abmind 0.0.1 → 0.1.0

package/dist/src/contradiction-checker.d.ts

@@ -0,0 +1,16 @@
+/**
+ * contradiction-checker.ts — Detect conflicting facts before core promotion.
+ * Heuristic: same topic + overlapping keywords + negation/replacement = contradiction.
+ */
+export interface ContradictionHit {
+    existingId: number;
+    existingContent: string;
+    reason: string;
+}
+/** Check if new content contradicts any existing core memory in the same topic. */
+export declare function checkContradiction(newContent: string, topic: string, existingCore: ReadonlyArray<{
+    id: number;
+    content_en: string;
+    topic: string;
+}>): ContradictionHit | null;
+//# sourceMappingURL=contradiction-checker.d.ts.map

package/dist/src/contradiction-checker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contradiction-checker.d.ts","sourceRoot":"","sources":["../../src/contradiction-checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC7E,gBAAgB,GAAG,IAAI,CAmCzB"}

package/dist/src/contradiction-checker.js

@@ -0,0 +1,40 @@
+/**
+ * contradiction-checker.ts — Detect conflicting facts before core promotion.
+ * Heuristic: same topic + overlapping keywords + negation/replacement = contradiction.
+ */
+/** Check if new content contradicts any existing core memory in the same topic. */
+export function checkContradiction(newContent, topic, existingCore) {
+    const newLower = newContent.toLowerCase();
+    const newWords = new Set(newLower.match(/[a-z]{3,}/g) ?? []);
+    for (const existing of existingCore) {
+        if (existing.topic !== topic)
+            continue;
+        const existLower = existing.content_en.toLowerCase();
+        const existWords = new Set(existLower.match(/[a-z]{3,}/g) ?? []);
+        // Compute keyword overlap
+        let overlap = 0;
+        for (const w of newWords)
+            if (existWords.has(w))
+                overlap++;
+        if (overlap < 2)
+            continue; // not enough overlap to be about the same thing
+        // Check for negation/replacement patterns
+        const negationPatterns = [
+            /\bnot\b.*\buse\b|\bno longer\b|\bstopped\b|\bswitched from\b|\breplaced\b|\binstead of\b|\bwas wrong\b|\bactually\b/,
+        ];
+        const hasNegation = negationPatterns.some(p => p.test(newLower));
+        if (!hasNegation)
+            continue;
+        // Check if the negation targets something in the existing memory
+        const overlapWords = [...newWords].filter(w => existWords.has(w));
+        if (overlapWords.length >= 2) {
+            return {
+                existingId: existing.id,
+                existingContent: existing.content_en,
+                reason: `Potential contradiction: overlapping keywords [${overlapWords.slice(0, 5).join(", ")}] with negation pattern`,
+            };
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=contradiction-checker.js.map

package/dist/src/contradiction-checker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contradiction-checker.js","sourceRoot":"","sources":["../../src/contradiction-checker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,KAAa,EACb,YAA8E;IAE9E,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7D,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;YAAE,SAAS;QAEvC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;QAEjE,0BAA0B;QAC1B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC;QAC3D,IAAI,OAAO,GAAG,CAAC;YAAE,SAAS,CAAC,gDAAgD;QAE3E,0CAA0C;QAC1C,MAAM,gBAAgB,GAAG;YACvB,qHAAqH;SACtH,CAAC;QAEF,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,iEAAiE;QACjE,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,eAAe,EAAE,QAAQ,CAAC,UAAU;gBACpC,MAAM,EAAE,kDAAkD,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;aACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/crypto.d.ts

@@ -0,0 +1,15 @@
+/** Load or generate the encryption key. Cached per process. */
+export declare function loadKey(): Buffer;
+/** Returns true if a key file exists (without loading it). */
+export declare function hasKey(): boolean;
+/** Encrypt plaintext. Returns base64(iv + ciphertext + authTag). */
+export declare function encrypt(plaintext: string): string;
+/** Decrypt base64(iv + ciphertext + authTag). Returns plaintext. */
+export declare function decrypt(blob: string): string;
+/** Load a key from a specific file path (for rekey). */
+export declare function loadKeyFromFile(path: string): Buffer;
+/** Decrypt using a specific key (for rekey). */
+export declare function decryptWithKey(blob: string, key: Buffer): string;
+/** Reset cached key (for testing). */
+export declare function _resetKeyCache(): void;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/src/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAyBA,+DAA+D;AAC/D,wBAAgB,OAAO,IAAI,MAAM,CA0BhC;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,IAAI,OAAO,CAEhC;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS5C;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,gDAAgD;AAChD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED,sCAAsC;AACtC,wBAAgB,cAAc,IAAI,IAAI,CAErC"}

