relembra 1.0.0-beta.1 → 1.0.0-beta.3

package/README.md

@@ -25,7 +25,7 @@ and storage (an adapter). relembra enforces the rules:
 - **Measured.** An evaluation harness with leak, scope, retrieval and wake-coverage gates, plus
   controls that must fail. Results: [docs/eval/](docs/eval/).
 
-Version: 1.0.0-beta.1, a beta ([changelog](CHANGELOG.md),
+Version: 1.0.0-beta.3, a beta ([changelog](CHANGELOG.md),
 [releases](https://github.com/mneves75/relembra/releases)). Release procedure:
 [docs/RELEASE.md](docs/RELEASE.md).
 Design: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md).
@@ -203,23 +203,36 @@ scope. Outside a repository it is the scope itself. The wake gives each of the t
 its budget and passes the room one leaves unused to the other, so neither can crowd the other
 out. Set `RELEMBRA_SCOPE` to the global scope to change what it holds.
 
-Each [GitHub release](https://github.com/mneves75/relembra/releases) carries the macOS arm64
-binary `relembra-darwin-arm64`, `SHA256SUMS` and the library archive npm serves. Download the
-binary and checksum file, then install them with `install.sh` from a checkout of the same tag:
+Each [GitHub release](https://github.com/mneves75/relembra/releases) carries a native binary
+per platform, `SHA256SUMS` and the library archive npm serves:
+
+| Platform | Binary |
+|---|---|
+| macOS arm64 | `relembra-darwin-arm64` |
+| Linux x64 (glibc) | `relembra-linux-x64` |
+| Linux arm64 (glibc) | `relembra-linux-arm64` |
+| Windows x64 | `relembra-windows-x64.exe` |
+| Windows arm64 | `relembra-windows-arm64.exe` |
+
+On macOS and Linux, download the binary and checksum file, then install them with `install.sh`
+from a checkout of the same tag:
 
 ```sh
-sh install.sh relembra-darwin-arm64 SHA256SUMS  # verifies the checksum, installs to ~/.local/bin
+sh install.sh relembra-linux-x64 SHA256SUMS  # verifies the checksum, installs to ~/.local/bin
 ```
 
+On Windows, check the hash with `Get-FileHash` and copy the binary onto `PATH` as
+`relembra.exe`; the session hook needs Git Bash ([docs/CLI.md](docs/CLI.md#windows)).
+
 Before replacing an installed executable, retain a backup and its hash. Verify installed bytes
 against the release checksum and export metadata from a disposable store
-(`relembra: "1.0.0-beta.1"`); there is no `--version` flag. The [release procedure](docs/RELEASE.md) covers isolated checks and
+(`relembra: "1.0.0-beta.3"`); there is no `--version` flag. The [release procedure](docs/RELEASE.md) covers isolated checks and
 rollback without opening a live memory store. After verification, `relembra init` prints the
 session hook for your agent.
 
-On other platforms, build it from a clone with an AOT-capable Bun using `bun run build:cli`
-(writes `bin/relembra` and `bin/relembra.sha256`) and install that pair the same way. A local Mac
-check does not attest another platform's binary.
+To build it yourself, run `bun run build:cli` from a clone with the pinned Bun
+(`build/bun-toolchain.txt`); it writes `bin/relembra` (`relembra.exe` on Windows) and
+`bin/relembra.sha256`.
 
 Commands, flags, exit codes and the JSON envelope: [docs/CLI.md](docs/CLI.md).
 
@@ -304,9 +317,10 @@ The landing page is `site/`: static files, no build step besides `bun run build:
 the library into `site/assets/relembra.js` so the page's demos run the real code in the browser
 (`test/site.test.ts` fails while that file is stale). Preview it with
 `python3 -m http.server --directory site`, or open `site/index.html` directly.
-`scripts/site/publish.sh` publishes a committed `site/` to the `gh-pages` branch for GitHub Pages
-(`--dry-run` shows the tree without pushing); the explainer video in `site/assets/video/` is
-git-ignored on `main` and ships only there.
+The `pages` workflow (`gh workflow run pages.yml --ref main`) publishes it to GitHub Pages with
+OIDC, no stored token: `scripts/site/assemble.sh <new directory>` builds what ships from the
+commit's `site/` plus the explainer video, which is git-ignored on `main` and kept on the
+`gh-pages` branch, checked against `scripts/site/video.sha256`.
 
 Contributing: [CONTRIBUTING.md](CONTRIBUTING.md). Security reports: [SECURITY.md](SECURITY.md).
 

package/dist/cli/commands.d.ts

@@ -36,5 +36,5 @@ export declare const COMMANDS: readonly CommandSpec[];
 /** Flags every command takes. */
 export declare const GLOBAL_FLAGS: readonly ["--json", "--help"];
 /** The environment the CLI reads, in the order docs/CLI.md lists it. */
-export declare const ENV_VARS: readonly ["RELEMBRA_HOME", "RELEMBRA_SCOPE", "RELEMBRA_GLOBAL_SCOPE", "RELEMBRA_AGENT", "RELEMBRA_HARNESS", "RELEMBRA_MODEL", "BUN_OPTIONS", "BUN_BYTECODE_ORDER_OUT", "PATH", "HOME", "XDG_CONFIG_HOME"];
+export declare const ENV_VARS: readonly ["RELEMBRA_HOME", "RELEMBRA_SCOPE", "RELEMBRA_GLOBAL_SCOPE", "RELEMBRA_AGENT", "RELEMBRA_HARNESS", "RELEMBRA_MODEL", "BUN_OPTIONS", "BUN_BYTECODE_ORDER_OUT", "PATH", "HOME", "XDG_CONFIG_HOME", "SystemRoot"];
 export declare function usageText(): string;

package/dist/cli/commands.js

@@ -99,6 +99,7 @@ export const ENV_VARS = [
     "PATH",
     "HOME",
     "XDG_CONFIG_HOME",
+    "SystemRoot",
 ];
 export function usageText() {
     return [

