openmates 0.18.0-alpha.0 → 0.18.0-alpha.2

package/dist/{chunk-RLOO6QKC.js → chunk-XKIFO4JO.js}

@@ -24301,7 +24301,7 @@ import { stdin as stdin3, stdout as stdout2 } from "process";
 import { existsSync as existsSync13, readFileSync as readFileSync12, realpathSync as realpathSync2, writeFileSync as writeFileSync9 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { basename as basename3, dirname as dirname9 } from "path";
-import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID14 } from "crypto";
+import { createHash as createHash14, randomBytes as randomBytes9, randomUUID as randomUUID15 } from "crypto";
 import { arch as arch2, platform as platform3 } from "os";
 import { parse as parseYaml } from "yaml";
 import WebSocket2 from "ws";
@@ -26479,9 +26479,9 @@ function formatTs(ts) {
 }
 
 // src/server.ts
-import { execFileSync as execFileSync3, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID10 } from "crypto";
-import { appendFileSync, chmodSync as chmodSync4, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync3, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
+import { execFileSync as execFileSync4, execSync, spawn as nodeSpawn, spawnSync } from "child_process";
+import { createHash as createHash12, randomBytes as randomBytes8, randomUUID as randomUUID11 } from "crypto";
+import { appendFileSync, chmodSync as chmodSync5, closeSync as closeSync2, copyFileSync as copyFileSync2, cpSync, existsSync as existsSync9, mkdirSync as mkdirSync6, mkdtempSync, openSync as openSync2, readFileSync as readFileSync7, readSync, readdirSync as readdirSync4, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
 import { createInterface as createInterface3 } from "readline";
 import { createInterface as createPromptInterface } from "readline/promises";
 import { homedir as homedir6 } from "os";
@@ -26955,12 +26955,11 @@ function planUpdate(input) {
 function planBackup(input) {
   const role = parseServerRole(input.role);
   const contentsByRole = {
-    core: ["postgres-dump", "directus-uploads", "directus-extensions", "vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    upload: ["vault-data", "vault-setup-data", "runtime-env", "runtime-config", "manifest", "checksums"],
-    preview: ["runtime-env", "runtime-config", "preview-cache", "manifest", "checksums"]
+    core: ["postgres-dump", "runtime-env", "runtime-config", "manifest", "checksums"],
+    upload: ["runtime-env", "runtime-config", "manifest", "checksums"],
+    preview: ["runtime-env", "runtime-config", "manifest", "checksums"]
   };
   const contents = [...contentsByRole[role]];
-  if (input.includeObservability) contents.push("openobserve-data", "prometheus-data");
   return { role, contents, fileMode: 384 };
 }
 function planRestore(input) {
@@ -27193,9 +27192,38 @@ function shouldAutoInstallRuntimeMonitoringServices(env) {
   return env.OPENMATES_SKIP_RUNTIME_MONITORING !== "1";
 }
 
+// src/serverBackupArchive.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { chmodSync as chmodSync3, lstatSync, readdirSync as readdirSync3, renameSync, rmSync as rmSync4 } from "fs";
+import { randomUUID as randomUUID8 } from "crypto";
+function assertRegularBackupTree(path2) {
+  const stat2 = lstatSync(path2);
+  if (stat2.isDirectory()) {
+    for (const entry of readdirSync3(path2)) assertRegularBackupTree(`${path2}/${entry}`);
+    return;
+  }
+  if (!stat2.isFile() || stat2.nlink !== 1) {
+    throw new Error(`Backup archive refused unsafe entry: ${path2}`);
+  }
+}
+function publishServerBackupArchive(sourceDir, archivePath, options = {}) {
+  assertRegularBackupTree(sourceDir);
+  const temporaryArchivePath = `${archivePath}.tmp-${randomUUID8()}`;
+  const previousUmask = process.umask(63);
+  try {
+    execFileSync3(options.tarCommand ?? "tar", ["-czf", temporaryArchivePath, "-C", sourceDir, "."], { stdio: "pipe" });
+    chmodSync3(temporaryArchivePath, 384);
+    renameSync(temporaryArchivePath, archivePath);
+    chmodSync3(archivePath, 384);
+  } finally {
+    process.umask(previousUmask);
+    rmSync4(temporaryArchivePath, { force: true });
+  }
+}
+
 // src/serverHealth.ts
 import dnsModule, { promises as dns } from "dns";
