negotium 0.1.49 → 0.2.1

package/dist/main.js

@@ -168,7 +168,7 @@ function resolveBrowserRsBin(envValue) {
   if (!override && !versionAtLeast(BROWSER_RS_VERSION.replace(/^v/, ""), BROWSER_RS_MIN_SECURE_VERSION)) {
     return;
   }
-  const candidate = override ? resolve(override) : resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  const candidate = override ? resolve(override) : resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
   try {
     accessSync(candidate, constants.X_OK);
     return browserRsMeetsMinimumVersion(candidate) ? candidate : undefined;
@@ -180,7 +180,7 @@ function resolveBrowserMcpBin(envValue) {
   const override = envValue?.trim();
   if (override)
     return resolve(override);
-  return BROWSER_RS_BIN ?? resolve(STATE_DIR, "bin", "browser-rs", BROWSER_RS_VERSION, "browser-rs");
+  return BROWSER_RS_BIN ?? resolve(BINARIES_DIR, "browser-rs", BROWSER_RS_VERSION, "browser-rs");
 }
 function resolveBrowserProxy() {
   const raw = envText("BROWSER_PROXY_URL");
@@ -212,7 +212,7 @@ function resolveTopicWorkspaceDir(topicId) {
 }
 function loadOrCreateLocalSecret(envKey, filename, options = {}) {
   const envValue = envText(envKey);
-  const secretFile = resolve(STATE_DIR, filename);
+  const secretFile = resolve(SECRETS_DIR, filename);
   mkdirSync(dirname(secretFile), { recursive: true });
   if (envValue) {
     if (options.persistEnvValue) {
@@ -253,7 +253,7 @@ function resolveDefaultModel(agent, registryDefaultModel) {
 function codexAuthFilePath() {
   return process.env.NEGOTIUM_CODEX_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 }
-var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CONTEXTS_DIR, BROWSER_PROFILES_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.16", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
+var HOME, PROJECT_ROOT, STATE_DIR_ENV, STATE_DIR, WORKSPACE_DIR, TOPIC_WORKSPACE_DIR, SHARED_WIKI_DIR, CRON_WORKSPACE_DIR, BROWSER_DIR, BROWSER_PROFILES_DIR, BINARIES_DIR, SECRETS_DIR, CONTEXTS_DIR, DM_WORKSPACE_DIR, SESSION_WORKSPACE_DIR, CLAUDE_EXECUTABLE_ENV, CLAUDE_EXECUTABLE, DEFAULT_OUTPUT_LANGUAGE = "English", BROWSER_RS_VERSION = "v0.1.16", BROWSER_RS_MIN_SECURE_VERSION = "0.1.15", BROWSER_RS_BIN, PLAYWRIGHT_MCP_BIN, TSX_BIN, TSX_LOADER, TSCONFIG_PATH, SESSION_COMM_SERVER, TASK_SERVER, BROWSER_MCP_SSE_PROXY_SERVER, CANONICAL_MCP_PROXY_SERVER, WIKI_SERVER, TOKEN_STATS_SERVER, COMPACTION_LOG_SERVER, SYSTEM_HEALTH_SERVER, AGENT_HEALTH_SERVER, BACKGROUND_BASH_SERVER, VAULT_SERVER, BG_BASH_BASE_PORT, BG_BASH_MAX_PORT, RUNTIME_MCP_SECRET, NODE_CONTROL_TOKEN, VAULT_MASTER_KEY, NEGOTIUM_PORT, hostname, DATA_DIR, LOG_DIR, UPLOADS_DIR, VAULT_DIR, SESSIONS_DB, DEBUG_FILE, USERS_LOG_DIR, RUN_DIR, PROGRESS_DIR, DM_CMD_DIR, DM_RESP_DIR, SESSION_INBOX_DIR, SESSION_ASKS_DIR, PLAYWRIGHT_BASE_PORT, PLAYWRIGHT_MAX_PORT, PLAYWRIGHT_PORTS_DIR, ACTIVE_QUERY_STALE_MS, AGENTS_PROMPTS_DIR, RESOURCES_DIR, FILE_TAG_REGEX, MODEL_SONNET = "claude-sonnet-5", MODEL_OPUS = "claude-opus-5", MODEL_FABLE = "claude-fable-5", FALLBACK_AGENT, SESSION_AGENT, GATEWAY_AGENT, FALLBACK_MODEL, SESSION_MODEL, GATEWAY_MODEL, FFMPEG_BIN, FFPROBE_BIN, PYTHON_BIN, FASTER_WHISPER_WRAPPER, WHISPER_MODEL, TESSERACT_BIN, PDFTOTEXT_BIN, _envMaxTellDepth, MAX_TELL_DEPTH;
 var init_config = __esm(() => {
   init_config_helpers();
   init_logger();
@@ -265,10 +265,14 @@ var init_config = __esm(() => {
   WORKSPACE_DIR = resolveLocalStateDir("NEGOTIUM_WORKSPACE_DIR", "workspace");
   TOPIC_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "topics");
   SHARED_WIKI_DIR = resolve(WORKSPACE_DIR, "wiki");
-  CONTEXTS_DIR = resolve(WORKSPACE_DIR, "contexts");
-  BROWSER_PROFILES_DIR = resolve(WORKSPACE_DIR, "browser-profiles");
-  DM_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "dm");
-  SESSION_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "sessions");
+  CRON_WORKSPACE_DIR = resolve(WORKSPACE_DIR, "cron");
+  BROWSER_DIR = resolveLocalStateDir("NEGOTIUM_BROWSER_DIR", "browser");
+  BROWSER_PROFILES_DIR = resolve(BROWSER_DIR, "profiles");
+  BINARIES_DIR = resolve(STATE_DIR, "binaries");
+  SECRETS_DIR = resolve(STATE_DIR, "secrets");
+  CONTEXTS_DIR = resolve(STATE_DIR, "data", "contexts");
+  DM_WORKSPACE_DIR = resolve(STATE_DIR, "data", "dm");
+  SESSION_WORKSPACE_DIR = resolve(STATE_DIR, "data", "sessions");
   CLAUDE_EXECUTABLE_ENV = envText("NEGOTIUM_CLAUDE_EXECUTABLE");
   CLAUDE_EXECUTABLE = CLAUDE_EXECUTABLE_ENV ? resolve(CLAUDE_EXECUTABLE_ENV) : undefined;
   BROWSER_RS_BIN = resolveBrowserRsBin(envText("NEGOTIUM_BROWSER_RS_BIN"));
@@ -297,10 +301,12 @@ var init_config = __esm(() => {
   hostname = process.env.HOSTNAME || "127.0.0.1";
   DATA_DIR = resolveLocalStateDir("NEGOTIUM_DATA_DIR", "data");
   LOG_DIR = resolveLocalStateDir("NEGOTIUM_LOG_DIR", "logs");
+  UPLOADS_DIR = resolve(DATA_DIR, "uploads");
+  VAULT_DIR = resolve(DATA_DIR, "vault");
   SESSIONS_DB = process.env.SESSIONS_DB_PATH ? resolve(process.env.SESSIONS_DB_PATH) : resolve(DATA_DIR, "sessions.db");
   DEBUG_FILE = resolve(DATA_DIR, "debug-users.json");
   USERS_LOG_DIR = resolve(DATA_DIR, "users");
-  RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "run");
+  RUN_DIR = resolveLocalStateDir("NEGOTIUM_RUN_DIR", "runtime");
   PROGRESS_DIR = resolve(RUN_DIR, "progress");
   DM_CMD_DIR = resolve(RUN_DIR, "dm-commands");
   DM_RESP_DIR = resolve(RUN_DIR, "dm-responses");
@@ -311,6 +317,8 @@ var init_config = __esm(() => {
   PLAYWRIGHT_PORTS_DIR = resolve(RUN_DIR, "playwright-ports");
   mkdirSync(STATE_DIR, { recursive: true });
   mkdirSync(DATA_DIR, { recursive: true });
+  mkdirSync(UPLOADS_DIR, { recursive: true });
+  mkdirSync(VAULT_DIR, { recursive: true, mode: 448 });
   mkdirSync(LOG_DIR, { recursive: true });
   mkdirSync(PROGRESS_DIR, { recursive: true });
   mkdirSync(DM_CMD_DIR, { recursive: true });
@@ -321,10 +329,14 @@ var init_config = __esm(() => {
   mkdirSync(WORKSPACE_DIR, { recursive: true });
   mkdirSync(TOPIC_WORKSPACE_DIR, { recursive: true });
   mkdirSync(SHARED_WIKI_DIR, { recursive: true });
+  mkdirSync(CRON_WORKSPACE_DIR, { recursive: true });
   mkdirSync(CONTEXTS_DIR, { recursive: true });
