@runcore-sh/runcore 0.1.2

package/dist/lib/brain-io.js

@@ -0,0 +1,180 @@
+/**
+ * Centralized encrypted I/O for brain files at rest.
+ * Brain file reads/writes go through this module for transparent
+ * encryption/decryption using AES-256-GCM with the session-derived key.
+ * Only files in the ENCRYPTED_FILES set (episodic/personal) are encrypted.
+ *
+ * Two modes:
+ * - Per-line (JSONL): each line encrypted individually, preserving append-only semantics.
+ * - Whole-file (YAML, MD, JSON): entire file content encrypted as one blob.
+ *
+ * Backward compatible: plaintext content passes through on read when no encryption
+ * marker is detected. Mixed encrypted/plaintext lines are handled gracefully.
+ */
+import { readFile, writeFile, appendFile, mkdir } from "node:fs/promises";
+import { readFileSync, appendFileSync, mkdirSync, existsSync, } from "node:fs";
+import { dirname } from "node:path";
+import { createLogger } from "../utils/logger.js";
+import { getEncryptionKey, getWriteEncryptionKey } from "./key-store.js";
+const log = createLogger("brain-io");
+import { shouldEncryptFile } from "./encryption-config.js";
+import { encryptLine, decryptLine, isEncryptedLine, encryptFile, decryptFile, isEncryptedFile, } from "./encryption.js";
+// ── Helpers ──────────────────────────────────────────────────────────────────
+/** Returns the encryption key for reading (decryption) if the file is encrypted, or null. */
+function readKey(filePath) {
+    if (!shouldEncryptFile(filePath))
+        return null;
+    return getEncryptionKey();
+}
+/** Returns the encryption key for writing if the file should be encrypted AND writes are enabled. */
+function writeKey(filePath) {
+    if (!shouldEncryptFile(filePath))
+        return null;
+    return getWriteEncryptionKey();
+}
+// ── Async JSONL (per-line) I/O ───────────────────────────────────────────────
+/**
+ * Read a JSONL file, decrypting each line if needed.
+ * Returns raw (decrypted) line strings. Caller is responsible for JSON.parse.
+ * Empty/whitespace lines are filtered out.
+ */
+export async function readBrainLines(filePath) {
+    let raw;
+    try {
+        raw = await readFile(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+    const key = readKey(filePath);
+    if (!key)
+        return lines;
+    return lines.map((line) => {
+        if (isEncryptedLine(line)) {
+            try {
+                return decryptLine(line, key);
+            }
+            catch {
+                log.debug(`Decryption failed for line in ${filePath} — passing through as-is`);
+                return line;
+            }
+        }
+        return line;
+    });
+}
+/**
+ * Append a single line to a JSONL file, encrypting if enabled.
+ * The line should be a JSON string (not newline-terminated).
+ */
+export async function appendBrainLine(filePath, jsonLine) {
+    const key = writeKey(filePath);
+    const line = key ? encryptLine(jsonLine, key) : jsonLine;
+    await appendFile(filePath, line + "\n", "utf-8");
+}
+/**
+ * Write an entire JSONL file from an array of JSON strings, encrypting each if enabled.
+ * Used for compaction/rotation where the whole file is rewritten.
+ */
+export async function writeBrainLines(filePath, jsonLines) {
+    const key = writeKey(filePath);
+    const output = jsonLines
+        .map((l) => (key ? encryptLine(l, key) : l))
+        .join("\n") + "\n";
+    await writeFile(filePath, output, "utf-8");
+}
+// ── Async whole-file I/O (YAML, MD, JSON) ────────────────────────────────────
+/**
+ * Read a brain file (MD, YAML, JSON), decrypting if it's an encrypted blob.
+ * Returns the plaintext content. Falls back to raw content if not encrypted.
+ */
+export async function readBrainFile(filePath) {
+    const raw = await readFile(filePath, "utf-8");
+    const key = readKey(filePath);
+    if (key && isEncryptedFile(raw)) {
+        return decryptFile(raw, key);
+    }
+    return raw;
+}
+/**
+ * Write a brain file (MD, YAML, JSON), encrypting if enabled.
+ * Creates parent directories if needed.
+ */
+export async function writeBrainFile(filePath, content) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const key = writeKey(filePath);
+    const output = key ? encryptFile(content, key) : content;
+    await writeFile(filePath, output, "utf-8");
+}
+// ── Sync JSONL I/O (for activity log and other fire-and-forget paths) ────────
+/**
+ * Synchronously read a JSONL file, decrypting each line if needed.
+ */
+export function readBrainLinesSync(filePath) {
+    let raw;
+    try {
+        raw = readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return [];
+    }
+    const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+    const key = readKey(filePath);
+    if (!key)
+        return lines;
+    return lines.map((line) => {
+        if (isEncryptedLine(line)) {
+            try {
+                return decryptLine(line, key);
+            }
+            catch {
+                log.debug(`Decryption failed for line in ${filePath} — passing through as-is`);
+                return line;
+            }
+        }
+        return line;
+    });
+}
+/**
+ * Synchronously append a single line to a JSONL file, encrypting if enabled.
+ */
+export function appendBrainLineSync(filePath, jsonLine) {
+    const key = writeKey(filePath);
+    const line = key ? encryptLine(jsonLine, key) : jsonLine;
+    appendFileSync(filePath, line + "\n", "utf-8");
+}
+/**
+ * Synchronously ensure a directory exists.
+ */
+export function ensureDirSync(dirPath) {
+    if (!existsSync(dirPath)) {
+        mkdirSync(dirPath, { recursive: true });
+    }
+}
+/**
+ * Synchronously ensure a JSONL file exists with a schema header.
+ */
+export function ensureBrainFileSync(filePath, schemaLine) {
+    ensureDirSync(dirname(filePath));
+    if (!existsSync(filePath)) {
+        const key = writeKey(filePath);
+        const line = key ? encryptLine(schemaLine, key) : schemaLine;
+        appendFileSync(filePath, line + "\n", "utf-8");
+    }
+}
+// ── Async JSONL ensure ───────────────────────────────────────────────────────
+/**
+ * Ensure a JSONL file exists with a schema header line (encrypted if applicable).
+ */
+export async function ensureBrainJsonl(filePath, schemaLine) {
+    try {
+        await readFile(filePath, "utf-8");
+    }
+    catch {
+        await mkdir(dirname(filePath), { recursive: true });
+        const key = writeKey(filePath);
+        const line = key ? encryptLine(schemaLine, key) : schemaLine;
+        await appendFile(filePath, line + "\n", "utf-8");
+    }
+}
+//# sourceMappingURL=brain-io.js.map

