@clude/sdk 3.0.4 → 3.2.0

package/dist/cli/index.js

@@ -749,9 +749,9 @@ function createPrompt() {
   });
 }
 function ask(rl, question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`  ${c.white}?${c.reset} ${question}`, (answer) => {
-      resolve4(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
@@ -759,14 +759,14 @@ function askChoice(rl, question, choices) {
   for (const [i, ch] of choices.entries()) {
     console.log(`    ${c.cyan}${i + 1}${c.reset}) ${ch.label}`);
   }
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`
   ${c.white}?${c.reset} ${question} `, (answer) => {
       const idx = parseInt(answer.trim(), 10) - 1;
       if (idx >= 0 && idx < choices.length) {
-        resolve4(choices[idx].key);
+        resolve5(choices[idx].key);
       } else {
-        resolve4(choices[choices.length - 1].key);
+        resolve5(choices[choices.length - 1].key);
       }
     });
   });
@@ -1497,11 +1497,11 @@ async function getEmail(opts = {}) {
   }
   if (opts.skipPrompt) return null;
   const rl = createPrompt();
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question("  Email: ", (answer) => {
       rl.close();
       const trimmed = answer.trim();
-      resolve4(trimmed && emailRegex.test(trimmed) ? trimmed : null);
+      resolve5(trimmed && emailRegex.test(trimmed) ? trimmed : null);
     });
   });
 }
@@ -1622,23 +1622,23 @@ function createPrompt2() {
   });
 }
 function ask2(rl, question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`  ${c.white}?${c.reset} ${question}`, (answer) => {
-      resolve4(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
 function askChoice2(rl, question, choices) {
   const choiceStr = choices.map((ch, i) => `${c.cyan}${i + 1}${c.reset}) ${ch}`).join("  ");
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`  ${c.white}?${c.reset} ${question} [${choiceStr}]: `, (answer) => {
       const idx = parseInt(answer.trim(), 10) - 1;
       if (idx >= 0 && idx < choices.length) {
-        resolve4(choices[idx]);
+        resolve5(choices[idx]);
       } else if (choices.map((c2) => c2.toLowerCase()).includes(answer.trim().toLowerCase())) {
-        resolve4(answer.trim().toLowerCase());
+        resolve5(answer.trim().toLowerCase());
       } else {
-        resolve4(choices[0]);
+        resolve5(choices[0]);
       }
     });
   });
@@ -2172,9 +2172,9 @@ function createPrompt3() {
   });
 }
 function ask3(rl, question) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     rl.question(`  ${c.white}?${c.reset} ${question}`, (answer) => {
-      resolve4(answer.trim());
+      resolve5(answer.trim());
     });
   });
 }
@@ -2262,6 +2262,249 @@ var init_register = __esm({
   }
 });
 
+// packages/brain/src/cli/connect.ts
+var connect_exports = {};
+__export(connect_exports, {
+  runConnect: () => runConnect
+});
+function createPrompt4() {
+  return readline4.createInterface({ input: process.stdin, output: process.stdout });
+}
+function ask4(rl, question) {
+  return new Promise((resolve5) => {
+    rl.question(`  ${c.white}?${c.reset} ${question}`, (answer) => resolve5(answer.trim()));
+  });
+}
+function askYesNo(rl, question, defaultYes = true) {
+  const hint = defaultYes ? "Y/n" : "y/N";
+  return ask4(rl, `${question} [${hint}]: `).then((a) => {
+    if (!a) return defaultYes;
+    return /^y(es)?$/i.test(a);
+  });
+}
+function readStoredConfig() {
+  const p = path4.join(os3.homedir(), ".clude", "config.json");
+  if (!fs3.existsSync(p)) return null;
+  try {
+    return JSON.parse(fs3.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function detectClaudeDesktopConfigPath() {
+  const home = process.env.HOME || process.env.USERPROFILE || os3.homedir();
+  if (process.platform === "darwin") {
+    return path4.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+  }
+  if (process.platform === "win32") {
+    return path4.join(home, "AppData", "Roaming", "Claude", "claude_desktop_config.json");
+  }
+  return path4.join(home, ".config", "Claude", "claude_desktop_config.json");
+}
+async function verifyMcpKey(host, apiKey) {
+  try {
+    const res = await fetch(`${host}${MCP_PATH}`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Accept": "application/json, text/event-stream",
+        "Authorization": `Bearer ${apiKey}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion: "2025-06-18",
+          capabilities: {},
+          clientInfo: { name: "clude-connect", version: "1.0.0" }
+        }
+      })
+    });
+    if (res.status === 401) return { ok: false, error: "Bearer key rejected (401)" };
+    if (!res.ok) return { ok: false, error: `HTTP ${res.status}` };
+    const body = await res.text();
+    const match = body.match(/data:\s*(\{.*\})/);
+    if (!match) return { ok: false, error: "No SSE data frame in response" };
+    const doc = JSON.parse(match[1]);
+    if (doc.error) return { ok: false, error: doc.error.message };
+    return { ok: true, serverName: doc?.result?.serverInfo?.name };
+  } catch (err) {
+    return { ok: false, error: err.message ?? "fetch failed" };
+  }
+}
+async function registerNewKey(host, name, email) {
+  try {
+    const res = await fetch(`${host}/api/cortex/register`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(email ? { name, email } : { name })
+    });
+    const data = await res.json();
+    if (!res.ok || !data.apiKey) return { error: data?.error ?? `HTTP ${res.status}` };
+    return { apiKey: data.apiKey, agentId: data.agentId };
+  } catch (err) {
+    return { error: err.message ?? "register failed" };
+  }
+}
+function buildDesktopEntry(host, apiKey) {
+  return {
+    name: "clude",
+    entry: {
+      url: `${host}${MCP_PATH}`,
+      headers: { Authorization: `Bearer ${apiKey}` }
+    }
+  };
+}
+function writeDesktopConfig(configPath, host, apiKey) {
+  const dir = path4.dirname(configPath);
+  fs3.mkdirSync(dir, { recursive: true });
+  let existing = {};
+  let merged = false;
+  if (fs3.existsSync(configPath)) {
+    try {
+      existing = JSON.parse(fs3.readFileSync(configPath, "utf8"));
+      merged = true;
+    } catch {
+      existing = {};
+    }
+  }
+  const { name, entry } = buildDesktopEntry(host, apiKey);
+  existing.mcpServers = existing.mcpServers || {};
+  existing.mcpServers[name] = entry;
+  fs3.writeFileSync(configPath, JSON.stringify(existing, null, 2) + "\n");
+  return { wrote: true, merged };
+}
+async function runConnect() {
+  const args = process.argv.slice(3);
+  const nonInteractive = args.includes("--non-interactive") || args.includes("-y");
+  const hostFlag = args.find((a) => a.startsWith("--host="));
+  const host = hostFlag ? hostFlag.split("=")[1] : DEFAULT_HOST;
+  const keyFlag = args.find((a) => a.startsWith("--key="));
+  printBanner();
+  console.log(`  ${c.bold}Connect Clude to Claude Desktop${c.reset}
+`);
+  console.log(`  ${c.gray}Adds Clude as a remote MCP connector. You'll see memory tools${c.reset}`);