-  mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
   mkdirSync(DM_WORKSPACE_DIR, { recursive: true });
   mkdirSync(SESSION_WORKSPACE_DIR, { recursive: true });
+  mkdirSync(BROWSER_DIR, { recursive: true });
+  mkdirSync(BROWSER_PROFILES_DIR, { recursive: true });
+  mkdirSync(BINARIES_DIR, { recursive: true });
+  mkdirSync(SECRETS_DIR, { recursive: true, mode: 448 });
   ACTIVE_QUERY_STALE_MS = 10 * 60 * 1000;
   AGENTS_PROMPTS_DIR = resolve(PROJECT_ROOT, "src/prompts/agents");
   RESOURCES_DIR = resolve(PROJECT_ROOT, "src/resources");
@@ -399,9 +411,9 @@ var init_sqlite = __esm(async () => {
   }
 });
 
-// ../../packages/core/src/storage/vault-crypto.ts
+// ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes2 } from "crypto";
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+function encryptionKey(masterKey) {
   return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
 }
 function aad(userId, key) {
@@ -410,7 +422,7 @@ function aad(userId, key) {
 function isEncryptedVaultValue(value) {
   return value.startsWith(ENVELOPE_PREFIX);
 }
-function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+function encryptVaultValueWithKey(userId, key, value, masterKey) {
   const iv = randomBytes2(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
   cipher.setAAD(aad(userId, key));
@@ -418,7 +430,7 @@ function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
   const tag = cipher.getAuthTag();
   return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
 }
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
   if (!isEncryptedVaultValue(storedValue)) {
     return { value: storedValue, legacyPlaintext: true };
   }
@@ -440,8 +452,18 @@ function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KE
   return { value: plaintext.toString("utf8"), legacyPlaintext: false };
 }
 var ENVELOPE_PREFIX = "otium-vault:v1:", IV_BYTES = 12, KEY_BYTES = 32;
+var init_vault_crypto_core = () => {};
+
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
 var init_vault_crypto = __esm(() => {
   init_config();
+  init_vault_crypto_core();
 });
 
 // ../../packages/core/src/storage/vault.ts
@@ -481,8 +503,9 @@ function initializeVaultDatabase(database) {
   }
 }
 function openVaultDatabase(dataDir) {
-  const path = join2(dataDir, "vault.db");
-  mkdirSync2(dataDir, { recursive: true });
+  const vaultDir = join2(dataDir, "vault");
+  const path = join2(vaultDir, "vault.db");
+  mkdirSync2(vaultDir, { recursive: true, mode: 448 });
   const database = new Database(path, { create: true });
   chmodSync2(path, 384);
   initializeVaultDatabase(database);
@@ -1119,7 +1142,12 @@ var init_shared = __esm(() => {
   init_config();
   init_logger();
   __dirname2 = dirname2(fileURLToPath2(import.meta.url));
-  trustedWorkspaceRoots = [WORKSPACE_DIR, DM_WORKSPACE_DIR, TOPIC_WORKSPACE_DIR].map((root) => resolve2(root));
+  trustedWorkspaceRoots = [
+    WORKSPACE_DIR,
+    DM_WORKSPACE_DIR,
+    SESSION_WORKSPACE_DIR,
+    TOPIC_WORKSPACE_DIR
+  ].map((root) => resolve2(root));
   FIXTURES_DIR = join4(__dirname2, "..", "fixtures");
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 });
@@ -2029,7 +2057,7 @@ function defaultWorkspaceDir() {
   return envPath("NEGOTIUM_WORKSPACE_DIR", join8(defaultStateDir(), "workspace"));
 }
 function defaultSessionAsksDir() {
-  const runDir = envPath("NEGOTIUM_RUN_DIR", join8(defaultStateDir(), "run"));
+  const runDir = envPath("NEGOTIUM_RUN_DIR", join8(defaultStateDir(), "runtime"));
   return join8(runDir, "session-asks");
 }
 function defaultSessionsDatabasePath() {
@@ -2210,15 +2238,8 @@ import {
   writeFileSync as writeFileSync4
 } from "fs";
 import { dirname as dirname6, join as join9 } from "path";
-function safeUserIdComponent(userId) {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`conversations: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
-function conversationDir(userId) {
-  return join9(resolveStorageDataDir(), "conversations", safeUserIdComponent(userId));
+function conversationDir(_userId) {
+  return join9(resolveStorageDataDir(), "conversations");
 }
 function topicFilename(topicName) {
   const t = sanitizeTopicName(topicName, true);
@@ -2500,7 +2521,7 @@ function writeRollout(options) {
         version: 1,
         cwd: options.cwd,
         createdAt: existingCreatedAt(path) ?? new Date().toISOString(),
-        sdkVersion: "0.1.53"
+        sdkVersion: "0.1.54"
       }
     },
     ...messages
@@ -2677,13 +2698,6 @@ __export(exports_tasks, {
 });
 import { existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync7, renameSync as renameSync4, statSync as statSync3, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname7, join as join12 } from "path";
-function safeUserIdComponent2(userId) {
-  const str = String(userId);
-  if (!str || /[/\\]|\.\./.test(str)) {
-    throw new Error(`tasks: refusing unsafe userId path component: ${str}`);
-  }
-  return str;
-}
 function safeTaskScopeKey(scopeKey) {
   const safe = sanitizeFileName(scopeKey);
   if (!safe || safe === "." || safe === "..") {
@@ -2695,7 +2709,7 @@ function taskScopeKey(opts) {
   return opts.topicId?.trim() || opts.session || "default";
 }
 function getTaskFilePath(userId, scopeKey) {
-  return join12(resolveStorageDataDir(), "tasks", safeUserIdComponent2(userId), `${safeTaskScopeKey(scopeKey)}.json`);
+  return join12(resolveStorageDataDir(), "tasks", `${safeTaskScopeKey(scopeKey)}.json`);
 }
 function readTasks(userId, scopeKey) {
   const path = getTaskFilePath(userId, scopeKey);
@@ -3680,7 +3694,7 @@ function getMcpServersForQuery(opts) {
     if (!opts.topicId)
       throw new Error("getMcpServersForQuery: cron sessionType requires topicId");
     return getCronMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session || "cron",
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -3697,7 +3711,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "dm" || opts.sessionType === "ephemeral") {
     return getDmMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       agent: opts.agent,
       playwrightPort: opts.playwrightPort,
       playwrightCapability: opts.playwrightCapability
