atabey 0.1.1-beta → 0.1.3

package/dist/shared/src/memory-prune.d.ts

@@ -1,18 +1 @@
-/**
- * Specialty memory pruning — deduplication + cap + summary.
- *
- * `updateSpecialtyMemory` appends raw markdown lessons forever, which bloats
- * prompts and accumulates contradictions. This pure function deduplicates
- * identical lessons (ignoring the timestamp) and caps the retained count,
- * leaving a summary marker for pruned entries.
- */
-export interface PruneResult {
-    content: string;
-    removed: number;
-    kept: number;
-}
-export interface PruneOptions {
-    /** Maximum number of lessons retained (newest kept). Default: 100. */
-    maxLessons?: number;
-}
-export declare function pruneSpecialtyMarkdown(content: string, options?: PruneOptions): PruneResult;
+export * from "./modules/storage/memory-prune.js";

package/dist/shared/src/memory-prune.js

@@ -1,48 +1,2 @@
-/**
- * Specialty memory pruning — deduplication + cap + summary.
- *
- * `updateSpecialtyMemory` appends raw markdown lessons forever, which bloats
- * prompts and accumulates contradictions. This pure function deduplicates
- * identical lessons (ignoring the timestamp) and caps the retained count,
- * leaving a summary marker for pruned entries.
- */
-const LESSON_PREFIX = /^\s*-\s+\*\*\[/;
-const TIMESTAMP = /\[[^\]]*\]/g;
-export function pruneSpecialtyMarkdown(content, options = {}) {
-    const maxLessons = options.maxLessons ?? 100;
-    if (!content)
-        return { content: content ?? "", removed: 0, kept: 0 };
-    const lines = content.split(/\r?\n/);
-    const header = [];
-    const lessons = [];
-    const seen = new Set();
-    let removed = 0;
-    for (const line of lines) {
-        if (LESSON_PREFIX.test(line)) {
-            const key = line.replace(TIMESTAMP, "").trim().toLowerCase();
-            if (seen.has(key)) {
-                removed++;
-                continue;
-            }
-            seen.add(key);
-            lessons.push(line);
-        }
-        else if (line.trim() === "" && lessons.length > 0) {
-            // collapse blank lines between lessons
-            continue;
-        }
-        else {
-            header.push(line);
-        }
-    }
-    let kept = lessons;
-    if (lessons.length > maxLessons) {
-        const dropped = lessons.length - maxLessons;
-        removed += dropped;
-        kept = lessons.slice(-maxLessons);
-        header.push(`- _[memory-prune] ${dropped} older lesson(s) pruned to control prompt size._`);
-    }
-    const body = [...header, ...kept].join("\n").replace(/\n{3,}/g, "\n\n").trimEnd();
-    return { content: body ? `${body}\n` : "", removed, kept: kept.length };
-}
+export * from "./modules/storage/memory-prune.js";
 //# sourceMappingURL=memory-prune.js.map

package/dist/shared/src/memory-prune.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory-prune.js","sourceRoot":"","sources":["../../../../shared/src/memory-prune.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,UAAwB,EAAE;IAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAErE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,CAAC;gBACV,SAAS;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,uCAAuC;YACvC,SAAS;QACb,CAAC;aAAM,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;QAC5C,OAAO,IAAI,OAAO,CAAC;QACnB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,qBAAqB,OAAO,kDAAkD,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"memory-prune.js","sourceRoot":"","sources":["../../../../shared/src/memory-prune.ts"],"names":[],"mappings":"AAAA,cAAc,mCAAmC,CAAC"}

