context-vault 2.3.0 → 2.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Felix Hellstrom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/cli.js

@@ -20,7 +20,7 @@ import {
   unlinkSync,
 } from "node:fs";
 import { join, resolve, dirname } from "node:path";
-import { homedir } from "node:os";
+import { homedir, platform } from "node:os";
 import { execSync, fork } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
@@ -73,6 +73,36 @@ function prompt(question, defaultVal) {
   });
 }
 
+// ─── Platform Helpers ────────────────────────────────────────────────────────
+
+const PLATFORM = platform();
+
+/** Get the platform-specific application data directory */
+function appDataDir() {
+  switch (PLATFORM) {
+    case "win32":
+      return process.env.APPDATA || join(HOME, "AppData", "Roaming");
+    case "darwin":
+      return join(HOME, "Library", "Application Support");
+    case "linux":
+    default:
+      return process.env.XDG_CONFIG_HOME || join(HOME, ".config");
+  }
+}
+
+/** Get the platform-specific VS Code extensions directory */
+function vscodeDataDir() {
+  switch (PLATFORM) {
+    case "win32":
+      return join(appDataDir(), "Code", "User", "globalStorage");
+    case "darwin":
+      return join(appDataDir(), "Code", "User", "globalStorage");
+    case "linux":
+    default:
+      return join(HOME, ".config", "Code", "User", "globalStorage");
+  }
+}
+
 // ─── Tool Detection ──────────────────────────────────────────────────────────
 
 const TOOLS = [
@@ -81,7 +111,8 @@ const TOOLS = [
     name: "Claude Code",
     detect: () => {
       try {
-        execSync("which claude", { stdio: "pipe" });
+        const cmd = PLATFORM === "win32" ? "where claude" : "which claude";
+        execSync(cmd, { stdio: "pipe" });
         return true;
       } catch {
         return false;
@@ -92,16 +123,9 @@ const TOOLS = [
   {
     id: "claude-desktop",
     name: "Claude Desktop",
-    detect: () =>
-      existsSync(join(HOME, "Library", "Application Support", "Claude")),
+    detect: () => existsSync(join(appDataDir(), "Claude")),
     configType: "json",
-    configPath: join(
-      HOME,
-      "Library",
-      "Application Support",
-      "Claude",
-      "claude_desktop_config.json"
-    ),
+    configPath: join(appDataDir(), "Claude", "claude_desktop_config.json"),
     configKey: "mcpServers",
   },
   {
@@ -124,26 +148,10 @@ const TOOLS = [
     id: "cline",
     name: "Cline (VS Code)",
     detect: () =>
-      existsSync(
-        join(
-          HOME,
-          "Library",
-          "Application Support",
-          "Code",
-          "User",
-          "globalStorage",
-          "saoudrizwan.claude-dev",
-          "settings"
-        )
-      ),
+      existsSync(join(vscodeDataDir(), "saoudrizwan.claude-dev", "settings")),
     configType: "json",
     configPath: join(
-      HOME,
-      "Library",
-      "Application Support",
-      "Code",
-      "User",
-      "globalStorage",
+      vscodeDataDir(),
       "saoudrizwan.claude-dev",
       "settings",
       "cline_mcp_settings.json"
@@ -672,7 +680,7 @@ async function runReindex() {
     process.exit(1);
   }
 
-  const db = initDatabase(config.dbPath);
+  const db = await initDatabase(config.dbPath);
   const stmts = prepareStatements(db);
   const ctx = {
     db,
@@ -701,7 +709,7 @@ async function runStatus() {
   const { gatherVaultStatus } = await import("@context-vault/core/core/status");
 
   const config = resolveConfig();
-  const db = initDatabase(config.dbPath);
+  const db = await initDatabase(config.dbPath);
 
   const status = gatherVaultStatus({ db, config });
 

package/node_modules/@context-vault/core/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Felix Hellstrom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@context-vault/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@context-vault/core",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "type": "module",
   "description": "Shared core: capture, index, retrieve, tools, and utilities for context-vault",
   "main": "src/index.js",
@@ -25,7 +25,7 @@
   "license": "MIT",
   "engines": { "node": ">=20" },
   "author": "Felix Hellstrom",
-  "repository": { "type": "git", "url": "https://github.com/fellanH/context-mcp.git", "directory": "packages/core" },
+  "repository": { "type": "git", "url": "git+https://github.com/fellanH/context-mcp.git", "directory": "packages/core" },
   "homepage": "https://github.com/fellanH/context-mcp",
   "dependencies": {
     "@huggingface/transformers": "^3.0.0",

package/node_modules/@context-vault/core/src/capture/index.js

@@ -15,7 +15,7 @@ import { parseFrontmatter, formatFrontmatter } from "../core/frontmatter.js";
 import { formatBody } from "./formatters.js";
 import { writeEntryFile } from "./file-ops.js";
 