@@ -3705,7 +3719,7 @@ function getMcpServersForQuery(opts) {
   }
   if (opts.sessionType === "manager") {
     return getManagerMcpServers({
-      userId: opts.userId || "default",
+      userId: opts.userId || "local",
       session: opts.session,
       topicId: opts.topicId,
       queryId: opts.queryId,
@@ -3722,7 +3736,7 @@ function getMcpServersForQuery(opts) {
     });
   }
   return getForumMcpServers({
-    userId: opts.userId || "default",
+    userId: opts.userId || "local",
     session: opts.session || "default",
     topicId: opts.topicId,
     subagentParentTopicId: opts.subagentParentTopicId,
@@ -4580,7 +4594,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.1.49";
+var NEGOTIUM_VERSION = "0.2.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn3 } from "child_process";
@@ -9730,7 +9744,7 @@ function createBrowserProfile(ownerId, rawName) {
   const name = normalizeBrowserProfileName(rawName);
   if (name === DEFAULT_BROWSER_PROFILE)
     return name;
-  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run(ownerId, name, new Date().toISOString());
+  db.query("INSERT OR IGNORE INTO browser_profiles (owner_id, name, created_at) VALUES (?, ?, ?)").run("local", name, new Date().toISOString());
   return name;
 }
 function assignTopicBrowserProfile(opts) {
@@ -9750,10 +9764,9 @@ function assignTopicBrowserProfile(opts) {
   return { previous, profile };
 }
 function listBrowserProfiles(ownerId) {
-  const records = db.query("SELECT name, created_at FROM browser_profiles WHERE owner_id = ? ORDER BY name").all(ownerId);
+  const records = db.query("SELECT name, created_at FROM browser_profiles WHERE owner_id = ? ORDER BY name").all("local");
   const topics = db.query(`SELECT t.id, t.title, t.browser_profile FROM api_topics t
-       WHERE t.browser_profile_owner = ?
-       ORDER BY t.title`).all(ownerId);
+       ORDER BY t.title`).all();
   const byName = new Map;
   byName.set(DEFAULT_BROWSER_PROFILE, {
     name: DEFAULT_BROWSER_PROFILE,
@@ -9798,7 +9811,6 @@ import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync10,
   readFileSync as readFileSync12,
-  renameSync as renameSync6,
   rmSync as rmSync2,
   unlinkSync as unlinkSync11,
   writeFileSync as writeFileSync8
@@ -9814,7 +9826,7 @@ function defaultTopicBinding(userId, topic) {
   if (!topic)
     return managerHost.resolveNamedBinding(userId, "default");
   const ownerId = getBrowserProfileOwner(topic, userId);
-  const profile = migrateLegacyTopicProfile(ownerId, topic);
+  const profile = getTopicBrowserProfile(topic);
   return managerHost.resolveNamedBinding(ownerId, profile);
 }
 function resolvePlaywrightProfileBinding(ownerId, rawProfile) {
@@ -9826,34 +9838,15 @@ function validateProfileBinding(binding) {
   }
   return Object.freeze({ ...binding });
 }
-function defaultNamedBinding(ownerId, rawProfile) {
+function defaultNamedBinding(_ownerId, rawProfile) {
   const profile = normalizeBrowserProfileName(rawProfile);
-  const instanceKey = `profile:${encodeURIComponent(ownerId)}:${profile}`;
+  const instanceKey = `profile:${profile}`;
   return {
     instanceKey,
-    ownerId,
+    ownerId: "local",
     profile
   };
 }
-function legacyBrowserProfileName(topic) {
-  return `legacy_${createHash3("sha256").update(topic).digest("hex").slice(0, 12)}`;
-}
-function migrateLegacyTopicProfile(ownerId, topic) {
-  const current2 = getTopicBrowserProfile(topic);
-  if (current2 !== "default" || !hasBrowserProfileTopic(topic))
-    return current2;
-  const legacyDir = resolve12(BROWSER_PROFILES_DIR, sanitizeTopicName(topic));
-  if (!existsSync15(legacyDir))
-    return current2;
-  const profile = legacyBrowserProfileName(topic);
-  const profileDir = defaultProfileDir(ownerId, profile);
-  mkdirSync10(dirname10(profileDir), { recursive: true });
-  if (!existsSync15(profileDir))
-    renameSync6(legacyDir, profileDir);
-  assignTopicBrowserProfile({ topicId: topic, actorUserId: ownerId, profile });
-  logger.info({ ownerId, topic, profile }, "Adopted legacy topic browser profile");
-  return profile;
-}
 function defaultChildEnvironment(context) {
   const childEnvironment = {};
   for (const key of [
@@ -9884,6 +9877,10 @@ function defaultChildEnvironment(context) {
   return childEnvironment;
 }
 function parseInstanceKey(instanceKey) {
+  const shared = /^profile:(.+)$/.exec(instanceKey);
+  if (shared && !shared[1].includes(":")) {
+    return { ownerId: "local", profile: normalizeBrowserProfileName(shared[1]) };
+  }
   const match = /^profile:([^:]+):(.+)$/.exec(instanceKey);
   if (!match)
     return { ownerId: "legacy", profile: sanitizeTopicName(instanceKey) };
@@ -10026,12 +10023,8 @@ async function allocatePort() {
 function releasePort(port) {
   usedPorts.delete(port);
 }
-function ownerDirectory(ownerId) {
-  const digest = createHash3("sha256").update(ownerId).digest("hex").slice(0, 16);
-  return `${sanitizeTopicName(ownerId).slice(0, 24)}_${digest}`;
-}
-function defaultProfileDir(ownerId, profile) {
-  return resolve12(BROWSER_PROFILES_DIR, "profiles", ownerDirectory(ownerId), profile);
+function defaultProfileDir(_ownerId, profile) {
+  return resolve12(BROWSER_PROFILES_DIR, profile);
 }
 function resolveUserDataDir(instanceKey) {
   return managerHost.resolveInstanceDataDir(instanceKey);
@@ -12440,7 +12433,7 @@ var init_idle_archiver = __esm(async () => {
 });
 
 // ../../packages/core/src/agents/topic-cleanup.ts
-import { mkdirSync as mkdirSync12, renameSync as renameSync7, unlinkSync as unlinkSync12, writeFileSync as writeFileSync10 } from "fs";
+import { mkdirSync as mkdirSync12, renameSync as renameSync6, unlinkSync as unlinkSync12, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname12 } from "path";
 function collectSessionIdsByAgent(entries, extraSessions = []) {
   const out = new Map;
@@ -12511,7 +12504,7 @@ function createTopicLogMaintenance(host) {
         writeFileSync10(tempPath, retained.length > 0 ? `${retained.map((entry) => JSON.stringify(entry)).join(`
 `)}
 ` : "", { flag: "wx" });
-        renameSync7(tempPath, path);
+        renameSync6(tempPath, path);