+  console.log(`  ${c.gray}(recall_memories, store_memory, get_memory_stats) in Claude.${c.reset}
+`);
+  printStep(1, 3, "Get your API key");
+  let apiKey = keyFlag?.split("=")[1] || process.env.CORTEX_API_KEY || "";
+  let source = apiKey ? keyFlag ? "--key flag" : "CORTEX_API_KEY env var" : "";
+  if (!apiKey) {
+    const stored = readStoredConfig();
+    if (stored?.apiKey) {
+      apiKey = stored.apiKey;
+      source = "~/.clude/config.json";
+    }
+  }
+  if (apiKey) {
+    printSuccess(`Using existing key from ${source}`);
+    printInfo(`  ${apiKey.slice(0, 12)}\u2026`);
+  } else if (nonInteractive) {
+    printError("No API key found. Provide one with --key=<clk_\u2026> or run `npx @clude/sdk setup` first.");
+    process.exit(1);
+  } else {
+    const rl = createPrompt4();
+    try {
+      console.log(`  ${c.gray}No API key found locally. Choose one:${c.reset}
+`);
+      console.log(`    ${c.cyan}1${c.reset}) Register a new key now (free)`);
+      console.log(`    ${c.cyan}2${c.reset}) Paste an existing ${c.gray}clk_\u2026${c.reset} key
+`);
+      const choice = await ask4(rl, "Choice [1]: ");
+      if (choice === "" || choice === "1") {
+        const name = await ask4(rl, "Display name: ") || "claude-desktop-user";
+        const email = await ask4(rl, "Email (optional, enables dashboard login): ");
+        printInfo("  Registering\u2026");
+        const reg = await registerNewKey(host, name, email || void 0);
+        if ("error" in reg) {
+          printError(`Registration failed: ${reg.error}`);
+          process.exit(1);
+        }
+        apiKey = reg.apiKey;
+        printSuccess(`API key created  ${c.green}${apiKey}${c.reset}`);
+        printWarn("Save this key. It will not be shown again.");
+      } else {
+        apiKey = await ask4(rl, "Paste your clk_\u2026 key: ");
+        if (!apiKey.startsWith("clk_")) {
+          printError("Key should start with clk_. Aborting.");
+          process.exit(1);
+        }
+      }
+    } finally {
+      rl.close();
+    }
+  }
+  printStep(2, 3, "Verify connector");
+  printInfo(`  POST ${host}${MCP_PATH} \u2192 initialize`);
+  const verify = await verifyMcpKey(host, apiKey);
+  if (!verify.ok) {
+    printError(`Connector check failed: ${verify.error}`);
+    printInfo("  If the host is right, double-check the bearer key at https://clude.io/dashboard");
+    process.exit(1);
+  }
+  printSuccess(`Connector responded \u2014 server: ${c.green}${verify.serverName ?? "clude"}${c.reset}`);
+  printStep(3, 3, "Install in Claude Desktop");
+  const configPath = detectClaudeDesktopConfigPath();
+  let shouldWrite = nonInteractive;
+  if (!nonInteractive) {
+    const rl = createPrompt4();
+    try {
+      console.log(`  ${c.gray}Config path: ${configPath}${c.reset}`);
+      shouldWrite = await askYesNo(rl, "Write this connector to your Claude Desktop config?", true);
+    } finally {
+      rl.close();
+    }
+  }
+  if (shouldWrite) {
+    try {
+      const { merged } = writeDesktopConfig(configPath, host, apiKey);
+      printSuccess(`${merged ? "Merged into" : "Created"} ${configPath}`);
+      printInfo("  Restart Claude Desktop to pick up the new connector.");
+    } catch (err) {
+      printError(`Could not write config: ${err.message}`);
+      printSnippet(host, apiKey);
+      process.exit(1);
+    }
+  } else {
+    printSnippet(host, apiKey);
+  }
+  printDivider();
+  console.log(`
+  ${c.bold}Claude Code users:${c.reset} add this to your project's ${c.cyan}.mcp.json${c.reset}
+`);
+  printCodeBlock(JSON.stringify({
+    mcpServers: { clude: buildDesktopEntry(host, apiKey).entry }
+  }, null, 2));
+  console.log(`  ${c.bold}claude.ai web users:${c.reset}`);
+  console.log(`    1. Open Settings \u2192 Connectors \u2192 Add custom connector`);
+  console.log(`    2. URL:    ${c.cyan}${host}${MCP_PATH}${c.reset}`);
+  console.log(`    3. Header: ${c.cyan}Authorization: Bearer ${apiKey.slice(0, 12)}\u2026${c.reset}
+`);
+  console.log(`  ${c.gray}Docs: https://clude.io/docs/connector${c.reset}
+`);
+}
+function printSnippet(host, apiKey) {
+  const configPath = detectClaudeDesktopConfigPath();
+  printWarn(`Skipped writing config. Add manually to ${configPath}:`);
+  printCodeBlock(JSON.stringify({
+    mcpServers: { clude: buildDesktopEntry(host, apiKey).entry }
+  }, null, 2));
+}
+var readline4, fs3, path4, os3, DEFAULT_HOST, MCP_PATH;
+var init_connect = __esm({
+  "packages/brain/src/cli/connect.ts"() {
+    "use strict";
+    readline4 = __toESM(require("readline"));
+    fs3 = __toESM(require("fs"));
+    path4 = __toESM(require("path"));
+    os3 = __toESM(require("os"));
+    init_banner();
+    DEFAULT_HOST = process.env.CORTEX_HOST_URL || "https://clude.io";
+    MCP_PATH = "/api/mcp";
+  }
+});
+
 // packages/shared/src/config.ts
 var config_exports = {};
 __export(config_exports, {
@@ -2797,21 +3040,25 @@ var init_status = __esm({
   }
 });
 
-// packages/brain/src/memorypack/types.ts
+// packages/memorypack/src/types.ts
 var MEMORYPACK_VERSION;
 var init_types = __esm({
-  "packages/brain/src/memorypack/types.ts"() {
+  "packages/memorypack/src/types.ts"() {
     "use strict";
-    MEMORYPACK_VERSION = "0.1";
+    MEMORYPACK_VERSION = "0.2";
   }
 });
 
-// packages/brain/src/memorypack/sign.ts
+// packages/memorypack/src/sign.ts
 function hashRecordLine(line) {
   const clean = line.replace(/\n$/, "");
   const hex = (0, import_crypto.createHash)("sha256").update(clean, "utf-8").digest("hex");
   return `sha256:${hex}`;
 }
+function hashBuffer(buf) {
+  const hex = (0, import_crypto.createHash)("sha256").update(buf).digest("hex");
+  return `sha256:${hex}`;
+}
 function signHash(hash, secretKey) {
   const messageBytes = Buffer.from(hash, "utf-8");
   const sig = import_tweetnacl.default.sign.detached(messageBytes, secretKey);
@@ -2828,18 +3075,75 @@ function verifyHash(hash, signature, publicKey) {
     return false;
   }
 }
-var import_crypto, import_tweetnacl, bs58Module, bs58;
+function revocationPayload(record_hash, revoked_at) {
+  return `revoke:v1:${record_hash}:${revoked_at}`;
+}
+function verifyRevocation(record_hash, revoked_at, signature, publicKey) {
+  try {
+    const messageBytes = Buffer.from(revocationPayload(record_hash, revoked_at), "utf-8");
+    const sigRaw = signature.startsWith("base58:") ? signature.slice("base58:".length) : signature;
+    const sigBytes = bs58.decode(sigRaw);
+    const pkBytes = bs58.decode(publicKey);
+    return import_tweetnacl.default.sign.detached.verify(messageBytes, sigBytes, pkBytes);
+  } catch {
+    return false;
+  }
+}
+function randomNonce() {
+  return new Uint8Array((0, import_crypto.randomBytes)(ENCRYPTION_NONCE_BYTES));
+}
+function encryptString(plaintext, key) {
+  if (key.length !== ENCRYPTION_KEY_BYTES) {
+    throw new Error(`encryption key must be ${ENCRYPTION_KEY_BYTES} bytes`);