package/dist/src/crypto.js

@@ -0,0 +1,86 @@
+import { getAbmindEnv } from "./env-schema.js";
+/**
+ * AES-256-GCM encryption for SECRET (classification=3) memories.
+ * Key: 32 random bytes stored as 64 hex chars in abmind.key.
+ */
+import { randomBytes, createCipheriv, createDecipheriv } from "node:crypto";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, copyFileSync } from "node:fs";
+import { dirname } from "node:path";
+const ALGO = "aes-256-gcm";
+const IV_LEN = 12;
+const TAG_LEN = 16;
+let cachedKey = null;
+function keyPath() {
+    return getAbmindEnv().keyFile;
+}
+function backupKeyPath() {
+    return getAbmindEnv().keyFile;
+}
+/** Load or generate the encryption key. Cached per process. */
+export function loadKey() {
+    if (cachedKey)
+        return cachedKey;
+    const path = keyPath();
+    if (existsSync(path)) {
+        cachedKey = Buffer.from(readFileSync(path, "utf-8").trim(), "hex");
+        return cachedKey;
+    }
+    // Generate new key
+    const key = randomBytes(32);
+    const hex = key.toString("hex");
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, hex + "\n", { mode: 0o600 });
+    // Copy to abmind backup
+    const backup = backupKeyPath();
+    try {
+        if (existsSync(dirname(backup))) {
+            copyFileSync(path, backup);
+        }
+    }
+    catch { /* backup dir may not exist */ }
+    cachedKey = key;
+    return cachedKey;
+}
+/** Returns true if a key file exists (without loading it). */
+export function hasKey() {
+    return existsSync(keyPath()) || cachedKey !== null;
+}
+/** Encrypt plaintext. Returns base64(iv + ciphertext + authTag). */
+export function encrypt(plaintext) {
+    const key = loadKey();
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, encrypted, tag]).toString("base64");
+}
+/** Decrypt base64(iv + ciphertext + authTag). Returns plaintext. */
+export function decrypt(blob) {
+    const key = loadKey();
+    const buf = Buffer.from(blob, "base64");
+    const iv = buf.subarray(0, IV_LEN);
+    const tag = buf.subarray(buf.length - TAG_LEN);
+    const ciphertext = buf.subarray(IV_LEN, buf.length - TAG_LEN);
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    return decipher.update(ciphertext) + decipher.final("utf-8");
+}
+/** Load a key from a specific file path (for rekey). */
+export function loadKeyFromFile(path) {
+    return Buffer.from(readFileSync(path, "utf-8").trim(), "hex");
+}
+/** Decrypt using a specific key (for rekey). */
+export function decryptWithKey(blob, key) {
+    const buf = Buffer.from(blob, "base64");
+    const iv = buf.subarray(0, IV_LEN);
+    const tag = buf.subarray(buf.length - TAG_LEN);
+    const ciphertext = buf.subarray(IV_LEN, buf.length - TAG_LEN);
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    return decipher.update(ciphertext) + decipher.final("utf-8");
+}
+/** Reset cached key (for testing). */
+export function _resetKeyCache() {
+    cachedKey = null;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/src/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAQ,OAAO,EAAE,MAAM,WAAW,CAAC;AAG1C,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,MAAM,GAAG,EAAE,CAAC;AAClB,MAAM,OAAO,GAAG,EAAE,CAAC;AAEnB,IAAI,SAAS,GAAkB,IAAI,CAAC;AAEpC,SAAS,OAAO;IACd,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC;AAChC,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC;AAChC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,OAAO;IACrB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,mBAAmB;IACnB,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEhC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,wBAAwB;IACxB,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAChC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAE1C,SAAS,GAAG,GAAG,CAAC;IAChB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,MAAM;IACpB,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,EAAE,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/src/deploy-lib/cleanup.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Safety-guarded destructive ops for `reset` / `uninstall`.
+ *
+ * Ported from openclaw's cleanup-utils pattern (docs/plans/158 §Reset scopes).
+ * Key primitive: isUnsafeRemovalTarget() rejects catastrophic paths ('/',
+ * '~', empty, etc.) BEFORE any caller invokes rm. Caller must always check.
+ */
+/**
+ * True if the path is something we refuse to remove, regardless of flags.
+ *
+ * Rejects:
+ *   - empty / whitespace-only strings
+ *   - '/', '\\', or any path that resolves to root
+ *   - '~' (home), home dir itself, or parents of home
+ *   - Anything not under the user's home dir (defense-in-depth against
+ *     config pointing at /etc/... by mistake)
+ *
+ * Callers SHOULD still confirm with the user before removing even "safe"
+ * paths; this function is a hard floor, not a substitute for confirmation.
+ */
+export declare function isUnsafeRemovalTarget(path: string): boolean;
+export interface RemovePlan {
+    readonly path: string;
+    readonly willRemove: boolean;
+    readonly reason: string;
+}
+/**
+ * Plan a remove without executing. Used by --dry-run flows in reset/uninstall.
+ */
+export declare function planRemoval(path: string): RemovePlan;
+/**
+ * Remove a path after validating safety. Throws if the target is unsafe.
+ * Returns true if the path was removed, false if it didn't exist.
+ */
+export declare function removePath(path: string, opts?: {
+    dryRun?: boolean;
+}): Promise<boolean>;
+//# sourceMappingURL=cleanup.d.ts.map