       } catch (e) {
         try {
           unlinkSync12(tempPath);
@@ -14767,7 +14760,7 @@ var init_session_inbox_cleanup = __esm(() => {
 });
 
 // ../../packages/core/src/query/state.ts
-import { mkdirSync as mkdirSync14, renameSync as renameSync8, unlinkSync as unlinkSync15, writeFileSync as writeFileSync12 } from "fs";
+import { mkdirSync as mkdirSync14, renameSync as renameSync7, unlinkSync as unlinkSync15, writeFileSync as writeFileSync12 } from "fs";
 import { basename as basename4, join as join24 } from "path";
 function createQueryStateStore(options) {
   const sanitize = options.sanitizeTopicId ?? sanitizeId;
@@ -14789,7 +14782,7 @@ function createQueryStateStore(options) {
       const target = queryStateFile(userId, topicId);
       const tmp = `${target}.${process.pid}.${Date.now()}.tmp`;
       writeFileSync12(tmp, JSON.stringify(state));
-      renameSync8(tmp, target);
+      renameSync7(tmp, target);
     },
     clear(userId, topicId, legacyTopicName) {
       const paths = [
@@ -15943,7 +15936,7 @@ function promptWithAttachments(prompt, attachments) {
   return composeAttachmentPrompt(prompt, attachments.map(({ filename, path }) => attachmentPromptLine(filename, path)));
 }
 function ingestAttachment(args) {
-  const destDir = join26(workspaceCwdFor(args.topicId), "uploads");
+  const destDir = join26(UPLOADS_DIR, args.topicId);
   mkdirSync16(destDir, { recursive: true });
   const safeName = safeAttachmentFilename(args.filename, "upload");
   const destPath = join26(destDir, `${Date.now()}-${randomUUID15().slice(0, 8)}-${safeName}`);
@@ -20616,7 +20609,7 @@ function renderTurnFooter(msg) {
 
 // ../../packages/core/src/outbox/file-ops.ts
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import { appendFileSync as appendFileSync2, existsSync as existsSync21, readFileSync as readFileSync18, renameSync as renameSync9, unlinkSync as unlinkSync17 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync21, readFileSync as readFileSync18, renameSync as renameSync8, unlinkSync as unlinkSync17 } from "fs";
 function host() {
   return hostContext.getStore() ?? defaultHost2;
 }
@@ -20657,7 +20650,7 @@ function drainOutboxFile(filePath, label) {
   if (!existsSync21(filePath))
     return null;
   try {
-    renameSync9(filePath, processingPath);
+    renameSync8(filePath, processingPath);
   } catch (e) {
     host().logger.warn({ err: e, filePath }, `${label}: failed to rename for processing`);
     return null;
@@ -23678,7 +23671,7 @@ import {
   openSync as openSync3,
   readdirSync as readdirSync9,
   readFileSync as readFileSync20,
-  renameSync as renameSync10,
+  renameSync as renameSync9,
   statSync as statSync12,
   unlinkSync as unlinkSync18,
   writeFileSync as writeFileSync17
@@ -23798,7 +23791,7 @@ function atomicWriteFile(path, content) {
   const temporaryPath = `${path}.tmp.${process.pid}.${Date.now()}`;
   writeFileSync17(temporaryPath, content, "utf-8");
   try {
-    renameSync10(temporaryPath, path);
+    renameSync9(temporaryPath, path);
   } catch (error2) {
     try {
       unlinkSync18(temporaryPath);
@@ -24531,7 +24524,7 @@ import {
   existsSync as existsSync25,
   mkdirSync as mkdirSync25,
   readdirSync as readdirSync10,
-  renameSync as renameSync11,
+  renameSync as renameSync10,
   statSync as statSync13,
   unlinkSync as unlinkSync19,
   writeFileSync as writeFileSync18
@@ -24555,7 +24548,7 @@ function writeLog(entry) {
     const stat = statSync13(file);
     if (stat.size >= MAX_FILE_SIZE) {
       const rotated = file.replace(/\.jsonl$/, `.${Date.now()}.jsonl`);
-      renameSync11(file, rotated);
+      renameSync10(file, rotated);
     }
   } catch {}
   try {
@@ -26143,7 +26136,7 @@ var init_spec = __esm(() => {
 });
 
 // ../../packages/mcp-host/src/manifest.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync26, readFileSync as readFileSync21, renameSync as renameSync12, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync26, readFileSync as readFileSync21, renameSync as renameSync11, writeFileSync as writeFileSync19 } from "fs";
 import { dirname as dirname17 } from "path";
 import { z as z13 } from "zod";
 
@@ -26212,7 +26205,7 @@ class McpManifest {
     const tmp = `${this.file}.tmp-${process.pid}`;
     writeFileSync19(tmp, `${JSON.stringify(payload, null, 2)}
 `);
-    renameSync12(tmp, this.file);
+    renameSync11(tmp, this.file);
   }
 }
 var manifestEntrySchema, manifestFileSchema;
@@ -26243,7 +26236,7 @@ import {
   mkdirSync as mkdirSync27,
   readdirSync as readdirSync11,
   readFileSync as readFileSync22,
-  renameSync as renameSync13,
+  renameSync as renameSync12,
   unlinkSync as unlinkSync20,
   writeFileSync as writeFileSync20
 } from "fs";
@@ -26563,7 +26556,7 @@ class McpHost {
       const file = join37(this.portsDir, fileName);
       const tmp = `${file}.tmp-${process.pid}`;
       writeFileSync20(tmp, String(port));
-      renameSync13(tmp, file);
+      renameSync12(tmp, file);
     } catch (e) {
       this.log("warn", "Failed to write MCP port file", { fileName, port, err: String(e) });
     }
@@ -26961,7 +26954,7 @@ import {
   existsSync as existsSync28,
   mkdirSync as mkdirSync29,
   readFileSync as readFileSync24,
-  renameSync as renameSync14,
+  renameSync as renameSync13,
   unlinkSync as unlinkSync21,
   writeFileSync as writeFileSync22
 } from "fs";
@@ -27456,7 +27449,7 @@ function writeNodeDaemonInfo(port, startedAt) {
   writeFileSync22(temporary, `${JSON.stringify(info, null, 2)}
 `, { mode: 384 });
   chmodSync5(temporary, 384);
-  renameSync14(temporary, NODE_DAEMON_INFO_PATH);
+  renameSync13(temporary, NODE_DAEMON_INFO_PATH);
   chmodSync5(NODE_DAEMON_INFO_PATH, 384);
   return info;
 }
@@ -38926,7 +38919,7 @@ import {
   mkdirSync as mkdirSync32,
   openSync as openSync4,
   readFileSync as readFileSync25,
-  renameSync as renameSync15,
+  renameSync as renameSync14,
   rmSync as rmSync9,
   statSync as statSync17,
   unlinkSync as unlinkSync22,
@@ -39047,7 +39040,7 @@ function withJoinCredentialLock(operation) {
       }
       const stalePath = `${lockPath}.stale.${process.pid}.${randomUUID28()}`;
       try {
