aegis-desktop 1.0.13 → 1.0.15

package/lib/avatar/holders.js

@@ -1,614 +1,3 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 // Copyright (C) 2026 Niklas Borneklint — AEGIS Code (aegiscode) / Aegiscloud.
-// AEGIS Code (aegiscode) — source: https://github.com/aegisinfo/aegiscode-plugin
-// Conveying a modified copy, or running one as a network service, owes the
-// corresponding source under this licence (§5/§13) — see LICENSING.md.
-'use strict';
-
-/**
- * holders.js — who holds the memory.
- *
- * `identity.js` decides *which* holder a set of signals points at and
- * refuses to merge two people on a fingerprint match. `profile.js`
- * folds one holder's entries into bounded, evidence-gated facets. Neither of
- * them owns a directory. This file is that owner — the layout, the registry, the
- * switch, the conflict decision and the "why does it know this" surface — and it
- * is deliberately still pure Node (fs + path only, no Electron, no clock unless
- * one is injected) so the whole phase is testable with `node --test`.
- *
- * The four claims this module exists to make true:
- *
- *  1. **A switch swaps everything together.** `switchHolder()` returns a state
- *     read fresh off disk for the new holder — ledger, persona and profile
- *     cache — and names the holder's memory scope in the same object. There is
- *     no field carried over from the previous holder, and the only thing that
- *     survives in memory is the registry (which is an *index*, not data). The
- *     claim is asserted by comparing the two states byte-for-byte for any field
- *     that could carry holder A's text.
- *
- *  2. **A fingerprint is not an identity.** `applyConflict()` has one default:
- *     *keep separate*. Rebinding two holders behind one fingerprint requires
- *     `{ choice: 'rebind', confirm: true }` — the card's explicit confirm — and
- *     even then it only copies the fingerprint onto the surviving row. Nothing
- *     in this file ever merges two ledgers, two personas or two profiles.
- *
- *  3. **Isolation is applied at the seam, not hoped for.** `entriesForHolder()`
- *     is the client-side filter §3 calls "the assertion that the fix happened":
- *     the server-side scope is the fix, and this is what proves it ran. It is
- *     used by the fold *and* by the recall block, so a leak needs to defeat one
- *     function rather than two call sites — and the test drives two
- *     holders through the real turn assembly and greps the prompt.
- *
- *  4. **Every claim is traceable and deletable.** `provenance()` renders a
- *     facet's `sources` as the underlying entry text, and `forgetFacet()`
- *     removes the facet *and* the entries behind it: the ids go on the holder's
- *     own forget list, which `entriesForHolder()` honours on the next fold, so
- *     the claim cannot silently re-derive from the same row (§4).
- *
- * What is NOT here: any level arithmetic (that is `xp.js` + `store.js`), any
- * prompt text (that is `holder-turn.js`), and any IPC (that is `holder-ipc.js`).
- */
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const identity = require('./identity.js');
-const personaModule = require('./persona.js');
-const profileModule = require('./profile.js');
-const xp = require('./xp.js');
-
-/** `<userData>/avatar/` — the one directory tree this module owns. */
-const AVATAR_DIR = 'avatar';
-const REGISTRY_FILE = 'holders.json';
-const HOLDERS_DIR = 'holders';
-const LEDGER_FILE = 'ledger.jsonl';
-const PERSONA_FILE = 'persona.json';
-const PROFILE_FILE = 'profile.json';
-const FORGOTTEN_FILE = 'forgotten.json';
-
-/**
- * The one thing a switch may leave behind. A list, not a sentence: the
- * test iterates it, so adding a survivor to the code without adding it here
- * makes the test fail rather than the promise quietly rot.