package/dist/lib/brain-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-io.js","sourceRoot":"","sources":["../../src/lib/brain-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EACL,YAAY,EAEZ,cAAc,EACd,SAAS,EACT,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,WAAW,EACX,eAAe,EACf,WAAW,EACX,WAAW,EACX,eAAe,GAChB,MAAM,iBAAiB,CAAC;AAEzB,gFAAgF;AAEhF,6FAA6F;AAC7F,SAAS,OAAO,CAAC,QAAgB;IAC/B,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,qGAAqG;AACrG,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,QAAgB;IACtE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,SAAmB;IACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAe;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,OAAO,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,iCAAiC,QAAQ,0BAA0B,CAAC,CAAC;gBAC/E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,UAAkB;IACtE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7D,cAAc,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7D,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/dist/lib/encryption-config.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Encryption configuration for brain files at rest.
+ * Only episodic/personal memory files are encrypted. Structural files
+ * (goals, queue, open-loops, settings, skills, templates) stay plaintext
+ * for git-diffability and debugging.
+ */
+/**
+ * Check if a specific brain file should be encrypted.
+ * Only files in the ENCRYPTED_FILES allowlist are encrypted.
+ */
+export declare function shouldEncryptFile(fileName: string): boolean;
+/** Get the basenames of files that are encrypted. */
+export declare function getEncryptedFiles(): string[];
+/** Alias for getEncryptedFiles (used by tests). */
+export declare const getEncryptedFileList: typeof getEncryptedFiles;
+//# sourceMappingURL=encryption-config.d.ts.map