-        renameSync15(lockPath, stalePath);
+        renameSync14(lockPath, stalePath);
         rmSync9(stalePath, { recursive: true, force: true });
       } catch (staleError) {
         if (staleError.code !== "ENOENT")
@@ -39145,7 +39138,7 @@ function saveJoinWhileLocked(join41, options = {}) {
     closeSync4(fd);
     fd = undefined;
     if (options.replaceExisting) {
-      renameSync15(temporaryPath, path);
+      renameSync14(temporaryPath, path);
     } else {
       linkSync(temporaryPath, path);
       unlinkSync22(temporaryPath);
@@ -41931,7 +41924,7 @@ import {
   mkdirSync as mkdirSync34,
   openSync as openSync5,
   readFileSync as readFileSync26,
-  renameSync as renameSync16,
+  renameSync as renameSync15,
   unlinkSync as unlinkSync23,
   writeFileSync as writeFileSync24
 } from "fs";
@@ -42030,7 +42023,7 @@ function replacePendingEnrollment(pending2) {
     fsyncSync3(fd);
     closeSync5(fd);
     fd = undefined;
-    renameSync16(temporaryPath, path);
+    renameSync15(temporaryPath, path);
     const directoryFd = openSync5(directory, "r");
     try {
       fsyncSync3(directoryFd);
@@ -43657,6 +43650,476 @@ var init_init = __esm(async () => {
   await init_src();
 });
 
+// ../../packages/core/src/migration/single-user.ts
+import { createHash as createHash11, randomUUID as randomUUID34 } from "crypto";
+import {
+  chmodSync as chmodSync8,
+  copyFileSync as copyFileSync6,
+  existsSync as existsSync36,
+  mkdirSync as mkdirSync35,
+  readdirSync as readdirSync14,
+  readFileSync as readFileSync27,
+  renameSync as renameSync16,
+  rmSync as rmSync11,
+  statSync as statSync19,
+  writeFileSync as writeFileSync25
+} from "fs";
+import { homedir as homedir12 } from "os";
+import { basename as basename14, dirname as dirname23, join as join42, resolve as resolve25 } from "path";
+function entries(path) {
+  return existsSync36(path) && statSync19(path).isDirectory() ? readdirSync14(path) : [];
+}
+function processIsAlive2(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error2) {
+    return error2.code === "EPERM";
+  }
+}
+function assertNoActiveNode(stateDir2) {
+  for (const runtimeName of ["run", "runtime"]) {
+    const infoPath = join42(stateDir2, runtimeName, "node-daemon.json");
+    if (!existsSync36(infoPath))
+      continue;
+    try {
+      const value = JSON.parse(readFileSync27(infoPath, "utf8"));
+      if (typeof value.pid === "number" && processIsAlive2(value.pid)) {
+        throw new Error(`Refusing migration while Negotium pid ${value.pid} is active.`);
+      }
+    } catch (error2) {
+      if (error2 instanceof SyntaxError) {
+        throw new Error(`Refusing migration: unreadable process metadata at ${infoPath}.`);
+      }
+      throw error2;
+    }
+  }
+  const dbPath = join42(stateDir2, "data", "sessions.db");
+  if (!existsSync36(dbPath))
+    return;
+  const database = new Database(dbPath, { readonly: true });
+  try {
+    const hasLeases = database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='runtime_process_leases'").get();
+    if (!hasLeases)
+      return;
+    const leases = database.query("SELECT role, pid FROM runtime_process_leases").all();
+    const active2 = leases.find((lease) => processIsAlive2(lease.pid));
+    if (active2)
+      throw new Error(`Refusing migration while ${active2.role} pid ${active2.pid} is active.`);
+  } finally {
+    database.close();
+  }
+}
+function oldOwnerDirectory(ownerId) {
+  const digest = createHash11("sha256").update(ownerId).digest("hex").slice(0, 16);
+  return `${sanitizeTopicName(ownerId).slice(0, 24)}_${digest}`;
+}
+function addDirectoryContents(operations, sourceDir, destinationDir, stagingDir) {
+  for (const name of entries(sourceDir)) {
+    operations.push({
+      source: join42(sourceDir, name),
+      staged: join42(stagingDir, randomUUID34()),
+      ...destinationDir ? { destination: join42(destinationDir, name) } : {},
+      state: "pending"
+    });
+  }
+}
+function assertNoCollisions(operations) {
+  const destinations = new Set;
+  for (const operation of operations) {
+    if (!operation.destination)
+      continue;
+    if (existsSync36(operation.destination)) {
+      throw new Error(`Migration collision at ${operation.destination}.`);
+    }
+    if (destinations.has(operation.destination)) {
+      throw new Error(`Multiple legacy paths target ${operation.destination}.`);
+    }
+    destinations.add(operation.destination);
+  }
+}
+function writeJournal(path, journal) {
+  writeFileSync25(path, `${JSON.stringify(journal, null, 2)}
+`, { mode: 384 });
+}
+function rollbackFilesystem(journal, journalPath) {
+  for (const operation of [...journal.operations].reverse()) {
+    const current3 = operation.state === "placed" ? operation.destination : operation.staged;
+    if (!current3 || !existsSync36(current3) || existsSync36(operation.source))
+      continue;
+    mkdirSync35(dirname23(operation.source), { recursive: true });
+    renameSync16(current3, operation.source);
+    operation.state = "pending";
+  }
+  journal.phase = "filesystem";
+  writeJournal(journalPath, journal);
+}
+function tablesWithColumn(database, columnName) {
+  const tables = database.query("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+  return tables.map((row) => row.name).filter((table) => database.query(`PRAGMA table_info("${table.replaceAll('"', '""')}")`).all().some((column) => column.name === columnName));
+}
+function selectedTopicIds(dbPath, source) {
+  if (!existsSync36(dbPath))
+    return null;
+  const database = new Database(dbPath, { readonly: true });
+  try {
+    const hasMemberships = database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='topic_members'").get();
+    if (!hasMemberships)
+      return null;
+    return new Set(database.query("SELECT topic_id FROM topic_members WHERE user_id = ?").all(source).map((row) => row.topic_id));
+  } finally {
+    database.close();
+  }
+}
+function migrateDatabase(dbPath, source, masterKey, legacyTopicProfiles = []) {
+  if (!existsSync36(dbPath))
+    return [];
+  const database = new Database(dbPath);
+  const userTables = tablesWithColumn(database, "user_id");