package/dist/shared/src/migrations.d.ts

@@ -1,69 +1 @@
-/**
- * SQLite Schema Migration Runner, Startup Integrity Check & Online Backup/Restore (Phase 1.5)
- *
- * Provides:
- *   1. Versioned, checksummed schema migrations (`schema_migrations` table).
- *   2. Startup integrity verification (`PRAGMA quick_check` / `PRAGMA integrity_check`).
- *   3. Atomic online backup (`VACUUM INTO` + `.sha256` manifest) and verified restore.
- */
-import Database from "better-sqlite3";
-export interface SchemaMigration {
-    version: number;
-    name: string;
-    sql: string;
-}
-export interface AppliedMigration {
-    version: number;
-    name: string;
-    checksum: string;
-    applied_at: string;
-}
-export interface IntegrityCheckResult {
-    ok: boolean;
-    messages: string[];
-    foreignKeyViolations: number;
-}
-export interface BackupResult {
-    backupPath: string;
-    sha256: string;
-    sizeBytes: number;
-    createdAt: string;
-    schemaVersion: number;
-}
-export declare const BUILTIN_MIGRATIONS: SchemaMigration[];
-/**
- * Run all pending schema migrations transactionally and return applied version numbers.
- */
-export declare function runPendingMigrations(db: Database.Database, migrations?: SchemaMigration[]): {
-    applied: number[];
-    currentVersion: number;
-};
-/**
- * Return applied and pending migrations for diagnostics/CLI.
- */
-export declare function getMigrationStatus(db: Database.Database, migrations?: SchemaMigration[]): {
-    currentVersion: number;
-    applied: AppliedMigration[];
-    pending: Array<{
-        version: number;
-        name: string;
-    }>;
-};
-/**
- * Run SQLite integrity_check / quick_check and foreign_key_check.
- */
-export declare function verifyDatabaseIntegrity(db: Database.Database, mode?: "quick" | "full"): IntegrityCheckResult;
-/**
- * Perform a consistent online backup using SQLite `VACUUM INTO` and write a `.sha256` sidecar.
- */
-export declare function backupDatabase(db: Database.Database, destinationPath: string): BackupResult;
-/**
- * Verify a backup file (checksum sidecar + SQLite integrity_check) and atomically restore it.
- */
-export declare function restoreDatabase(backupPath: string, targetDbPath: string, options?: {
-    verifyChecksum?: boolean;
-}): {
-    restoredPath: string;
-    sha256: string;
-    schemaVersion: number;
-};
+export * from "./modules/storage/migrations.js";