+  }
+  const nonce = randomNonce();
+  const messageBytes = Buffer.from(plaintext, "utf-8");
+  const cipherBytes = import_tweetnacl.default.secretbox(messageBytes, nonce, key);
+  return {
+    ciphertext: Buffer.from(cipherBytes).toString("base64"),
+    nonce: Buffer.from(nonce).toString("base64")
+  };
+}
+function decryptString(ciphertext, nonce, key) {
+  if (key.length !== ENCRYPTION_KEY_BYTES) {
+    throw new Error(`encryption key must be ${ENCRYPTION_KEY_BYTES} bytes`);
+  }
+  const cipherBytes = Buffer.from(ciphertext, "base64");
+  const nonceBytes = Buffer.from(nonce, "base64");
+  if (nonceBytes.length !== ENCRYPTION_NONCE_BYTES) {
+    throw new Error(`nonce must be ${ENCRYPTION_NONCE_BYTES} bytes (decoded got ${nonceBytes.length})`);
+  }
+  const plain = import_tweetnacl.default.secretbox.open(cipherBytes, nonceBytes, key);
+  if (!plain) {
+    throw new Error("decryption failed (MAC mismatch \u2014 wrong key or tampered ciphertext)");
+  }
+  return Buffer.from(plain).toString("utf-8");
+}
+function encryptBuffer(plaintext, key) {
+  if (key.length !== ENCRYPTION_KEY_BYTES) {
+    throw new Error(`encryption key must be ${ENCRYPTION_KEY_BYTES} bytes`);
+  }
+  const nonce = randomNonce();
+  const cipherBytes = import_tweetnacl.default.secretbox(plaintext, nonce, key);
+  return {
+    ciphertext: Buffer.from(cipherBytes),
+    nonce: Buffer.from(nonce).toString("base64")
+  };
+}
+var import_crypto, import_tweetnacl, bs58Module, bs58, ENCRYPTION_KEY_BYTES, ENCRYPTION_NONCE_BYTES;
 var init_sign = __esm({
-  "packages/brain/src/memorypack/sign.ts"() {
+  "packages/memorypack/src/sign.ts"() {
     "use strict";
     import_crypto = require("crypto");
     import_tweetnacl = __toESM(require("tweetnacl"));
     bs58Module = __toESM(require("bs58"));
     bs58 = bs58Module.default || bs58Module;
+    ENCRYPTION_KEY_BYTES = import_tweetnacl.default.secretbox.keyLength;
+    ENCRYPTION_NONCE_BYTES = import_tweetnacl.default.secretbox.nonceLength;
   }
 });
 
-// packages/brain/src/memorypack/writer.ts
+// packages/memorypack/src/writer.ts
 function serializeRecord(record) {
   const KNOWN_ORDER = [
     "id",
@@ -2857,7 +3161,9 @@ function serializeRecord(record) {
     "last_accessed_at",
     "parent_ids",
     "compacted_from",
-    "blob_ref"
+    "blob_ref",
+    "encrypted",
+    "nonce"
   ];
   const out = {};
   for (const k of KNOWN_ORDER) {
@@ -2872,21 +3178,66 @@ function serializeRecord(record) {
   }
   return JSON.stringify(out);
 }
-function writeMemoryPack(dir, records, opts, anchors) {
+function writeMemoryPack(targetPath, records, opts) {
+  const format = opts.format ?? "directory";
+  if (format === "tarball") {
+    writeTarball(targetPath, records, opts);
+    return;
+  }
+  writeDirectory(targetPath, records, opts);
+}
+function writeDirectory(dir, records, opts) {
+  if ((0, import_fs2.existsSync)(dir)) {
+    for (const f of [
+      "manifest.json",
+      "records.jsonl",
+      "signatures.jsonl",
+      "anchors.jsonl",
+      "revocations.jsonl",
+      "revocation_anchors.jsonl"
+    ]) {
+      const p = (0, import_path3.join)(dir, f);
+      if ((0, import_fs2.existsSync)(p)) (0, import_fs2.rmSync)(p, { force: true });
+    }
+    const blobsDir = (0, import_path3.join)(dir, "blobs");
+    if ((0, import_fs2.existsSync)(blobsDir)) (0, import_fs2.rmSync)(blobsDir, { recursive: true, force: true });
+  }
   (0, import_fs2.mkdirSync)(dir, { recursive: true });
+  const clock = opts.clock ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const encryption = opts.encryption ? {
+    ...opts.encryption,
+    scope: opts.encryption.scope ?? (opts.blobs && opts.blobs.size > 0 ? "records+blobs" : "records")
+  } : void 0;
+  if (encryption && encryption.key.length !== ENCRYPTION_KEY_BYTES) {
+    throw new Error(`encryption.key must be ${ENCRYPTION_KEY_BYTES} bytes`);
+  }
+  const encryptBlobs = encryption?.scope === "records+blobs";
+  const recordsToWrite = records.map((r) => {
+    if (!encryption) return r;
+    const { ciphertext, nonce } = encryptString(r.content, encryption.key);
+    return { ...r, content: ciphertext, encrypted: true, nonce };
+  });
   const manifest = {
     memorypack_version: MEMORYPACK_VERSION,
     producer: opts.producer,
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    record_count: records.length,
+    created_at: clock(),
+    record_count: recordsToWrite.length,
     record_schema: opts.record_schema,
     signature_algorithm: opts.secretKey ? "ed25519" : void 0,
-    anchor_chain: opts.anchor_chain
+    anchor_chain: opts.anchor_chain,
+    pack_format: "directory",
+    blobs_count: opts.blobs && opts.blobs.size > 0 ? opts.blobs.size : void 0,
+    encryption: encryption ? {
+      algorithm: "xsalsa20-poly1305",
+      nonce_strategy: "per-record-random",
+      key_derivation: "none",
+      scope: encryption.scope
+    } : void 0
   };
   (0, import_fs2.writeFileSync)((0, import_path3.join)(dir, "manifest.json"), JSON.stringify(manifest, null, 2));
   const recordLines = [];
   const sigs = [];
-  for (const record of records) {
+  for (const record of recordsToWrite) {
     const line = serializeRecord(record);
     recordLines.push(line);
     if (opts.secretKey && opts.producer.public_key) {
@@ -2907,26 +3258,124 @@ function writeMemoryPack(dir, records, opts, anchors) {
       sigs.map((s) => JSON.stringify(s)).join("\n") + "\n"
     );
   }
-  if (anchors && anchors.length > 0) {
+  if (opts.anchors && opts.anchors.length > 0) {
     (0, import_fs2.writeFileSync)(
       (0, import_path3.join)(dir, "anchors.jsonl"),
-      anchors.map((a) => JSON.stringify(a)).join("\n") + "\n"
+      opts.anchors.map((a) => JSON.stringify(a)).join("\n") + "\n"
     );
   }
+  if (opts.blobs && opts.blobs.size > 0) {
+    const blobsDir = (0, import_path3.join)(dir, "blobs", "sha256");
+    (0, import_fs2.mkdirSync)(blobsDir, { recursive: true });
+    const indexEntries = [];
+    for (const [declaredHash, blob] of opts.blobs.entries()) {
+      const dataBuf = Buffer.from(blob.data);
+      const computedPlainHash = hashBuffer(dataBuf);
+      if (computedPlainHash !== declaredHash) {
+        throw new Error(
+          `MemoryPack: blob key '${declaredHash}' does not match sha256 of data (computed ${computedPlainHash})`
+        );
+      }
+      let storedBytes;
+      let entry;
+      if (encryptBlobs && encryption) {
+        const { ciphertext, nonce } = encryptBuffer(dataBuf, encryption.key);
+        storedBytes = ciphertext;
+        const storedHash = hashBuffer(ciphertext);
+        entry = {
+          hash: storedHash,
+          byte_size: ciphertext.length,
+          encrypted: true,
+          nonce
+          // filename + content_type intentionally omitted under records+blobs
+          // encryption to avoid leaking attachment metadata in cleartext.
