valija 0.1.0

package/dist/program.js

@@ -0,0 +1,1527 @@
+#!/usr/bin/env node
+
+// src/delivery/cli/program.ts
+import { Command } from "commander";
+
+// src/delivery/container.ts
+import { ulid } from "ulid";
+
+// src/shared/domain/result.ts
+var ok = (value) => ({ ok: true, value });
+var err = (error) => ({ ok: false, error });
+var DomainError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "DomainError";
+  }
+  code;
+};
+
+// src/context/domain/errors.ts
+var contextErr = (code, message) => err(new DomainError(code, message));
+
+// src/context/domain/values/project-name.ts
+var PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+function parseProjectName(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (!PATTERN.test(normalized)) {
+    return contextErr(
+      "INVALID_PROJECT_NAME",
+      `Project name must be 1-64 chars of [a-z0-9-], starting with a letter or digit. Got: "${raw}"`
+    );
+  }
+  return ok(normalized);
+}
+
+// src/context/application/export-pack.ts
+var ExportPack = class {
+  constructor(sessions, getContextPack) {
+    this.sessions = sessions;
+    this.getContextPack = getContextPack;
+  }
+  sessions;
+  getContextPack;
+  execute(project, format) {
+    if (format === "md") {
+      const pack = this.getContextPack.execute({ project, budgetTokens: Number.MAX_SAFE_INTEGER });
+      return pack.ok ? ok(pack.value.markdown) : pack;
+    }
+    const name = parseProjectName(project);
+    if (!name.ok) return name;
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      const found = session.value.projects.findByName(name.value);
+      if (found === null) {
+        return contextErr("PROJECT_NOT_FOUND", `No project named "${name.value}".`);
+      }
+      const items = session.value.items.findByProject(found.id).map((item) => ({
+        id: item.id,
+        type: item.type,
+        content: item.content,
+        tags: item.tags,
+        pinned: item.pinned,
+        source: item.source ?? null,
+        createdAt: item.createdAt.toISOString()
+      }));
+      return ok(JSON.stringify({ project: name.value, items }, null, 2));
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/context/application/get-context-pack.ts
+var DEFAULT_BUDGET_TOKENS = 4e3;
+var estimateTokens = (text) => Math.ceil(text.length / 4);
+var SECTION_ORDER = ["decision", "preference", "progress", "fact"];
+var SECTION_LABELS = {
+  decision: "Decisions",
+  preference: "Preferences",
+  progress: "Progress",
+  fact: "Facts"
+};
+var renderItem = (item) => {
+  const date = item.createdAt.toISOString().slice(0, 10);
+  const tags = item.tags.length > 0 ? ` \xB7 ${item.tags.map((t) => `#${t}`).join(" ")}` : "";
+  return `### ${item.type} \xB7 ${date}${tags}
+
+${item.content}
+`;
+};
+var GetContextPack = class {
+  constructor(sessions, clock) {
+    this.sessions = sessions;
+    this.clock = clock;
+  }
+  sessions;
+  clock;
+  execute(input) {
+    const name = parseProjectName(input.project);
+    if (!name.ok) return name;
+    const budget = input.budgetTokens ?? DEFAULT_BUDGET_TOKENS;
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      const project = session.value.projects.findByName(name.value);
+      if (project === null) {
+        return contextErr("PROJECT_NOT_FOUND", `No project named "${name.value}".`);
+      }
+      const all = session.value.items.findByProject(project.id);
+      const included = /* @__PURE__ */ new Set();
+      const parts = [];
+      let used = 0;
+      const header = `# Context pack: ${name.value}
+
+> ${all.length} items in vault \xB7 generated ${this.clock.now().toISOString()}
+`;
+      used += estimateTokens(header);
+      const pinned = all.filter((i) => i.pinned);
+      const pinnedKept = [];
+      for (const item of pinned) {
+        const cost = estimateTokens(renderItem(item));
+        if (pinnedKept.length > 0 && used + cost > budget) break;
+        pinnedKept.push(item);
+        used += cost;
+      }
+      if (pinnedKept.length > 0) {
+        parts.push("\n## Pinned\n");
+        for (const item of pinnedKept) {
+          parts.push(renderItem(item));
+          included.add(item.id);
+        }
+      }
+      const handoff = all.find((i) => i.type === "handoff" && !included.has(i.id));
+      if (handoff) {
+        const rendered = renderItem(handoff);
+        const cost = estimateTokens(rendered);
+        if (used + cost <= budget) {
+          parts.push("\n## Latest handoff\n", rendered);
+          included.add(handoff.id);
+          used += cost;
+        }
+      }
+      for (const type of SECTION_ORDER) {
+        const items = all.filter((i) => i.type === type && !included.has(i.id));
+        let sectionOpened = false;
+        for (const item of items) {
+          const rendered = renderItem(item);
+          const sectionHeader = sectionOpened ? "" : `
+## ${SECTION_LABELS[type]}
+`;
+          const cost = estimateTokens(sectionHeader + rendered);
+          if (used + cost > budget) break;
+          if (!sectionOpened) {
+            parts.push(sectionHeader);
+            sectionOpened = true;
+          }
+          parts.push(rendered);
+          included.add(item.id);
+          used += cost;
+        }
+      }
+      const markdown = header + parts.join("\n");
+      return ok({
+        markdown,
+        includedCount: included.size,
+        totalCount: all.length,
+        estimatedTokens: estimateTokens(markdown)
+      });
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/context/application/list-projects.ts
+var ListProjects = class {
+  constructor(sessions) {
+    this.sessions = sessions;
+  }
+  sessions;
+  execute() {
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      const entries = session.value.projects.list().map((summary) => ({
+        name: summary.project.name,
+        ...summary.project.description === void 0 ? {} : { description: summary.project.description },
+        itemCount: summary.itemCount,
+        lastActivityAt: summary.lastActivityAt?.toISOString() ?? null
+      }));
+      return ok(entries);
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/context/domain/entities/context-item.ts
+var MAX_CONTENT_BYTES = 32 * 1024;
+function validateContent(content) {
+  const trimmed = content.trim();
+  if (trimmed.length === 0) {
+    return contextErr("CONTENT_EMPTY", "Content must not be empty.");