- */
-const SURVIVES_SWITCH = Object.freeze(['registry']);
-
-/** Reserved mirror sessions (§6) — holder id, never a fingerprint. */
-const MIRROR_SESSIONS = Object.freeze(['avatar:ledger', 'avatar:profile']);
-function mirrorSession(holderId, kind = 'ledger') {
-  const suffix = kind === 'profile' ? 'profile' : 'ledger';
-  return `avatar:${suffix}:${holderId}`;
-}
-
-// ---------------------------------------------------------------- paths ----
-
-function registryPath(dir) {
-  return path.join(String(dir), AVATAR_DIR, REGISTRY_FILE);
-}
-
-/** The holder's own directory. Ids are shape-checked before they touch a path. */
-function holderDir(dir, holderId) {
-  const id = safeHolderId(holderId);
-  if (!id) throw new Error('holderDir: expected a holder id (h_ + 8-16 hex)');
-  return path.join(String(dir), AVATAR_DIR, HOLDERS_DIR, id);
-}
-
-function holderPaths(dir, holderId) {
-  const base = holderDir(dir, holderId);
-  return {
-    dir: base,
-    ledger: path.join(base, LEDGER_FILE),
-    persona: path.join(base, PERSONA_FILE),
-    profile: path.join(base, PROFILE_FILE),
-    forgotten: path.join(base, FORGOTTEN_FILE),
-  };
-}
-
-function safeHolderId(value) {
-  const id = value == null ? '' : String(value).trim();
-  if (!id) return null;
-  return identity.HOLDER_ID_RE && identity.HOLDER_ID_RE.test(id) ? id : null;
-}
-
-// -------------------------------------------------------------- file IO ----
-
-function readJsonFile(file) {
-  try {
-    const raw = fs.readFileSync(file, 'utf8');
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === 'object' ? parsed : null;
-  } catch (err) {
-    return null;
-  }
-}
-
-function writeJsonFile(file, value) {
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  const tmp = `${file}.tmp`;
-  fs.writeFileSync(tmp, `${JSON.stringify(value, null, 2)}\n`);
-  fs.renameSync(tmp, file);
-  return value;
-}
-
-/** Parse a JSONL ledger. Tolerant by construction: a torn last line is skipped. */
-function readLedger(file) {
-  let raw = '';
-  try {
-    raw = fs.readFileSync(file, 'utf8');
-  } catch (err) {
-    return [];
-  }
-  const rows = [];
-  for (const line of raw.split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed) continue;
-    try {
-      const row = JSON.parse(trimmed);
-      if (row && typeof row === 'object') rows.push(row);
-    } catch (err) {
-      // A half-written append is lost XP, never a crash — same rule as store.js.
-    }
-  }
-  return rows;
-}
-
-function appendLedgerRow(file, row) {
-  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
-  fs.appendFileSync(file, `${JSON.stringify(row)}\n`);
-  return row;
-}
-
-// ------------------------------------------------------------ registry ----
-
-/**
- * Read the registry. Anything unreadable or invalid degrades to a fresh empty
- * registry (identity.load validates and migrates), because "the index is gone"
- * must never read as "your memory is gone" — the holder directories are still
- * on disk and a registry rebuild is not a data loss.
- */
-function readRegistry(dir) {
-  const raw = readJsonFile(registryPath(dir));
-  try {
-    return identity.load(raw || identity.emptyRegistry());
-  } catch (err) {
-    return identity.load(identity.emptyRegistry());
-  }
-}
-
-/** Validate + persist. Returns the validated registry, never the raw input. */
-function writeRegistry(dir, registry) {
-  const validated = identity.load(registry);
-  writeJsonFile(registryPath(dir), validated);
-  return validated;
-}
-
-function holderRow(registry, holderId) {
-  const id = safeHolderId(holderId);
-  if (!id) return null;
-  return (registry.holders || []).find((row) => row && row.id === id) || null;
-}
-
-/**
- * Add a holder (idempotent by id and by fingerprint-free identity) and return
- * `{ registry, row, created }`. Used by a first-run mint and by the conflict
- * card's "keep separate", which is exactly `ensureHolder` with no fingerprint.
- */
-function ensureHolder(dir, input = {}) {
-  const registry = input.registry || readRegistry(dir);
-  const wanted = input.id ? safeHolderId(input.id) : null;
-  const existing = wanted ? holderRow(registry, wanted) : null;
-  if (existing) return { registry, row: existing, created: false };
-
-  const withRow = identity.addHolder(registry, {
-    id: wanted || undefined,
-    displayName: input.displayName,
-    fingerprint: input.fingerprint,
-    accountId: input.accountId,
-    now: input.now,
-  });
-  const validated = identity.load(withRow);
-  const row = validated.holders[validated.holders.length - 1] || null;
-  if (input.persist !== false) writeRegistry(dir, validated);
-  return { registry: validated, row, created: true };
-}
-
-// --------------------------------------------------------------- state -----
-
-/** What a level reads as, from this holder's ledger rows alone. */
-function levelOf(ledger) {
-  try {
-    const evaluated = xp.evaluate(Array.isArray(ledger) ? ledger : []);
-    return evaluated && Number.isFinite(evaluated.level) ? evaluated.level : 1;
-  } catch (err) {
-    return 1;
-  }
-}
-
-/** The forgotten-entry list: what "forget" actually writes. */
-function readForgotten(dir, holderId) {
-  const parsed = readJsonFile(holderPaths(dir, holderId).forgotten);
-  const ids = parsed && Array.isArray(parsed.entries) ? parsed.entries : [];
-  return new Set(ids.map(String));
-}
-
-function writeForgotten(dir, holderId, ids) {
-  const list = Array.from(new Set(Array.from(ids).map(String))).sort();
-  writeJsonFile(holderPaths(dir, holderId).forgotten, {
-    schema: 1,
-    holderId,
-    entries: list,
-  });
-  return new Set(list);
-}
-
-function emptyProfile(holderId) {
-  return { schema: 1, holderId, facets: [], budget: { tokens: 0, used: 0 }, coldStart: true };
-}
-
-/**
- * Load one holder's state — every field read from that holder's own directory,
- * nothing defaulted from a previous holder.
