negotium 0.2.0 → 0.2.1

package/dist/main.js

@@ -411,9 +411,9 @@ var init_sqlite = __esm(async () => {
   }
 });
 
-// ../../packages/core/src/storage/vault-crypto.ts
+// ../../packages/core/src/storage/vault-crypto-core.ts
 import { createCipheriv, createDecipheriv, createHash, randomBytes as randomBytes2 } from "crypto";
-function encryptionKey(masterKey = VAULT_MASTER_KEY) {
+function encryptionKey(masterKey) {
   return createHash("sha256").update("otium-vault-value-v1\x00", "utf8").update(masterKey, "utf8").digest().subarray(0, KEY_BYTES);
 }
 function aad(userId, key) {
@@ -422,7 +422,7 @@ function aad(userId, key) {
 function isEncryptedVaultValue(value) {
   return value.startsWith(ENVELOPE_PREFIX);
 }
-function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+function encryptVaultValueWithKey(userId, key, value, masterKey) {
   const iv = randomBytes2(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", encryptionKey(masterKey), iv);
   cipher.setAAD(aad(userId, key));
@@ -430,7 +430,7 @@ function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
   const tag = cipher.getAuthTag();
   return `${ENVELOPE_PREFIX}${iv.toString("base64url")}.${ciphertext.toString("base64url")}.${tag.toString("base64url")}`;
 }
-function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+function decryptVaultValueWithKey(userId, key, storedValue, masterKey) {
   if (!isEncryptedVaultValue(storedValue)) {
     return { value: storedValue, legacyPlaintext: true };
   }
@@ -452,8 +452,18 @@ function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KE
   return { value: plaintext.toString("utf8"), legacyPlaintext: false };
 }
 var ENVELOPE_PREFIX = "otium-vault:v1:", IV_BYTES = 12, KEY_BYTES = 32;
+var init_vault_crypto_core = () => {};
+
+// ../../packages/core/src/storage/vault-crypto.ts
+function encryptVaultValue(userId, key, value, masterKey = VAULT_MASTER_KEY) {
+  return encryptVaultValueWithKey(userId, key, value, masterKey);
+}
+function decryptVaultValue(userId, key, storedValue, masterKey = VAULT_MASTER_KEY) {
+  return decryptVaultValueWithKey(userId, key, storedValue, masterKey);
+}
 var init_vault_crypto = __esm(() => {
   init_config();
+  init_vault_crypto_core();
 });
 
 // ../../packages/core/src/storage/vault.ts
@@ -4584,7 +4594,7 @@ var exports_version = {};
 __export(exports_version, {
   NEGOTIUM_VERSION: () => NEGOTIUM_VERSION
 });
-var NEGOTIUM_VERSION = "0.2.0";
+var NEGOTIUM_VERSION = "0.2.1";
 
 // ../../packages/core/src/agents/codex-native-multi-agent.ts
 import { spawn as spawn3 } from "child_process";
@@ -43800,8 +43810,8 @@ function migrateDatabase(dbPath, source, masterKey, legacyTopicProfiles = []) {
           throw new Error("Cannot migrate encrypted vault rows without vault-master-key.");
         const rows = database.query("SELECT key, value FROM vault WHERE user_id = ?").all(source);
         for (const row of rows) {
-          const plaintext = decryptVaultValue(source, row.key, row.value, masterKey).value;
-          database.query("UPDATE vault SET value = ? WHERE user_id = ? AND key = ?").run(encryptVaultValue(CANONICAL_LOCAL_USER_ID, row.key, plaintext, masterKey), source, row.key);
+          const plaintext = decryptVaultValueWithKey(source, row.key, row.value, masterKey).value;
+          database.query("UPDATE vault SET value = ? WHERE user_id = ? AND key = ?").run(encryptVaultValueWithKey(CANONICAL_LOCAL_USER_ID, row.key, plaintext, masterKey), source, row.key);
         }
       }
       database.query(`UPDATE ${quote(table)} SET user_id = ? WHERE user_id = ?`).run(CANONICAL_LOCAL_USER_ID, source);
@@ -44082,7 +44092,7 @@ function migrateSingleUserState(options) {
 }
 var CANONICAL_LOCAL_USER_ID = "local", SINGLE_USER_MIGRATION_ID = "negotium-0.2.0-single-user";
 var init_single_user = __esm(async () => {
-  init_vault_crypto();
+  init_vault_crypto_core();
   await init_sqlite();
 });
 
@@ -44788,4 +44798,4 @@ switch (command) {
   }
 }
 
-//# debugId=0E990AB8BEC23DD564756E2164756E21
+//# debugId=9371DDB5367979FC64756E2164756E21