+  }
+  const bytes = new TextEncoder().encode(trimmed).length;
+  if (bytes > MAX_CONTENT_BYTES) {
+    return contextErr(
+      "CONTENT_TOO_LARGE",
+      `Content is ${bytes} bytes; the maximum is ${MAX_CONTENT_BYTES} (32 KB). Distill it.`
+    );
+  }
+  return ok(trimmed);
+}
+
+// src/context/domain/values/item-type.ts
+var ITEM_TYPES = ["decision", "progress", "preference", "fact", "handoff"];
+function parseItemType(raw) {
+  if (ITEM_TYPES.includes(raw)) {
+    return ok(raw);
+  }
+  return contextErr(
+    "INVALID_ITEM_TYPE",
+    `Item type must be one of ${ITEM_TYPES.join(", ")}. Got: "${raw}"`
+  );
+}
+
+// src/context/domain/values/tag.ts
+var PATTERN2 = /^[a-z0-9][a-z0-9-]{0,31}$/;
+var MAX_TAGS = 10;
+function parseTag(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (!PATTERN2.test(normalized)) {
+    return contextErr("INVALID_TAG", `Tag must be 1-32 chars of [a-z0-9-]. Got: "${raw}"`);
+  }
+  return ok(normalized);
+}
+function parseTags(raw) {
+  if (raw.length > MAX_TAGS) {
+    return contextErr("TOO_MANY_TAGS", `At most ${MAX_TAGS} tags allowed. Got ${raw.length}.`);
+  }
+  const tags = [];
+  for (const r of raw) {
+    const parsed = parseTag(r);
+    if (!parsed.ok) return parsed;
+    if (!tags.includes(parsed.value)) tags.push(parsed.value);
+  }
+  return ok(tags);
+}
+
+// src/context/application/save-context.ts
+var SaveContext = class {
+  constructor(sessions, clock, idGen) {
+    this.sessions = sessions;
+    this.clock = clock;
+    this.idGen = idGen;
+  }
+  sessions;
+  clock;
+  idGen;
+  execute(input) {
+    const name = parseProjectName(input.project);
+    if (!name.ok) return name;
+    const type = parseItemType(input.type ?? "fact");
+    if (!type.ok) return type;
+    const tags = parseTags(input.tags ?? []);
+    if (!tags.ok) return tags;
+    const content = validateContent(input.content);
+    if (!content.ok) return content;
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      const now = this.clock.now();
+      let project = session.value.projects.findByName(name.value);
+      const projectCreated = project === null;
+      if (project === null) {
+        project = {
+          id: this.idGen.next(),
+          name: name.value,
+          createdAt: now,
+          updatedAt: now
+        };
+        session.value.projects.save(project);
+      }
+      const itemId = this.idGen.next();
+      session.value.items.save({
+        id: itemId,
+        projectId: project.id,
+        type: type.value,
+        content: content.value,
+        tags: tags.value,
+        pinned: input.pinned ?? false,
+        ...input.source === void 0 ? {} : { source: input.source },
+        archived: false,
+        createdAt: now,
+        updatedAt: now
+      });
+      return ok({ itemId, project: name.value, type: type.value, projectCreated });
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/context/application/search-context.ts
+var SearchContext = class {
+  constructor(sessions) {
+    this.sessions = sessions;
+  }
+  sessions;
+  execute(input) {
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      let projectId;
+      if (input.project !== void 0) {
+        const name = parseProjectName(input.project);
+        if (!name.ok) return name;
+        const project = session.value.projects.findByName(name.value);
+        if (project === null) {
+          return contextErr("PROJECT_NOT_FOUND", `No project named "${name.value}".`);
+        }
+        projectId = project.id;
+      }
+      const limit = Math.min(Math.max(input.limit ?? 20, 1), 100);
+      const hits = session.value.items.search(input.query, projectId, limit).map((result) => ({
+        id: result.item.id,
+        project: result.projectName,
+        type: result.item.type,
+        content: result.item.content,
+        tags: [...result.item.tags],
+        pinned: result.item.pinned,
+        createdAt: result.item.createdAt.toISOString()
+      }));
+      return ok(hits);
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/context/application/show-project.ts
+var ShowProject = class {
+  constructor(sessions) {
+    this.sessions = sessions;
+  }
+  sessions;
+  execute(project, type) {
+    const name = parseProjectName(project);
+    if (!name.ok) return name;
+    let typeValue;
+    if (type !== void 0) {
+      const parsed = parseItemType(type);
+      if (!parsed.ok) return parsed;
+      typeValue = parsed.value;
+    }
+    const session = this.sessions.open();
+    if (!session.ok) return session;
+    try {
+      const found = session.value.projects.findByName(name.value);
+      if (found === null) {
+        return contextErr("PROJECT_NOT_FOUND", `No project named "${name.value}".`);
+      }
+      const items = session.value.items.findByProject(
+        found.id,
+        typeValue === void 0 ? {} : { type: typeValue }
+      );
+      return ok(
+        items.map((item) => ({
+          id: item.id,
+          project: name.value,
+          type: item.type,
+          content: item.content,
+          tags: [...item.tags],
+          pinned: item.pinned,
+          createdAt: item.createdAt.toISOString()
+        }))
+      );
+    } finally {
+      session.value.close();
+    }
+  }
+};
+
+// src/shared/infra/migrations/001-init.ts
+var MIGRATION_001 = `
+CREATE TABLE projects (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL UNIQUE,
+  description TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE context_items (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  type TEXT NOT NULL CHECK (type IN ('decision','progress','preference','fact','handoff')),
+  content TEXT NOT NULL,
+  tags TEXT NOT NULL DEFAULT '[]',
+  pinned INTEGER NOT NULL DEFAULT 0,
+  source TEXT,
+  archived INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX idx_items_project ON context_items(project_id, created_at DESC);
+
+CREATE VIRTUAL TABLE context_items_fts USING fts5(
+  content,
+  tags,
+  content='context_items',
+  content_rowid='rowid'
+);
+
+CREATE TRIGGER items_ai AFTER INSERT ON context_items BEGIN
+  INSERT INTO context_items_fts(rowid, content, tags)
+  VALUES (new.rowid, new.content, new.tags);
+END;
+
+CREATE TRIGGER items_ad AFTER DELETE ON context_items BEGIN
+  INSERT INTO context_items_fts(context_items_fts, rowid, content, tags)
+  VALUES ('delete', old.rowid, old.content, old.tags);