package/dist/shared/src/migrations.js

@@ -1,394 +1,2 @@
-/**
- * SQLite Schema Migration Runner, Startup Integrity Check & Online Backup/Restore (Phase 1.5)
- *
- * Provides:
- *   1. Versioned, checksummed schema migrations (`schema_migrations` table).
- *   2. Startup integrity verification (`PRAGMA quick_check` / `PRAGMA integrity_check`).
- *   3. Atomic online backup (`VACUUM INTO` + `.sha256` manifest) and verified restore.
- */
-import Database from "better-sqlite3";
-import crypto from "crypto";
-import fs from "fs";
-import path from "path";
-export const BUILTIN_MIGRATIONS = [
-    {
-        version: 1,
-        name: "001_initial_core_tables",
-        sql: `
-            CREATE TABLE IF NOT EXISTS agents (
-                name TEXT PRIMARY KEY,
-                state TEXT DEFAULT 'READY',
-                task TEXT DEFAULT 'Idle',
-                description TEXT DEFAULT '',
-                skills TEXT DEFAULT '[]',
-                last_updated DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS messages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                sender TEXT,
-                receiver TEXT,
-                category TEXT,
-                content TEXT,
-                trace_id TEXT,
-                parent_id TEXT,
-                status TEXT DEFAULT 'PENDING',
-                priority TEXT DEFAULT 'NORMAL',
-                requires_approval BOOLEAN DEFAULT 0
-            );
-            CREATE TABLE IF NOT EXISTS tasks (
-                id TEXT PRIMARY KEY,
-                trace_id TEXT,
-                description TEXT,
-                agent TEXT,
-                status TEXT DEFAULT 'PENDING',
-                priority TEXT DEFAULT 'NORMAL',
-                dependencies TEXT,
-                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS logs (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                agent TEXT,
-                action TEXT,
-                trace_id TEXT,
-                status TEXT,
-                summary TEXT,
-                findings TEXT,
-                prev_hash TEXT,
-                hash TEXT
-            );
-            CREATE TABLE IF NOT EXISTS metadata (
-                key TEXT PRIMARY KEY,
-                value TEXT
-            );
-            CREATE TABLE IF NOT EXISTS costs (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                provider TEXT,
-                model TEXT,
-                input_tokens INTEGER,
-                output_tokens INTEGER,
-                cost REAL,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                trace_id TEXT
-            );
-            CREATE TABLE IF NOT EXISTS knowledge (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                filename TEXT UNIQUE,
-                content TEXT,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS users (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                name TEXT UNIQUE,
-                token TEXT UNIQUE,
-                role TEXT DEFAULT 'user',
-                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-        `,
-    },
-    {
-        version: 2,
-        name: "002_governance_approvals_discipline_cooldowns",
-        sql: `
-            CREATE TABLE IF NOT EXISTS loop_cooldowns (
-                agent TEXT PRIMARY KEY,
-                cooldown_until INTEGER NOT NULL,
-                detail TEXT,
-                cooldown_count INTEGER DEFAULT 1,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS approvals (
-                trace_id TEXT PRIMARY KEY,
-                tool_name TEXT NOT NULL,
-                agent TEXT NOT NULL,
-                risk_score INTEGER NOT NULL,
-                risk_level TEXT NOT NULL,
-                reason TEXT NOT NULL,
-                args TEXT NOT NULL,
-                created_at INTEGER NOT NULL,
-                expires_at INTEGER NOT NULL,
-                status TEXT DEFAULT 'PENDING',
-                passcode TEXT
-            );
-            CREATE TABLE IF NOT EXISTS discipline (
-                agent TEXT PRIMARY KEY,
-                total_calls INTEGER DEFAULT 0,
-                violations INTEGER DEFAULT 0,
-                last_violation TEXT,
-                cooldown_until INTEGER DEFAULT 0,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-        `,
-    },
-    {
-        version: 3,
-        name: "003_performance_indexes",
-        sql: `
-            CREATE INDEX IF NOT EXISTS idx_messages_receiver_status ON messages(receiver, status);
-            CREATE INDEX IF NOT EXISTS idx_messages_trace ON messages(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_tasks_trace ON tasks(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_logs_trace ON logs(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_costs_timestamp ON costs(timestamp);
-            CREATE INDEX IF NOT EXISTS idx_costs_trace ON costs(trace_id);
-        `,
-    },
-    {
-        version: 4,
-        name: "004_api_catalog",