-export function writeEntry(ctx, { kind, title, body, meta, tags, source, folder, identity_key, expires_at }) {
+export function writeEntry(ctx, { kind, title, body, meta, tags, source, folder, identity_key, expires_at, userId }) {
   if (!kind || typeof kind !== "string") {
     throw new Error("writeEntry: kind is required (non-empty string)");
   }
@@ -59,7 +59,7 @@ export function writeEntry(ctx, { kind, title, body, meta, tags, source, folder,
     category, identity_key, expires_at,
   });
 
-  return { id, filePath, kind, category, title, body, meta, tags, source, createdAt, identity_key, expires_at };
+  return { id, filePath, kind, category, title, body, meta, tags, source, createdAt, identity_key, expires_at, userId: userId || null };
 }
 
 /**
@@ -123,6 +123,7 @@ export function updateEntryFile(ctx, existing, updates) {
     createdAt: fmMeta.created || existing.created_at,
     identity_key: existing.identity_key,
     expires_at,
+    userId: existing.user_id || null,
   };
 }
 

package/node_modules/@context-vault/core/src/core/config.js

@@ -19,6 +19,7 @@ export function parseArgs(argv) {
     else if (argv[i] === "--data-dir" && argv[i + 1]) args.dataDir = argv[++i];
     else if (argv[i] === "--db-path" && argv[i + 1]) args.dbPath = argv[++i];
     else if (argv[i] === "--dev-dir" && argv[i + 1]) args.devDir = argv[++i];
+    else if (argv[i] === "--event-decay-days" && argv[i + 1]) args.eventDecayDays = Number(argv[++i]);
   }
   return args;
 }
@@ -34,6 +35,7 @@ export function resolveConfig() {
     dataDir,
     dbPath: join(dataDir, "vault.db"),
     devDir: join(HOME, "dev"),
+    eventDecayDays: 30,
     resolvedFrom: "defaults",
   };
 
@@ -46,6 +48,7 @@ export function resolveConfig() {
       if (fc.dataDir) { config.dataDir = fc.dataDir; config.dbPath = join(resolve(fc.dataDir), "vault.db"); }
       if (fc.dbPath) config.dbPath = fc.dbPath;
       if (fc.devDir) config.devDir = fc.devDir;
+      if (fc.eventDecayDays) config.eventDecayDays = fc.eventDecayDays;
       config.resolvedFrom = "config file";
     } catch (e) {
       throw new Error(`[context-mcp] Invalid config at ${configPath}: ${e.message}`);
@@ -57,11 +60,13 @@ export function resolveConfig() {
   if (process.env.CONTEXT_MCP_VAULT_DIR) { config.vaultDir = process.env.CONTEXT_MCP_VAULT_DIR; config.resolvedFrom = "env"; }
   if (process.env.CONTEXT_MCP_DB_PATH) { config.dbPath = process.env.CONTEXT_MCP_DB_PATH; config.resolvedFrom = "env"; }
   if (process.env.CONTEXT_MCP_DEV_DIR) { config.devDir = process.env.CONTEXT_MCP_DEV_DIR; config.resolvedFrom = "env"; }
+  if (process.env.CONTEXT_MCP_EVENT_DECAY_DAYS) { config.eventDecayDays = Number(process.env.CONTEXT_MCP_EVENT_DECAY_DAYS); config.resolvedFrom = "env"; }
 
   // 4. CLI arg overrides (highest priority)
   if (cliArgs.vaultDir) { config.vaultDir = cliArgs.vaultDir; config.resolvedFrom = "CLI args"; }
   if (cliArgs.dbPath) { config.dbPath = cliArgs.dbPath; config.resolvedFrom = "CLI args"; }
   if (cliArgs.devDir) { config.devDir = cliArgs.devDir; config.resolvedFrom = "CLI args"; }
+  if (cliArgs.eventDecayDays) { config.eventDecayDays = cliArgs.eventDecayDays; config.resolvedFrom = "CLI args"; }
 