package/dist/src/deploy-lib/cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../../src/deploy-lib/cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAY3D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKpD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAYhG"}

package/dist/src/deploy-lib/cleanup.js

@@ -0,0 +1,71 @@
+/**
+ * Safety-guarded destructive ops for `reset` / `uninstall`.
+ *
+ * Ported from openclaw's cleanup-utils pattern (docs/plans/158 §Reset scopes).
+ * Key primitive: isUnsafeRemovalTarget() rejects catastrophic paths ('/',
+ * '~', empty, etc.) BEFORE any caller invokes rm. Caller must always check.
+ */
+import { rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { resolve } from 'node:path';
+/**
+ * True if the path is something we refuse to remove, regardless of flags.
+ *
+ * Rejects:
+ *   - empty / whitespace-only strings
+ *   - '/', '\\', or any path that resolves to root
+ *   - '~' (home), home dir itself, or parents of home
+ *   - Anything not under the user's home dir (defense-in-depth against
+ *     config pointing at /etc/... by mistake)
+ *
+ * Callers SHOULD still confirm with the user before removing even "safe"
+ * paths; this function is a hard floor, not a substitute for confirmation.
+ */
+export function isUnsafeRemovalTarget(path) {
+    const trimmed = path.trim();
+    if (trimmed === '')
+        return true;
+    if (trimmed === '~' || trimmed === '/' || trimmed === '\\')
+        return true;
+    const abs = resolve(trimmed);
+    if (abs === '/' || abs === '')
+        return true;
+    const home = homedir();
+    if (abs === home)
+        return true;
+    // Must be under home (defense in depth).
+    const homeWithSep = home.endsWith('/') ? home : home + '/';
+    if (!abs.startsWith(homeWithSep))
+        return true;
+    return false;
+}
+/**
+ * Plan a remove without executing. Used by --dry-run flows in reset/uninstall.
+ */
+export function planRemoval(path) {
+    if (isUnsafeRemovalTarget(path)) {
+        return { path, willRemove: false, reason: 'refused: unsafe target' };
+    }
+    return { path, willRemove: true, reason: 'would remove recursively' };
+}
+/**
+ * Remove a path after validating safety. Throws if the target is unsafe.
+ * Returns true if the path was removed, false if it didn't exist.
+ */
+export async function removePath(path, opts = {}) {
+    if (isUnsafeRemovalTarget(path)) {
+        throw new Error(`Refused to remove unsafe target: ${path}`);
+    }
+    if (opts.dryRun)
+        return true;
+    try {
+        await rm(path, { recursive: true });
+        return true;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return false;
+        throw err;
+    }
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/src/deploy-lib/cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../../src/deploy-lib/cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,yCAAyC;IACzC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAA6B,EAAE;IAC5E,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/src/deploy-lib/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Deploy-lib: shared install/update/rollback primitives.
+ *
+ * Consumed by both `abmind` CLI (its own runtime at ~/.abmind) and by
+ * `agentbridge` (via file:../abmind dependency, managing ~/.agentbridge).
+ *
+ * Entry points are the module files directly:
+ *   import { resolveBridgeHome } from 'abmind/deploy-lib/paths.js'
+ *   import { readManifest, writeManifest } from 'abmind/deploy-lib/manifest.js'
+ *   etc.
+ *
+ * See abproject/docs/plans/158-deploy-rewrite.md for the full contract.
+ */
+export * from './paths.js';
+export * from './manifest.js';
+export * from './lock.js';
+export * from './releases.js';
+export * from './cleanup.js';
+export * from './safe-copy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/deploy-lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/deploy-lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC"}