+  const ownerUserTables = tablesWithColumn(database, "owner_user_id");
+  const migratedTables = [...new Set([...userTables, ...ownerUserTables])];
+  const retainedTopicIds = selectedTopicIds(dbPath, source);
+  const quote = (name) => `"${name.replaceAll('"', '""')}"`;
+  try {
+    if (source !== CANONICAL_LOCAL_USER_ID) {
+      for (const [column, tables] of [
+        ["user_id", userTables],
+        ["owner_user_id", ownerUserTables]
+      ]) {
+        for (const table of tables) {
+          const collision = database.query(`SELECT COUNT(*) AS count FROM ${quote(table)} WHERE ${column} = ?`).get(CANONICAL_LOCAL_USER_ID)?.count;
+          if (collision)
+            throw new Error(`Database collision: ${table}.${column} already contains local rows.`);
+        }
+      }
+      const hasUsers = database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='users'").get();
+      if (hasUsers) {
+        const localUser = database.query("SELECT 1 FROM users WHERE id = ?").get(CANONICAL_LOCAL_USER_ID);
+        if (localUser)
+          throw new Error("Database collision: users already contains canonical local.");
+      }
+    }
+    database.exec("PRAGMA foreign_keys = OFF");
+    database.exec("BEGIN IMMEDIATE");
+    for (const table of userTables) {
+      database.query(`DELETE FROM ${quote(table)} WHERE user_id <> ?`).run(source);
+      if (table === "vault" && source !== CANONICAL_LOCAL_USER_ID) {
+        if (!masterKey)
+          throw new Error("Cannot migrate encrypted vault rows without vault-master-key.");
+        const rows = database.query("SELECT key, value FROM vault WHERE user_id = ?").all(source);
+        for (const row of rows) {
+          const plaintext = decryptVaultValueWithKey(source, row.key, row.value, masterKey).value;
+          database.query("UPDATE vault SET value = ? WHERE user_id = ? AND key = ?").run(encryptVaultValueWithKey(CANONICAL_LOCAL_USER_ID, row.key, plaintext, masterKey), source, row.key);
+        }
+      }
+      database.query(`UPDATE ${quote(table)} SET user_id = ? WHERE user_id = ?`).run(CANONICAL_LOCAL_USER_ID, source);
+    }
+    for (const table of ownerUserTables) {
+      database.query(`DELETE FROM ${quote(table)} WHERE owner_user_id <> ?`).run(source);
+      database.query(`UPDATE ${quote(table)} SET owner_user_id = ? WHERE owner_user_id = ?`).run(CANONICAL_LOCAL_USER_ID, source);
+    }
+    if (retainedTopicIds) {
+      database.exec("CREATE TEMP TABLE migration_selected_topics (id TEXT PRIMARY KEY)");
+      for (const topicId of retainedTopicIds) {
+        database.query("INSERT INTO migration_selected_topics (id) VALUES (?)").run(topicId);
+      }
+      const topicTables = database.query("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all().map((row) => row.name).filter((table) => database.query(`PRAGMA table_info(${quote(table)})`).all().some((column) => column.name === "topic_id"));
+      for (const table of topicTables) {
+        database.query(`DELETE FROM ${quote(table)} WHERE topic_id NOT IN (SELECT id FROM migration_selected_topics)`).run();
+      }
+      if (database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='api_topics'").get()) {
+        database.query("DELETE FROM api_topics WHERE id NOT IN (SELECT id FROM migration_selected_topics)").run();
+      }
+    }
+    if (database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='browser_profiles'").get()) {
+      database.query("DELETE FROM browser_profiles WHERE owner_id <> ?").run(source);
+      database.query("UPDATE browser_profiles SET owner_id = ? WHERE owner_id = ?").run(CANONICAL_LOCAL_USER_ID, source);
+    }
+    if (database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='api_topics'").get() && database.query("PRAGMA table_info(api_topics)").all().some((column) => column.name === "browser_profile_owner")) {
+      database.query("UPDATE api_topics SET browser_profile_owner = ? WHERE browser_profile_owner = ?").run(CANONICAL_LOCAL_USER_ID, source);
+      if (retainedTopicIds) {
+        database.query("UPDATE api_topics SET browser_profile_owner = ? WHERE browser_profile_owner IS NOT NULL").run(CANONICAL_LOCAL_USER_ID);
+      } else {
+        database.query("DELETE FROM api_topics WHERE browser_profile_owner IS NOT NULL AND browser_profile_owner <> ?").run(CANONICAL_LOCAL_USER_ID);
+      }
+      for (const binding of legacyTopicProfiles) {
+        database.query("UPDATE api_topics SET browser_profile = ?, browser_profile_owner = ? WHERE id = ?").run(binding.profile, CANONICAL_LOCAL_USER_ID, binding.topicId);
+      }
+    }
+    if (database.query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='users'").get()) {
+      database.query("DELETE FROM users WHERE id <> ?").run(source);
+      database.query("UPDATE users SET id = ? WHERE id = ?").run(CANONICAL_LOCAL_USER_ID, source);
+    }
+    database.exec("COMMIT");
+    database.exec("PRAGMA foreign_keys = ON");
+    const fkErrors = database.query("PRAGMA foreign_key_check").all();
+    if (fkErrors.length > 0)
+      throw new Error("Database migration left foreign-key violations.");
+    return migratedTables;
+  } catch (error2) {
+    try {
+      database.exec("ROLLBACK");
+    } catch {}
+    throw error2;
+  } finally {
+    database.close();
+  }
+}
+function migrateSingleUserState(options) {
+  const stateDir2 = resolve25(options.stateDir ?? process.env.NEGOTIUM_STATE_DIR ?? join42(homedir12(), ".negotium"));
+  const source = options.sourcePrincipal?.trim() || CANONICAL_LOCAL_USER_ID;
+  if (!source || /[/\\]|\.\./.test(source))
+    throw new Error("Invalid source principal.");
+  if (!options.deleteOtherUsers || !options.confirmed) {
+    throw new Error("Migration requires --delete-other-users and --yes; other principals are permanently deleted.");
+  }
+  const markerPath = join42(stateDir2, ".migration-0.2.0-single-user.json");
+  if (existsSync36(markerPath)) {
+    const marker = JSON.parse(readFileSync27(markerPath, "utf8"));
+    if (marker.id !== SINGLE_USER_MIGRATION_ID)
+      throw new Error(`Unexpected migration marker at ${markerPath}.`);