+        };
+      } else {
+        storedBytes = dataBuf;
+        entry = {
+          hash: declaredHash,
+          byte_size: dataBuf.length,
+          content_type: blob.content_type,
+          filename: blob.filename
+        };
+      }
+      const hex = entry.hash.replace(/^sha256:/, "");
+      (0, import_fs2.writeFileSync)((0, import_path3.join)(blobsDir, hex), storedBytes);
+      indexEntries.push(entry);
+    }
+    (0, import_fs2.writeFileSync)(
+      (0, import_path3.join)(dir, "blobs", "index.jsonl"),
+      indexEntries.map((e) => JSON.stringify(e)).join("\n") + "\n"
+    );
+  }
+}
+function writeTarball(targetPath, records, opts) {
+  const targetAbs = (0, import_path3.resolve)(targetPath);
+  const parent = (0, import_path3.dirname)(targetAbs);
+  const innerName = (0, import_path3.basename)(targetAbs).replace(/\.tar\.zst$/i, "") || "memorypack";
+  const tmpRoot = `${targetAbs}.tmp-${process.pid}-${Date.now()}`;
+  const stagingDir = (0, import_path3.join)(tmpRoot, innerName);
+  (0, import_fs2.mkdirSync)(stagingDir, { recursive: true });
+  try {
+    writeDirectory(stagingDir, records, opts);
+    const manifestPath = (0, import_path3.join)(stagingDir, "manifest.json");
+    const manifest = JSON.parse(
+      require("fs").readFileSync(manifestPath, "utf-8")
+    );
+    manifest.pack_format = "tarball";
+    (0, import_fs2.writeFileSync)(manifestPath, JSON.stringify(manifest, null, 2));
+    const res = (0, import_child_process2.spawnSync)(
+      "tar",
+      ["--zstd", "-cf", targetAbs, "-C", tmpRoot, innerName],
+      { stdio: ["ignore", "ignore", "pipe"] }
+    );
+    if (res.error) {
+      throw new Error(
+        `MemoryPack: failed to invoke 'tar' (${res.error.message}). Install a recent tar with zstd support.`
+      );
+    }
+    if (res.status !== 0) {
+      const stderr = res.stderr ? res.stderr.toString() : "";
+      throw new Error(
+        `MemoryPack: tar --zstd failed (exit ${res.status}): ${stderr.trim() || "no stderr"}`
+      );
+    }
+    if (!(0, import_fs2.existsSync)(targetAbs) || (0, import_fs2.statSync)(targetAbs).size === 0) {
+      throw new Error("MemoryPack: tar produced an empty archive");
+    }
+  } finally {
+    (0, import_fs2.rmSync)(tmpRoot, { recursive: true, force: true });
+  }
 }
-var import_fs2, import_path3;
+var import_fs2, import_child_process2, import_path3;
 var init_writer = __esm({
-  "packages/brain/src/memorypack/writer.ts"() {
+  "packages/memorypack/src/writer.ts"() {
     "use strict";
     import_fs2 = require("fs");
+    import_child_process2 = require("child_process");
     import_path3 = require("path");
     init_types();
     init_sign();
   }
 });
 
-// packages/brain/src/memorypack/reader.ts
-function readMemoryPack(dir, opts = {}) {
+// packages/memorypack/src/reader.ts
+function readMemoryPack(path9, opts = {}) {
+  const isTarball = /\.tar\.zst$/i.test(path9) || (0, import_fs3.existsSync)(path9) && (0, import_fs3.statSync)(path9).isFile();
+  if (!isTarball) {
+    return readDirectory(path9, opts);
+  }
+  let extractRoot = null;
+  try {
+    extractRoot = extractTarball(path9);
+    return readDirectory(extractRoot, opts);
+  } finally {
+    if (extractRoot) {
+      (0, import_fs3.rmSync)(extractRoot, { recursive: true, force: true });
+    }
+  }
+}
+function readDirectory(dir, opts) {
   const warnings = [];
   const manifestPath = (0, import_path4.join)(dir, "manifest.json");
   if (!(0, import_fs3.existsSync)(manifestPath)) {
@@ -2954,12 +3403,14 @@ function readMemoryPack(dir, opts = {}) {
     lineByHash.set(hashRecordLine(line), line);
   }
   if (records.length !== manifest.record_count) {
-    warnings.push(`record_count mismatch: manifest ${manifest.record_count} vs jsonl ${records.length}`);
+    warnings.push(
+      `record_count mismatch: manifest ${manifest.record_count} vs jsonl ${records.length}`
+    );
   }
   const verifiedRecords = /* @__PURE__ */ new Set();
   const sigsPath = (0, import_path4.join)(dir, "signatures.jsonl");
-  const signaturesFilePresent = (0, import_fs3.existsSync)(sigsPath);
-  if (signaturesFilePresent) {
+  const signaturesPresent = (0, import_fs3.existsSync)(sigsPath);
+  if (signaturesPresent) {
     const sigLines = (0, import_fs3.readFileSync)(sigsPath, "utf-8").split("\n").filter((l) => l.length > 0);
     const pubkey = opts.publicKey ?? manifest.producer.public_key;
     if (!pubkey) {
@@ -2984,7 +3435,7 @@ function readMemoryPack(dir, opts = {}) {
     }
   }
   const unsignedRecords = /* @__PURE__ */ new Set();
-  if (!signaturesFilePresent) {
+  if (!signaturesPresent) {
     for (const hash of lineByHash.keys()) unsignedRecords.add(hash);
   }
   if (opts.strictSignatures && unsignedRecords.size > 0) {
@@ -3000,25 +3451,404 @@ function readMemoryPack(dir, opts = {}) {
       anchors.push(JSON.parse(line));
     }
   }
-  return { manifest, records, verifiedRecords, unsignedRecords, anchors, warnings };
+  const revocations = [];
+  const revokedRecordHashes = /* @__PURE__ */ new Set();
+  const revocationsPath = (0, import_path4.join)(dir, "revocations.jsonl");
+  if ((0, import_fs3.existsSync)(revocationsPath)) {
+    const expectedSigner = opts.publicKey ?? manifest.producer.public_key;
+    const revLines = (0, import_fs3.readFileSync)(revocationsPath, "utf-8").split("\n").filter((l) => l.length > 0);
+    for (const line of revLines) {
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        warnings.push(`revocations.jsonl: skipping malformed line`);
+        continue;
+      }
+      if (expectedSigner && entry.public_key !== expectedSigner) {
+        warnings.push(
+          `revocation for ${entry.record_hash} signed by unexpected key ${entry.public_key} \u2014 rejected`
+        );
+        continue;
+      }
+      const ok = verifyRevocation(
+        entry.record_hash,
+        entry.revoked_at,
+        entry.signature,
+        entry.public_key
+      );
+      if (!ok) {
+        warnings.push(
+          `revocation for ${entry.record_hash} signature failed verification \u2014 rejected`