package/dist/cli/main.js

@@ -21,6 +21,7 @@ import { LATEST_EVENT_FORMAT, } from "../model.js";
 import { importOptmem } from "../optmem.js";
 import { createRelembra } from "../relembra.js";
 import { identityEgress, renderMemory } from "../render.js";
+import { OWNER_MODES } from "../sqlite/database.js";
 import { openSqliteStore } from "../sqlite/index.js";
 import { exportJsonl, importJsonl, MAX_IMPORT_BYTES } from "../transfer.js";
 import { flagValue, hasFlag, intFlag, parseArgs, wantsJson } from "./args.js";
@@ -38,10 +39,10 @@ const MAX_BUDGET = 1_000_000;
 const MAX_AGE_DAYS = 36_500;
 const MAX_SOURCES = 100;
 /** Reads the session's scope and the global one; writes, pins and owns the session's only. */
-function principalFor(scopes, trustCeiling) {
+function principalFor(env, scopes, trustCeiling) {
     const scope = scopes.session;
     return {
-        id: osUser(),
+        id: osUser(env),
         readable: scopes.global === undefined ? [scope] : [scope, scopes.global],
         writable: [scope],
         promotable: [],
@@ -57,8 +58,8 @@ function principalFor(scopes, trustCeiling) {
  * (`denied:above-ceiling`), as it would be without the owner's confirmation. Export needs
  * ownership only, not trust.
  */
-function transferPrincipal(scope) {
-    return principalFor({ session: scope }, "agent");
+function transferPrincipal(env, scope) {
+    return principalFor(env, { session: scope }, "agent");
 }
 function provenanceFrom(context) {
     const { parsed, env } = context;
@@ -189,7 +190,7 @@ function hookCommand() {
  * with harness `mcp` by default. Log lines go to stderr; stdout carries protocol messages only.
  */
 async function serveStdio(env, scopes, store) {
-    const principal = principalFor(scopes, "agent");
+    const principal = principalFor(env, scopes, "agent");
     const egress = identityEgress;
     const relembra = createRelembra({ store, policy: () => principal, egress });
     const pick = (variable, fallback) => variable === undefined || variable === "" ? fallback : variable;
@@ -249,7 +250,7 @@ async function runStoreCommand(context, scopes, store, path) {
     });
     const relembra = createRelembra({
         store,
-        policy: () => principalFor(scopes, ceiling),
+        policy: () => principalFor(context.env, scopes, ceiling),
         ...(maxAgeDays === undefined ? {} : { retention: [{ scope, maxAgeDays }] }),
     });
     switch (name) {
@@ -399,7 +400,7 @@ async function runStoreCommand(context, scopes, store, path) {
         case "check":
             return check(scope, store, path);
         case "export": {
-            const jsonl = await exportJsonl(store, transferPrincipal(scope), { scope });
+            const jsonl = await exportJsonl(store, transferPrincipal(context.env, scope), { scope });
             const [header, ...events] = jsonl
                 .split("\n")
                 .slice(0, -1)
@@ -412,7 +413,7 @@ async function runStoreCommand(context, scopes, store, path) {
                 throw usage("missing-argument", "import takes a file, or --optmem <dir>, not both");
             }
             const report = optmem === undefined
-                ? await importJsonl(store, transferPrincipal(scope), readImportFile(context, first))
+                ? await importJsonl(store, transferPrincipal(context.env, scope), readImportFile(context, first))
                 : await importFromOptmem(context, scope, store, optmem);
             return { data: report, text: reportText(report) };
         }
@@ -453,7 +454,7 @@ async function importFromOptmem(context, scope, store, dir) {
     }
     const log = readRegularFile(join(real, "LOG.txt"), "the OptMem log");
     const { agent, harness, model, host } = provenanceFrom(context);
-    return importOptmem(store, transferPrincipal(scope), {
+    return importOptmem(store, transferPrincipal(context.env, scope), {
         scope,
         store: createHash("sha256").update(real).digest("hex").slice(0, 16),
         log,
@@ -540,7 +541,7 @@ function parseSource(value) {
  */
 async function check(scope, store, path) {
     const homeMode = Number(lstatSync(dirname(path)).mode) & 0o777;
-    if ((homeMode & 0o077) !== 0) {
+    if (OWNER_MODES && (homeMode & 0o077) !== 0) {
         throw new CliError("store-file", "the store's directory grants group or others access", "mode");
     }
     const db = new DatabaseSync(path, { readOnly: true });
@@ -747,7 +748,7 @@ function fail(error, json, write) {
 }
 if (import.meta.main) {
     // Only the variables docs/CLI.md lists are read.
-    const { RELEMBRA_HOME, RELEMBRA_SCOPE, RELEMBRA_GLOBAL_SCOPE, RELEMBRA_AGENT, RELEMBRA_HARNESS, RELEMBRA_MODEL, BUN_OPTIONS, BUN_BYTECODE_ORDER_OUT, PATH, HOME, XDG_CONFIG_HOME, } = process.env;
+    const { RELEMBRA_HOME, RELEMBRA_SCOPE, RELEMBRA_GLOBAL_SCOPE, RELEMBRA_AGENT, RELEMBRA_HARNESS, RELEMBRA_MODEL, BUN_OPTIONS, BUN_BYTECODE_ORDER_OUT, PATH, HOME, XDG_CONFIG_HOME, SystemRoot, } = process.env;
     const env = {
         RELEMBRA_HOME,
         RELEMBRA_SCOPE,
@@ -760,6 +761,7 @@ if (import.meta.main) {
         PATH,
         HOME,
         XDG_CONFIG_HOME,
+        SystemRoot,
     };
     const code = await main(process.argv.slice(2), env, process.cwd(), process.execArgv);
     process.exitCode = code;

package/dist/cli/scope.d.ts

@@ -14,13 +14,15 @@ export interface CliEnv {
     readonly PATH?: string | undefined;
     readonly HOME?: string | undefined;
     readonly XDG_CONFIG_HOME?: string | undefined;
+    /** Windows only: the Windows folder, whose System32 holds whoami.exe; default `C:\Windows`. */
+    readonly SystemRoot?: string | undefined;
 }
 /**
  * The OS user, as `uid-<uid>`. Not the user name: Bun's os.userInfo().username reads $USER and
  * answers "unknown" when it is unset (measured on Bun 1.4.4; Node asks getpwuid), so a hook run
  * without USER would land in a second scope. The uid is the same in every environment.
  */
-export declare function osUser(): string;
+export declare function osUser(env: CliEnv): string;
 /** The store file: RELEMBRA_HOME/relembra.db, RELEMBRA_HOME defaulting to ~/.relembra. */
 export declare function storePath(env: CliEnv, cwd: string): string;
 /** The global scope RELEMBRA_GLOBAL_SCOPE names, checked like RELEMBRA_SCOPE; undefined unset. */