- *
- * @returns {{ holderId:string, displayName:string, ledger:object[],
- *             persona:object, profile:object, forgotten:Set<string>,
- *             level:number, scope:string[] }}
- */
-function loadState(dir, holderId, opts = {}) {
-  const id = safeHolderId(holderId);
-  if (!id) throw new Error('loadState: expected a holder id (h_ + 8-16 hex)');
-  const registry = opts.registry || readRegistry(dir);
-  const row = holderRow(registry, id);
-  const paths = holderPaths(dir, id);
-  const ledger = readLedger(paths.ledger);
-
-  const rawPersona = readJsonFile(paths.persona);
-  let persona = personaModule.defaultPersona();
-  if (rawPersona) {
-    try {
-      const loaded = personaModule.load(rawPersona);
-      persona = loaded && loaded.persona ? loaded.persona : loaded;
-    } catch (err) {
-      persona = personaModule.defaultPersona();
-    }
-  } else {
-    // A holder with no persona file inherits nothing: it gets the neutral
-    // default, so a fresh holder is an unconfigured install (§4, cold start).
-    persona = personaModule.defaultPersona();
-  }
-
-  const profile = readJsonFile(paths.profile) || emptyProfile(id);
-  const forgotten = readForgotten(dir, id);
-
-  return {
-    holderId: id,
-    displayName: (row && row.displayName) || personaDisplayName(persona) || identity.DEFAULT_DISPLAY_NAME,
-    ledger,
-    persona,
-    profile: profile && profile.holderId === id ? profile : { ...profile, holderId: id },
-    forgotten,
-    level: levelOf(ledger),
-    scope: MIRROR_SESSIONS.map((kind) => mirrorSession(id, kind.split(':')[1])),
-  };
-}
-
-function personaDisplayName(persona) {
-  const name = persona && persona.identity && persona.identity.name;
-  return typeof name === 'string' && name.trim() ? name.trim() : null;
-}
-
-/** Persist a folded profile into the holder's own cache file. */
-function writeProfile(dir, holderId, profile) {
-  const withHolder = { ...(profile || {}), holderId };
-  writeJsonFile(holderPaths(dir, holderId).profile, withHolder);
-  return withHolder;
-}
-
-function writePersona(dir, holderId, persona) {
-  writeJsonFile(holderPaths(dir, holderId).persona, { ...(persona || {}), holderId });
-  return persona;
-}
-
-// -------------------------------------------------------------- switching --
-
-/**
- * Switch the active holder.
- *
- * The returned `state` is loaded *after* the registry write, so a caller cannot
- * accidentally keep rendering the old holder by holding a stale object: every
- * field that can carry holder A's text — ledger, persona, profile, forget list
- * and memory scope — is fresh. `survived` is the honest list of what came
- * across, and it is `['registry']` by construction.
- */
-function switchHolder(dir, holderId, opts = {}) {
-  const id = safeHolderId(holderId);
-  if (!id) return { ok: false, reason: 'expected a holder id (h_ + 8-16 hex)', survived: SURVIVES_SWITCH.slice() };
-
-  const registry = opts.registry || readRegistry(dir);
-  if (!holderRow(registry, id) && !opts.create) {
-    return { ok: false, reason: `unknown holder ${id}`, survived: SURVIVES_SWITCH.slice() };
-  }
-
-  let next = registry;
-  if (holderRow(registry, id)) {
-    try {
-      next = identity.setActive(registry, id);
-    } catch (err) {
-      next = { ...registry, active: id };
-    }
-    next = writeRegistry(dir, next);
-  } else {
-    const created = ensureHolder(dir, { id, displayName: opts.displayName, now: opts.now });
-    next = writeRegistry(dir, identity.setActive(created.registry, id));
-  }
-
-  const state = loadState(dir, id, { registry: next });
-  return {
-    ok: true,
-    previous: opts.previous || (registry && registry.active) || null,
-    state,
-    registry: next,
-    survived: SURVIVES_SWITCH.slice(),
-  };
-}
-
-/**
- * Resolve the active holder from signals (identity.resolve — one source of
- * truth for precedence) and, when a signal minted nothing, create the row so
- * the next launch resolves to the same holder.