+        );
+        continue;
+      }
+      revocations.push(entry);
+      revokedRecordHashes.add(entry.record_hash);
+    }
+  }
+  const revocationAnchors = [];
+  const revAnchorsPath = (0, import_path4.join)(dir, "revocation_anchors.jsonl");
+  if ((0, import_fs3.existsSync)(revAnchorsPath)) {
+    const validPairs = new Set(
+      revocations.map((r) => `${r.record_hash}@${r.revoked_at}`)
+    );
+    const anchorLines = (0, import_fs3.readFileSync)(revAnchorsPath, "utf-8").split("\n").filter((l) => l.length > 0);
+    for (const line of anchorLines) {
+      let entry;
+      try {
+        entry = JSON.parse(line);
+      } catch {
+        warnings.push("revocation_anchors.jsonl: skipping malformed line");
+        continue;
+      }
+      if (entry.anchor_format !== "memo-revoke-v1") {
+        warnings.push(
+          `revocation anchor ${entry.tx} has unsupported format '${entry.anchor_format}' \u2014 skipped`
+        );
+        continue;
+      }
+      const pair = `${entry.record_hash}@${entry.revoked_at}`;
+      if (!validPairs.has(pair)) {
+        warnings.push(
+          `revocation anchor ${entry.tx} pair (${entry.record_hash}, ${entry.revoked_at}) does not match any verified revocation \u2014 skipped`
+        );
+        continue;
+      }
+      revocationAnchors.push(entry);
+    }
+  }
+  const verifiedBlobs = /* @__PURE__ */ new Set();
+  const blobsDir = (0, import_path4.join)(dir, "blobs", "sha256");
+  const blobIndexPath = (0, import_path4.join)(dir, "blobs", "index.jsonl");
+  const blobIndexEntries = /* @__PURE__ */ new Map();
+  if ((0, import_fs3.existsSync)(blobIndexPath)) {
+    const indexLines = (0, import_fs3.readFileSync)(blobIndexPath, "utf-8").split("\n").filter((l) => l.length > 0);
+    for (const line of indexLines) {
+      const entry = JSON.parse(line);
+      blobIndexEntries.set(entry.hash, entry);
+      const hex = entry.hash.replace(/^sha256:/, "");
+      const blobPath = (0, import_path4.join)(blobsDir, hex);
+      if (!(0, import_fs3.existsSync)(blobPath)) {
+        warnings.push(`declared blob ${entry.hash} missing from blobs/`);
+        continue;
+      }
+      const data = (0, import_fs3.readFileSync)(blobPath);
+      const computed = hashBuffer(data);
+      if (computed !== entry.hash) {
+        throw new Error(
+          `MemoryPack: blob hash mismatch \u2014 declared ${entry.hash}, computed ${computed}`
+        );
+      }
+      const actualSize = (0, import_fs3.statSync)(blobPath).size;
+      if (entry.byte_size !== actualSize) {
+        warnings.push(
+          `blob ${entry.hash} byte_size mismatch: declared ${entry.byte_size}, actual ${actualSize}`
+        );
+      }
+      verifiedBlobs.add(entry.hash);
+    }
+  }
+  for (const r of records) {
+    if (r.blob_ref && !verifiedBlobs.has(r.blob_ref)) {
+      const reason = blobIndexEntries.size === 0 ? "no blobs/index.jsonl in pack" : "not present or not verified";
+      warnings.push(
+        `record ${r.id} references blob ${r.blob_ref} (${reason})`
+      );
+    }
+  }
+  if (manifest.encryption) {
+    if (!opts.decryptionKey) {
+      warnings.push(
+        `manifest declares encryption (${manifest.encryption.algorithm}, scope=${manifest.encryption.scope}) but no decryptionKey supplied \u2014 content remains ciphertext`
+      );
+    } else if (opts.decryptionKey.length !== ENCRYPTION_KEY_BYTES) {
+      throw new Error(
+        `MemoryPack: decryptionKey must be ${ENCRYPTION_KEY_BYTES} bytes (got ${opts.decryptionKey.length})`
+      );
+    } else {
+      for (const r of records) {
+        if (!r.encrypted) continue;
+        if (!r.nonce) {
+          warnings.push(`record ${r.id} marked encrypted but has no nonce \u2014 leaving ciphertext`);
+          continue;
+        }
+        try {
+          r.content = decryptString(r.content, r.nonce, opts.decryptionKey);
+          r.encrypted = false;
+          delete r.nonce;
+        } catch (e) {
+          warnings.push(
+            `record ${r.id} decryption failed: ${e.message}`
+          );
+        }
+      }
+    }
+  }
+  const minimalRecords = records.filter((r) => !r.encrypted).map((r) => ({
+    id: r.id,
+    created_at: r.created_at,
+    kind: r.kind,
+    content: r.content,
+    tags: r.tags,
+    importance: r.importance,
+    source: r.source,
+    encrypted: r.encrypted
+  }));
+  return {
+    manifest,
+    records,
+    verifiedRecords,
+    unsignedRecords,
+    anchors,
+    verifiedBlobs,
+    verifiedAnchors: /* @__PURE__ */ new Set(),
+    revocations,
+    revokedRecordHashes,
+    revocationAnchors,
+    verifiedRevocationAnchors: /* @__PURE__ */ new Set(),
+    minimalRecords,
+    warnings
+  };
+}
+function extractTarball(path9) {
+  if (!(0, import_fs3.existsSync)(path9)) {
+    throw new Error(`MemoryPack: tarball not found: ${path9}`);
+  }
+  const list = (0, import_child_process3.spawnSync)("tar", ["--zstd", "-tvf", path9], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (list.error) {
+    throw new Error(
+      `MemoryPack: failed to invoke 'tar' (${list.error.message}). Install a recent tar with zstd support.`
+    );
+  }
+  if (list.status !== 0) {
+    const stderr = list.stderr ? list.stderr.toString() : "";
+    throw new Error(
+      `MemoryPack: tar --zstd -tvf failed (exit ${list.status}): ${stderr.trim() || "no stderr"}`
+    );
+  }
+  const lines = list.stdout.toString().split("\n").filter((l) => l.length > 0);
+  for (const line of lines) {
+    const typeChar = line.charAt(0);
+    if (typeChar === "l" || typeChar === "h") {
+      throw new Error(
+        `MemoryPack: tarball contains symlink/hardlink \u2014 refusing to extract (${line.slice(0, 80)})`
+      );
+    }
+    const name = line.split(/\s+/).pop() ?? "";
+    if (!name) continue;
+    if (name.startsWith("/")) {
+      throw new Error(`MemoryPack: tarball contains absolute path \u2014 refusing (${name})`);
+    }
+    if (name.split("/").some((seg) => seg === "..")) {
+      throw new Error(`MemoryPack: tarball contains '..' segment \u2014 refusing (${name})`);