package/dist/lib/encryption-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-config.d.ts","sourceRoot":"","sources":["../../src/lib/encryption-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwBH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAED,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,0BAAoB,CAAC"}

package/dist/lib/encryption-config.js

@@ -0,0 +1,40 @@
+/**
+ * Encryption configuration for brain files at rest.
+ * Only episodic/personal memory files are encrypted. Structural files
+ * (goals, queue, open-loops, settings, skills, templates) stay plaintext
+ * for git-diffability and debugging.
+ */
+import { basename } from "node:path";
+/** Brain files that contain personal data and must be encrypted. */
+const ENCRYPTED_FILES = new Set([
+    // Episodic memory
+    "experiences.jsonl",
+    "decisions.jsonl",
+    "failures.jsonl",
+    "triads.jsonl",
+    "personal.enc.jsonl",
+    // Knowledge & reasoning (contain encrypted entries)
+    "semantic.jsonl",
+    "embeddings.jsonl",
+    "open-loops.jsonl",
+    "resonances.jsonl",
+    // Contacts (personal relationship data)
+    "entities.jsonl",
+    "edges.jsonl",
+    // Credentials (secrets at rest)
+    "credentials.enc.jsonl",
+]);
+/**
+ * Check if a specific brain file should be encrypted.
+ * Only files in the ENCRYPTED_FILES allowlist are encrypted.
+ */
+export function shouldEncryptFile(fileName) {
+    return ENCRYPTED_FILES.has(basename(fileName));
+}
+/** Get the basenames of files that are encrypted. */
+export function getEncryptedFiles() {
+    return Array.from(ENCRYPTED_FILES);
+}
+/** Alias for getEncryptedFiles (used by tests). */
+export const getEncryptedFileList = getEncryptedFiles;
+//# sourceMappingURL=encryption-config.js.map

package/dist/lib/encryption-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption-config.js","sourceRoot":"","sources":["../../src/lib/encryption-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,oEAAoE;AACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,kBAAkB;IAClB,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,oDAAoD;IACpD,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,wCAAwC;IACxC,gBAAgB;IAChB,aAAa;IACb,gCAAgC;IAChC,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AACrC,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC"}

package/dist/lib/encryption.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Transparent file encryption layer for brain files at rest.
+ * Per-line encryption for JSONL (preserves append-only semantics).
+ * Whole-file encryption for YAML/MD.
+ * Reuses AES-256-GCM primitives from auth/crypto.ts.
+ */
+/** Encrypt a single JSONL line. Returns a JSON string ready for appending. */
+export declare function encryptLine(plaintext: string, key: Buffer): string;
+/** Decrypt a single encrypted JSONL line. Throws on tamper or wrong key. */
+export declare function decryptLine(encryptedJson: string, key: Buffer): string;
+/** Check if a raw JSON line is an encrypted line (has _e marker). */
+export declare function isEncryptedLine(line: string): boolean;
+/** Encrypt an entire file's contents. Returns JSON string. */
+export declare function encryptFile(content: string, key: Buffer): string;
+/** Decrypt an entire encrypted file. Throws on tamper or wrong key. */
+export declare function decryptFile(encryptedJson: string, key: Buffer): string;
+/** Check if file content is an encrypted file (JSON with v:1 marker). */
+export declare function isEncryptedFile(content: string): boolean;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/lib/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/lib/encryption.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAcH,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CASlE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED,qEAAqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGrD;AAYD,8DAA8D;AAC9D,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAShE;AAED,uEAAuE;AACvE,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQtE;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOxD"}