- */
-function resolveActive(dir, signals = {}, opts = {}) {
-  const registry = opts.registry || readRegistry(dir);
-  const resolution = identity.resolve(signals, registry);
-  if (resolution.needsMint || !resolution.holderId) {
-    return { registry, resolution, holderId: null, created: false };
-  }
-  const existing = holderRow(registry, resolution.holderId);
-  if (existing) {
-    return { registry, resolution, holderId: existing.id, created: false };
-  }
-  const created = ensureHolder(dir, {
-    id: resolution.holderId,
-    displayName: resolution.displayName,
-    fingerprint: resolution.proposal ? resolution.proposal.fingerprint : undefined,
-    now: opts.now,
-    registry,
-  });
-  return { registry: created.registry, resolution, holderId: created.row ? created.row.id : resolution.holderId, created: created.created };
-}
-
-/**
- * Apply the conflict card's choice (§2/§3).
- *
- * Default is *keep separate*: two holders stay two holders, and the only thing
- * the fingerprint gets is a note that it is shared. `rebind` requires
- * `confirm: true` — the explicit confirm behind the card — and still never
- * merges data: it moves the fingerprint onto the winner and records the loser
- * as unbound, because a fingerprint is not an identity.
- */
-function applyConflict(registry, resolution, choice = {}) {
-  const reg = identity.load(registry || identity.emptyRegistry());
-  const conflict = resolution && resolution.conflict;
-  const target = (resolution && resolution.holderId) || reg.active;
-  const action = choice && choice.choice === 'rebind' ? 'rebind' : 'keep-separate';
-
-  if (!conflict || !target) {
-    return { ok: false, action, reason: 'no conflict to resolve', registry: reg, requiresConfirm: false };
-  }
-
-  const other = conflict.a === target ? conflict.b : conflict.a;
-  if (action === 'keep-separate') {
-    // Nothing about the rows changes. Keeping the two is not a failure state —
-    // it is the outcome the copy on the card recommends.
-    return {
-      ok: true,
-      action,
-      registry: reg,
-      requiresConfirm: false,
-      kept: [target, other].filter(Boolean),
-    };
-  }
-
-  if (choice.confirm !== true) {
-    return {
-      ok: false,
-      action,
-      reason: 'rebind requires an explicit confirm',
-      registry: reg,
-      requiresConfirm: true,
-      kept: [target, other].filter(Boolean),
-    };
-  }
-
-  const losers = new Set((reg.holders || [])
-    .filter((row) => row && row.id !== target && row.id === other)
-    .map((row) => row.id));
-  const holders = (reg.holders || []).map((row) => {
-    if (!row) return row;
-    if (row.id === target) {
-      return { ...row, fingerprint: resolution.proposal ? resolution.proposal.fingerprint : row.fingerprint };
-    }
-    if (losers.has(row.id)) return { ...row, fingerprint: undefined };
-    return row;
-  });
-
-  return {
-    ok: true,
-    action,
-    requiresConfirm: false,
-    registry: identity.load({ ...reg, holders }),
-    rebound: { kept: target, unbound: Array.from(losers) },
-  };
-}
-
-// ---------------------------------------------------------------- scope ----
-
-/**
- * The client-side filter (§3). `profile.belongsTo` is the same predicate the
- * fold uses, so there is one definition of "this row is this holder's", and a
- * row with no holder stamp is *unattributed* — it belongs to nobody in
- * particular and therefore to the holder asking, which is what makes a legacy
- * unstamped ledger readable instead of invisible.
- *
- * `clientFilter:false` exists only so the isolation test can prove the
- * filter is load-bearing by removing it and watching the leg go red. It is not
- * reachable from any IPC handler (holder-ipc.js never passes it).