+END;
+
+CREATE TRIGGER items_au AFTER UPDATE ON context_items BEGIN
+  INSERT INTO context_items_fts(context_items_fts, rowid, content, tags)
+  VALUES ('delete', old.rowid, old.content, old.tags);
+  INSERT INTO context_items_fts(rowid, content, tags)
+  VALUES (new.rowid, new.content, new.tags);
+END;
+`;
+
+// src/shared/infra/migrations.ts
+var MIGRATIONS = [
+  { version: 1, sql: MIGRATION_001 }
+];
+function migrate(db) {
+  db.exec("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+  const row = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
+  const current = row ? Number(row.value) : 0;
+  for (const migration of MIGRATIONS) {
+    if (migration.version <= current) continue;
+    db.transaction(() => {
+      db.exec(migration.sql);
+      db.prepare(
+        "INSERT INTO meta (key, value) VALUES ('schema_version', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value"
+      ).run(String(migration.version));
+    })();
+  }
+}
+
+// src/shared/infra/sqlite.ts
+import { mkdirSync } from "fs";
+import { dirname } from "path";
+import SqliteDatabase from "better-sqlite3-multiple-ciphers";
+function openVaultDb(dbPath, keyHex) {
+  if (!/^[0-9a-f]{64}$/i.test(keyHex)) {
+    throw new Error("Vault key must be 64 hex characters (32 bytes).");
+  }
+  mkdirSync(dirname(dbPath), { recursive: true });
+  const db = new SqliteDatabase(dbPath);
+  try {
+    db.pragma("cipher='sqlcipher'");
+    db.pragma(`key="x'${keyHex}'"`);
+    db.prepare("SELECT count(*) FROM sqlite_master").get();
+    db.pragma("journal_mode = WAL");
+    db.pragma("foreign_keys = ON");
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}
+function isWrongKeyError(error) {
+  return error instanceof Error && "code" in error && error.code === "SQLITE_NOTADB";
+}
+
+// src/vault/domain/errors.ts
+var vaultErr = (code, message) => err(new DomainError(code, message));
+
+// src/vault/infra/vault-header.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { z } from "zod";
+var headerSchema = z.object({
+  vaultId: z.string().min(1),
+  schemaVersion: z.literal(1),
+  kdf: z.object({
+    algorithm: z.literal("argon2id"),
+    memoryKiB: z.number().int().positive(),
+    iterations: z.number().int().positive(),
+    parallelism: z.number().int().positive()
+  }),
+  saltBase64: z.string().min(1),
+  createdAt: z.string()
+});
+function writeVaultHeader(path, header) {
+  const json = {
+    vaultId: header.vaultId,
+    schemaVersion: header.schemaVersion,
+    kdf: header.kdf,
+    saltBase64: Buffer.from(header.salt).toString("base64"),
+    createdAt: header.createdAt
+  };
+  writeFileSync(path, `${JSON.stringify(json, null, 2)}
+`, "utf8");
+}
+function readVaultHeader(path) {
+  if (!existsSync(path)) {
+    return vaultErr("VAULT_NOT_FOUND", `No vault header found at ${path}. Run "valija init".`);
+  }
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return vaultErr("STORAGE_ERROR", `Vault header at ${path} is not valid JSON.`);
+  }
+  const parsed = headerSchema.safeParse(raw);
+  if (!parsed.success) {
+    return vaultErr(
+      "STORAGE_ERROR",
+      `Vault header at ${path} is malformed: ${parsed.error.message}`
+    );
+  }
+  const h = parsed.data;
+  return ok({
+    vaultId: h.vaultId,
+    schemaVersion: h.schemaVersion,
+    kdf: h.kdf,
+    salt: new Uint8Array(Buffer.from(h.saltBase64, "base64")),
+    createdAt: h.createdAt
+  });
+}
+
+// src/context/infra/item-repo.ts
+var toItem = (row) => ({
+  id: row.id,
+  projectId: row.project_id,
+  type: row.type,
+  content: row.content,
+  tags: JSON.parse(row.tags),
+  pinned: row.pinned === 1,
+  ...row.source === null ? {} : { source: row.source },
+  archived: row.archived === 1,
+  createdAt: new Date(row.created_at),
+  updatedAt: new Date(row.updated_at)
+});
+var toFtsQuery = (query) => query.split(/\s+/).filter(Boolean).map((term) => `"${term.replace(/"/g, '""')}"`).join(" ");
+var SqliteContextItemRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  save(item) {
+    this.db.prepare(
+      `INSERT INTO context_items
+           (id, project_id, type, content, tags, pinned, source, archived, created_at, updated_at)
+         VALUES (@id, @projectId, @type, @content, @tags, @pinned, @source, @archived, @createdAt, @updatedAt)
+         ON CONFLICT(id) DO UPDATE SET
+           type = excluded.type,
+           content = excluded.content,
+           tags = excluded.tags,
+           pinned = excluded.pinned,
+           source = excluded.source,
+           archived = excluded.archived,
+           updated_at = excluded.updated_at`
+    ).run({
+      id: item.id,
+      projectId: item.projectId,
+      type: item.type,
+      content: item.content,
+      tags: JSON.stringify(item.tags),
+      pinned: item.pinned ? 1 : 0,
+      source: item.source ?? null,
+      archived: item.archived ? 1 : 0,
+      createdAt: item.createdAt.toISOString(),
+      updatedAt: item.updatedAt.toISOString()
+    });
+  }
+  findByProject(projectId, filters = {}) {
+    const conditions = ["project_id = @projectId"];
+    const params = { projectId };
+    if (!filters.includeArchived) conditions.push("archived = 0");
+    if (filters.type !== void 0) {
+      conditions.push("type = @type");
+      params.type = filters.type;
+    }
+    if (filters.pinned !== void 0) {
+      conditions.push("pinned = @pinned");
+      params.pinned = filters.pinned ? 1 : 0;
+    }
+    const limit = filters.limit !== void 0 ? ` LIMIT ${Math.max(0, filters.limit)}` : "";
+    const rows = this.db.prepare(
+      `SELECT * FROM context_items WHERE ${conditions.join(" AND ")}
+         ORDER BY created_at DESC${limit}`
+    ).all(params);
+    return rows.map(toItem);
+  }
+  search(query, projectId, limit = 20) {
+    const fts = toFtsQuery(query);
+    if (fts.length === 0) return [];
+    const projectFilter = projectId !== void 0 ? "AND i.project_id = @projectId" : "";
+    const rows = this.db.prepare(
+      `SELECT i.*, p.name AS project_name
+         FROM context_items_fts f
+         JOIN context_items i ON i.rowid = f.rowid
+         JOIN projects p ON p.id = i.project_id
+         WHERE context_items_fts MATCH @fts AND i.archived = 0 ${projectFilter}
+         ORDER BY rank LIMIT @limit`
+    ).all({ fts, projectId, limit });
+    return rows.map((row) => ({
+      item: toItem(row),