package/dist/lib/encryption.js

@@ -0,0 +1,65 @@
+/**
+ * Transparent file encryption layer for brain files at rest.
+ * Per-line encryption for JSONL (preserves append-only semantics).
+ * Whole-file encryption for YAML/MD.
+ * Reuses AES-256-GCM primitives from auth/crypto.ts.
+ */
+import { encrypt, decrypt } from "../auth/crypto.js";
+/** Encrypt a single JSONL line. Returns a JSON string ready for appending. */
+export function encryptLine(plaintext, key) {
+    const payload = encrypt(plaintext, key);
+    const line = {
+        _e: 1,
+        c: payload.ciphertext,
+        iv: payload.iv,
+        t: payload.authTag,
+    };
+    return JSON.stringify(line);
+}
+/** Decrypt a single encrypted JSONL line. Throws on tamper or wrong key. */
+export function decryptLine(encryptedJson, key) {
+    const line = JSON.parse(encryptedJson);
+    const payload = {
+        ciphertext: line.c,
+        iv: line.iv,
+        authTag: line.t,
+    };
+    return decrypt(payload, key);
+}
+/** Check if a raw JSON line is an encrypted line (has _e marker). */
+export function isEncryptedLine(line) {
+    // Fast check before parsing — encrypted lines always start with {"_e":
+    return line.startsWith('{"_e":');
+}
+/** Encrypt an entire file's contents. Returns JSON string. */
+export function encryptFile(content, key) {
+    const payload = encrypt(content, key);
+    const file = {
+        v: 1,
+        ciphertext: payload.ciphertext,
+        iv: payload.iv,
+        authTag: payload.authTag,
+    };
+    return JSON.stringify(file);
+}
+/** Decrypt an entire encrypted file. Throws on tamper or wrong key. */
+export function decryptFile(encryptedJson, key) {
+    const file = JSON.parse(encryptedJson);
+    const payload = {
+        ciphertext: file.ciphertext,
+        iv: file.iv,
+        authTag: file.authTag,
+    };
+    return decrypt(payload, key);
+}
+/** Check if file content is an encrypted file (JSON with v:1 marker). */
+export function isEncryptedFile(content) {
+    try {
+        const parsed = JSON.parse(content);
+        return parsed?.v === 1 && typeof parsed.ciphertext === "string";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=encryption.js.map

package/dist/lib/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/lib/encryption.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAyB,MAAM,mBAAmB,CAAC;AAY5E,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAW;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAkB;QAC1B,EAAE,EAAE,CAAC;QACL,CAAC,EAAE,OAAO,CAAC,UAAU;QACrB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,CAAC,EAAE,OAAO,CAAC,OAAO;KACnB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,aAAqB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAkB,CAAC;IACxD,MAAM,OAAO,GAAqB;QAChC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,CAAC;KAChB,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,uEAAuE;IACvE,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAYD,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,GAAW;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,aAAqB,EAAE,GAAW;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAkB,CAAC;IACxD,MAAM,OAAO,GAAqB;QAChC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/lib/key-store.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Shared encryption key store.
+ * Holds the current session-derived encryption key for brain files at rest.
+ * Set once after authentication; consumed by any module that does brain I/O.
+ *
+ * Also tracks the `encryptBrainFiles` toggle from settings:
+ * - When true (default): new writes to allowlisted files are encrypted.
+ * - When false: new writes are plaintext. Reads still decrypt existing data.
+ */
+/** Set the encryption key (called after auth/pairing). */
+export declare function setEncryptionKey(key: Buffer): void;
+/** Get the current encryption key, or null if not yet authenticated. */
+export declare function getEncryptionKey(): Buffer | null;
+/**
+ * Get the encryption key for write operations.
+ * Returns null if encryption is disabled via settings (encryptBrainFiles: false),
+ * even when a key is available. Reads should use getEncryptionKey() directly.
+ */
+export declare function getWriteEncryptionKey(): Buffer | null;
+/** Set whether new writes should be encrypted (from settings.encryptBrainFiles). */
+export declare function setWriteEncryptionEnabled(enabled: boolean): void;
+/** Clear the encryption key (e.g. on logout). */
+export declare function clearEncryptionKey(): void;
+//# sourceMappingURL=key-store.d.ts.map