package/dist/src/deploy-lib/index.js

@@ -0,0 +1,20 @@
+/**
+ * Deploy-lib: shared install/update/rollback primitives.
+ *
+ * Consumed by both `abmind` CLI (its own runtime at ~/.abmind) and by
+ * `agentbridge` (via file:../abmind dependency, managing ~/.agentbridge).
+ *
+ * Entry points are the module files directly:
+ *   import { resolveBridgeHome } from 'abmind/deploy-lib/paths.js'
+ *   import { readManifest, writeManifest } from 'abmind/deploy-lib/manifest.js'
+ *   etc.
+ *
+ * See abproject/docs/plans/158-deploy-rewrite.md for the full contract.
+ */
+export * from './paths.js';
+export * from './manifest.js';
+export * from './lock.js';
+export * from './releases.js';
+export * from './cleanup.js';
+export * from './safe-copy.js';
+//# sourceMappingURL=index.js.map

package/dist/src/deploy-lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/deploy-lib/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC"}

package/dist/src/deploy-lib/lock.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Update lock: prevents concurrent `install` / `update` / `rollback` runs
+ * in the same runtime from colliding.
+ *
+ * Mechanism: write a JSON pidfile at packagePaths().lock. If file exists and
+ * the PID is alive and the mtime is recent (<1h), refuse to proceed. Otherwise
+ * take the lock.
+ *
+ * Stale timeout matches plan: 1 hour (our updates take minutes). Compared to
+ * claude-code's 7-day timeout which accommodates laptop sleep during a long
+ * install — not applicable for our short-lived updates.
+ */
+export interface LockContent {
+    readonly pid: number;
+    readonly host: string;
+    readonly startedAt: string;
+    readonly cmd: string;
+}
+export declare class LockHeldError extends Error {
+    readonly content: LockContent;
+    readonly isStale: boolean;
+    constructor(content: LockContent, isStale: boolean);
+}
+/**
+ * Acquire the lock or throw LockHeldError. Returns a release function.
+ * Caller must call release() on both success and failure; the returned
+ * function is idempotent.
+ */
+export declare function acquireLock(path: string, cmd: string): Promise<() => Promise<void>>;
+export declare function inspectLock(path: string): Promise<{
+    held: false;
+} | {
+    held: true;
+    content: LockContent;
+    stale: boolean;
+}>;
+//# sourceMappingURL=lock.d.ts.map

package/dist/src/deploy-lib/lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.d.ts","sourceRoot":"","sources":["../../../src/deploy-lib/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,aAAc,SAAQ,KAAK;aAEpB,OAAO,EAAE,WAAW;aACpB,OAAO,EAAE,OAAO;gBADhB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO;CASnC;AAoBD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CA2CzF;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CACpD;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CACvD,CAQA"}