package/dist/cli/scope.js

@@ -2,21 +2,41 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { findGuardViolation } from "../guard.js";
 import { MAX_SCOPE_BYTES, utf8Bytes } from "../render.js";
+import { windowsUserSid } from "../sqlite/database.js";
 import { CliError } from "./errors.js";
 /**
  * The OS user, as `uid-<uid>`. Not the user name: Bun's os.userInfo().username reads $USER and
  * answers "unknown" when it is unset (measured on Bun 1.4.4; Node asks getpwuid), so a hook run
  * without USER would land in a second scope. The uid is the same in every environment.
  */
-export function osUser() {
+export function osUser(env) {
+    if (process.platform === "win32")
+        return windowsUser(env.SystemRoot);
     const uid = process.getuid?.();
     if (uid === undefined)
         throw new CliError("no-scope", "this platform has no OS user id");
     return `uid-${uid}`;
 }
+/**
+ * Windows has no uid: the user is `sid-<SID>`, the logon account's security identifier, which,
+ * like a uid, is one per account (`PC\alex` and `CORP\alex` differ) and survives a rename. It
+ * comes from the process token through whoami, never from os.userInfo(): Bun reads that from
+ * %USERNAME% on Windows (seen on the hosted runners), which the hook's `env -i` clears and any
+ * caller can set. An account whoami cannot name is refused, never mapped to a shared scope.
+ * windowsUserSid runs whoami once per process, though the policy builds a principal for every
+ * operation.
+ */
+function windowsUser(systemRoot) {
+    try {
+        return `sid-${windowsUserSid(systemRoot)}`;
+    }
+    catch {
+        throw new CliError("no-scope", "no scope: the OS did not name the user; set RELEMBRA_SCOPE");
+    }
+}
 /** The store file: RELEMBRA_HOME/relembra.db, RELEMBRA_HOME defaulting to ~/.relembra. */
 export function storePath(env, cwd) {
     const home = env.RELEMBRA_HOME;
@@ -46,7 +66,7 @@ export function resolveScope(env, cwd) {
     if (found === undefined)
         return global;
     const hash = createHash("sha256").update(found.key).digest("hex").slice(0, 16);
-    return checkScope(`${osUser()}/${found.name}-${hash}`);
+    return checkScope(`${osUser(env)}/${found.name}-${hash}`);
 }
 /**
  * The scopes the session reads (src/cli/wake.ts): its own (resolveScope) and the global scope
@@ -59,6 +79,9 @@ export function resolveScopes(env, cwd) {
     const global = resolveGlobalScope(env);
     return global === undefined || global === session ? { session } : { session, global };
 }
+const WINDOWS = process.platform === "win32";
+/** Git's file name: Windows runs only files named .exe. */
+const GIT = WINDOWS ? "git.exe" : "git";
 /** Git gets this long to answer each question before the scope is refused. */
 const GIT_TIMEOUT_MS = 2_000;
 /** Characters a path or URL from git may not hold: control characters, a newline among them. */
@@ -82,18 +105,20 @@ function hostGit(env, cwd) {
         if (dirname(dir) === dir)
             break;
     }
-    const inside = (dir) => fences.some((f) => dir === f || dir.startsWith(`${f}/`));
+    // Windows paths ignore case, so a fence compared by bytes would let C:\REPO\bin past C:\repo.
+    const fold = (path) => (WINDOWS ? path.toLowerCase() : path);
+    const inside = (dir) => fences.some((f) => fold(dir) === fold(f) || fold(dir).startsWith(fold(`${f}${sep}`)));
     const entries = (env.PATH ?? "")
-        .split(":")
+        .split(delimiter)
         .filter((entry) => isAbsolute(entry) && !inside(safeRealpath(entry)));
     for (const entry of entries) {
         try {
-            const candidate = realpathSync(join(entry, "git"));
+            const candidate = realpath(join(entry, GIT));
             if (inside(candidate))
                 continue;
             if (statSync(candidate).isFile()) {
                 accessSync(candidate, constants.X_OK);
-                return { git: candidate, path: entries.join(":") };
+                return { git: candidate, path: entries.join(delimiter) };
             }
         }
         catch {
@@ -217,6 +242,10 @@ export function normalizeRemote(url, base) {
         if (port === DEFAULT_PORTS[name])
             port = "";
     }
+    else if (WINDOWS && /^[A-Za-z]:[\\/]/.test(rest)) {
+        // A drive path, which git on Windows reads as local, never as an scp-like host "C".
+        return localKey(rest, base);
+    }
     else {
         // scp-like `[user@]host:path`, as git reads it: a colon before any slash.
         const scp = /^(?:[^@/]+@)?(\[[^\]]*\]|[^/:]+):(.*)$/.exec(rest);
@@ -259,15 +288,28 @@ function filePath(afterScheme) {
     if (UNSUPPORTED.test(path)) {
         throw new CliError("no-scope", "no scope: the origin's file URL decodes to a control character; set RELEMBRA_SCOPE", "unsupported-path");
     }
-    return path;
+    // On Windows a drive path is written /C:/x in the URL; the path is C:/x.
+    return WINDOWS && /^\/[A-Za-z]:\//.test(path) ? path.slice(1) : path;
 }
+/**
+ * The key of a local origin: `file:` and its real path, with forward slashes on Windows too, so
+ * the project name beside the hash is the last folder, never the whole path.
+ */
 function localKey(path, base) {
     const absolute = isAbsolute(path) ? path : resolve(base(), path);
-    return `file:${safeRealpath(absolute).replace(/(?<=.)\/+$/, "")}`;
+    const real = safeRealpath(absolute);
+    return `file:${(WINDOWS ? real.replaceAll("\\", "/") : real).replace(/(?<=.)\/+$/, "")}`;
+}
+/**
+ * The real path. On Windows the native call, which also gives the canonical case and long names,
+ * so one folder reached as C:\Repo and c:\repo is one project and one fence.
+ */
+function realpath(path) {
+    return WINDOWS ? realpathSync.native(path) : realpathSync(path);
 }
 function safeRealpath(path) {
     try {
-        return realpathSync(path);
+        return realpath(path);
     }
     catch {
         return resolve(path);