+    }
+    if (!SAFE_MEMBER_RE.test(name.replace(/\/$/, ""))) {
+      throw new Error(`MemoryPack: tarball member has unsafe characters \u2014 refusing (${name})`);
+    }
+  }
+  const tmp = (0, import_fs3.mkdtempSync)((0, import_path4.join)((0, import_os.tmpdir)(), "mp-extract-"));
+  const extract = (0, import_child_process3.spawnSync)(
+    "tar",
+    [
+      "--zstd",
+      "--no-same-owner",
+      "--no-same-permissions",
+      "-xf",
+      path9,
+      "-C",
+      tmp
+    ],
+    { stdio: ["ignore", "ignore", "pipe"] }
+  );
+  if (extract.status !== 0) {
+    (0, import_fs3.rmSync)(tmp, { recursive: true, force: true });
+    const stderr = extract.stderr ? extract.stderr.toString() : "";
+    throw new Error(
+      `MemoryPack: tar --zstd -xf failed (exit ${extract.status}): ${stderr.trim() || "no stderr"}`
+    );
+  }
+  if ((0, import_fs3.existsSync)((0, import_path4.join)(tmp, "manifest.json"))) {
+    return tmp;
+  }
+  const fs7 = require("fs");
+  const entries = fs7.readdirSync(tmp);
+  if (entries.length === 1) {
+    const inner = (0, import_path4.join)(tmp, entries[0]);
+    if ((0, import_fs3.statSync)(inner).isDirectory() && (0, import_fs3.existsSync)((0, import_path4.join)(inner, "manifest.json"))) {
+      return inner;
+    }
+  }
+  (0, import_fs3.rmSync)(tmp, { recursive: true, force: true });
+  throw new Error(
+    `MemoryPack: tarball must contain manifest.json at the root or inside a single wrapping directory`
+  );
 }
-var import_fs3, import_path4;
+var import_fs3, import_child_process3, import_os, import_path4, SAFE_MEMBER_RE;
 var init_reader = __esm({
-  "packages/brain/src/memorypack/reader.ts"() {
+  "packages/memorypack/src/reader.ts"() {
     "use strict";
     import_fs3 = require("fs");
+    import_child_process3 = require("child_process");
+    import_os = require("os");
     import_path4 = require("path");
     init_sign();
+    SAFE_MEMBER_RE = /^[A-Za-z0-9._/-]+$/;
   }
 });
 
-// packages/brain/src/memorypack/index.ts
-var init_memorypack = __esm({
-  "packages/brain/src/memorypack/index.ts"() {
+// packages/memorypack/src/stream.ts
+var init_stream = __esm({
+  "packages/memorypack/src/stream.ts"() {
+    "use strict";
+    init_sign();
+  }
+});
+
+// packages/memorypack/src/chain-verify.ts
+async function verifyChainAnchors(anchors, opts) {
+  const verified = /* @__PURE__ */ new Set();
+  const warnings = [];
+  if (anchors.length === 0) return { verified, warnings };
+  const conn = new import_web3.Connection(opts.rpcUrl, { commitment: "confirmed" });
+  if (opts.cluster) {
+    try {
+      const genesis = await conn.getGenesisHash();
+      const expected = GENESIS_HASHES[opts.cluster];
+      if (!expected) {
+        const msg = `unknown cluster '${opts.cluster}' \u2014 cannot cross-check genesis`;
+        if (opts.strict) throw new Error(msg);
+        warnings.push(msg);
+      } else if (genesis !== expected) {
+        const msg = `cluster mismatch: rpc reports genesis ${genesis}, expected ${expected} for ${opts.cluster}`;
+        if (opts.strict) throw new Error(msg);
+        warnings.push(msg);
+        return { verified, warnings };
+      }
+    } catch (e) {
+      const msg = `getGenesisHash failed: ${e.message}`;
+      if (opts.strict) throw new Error(msg);
+      warnings.push(msg);
+    }
+  }
+  for (const anchor of anchors) {
+    try {
+      await verifyOne(anchor, conn, opts, verified);
+    } catch (e) {
+      const msg = `${anchor.tx} \u2192 ${e.message}`;
+      if (opts.strict) throw new Error(msg);
+      warnings.push(msg);
+    }
+  }
+  return { verified, warnings };
+}
+async function verifyOne(anchor, conn, opts, verified) {
+  if (anchor.anchor_format !== "memo-v1") {
+    throw new Error(`unsupported anchor_format '${anchor.anchor_format}'`);
+  }
+  const cfg = {
+    commitment: "confirmed",
+    maxSupportedTransactionVersion: 0
+  };
+  const tx = await conn.getTransaction(anchor.tx, cfg);
+  if (!tx) {
+    throw new Error("transaction not found");
+  }
+  const message = tx.transaction.message;
+  let accountKeys;
+  if (Array.isArray(message.accountKeys)) {
+    accountKeys = message.accountKeys;
+  } else if (typeof message.getAccountKeys === "function") {
+    accountKeys = message.getAccountKeys({
+      accountKeysFromLookups: tx.meta?.loadedAddresses
+    }).staticAccountKeys;
+  } else {
+    throw new Error("cannot resolve account keys from transaction message");
+  }
+  const numSigners = message.header.numRequiredSignatures;
+  const signerKeys = accountKeys.slice(0, numSigners).map((k) => k.toBase58());
+  const expectedMemo = expectedMemoForRecordHash(anchor.record_hash);
+  const instructions = message.compiledInstructions ?? message.instructions ?? [];
+  let memoInstructionFound = false;
+  let memoMatched = false;
+  for (const ix of instructions) {
+    const programId = accountKeys[ix.programIdIndex]?.toBase58();
+    if (!programId || !MEMO_PROGRAM_IDS.has(programId)) continue;
+    memoInstructionFound = true;
+    const dataStr = decodeMemoInstructionData(ix.data);
+    if (dataStr === expectedMemo) {
+      memoMatched = true;
+      break;
+    }
+  }
+  if (!memoInstructionFound) {
+    throw new Error("no SPL Memo program instruction in transaction");
+  }
+  if (!memoMatched) {
+    throw new Error(`no Memo instruction with data exactly equal to "${expectedMemo}"`);
+  }
+  if (opts.expectedSigner) {
+    if (!signerKeys.includes(opts.expectedSigner)) {
+      throw new Error(
+        `expectedSigner ${opts.expectedSigner} is not among tx signers [${signerKeys.join(", ")}]`
+      );
+    }
+  }
+  verified.add(anchor.record_hash);
+}
+function expectedMemoForRecordHash(recordHash) {
+  return `clude:v1:${recordHash}`;
+}
+function decodeMemoInstructionData(data) {
+  if (typeof data === "string") {
+    const bs583 = loadBs58();
+    const bytes = bs583.decode(data);
+    return Buffer.from(bytes).toString("utf-8");
+  }
+  if (data instanceof Uint8Array || Buffer.isBuffer(data)) {