+      projectName: row.project_name
+    }));
+  }
+  archive(itemId) {
+    const result = this.db.prepare("UPDATE context_items SET archived = 1 WHERE id = ?").run(itemId);
+    return result.changes > 0;
+  }
+};
+
+// src/context/infra/project-repo.ts
+var toProject = (row) => ({
+  id: row.id,
+  name: row.name,
+  ...row.description === null ? {} : { description: row.description },
+  createdAt: new Date(row.created_at),
+  updatedAt: new Date(row.updated_at)
+});
+var SqliteProjectRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  save(project) {
+    this.db.prepare(
+      `INSERT INTO projects (id, name, description, created_at, updated_at)
+         VALUES (@id, @name, @description, @createdAt, @updatedAt)
+         ON CONFLICT(id) DO UPDATE SET
+           name = excluded.name,
+           description = excluded.description,
+           updated_at = excluded.updated_at`
+    ).run({
+      id: project.id,
+      name: project.name,
+      description: project.description ?? null,
+      createdAt: project.createdAt.toISOString(),
+      updatedAt: project.updatedAt.toISOString()
+    });
+  }
+  findByName(name) {
+    const row = this.db.prepare("SELECT * FROM projects WHERE name = ?").get(name);
+    return row ? toProject(row) : null;
+  }
+  list() {
+    const rows = this.db.prepare(
+      `SELECT p.*,
+                COUNT(i.id) AS item_count,
+                MAX(i.updated_at) AS last_activity
+         FROM projects p
+         LEFT JOIN context_items i ON i.project_id = p.id AND i.archived = 0
+         GROUP BY p.id
+         ORDER BY last_activity DESC NULLS LAST, p.name ASC`
+    ).all();
+    return rows.map((row) => ({
+      project: toProject(row),
+      itemCount: row.item_count,
+      lastActivityAt: row.last_activity ? new Date(row.last_activity) : null
+    }));
+  }
+};
+
+// src/context/infra/session-factory.ts
+var LOCKED_MESSAGE = 'Vault is locked. Ask the user to run "valija unlock" in a terminal.';
+var SqliteVaultSessionFactory = class {
+  constructor(paths, keychain) {
+    this.paths = paths;
+    this.keychain = keychain;
+  }
+  paths;
+  keychain;
+  open() {
+    const header = readVaultHeader(this.paths.header);
+    if (!header.ok) return header;
+    const keyHex = this.keychain.getKey(header.value.vaultId);
+    if (keyHex === null) return vaultErr("VAULT_LOCKED", LOCKED_MESSAGE);
+    try {
+      const db = openVaultDb(this.paths.db, keyHex);
+      migrate(db);
+      return ok({
+        projects: new SqliteProjectRepository(db),
+        items: new SqliteContextItemRepository(db),
+        close: () => db.close()
+      });
+    } catch (error) {
+      if (isWrongKeyError(error)) {
+        this.keychain.deleteKey(header.value.vaultId);
+        return vaultErr("VAULT_LOCKED", LOCKED_MESSAGE);
+      }
+      return vaultErr("STORAGE_ERROR", `Could not open vault: ${error.message}`);
+    }
+  }
+};
+
+// src/shared/infra/vault-paths.ts
+import { homedir } from "os";
+import { join } from "path";
+function resolveVaultPaths(rootOverride) {
+  const root = rootOverride ?? process.env.VALIJA_HOME ?? join(homedir(), ".valija");
+  return {
+    root,
+    header: join(root, "vault.json"),
+    db: join(root, "vault.db")
+  };
+}
+
+// src/vault/application/hex.ts
+var bytesToHex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+var isKeyHex = (value) => /^[0-9a-f]{64}$/i.test(value);
+
+// src/vault/application/ports/crypto.ts
+var DEFAULT_KDF_PARAMS = {
+  algorithm: "argon2id",
+  memoryKiB: 64 * 1024,
+  iterations: 3,
+  parallelism: 1
+};
+
+// src/vault/application/create-vault.ts
+var MIN_PASSPHRASE_LENGTH = 8;
+var CreateVault = class {
+  constructor(store, crypto, keychain, clock, idGen) {
+    this.store = store;
+    this.crypto = crypto;
+    this.keychain = keychain;
+    this.clock = clock;
+    this.idGen = idGen;
+  }
+  store;
+  crypto;
+  keychain;
+  clock;
+  idGen;
+  async execute(passphrase) {
+    if (this.store.headerExists()) {
+      return vaultErr("VAULT_ALREADY_EXISTS", "A vault already exists on this machine.");
+    }
+    if (passphrase.length < MIN_PASSPHRASE_LENGTH) {
+      return vaultErr(
+        "WEAK_PASSPHRASE",
+        `Passphrase must be at least ${MIN_PASSPHRASE_LENGTH} characters.`
+      );
+    }
+    const vaultId = this.idGen.next();
+    const salt = this.crypto.generateSalt();
+    const key = await this.crypto.deriveKey(passphrase, salt, DEFAULT_KDF_PARAMS);
+    const keyHex = bytesToHex(key);
+    const createdAt = this.clock.now().toISOString();
+    this.store.writeHeader({ vaultId, schemaVersion: 1, kdf: DEFAULT_KDF_PARAMS, salt, createdAt });
+    const init = this.store.initializeDb(keyHex);
+    if (!init.ok) return init;
+    this.keychain.setKey(vaultId, keyHex);
+    return ok({ vaultId, keyHex, createdAt });
+  }
+};
+
+// src/vault/application/lock-vault.ts
+var LockVault = class {
+  constructor(store, keychain) {
+    this.store = store;
+    this.keychain = keychain;
+  }
+  store;
+  keychain;
+  execute() {
+    const header = this.store.readHeader();
+    if (!header.ok) return header;
+    const wasUnlocked = this.keychain.deleteKey(header.value.vaultId);
+    return ok({ wasUnlocked });
+  }
+};
+
+// src/vault/application/unlock-vault.ts
+var UnlockVault = class {
+  constructor(store, crypto, keychain) {
+    this.store = store;
+    this.crypto = crypto;
+    this.keychain = keychain;
+  }
+  store;
+  crypto;
+  keychain;
+  async execute(input) {
+    const header = this.store.readHeader();
+    if (!header.ok) return header;
+    let keyHex;
+    if (input.recoveryKeyHex !== void 0) {
+      if (!isKeyHex(input.recoveryKeyHex)) {
+        return vaultErr("WRONG_PASSPHRASE", "Recovery key must be 64 hex characters.");
+      }
+      keyHex = input.recoveryKeyHex.toLowerCase();
+    } else if (input.passphrase !== void 0) {
+      const key = await this.crypto.deriveKey(
+        input.passphrase,
+        header.value.salt,
+        header.value.kdf
+      );
+      keyHex = bytesToHex(key);
+    } else {
+      return vaultErr("WRONG_PASSPHRASE", "Provide a passphrase or a recovery key.");
+    }
+    const verified = this.store.verifyKey(keyHex);
+    if (!verified.ok) return verified;
+    this.keychain.setKey(header.value.vaultId, keyHex);
+    return ok({ vaultId: header.value.vaultId });
+  }
+};
+