package/dist/sqlite/database.d.ts

@@ -30,12 +30,46 @@ export declare class StoreUnverifiedError extends Error {
 export declare function isBusy(error: unknown): boolean;
 /** Refuses a busy timeout that would make waits unbounded or meaningless. */
 export declare function checkBusyTimeout(busyTimeoutMs: number): number;
+/** Whether file modes say who may read a file: every platform but Windows. */
+export declare const OWNER_MODES: boolean;
 /**
  * Creates missing directories as 0700 and a missing file as 0600, then checks the files with
  * checkOwnerOnly. A symbolic link at the path is refused before anything is created, so no file
  * appears behind it.
  */
 export declare function createOwnerOnly(path: string): void;
+/**
+ * Windows' System32 folder under `systemRoot` (%SystemRoot%). An empty or relative value falls
+ * back to `C:\Windows`: a relative executable path would be resolved against the working
+ * directory, which may be a repository's.
+ */
+export declare function windowsSystem32(systemRoot: string | undefined): string;
+/**
+ * The logon account's SID, from the process token as whoami prints it. Thrown when none. The
+ * account cannot change while the process runs, so whoami runs once: the CLI's scope and a new
+ * store's ACL both ask.
+ */
+export declare function windowsUserSid(systemRoot: string | undefined): string;
+/**
+ * Windows: makes the current user the folder's owner, then replaces its ACL with full control for
+ * the user, SYSTEM and the Administrators group only, inherited by everything in it. An owner may
+ * always rewrite an ACL, so a folder another account made would otherwise give that account its
+ * access back; `/setowner` fails, and no store is created, unless the user may take ownership.
+ * `/inheritance:r` with the three `/grant:r` then drops what the folder inherited, in one change
+ * that never widens access: another process may already have made the store here (two first
+ * opens at once), and a step that restored the parent's grants, as `/reset` does, would let the
+ * store inherit them for a moment. An explicit grant to anyone else is refused, not dropped: the
+ * ACL is read back and must hold one entry per account in storeFolderAccounts, and no other.
+ * Accounts are named by SID, so no account name or system language is involved. Any failure is
+ * thrown: a store is never created in a folder others may read.
+ */
+export declare function restrictFolderToOwner(dir: string): void;
+/**
+ * The accounts a store folder grants full control: the user, SYSTEM and Administrators, each once.
+ * A process running as LocalSystem is SYSTEM itself, so its folder holds two entries; counting
+ * three would let a foreign grant pass as the third.
+ */
+export declare function storeFolderAccounts(userSid: string): string[];
 /**
  * The store file must exist. It and any -wal or -shm file must be regular files (lstat never
  * follows a symbolic link) that grant group and others nothing. A loose file is refused, never