+    return Buffer.from(data).toString("utf-8");
+  }
+  if (data && typeof data === "object" && "type" in data && "data" in data) {
+    return Buffer.from(data.data).toString("utf-8");
+  }
+  throw new Error(`unrecognized instruction data shape: ${typeof data}`);
+}
+function loadBs58() {
+  if (_bs58) return _bs58;
+  const mod = require("bs58");
+  _bs58 = mod.default || mod;
+  return _bs58;
+}
+var import_web3, MEMO_PROGRAM_IDS, GENESIS_HASHES, _bs58;
+var init_chain_verify = __esm({
+  "packages/memorypack/src/chain-verify.ts"() {
+    "use strict";
+    import_web3 = require("@solana/web3.js");
+    MEMO_PROGRAM_IDS = /* @__PURE__ */ new Set([
+      "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr",
+      "Memo1UhkJRfHyvLMcVucJwxXeuD728EqVDDwQDxFMNo"
+    ]);
+    GENESIS_HASHES = {
+      mainnet: "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d",
+      "mainnet-beta": "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d",
+      devnet: "EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG",
+      testnet: "4uhcVJyU9pJkvQyS88uRDiswHXSCkY3zQawwpjk2NsNY"
+    };
+    _bs58 = null;
+  }
+});
+
+// packages/memorypack/src/index.ts
+var init_src = __esm({
+  "packages/memorypack/src/index.ts"() {
     "use strict";
     init_types();
     init_writer();
     init_reader();
+    init_stream();
+    init_chain_verify();
     init_sign();
   }
 });
@@ -3386,13 +4216,18 @@ async function initDatabase2() {
           is_active BOOLEAN DEFAULT TRUE,
           metadata JSONB DEFAULT '{}',
           owner_wallet TEXT,
-          privy_did TEXT
+          privy_did TEXT,
+          email TEXT
         );
 
+        -- Backfill: older deployments may have agent_keys without the email column.
+        ALTER TABLE agent_keys ADD COLUMN IF NOT EXISTS email TEXT;
+
         CREATE INDEX IF NOT EXISTS idx_agent_keys_api_key ON agent_keys(api_key);
         CREATE INDEX IF NOT EXISTS idx_agent_keys_owner ON agent_keys(owner_wallet);
         CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_keys_owner_unique ON agent_keys(owner_wallet) WHERE owner_wallet IS NOT NULL;
         CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_keys_privy_did ON agent_keys(privy_did) WHERE privy_did IS NOT NULL;
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_keys_email ON agent_keys(email) WHERE email IS NOT NULL AND is_active = true;
 
         -- Cortex recall performance: owner_wallet scoped queries
         CREATE INDEX IF NOT EXISTS idx_cortex_owner_recall ON memories(owner_wallet, decay_factor DESC, created_at DESC);
@@ -3826,6 +4661,19 @@ async function initDatabase2() {
           created_at TIMESTAMPTZ DEFAULT NOW()
         );
         CREATE INDEX IF NOT EXISTS idx_chat_usage_wallet ON chat_usage(wallet_address, created_at DESC);
+
+        -- Wiki pack installations: which packs (Workspace, Compliance, Sales)
+        -- each wallet has installed. Drives the topic rail in /wiki and
+        -- the auto-categorisation rules applied to incoming memories.
+        CREATE TABLE IF NOT EXISTS wiki_pack_installations (
+          id BIGSERIAL PRIMARY KEY,
+          owner_wallet TEXT NOT NULL,
+          pack_id TEXT NOT NULL,
+          installed_at TIMESTAMPTZ DEFAULT NOW(),
+          UNIQUE (owner_wallet, pack_id)
+        );
+        CREATE INDEX IF NOT EXISTS idx_wiki_pack_installations_owner
+          ON wiki_pack_installations(owner_wallet);
       `
     });
     if (error) {
@@ -4110,11 +4958,13 @@ var init_openrouter_client = __esm({
     OPENROUTER_API_URL = "https://openrouter.ai/api/v1";
     OPENROUTER_MODELS = {
       // Frontier (Anthropic)
+      "claude-opus-4.7": "anthropic/claude-opus-4.7",
       "claude-opus-4.6": "anthropic/claude-opus-4.6",
       "claude-sonnet-4.6": "anthropic/claude-sonnet-4.6",
       "claude-opus-4.5": "anthropic/claude-opus-4.5",
       "claude-sonnet-4.5": "anthropic/claude-sonnet-4.5",
       // Frontier (Other providers)
+      "gpt-5.5": "openai/gpt-5.5",
       "gpt-5.4": "openai/gpt-5.4",
       "grok-4.1": "x-ai/grok-4.1-fast",
       "gemini-3-pro": "google/gemini-3-pro-preview",
@@ -4236,12 +5086,12 @@ __export(solana_client_exports, {
 });
 function getConnection() {
   if (!connection) {
-    connection = new import_web3.Connection(config.solana.rpcUrl, "confirmed");
+    connection = new import_web32.Connection(config.solana.rpcUrl, "confirmed");
   }
   return connection;
 }
 function _configureSolana(rpcUrl, privateKey) {
-  connection = new import_web3.Connection(rpcUrl, "confirmed");
+  connection = new import_web32.Connection(rpcUrl, "confirmed");
   if (privateKey) {
     try {
       const raw = privateKey.trim();
@@ -4251,7 +5101,7 @@ function _configureSolana(rpcUrl, privateKey) {
       } else {
         secretKey = bs582.decode(raw);
       }
-      botWallet = import_web3.Keypair.fromSecretKey(secretKey);
+      botWallet = import_web32.Keypair.fromSecretKey(secretKey);
     } catch (err) {
       log6.error({ err }, "SDK: Failed to load bot wallet");
     }
@@ -4267,7 +5117,7 @@ function getBotWallet() {
       } else {
         secretKey = bs582.decode(raw);
       }
-      botWallet = import_web3.Keypair.fromSecretKey(secretKey);
+      botWallet = import_web32.Keypair.fromSecretKey(secretKey);
       log6.info({ publicKey: botWallet.publicKey.toBase58() }, "Bot wallet loaded");
     } catch (err) {
       log6.error({ err }, "Failed to load bot wallet");
@@ -4283,14 +5133,14 @@ async function writeMemo(memo) {
   }
   const conn = getConnection();
   const truncatedMemo = memo.slice(0, MEMO_MAX_LENGTH);
-  const instruction = new import_web3.TransactionInstruction({
+  const instruction = new import_web32.TransactionInstruction({
     keys: [{ pubkey: wallet.publicKey, isSigner: true, isWritable: true }],
     programId: MEMO_PROGRAM_ID2,
     data: Buffer.from(truncatedMemo, "utf-8")
   });
-  const transaction = new import_web3.Transaction().add(instruction);
+  const transaction = new import_web32.Transaction().add(instruction);
   try {
-    const signature = await (0, import_web3.sendAndConfirmTransaction)(conn, transaction, [wallet]);