   // Resolve all paths to absolute
   config.vaultDir = resolve(config.vaultDir);

package/node_modules/@context-vault/core/src/core/status.js

@@ -5,17 +5,26 @@
 import { existsSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { walkDir } from "./files.js";
+import { isEmbedAvailable } from "../index/embed.js";
 
 /**
  * Gather raw vault status data for formatting by consumers.
  *
  * @param {{ db, config }} ctx
+ * @param {{ userId?: string }} opts — optional userId for per-user stats
  * @returns {{ fileCount, subdirs, kindCounts, dbSize, stalePaths, resolvedFrom, embeddingStatus, errors }}
  */
-export function gatherVaultStatus(ctx) {
+export function gatherVaultStatus(ctx, opts = {}) {
   const { db, config } = ctx;
+  const { userId } = opts;
   const errors = [];
 
+  // Build user filter clause for DB queries
+  const hasUser = userId !== undefined;
+  const userWhere = hasUser ? "WHERE user_id = ?" : "";
+  const userAnd = hasUser ? "AND user_id = ?" : "";
+  const userParams = hasUser ? [userId] : [];
+
   // Count files in vault subdirs (auto-discover)
   let fileCount = 0;
   const subdirs = [];
@@ -37,7 +46,7 @@ export function gatherVaultStatus(ctx) {
   // Count DB rows by kind
   let kindCounts = [];
   try {
-    kindCounts = db.prepare("SELECT kind, COUNT(*) as c FROM vault GROUP BY kind").all();
+    kindCounts = db.prepare(`SELECT kind, COUNT(*) as c FROM vault ${userWhere} GROUP BY kind`).all(...userParams);
   } catch (e) {
     errors.push(`Kind count query failed: ${e.message}`);
   }
@@ -45,7 +54,7 @@ export function gatherVaultStatus(ctx) {
   // Count DB rows by category
   let categoryCounts = [];
   try {
-    categoryCounts = db.prepare("SELECT category, COUNT(*) as c FROM vault GROUP BY category").all();
+    categoryCounts = db.prepare(`SELECT category, COUNT(*) as c FROM vault ${userWhere} GROUP BY category`).all(...userParams);
   } catch (e) {
     errors.push(`Category count query failed: ${e.message}`);
   }
@@ -69,26 +78,39 @@ export function gatherVaultStatus(ctx) {
   let staleCount = 0;
   try {
     const result = db.prepare(
-      "SELECT COUNT(*) as c FROM vault WHERE file_path NOT LIKE ? || '%'"
-    ).get(config.vaultDir);
+      `SELECT COUNT(*) as c FROM vault WHERE file_path NOT LIKE ? || '%' ${userAnd}`
+    ).get(config.vaultDir, ...userParams);
     staleCount = result.c;
     stalePaths = staleCount > 0;
   } catch (e) {
     errors.push(`Stale path check failed: ${e.message}`);
   }
 
+  // Count expired entries pending pruning
+  let expiredCount = 0;
+  try {
+    expiredCount = db.prepare(
+      `SELECT COUNT(*) as c FROM vault WHERE expires_at IS NOT NULL AND expires_at <= datetime('now') ${userAnd}`
+    ).get(...userParams).c;
+  } catch (e) {
+    errors.push(`Expired count failed: ${e.message}`);
+  }
+
   // Embedding/vector status
   let embeddingStatus = null;
   try {
-    const total = db.prepare("SELECT COUNT(*) as c FROM vault").get().c;
+    const total = db.prepare(`SELECT COUNT(*) as c FROM vault ${userWhere}`).get(...userParams).c;
     const indexed = db.prepare(
-      "SELECT COUNT(*) as c FROM vault WHERE rowid IN (SELECT rowid FROM vault_vec)"
-    ).get().c;
+      `SELECT COUNT(*) as c FROM vault WHERE rowid IN (SELECT rowid FROM vault_vec) ${userAnd}`
+    ).get(...userParams).c;
     embeddingStatus = { indexed, total, missing: total - indexed };
   } catch (e) {
     errors.push(`Embedding status check failed: ${e.message}`);
   }
 