-import { createHmac as createHmac4, randomUUID as randomUUID8 } from "crypto";
+import { createHmac as createHmac4, randomUUID as randomUUID9 } from "crypto";
 import { promises as fs } from "fs";
 import { isIP } from "net";
 import { request as httpsRequest } from "https";
@@ -27578,7 +27606,7 @@ async function resolveGenericWebhookTarget(rawUrl, allowLocalDevelopmentFixture
 async function sendGenericWebhook(target, secret, payload, allowLocalDevelopmentFixture = false) {
   const { url, addresses } = await resolveGenericWebhookTarget(target, allowLocalDevelopmentFixture);
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const eventId = randomUUID8();
+  const eventId = randomUUID9();
   const signed = signRuntimeWebhookPayload(payload, secret, timestamp, eventId);
   const selected = addresses[0];
   await new Promise((resolve11, reject) => {
@@ -27787,7 +27815,7 @@ function signRuntimeWebhookPayload(payload, secret, timestamp, eventId) {
 
 // src/serverUpdateState.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { chmodSync as chmodSync3, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
+import { chmodSync as chmodSync4, closeSync, existsSync as existsSync8, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname5, join as join6 } from "path";
 function serverUpdateStatusFile(installPath, role) {
   return join6(installPath, ".openmates", `${role}-update-status.json`);
@@ -27811,8 +27839,8 @@ function writeServerUpdateStatus(installPath, role, status) {
   const temporaryPath = `${filePath}.${process.pid}.${randomBytes7(4).toString("hex")}.tmp`;
   writeFileSync4(temporaryPath, `${JSON.stringify({ role, updated_at: (/* @__PURE__ */ new Date()).toISOString(), ...status }, null, 2)}
 `, { mode: 384 });
-  renameSync(temporaryPath, filePath);
-  chmodSync3(filePath, 384);
+  renameSync2(temporaryPath, filePath);
+  chmodSync4(filePath, 384);
 }
 function acquireServerUpdateLock(installPath) {
   const stateDir2 = join6(installPath, ".openmates");
@@ -27839,13 +27867,13 @@ function acquireServerUpdateLock(installPath) {
   return () => {
     closeSync(descriptor);
     if (existsSync8(lockPath) && readFileSync6(lockPath, "utf8").trim() === ownershipToken) {
-      rmSync4(lockPath);
+      rmSync5(lockPath);
     }
   };
 }
 
 // src/serverQuickTest.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var QUICK_TEST_RESPONSE_TIMEOUT_MS = 12e4;
 var QUICK_TEST_WEB_QUERY = "site:openmates.org OpenMates";
 var QUICK_TEST_EXPECTED_RESPONSE = "server quick test passed";
@@ -27911,7 +27939,7 @@ function decideQuickServerTestAction(input) {
 async function runQuickServerTest(client, options = {}) {
   const now = options.now ?? Date.now;
   const checks = [];
-  const chatId = randomUUID9();
+  const chatId = randomUUID10();
   let chatMayExist = false;
   checks.push({ id: "account.session", status: "passed", duration_ms: 0 });
   const createStarted = now();
@@ -28042,6 +28070,7 @@ var HEALTH_REQUEST_TIMEOUT_MS = 5e3;
 var CHECKSUM_BUFFER_BYTES = 1024 * 1024;
 var ENV_BACKUP_PREFIX = ".env.openmates-backup-";
 var ENV_BACKUP_RETENTION_COUNT = 5;
+var BACKUP_FORMAT_VERSION = 2;
 var IMAGE_CHANNEL_TAGS = {
   stable: MAIN_BRANCH,
   main: MAIN_BRANCH,
@@ -28268,7 +28297,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
     "dev-stack"
   ];
   for (const service of services) args.push("--service", service);
-  const output = execFileSync3("python3", args, {
+  const output = execFileSync4("python3", args, {
     cwd: installPath,
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "pipe"]
@@ -28279,7 +28308,7 @@ function beginEngineeringRuntimeOperation(installPath, operationType, services)
 }
 function finishEngineeringRuntimeOperation(installPath, operationKey, status) {
   const manager = join7(installPath, "scripts", "engineering_control_plane.py");
-  execFileSync3(
+  execFileSync4(
     "python3",
     [manager, "operation", "update", "--operation-key", operationKey, "--status", status],
     { cwd: installPath, stdio: ["ignore", "ignore", "pipe"] }
@@ -28939,13 +28968,13 @@ function targetSourceLinks(imageTag, templateRef) {
   };
 }
 function installedImageMetadata(input) {
-  const containerId = execFileSync3(
+  const containerId = execFileSync4(