+// src/vault/application/vault-status.ts
+var VaultStatus = class {
+  constructor(store, keychain) {
+    this.store = store;
+    this.keychain = keychain;
+  }
+  store;
+  keychain;
+  execute() {
+    const dbPath = this.store.dbPath();
+    if (!this.store.headerExists()) {
+      return ok({ initialized: false, unlocked: false, dbPath });
+    }
+    const header = this.store.readHeader();
+    if (!header.ok) return header;
+    const keyHex = this.keychain.getKey(header.value.vaultId);
+    const unlocked = keyHex !== null && this.store.verifyKey(keyHex).ok;
+    return ok({ initialized: true, unlocked, vaultId: header.value.vaultId, dbPath });
+  }
+};
+
+// src/vault/infra/argon2.ts
+import { randomBytes } from "crypto";
+import argon2 from "argon2";
+var KEY_LENGTH = 32;
+var SALT_LENGTH = 16;
+var Argon2VaultCrypto = class {
+  async deriveKey(passphrase, salt, params) {
+    const key = await argon2.hash(passphrase, {
+      type: argon2.argon2id,
+      raw: true,
+      salt: Buffer.from(salt),
+      memoryCost: params.memoryKiB,
+      timeCost: params.iterations,
+      parallelism: params.parallelism,
+      hashLength: KEY_LENGTH
+    });
+    return new Uint8Array(key);
+  }
+  generateSalt() {
+    return new Uint8Array(randomBytes(SALT_LENGTH));
+  }
+};
+
+// src/vault/infra/file-vault-store.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2 } from "fs";
+var FileVaultStore = class {
+  constructor(paths) {
+    this.paths = paths;
+  }
+  paths;
+  headerExists() {
+    return existsSync2(this.paths.header);
+  }
+  readHeader() {
+    return readVaultHeader(this.paths.header);
+  }
+  writeHeader(header) {
+    mkdirSync2(this.paths.root, { recursive: true });
+    writeVaultHeader(this.paths.header, header);
+  }
+  initializeDb(keyHex) {
+    try {
+      const db = openVaultDb(this.paths.db, keyHex);
+      migrate(db);
+      db.close();
+      return ok(void 0);
+    } catch (error) {
+      return vaultErr("STORAGE_ERROR", `Could not create vault db: ${error.message}`);
+    }
+  }
+  verifyKey(keyHex) {
+    try {
+      const db = openVaultDb(this.paths.db, keyHex);
+      db.close();
+      return ok(void 0);
+    } catch (error) {
+      if (isWrongKeyError(error)) {
+        return vaultErr("WRONG_PASSPHRASE", "Wrong passphrase (or recovery key) for this vault.");
+      }
+      return vaultErr("STORAGE_ERROR", `Could not open vault db: ${error.message}`);
+    }
+  }
+  dbPath() {
+    return this.paths.db;
+  }
+};
+
+// src/vault/infra/keyring.ts
+import { Entry } from "@napi-rs/keyring";
+var SERVICE = "valija";
+var OsKeychain = class {
+  setKey(vaultId, keyHex) {
+    new Entry(SERVICE, vaultId).setPassword(keyHex);
+  }
+  getKey(vaultId) {
+    try {
+      return new Entry(SERVICE, vaultId).getPassword();
+    } catch {
+      return null;
+    }
+  }
+  deleteKey(vaultId) {
+    try {
+      return new Entry(SERVICE, vaultId).deletePassword();
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/delivery/container.ts
+var systemClock = { now: () => /* @__PURE__ */ new Date() };
+var ulidIds = { next: () => ulid() };
+function buildContainer() {
+  const paths = resolveVaultPaths();
+  const store = new FileVaultStore(paths);
+  const crypto = new Argon2VaultCrypto();
+  const keychain = new OsKeychain();
+  const sessions = new SqliteVaultSessionFactory(paths, keychain);
+  const getContextPack = new GetContextPack(sessions, systemClock);
+  return {
+    paths,
+    createVault: new CreateVault(store, crypto, keychain, systemClock, ulidIds),
+    unlockVault: new UnlockVault(store, crypto, keychain),
+    lockVault: new LockVault(store, keychain),
+    vaultStatus: new VaultStatus(store, keychain),
+    saveContext: new SaveContext(sessions, systemClock, ulidIds),
+    listProjects: new ListProjects(sessions),
+    searchContext: new SearchContext(sessions),
+    getContextPack,
+    exportPack: new ExportPack(sessions, getContextPack),
+    showProject: new ShowProject(sessions)
+  };
+}
+
+// src/delivery/mcp/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z as z2 } from "zod";
+
+// src/delivery/version.ts
+var VERSION = "0.1.0";
+
+// src/delivery/mcp/server.ts
+var ok2 = (text) => ({ content: [{ type: "text", text }] });
+var err2 = (error) => ({
+  content: [{ type: "text", text: `${error.message} [${error.code}]` }],
+  isError: true
+});
+var DESCRIPTIONS = {
+  save_context: "Save durable context about a project for future sessions in any AI tool. Use when the user asks to save or remember something, or at the end of a working session. Write `content` so it is self-contained and specific for a reader with no other context: decisions made and why, current state, conventions and preferences established, next steps, unresolved questions. Never include secrets, API keys, or passwords.",
+  save_handoff: "Package the state of THIS conversation so another AI tool or session can continue seamlessly. Structure `content` as: goal, what was done, current blockers, exact next step, relevant files or links.",
+  get_context: "Load the saved context pack for a project before starting work on it. Returns pinned and recent context (decisions, preferences, progress, latest handoff) as markdown within a token budget. Call this when the user asks to load, resume, or continue a project.",
+  search_context: "Full-text search across saved context. Use for specific recall questions such as 'what did we decide about auth?'. Returns matching items with project, type, and date.",
+  list_projects: "List existing projects with item counts and last activity. Use to disambiguate which project the user means before saving or loading."
+};
+function buildMcpServer(c) {
+  const server = new McpServer({ name: "valija", version: VERSION });
+  const clientName = () => server.server.getClientVersion()?.name;
+  server.registerTool(
+    "save_context",
+    {
+      title: "Save context",
+      description: DESCRIPTIONS.save_context,
+      inputSchema: {
+        project: z2.string().describe("Project slug, e.g. 'vault-app'. Created if it does not exist."),
+        content: z2.string().describe("Self-contained markdown. Max 32 KB."),
+        type: z2.enum(ITEM_TYPES).optional().describe("Kind of context. Defaults to 'fact'."),
+        tags: z2.array(z2.string()).max(10).optional().describe("Lowercase tags for recall.")