-        sql: `
-            CREATE TABLE IF NOT EXISTS api_endpoints (
-                method TEXT NOT NULL,
-                path TEXT NOT NULL,
-                tag TEXT,
-                summary TEXT,
-                auth_required INTEGER DEFAULT 0,
-                request_schema TEXT,
-                response_schema TEXT,
-                source TEXT,
-                updated_at TEXT NOT NULL,
-                PRIMARY KEY (method, path)
-            );
-            CREATE INDEX IF NOT EXISTS idx_api_endpoints_tag ON api_endpoints(tag);
-        `,
-    },
-    {
-        version: 5,
-        name: "005_discipline_call_history",
-        sql: `
-            CREATE TABLE IF NOT EXISTS discipline_calls (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent TEXT NOT NULL,
-                tool TEXT NOT NULL,
-                ts INTEGER NOT NULL,
-                args_size INTEGER DEFAULT 0
-            );
-            CREATE INDEX IF NOT EXISTS idx_discipline_calls_agent_ts ON discipline_calls(agent, ts);
-        `,
-    },
-    {
-        version: 6,
-        name: "006_code_graph",
-        sql: `
-            CREATE TABLE IF NOT EXISTS code_files (
-                path TEXT PRIMARY KEY,
-                hash TEXT NOT NULL,
-                updated_at TEXT NOT NULL
-            );
-            CREATE TABLE IF NOT EXISTS code_symbols (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                file TEXT NOT NULL,
-                name TEXT NOT NULL,
-                kind TEXT NOT NULL,
-                start_line INTEGER,
-                end_line INTEGER,
-                signature TEXT,
-                exported INTEGER DEFAULT 0
-            );
-            CREATE INDEX IF NOT EXISTS idx_code_symbols_name ON code_symbols(name);
-            CREATE INDEX IF NOT EXISTS idx_code_symbols_file ON code_symbols(file);
-            CREATE TABLE IF NOT EXISTS code_imports (
-                file TEXT NOT NULL,
-                specifier TEXT NOT NULL
-            );
-            CREATE INDEX IF NOT EXISTS idx_code_imports_file ON code_imports(file);
-        `,
-    },
-    {
-        version: 7,
-        name: "007_job_queue",
-        sql: `
-            CREATE TABLE IF NOT EXISTS job_queue (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                queue_name TEXT NOT NULL,
-                payload TEXT NOT NULL,
-                status TEXT DEFAULT 'pending',
-                retries INTEGER DEFAULT 0,
-                max_retries INTEGER DEFAULT 3,
-                error_message TEXT,
-                created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE INDEX IF NOT EXISTS idx_job_queue_status ON job_queue(status);
-            CREATE INDEX IF NOT EXISTS idx_job_queue_queue_name ON job_queue(queue_name);
-        `,
-    },
-];
-function migrationChecksum(sql) {
-    return crypto.createHash("sha256").update(sql.trim(), "utf8").digest("hex");
-}
-function ensureMigrationsTable(db) {
-    db.exec(`
-        CREATE TABLE IF NOT EXISTS schema_migrations (
-            version INTEGER PRIMARY KEY,
-            name TEXT NOT NULL,
-            checksum TEXT NOT NULL,
-            applied_at TEXT NOT NULL
-        )
-    `);
-}
-/**
- * Run all pending schema migrations transactionally and return applied version numbers.
- */
-export function runPendingMigrations(db, migrations = BUILTIN_MIGRATIONS) {
-    ensureMigrationsTable(db);
-    const existingRows = db
-        .prepare("SELECT version, name, checksum, applied_at FROM schema_migrations ORDER BY version ASC")
-        .all();
-    const existingMap = new Map(existingRows.map((r) => [r.version, r]));
-    const sorted = [...migrations].sort((a, b) => a.version - b.version);
-    const applied = [];
-    for (const m of sorted) {
-        const prev = existingMap.get(m.version);
-        const checksum = migrationChecksum(m.sql);
-        if (prev) {
-            if (prev.checksum !== checksum) {
-                throw new Error(`[MIGRATION] Checksum mismatch for migration v${m.version} (${m.name}): ` +
-                    `expected ${prev.checksum}, got ${checksum}.`);
-            }
-            continue;
-        }
-        const applyOne = db.transaction(() => {
-            db.exec(m.sql);
-            db.prepare("INSERT INTO schema_migrations (version, name, checksum, applied_at) VALUES (?, ?, ?, ?)").run(m.version, m.name, checksum, new Date().toISOString());
-        });
-        applyOne();
-        applied.push(m.version);
-    }
-    // Legacy column backfill for older databases that predate v1 hash columns
-    try {
-        const tableInfo = db.prepare("PRAGMA table_info(logs)").all();
-        const colNames = tableInfo.map((c) => c.name);
-        if (colNames.length > 0) {
-            if (!colNames.includes("prev_hash"))
-                db.exec("ALTER TABLE logs ADD COLUMN prev_hash TEXT");
-            if (!colNames.includes("hash"))
-                db.exec("ALTER TABLE logs ADD COLUMN hash TEXT");
-        }
-    }
-    catch {