+  // Embedding model availability
+  const embedModelAvailable = isEmbedAvailable();
+
   return {
     fileCount,
     subdirs,
@@ -98,7 +120,9 @@ export function gatherVaultStatus(ctx) {
     dbSizeBytes,
     stalePaths,
     staleCount,
+    expiredCount,
     embeddingStatus,
+    embedModelAvailable,
     resolvedFrom: config.resolvedFrom,
     errors,
   };

package/node_modules/@context-vault/core/src/index/db.js

@@ -2,32 +2,101 @@
  * db.js — Database schema, initialization, and prepared statements
  */
 
-import Database from "better-sqlite3";
-import * as sqliteVec from "sqlite-vec";
-import { unlinkSync } from "node:fs";
+import { unlinkSync, copyFileSync, existsSync } from "node:fs";
 
-// ─── Schema DDL (v5 — categories) ───────────────────────────────────────────
+// ─── Native Module Error ────────────────────────────────────────────────────
+
+export class NativeModuleError extends Error {
+  constructor(originalError) {
+    const diagnostic = formatNativeModuleError(originalError);
+    super(diagnostic);
+    this.name = "NativeModuleError";
+    this.originalError = originalError;
+  }
+}
+
+function formatNativeModuleError(err) {
+  const msg = err.message || "";
+  const versionMatch = msg.match(
+    /was compiled against a different Node\.js version using\s+NODE_MODULE_VERSION (\d+)\. This version of Node\.js requires\s+NODE_MODULE_VERSION (\d+)/
+  );
+
+  const lines = [
+    `Native module failed to load: ${msg}`,
+    "",
+    `  Running Node.js: ${process.version} (${process.execPath})`,
+  ];
+
+  if (versionMatch) {
+    lines.push(`  Module compiled for: NODE_MODULE_VERSION ${versionMatch[1]}`);
+    lines.push(`  Current runtime:     NODE_MODULE_VERSION ${versionMatch[2]}`);
+  }
+
+  lines.push(
+    "",
+    "  Fix: Rebuild native modules for your current Node.js:",
+    "    npm rebuild better-sqlite3 sqlite-vec",
+    "",
+    "  Or reinstall:",
+    "    npm install -g context-vault",
+  );
+
+  return lines.join("\n");
+}
+
+// ─── Lazy Native Module Loading ─────────────────────────────────────────────
+
+let _Database = null;
+let _sqliteVec = null;
+
+async function loadNativeModules() {
+  if (_Database && _sqliteVec) return { Database: _Database, sqliteVec: _sqliteVec };
+
+  try {
+    const dbMod = await import("better-sqlite3");
+    _Database = dbMod.default;
+  } catch (e) {
+    throw new NativeModuleError(e);
+  }
+
+  try {
+    const vecMod = await import("sqlite-vec");
+    _sqliteVec = vecMod;
+  } catch (e) {
+    throw new NativeModuleError(e);
+  }
+
+  return { Database: _Database, sqliteVec: _sqliteVec };
+}
+
+// ─── Schema DDL (v6 — multi-tenancy + encryption) ──────────────────────────
 
 export const SCHEMA_DDL = `
   CREATE TABLE IF NOT EXISTS vault (
-    id           TEXT PRIMARY KEY,
-    kind         TEXT NOT NULL,
-    category     TEXT NOT NULL DEFAULT 'knowledge',
-    title        TEXT,
-    body         TEXT NOT NULL,
-    meta         TEXT,
-    tags         TEXT,
-    source       TEXT,
-    file_path    TEXT UNIQUE,
-    identity_key TEXT,
-    expires_at   TEXT,
-    created_at   TEXT DEFAULT (datetime('now'))
+    id              TEXT PRIMARY KEY,
+    kind            TEXT NOT NULL,
+    category        TEXT NOT NULL DEFAULT 'knowledge',
+    title           TEXT,
+    body            TEXT NOT NULL,
+    meta            TEXT,
+    tags            TEXT,
+    source          TEXT,
+    file_path       TEXT UNIQUE,
+    identity_key    TEXT,
+    expires_at      TEXT,
+    created_at      TEXT DEFAULT (datetime('now')),
+    user_id         TEXT,
+    body_encrypted  BLOB,
+    title_encrypted BLOB,
+    meta_encrypted  BLOB,
+    iv              BLOB
   );
 