+      }
+    },
+    async ({ project, content, type, tags }) => {
+      const source = clientName();
+      const r = c.saveContext.execute({
+        project,
+        content,
+        ...type === void 0 ? {} : { type },
+        ...tags === void 0 ? {} : { tags },
+        ...source === void 0 ? {} : { source }
+      });
+      if (!r.ok) return err2(r.error);
+      return ok2(
+        `Saved ${r.value.type} to project "${r.value.project}"${r.value.projectCreated ? " (project created)" : ""}. Item id: ${r.value.itemId}.`
+      );
+    }
+  );
+  server.registerTool(
+    "save_handoff",
+    {
+      title: "Save handoff",
+      description: DESCRIPTIONS.save_handoff,
+      inputSchema: {
+        project: z2.string().describe("Project slug. Created if it does not exist."),
+        content: z2.string().describe("Goal, what was done, blockers, exact next step, relevant files or links.")
+      }
+    },
+    async ({ project, content }) => {
+      const source = clientName();
+      const r = c.saveContext.execute({
+        project,
+        content,
+        type: "handoff",
+        ...source === void 0 ? {} : { source }
+      });
+      if (!r.ok) return err2(r.error);
+      return ok2(`Handoff saved to project "${r.value.project}". Item id: ${r.value.itemId}.`);
+    }
+  );
+  server.registerTool(
+    "get_context",
+    {
+      title: "Get context pack",
+      description: DESCRIPTIONS.get_context,
+      inputSchema: {
+        project: z2.string().describe("Project slug to load."),
+        budget: z2.number().int().positive().optional().describe("Token budget. Default 4000.")
+      }
+    },
+    async ({ project, budget }) => {
+      const r = c.getContextPack.execute({
+        project,
+        ...budget === void 0 ? {} : { budgetTokens: budget }
+      });
+      if (!r.ok) return err2(r.error);
+      return ok2(r.value.markdown);
+    }
+  );
+  server.registerTool(
+    "search_context",
+    {
+      title: "Search context",
+      description: DESCRIPTIONS.search_context,
+      inputSchema: {
+        query: z2.string().describe("Full-text query, e.g. 'auth decision'."),
+        project: z2.string().optional().describe("Limit to one project."),
+        limit: z2.number().int().positive().max(100).optional().describe("Max results. Default 20.")
+      }
+    },
+    async ({ query, project, limit }) => {
+      const r = c.searchContext.execute({
+        query,
+        ...project === void 0 ? {} : { project },
+        ...limit === void 0 ? {} : { limit }
+      });
+      if (!r.ok) return err2(r.error);
+      if (r.value.length === 0) return ok2("No matches.");
+      const lines = r.value.map(
+        (hit) => `- [${hit.project}] (${hit.type}, ${hit.createdAt.slice(0, 10)}) ${hit.content}`
+      );
+      return ok2(`${r.value.length} match(es):
+
+${lines.join("\n")}`);
+    }
+  );
+  server.registerTool(
+    "list_projects",
+    {
+      title: "List projects",
+      description: DESCRIPTIONS.list_projects,
+      inputSchema: {}
+    },
+    async () => {
+      const r = c.listProjects.execute();
+      if (!r.ok) return err2(r.error);
+      if (r.value.length === 0) return ok2("No projects in the vault yet.");
+      const lines = r.value.map(
+        (p) => `- ${p.name}: ${p.itemCount} item(s), last activity ${p.lastActivityAt?.slice(0, 10) ?? "never"}`
+      );
+      return ok2(lines.join("\n"));
+    }
+  );
+  server.registerPrompt(
+    "save-context",
+    {
+      title: "Save session context to valija",
+      description: "Distill this session into a self-contained context save.",
+      argsSchema: { project: z2.string().optional() }
+    },
+    ({ project }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Review this conversation and save its durable context to valija${project ? ` under the project "${project}"` : ""}.
+
+1. If the project is ambiguous, call list_projects first and confirm with me.
+2. Compose content that is self-contained for a reader with no other context: decisions made and why, current state, conventions/preferences established, next steps, unresolved questions. No secrets, API keys, or passwords.
+3. Pick the right type (decision/progress/preference/fact) and 1-5 tags.
+4. Call save_context, then tell me what you saved in one line.`
+          }
+        }
+      ]
+    })
+  );
+  server.registerPrompt(
+    "load-context",
+    {
+      title: "Load project context from valija",
+      description: "Load a project's context pack and resume work.",
+      argsSchema: { project: z2.string() }
+    },
+    ({ project }) => ({
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: `Call get_context for the project "${project}". Then:
+1. Summarize the current state in 3 lines max.
+2. Propose the next step based on the latest handoff or progress.
+Do not repeat the whole pack back to me.`
+          }
+        }
+      ]
+    })
+  );
+  return server;
+}
+async function runMcpServer(c) {
+  const server = buildMcpServer(c);
+  await server.connect(new StdioServerTransport());
+}
+
+// src/delivery/cli/content-commands.ts
+import { writeFileSync as writeFileSync2 } from "fs";
+
+// src/delivery/cli/render.ts
+function fail(error) {
+  console.error(`error [${error.code}]: ${error.message}`);
+  process.exit(1);
+}
+function truncate(text, max = 80) {
+  const oneLine = text.replace(/\s+/g, " ").trim();
+  return oneLine.length <= max ? oneLine : `${oneLine.slice(0, max - 1)}\u2026`;
+}
+function formatDate(iso) {
+  return iso === null ? "\u2014" : iso.slice(0, 10);
+}
+
+// src/delivery/cli/content-commands.ts
+function projectsCommand(c) {
+  const result = c.listProjects.execute();
+  if (!result.ok) fail(result.error);
+  if (result.value.length === 0) {
+    console.log(
+      "No projects yet. Save context from an AI tool, or check back after your first session."