package/dist/src/deploy-lib/lock.js

@@ -0,0 +1,107 @@
+/**
+ * Update lock: prevents concurrent `install` / `update` / `rollback` runs
+ * in the same runtime from colliding.
+ *
+ * Mechanism: write a JSON pidfile at packagePaths().lock. If file exists and
+ * the PID is alive and the mtime is recent (<1h), refuse to proceed. Otherwise
+ * take the lock.
+ *
+ * Stale timeout matches plan: 1 hour (our updates take minutes). Compared to
+ * claude-code's 7-day timeout which accommodates laptop sleep during a long
+ * install — not applicable for our short-lived updates.
+ */
+import { readFile, unlink, writeFile } from 'node:fs/promises';
+import { unlinkSync } from 'node:fs';
+import { hostname } from 'node:os';
+const STALE_MS = 60 * 60 * 1000; // 1 hour
+export class LockHeldError extends Error {
+    content;
+    isStale;
+    constructor(content, isStale) {
+        const staleMsg = isStale ? ' (appears stale — process may have crashed)' : '';
+        super(`Lock held by pid ${content.pid} since ${content.startedAt} ` +
+            `(cmd: ${content.cmd})${staleMsg}`);
+        this.content = content;
+        this.isStale = isStale;
+        this.name = 'LockHeldError';
+    }
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+async function readLock(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf-8'));
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+/**
+ * Acquire the lock or throw LockHeldError. Returns a release function.
+ * Caller must call release() on both success and failure; the returned
+ * function is idempotent.
+ */
+export async function acquireLock(path, cmd) {
+    const existing = await readLock(path);
+    if (existing) {
+        const alive = isPidAlive(existing.pid);
+        const started = Date.parse(existing.startedAt);
+        const age = Date.now() - (Number.isFinite(started) ? started : 0);
+        const stale = !alive || age > STALE_MS;
+        if (!stale) {
+            throw new LockHeldError(existing, false);
+        }
+        // Stale: fall through and take it, but tell the caller so doctor can surface.
+    }
+    const content = {
+        pid: process.pid,
+        host: hostname(),
+        startedAt: new Date().toISOString(),
+        cmd,
+    };
+    await writeFile(path, JSON.stringify(content, null, 2) + '\n', 'utf-8');
+    let released = false;
+    const release = async () => {
+        if (released)
+            return;
+        released = true;
+        try {
+            await unlink(path);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+    };
+    // Best-effort cleanup on unexpected exit.
+    const exitHandler = () => {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            /* ignore — stale detection handles orphans next run */
+        }
+    };
+    process.once('exit', exitHandler);
+    return release;
+}
+export async function inspectLock(path) {
+    const content = await readLock(path);
+    if (!content)
+        return { held: false };
+    const alive = isPidAlive(content.pid);
+    const started = Date.parse(content.startedAt);
+    const age = Date.now() - (Number.isFinite(started) ? started : 0);
+    const stale = !alive || age > STALE_MS;
+    return { held: true, content, stale };
+}
+//# sourceMappingURL=lock.js.map

package/dist/src/deploy-lib/lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock.js","sourceRoot":"","sources":["../../../src/deploy-lib/lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAS1C,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEpB;IACA;IAFlB,YACkB,OAAoB,EACpB,OAAgB;QAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,KAAK,CACH,oBAAoB,OAAO,CAAC,GAAG,UAAU,OAAO,CAAC,SAAS,GAAG;YAC3D,SAAS,OAAO,CAAC,GAAG,IAAI,QAAQ,EAAE,CACrC,CAAC;QAPc,YAAO,GAAP,OAAO,CAAa;QACpB,YAAO,GAAP,OAAO,CAAS;QAOhC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAgB,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,GAAW;IACzD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,8EAA8E;IAChF,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,IAAI,EAAE,QAAQ,EAAE;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG;KACJ,CAAC;IACF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAExE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,0CAA0C;IAC1C,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAElC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAI5C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,GAAG,GAAG,QAAQ,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC"}