- */
-function entriesForHolder(entries, holderId, opts = {}) {
-  const rows = Array.isArray(entries) ? entries : [];
-  const id = safeHolderId(holderId);
-  const forgotten = opts.forgotten instanceof Set ? opts.forgotten : new Set();
-  if (opts.clientFilter === false || !id) {
-    return rows.filter((row) => row && typeof row === 'object' && !forgotten.has(String(rowId(row))));
-  }
-  return rows.filter((row) => {
-    if (!row || typeof row !== 'object') return false;
-    if (forgotten.has(String(rowId(row)))) return false;
-    try {
-      return profileModule.belongsTo(row, id);
-    } catch (err) {
-      return String(row.holder || '') === id;
-    }
-  });
-}
-
-function rowId(row) {
-  if (!row || typeof row !== 'object') return '';
-  return row.id != null ? row.id : (row.entryId != null ? row.entryId : '');
-}
-
-/**
- * Main stamps the holder on every row it writes; the renderer never supplies it
- * (same reasoning as lib/sync/persist-gate.js). A renderer-supplied `holder`
- * field is overwritten, not merged, so a malformed payload cannot smuggle a row
- * into another holder's fold.
- */
-function stampEntry(entry, holderId) {
-  const id = safeHolderId(holderId);
-  if (!entry || typeof entry !== 'object') return entry;
-  if (!id) return { ...entry, holder: undefined };
-  return { ...entry, holder: id };
-}
-
-// ------------------------------------------------------------ provenance ---
-
-/**
- * "Why does it know this" (§4): a facet's sources rendered as the underlying
- * entry text, in the facet's own source order.
- */
-function provenance(profile, entries, facetId, opts = {}) {
-  const facets = (profile && Array.isArray(profile.facets)) ? profile.facets : [];
-  const facet = facets.find((f) => f && f.id === facetId) || null;
-  if (!facet) return { ok: false, reason: `no facet ${facetId}`, facet: null, claims: [] };
-  const byId = new Map();
-  for (const row of Array.isArray(entries) ? entries : []) {
-    const id = rowId(row);
-    if (id) byId.set(String(id), row);
-  }
-  const claims = (Array.isArray(facet.sources) ? facet.sources : []).map((sourceId) => {
-    const row = byId.get(String(sourceId)) || null;
-    return {
-      entryId: String(sourceId),
-      // The text is quoted as inert data: this surface renders memory, it never
-      // re-emits it as an instruction (holder-turn.js neutralises on the way out).
-      text: row ? textOf(row) : '',
-      kind: row ? String(row.kind || '') : '',
-      at: row && Number.isFinite(Number(row.t)) ? Number(row.t) : null,
-      present: Boolean(row),
-    };
-  });
-  return {
-    ok: true,
-    facet: { id: facet.id, key: facet.key, value: facet.value, confidence: facet.confidence },
-    claims,
-    missing: claims.filter((c) => !c.present).map((c) => c.entryId),
-  };
-}
-
-function textOf(row) {
-  if (!row || typeof row !== 'object') return '';
-  const value = row.text != null ? row.text : (row.content != null ? row.content : row.value);
-  return typeof value === 'string' ? value : '';
-}
-
-/**
- * Forget one facet: drop the facet from the profile and put the entries behind
- * it on the holder's forget list, which `entriesForHolder()` reads on the next
- * fold — so the claim cannot silently re-derive from the same row.
- *
- * @returns {{ ok:boolean, profile:object, removed:string[], facetIds:string[] }}
- */
-function forgetFacet(dir, holderId, profile, facetId) {
-  const facets = (profile && Array.isArray(profile.facets)) ? profile.facets : [];
-  const facet = facets.find((f) => f && f.id === facetId) || null;
-  if (!facet) return { ok: false, reason: `no facet ${facetId}`, profile, removed: [], facetIds: [] };
-
-  const removed = (Array.isArray(facet.sources) ? facet.sources : []).map(String);
-  const forgotten = readForgotten(dir, holderId);
-  for (const id of removed) forgotten.add(id);
-  writeForgotten(dir, holderId, forgotten);
-
-  // A second facet folded from the same entries loses its sources too: dropping
-  // nothing but the clicked facet would leave "why does it know this" pointing
-  // at entries the holder just deleted.