     "docker",
     [...composeArgs(input.installPath, input.withOverrides, "image", input.role), "ps", "-q", ROLE_PROVENANCE_SERVICE[input.role]],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
   ).trim();
   if (!containerId) throw new Error("updated_container_unavailable");
-  const labels = JSON.parse(execFileSync3(
+  const labels = JSON.parse(execFileSync4(
     "docker",
     ["inspect", "--format", "{{json .Config.Labels}}", containerId],
     { cwd: input.installPath, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
@@ -29012,9 +29041,9 @@ function readEnvContent(installPath) {
   return existsSync9(envPath) ? readFileSync7(envPath, "utf-8") : "";
 }
 function pruneEnvBackups(installPath) {
-  const backups = readdirSync3(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
+  const backups = readdirSync4(installPath, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.startsWith(ENV_BACKUP_PREFIX)).map((entry) => entry.name).sort();
   for (const backup of backups.slice(0, Math.max(0, backups.length - ENV_BACKUP_RETENTION_COUNT))) {
-    rmSync5(join7(installPath, backup), { force: true });
+    rmSync6(join7(installPath, backup), { force: true });
   }
 }
 function backupEnvFile(installPath) {
@@ -29022,7 +29051,7 @@ function backupEnvFile(installPath) {
   if (!existsSync9(envPath)) return null;
   const backupPath = join7(installPath, `${ENV_BACKUP_PREFIX}${nowStamp()}`);
   copyFileSync2(envPath, backupPath);
-  chmodSync4(backupPath, 384);
+  chmodSync5(backupPath, 384);
   pruneEnvBackups(installPath);
   return backupPath;
 }
@@ -29030,7 +29059,7 @@ function writeEnvContent(installPath, content) {
   const envPath = envPathForInstall(installPath);
   mkdirSync6(dirname6(envPath), { recursive: true });
   writeFileSync5(envPath, content, { mode: 384 });
-  chmodSync4(envPath, 384);
+  chmodSync5(envPath, 384);
 }
 function writeDeploymentModeEnv(installPath, deploymentMode, overlayPath) {
   let content = readEnvContent(installPath);
@@ -29203,7 +29232,7 @@ for item in checks:
 print(json.dumps({"ok": True, "presence": presence}))
 `;
   try {
-    const output = execFileSync3(
+    const output = execFileSync4(
       "docker",
       ["exec", "-e", `OPENMATES_SECRET_CHECKS=${JSON.stringify(checks)}`, container, "python", "-c", script],
       { encoding: "utf-8", timeout: 1e4, stdio: ["pipe", "pipe", "pipe"] }
@@ -29258,7 +29287,7 @@ function hashFile(path2) {
 function writeChecksums(rootDir) {
   const lines = [];
   const walk = (dir) => {
-    for (const entry of readdirSync3(dir, { withFileTypes: true })) {
+    for (const entry of readdirSync4(dir, { withFileTypes: true })) {
       const path2 = join7(dir, entry.name);
       if (entry.isDirectory()) {
         walk(path2);
@@ -29296,19 +29325,20 @@ function createServerBackup(installPath, role, options = {}) {
   const backupDir = roleBackupDir(installPath, role);
   mkdirSync6(backupDir, { recursive: true, mode: 448 });
   const archivePath = options.output ? resolve6(options.output) : join7(backupDir, options.preUpdate ? `latest-pre-update-${role}.tar.gz` : `openmates-${role}-${nowStamp()}.tar.gz`);
+  mkdirSync6(dirname6(archivePath), { recursive: true, mode: 448 });
   const tempDir = mkdtempSync(join7(backupDir, ".tmp-"));
   const env = readEnvMap(installPath);
   const manifest = {
     role,
+    backup_format_version: BACKUP_FORMAT_VERSION,
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     cli_version: getPackageVersion(),
     image_tag: getEnvVar(existsSync9(join7(installPath, ".env")) ? readFileSync7(join7(installPath, ".env"), "utf-8") : "", "OPENMATES_IMAGE_TAG"),
-    include_observability: options.includeObservability === true,
-    contents: plan.contents
+    recovery_scope: role === "core" ? "database-and-runtime-only" : "runtime-only",
+    include_observability: false,
+    contents: plan.contents.filter((content) => content !== "runtime-env" || existsSync9(join7(installPath, ".env"))).filter((content) => content !== "runtime-config" || existsSync9(join7(installPath, "config")))
   };
   try {
-    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
-`);
     copyIfExists(join7(installPath, ".env"), join7(tempDir, "runtime", ".env"));