package/dist/sqlite/database.js

@@ -1,11 +1,15 @@
-import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync } from "node:fs";
-import { dirname } from "node:path";
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { closeSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, win32 } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
 import { StoreBusyError } from "../errors.js";
 import { MIGRATIONS, migrate, SchemaTooNewError, schemaVersion } from "./migrations.js";
 export { StoreBusyError };
 import { walImage } from "./wal-image.js";
+import { chainRefusal, storeFolderChain, trustedAccounts, } from "./windows-acl.js";
 /** Thrown when an existing store file, or its -wal or -shm file, grants group or others access. */
 export class StoreFileModeError extends Error {
     name = "StoreFileModeError";
@@ -52,6 +56,8 @@ export function checkBusyTimeout(busyTimeoutMs) {
     }
     return busyTimeoutMs;
 }
+/** Whether file modes say who may read a file: every platform but Windows. */
+export const OWNER_MODES = process.platform !== "win32";
 /**
  * Creates missing directories as 0700 and a missing file as 0600, then checks the files with
  * checkOwnerOnly. A symbolic link at the path is refused before anything is created, so no file
@@ -61,6 +67,21 @@ export function createOwnerOnly(path) {
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     if (isSymbolicLink(path))
         throw new StoreFileTypeError(path);
+    // Windows ignores the modes: before a new store's first byte, its folder gets an ACL of its own,
+    // so the store and the -wal and -shm files SQLite makes beside it inherit owner-only access.
+    if (!OWNER_MODES && !existsSync(path)) {
+        restrictFolderToOwner(dirname(path));
+        // A sidecar without its store was put there by someone: it keeps its own ACL, and Windows
+        // opens a file by its full path whatever the folder grants, so SQLite would write into a file
+        // another account can read. Checked after the ACL, when no other account can add one. A
+        // sidecar beside a store that exists by now belongs to another process that created the
+        // store first (its folder got the same three grants), so it is no plant.
+        for (const sidecar of [`${path}-wal`, `${path}-shm`, `${path}-journal`]) {
+            if (hasEntry(sidecar) && !hasEntry(path)) {
+                throw new Error(`${sidecar} exists without its store; no store is created beside it`);
+            }
+        }
+    }
     try {
         // O_EXCL never follows a link, so a link made since the check fails here with EEXIST.
         closeSync(openSync(path, "wx", 0o600));
@@ -71,6 +92,185 @@ export function createOwnerOnly(path) {
     }
     checkOwnerOnly(path);
 }
+/**
+ * Windows' System32 folder under `systemRoot` (%SystemRoot%). An empty or relative value falls
+ * back to `C:\Windows`: a relative executable path would be resolved against the working
+ * directory, which may be a repository's.
+ */
+export function windowsSystem32(systemRoot) {
+    const root = systemRoot !== undefined && win32.isAbsolute(systemRoot) && /^[A-Za-z]:/.test(systemRoot)
+        ? systemRoot
+        : "C:\\Windows";
+    return win32.join(root, "System32");
+}
+/** Runs a System32 tool; any failure is thrown with its output. */
+function runSystemTool(systemRoot, exe, args) {
+    const result = spawnSync(win32.join(windowsSystem32(systemRoot), exe), args, {
+        encoding: "utf8",
+        shell: false,
+        windowsHide: true,
+        timeout: 10_000,
+    });
+    if (result.status !== 0) {
+        throw new Error(`${exe} failed (exit ${result.status}): ${result.stderr || result.stdout}`);
+    }
+    return result.stdout;
+}
+let userSid;
+/**
+ * The logon account's SID, from the process token as whoami prints it. Thrown when none. The
+ * account cannot change while the process runs, so whoami runs once: the CLI's scope and a new
+ * store's ACL both ask.
+ */
+export function windowsUserSid(systemRoot) {
+    if (userSid !== undefined)
+        return userSid;
+    // `"HOST\user","S-1-5-21-..."`: the SID is the last quoted field.
+    const printed = runSystemTool(systemRoot, "whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+    const sid = /"(S-1-[0-9-]+)"\s*$/.exec(printed)?.[1];
+    if (sid === undefined)
+        throw new Error("whoami did not print the user's SID");
+    userSid = sid;
+    return sid;
+}
+/**
+ * Windows: makes the current user the folder's owner, then replaces its ACL with full control for
+ * the user, SYSTEM and the Administrators group only, inherited by everything in it. An owner may
+ * always rewrite an ACL, so a folder another account made would otherwise give that account its
+ * access back; `/setowner` fails, and no store is created, unless the user may take ownership.
+ * `/inheritance:r` with the three `/grant:r` then drops what the folder inherited, in one change
+ * that never widens access: another process may already have made the store here (two first
+ * opens at once), and a step that restored the parent's grants, as `/reset` does, would let the
+ * store inherit them for a moment. An explicit grant to anyone else is refused, not dropped: the
+ * ACL is read back and must hold one entry per account in storeFolderAccounts, and no other.
+ * Accounts are named by SID, so no account name or system language is involved. Any failure is
+ * thrown: a store is never created in a folder others may read.
+ */
+export function restrictFolderToOwner(dir) {
+    // icacls follows a junction or symbolic link: the owner and ACL of its target would change.
+    if (lstatSync(dir).isSymbolicLink())
+        throw new Error(`${dir} is a link; no store is created in it`);
+    const systemRoot = process.env["SystemRoot"];
+    const sid = windowsUserSid(systemRoot);
+    checkFolderChain(systemRoot, dir, sid);
+    const accounts = storeFolderAccounts(sid);
+    runSystemTool(systemRoot, "icacls.exe", [dir, "/setowner", `*${sid}`]);
+    runSystemTool(systemRoot, "icacls.exe", [
+        dir,
+        "/inheritance:r",
+        ...accounts.flatMap((who) => ["/grant:r", `*${who}:(OI)(CI)F`]),
+    ]);
+    // icacls prints one `name:(flags)` entry per line; the path, on the first, holds no `:(`.
+    const entries = runSystemTool(systemRoot, "icacls.exe", [dir])
+        .split(/\r?\n/)
+        .filter((line) => line.includes(":("));
+    if (entries.length !== accounts.length) {
+        throw new Error(`${dir} grants another account access (${entries.length} entries, not ${accounts.length}); no store is created in it: remove those grants or use another folder`);
+    }
+}
+/**
+ * Windows: refuses a store folder whose path another account could change (docs/specs/w-nv1/spec.md).
+ * The ACL steps work on the folder's path, so they hold only while no other account can rename,
+ * delete or re-permission a folder above it, make the store folder first, or open it before its
+ * ACL is set. Every folder from the store folder's parent up to the drive root, on the path as
+ * given (storeFolderChain), is read as SDDL with `icacls /save`, which names accounts by SID, and
+ * judged by chainRefusal. A link on the path is refused: icacls would read its target, and whoever
+ * may change the link may point it elsewhere. Owners are not read, since no stock tool prints one
+ * as a SID: an ancestor another account owns, whose access list does not name that account, is
+ * not detected.
+ */
+function checkFolderChain(systemRoot, dir, sid) {
+    const folders = storeFolderChain(dir);
+    for (const folder of folders) {
+        if (lstatSync(folder).isSymbolicLink()) {
+            throw new Error(`${folder} is a link; no store is created under it: use a path without links`);
+        }
+    }
+    if (folders.length === 0)
+        return;
+    const chain = [];
+    const scratch = privateScratch(systemRoot, sid);
+    try {
+        for (const [index, folder] of folders.entries()) {
+            chain.push({
+                path: folder,
+                dacl: savedDacl(systemRoot, folder, scratch),
+                holdsStoreFolder: index === 0,
+            });
+        }
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+    const refusal = chainRefusal(chain, trustedAccounts(sid));
+    if (refusal !== undefined) {
+        throw new Error(`${refusal}; no store is created under it: remove that grant or keep the store in a folder only you can change, such as your profile`);
+    }
+}
+/**
+ * A folder under TEMP for the `icacls /save` files the chain check trusts, with the store
+ * folder's own ACL: owned by the user, and full control for the user, SYSTEM and Administrators
+ * only, read back on stdout. Bun's mkdtemp already gives it those three entries, explicit; Node's
+ * gives it TEMP's inherited ACL until these steps. Each file gets a random name, so no account can
+ * make one first. The steps act on the folder's path after it exists, so TEMP is trusted for what
+ * they cannot see (docs/specs/w-nv1/spec.md): it must give other accounts no inherited access to
+ * folders made in it (a handle opened before these steps keeps its access, and could turn the
+ * folder into a junction), must not let them delete or rename its entries, and must not be theirs.
+ * The default, under the user's profile, meets that.
+ */
+function privateScratch(systemRoot, sid) {
+    const scratch = mkdtempSync(join(tmpdir(), "relembra-acl-"));
+    try {
+        const accounts = storeFolderAccounts(sid);
+        runSystemTool(systemRoot, "icacls.exe", [scratch, "/setowner", `*${sid}`]);
+        runSystemTool(systemRoot, "icacls.exe", [
+            scratch,
+            "/inheritance:r",
+            ...accounts.flatMap((who) => ["/grant:r", `*${who}:(OI)(CI)F`]),
+        ]);
+        const entries = runSystemTool(systemRoot, "icacls.exe", [scratch])
+            .split(/\r?\n/)
+            .filter((line) => line.includes(":("));
+        if (entries.length !== accounts.length) {
+            throw new Error(`${scratch} grants another account access (${entries.length} entries, not ${accounts.length}); no store is created: point TEMP at a folder only you can change`);
+        }
+        return scratch;
+    }
+    catch (error) {
+        rmSync(scratch, { recursive: true, force: true });
+        throw error;
+    }
+}
+/**
+ * A folder's access list as SDDL. `icacls <folder> /save <file>` writes the folder's name on one
+ * line (none for a drive root) and its access list on the next, in UTF-16 or the console's
+ * encoding; parseDacl drops the SACL that follows it on that line.
+ */
+function savedDacl(systemRoot, folder, scratch) {
+    // A fresh random name for each save, so no account can make the file first.
+    const file = join(scratch, randomBytes(16).toString("hex"));
+    runSystemTool(systemRoot, "icacls.exe", [folder, "/save", file]);
+    const bytes = readFileSync(file);
+    const utf16 = (bytes[0] === 0xff && bytes[1] === 0xfe) || bytes[1] === 0;
+    const lines = (utf16 ? bytes.toString("utf16le") : bytes.toString("utf8"))
+        .replace(/^\uFEFF/, "")
+        .split(/\r?\n/)
+        .filter((line) => line.trim() !== "");
+    // A drive root has no name, so its file holds the access list alone.
+    const dacl = lines.at(-1);
+    if (lines.length > 2 || dacl === undefined || !dacl.startsWith("D:")) {
+        throw new Error(`icacls /save did not write one access list for ${folder}: ${lines.join(" | ")}`);
+    }
+    return dacl.trim();
+}
+/**
+ * The accounts a store folder grants full control: the user, SYSTEM and Administrators, each once.
+ * A process running as LocalSystem is SYSTEM itself, so its folder holds two entries; counting
+ * three would let a foreign grant pass as the third.
+ */
+export function storeFolderAccounts(userSid) {
+    return [...new Set([userSid, "S-1-5-18", "S-1-5-32-544"])];
+}
 /**
  * The store file must exist. It and any -wal or -shm file must be regular files (lstat never
  * follows a symbolic link) that grant group and others nothing. A loose file is refused, never
@@ -90,9 +290,14 @@ export function checkOwnerOnly(path) {
         }
         if (!stats.isFile())
             throw new StoreFileTypeError(file);
-        const mode = Number(stats.mode) & 0o777;
-        if ((mode & 0o077) !== 0)
-            throw new StoreFileModeError(file, mode);
+        // Windows has no mode bits: Node and Bun report 0o666 for every writable file, whatever its
+        // access control list grants. There the store relies on its folder's ACL, which under the
+        // user profile grants only the user, SYSTEM and Administrators (docs/CLI.md, Windows).
+        if (OWNER_MODES) {
+            const mode = Number(stats.mode) & 0o777;
+            if ((mode & 0o077) !== 0)
+                throw new StoreFileModeError(file, mode);
+        }
     }
 }
 function isSymbolicLink(path) {
@@ -105,6 +310,18 @@ function isSymbolicLink(path) {
         throw error;
     }
 }
+/** Whether a directory entry exists at `path`: a link counts, even one whose target is missing. */
+function hasEntry(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
 /**
  * True for SQLITE_CANTOPEN (14) and SQLITE_READONLY (8), with their extended codes: what a
  * read-only connection answers when only a write-capable one could proceed, for example
@@ -150,6 +367,11 @@ function isTorn(error) {
 function readOnlySchemaVersion(path, busyTimeoutMs) {
     const deadline = Date.now() + busyTimeoutMs;
     for (let delay = 1;; delay = Math.min(delay * 2, 32)) {
+        // A -wal without its -shm: only a writer could rebuild the index, so the version comes from
+        // the image straight away. A read-only connection would refuse it on POSIX, but on Windows it
+        // creates the -shm or answers SQLITE_PROTOCOL.
+        if (existsSync(`${path}-wal`) && !existsSync(`${path}-shm`))
+            return imageSchemaVersion(path);
         const sidecars = existsSync(`${path}-wal`) || existsSync(`${path}-shm`);
         const parameters = sidecars ? "mode=ro&readonly_shm=1" : "mode=ro&immutable=1";
         let db;