-  const pruned = facets
-    .filter((f) => f && f.id !== facet.id)
-    .map((f) => {
-      const sources = (Array.isArray(f.sources) ? f.sources : []).filter((id) => !forgotten.has(String(id)));
-      return { ...f, sources };
-    })
-    .filter((f) => (Array.isArray(f.sources) ? f.sources.length : 0) > 0);
-  const dropped = facets.filter((f) => f && f.id !== facet.id).length - pruned.length;
-
-  const next = {
-    ...(profile || {}),
-    holderId,
-    facets: pruned,
-    budget: { tokens: (profile && profile.budget && profile.budget.tokens) || profileModule.BUDGET_TOKENS, used: 0 },
-    coldStart: pruned.length === 0,
-  };
-  writeProfile(dir, holderId, next);
-  return {
-    ok: true,
-    profile: next,
-    removed,
-    facetIds: [facet.id].concat(dropped > 0 ? pruned.map((f) => f.id) : []),
-  };
-}
-
-module.exports = {
-  AVATAR_DIR,
-  REGISTRY_FILE,
-  HOLDERS_DIR,
-  LEDGER_FILE,
-  PERSONA_FILE,
-  PROFILE_FILE,
-  FORGOTTEN_FILE,
-  SURVIVES_SWITCH,
-  MIRROR_SESSIONS,
-  mirrorSession,
-  registryPath,
-  holderDir,
-  holderPaths,
-  readJsonFile,
-  writeJsonFile,
-  readLedger,
-  appendLedgerRow,
-  readRegistry,
-  writeRegistry,
-  holderRow,
-  ensureHolder,
-  levelOf,
-  readForgotten,
-  writeForgotten,
-  emptyProfile,
-  loadState,
-  writeProfile,
-  writePersona,
-  switchHolder,
-  resolveActive,
-  applyConflict,
-  entriesForHolder,
-  stampEntry,
-  provenance,
-  forgetFacet,
-};
+"use strict";const fs=require("node:fs"),path=require("node:path"),identity=require("./identity.js"),personaModule=require("./persona.js"),profileModule=require("./profile.js"),xp=require("./xp.js"),AVATAR_DIR="avatar",REGISTRY_FILE="holders.json",HOLDERS_DIR="holders",LEDGER_FILE="ledger.jsonl",PERSONA_FILE="persona.json",PROFILE_FILE="profile.json",FORGOTTEN_FILE="forgotten.json",SURVIVES_SWITCH=Object.freeze(["registry"]),MIRROR_SESSIONS=Object.freeze(["avatar:ledger","avatar:profile"]);function mirrorSession(e,r="ledger"){return`avatar:${"profile"===r?"profile":"ledger"}:${e}`}function registryPath(e){return path.join(String(e),AVATAR_DIR,REGISTRY_FILE)}function holderDir(e,r){const t=safeHolderId(r);if(!t)throw new Error("holderDir: expected a holder id (h_ + 8-16 hex)");return path.join(String(e),AVATAR_DIR,HOLDERS_DIR,t)}function holderPaths(e,r){const t=holderDir(e,r);return{dir:t,ledger:path.join(t,LEDGER_FILE),persona:path.join(t,PERSONA_FILE),profile:path.join(t,PROFILE_FILE),forgotten:path.join(t,FORGOTTEN_FILE)}}function safeHolderId(e){const r=null==e?"":String(e).trim();return r&&identity.HOLDER_ID_RE&&identity.HOLDER_ID_RE.test(r)?r:null}function readJsonFile(e){try{const r=fs.readFileSync(e,"utf8"),t=JSON.parse(r);return t&&"object"==typeof t?t:null}catch(e){return null}}function writeJsonFile(e,r){fs.mkdirSync(path.dirname(e),{recursive:!0,mode:448});const t=`${e}.tmp`;return fs.writeFileSync(t,`${JSON.stringify(r,null,2)}\n`),fs.renameSync(t,e),r}function readLedger(e){let r="";try{r=fs.readFileSync(e,"utf8")}catch(e){return[]}const t=[];for(const e of r.split("\n")){const r=e.trim();if(r)try{const e=JSON.parse(r);e&&"object"==typeof e&&t.push(e)}catch(e){}}return t}function appendLedgerRow(e,r){return fs.mkdirSync(path.dirname(e),{recursive:!0,mode:448}),fs.appendFileSync(e,`${JSON.stringify(r)}\n`),r}function readRegistry(e){const r=readJsonFile(registryPath(e));try{return identity.load(r||identity.emptyRegistry())}catch(e){return identity.load(identity.emptyRegistry())}}function writeRegistry(e,r){const t=identity.load(r);return writeJsonFile(registryPath(e),t),t}function holderRow(e,r){const t=safeHolderId(r);return t&&(e.holders||[]).find((e=>e&&e.id===t))||null}function ensureHolder(e,r={}){const t=r.registry||readRegistry(e),o=r.id?safeHolderId(r.id):null,n=o?holderRow(t,o):null;if(n)return{registry:t,row:n,created:!1};const i=identity.addHolder(t,{id:o||void 0,displayName:r.displayName,fingerprint:r.fingerprint,accountId:r.accountId,now:r.now}),s=identity.load(i),d=s.holders[s.holders.length-1]||null;return!1!