     copyIfExists(join7(installPath, "config"), join7(tempDir, "runtime", "config"));
     if (role === "core") {
@@ -29329,19 +29359,13 @@ function createServerBackup(installPath, role, options = {}) {
         closeSync2(dumpFile);
       }
     }
-    for (const item of [
-      [join7(installPath, "backend", "core", "uploads"), join7(tempDir, "directus-uploads")],
-      [join7(installPath, "backend", "core", "extensions"), join7(tempDir, "directus-extensions")],
-      [join7(installPath, "backend", role, "vault"), join7(tempDir, `${role}-vault-config`)]
-    ]) {
-      copyIfExists(item[0], item[1]);
-    }
+    writeFileSync5(join7(tempDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+`, { mode: 384 });
     writeChecksums(tempDir);
-    execSync(`tar -czf ${shellQuote(archivePath)} -C ${shellQuote(tempDir)} .`, { stdio: "pipe" });
-    chmodSync4(archivePath, plan.fileMode);
+    publishServerBackupArchive(tempDir, archivePath);
     return archivePath;
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync6(tempDir, { recursive: true, force: true });
   }
 }
 function restoreServerBackup(installPath, role, file) {
@@ -29357,19 +29381,30 @@ function restoreServerBackup(installPath, role, file) {
     if (!existsSync9(manifestPath)) throw new Error("Backup archive is missing manifest.json.");
     const manifest = JSON.parse(readFileSync7(manifestPath, "utf-8"));
     if (manifest.role !== role) throw new Error(`Backup role '${manifest.role}' does not match requested role '${role}'.`);
+    if (role === "core" && manifest.backup_format_version === BACKUP_FORMAT_VERSION && manifest.recovery_scope !== "full-core") {
+      throw new Error("This backup records database and runtime state only; refusing unsafe full core restore.");
+    }
     copyIfExists(join7(tempDir, "runtime", ".env"), join7(installPath, ".env"));
     copyIfExists(join7(tempDir, "runtime", "config"), join7(installPath, "config"));
     const postgresDump = join7(tempDir, "postgres.sql");
     if (role === "core" && existsSync9(postgresDump)) {
       const databaseUser = env.DATABASE_USERNAME || "directus";
       const databaseName = env.DATABASE_NAME || "directus";
-      execSync(`docker exec -i cms-database psql -v ON_ERROR_STOP=1 -U ${shellQuote(databaseUser)} ${shellQuote(databaseName)}`, {
-        input: readFileSync7(postgresDump),
-        stdio: ["pipe", "pipe", "pipe"]
-      });
+      const dumpFile = openSync2(postgresDump, "r");
+      try {
+        const result = spawnSync(
+          "docker",
+          ["exec", "-i", "cms-database", "psql", "-v", "ON_ERROR_STOP=1", "-U", databaseUser, databaseName],
+          { encoding: "utf-8", stdio: [dumpFile, "pipe", "pipe"] }
+        );
+        if (result.error) throw result.error;
+        if (result.status !== 0) throw new Error(result.stderr || `psql exited with status ${result.status}`);
+      } finally {
+        closeSync2(dumpFile);
+      }
     }
   } finally {
-    rmSync5(tempDir, { recursive: true, force: true });
+    rmSync6(tempDir, { recursive: true, force: true });
   }
 }
 function restoreStopServices(installPath, withOverrides, installMode, role) {
@@ -29992,7 +30027,7 @@ async function runUpdateCompletionEmailGate(input) {
       deliveryId: deliveryPlan.deliveryId
     };
   }
-  const deliveryId = deliveryPlan.deliveryId ?? randomUUID10();
+  const deliveryId = deliveryPlan.deliveryId ?? randomUUID11();
   const deliveryPendingAt = deliveryPlan.pendingAt ?? completedAt;
   const previousAttempts = deliveryPlan.previousAttempts ?? 0;
   const { role: _role, updated_at: _updatedAt, ...currentStatus } = readServerUpdateStatus(input.installPath, input.role);
@@ -30131,18 +30166,18 @@ async function installRuntimeMonitoringServices(installPath, role) {
     const installedOperationalUnits = operationalUnitNames.filter((name) => existsSync9(join7("/etc", "systemd", "system", name)));
     const installedOperationalTimers = installedOperationalUnits.filter((name) => name.endsWith(".timer"));
     if (installedOperationalTimers.length) {
-      execFileSync3("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