+    );
+    return;
+  }
+  console.log("PROJECT                          ITEMS  LAST ACTIVITY");
+  for (const p of result.value) {
+    console.log(
+      `${p.name.padEnd(32)} ${String(p.itemCount).padStart(5)}  ${formatDate(p.lastActivityAt)}`
+    );
+  }
+}
+function showCommand(c, project, options) {
+  const result = c.showProject.execute(project, options.type);
+  if (!result.ok) fail(result.error);
+  if (result.value.length === 0) {
+    console.log("No items.");
+    return;
+  }
+  for (const item of result.value) {
+    const pin = item.pinned ? " \u{1F4CC}" : "";
+    const tags = item.tags.length > 0 ? `  [${item.tags.join(", ")}]` : "";
+    console.log(`
+\u2014 ${item.type} \xB7 ${formatDate(item.createdAt)}${pin}${tags}`);
+    console.log(item.content);
+  }
+}
+function searchCommand(c, query, options) {
+  const result = c.searchContext.execute({
+    query,
+    ...options.project === void 0 ? {} : { project: options.project }
+  });
+  if (!result.ok) fail(result.error);
+  if (result.value.length === 0) {
+    console.log("No matches.");
+    return;
+  }
+  for (const hit of result.value) {
+    console.log(
+      `${hit.project}  ${hit.type.padEnd(10)}  ${formatDate(hit.createdAt)}  ${truncate(hit.content)}`
+    );
+  }
+}
+function exportCommand(c, project, options) {
+  const format = options.json ? "json" : "md";
+  const result = c.exportPack.execute(project, format);
+  if (!result.ok) fail(result.error);
+  if (options.output !== void 0) {
+    writeFileSync2(options.output, result.value, "utf8");
+    console.error(`Exported ${project} (${format}) to ${options.output}`);
+  } else {
+    console.log(result.value);
+  }
+}
+
+// src/delivery/cli/doctor.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+
+// src/delivery/cli/installer.ts
+import { copyFileSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join2 } from "path";
+var CLIENTS = ["claude-code", "claude-desktop", "cursor"];
+var MCP_ENTRY = { command: "npx", args: ["-y", "valija", "mcp"] };
+function clientConfigPath(client, platform = process.platform) {
+  const home = homedir2();
+  switch (client) {
+    case "claude-code":
+      return join2(home, ".claude.json");
+    case "cursor":
+      return join2(home, ".cursor", "mcp.json");
+    case "claude-desktop": {
+      if (platform === "win32")
+        return join2(
+          process.env.APPDATA ?? join2(home, "AppData", "Roaming"),
+          "Claude",
+          "claude_desktop_config.json"
+        );
+      if (platform === "darwin")
+        return join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+      return join2(home, ".config", "Claude", "claude_desktop_config.json");
+    }
+  }
+}
+function installIntoClient(client) {
+  const configPath = clientConfigPath(client);
+  let existing = {};
+  let backupPath = null;
+  if (existsSync3(configPath)) {
+    const raw = readFileSync2(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      throw new Error(`${configPath} does not contain a JSON object; not touching it.`);
+    }
+    existing = parsed;
+    backupPath = `${configPath}.backup-${Date.now()}`;
+    copyFileSync(configPath, backupPath);
+  } else {
+    mkdirSync3(dirname2(configPath), { recursive: true });
+  }
+  const servers = typeof existing.mcpServers === "object" && existing.mcpServers !== null ? existing.mcpServers : {};
+  const merged = { ...existing, mcpServers: { ...servers, valija: MCP_ENTRY } };
+  writeFileSync3(configPath, `${JSON.stringify(merged, null, 2)}
+`, "utf8");
+  return { configPath, backupPath };
+}
+function manualInstructions(client) {
+  return `Add this to the "mcpServers" object of ${clientConfigPath(client)}:
+
+  "valija": ${JSON.stringify(MCP_ENTRY, null, 2).replace(/\n/g, "\n  ")}
+`;
+}
+
+// src/delivery/cli/doctor.ts
+async function doctorCommand(c) {
+  const checks = [];
+  const [major] = process.versions.node.split(".").map(Number);
+  checks.push({
+    name: "node",
+    ok: (major ?? 0) >= 22,
+    detail: `v${process.versions.node} (need >=22)`,
+    fatal: true
+  });
+  try {
+    const { default: Db } = await import("better-sqlite3-multiple-ciphers");
+    const db = new Db(":memory:");
+    db.pragma("cipher='sqlcipher'");
+    db.close();
+    checks.push({ name: "sqlcipher", ok: true, detail: "native module loads" });
+  } catch (e) {
+    checks.push({ name: "sqlcipher", ok: false, detail: e.message, fatal: true });
+  }
+  try {
+    const keychain = new OsKeychain();
+    keychain.setKey("doctor-probe", "test");
+    const roundtrip = keychain.getKey("doctor-probe") === "test";
+    keychain.deleteKey("doctor-probe");
+    checks.push({ name: "keychain", ok: roundtrip, detail: "OS keychain read/write" });
+  } catch (e) {
+    checks.push({ name: "keychain", ok: false, detail: e.message });
+  }
+  const status = c.vaultStatus.execute();
+  if (status.ok) {
+    checks.push({
+      name: "vault",
+      ok: status.value.initialized,
+      detail: status.value.initialized ? `${status.value.unlocked ? "unlocked" : "locked"} at ${status.value.dbPath}` : 'not initialized \u2014 run "valija init"'
+    });
+  } else {
+    checks.push({ name: "vault", ok: false, detail: status.error.message });
+  }
+  for (const client of CLIENTS) {
+    const path = clientConfigPath(client);
+    let detail = "config not found";
+    let installed = false;
+    if (existsSync4(path)) {
+      detail = "config found, valija not installed";
+      try {
+        const parsed = JSON.parse(readFileSync3(path, "utf8"));
+        installed = parsed.mcpServers?.valija !== void 0;
+        if (installed) detail = "valija installed";
+      } catch {
+        detail = "config exists but is not valid JSON";
+      }
+    }
+    checks.push({ name: client, ok: installed, detail });
+  }
+  let fatal = false;
+  for (const check of checks) {
+    console.log(`${check.ok ? "\u2713" : "\u2717"} ${check.name.padEnd(16)} ${check.detail}`);
+    if (!check.ok && check.fatal) fatal = true;
+  }
+  if (fatal) process.exit(1);
+}
+
+// src/vault/infra/recovery-kit.ts
+function renderRecoveryKit(vaultId, keyHex, createdAt) {
+  return `================================================================
+                    VALIJA RECOVERY KIT
+================================================================
+
+Created:   ${createdAt}
+Vault id:  ${vaultId}
+
+RAW ENCRYPTION KEY (hex):
+
+  ${keyHex}
+
+----------------------------------------------------------------
+WHAT THIS IS
+
+This key decrypts your valija vault (~/.valija/vault.db) WITHOUT
+the passphrase. It is the only way back in if you forget your
+passphrase. There is no server, no account, no reset email.
+
+  passphrase lost + this kit lost  =  your data is gone. Forever.
+
+WHAT TO DO WITH IT
+
+  1. Print this file or copy it by hand.
+  2. Store it OFFLINE: a drawer, a safe, a password manager you
+     trust \u2014 anywhere that is not this computer.
+  3. Delete this file from disk once stored.
+
+HOW TO RECOVER
+
+  valija unlock --recovery-key <the hex above>
+
+Anyone holding this key can read your vault. Guard it like a key.