+    return {
+      status: "already-completed",
+      markerPath,
+      sourcePrincipal: marker.sourcePrincipal ?? source,
+      movedPaths: marker.movedPaths ?? 0,
+      deletedPaths: marker.deletedPaths ?? 0,
+      migratedTables: marker.migratedTables ?? []
+    };
+  }
+  assertNoActiveNode(stateDir2);
+  mkdirSync35(stateDir2, { recursive: true });
+  const stagingRoot = join42(stateDir2, ".migration-0.2.0-staging");
+  const journalPath = join42(stagingRoot, "journal.json");
+  mkdirSync35(stagingRoot, { recursive: true, mode: 448 });
+  let journal;
+  if (existsSync36(journalPath)) {
+    journal = JSON.parse(readFileSync27(journalPath, "utf8"));
+    if (journal.sourcePrincipal !== source)
+      throw new Error("Interrupted migration used a different source principal.");
+  } else {
+    const operations = [];
+    const retainedTopicIds = selectedTopicIds(join42(stateDir2, "data", "sessions.db"), source);
+    addDirectoryContents(operations, join42(stateDir2, "run"), join42(stateDir2, "runtime"), stagingRoot);
+    addDirectoryContents(operations, join42(stateDir2, "bin"), join42(stateDir2, "binaries"), stagingRoot);
+    for (const secret of ["node-control-token", "runtime-mcp-secret", "vault-master-key"]) {
+      const sourcePath = join42(stateDir2, secret);
+      if (existsSync36(sourcePath))
+        operations.push({
+          source: sourcePath,
+          staged: join42(stagingRoot, randomUUID34()),
+          destination: join42(stateDir2, "secrets", secret),
+          state: "pending"
+        });
+    }
+    const legacyVaultDb = join42(stateDir2, "data", "vault.db");
+    if (existsSync36(legacyVaultDb)) {
+      operations.push({
+        source: legacyVaultDb,
+        staged: join42(stagingRoot, randomUUID34()),
+        destination: join42(stateDir2, "data", "vault", "vault.db"),
+        state: "pending"
+      });
+    }
+    for (const store of ["conversations", "tasks", "users"]) {
+      const root = join42(stateDir2, "data", store);
+      addDirectoryContents(operations, join42(root, source), root, stagingRoot);
+      for (const owner of entries(root)) {
+        const ownerPath = join42(root, owner);
+        if (owner !== source && statSync19(ownerPath).isDirectory()) {
+          operations.push({
+            source: ownerPath,
+            staged: join42(stagingRoot, randomUUID34()),
+            state: "pending"
+          });
+        }
+      }
+    }
+    for (const legacyWorkspaceDir of ["contexts", "dm", "sessions"]) {
+      addDirectoryContents(operations, join42(stateDir2, "workspace", legacyWorkspaceDir), join42(stateDir2, "data", legacyWorkspaceDir), stagingRoot);
+    }
+    for (const topicId of entries(join42(stateDir2, "workspace", "topics"))) {
+      const topicPath = join42(stateDir2, "workspace", "topics", topicId);
+      if (retainedTopicIds && !retainedTopicIds.has(topicId)) {
+        operations.push({
+          source: topicPath,
+          staged: join42(stagingRoot, randomUUID34()),
+          state: "pending"
+        });
+      } else {
+        addDirectoryContents(operations, join42(topicPath, "uploads"), join42(stateDir2, "data", "uploads", topicId), stagingRoot);
+      }
+    }
+    if (retainedTopicIds) {
+      for (const topicId of entries(join42(stateDir2, "workspace", "wiki"))) {
+        if (retainedTopicIds.has(topicId))
+          continue;
+        operations.push({
+          source: join42(stateDir2, "workspace", "wiki", topicId),
+          staged: join42(stagingRoot, randomUUID34()),
+          state: "pending"
+        });
+      }
+    }
+    const legacyBrowserRoot = join42(stateDir2, "workspace", "browser-profiles");
+    const selectedProfiles = join42(legacyBrowserRoot, "profiles", oldOwnerDirectory(source));
+    addDirectoryContents(operations, selectedProfiles, join42(stateDir2, "browser", "profiles"), stagingRoot);
+    for (const owner of entries(join42(legacyBrowserRoot, "profiles"))) {
+      const ownerPath = join42(legacyBrowserRoot, "profiles", owner);
+      if (ownerPath !== selectedProfiles) {
+        operations.push({
+          source: ownerPath,
+          staged: join42(stagingRoot, randomUUID34()),
+          state: "pending"
+        });
+      }
+    }
+    for (const topicId of entries(legacyBrowserRoot).filter((name) => name !== "profiles")) {
+      if (retainedTopicIds && !retainedTopicIds.has(topicId)) {
+        operations.push({
+          source: join42(legacyBrowserRoot, topicId),
+          staged: join42(stagingRoot, randomUUID34()),
+          state: "pending"
+        });
+        continue;
+      }
+      const profile = `legacy_${createHash11("sha256").update(topicId).digest("hex").slice(0, 12)}`;
+      operations.push({
+        source: join42(legacyBrowserRoot, topicId),
+        staged: join42(stagingRoot, randomUUID34()),
+        destination: join42(stateDir2, "browser", "profiles", profile),
+        state: "pending"
+      });
+    }
+    assertNoCollisions(operations);
+    journal = {
+      id: SINGLE_USER_MIGRATION_ID,
+      sourcePrincipal: source,
+      createdAt: new Date().toISOString(),
+      phase: "filesystem",
+      operations
+    };
+    writeJournal(journalPath, journal);
+  }
+  const dbPath = join42(stateDir2, "data", "sessions.db");
+  const dbBackup = join42(stagingRoot, "sessions.db.rollback");
+  const vaultDbPath = join42(stateDir2, "data", "vault", "vault.db");
+  const vaultDbBackup = join42(stagingRoot, "vault.db.rollback");
+  try {
+    for (const operation of journal.operations) {
+      if (operation.state === "pending" && !existsSync36(operation.source) && existsSync36(operation.staged)) {
+        operation.state = "staged";
+      }
+      if (operation.state === "staged" && operation.destination && !existsSync36(operation.staged) && existsSync36(operation.destination)) {
+        operation.state = "placed";
+      }
+      if (operation.state === "pending") {
+        mkdirSync35(dirname23(operation.staged), { recursive: true });
+        renameSync16(operation.source, operation.staged);
+        operation.state = "staged";