==r.persist&&writeRegistry(e,s),{registry:s,row:d,created:!0}}function levelOf(e){try{const r=xp.evaluate(Array.isArray(e)?e:[]);return r&&Number.isFinite(r.level)?r.level:1}catch(e){return 1}}function readForgotten(e,r){const t=readJsonFile(holderPaths(e,r).forgotten),o=t&&Array.isArray(t.entries)?t.entries:[];return new Set(o.map(String))}function writeForgotten(e,r,t){const o=Array.from(new Set(Array.from(t).map(String))).sort();return writeJsonFile(holderPaths(e,r).forgotten,{schema:1,holderId:r,entries:o}),new Set(o)}function emptyProfile(e){return{schema:1,holderId:e,facets:[],budget:{tokens:0,used:0},coldStart:!0}}function loadState(e,r,t={}){const o=safeHolderId(r);if(!o)throw new Error("loadState: expected a holder id (h_ + 8-16 hex)");const n=holderRow(t.registry||readRegistry(e),o),i=holderPaths(e,o),s=readLedger(i.ledger),d=readJsonFile(i.persona);let l=personaModule.defaultPersona();if(d)try{const e=personaModule.load(d);l=e&&e.persona?e.persona:e}catch(e){l=personaModule.defaultPersona()}else l=personaModule.defaultPersona();const a=readJsonFile(i.profile)||emptyProfile(o),c=readForgotten(e,o);return{holderId:o,displayName:n&&n.displayName||personaDisplayName(l)||identity.DEFAULT_DISPLAY_NAME,ledger:s,persona:l,profile:a&&a.holderId===o?a:{...a,holderId:o},forgotten:c,level:levelOf(s),scope:MIRROR_SESSIONS.map((e=>mirrorSession(o,e.split(":")[1])))}}function personaDisplayName(e){const r=e&&e.identity&&e.identity.name;return"string"==typeof r&&r.trim()?r.trim():null}function writeProfile(e,r,t){const o={...t||{},holderId:r};return writeJsonFile(holderPaths(e,r).profile,o),o}function writePersona(e,r,t){return writeJsonFile(holderPaths(e,r).persona,{...t||{},holderId:r}),t}function switchHolder(e,r,t={}){const o=safeHolderId(r);if(!o)return{ok:!1,reason:"expected a holder id (h_ + 8-16 hex)",survived:SURVIVES_SWITCH.slice()};const n=t.registry||readRegistry(e);if(!holderRow(n,o)&&!t.create)return{ok:!1,reason:`unknown holder ${o}`,survived:SURVIVES_SWITCH.slice()};let i=n;if(holderRow(n,o)){try{i=identity.setActive(n,o)}catch(e){i={...n,active:o}}i=writeRegistry(e,i)}else{const r=ensureHolder(e,{id:o,displayName:t.displayName,now:t.now});i=writeRegistry(e,identity.setActive(r.registry,o))}const s=loadState(e,o,{registry:i});return{ok:!0,previous:t.previous||n&&n.active||null,state:s,registry:i,survived:SURVIVES_SWITCH.slice()}}function resolveActive(e,r={},t={}){const o=t.registry||readRegistry(e),n=identity.resolve(r,o);if(n.needsMint||!n.holderId)return{registry:o,resolution:n,holderId:null,created:!1};const i=holderRow(o,n.holderId);if(i)return{registry:o,resolution:n,holderId:i.id,created:!1};const s=ensureHolder(e,{id:n.holderId,displayName:n.displayName,fingerprint:n.proposal?n.proposal.fingerprint:void 0,now:t.now,registry:o});return{registry:s.registry,resolution:n,holderId:s.row?s.row.id:n.holderId,created:s.created}}function applyConflict(e,r,t={}){const o=identity.load(e||identity.emptyRegistry()),n=r&&r.conflict,i=r&&r.holderId||o.active,s=t&&"rebind"===t.choice?"rebind":"keep-separate";if(!n||!i)return{ok:!1,action:s,reason:"no conflict to resolve",registry:o,requiresConfirm:!1};const d=n.a===i?n.b:n.a;if("keep-separate"===s)return{ok:!0,action:s,registry:o,requiresConfirm:!1,kept:[i,d].filter(Boolean)};if(!0!