package/dist/sqlite/windows-acl.d.ts

@@ -0,0 +1,44 @@
+/** One access control entry, as the rules need it. */
+export interface Ace {
+    readonly allow: boolean;
+    /** The entry is only inherited: it gives the folder itself nothing. */
+    readonly inheritOnly: boolean;
+    /** Subfolders inherit the entry. */
+    readonly containerInherit: boolean;
+    readonly mask: number;
+    /** A SID, or an SDDL alias this module does not resolve (domain-relative ones: never trusted). */
+    readonly sid: string;
+}
+/** A folder on the path to the store folder, with its access list as `icacls /save` writes it. */
+export interface ChainFolder {
+    readonly path: string;
+    readonly dacl: string;
+    /** The folder the store folder is made in. */
+    readonly holdsStoreFolder: boolean;
+}
+/**
+ * The accounts whose rights on the chain refuse nothing: the user, SYSTEM, Administrators,
+ * TrustedInstaller, and CREATOR OWNER, which stands for whoever makes the folder, here the user.
+ * SDDL writes the built-in Administrator account (RID 500) as `LA`; it is the user only when the
+ * user is that account.
+ */
+export declare function trustedAccounts(userSid: string): ReadonlySet<string>;
+/**
+ * The entries of an SDDL access list (`D:` and its flags, then one parenthesised entry each), or
+ * null for a null DACL, which grants everyone everything. Anything this parser does not know is
+ * thrown, never skipped: a skipped entry could be the one that grants another account access.
+ */
+export declare function parseDacl(sddl: string): Ace[] | null;
+/**
+ * The folders whose access lists decide whether the store folder's path holds: its parent up to
+ * the drive root, written as given (an 8.3 short name stays short). Never the canonical path: a
+ * folder on this path that another account may swap would go unread, and the ACL steps use this
+ * path. Every folder here is read where it lies, so no other account can rename or replace one
+ * without a right the rules see: DELETE on it, or DELETE_CHILD on the folder above.
+ */
+export declare function storeFolderChain(storeFolder: string): string[];
+/**
+ * Why another account could change the path to the store folder, or undefined when none could.
+ * R1 to R4 are the rules of docs/specs/w-nv1/spec.md; the first folder that breaks one is named.
+ */
+export declare function chainRefusal(chain: readonly ChainFolder[], trusted: ReadonlySet<string>): string | undefined;