+        writeJournal(journalPath, journal);
+      }
+      if (operation.state === "staged" && operation.destination) {
+        mkdirSync35(dirname23(operation.destination), { recursive: true });
+        renameSync16(operation.staged, operation.destination);
+        operation.state = "placed";
+        writeJournal(journalPath, journal);
+      }
+    }
+    journal.phase = "database";
+    writeJournal(journalPath, journal);
+    if (existsSync36(dbPath) && !existsSync36(dbBackup))
+      copyFileSync6(dbPath, dbBackup);
+    if (existsSync36(vaultDbPath) && !existsSync36(vaultDbBackup))
+      copyFileSync6(vaultDbPath, vaultDbBackup);
+    const masterKeyPath = join42(stateDir2, "secrets", "vault-master-key");
+    const masterKey = existsSync36(masterKeyPath) ? readFileSync27(masterKeyPath, "utf8").trim() : undefined;
+    const legacyBrowserRoot = join42(stateDir2, "workspace", "browser-profiles");
+    const legacyTopicProfiles = journal.operations.filter((operation) => dirname23(operation.source) === legacyBrowserRoot && operation.destination).map((operation) => ({
+      topicId: basename14(operation.source),
+      profile: basename14(operation.destination)
+    }));
+    const migratedTables = migrateDatabase(dbPath, source, masterKey, legacyTopicProfiles);
+    const migratedVaultTables = migrateDatabase(vaultDbPath, source, masterKey);
+    for (const table of migratedVaultTables)
+      if (!migratedTables.includes(table))
+        migratedTables.push(table);
+    mkdirSync35(join42(stateDir2, "secrets"), { recursive: true, mode: 448 });
+    chmodSync8(join42(stateDir2, "secrets"), 448);
+    for (const secret of ["node-control-token", "runtime-mcp-secret", "vault-master-key"]) {
+      const path = join42(stateDir2, "secrets", secret);
+      if (existsSync36(path))
+        chmodSync8(path, 384);
+    }
+    const deletedPaths = journal.operations.filter((operation) => !operation.destination).length;
+    const movedPaths = journal.operations.length - deletedPaths;
+    const marker = {
+      id: SINGLE_USER_MIGRATION_ID,
+      version: "0.2.0",
+      completedAt: new Date().toISOString(),
+      sourcePrincipal: source,
+      canonicalPrincipal: CANONICAL_LOCAL_USER_ID,
+      movedPaths,
+      deletedPaths,
+      migratedTables
+    };
+    for (const store of ["conversations", "tasks", "users"]) {
+      rmSync11(join42(stateDir2, "data", store, source), { recursive: true, force: true });
+    }
+    rmSync11(join42(stateDir2, "workspace", "browser-profiles"), { recursive: true, force: true });
+    writeFileSync25(markerPath, `${JSON.stringify(marker, null, 2)}
+`, { mode: 384, flag: "wx" });
+    journal.phase = "complete";
+    rmSync11(stagingRoot, { recursive: true, force: true });
+    return {
+      status: "completed",
+      markerPath,
+      sourcePrincipal: source,
+      movedPaths,
+      deletedPaths,
+      migratedTables
+    };
+  } catch (error2) {
+    if (existsSync36(dbBackup))
+      copyFileSync6(dbBackup, dbPath);
+    if (existsSync36(vaultDbBackup))
+      copyFileSync6(vaultDbBackup, vaultDbPath);
+    rollbackFilesystem(journal, journalPath);
+    throw error2;
+  }
+}
+var CANONICAL_LOCAL_USER_ID = "local", SINGLE_USER_MIGRATION_ID = "negotium-0.2.0-single-user";
+var init_single_user = __esm(async () => {
+  init_vault_crypto_core();
+  await init_sqlite();
+});
+
+// ../cli/src/commands/migrate.ts
+var exports_migrate = {};
+__export(exports_migrate, {
+  migrateCommand: () => migrateCommand
+});
+function option3(args, name) {
+  const prefix = `--${name}=`;
+  return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
+function migrateCommand(args) {
+  if (args[0] !== "single-user") {
+    throw new Error("usage: negotium migrate single-user [--source=local] --delete-other-users --yes");
+  }
+  const result = migrateSingleUserState({
+    sourcePrincipal: option3(args, "source"),
+    deleteOtherUsers: args.includes("--delete-other-users"),
+    confirmed: args.includes("--yes")
+  });
+  console.log(`${result.status}: ${result.markerPath}`);
+}
+var init_migrate = __esm(async () => {
+  await init_single_user();
+});
+
 // ../cli/src/commands/topics.ts
 var exports_topics = {};
 __export(exports_topics, {
@@ -43758,12 +44221,12 @@ function vaultCommand(args) {
   switch (sub) {
     case undefined:
     case "list": {
-      const entries = vaultListWithValues(DEFAULT_USER);
-      if (entries.length === 0) {
+      const entries2 = vaultListWithValues(DEFAULT_USER);
+      if (entries2.length === 0) {
         console.log("vault is empty \u2014 `negotium vault set MY_KEY <value> [description]`");
         return;
       }
-      for (const entry of entries) {
+      for (const entry of entries2) {
         console.log(`${entry.key}  ${entry.description || ""}`.trimEnd());
       }
       return;
@@ -44087,6 +44550,12 @@ var CLI_COMMANDS = [
     description: "bootstrap ~/.negotium and check agent auth",
     group: "Setup"
   },
+  {
+    name: "migrate",
+    usage: "migrate single-user [--source=local] --delete-other-users --yes",
+    description: "explicitly migrate a 0.1 state tree to the 0.2 single-user layout",
+    group: "Setup"
+  },
   {
     name: "serve",
     usage: "serve [otium]",
@@ -44193,7 +44662,7 @@ async function runCanonicalNode(port) {
   });
   console.log(`negotium node listening on 127.0.0.1:${node.port} (ctrl-c to stop)`);
   await node.completed;
-  await new Promise((resolve25) => setImmediate(resolve25));
+  await new Promise((resolve26) => setImmediate(resolve26));
   process.exit(0);
 }
 async function stopAdapter(name) {
@@ -44216,6 +44685,11 @@ switch (command) {
     initCommand2();
     break;
   }
+  case "migrate": {
+    const { migrateCommand: migrateCommand2 } = await init_migrate().then(() => exports_migrate);
+    migrateCommand2(args);
+    break;
+  }
   case "-v":
   case "--version": {
     const { NEGOTIUM_VERSION: NEGOTIUM_VERSION2 } = await Promise.resolve().then(() => exports_version);
@@ -44324,4 +44798,4 @@ switch (command) {
   }
 }
 
-//# debugId=90FDEC7EC6CF014764756E2164756E21
+//# debugId=9371DDB5367979FC64756E2164756E21