package/dist/lib/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../src/lib/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAGrD;AAED,oFAAoF;AACpF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAEhE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/lib/key-store.js

@@ -0,0 +1,38 @@
+/**
+ * Shared encryption key store.
+ * Holds the current session-derived encryption key for brain files at rest.
+ * Set once after authentication; consumed by any module that does brain I/O.
+ *
+ * Also tracks the `encryptBrainFiles` toggle from settings:
+ * - When true (default): new writes to allowlisted files are encrypted.
+ * - When false: new writes are plaintext. Reads still decrypt existing data.
+ */
+let currentKey = null;
+let writeEnabled = true;
+/** Set the encryption key (called after auth/pairing). */
+export function setEncryptionKey(key) {
+    currentKey = key;
+}
+/** Get the current encryption key, or null if not yet authenticated. */
+export function getEncryptionKey() {
+    return currentKey;
+}
+/**
+ * Get the encryption key for write operations.
+ * Returns null if encryption is disabled via settings (encryptBrainFiles: false),
+ * even when a key is available. Reads should use getEncryptionKey() directly.
+ */
+export function getWriteEncryptionKey() {
+    if (!writeEnabled)
+        return null;
+    return currentKey;
+}
+/** Set whether new writes should be encrypted (from settings.encryptBrainFiles). */
+export function setWriteEncryptionEnabled(enabled) {
+    writeEnabled = enabled;
+}
+/** Clear the encryption key (e.g. on logout). */
+export function clearEncryptionKey() {
+    currentKey = null;
+}
+//# sourceMappingURL=key-store.js.map

package/dist/lib/key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.js","sourceRoot":"","sources":["../../src/lib/key-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,IAAI,UAAU,GAAkB,IAAI,CAAC;AACrC,IAAI,YAAY,GAAG,IAAI,CAAC;AAExB,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,UAAU,GAAG,GAAG,CAAC;AACnB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,YAAY,GAAG,OAAO,CAAC;AACzB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,kBAAkB;IAChC,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC"}

package/dist/lib/schema-migration.d.ts

@@ -0,0 +1,34 @@
+/**
+ * JSONL schema migration framework.
+ * Checks _version on the schema header line and runs migrations lazily on first read.
+ * Migrations are registered per-schema and run in version order.
+ */
+type MigrationFn = (entry: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * Register a migration for a schema.
+ * Migrations run in order: 1.0 → 1.1 → 1.2.
+ */
+export declare function registerMigration(schema: string, fromVersion: string, toVersion: string, migrate: MigrationFn): void;
+/**
+ * Apply migrations to a parsed JSONL entry based on its schema version.
+ * Returns the migrated entry and the final version.
+ * If no migrations are needed, returns the entry unchanged.
+ */
+export declare function migrateEntry(schema: string, currentVersion: string, entry: Record<string, unknown>): {
+    entry: Record<string, unknown>;
+    version: string;
+};
+/**
+ * Extract schema name and version from a JSONL schema header line.
+ * Returns null if the line is not a schema header.
+ */
+export declare function parseSchemaHeader(line: string): {
+    schema: string;
+    version: string;
+} | null;
+/**
+ * Check if a schema has any registered migrations from the given version.
+ */
+export declare function hasMigrations(schema: string, fromVersion: string): boolean;
+export {};
+//# sourceMappingURL=schema-migration.d.ts.map