package/dist/sqlite/windows-acl.js

@@ -0,0 +1,236 @@
+/**
+ * Whether another account could change the folders that hold a Windows store folder, read from
+ * their access lists as SDDL (docs/specs/w-nv1/spec.md). relembra secures a new store's folder by
+ * its path, which holds only while no other account can rename, delete, re-permission or pre-create
+ * a folder on that path, or open the new folder before its ACL is set. Pure: the caller reads the
+ * access lists with icacls.
+ */
+import { win32 } from "node:path";
+const EVERYONE = "S-1-1-0";
+const SYSTEM = "S-1-5-18";
+const ADMINISTRATORS = "S-1-5-32-544";
+const CREATOR_OWNER = "S-1-3-0";
+const TRUSTED_INSTALLER = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464";
+/** The well-known SDDL SID aliases whose SID does not depend on a domain. */
+const ALIASES = {
+    AC: "S-1-15-2-1",
+    AN: "S-1-5-7",
+    AO: "S-1-5-32-548",
+    AU: "S-1-5-11",
+    BA: ADMINISTRATORS,
+    BG: "S-1-5-32-546",
+    BO: "S-1-5-32-551",
+    BU: "S-1-5-32-545",
+    CG: "S-1-3-1",
+    CO: CREATOR_OWNER,
+    ED: "S-1-5-9",
+    IU: "S-1-5-4",
+    LS: "S-1-5-19",
+    NO: "S-1-5-32-556",
+    NS: "S-1-5-20",
+    NU: "S-1-5-2",
+    OW: "S-1-3-4",
+    PS: "S-1-5-10",
+    PU: "S-1-5-32-547",
+    RC: "S-1-5-12",
+    RD: "S-1-5-32-555",
+    RU: "S-1-5-32-554",
+    SO: "S-1-5-32-549",
+    SU: "S-1-5-6",
+    SY: SYSTEM,
+    WD: EVERYONE,
+    WR: "S-1-5-33",
+};
+/** SDDL's two-letter access rights. */
+const RIGHTS = {
+    GA: 0x10000000,
+    GX: 0x20000000,
+    GW: 0x40000000,
+    GR: 0x80000000,
+    RC: 0x20000,
+    SD: 0x10000,
+    WD: 0x40000,
+    WO: 0x80000,
+    FA: 0x1f01ff,
+    FR: 0x120089,
+    FW: 0x120116,
+    FX: 0x1200a0,
+    KA: 0xf003f,
+    KR: 0x20019,
+    KW: 0x20006,
+    KX: 0x20019,
+    CC: 0x1,
+    DC: 0x2,
+    LC: 0x4,
+    SW: 0x8,
+    RP: 0x10,
+    WP: 0x20,
+    DT: 0x40,
+    LO: 0x80,
+    CR: 0x100,
+};
+const FLAGS = new Set(["OI", "CI", "NP", "IO", "ID", "SA", "FA", "TP", "CR"]);
+const ALLOW_TYPES = new Set(["A", "XA", "OA", "ZA"]);
+const DENY_TYPES = new Set(["D", "XD", "OD"]);
+/** Entry types that may end in a condition; their allow ones count as unconditional here. */
+const CALLBACK_TYPES = new Set(["XA", "XD", "ZA"]);
+const GUID = /^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$/;
+const DELETE = 0x10000;
+const WRITE_DAC = 0x40000;
+const WRITE_OWNER = 0x80000;
+const DELETE_CHILD = 0x40;
+const ADD_SUBDIRECTORY = 0x4;
+const GENERIC_ALL = 0x10000000;
+const GENERIC_WRITE = 0x40000000;
+/** Read and execute: list, read attributes and the access list, traverse, synchronize. */
+const READ_EXECUTE = 0x1200a9 | 0x80000000 | 0x20000000;
+/**
+ * The accounts whose rights on the chain refuse nothing: the user, SYSTEM, Administrators,
+ * TrustedInstaller, and CREATOR OWNER, which stands for whoever makes the folder, here the user.
+ * SDDL writes the built-in Administrator account (RID 500) as `LA`; it is the user only when the
+ * user is that account.
+ */
+export function trustedAccounts(userSid) {
+    const trusted = new Set([userSid, SYSTEM, ADMINISTRATORS, TRUSTED_INSTALLER, CREATOR_OWNER]);
+    if (/^S-1-5-21-[0-9-]+-500$/.test(userSid))
+        trusted.add("LA");
+    return trusted;
+}
+/**
+ * The entries of an SDDL access list (`D:` and its flags, then one parenthesised entry each), or
+ * null for a null DACL, which grants everyone everything. Anything this parser does not know is
+ * thrown, never skipped: a skipped entry could be the one that grants another account access.
+ */
+export function parseDacl(sddl) {
+    const body = /^D:((?:P|AI|AR|NO_ACCESS_CONTROL)*)(.*)$/s.exec(sddl.trim());
+    if (body === null)
+        throw new Error(`not an SDDL access list: ${sddl}`);
+    const [, controlFlags = "", rest = ""] = body;
+    if (controlFlags.includes("NO_ACCESS_CONTROL"))
+        return null;
+    const aces = [];
+    let index = 0;
+    while (index < rest.length) {
+        // `icacls /save` writes the SACL, the mandatory label, on the same line: it ends the DACL.
+        if (rest.startsWith("S:", index))
+            break;
+        if (rest[index] !== "(")
+            throw new Error(`unexpected text in access list: ${rest.slice(index)}`);
+        // A conditional entry holds parentheses of its own, so the entry ends where depth returns to 0,
+        // counting none inside a quoted string, which SDDL delimits with `"` and never escapes.
+        let depth = 0;
+        let quoted = false;
+        let end = index;
+        for (; end < rest.length; end++) {
+            const char = rest[end];
+            if (char === '"')
+                quoted = !quoted;
+            else if (quoted)
+                continue;
+            else if (char === "(")
+                depth++;
+            else if (char === ")" && --depth === 0)
+                break;
+        }
+        if (depth !== 0 || quoted) {
+            throw new Error(`unclosed entry in access list: ${rest.slice(index)}`);
+        }
+        aces.push(parseAce(rest.slice(index + 1, end)));
+        index = end + 1;
+    }
+    return aces;
+}
+function parseAce(text) {
+    const fields = text.split(";");
+    const [type = "", flags = "", rights = "", objectGuid = "", inheritGuid = "", sid = ""] = fields;
+    const allow = ALLOW_TYPES.has(type);
+    if (!allow && !DENY_TYPES.has(type))
+        throw new Error(`unknown access entry type: (${text})`);
+    // Only a callback entry may carry a condition, its seventh field; its text may hold `;` and
+    // quotes of its own. Every other field is checked, so no quote can hide in one.
+    const condition = fields.slice(6).join(";");
+    const conditionOk = CALLBACK_TYPES.has(type)
+        ? fields.length === 6 || (condition.startsWith("(") && condition.endsWith(")"))
+        : fields.length === 6;
+    if (fields.length < 6 || !conditionOk)
+        throw new Error(`malformed access entry: (${text})`);
+    if (![objectGuid, inheritGuid].every((guid) => guid === "" || GUID.test(guid))) {
+        throw new Error(`malformed GUID in access entry: (${text})`);
+    }
+    const flagList = flags.match(/../g) ?? [];
+    if (flagList.join("") !== flags || flagList.some((flag) => !FLAGS.has(flag))) {
+        throw new Error(`unknown access entry flags: (${text})`);
+    }
+    if (!/^(S-1-[0-9-]+|[A-Z]{2})$/.test(sid))
+        throw new Error(`unknown SID in access entry: (${text})`);
+    return {
+        allow,
+        inheritOnly: flagList.includes("IO"),
+        containerInherit: flagList.includes("CI"),
+        mask: parseRights(rights, text),
+        sid: ALIASES[sid] ?? sid,
+    };
+}
+function parseRights(rights, text) {
+    if (/^0x[0-9a-fA-F]+$/.test(rights))
+        return Number.parseInt(rights.slice(2), 16);
+    const letters = rights.match(/../g) ?? [];
+    if (letters.length === 0 || letters.join("") !== rights) {
+        throw new Error(`unknown access rights: (${text})`);
+    }
+    let mask = 0;
+    for (const letter of letters) {
+        const right = RIGHTS[letter];
+        if (right === undefined)
+            throw new Error(`unknown access right ${letter}: (${text})`);
+        // Rights above bit 30 make a JavaScript bitwise result negative, so they are added.
+        mask = (mask | right) >>> 0;
+    }
+    return mask;
+}
+/**
+ * The folders whose access lists decide whether the store folder's path holds: its parent up to
+ * the drive root, written as given (an 8.3 short name stays short). Never the canonical path: a
+ * folder on this path that another account may swap would go unread, and the ACL steps use this
+ * path. Every folder here is read where it lies, so no other account can rename or replace one
+ * without a right the rules see: DELETE on it, or DELETE_CHILD on the folder above.
+ */
+export function storeFolderChain(storeFolder) {
+    const chain = [];
+    let folder = win32.resolve(storeFolder);
+    for (let up = win32.dirname(folder); up !== folder; up = win32.dirname(folder)) {
+        chain.push(up);
+        folder = up;
+    }
+    return chain;
+}
+/**
+ * Why another account could change the path to the store folder, or undefined when none could.
+ * R1 to R4 are the rules of docs/specs/w-nv1/spec.md; the first folder that breaks one is named.
+ */
+export function chainRefusal(chain, trusted) {
+    for (const folder of chain) {
+        const aces = parseDacl(folder.dacl) ?? [
+            { allow: true, inheritOnly: false, containerInherit: true, mask: 0x1f01ff, sid: EVERYONE },
+        ];
+        for (const ace of aces) {
+            if (!ace.allow || trusted.has(ace.sid))
+                continue;
+            const refuse = (what) => `${folder.path} lets another account (${ace.sid}) ${what}`;
+            const own = ace.inheritOnly ? 0 : ace.mask;
+            if (own & (DELETE | WRITE_DAC | WRITE_OWNER | GENERIC_ALL)) {
+                return refuse("rename, delete or re-permission it");
+            }
+            if (own & DELETE_CHILD)
+                return refuse("rename or delete the folders in it");
+            if (!folder.holdsStoreFolder)
+                continue;
+            if (own & (ADD_SUBDIRECTORY | GENERIC_WRITE))
+                return refuse("create the store folder first");
+            if (ace.containerInherit && (ace.mask & ~READ_EXECUTE) >>> 0 !== 0) {
+                return refuse("open the new store folder before its ACL is set");
+            }
+        }
+    }
+    return undefined;
+}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
 /** This relembra's version, as package.json gives it. An export's header carries it. */
-export declare const RELEMBRA_VERSION = "1.0.0-beta.1";
+export declare const RELEMBRA_VERSION = "1.0.0-beta.3";