   CREATE INDEX IF NOT EXISTS idx_vault_kind ON vault(kind);
   CREATE INDEX IF NOT EXISTS idx_vault_category ON vault(category);
   CREATE INDEX IF NOT EXISTS idx_vault_category_created ON vault(category, created_at DESC);
-  CREATE UNIQUE INDEX IF NOT EXISTS idx_vault_identity ON vault(kind, identity_key) WHERE identity_key IS NOT NULL;
+  CREATE INDEX IF NOT EXISTS idx_vault_user ON vault(user_id);
+  CREATE UNIQUE INDEX IF NOT EXISTS idx_vault_identity ON vault(user_id, kind, identity_key) WHERE identity_key IS NOT NULL;
 
   -- Single FTS5 table
   CREATE VIRTUAL TABLE IF NOT EXISTS vault_fts USING fts5(
@@ -57,34 +126,15 @@ export const SCHEMA_DDL = `
 
 // ─── Database Init ───────────────────────────────────────────────────────────
 
-export function initDatabase(dbPath) {
-  const db = new Database(dbPath);
-  db.pragma("journal_mode = WAL");
-  db.pragma("foreign_keys = ON");
-  try {
-    sqliteVec.load(db);
-  } catch (e) {
-    console.error(`[context-mcp] Failed to load sqlite-vec native module.`);
-    console.error(`[context-mcp] This usually means prebuilt binaries aren't available for your platform.`);
-    console.error(`[context-mcp] Try: npm rebuild sqlite-vec`);
-    console.error(`[context-mcp] Error: ${e.message}`);
-    throw e;
-  }
-
-  const version = db.pragma("user_version", { simple: true });
+export async function initDatabase(dbPath) {
+  const { Database, sqliteVec } = await loadNativeModules();
 
-  // Enforce fresh-DB-only — old schemas get a full rebuild
-  if (version > 0 && version < 5) {
-    console.error(`[context-mcp] Schema v${version} is outdated. Rebuilding database...`);
-    db.close();
-    unlinkSync(dbPath);
-    try { unlinkSync(dbPath + "-wal"); } catch {}
-    try { unlinkSync(dbPath + "-shm"); } catch {}
-    const freshDb = new Database(dbPath);
-    freshDb.pragma("journal_mode = WAL");
-    freshDb.pragma("foreign_keys = ON");
+  function createDb(path) {
+    const db = new Database(path);
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
     try {
-      sqliteVec.load(freshDb);
+      sqliteVec.load(db);
     } catch (e) {
       console.error(`[context-mcp] Failed to load sqlite-vec native module.`);
       console.error(`[context-mcp] This usually means prebuilt binaries aren't available for your platform.`);
@@ -92,14 +142,61 @@ export function initDatabase(dbPath) {
       console.error(`[context-mcp] Error: ${e.message}`);
       throw e;
     }
+    return db;
+  }
+
+  const db = createDb(dbPath);
+  const version = db.pragma("user_version", { simple: true });
+
+  // Enforce fresh-DB-only — old schemas get a full rebuild (with backup)
+  if (version > 0 && version < 5) {
+    console.error(`[context-mcp] Schema v${version} is outdated. Rebuilding database...`);
+
+    // Backup old DB before destroying it
+    const backupPath = `${dbPath}.v${version}.backup`;
+    try {
+      db.close();
+      if (existsSync(dbPath)) {
+        copyFileSync(dbPath, backupPath);
+        console.error(`[context-mcp] Backed up old database to: ${backupPath}`);
+      }
+    } catch (backupErr) {
+      console.error(`[context-mcp] Warning: could not backup old database: ${backupErr.message}`);
+    }
+
+    unlinkSync(dbPath);
+    try { unlinkSync(dbPath + "-wal"); } catch {}
+    try { unlinkSync(dbPath + "-shm"); } catch {}
+
+    const freshDb = createDb(dbPath);
     freshDb.exec(SCHEMA_DDL);
-    freshDb.pragma("user_version = 5");
+    freshDb.pragma("user_version = 6");
     return freshDb;
   }
 