+      execFileSync4("systemctl", ["disable", "--now", ...installedOperationalTimers], { stdio: "pipe" });
     }
-    for (const name of installedOperationalUnits) rmSync5(join7("/etc", "systemd", "system", name));
+    for (const name of installedOperationalUnits) rmSync6(join7("/etc", "systemd", "system", name));
     for (const path2 of [reportStatePath, startedMetricPath, successMetricPath]) {
-      if (existsSync9(path2)) rmSync5(path2);
+      if (existsSync9(path2)) rmSync6(path2);
     }
   }
   for (const [name, content] of files) writeFileSync5(join7("/etc", "systemd", "system", name), content, { mode: 420 });
   execSync("systemctl daemon-reload", { stdio: "pipe" });
   const timers = files.filter(([name]) => name.endsWith(".timer")).map(([name]) => name);
   execSync(`systemctl enable --now ${timers.map(shellQuote).join(" ")}`, { stdio: "pipe" });
-  for (const timer of timers) execFileSync3("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
+  for (const timer of timers) execFileSync4("systemctl", ["is-active", "--quiet", timer], { stdio: "pipe" });
 }
 async function autoInstallRuntimeMonitoringServices(installPath, role) {
   if (!shouldAutoInstallRuntimeMonitoringServices(process.env)) {
@@ -31145,7 +31180,7 @@ async function serverBackup(rest, flags) {
   const role = getServerRole(flags, config);
   if (action === "list") {
     const dir = roleBackupDir(installPath, role);
-    const files = existsSync9(dir) ? readdirSync3(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
+    const files = existsSync9(dir) ? readdirSync4(dir).filter((item) => item.endsWith(".tar.gz")).sort() : [];
     if (flags.json === true) {
       printJson({ role, backupDir: dir, files });
       return;
@@ -31240,7 +31275,7 @@ async function serverUninstall(flags) {
   } catch {
   }
   try {
-    rmSync5(installPath, { recursive: true, force: true });
+    rmSync6(installPath, { recursive: true, force: true });
     console.error(`  Removed installation directory: ${installPath}`);
   } catch (e) {
     console.error(`  Could not remove ${installPath}: ${e instanceof Error ? e.message : e}`);
@@ -70488,8 +70523,8 @@ function buildAssistantFeedbackDecision(rating) {
 }
 
 // src/benchmark.ts
-import { createHash as createHash13, randomUUID as randomUUID11 } from "crypto";
-import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { createHash as createHash13, randomUUID as randomUUID12 } from "crypto";
+import { existsSync as existsSync10, mkdtempSync as mkdtempSync2, readFileSync as readFileSync8, readdirSync as readdirSync5, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
 import { dirname as dirname7, join as join8, resolve as resolve8 } from "path";
 import { fileURLToPath } from "url";
@@ -70904,7 +70939,7 @@ async function handleBenchmark(client, subcommand, rest, flags) {
   const caseIds = parseCaseIds(flags.case);
   const dryRun = flags["dry-run"] === true;
   const output = typeof flags.output === "string" ? flags.output : void 0;
-  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID11();
+  const runId = typeof flags["run-id"] === "string" ? flags["run-id"] : randomUUID12();
   const imagePath = typeof flags.image === "string" ? resolve8(flags.image) : defaultImageFixturePath();
   if (!dryRun && flags["confirm-spend-credits"] !== true) {
     throw new Error(
@@ -71006,7 +71041,7 @@ async function handlePromptBudgetBenchmark(client, rest, flags) {
   if (resumeArtifact) {
     validatePromptBudgetResumeArtifact(resumeArtifact, { phase, targetModel, judgeModel });
   }
-  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID11();
+  const runId = stringFlag(flags["run-id"]) ?? resumeArtifact?.runId ?? randomUUID12();
   const result = makePromptBudgetBaseResult({
     phase,
     runId,
@@ -71567,7 +71602,7 @@ function buildLongContextHistory() {
 }
 function appendHistory(history, role, content) {
   history.push({
-    message_id: randomUUID11(),
+    message_id: randomUUID12(),
     role,
     sender_name: role === "user" ? "User" : "Assistant",
     content,
@@ -71657,7 +71692,7 @@ function loadProviderPricing() {
   const providersDir = findProvidersDir();
   const pricing = /* @__PURE__ */ new Map();
   if (!providersDir) return pricing;