-        /* ignore if logs table does not exist in custom migration test */
-    }
-    const latest = db.prepare("SELECT MAX(version) as v FROM schema_migrations").get();
-    return {
-        applied,
-        currentVersion: latest?.v ?? 0,
-    };
-}
-/**
- * Return applied and pending migrations for diagnostics/CLI.
- */
-export function getMigrationStatus(db, migrations = BUILTIN_MIGRATIONS) {
-    ensureMigrationsTable(db);
-    const applied = db
-        .prepare("SELECT version, name, checksum, applied_at FROM schema_migrations ORDER BY version ASC")
-        .all();
-    const appliedSet = new Set(applied.map((a) => a.version));
-    const pending = migrations
-        .filter((m) => !appliedSet.has(m.version))
-        .map((m) => ({ version: m.version, name: m.name }));
-    const currentVersion = applied.length > 0 ? applied[applied.length - 1].version : 0;
-    return { currentVersion, applied, pending };
-}
-/**
- * Run SQLite integrity_check / quick_check and foreign_key_check.
- */
-export function verifyDatabaseIntegrity(db, mode = "quick") {
-    const pragma = mode === "full" ? "integrity_check" : "quick_check";
-    const rows = db.prepare(`PRAGMA ${pragma}`).all();
-    const messages = rows.map((r) => Object.values(r)[0] || "");
-    const fkRows = db.prepare("PRAGMA foreign_key_check").all();
-    const ok = messages.length === 1 && messages[0].toLowerCase() === "ok" && fkRows.length === 0;
-    return {
-        ok,
-        messages,
-        foreignKeyViolations: fkRows.length,
-    };
-}
-/**
- * Perform a consistent online backup using SQLite `VACUUM INTO` and write a `.sha256` sidecar.
- */
-export function backupDatabase(db, destinationPath) {
-    const absDest = path.resolve(destinationPath);
-    const parentDir = path.dirname(absDest);
-    fs.mkdirSync(parentDir, { recursive: true });
-    if (fs.existsSync(absDest)) {
-        fs.unlinkSync(absDest);
-    }
-    // Escape single quotes in path for SQLite VACUUM INTO literal
-    const escapedPath = absDest.replace(/'/g, "''");
-    db.exec(`VACUUM INTO '${escapedPath}'`);
-    const bytes = fs.readFileSync(absDest);
-    const sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
-    fs.writeFileSync(`${absDest}.sha256`, `${sha256}  ${path.basename(absDest)}\n`, { mode: 0o600 });
-    const status = getMigrationStatus(db);
-    return {
-        backupPath: absDest,
-        sha256,
-        sizeBytes: bytes.length,
-        createdAt: new Date().toISOString(),
-        schemaVersion: status.currentVersion,
-    };
-}
-/**
- * Verify a backup file (checksum sidecar + SQLite integrity_check) and atomically restore it.
- */
-export function restoreDatabase(backupPath, targetDbPath, options = {}) {
-    const absBackup = path.resolve(backupPath);
-    const absTarget = path.resolve(targetDbPath);
-    if (!fs.existsSync(absBackup)) {
-        throw new Error(`Backup file does not exist: ${absBackup}`);
-    }
-    const bytes = fs.readFileSync(absBackup);
-    const actualSha256 = crypto.createHash("sha256").update(bytes).digest("hex");
-    const sidecarPath = `${absBackup}.sha256`;
-    if (options.verifyChecksum !== false && fs.existsSync(sidecarPath)) {
-        const expected = fs.readFileSync(sidecarPath, "utf8").trim().split(/\s+/)[0];
-        if (expected && expected !== actualSha256) {
-            throw new Error(`Backup checksum mismatch for ${absBackup}: expected ${expected}, got ${actualSha256}`);
-        }
-    }
-    // Open backup in read-only mode to verify SQLite integrity before overwriting target
-    const tempCheckDb = new Database(absBackup, { readonly: true });
-    let schemaVersion = 0;
-    try {
-        const integrity = verifyDatabaseIntegrity(tempCheckDb, "full");
-        if (!integrity.ok) {
-            throw new Error(`Backup file failed SQLite integrity check: ${integrity.messages.join("; ")}`);
-        }
-        try {
-            const row = tempCheckDb
-                .prepare("SELECT MAX(version) as v FROM schema_migrations")
-                .get();
-            schemaVersion = row?.v ?? 0;
-        }
-        catch {
-            /* schema_migrations table may not exist in older backups */
-        }
-    }
-    finally {
-        tempCheckDb.close();
-    }
-    fs.mkdirSync(path.dirname(absTarget), { recursive: true });
-    const stagingPath = `${absTarget}.restore.${process.pid}`;
-    fs.copyFileSync(absBackup, stagingPath);
-    // Remove stale WAL/SHM files before atomic swap
-    for (const suffix of ["-wal", "-shm"]) {
-        const walFile = `${absTarget}${suffix}`;
-        if (fs.existsSync(walFile)) {
-            try {
-                fs.unlinkSync(walFile);
-            }
-            catch {
-                /* ignore */
-            }
-        }
-    }
-    fs.renameSync(stagingPath, absTarget);
-    return {
-        restoredPath: absTarget,
-        sha256: actualSha256,
-        schemaVersion,
-    };
-}
+export * from "./modules/storage/migrations.js";
 //# sourceMappingURL=migrations.js.map