package/dist/lib/schema-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migration.d.ts","sourceRoot":"","sources":["../../src/lib/schema-migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,KAAK,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAU/E;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,WAAW,GACnB,IAAI,CAIN;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA6BrD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAU5C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAI1E"}

package/dist/lib/schema-migration.js

@@ -0,0 +1,77 @@
+/**
+ * JSONL schema migration framework.
+ * Checks _version on the schema header line and runs migrations lazily on first read.
+ * Migrations are registered per-schema and run in version order.
+ */
+import { createLogger } from "../utils/logger.js";
+const log = createLogger("schema-migration");
+const registry = new Map();
+/**
+ * Register a migration for a schema.
+ * Migrations run in order: 1.0 → 1.1 → 1.2.
+ */
+export function registerMigration(schema, fromVersion, toVersion, migrate) {
+    const key = schema;
+    if (!registry.has(key))
+        registry.set(key, []);
+    registry.get(key).push({ fromVersion, toVersion, migrate });
+}
+/**
+ * Apply migrations to a parsed JSONL entry based on its schema version.
+ * Returns the migrated entry and the final version.
+ * If no migrations are needed, returns the entry unchanged.
+ */
+export function migrateEntry(schema, currentVersion, entry) {
+    const migrations = registry.get(schema);
+    if (!migrations || migrations.length === 0) {
+        return { entry, version: currentVersion };
+    }
+    let version = currentVersion;
+    let result = entry;
+    // Apply migrations in chain: find the one matching current version, apply, repeat
+    let applied = true;
+    while (applied) {
+        applied = false;
+        for (const m of migrations) {
+            if (m.fromVersion === version) {
+                try {
+                    result = m.migrate(result);
+                    version = m.toVersion;
+                    applied = true;
+                    break;
+                }
+                catch (err) {
+                    log.warn(`Migration ${schema} ${m.fromVersion}→${m.toVersion} failed: ${err instanceof Error ? err.message : String(err)}`);
+                    return { entry: result, version };
+                }
+            }
+        }
+    }
+    return { entry: result, version };
+}
+/**
+ * Extract schema name and version from a JSONL schema header line.
+ * Returns null if the line is not a schema header.
+ */
+export function parseSchemaHeader(line) {
+    try {
+        const obj = JSON.parse(line);
+        if (obj._schema && obj._version) {
+            return { schema: obj._schema, version: obj._version };
+        }
+    }
+    catch {
+        // Not a valid JSON line
+    }
+    return null;
+}
+/**
+ * Check if a schema has any registered migrations from the given version.
+ */
+export function hasMigrations(schema, fromVersion) {
+    const migrations = registry.get(schema);
+    if (!migrations)
+        return false;
+    return migrations.some((m) => m.fromVersion === fromVersion);
+}
+//# sourceMappingURL=schema-migration.js.map

package/dist/lib/schema-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-migration.js","sourceRoot":"","sources":["../../src/lib/schema-migration.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAU7C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;AAEhD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,WAAmB,EACnB,SAAiB,EACjB,OAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAc,EACd,cAAsB,EACtB,KAA8B;IAE9B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,kFAAkF;IAClF,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC3B,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC;oBACtB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,aAAa,MAAM,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5H,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,WAAmB;IAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;AAC/D,CAAC"}

package/dist/library/brain-shadow.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Brain Shadow Files — read-only viewer for whitelisted brain directories.
+ * Mounted at /api/library/brain in server.ts.
+ * Pure GET routes, zero mutation surface.
+ */
+import { Hono } from "hono";
+/** Call once during server init to set the brain directory root. */
+export declare function initBrainShadow(dir: string): void;
+export declare const brainShadowRoutes: Hono<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=brain-shadow.d.ts.map

package/dist/library/brain-shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-shadow.d.ts","sourceRoot":"","sources":["../../src/library/brain-shadow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAgC5B,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,QAG1C;AAyED,eAAO,MAAM,iBAAiB,4EAAa,CAAC"}