-  for (const fileName of readdirSync4(providersDir)) {
+  for (const fileName of readdirSync5(providersDir)) {
     if (!fileName.endsWith(".yml")) continue;
     const filePath = join8(providersDir, fileName);
     const text = readFileSync8(filePath, "utf-8");
@@ -73434,7 +73469,7 @@ function clamp(value, min, max) {
 // src/remoteAccess.ts
 import { homedir as homedir7 } from "os";
 import {
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync6,
   closeSync as closeSync3,
   constants,
   existsSync as existsSync11,
@@ -73442,7 +73477,7 @@ import {
   mkdirSync as mkdirSync7,
   openSync as openSync3,
   readFileSync as readFileSync9,
-  readdirSync as readdirSync5,
+  readdirSync as readdirSync6,
   readSync as readSync2,
   realpathSync,
   statSync as statSync2,
@@ -73586,7 +73621,7 @@ function discoverRemoteAccessRepositories(roots) {
   const visit = (directory, approvedRoot) => {
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true });
+      entries = readdirSync6(directory, { withFileTypes: true });
     } catch (error) {
       const code = error.code;
       if (code === "EACCES" || code === "EPERM") {
@@ -73624,7 +73659,7 @@ function listRemoteAccessDirectory(options) {
   const entries = [];
   let omitted = 0;
   let excluded = 0;
-  for (const entry of readdirSync5(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of readdirSync6(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     const entryPath = relative2(root, join9(directory, entry.name)).replace(/\\/g, "/");
     if (entry.name === ".git" || entry.isSymbolicLink() || isGitIgnoredPath(root, entryPath) || classifyProjectFileRisk(entryPath, options.userProtectedPatterns ?? []).isHighRisk || entry.isFile() && isBinaryFile(join9(directory, entry.name))) {
       excluded += 1;
@@ -73972,7 +74007,7 @@ function searchRemoteSourceWithoutRg(query, sourceRoot, maxResults, userProtecte
     const directory = directories.pop();
     let entries;
     try {
-      entries = readdirSync5(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+      entries = readdirSync6(directory, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
     } catch {
       excluded += 1;
       continue;
@@ -74185,10 +74220,10 @@ function saveRemoteAccessSources(sources, homeDirectory) {
   const filePath = remoteAccessStorePath(homeDirectory);
   const stateDir2 = join9(homeDirectory, ".openmates");
   mkdirSync7(stateDir2, { recursive: true, mode: 448 });
-  chmodSync5(stateDir2, 448);
+  chmodSync6(stateDir2, 448);
   writeFileSync7(filePath, `${JSON.stringify({ sources }, null, 2)}
 `, { mode: 384 });
-  chmodSync5(filePath, 384);
+  chmodSync6(filePath, 384);
 }
 function assertRemoteAccessSourceRecord(value, index) {
   if (typeof value !== "object" || value === null) {
@@ -74206,7 +74241,7 @@ function assertRemoteAccessSourceRecord(value, index) {
 }
 
 // src/projectRequester.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 var REMOTE_PROTOCOL_TIMEOUT_MS = 45e3;
 var REMOTE_POLL_INTERVAL_MS = 250;
 var MAX_REMOTE_RESULT_BYTES = 200 * 1024;
@@ -74232,8 +74267,8 @@ async function requestProjectRemoteOperation(options) {
     keyEpoch = discovery.keyEpoch;
     routingIdentity = discovery.routingIdentity;
   }
-  const requestingClientId = randomUUID12();
-  const requestId = randomUUID12();
+  const requestingClientId = randomUUID13();
+  const requestId = randomUUID13();
   const identity = await buildIdentity(
     options.client,
     options.projectId,
@@ -74294,9 +74329,9 @@ async function requestProjectRemoteOperation(options) {
   return response.result;
 }
 async function discoverRouting(options, timeoutMs) {
-  const requestId = randomUUID12();
-  const requestingClientId = randomUUID12();
-  const nonce = randomUUID12();
+  const requestId = randomUUID13();
+  const requestingClientId = randomUUID13();
+  const nonce = randomUUID13();
   const encryptedEnvelope = await encryptWithAesGcmCombined(JSON.stringify({
     type: "routing_discovery",
     requesting_client_id: requestingClientId,
@@ -74507,7 +74542,7 @@ function commandName(name) {
 }
 
 // src/workRecovery.ts
-import { mkdirSync as mkdirSync8, renameSync as renameSync2, writeFileSync as writeFileSync8 } from "fs";