package/dist/shared/src/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../../shared/src/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AA6BxB,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACjD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,yBAAyB;QAC/B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAuEJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,+CAA+C;QACrD,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA6BJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,yBAAyB;QAC/B,GAAG,EAAE;;;;;;;SAOJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,iBAAiB;QACvB,GAAG,EAAE;;;;;;;;;;;;;;SAcJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,6BAA6B;QACnC,GAAG,EAAE;;;;;;;;;SASJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;SAuBJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,eAAe;QACrB,GAAG,EAAE;;;;;;;;;;;;;;SAcJ;KACJ;CACJ,CAAC;AAEF,SAAS,iBAAiB,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAqB;IAChD,EAAE,CAAC,IAAI,CAAC;;;;;;;KAOP,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAChC,EAAqB,EACrB,aAAgC,kBAAkB;IAElD,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAE1B,MAAM,YAAY,GAAG,EAAE;SAClB,OAAO,CAAC,wFAAwF,CAAC;SACjG,GAAG,EAAwB,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAA2B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACX,gDAAgD,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK;oBACrE,YAAY,IAAI,CAAC,QAAQ,SAAS,QAAQ,GAAG,CACpD,CAAC;YACN,CAAC;YACD,SAAS;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACf,EAAE,CAAC,OAAO,CACN,yFAAyF,CAC5F,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,GAAG,EAA6B,CAAC;QACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC3F,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,kEAAkE;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAA0B,CAAC;IAC3G,OAAO;QACH,OAAO;QACP,cAAc,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC;KACjC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,EAAqB,EACrB,aAAgC,kBAAkB;IAMlD,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE;SACb,OAAO,CAAC,wFAAwF,CAAC;SACjG,GAAG,EAAwB,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACnC,EAAqB,EACrB,OAAyB,OAAO;IAEhC,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,GAAG,EAAmC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAe,CAAC;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9F,OAAO;QACH,EAAE;QACF,QAAQ;QACR,oBAAoB,EAAE,MAAM,CAAC,MAAM;KACtC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,eAAuB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,WAAW,GAAG,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,EAAE,CAAC,aAAa,CAAC,GAAG,OAAO,SAAS,EAAE,GAAG,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO;QACH,UAAU,EAAE,OAAO;QACnB,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,aAAa,EAAE,MAAM,CAAC,cAAc;KACvC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC3B,UAAkB,EAClB,YAAoB,EACpB,UAAwC,EAAE;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7E,MAAM,WAAW,GAAG,GAAG,SAAS,SAAS,CAAC;IAC1C,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACX,gCAAgC,SAAS,cAAc,QAAQ,SAAS,YAAY,EAAE,CACzF,CAAC;QACN,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,WAAW;iBAClB,OAAO,CAAC,iDAAiD,CAAC;iBAC1D,GAAG,EAAsC,CAAC;YAC/C,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACL,4DAA4D;QAChE,CAAC;IACL,CAAC;YAAS,CAAC;QACP,WAAW,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,GAAG,SAAS,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAExC,gDAAgD;IAChD,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACL,YAAY;YAChB,CAAC;QACL,CAAC;IACL,CAAC;IAED,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO;QACH,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,YAAY;QACpB,aAAa;KAChB,CAAC;AACN,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../../shared/src/migrations.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAC"}