   if (version < 5) {
     db.exec(SCHEMA_DDL);
-    db.pragma("user_version = 5");
+    db.pragma("user_version = 6");
+  } else if (version === 5) {
+    // v5 -> v6 migration: add multi-tenancy + encryption columns
+    // Wrapped in transaction with duplicate-column guards for idempotent retry
+    const migrate = db.transaction(() => {
+      const addColumnSafe = (sql) => {
+        try { db.exec(sql); } catch (e) {
+          if (!e.message.includes("duplicate column")) throw e;
+        }
+      };
+      addColumnSafe(`ALTER TABLE vault ADD COLUMN user_id TEXT`);
+      addColumnSafe(`ALTER TABLE vault ADD COLUMN body_encrypted BLOB`);
+      addColumnSafe(`ALTER TABLE vault ADD COLUMN title_encrypted BLOB`);
+      addColumnSafe(`ALTER TABLE vault ADD COLUMN meta_encrypted BLOB`);
+      addColumnSafe(`ALTER TABLE vault ADD COLUMN iv BLOB`);
+      db.exec(`CREATE INDEX IF NOT EXISTS idx_vault_user ON vault(user_id)`);
+      db.exec(`DROP INDEX IF EXISTS idx_vault_identity`);
+      db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_vault_identity ON vault(user_id, kind, identity_key) WHERE identity_key IS NOT NULL`);
+      db.pragma("user_version = 6");
+    });
+    migrate();
   }
 
   return db;
@@ -108,18 +205,27 @@ export function initDatabase(dbPath) {
 // ─── Prepared Statements Factory ─────────────────────────────────────────────
 
 export function prepareStatements(db) {
-  return {
-    insertEntry: db.prepare(`INSERT INTO vault (id, kind, category, title, body, meta, tags, source, file_path, identity_key, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
-    updateEntry: db.prepare(`UPDATE vault SET title = ?, body = ?, meta = ?, tags = ?, source = ?, category = ?, identity_key = ?, expires_at = ? WHERE file_path = ?`),
-    deleteEntry: db.prepare(`DELETE FROM vault WHERE id = ?`),
-    getRowid: db.prepare(`SELECT rowid FROM vault WHERE id = ?`),
-    getRowidByPath: db.prepare(`SELECT rowid FROM vault WHERE file_path = ?`),
-    getEntryById: db.prepare(`SELECT * FROM vault WHERE id = ?`),
-    getByIdentityKey: db.prepare(`SELECT * FROM vault WHERE kind = ? AND identity_key = ?`),
-    upsertByIdentityKey: db.prepare(`UPDATE vault SET title = ?, body = ?, meta = ?, tags = ?, source = ?, category = ?, file_path = ?, expires_at = ? WHERE kind = ? AND identity_key = ?`),
-    insertVecStmt: db.prepare(`INSERT INTO vault_vec (rowid, embedding) VALUES (?, ?)`),
-    deleteVecStmt: db.prepare(`DELETE FROM vault_vec WHERE rowid = ?`),
-  };
+  try {
+    return {
+      insertEntry: db.prepare(`INSERT INTO vault (id, user_id, kind, category, title, body, meta, tags, source, file_path, identity_key, expires_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+      insertEntryEncrypted: db.prepare(`INSERT INTO vault (id, user_id, kind, category, title, body, meta, tags, source, file_path, identity_key, expires_at, created_at, body_encrypted, title_encrypted, meta_encrypted, iv) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`),
+      updateEntry: db.prepare(`UPDATE vault SET title = ?, body = ?, meta = ?, tags = ?, source = ?, category = ?, identity_key = ?, expires_at = ? WHERE file_path = ?`),
+      deleteEntry: db.prepare(`DELETE FROM vault WHERE id = ?`),
+      getRowid: db.prepare(`SELECT rowid FROM vault WHERE id = ?`),
+      getRowidByPath: db.prepare(`SELECT rowid FROM vault WHERE file_path = ?`),
+      getEntryById: db.prepare(`SELECT * FROM vault WHERE id = ?`),
+      getByIdentityKey: db.prepare(`SELECT * FROM vault WHERE kind = ? AND identity_key = ? AND user_id IS ?`),
+      upsertByIdentityKey: db.prepare(`UPDATE vault SET title = ?, body = ?, meta = ?, tags = ?, source = ?, category = ?, file_path = ?, expires_at = ? WHERE kind = ? AND identity_key = ? AND user_id IS ?`),
+      insertVecStmt: db.prepare(`INSERT INTO vault_vec (rowid, embedding) VALUES (?, ?)`),
+      deleteVecStmt: db.prepare(`DELETE FROM vault_vec WHERE rowid = ?`),
+    };
+  } catch (e) {
+    throw new Error(
+      `Failed to prepare database statements. The database may be corrupted.\n` +
+      `Try deleting and rebuilding: rm "${db.name}" && context-mcp reindex\n` +
+      `Original error: ${e.message}`
+    );
+  }
 }
 
 // ─── Vector Helpers (parameterized rowid via cached statements) ──────────────