+import { mkdirSync as mkdirSync8, renameSync as renameSync3, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname8 } from "path";
 import { stringify } from "yaml";
 async function projectPlanAssumption(plan, masterKey, assumption) {
@@ -74690,13 +74725,13 @@ function writeWorkRecoveryAtomically(path2, document) {
   mkdirSync8(dirname8(path2), { recursive: true, mode: 448 });
   const temporaryPath = `${path2}.tmp`;
   writeFileSync8(temporaryPath, stringify(document, { sortMapEntries: true, lineWidth: 0 }), { encoding: "utf8", mode: 384 });
-  renameSync2(temporaryPath, path2);
+  renameSync3(temporaryPath, path2);
 }
 
 // src/revolutBusinessCertificate.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { createSign, randomUUID as randomUUID13 } from "crypto";
-import { chmodSync as chmodSync6, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11 } from "fs";
+import { execFileSync as execFileSync5 } from "child_process";
+import { createSign, randomUUID as randomUUID14 } from "crypto";
+import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir8 } from "os";
 import { join as join10, resolve as resolve10 } from "path";
 var REVOLUT_BUSINESS_CERTIFICATE_DOCS_URL = "https://developer.revolut.com/docs/guides/manage-accounts/get-started/make-your-first-api-request#generate-a-private-and-a-public-certificate";
@@ -74769,7 +74804,7 @@ function generateRevolutBusinessClientAssertion(options) {
     aud: REVOLUT_BUSINESS_AUDIENCE,
     exp: now + 3600,
     iat: now,
-    jti: randomUUID13()
+    jti: randomUUID14()
   });
   const unsigned = `${header2}.${payload}`;
   const signer = createSign("RSA-SHA256");
@@ -74785,16 +74820,16 @@ function generateRevolutBusinessCertificate(options = {}) {
   if (!title) throw new Error("Revolut certificate title must not be empty.");
   if (!redirectUri.startsWith("https://")) throw new Error("Revolut OAuth redirect URI must start with https://.");
   mkdirSync9(outputDir, { recursive: true, mode: 448 });
-  chmodSync6(outputDir, 448);
+  chmodSync7(outputDir, 448);
   const privateKeyPath = join10(outputDir, "privatecert.pem");
   const publicCertificatePath = join10(outputDir, "publiccert.cer");
   if (!options.overwrite && (existsSync12(privateKeyPath) || existsSync12(publicCertificatePath))) {
     throw new Error(`Revolut certificate files already exist in ${outputDir}. Re-run with --overwrite to replace them.`);
   }
   try {
-    execFileSync4("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
-    chmodSync6(privateKeyPath, 384);
-    execFileSync4(
+    execFileSync5("openssl", ["genrsa", "-out", privateKeyPath, RSA_BITS], { stdio: "ignore" });
+    chmodSync7(privateKeyPath, 384);
+    execFileSync5(
       "openssl",
       [
         "req",
@@ -76081,7 +76116,7 @@ async function resolveAddToProjectStorageChoice(client, project, flags, objectTy
 async function createEncryptedProjectItem(client, project, input) {
   const timestamp = nowSeconds3();
   return client.createProjectItem(project.projectId, {
-    project_item_id: randomUUID14(),
+    project_item_id: randomUUID15(),
     folder_id: input.folderId ?? null,
     item_type: input.itemType,
     target_id: input.targetId,
@@ -76275,7 +76310,7 @@ async function handlePlans(client, subcommand, rest, flags, redactor) {
     const encryptedSources = proof.length ? await encryptPlanAssumptionSources(plan, masterKey, proof) : void 0;
     if (action === "create" || action === "add") {
       const assumption = await client.createPlanAssumption(plan.planId, {
-        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID14(),
+        assumption_id: typeof flags.id === "string" ? flags.id : randomUUID15(),
         encrypted_text: await encryptPlanAssumptionSources(plan, masterKey, requiredStringFlag(flags.text ?? rest.slice(2).join(" "), "--text <assumption>")),
         status: typeof flags.status === "string" ? flags.status : void 0,
         linked_sub_chat_id: typeof flags["sub-chat"] === "string" ? flags["sub-chat"] : void 0,
@@ -77200,7 +77235,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const name = requiredStringFlag(rest[0] ?? flags.name, "project name");