package/dist/shared/src/modules/agent/agent-identity.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+export interface AgentIdentity {
+    agent: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface AgentTokenResult {
+    valid: boolean;
+    agent?: string;
+    reason?: string;
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export declare function isAgentIdentityEnforced(): boolean;
+/** Sign an agent identity into a compact token. */
+export declare function signAgentToken(agent: string, options?: {
+    ttlMs?: number;
+    key?: string | Buffer;
+}): string;
+/** Verify an agent token (signature + expiry). */
+export declare function verifyAgentToken(token: string, options?: {
+    key?: string | Buffer;
+}): AgentTokenResult;
+/** Decode a token's identity without verification (for diagnostics only). */
+export declare function decodeAgentToken(token: string): AgentIdentity | null;

package/dist/shared/src/modules/agent/agent-identity.js

@@ -0,0 +1,77 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+import crypto from "crypto";
+import { resolveAuditChainKey } from "../observability/audit-chain.js";
+function resolveKey(explicit) {
+    if (explicit) {
+        return Buffer.isBuffer(explicit) ? explicit : crypto.createHash("sha256").update(explicit, "utf8").digest();
+    }
+    const envSecret = process.env.ATABEY_AGENT_SECRET;
+    if (envSecret && envSecret.trim()) {
+        return crypto.createHash("sha256").update(envSecret.trim(), "utf8").digest();
+    }
+    return resolveAuditChainKey();
+}
+function timingSafeEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ba, bb);
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export function isAgentIdentityEnforced() {
+    return process.env.ATABEY_AGENT_IDENTITY_REQUIRED === "true";
+}
+/** Sign an agent identity into a compact token. */
+export function signAgentToken(agent, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key) {
+        throw new Error("[AGENT_IDENTITY] No signing key. Set ATABEY_AGENT_SECRET.");
+    }
+    const name = agent.replace(/^@/, "");
+    const issuedAt = Date.now();
+    const expiresAt = issuedAt + (options.ttlMs ?? 60 * 60 * 1000);
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const sig = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    return `${payload}.${sig}`;
+}
+/** Verify an agent token (signature + expiry). */
+export function verifyAgentToken(token, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key)
+        return { valid: false, reason: "No signing key configured." };
+    if (!token || typeof token !== "string")
+        return { valid: false, reason: "Empty token." };
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return { valid: false, reason: "Malformed token." };
+    const [name, issuedAt, expiresAt, sig] = parts;
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const expected = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    if (!timingSafeEqual(sig, expected))
+        return { valid: false, reason: "Signature mismatch." };
+    const exp = Number(expiresAt);
+    if (!Number.isFinite(exp))
+        return { valid: false, reason: "Invalid expiry." };
+    if (Date.now() > exp)
+        return { valid: false, reason: "Token expired." };
+    return { valid: true, agent: `@${name}` };
+}
+/** Decode a token's identity without verification (for diagnostics only). */
+export function decodeAgentToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return null;
+    return { agent: `@${parts[0]}`, issuedAt: Number(parts[1]), expiresAt: Number(parts[2]) };
+}
+//# sourceMappingURL=agent-identity.js.map