package/dist/src/deploy-lib/manifest.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Runtime manifest: the single source of truth for "what's installed".
+ *
+ * Location: $HOME/manifest.json (per packagePaths().manifest).
+ * Read by: `status`, cross-package compatibility checks, doctor.
+ * Written by: `install`, `update`, `rollback`, migrations.
+ */
+export interface Manifest {
+    readonly package: 'agentbridge' | 'abmind';
+    /** Currently active release version (matches releases/<version>/ dirname). */
+    readonly version: string;
+    /** Git SHA of the source that produced the active release, if known. */
+    readonly commit: string | null;
+    /** Git branch, if known. */
+    readonly branch: string | null;
+    /** Hash of package-lock.json at time of last node_modules install. */
+    readonly packageLockHash: string | null;
+    /** ISO timestamp of when the active release became active. */
+    readonly activatedAt: string;
+    /** Hostname where install lives (informational). */
+    readonly host: string;
+    /** Source adapter that produced the current release (local | npm | github). */
+    readonly source: 'local' | 'npm' | 'github';
+    /** Applied migrations (ordered). */
+    readonly migrationsApplied: readonly string[];
+    /** Prior releases still retained (newest first). Empty on fresh install. */
+    readonly priorReleases: readonly PriorRelease[];
+    /** Pre-158 backup location, if this install was migrated from the flat layout. */
+    readonly preMigrationBackup: string | null;
+    /** Install mode: simple (manual), supervised (launchd/systemd user-scope), or supervised-daemon (system-scope). */
+    readonly installMode?: 'simple' | 'supervised' | 'supervised-daemon';
+}
+export interface PriorRelease {
+    readonly version: string;
+    readonly commit: string | null;
+    readonly activatedAt: string;
+    readonly packageLockHash: string | null;
+}
+export declare function readManifest(path: string): Promise<Manifest | null>;
+export declare function writeManifest(path: string, manifest: Manifest): Promise<void>;
+export declare function emptyManifest(pkg: 'agentbridge' | 'abmind', host: string): Manifest;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/src/deploy-lib/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/deploy-lib/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,QAAQ,CAAC;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,4BAA4B;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;IAChD,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,mHAAmH;IACnH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,mBAAmB,CAAC;CACtE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQzE;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAcnF"}

package/dist/src/deploy-lib/manifest.js

@@ -0,0 +1,38 @@
+/**
+ * Runtime manifest: the single source of truth for "what's installed".
+ *
+ * Location: $HOME/manifest.json (per packagePaths().manifest).
+ * Read by: `status`, cross-package compatibility checks, doctor.
+ * Written by: `install`, `update`, `rollback`, migrations.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+export async function readManifest(path) {
+    try {
+        const raw = await readFile(path, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return null;
+        throw err;
+    }
+}
+export async function writeManifest(path, manifest) {
+    await writeFile(path, JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
+}
+export function emptyManifest(pkg, host) {
+    return {
+        package: pkg,
+        version: '',
+        commit: null,
+        branch: null,
+        packageLockHash: null,
+        activatedAt: new Date().toISOString(),
+        host,
+        source: 'local',
+        migrationsApplied: [],
+        priorReleases: [],
+        preMigrationBackup: null,
+    };
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/deploy-lib/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../src/deploy-lib/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAmCvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;IAClE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAA6B,EAAE,IAAY;IACvE,OAAO;QACL,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,IAAI;QACZ,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,IAAI;QACJ,MAAM,EAAE,OAAO;QACf,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,EAAE;QACjB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC"}

package/dist/src/deploy-lib/paths.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Runtime directory resolution for deploy-lib consumers.
+ *
+ * Rules:
+ *   - agentbridge runtime root: $AGENT_BRIDGE_HOME ?? ~/.agentbridge
+ *   - abmind runtime root:      $ABMIND_HOME ?? ~/.abmind
+ *   - user bin dir:             ~/.local/bin (always, XDG convention)
+ *
+ * All callers use these resolvers — never hardcode paths. Required by
+ * plan #158 v7 (Ag2 round-2 nit): cross-repo manifest reads must respect
+ * env-var overrides, not assume default locations.
+ */
+export type PackageName = 'agentbridge' | 'abmind';
+export declare function resolveBridgeHome(): string;
+export declare function resolveAbmindHome(): string;
+export declare function resolvePackageHome(pkg: PackageName): string;
+export declare function resolveUserBinDir(): string;
+export interface PackagePaths {
+    readonly home: string;
+    readonly config: string;
+    readonly releases: string;
+    readonly current: string;
+    readonly nodeModules: string;
+    readonly bin: string;
+    readonly manifest: string;
+    readonly lock: string;
+}
+export declare function packagePaths(pkg: PackageName): PackagePaths;
+//# sourceMappingURL=paths.d.ts.map

package/dist/src/deploy-lib/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/deploy-lib/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAE3D;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,YAAY,CAY3D"}