     const projectKey = randomBytes9(32);
     const wrapping = await client.projectWrappingKey(context);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const timestamp = nowSeconds3();
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -77308,7 +77343,7 @@ async function handleProjects(client, subcommand, rest, flags, redactor) {
     const proposal = isShortWorkspaceAsk(instruction) ? { name: instruction, description: "", icon: "folder", color: "default" } : extractRecord(await client.planProjectAsk({ instruction }), "proposed_project");
     const projectKey = randomBytes9(32);
     const timestamp = Math.floor(Date.now() / 1e3);
-    const projectId = randomUUID14();
+    const projectId = randomUUID15();
     const name = requiredString(proposal, "name", instruction);
     const slugMetadata = await buildEncryptedObjectSlugMetadata({
       value: typeof flags.slug === "string" ? flags.slug : name,
@@ -78207,7 +78242,7 @@ async function handleRemoteAccess(client, subcommand, rest, flags) {
     const projects = await loadProjects(client, masterKey, hostingFlags, hostingContext);
     const bindings = await resolveRemoteAccessBindings(client, masterKey, projects, candidateRoots, hostingFlags, hostingContext);
     if (bindings.length === 0) throw new Error("No Project folders were approved for remote access.");
-    const sourceSessionId = randomUUID14();
+    const sourceSessionId = randomUUID15();
     const controller = new AbortController();
     const stop = () => controller.abort();
     process.once("SIGINT", stop);
@@ -78315,7 +78350,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
     if (answer !== "y" && answer !== "yes") throw new Error("Remote access Project creation cancelled.");
     for (const rootPath of unresolved) {
       const project = await createEncryptedRemoteAccessProject(client, masterKey, basename3(rootPath), context);
-      resolved.push({ rootPath, project, sourceId: randomUUID14() });
+      resolved.push({ rootPath, project, sourceId: randomUUID15() });
     }
   }
   const bindings = [];
@@ -78352,7 +78387,7 @@ async function resolveRemoteAccessBindings(client, masterKey, projects, candidat
 }
 async function createEncryptedRemoteAccessProject(client, masterKey, name, context) {
   const projectKey = randomBytes9(32);
-  const projectId = randomUUID14();
+  const projectId = randomUUID15();
   const timestamp = Math.floor(Date.now() / 1e3);
   const wrapping = await client.projectWrappingKey(context);
   const payload = {
@@ -81650,7 +81685,7 @@ async function runAccountImport(client, parserFormat, file, flags) {
   if (flags.yes !== true) {
     await confirmOrExit(`Import ${selectedCount} chat(s) into new encrypted OpenMates chats? [y/N] `);
   }
-  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID14();
+  const importId = typeof preview.import_id === "string" ? preview.import_id : randomUUID15();
   const selectedChats = parsed.chats.slice(0, selectedCount);
   const selectedFingerprints = selectedChats.map((chat) => chat.source_fingerprint);
   const confirmation = await client.confirmAccountImport(importId, selectedFingerprints);
@@ -82144,8 +82179,8 @@ async function handleFinance(client, subcommand, _rest, flags) {
         refresh_token_envelope: connectedAccount.refreshTokenBundle
       }
     ] : [],
-    chatId: `cli-finance-${randomUUID14()}`,
-    messageId: `cli-finance-message-${randomUUID14()}`,
+    chatId: `cli-finance-${randomUUID15()}`,
+    messageId: `cli-finance-message-${randomUUID15()}`,
     apiKey: resolveApiKey(flags) ?? void 0,
     promptInjectionProtection: false
   });

package/dist/cli.js

@@ -11,7 +11,7 @@ import {
   resolveProjectContext,
   serializeToYaml,
   shouldRequireTrustedAccountGuard
-} from "./chunk-RLOO6QKC.js";
+} from "./chunk-XKIFO4JO.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   selectAssistantMessagesForSpeech,
   serializeToYaml,
   summarizeAssistantSpeech
-} from "./chunk-RLOO6QKC.js";
+} from "./chunk-XKIFO4JO.js";
 import "./chunk-IWKP55ZB.js";
 import "./chunk-BBKJZ23O.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.18.0-alpha.0",
+  "version": "0.18.0-alpha.2",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",