+================================================================
+`;
+}
+
+// src/delivery/cli/prompt.ts
+import { createInterface } from "readline";
+var CTRL_C = String.fromCharCode(3);
+var BACKSPACE = String.fromCharCode(8);
+var DEL = String.fromCharCode(127);
+var reader;
+var bufferedLines = [];
+var waiters = [];
+function readPipedLine() {
+  if (reader === void 0) {
+    reader = createInterface({ input: process.stdin });
+    reader.on("line", (line) => {
+      const waiter = waiters.shift();
+      if (waiter) waiter(line);
+      else bufferedLines.push(line);
+      if (waiters.length === 0) reader?.pause();
+    });
+  }
+  const queued = bufferedLines.shift();
+  if (queued !== void 0) return Promise.resolve(queued);
+  reader.resume();
+  return new Promise((resolve) => waiters.push(resolve));
+}
+function readHiddenTtyLine() {
+  return new Promise((resolve) => {
+    const { stdin, stdout } = process;
+    const chars = [];
+    const onData = (buf) => {
+      for (const c of buf.toString("utf8")) {
+        if (c === "\r" || c === "\n") {
+          stdin.setRawMode(false);
+          stdin.pause();
+          stdin.off("data", onData);
+          stdout.write("\n");
+          resolve(chars.join(""));
+          return;
+        }
+        if (c === CTRL_C) {
+          stdin.setRawMode(false);
+          stdout.write("\n");
+          process.exit(130);
+        }
+        if (c === BACKSPACE || c === DEL) chars.pop();
+        else chars.push(c);
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+function promptHidden(question) {
+  process.stdout.write(question);
+  return process.stdin.isTTY === true ? readHiddenTtyLine() : readPipedLine();
+}
+
+// src/delivery/cli/vault-commands.ts
+async function initCommand(c) {
+  console.log("Creating your encrypted vault.\n");
+  console.log("Choose a passphrase (min 8 chars). You will need it to unlock the vault.");
+  console.log("If you lose it AND the recovery kit, your data is gone. No reset exists.\n");
+  const passphrase = await promptHidden("Passphrase: ");
+  const confirmation = await promptHidden("Repeat passphrase: ");
+  if (passphrase !== confirmation) {
+    console.error("error: passphrases do not match.");
+    process.exit(1);
+  }
+  console.log("\nDeriving key (Argon2id, ~1s)...");
+  const result = await c.createVault.execute(passphrase);
+  if (!result.ok) fail(result.error);
+  const kit = renderRecoveryKit(result.value.vaultId, result.value.keyHex, result.value.createdAt);
+  console.log(`
+Vault created at ${c.paths.root} and unlocked.
+`);
+  console.log(kit);
+  console.log("^ THIS IS YOUR RECOVERY KIT \u2014 it is shown ONCE and never stored.");
+  console.log("  Copy it somewhere safe (offline) before you close this terminal.\n");
+  console.log('Next: run "valija install claude-code" (or claude-desktop, cursor).');
+}
+async function unlockCommand(c, options) {
+  const input = options.recoveryKey !== void 0 ? { recoveryKeyHex: options.recoveryKey } : { passphrase: await promptHidden("Passphrase: ") };
+  const result = await c.unlockVault.execute(input);
+  if (!result.ok) fail(result.error);
+  console.log("Vault unlocked. MCP tools can now read and write context.");
+  console.log('Lock it again with "valija lock".');
+}
+function lockCommand(c) {
+  const result = c.lockVault.execute();
+  if (!result.ok) fail(result.error);
+  console.log(result.value.wasUnlocked ? "Vault locked." : "Vault was already locked.");
+}
+function statusCommand(c) {
+  const result = c.vaultStatus.execute();
+  if (!result.ok) fail(result.error);
+  const s = result.value;
+  if (!s.initialized) {
+    console.log('No vault on this machine. Run "valija init" to create one.');
+    return;
+  }
+  console.log(`vault:    ${s.dbPath}`);
+  console.log(`vault id: ${s.vaultId}`);
+  console.log(`state:    ${s.unlocked ? "UNLOCKED" : "LOCKED"}`);
+}
+
+// src/delivery/cli/program.ts
+var program = new Command();
+var container = buildContainer();
+program.name("valija").description("Encrypted context vault for developers who use several AI tools.").version(VERSION);
+program.command("init").description("Create the encrypted vault (passphrase + recovery kit).").action(() => initCommand(container));
+program.command("unlock").description("Unlock the vault for this session (key goes to the OS keychain).").option("--recovery-key <hex>", "unlock with the raw key from your recovery kit").action((options) => unlockCommand(container, options));
+program.command("lock").description("Lock the vault (remove the key from the OS keychain).").action(() => lockCommand(container));
+program.command("status").description("Show vault location and lock state.").action(() => statusCommand(container));
+program.command("projects").description("List projects with item counts and last activity.").action(() => projectsCommand(container));
+program.command("show").description("Print the items of a project.").argument("<project>", "project slug").option("--type <type>", "filter by type (decision|progress|preference|fact|handoff)").action(
+  (project, options) => showCommand(container, project, options)
+);
+program.command("search").description("Full-text search across saved context.").argument("<query>", "search terms").option("-p, --project <project>", "limit to one project").action(
+  (query, options) => searchCommand(container, query, options)
+);
+program.command("export").description("Export a project's context pack (markdown by default).").argument("<project>", "project slug").option("--json", "export as JSON instead of markdown").option("-o, --output <file>", "write to a file instead of stdout").action(
+  (project, options) => exportCommand(container, project, options)
+);
+program.command("install").description("Wire the valija MCP server into an AI tool's config.").argument("<client>", `one of: ${CLIENTS.join(", ")}`).action((client) => {
+  if (!CLIENTS.includes(client)) {
+    console.error(`error: unknown client "${client}". Use one of: ${CLIENTS.join(", ")}`);
+    process.exit(1);
+  }
+  try {
+    const result = installIntoClient(client);
+    console.log(`valija MCP server added to ${result.configPath}`);
+    if (result.backupPath) console.log(`Backup of the previous config: ${result.backupPath}`);
+    console.log(`Restart ${client} to pick it up.`);
+  } catch (e) {
+    console.error(`Could not update the config automatically: ${e.message}
+`);
+    console.error(manualInstructions(client));
+    process.exit(1);
+  }
+});
+program.command("mcp").description("Run the MCP server on stdio (used by AI tools, not by humans).").action(async () => {
+  await runMcpServer(container);
+});
+program.command("doctor").description("Check environment, vault, keychain, and client configs.").action(() => doctorCommand(container));
+program.parseAsync().catch((error) => {
+  console.error(`error: ${error.message}`);
+  process.exit(1);
+});
+//# sourceMappingURL=program.js.map