==t.confirm)return{ok:!1,action:s,reason:"rebind requires an explicit confirm",registry:o,requiresConfirm:!0,kept:[i,d].filter(Boolean)};const l=new Set((o.holders||[]).filter((e=>e&&e.id!==i&&e.id===d)).map((e=>e.id))),a=(o.holders||[]).map((e=>e?e.id===i?{...e,fingerprint:r.proposal?r.proposal.fingerprint:e.fingerprint}:l.has(e.id)?{...e,fingerprint:void 0}:e:e));return{ok:!0,action:s,requiresConfirm:!1,registry:identity.load({...o,holders:a}),rebound:{kept:i,unbound:Array.from(l)}}}function entriesForHolder(e,r,t={}){const o=Array.isArray(e)?e:[],n=safeHolderId(r),i=t.forgotten instanceof Set?t.forgotten:new Set;return!1!==t.clientFilter&&n?o.filter((e=>{if(!e||"object"!=typeof e)return!1;if(i.has(String(rowId(e))))return!1;try{return profileModule.belongsTo(e,n)}catch(r){return String(e.holder||"")===n}})):o.filter((e=>e&&"object"==typeof e&&!i.has(String(rowId(e)))))}function rowId(e){return e&&"object"==typeof e?null!=e.id?e.id:null!=e.entryId?e.entryId:"":""}function stampEntry(e,r){const t=safeHolderId(r);return e&&"object"==typeof e?t?{...e,holder:t}:{...e,holder:void 0}:e}function provenance(e,r,t,o={}){const n=(e&&Array.isArray(e.facets)?e.facets:[]).find((e=>e&&e.id===t))||null;if(!n)return{ok:!1,reason:`no facet ${t}`,facet:null,claims:[]};const i=new Map;for(const e of Array.isArray(r)?r:[]){const r=rowId(e);r&&i.set(String(r),e)}const s=(Array.isArray(n.sources)?n.sources:[]).map((e=>{const r=i.get(String(e))||null;return{entryId:String(e),text:r?textOf(r):"",kind:r?String(r.kind||""):"",at:r&&Number.isFinite(Number(r.t))?Number(r.t):null,present:Boolean(r)}}));return{ok:!0,facet:{id:n.id,key:n.key,value:n.value,confidence:n.confidence},claims:s,missing:s.filter((e=>!e.present)).map((e=>e.entryId))}}function textOf(e){if(!e||"object"!=typeof e)return"";const r=null!=e.text?e.text:null!=e.content?e.content:e.value;return"string"==typeof r?r:""}function forgetFacet(e,r,t,o){const n=t&&Array.isArray(t.facets)?t.facets:[],i=n.find((e=>e&&e.id===o))||null;if(!i)return{ok:!1,reason:`no facet ${o}`,profile:t,removed:[],facetIds:[]};const s=(Array.isArray(i.sources)?i.sources:[]).map(String),d=readForgotten(e,r);for(const e of s)d.add(e);writeForgotten(e,r,d);const l=n.filter((e=>e&&e.id!==i.id)).map((e=>{const r=(Array.isArray(e.sources)?e.sources:[]).filter((e=>!d.has(String(e))));return{...e,sources:r}})).filter((e=>(Array.isArray(e.sources)?e.sources.length:0)>0)),a=n.filter((e=>e&&e.id!==i.id)).length-l.length,c={...t||{},holderId:r,facets:l,budget:{tokens:t&&t.budget&&t.budget.tokens||profileModule.BUDGET_TOKENS,used:0},coldStart:0===l.length};return writeProfile(e,r,c),{ok:!0,profile:c,removed:s,facetIds:[i.id].concat(a>0?l.map((e=>e.id)):[])}}module.exports={AVATAR_DIR:AVATAR_DIR,REGISTRY_FILE:REGISTRY_FILE,HOLDERS_DIR:HOLDERS_DIR,LEDGER_FILE:LEDGER_FILE,PERSONA_FILE:PERSONA_FILE,PROFILE_FILE:PROFILE_FILE,FORGOTTEN_FILE:FORGOTTEN_FILE,SURVIVES_SWITCH:SURVIVES_SWITCH,MIRROR_SESSIONS:MIRROR_SESSIONS,mirrorSession:mirrorSession,registryPath:registryPath,holderDir:holderDir,holderPaths:holderPaths,readJsonFile:readJsonFile,writeJsonFile:writeJsonFile,readLedger:readLedger,appendLedgerRow:appendLedgerRow,readRegistry:readRegistry,writeRegistry:writeRegistry,holderRow:holderRow,ensureHolder:ensureHolder,levelOf:levelOf,readForgotten:readForgotten,writeForgotten:writeForgotten,emptyProfile:emptyProfile,loadState:loadState,writeProfile:writeProfile,writePersona:writePersona,switchHolder:switchHolder,resolveActive:resolveActive,applyConflict:applyConflict,entriesForHolder:entriesForHolder,stampEntry:stampEntry,provenance:provenance,forgetFacet:forgetFacet};