package/dist/version.js

@@ -1,2 +1,2 @@
 /** This relembra's version, as package.json gives it. An export's header carries it. */
-export const RELEMBRA_VERSION = "1.0.0-beta.1";
+export const RELEMBRA_VERSION = "1.0.0-beta.3";

package/docs/FORMAT.md

@@ -1,6 +1,6 @@
 # relembra storage format
 
-Status: event formats 1 and 2, SQLite schema version 6, Postgres schema version 3. Release 1.0.0-beta.1.
+Status: event formats 1 and 2, SQLite schema version 6, Postgres schema version 3. Release 1.0.0-beta.3.
 
 This document is the contract for what relembra stores. A reader that follows it needs no
 relembra code.
@@ -175,7 +175,7 @@ the events above, so a reader needs only this document.
 |---|---|---|
 | `export` | string | Always `relembra`. What makes the file an export. |
 | `format` | integer | The newest event format of the lines after it: `1` when none is a `promote` line, so a format 1 reader still reads the file, and `2` when one is. |
-| `relembra` | string | The relembra version that wrote the file, such as `1.0.0-beta.1`. Informational: a reader decides by `format` alone. |
+| `relembra` | string | The relembra version that wrote the file, such as `1.0.0-beta.3`. Informational: a reader decides by `format` alone. |
 | `scopes` | array of strings | The scopes exported. Every event's `scope` is one of them. |
 
 ### Events (lines 2 onward)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relembra",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.3",
   "description": "A curated, scoped, bounded, durable, erasable and measured memory for AI agents.",
   "license": "MIT",
   "author": "mneves75",