAAY,EAAE,YAAY,GACzB,IAAI,CA2BN"}

package/dist/security/audit-memory.d.ts

@@ -0,0 +1,48 @@
+import type { MemoryFile, MemoryFrontmatter } from "../types.js";
+export type AuditMemoryFindingCategory = "injection-signature" | "write-burst" | "authority-escalation";
+export interface AuditMemoryFinding {
+    memoryId: string;
+    category: AuditMemoryFindingCategory;
+    rule: string;
+    excerpt: string;
+    lineageHint: string;
+}
+export interface AuditMemoryStorage {
+    readAllMemories(): Promise<MemoryFile[]>;
+    readAllColdMemories?: () => Promise<MemoryFile[]>;
+    readMemoryByPath(filePath: string): Promise<MemoryFile | null>;
+    writeMemoryFrontmatterIfUnchanged(expected: MemoryFile, patch: Partial<MemoryFrontmatter>, lifecycle?: {
+        actor?: string;
+        reasonCode?: string;
+        ruleVersion?: string;
+        at?: Date;
+    }): Promise<boolean>;
+}
+export interface AuditMemoryStoreOptions {
+    memoryDir: string;
+    since?: string | Date;
+    quarantine?: boolean;
+    now?: Date;
+    storage: AuditMemoryStorage;
+}
+export interface AuditMemoryReport {
+    since?: string;
+    scannedMemories: number;
+    activeMemories: number;
+    findings: AuditMemoryFinding[];
+    quarantinedMemoryIds: string[];
+    transitions: number;
+    writeBurstStats: {
+        groupCount: number;
+        mean: number;
+        standardDeviation: number;
+        threshold: number;
+        anomalousGroups: Array<{
+            lineageHint: string;
+            count: number;
+        }>;
+    };
+}
+export declare function auditMemoryStore(options: AuditMemoryStoreOptions): Promise<AuditMemoryReport>;
+export declare function formatAuditMemoryReport(report: AuditMemoryReport): string;
+//# sourceMappingURL=audit-memory.d.ts.map

package/dist/security/audit-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-memory.d.ts","sourceRoot":"","sources":["../../src/security/audit-memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAKjE,MAAM,MAAM,0BAA0B,GAClC,qBAAqB,GACrB,aAAa,GACb,sBAAsB,CAAC;AAE3B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,0BAA0B,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACzC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAClD,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC/D,iCAAiC,CAC/B,QAAQ,EAAE,UAAU,EACpB,KAAK,EAAE,OAAO,CAAC,iBAAiB,CAAC,EACjC,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,EAAE,CAAC,EAAE,IAAI,CAAC;KACX,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,kBAAkB,EAAE,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,KAAK,CAAC;YAAE,WAAW,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAChE,CAAC;CACH;AAqJD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuFnG;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAuBzE"}

package/dist/security/injection-screen.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Deterministic write-path screening for prompt-injection-shaped facts (#1955).
+ *
+ * This module has no model or storage calls. It only returns explainable
+ * findings so callers can quarantine a candidate for human review.
+ */
+export interface InjectionScreenFinding {
+    rule: string;
+    excerpt: string;
+}
+export interface InjectionScreenResult {
+    score: number;
+    findings: InjectionScreenFinding[];
+    quarantine: boolean;
+}
+export declare const INJECTION_SCREEN_THRESHOLD = 4;
+/** Screen a candidate fact without model calls, I/O, or mutable state. */
+export declare function screenCandidateFact(content: string): InjectionScreenResult;
+//# sourceMappingURL=injection-screen.d.ts.map

package/dist/security/injection-screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-screen.d.ts","sourceRoot":"","sources":["../../src/security/injection-screen.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,UAAU,EAAE,OAAO,CAAC;CACrB;AAqBD,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAuG5C,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAgB1E"}