+    const signature = await (0, import_web32.sendAndConfirmTransaction)(conn, transaction, [wallet]);
     log6.info({ signature, memoLength: truncatedMemo.length }, "Memo written on-chain");
     return signature;
   } catch (err) {
@@ -4300,7 +5150,7 @@ async function writeMemo(memo) {
 }
 function getDevnetConnection() {
   if (!devnetConnection) {
-    devnetConnection = new import_web3.Connection("https://api.devnet.solana.com", "confirmed");
+    devnetConnection = new import_web32.Connection("https://api.devnet.solana.com", "confirmed");
   }
   return devnetConnection;
 }
@@ -4312,14 +5162,14 @@ async function writeMemoDevnet(memo) {
   }
   const conn = getDevnetConnection();
   const truncatedMemo = memo.slice(0, MEMO_MAX_LENGTH);
-  const instruction = new import_web3.TransactionInstruction({
+  const instruction = new import_web32.TransactionInstruction({
     keys: [{ pubkey: wallet.publicKey, isSigner: true, isWritable: true }],
     programId: MEMO_PROGRAM_ID2,
     data: Buffer.from(truncatedMemo, "utf-8")
   });
-  const transaction = new import_web3.Transaction().add(instruction);
+  const transaction = new import_web32.Transaction().add(instruction);
   try {
-    const signature = await (0, import_web3.sendAndConfirmTransaction)(conn, transaction, [wallet]);
+    const signature = await (0, import_web32.sendAndConfirmTransaction)(conn, transaction, [wallet]);
     log6.info({ signature, memoLength: truncatedMemo.length }, "Memo written on devnet");
     return signature;
   } catch (err) {
@@ -4336,7 +5186,7 @@ function solscanTxUrl(signature) {
 }
 function _configureMemoryRegistry(programId) {
   try {
-    registryProgramId = new import_web3.PublicKey(programId);
+    registryProgramId = new import_web32.PublicKey(programId);
     log6.info({ programId: programId.slice(0, 12) + "..." }, "Memory registry program configured");
   } catch (err) {
     log6.error({ err }, "Invalid memory registry program ID");
@@ -4347,14 +5197,14 @@ function isRegistryEnabled() {
 }
 function deriveRegistryPDA(authority) {
   if (!registryProgramId) throw new Error("Registry program not configured");
-  return import_web3.PublicKey.findProgramAddressSync(
+  return import_web32.PublicKey.findProgramAddressSync(
     [Buffer.from("memory-registry"), authority.toBuffer()],
     registryProgramId
   );
 }
 function anchorDiscriminator(name) {
-  const { createHash: createHash4 } = require("crypto");
-  const hash = createHash4("sha256").update(`global:${name}`).digest();
+  const { createHash: createHash5 } = require("crypto");
+  const hash = createHash5("sha256").update(`global:${name}`).digest();
   return hash.subarray(0, 8);
 }
 async function initializeRegistry() {
@@ -4370,18 +5220,18 @@ async function initializeRegistry() {
     return;
   }
   const discriminator = anchorDiscriminator("initialize");
-  const instruction = new import_web3.TransactionInstruction({
+  const instruction = new import_web32.TransactionInstruction({
     keys: [
       { pubkey: registryPDA, isSigner: false, isWritable: true },
       { pubkey: wallet.publicKey, isSigner: true, isWritable: true },
-      { pubkey: import_web3.SystemProgram.programId, isSigner: false, isWritable: false }
+      { pubkey: import_web32.SystemProgram.programId, isSigner: false, isWritable: false }
     ],
     programId: registryProgramId,
     data: discriminator
   });
-  const transaction = new import_web3.Transaction().add(instruction);
+  const transaction = new import_web32.Transaction().add(instruction);
   try {
-    const signature = await (0, import_web3.sendAndConfirmTransaction)(conn, transaction, [wallet]);
+    const signature = await (0, import_web32.sendAndConfirmTransaction)(conn, transaction, [wallet]);
     registryInitialized = true;
     log6.info({ signature, registry: registryPDA.toBase58() }, "Registry PDA initialized on-chain");
   } catch (err) {
@@ -4421,18 +5271,18 @@ async function registerMemoryOnChain(contentHash, memoryType, importance, memory
   data.writeUInt8(importanceToTier(importance), 41);
   data.writeBigUInt64LE(BigInt(memoryId), 42);
   data.writeUInt8(encrypted ? 1 : 0, 50);
-  const instruction = new import_web3.TransactionInstruction({
+  const instruction = new import_web32.TransactionInstruction({
     keys: [
       { pubkey: registryPDA, isSigner: false, isWritable: true },
       { pubkey: wallet.publicKey, isSigner: true, isWritable: true },
-      { pubkey: import_web3.SystemProgram.programId, isSigner: false, isWritable: false }
+      { pubkey: import_web32.SystemProgram.programId, isSigner: false, isWritable: false }
     ],
     programId: registryProgramId,
     data
   });
-  const transaction = new import_web3.Transaction().add(instruction);
+  const transaction = new import_web32.Transaction().add(instruction);
   try {
-    const signature = await (0, import_web3.sendAndConfirmTransaction)(conn, transaction, [wallet]);
+    const signature = await (0, import_web32.sendAndConfirmTransaction)(conn, transaction, [wallet]);
     log6.info({ signature: signature.slice(0, 16), memoryId }, "Memory registered on-chain");
     return signature;
   } catch (err) {
@@ -4500,11 +5350,11 @@ async function verifyMemoTransaction(signature, contentHash) {
     return false;
   }
 }
-var import_web3, bs58Module2, import_tweetnacl2, bs582, log6, connection, botWallet, MEMO_PROGRAM_ID2, devnetConnection, registryProgramId, registryInitialized;
+var import_web32, bs58Module2, import_tweetnacl2, bs582, log6, connection, botWallet, MEMO_PROGRAM_ID2, devnetConnection, registryProgramId, registryInitialized;
 var init_solana_client = __esm({
   "packages/shared/src/core/solana-client.ts"() {
     "use strict";
-    import_web3 = require("@solana/web3.js");
+    import_web32 = require("@solana/web3.js");
     bs58Module2 = __toESM(require("bs58"));
     init_config();
     init_logger();
@@ -4513,12 +5363,126 @@ var init_solana_client = __esm({
     bs582 = bs58Module2.default || bs58Module2;
     log6 = createChildLogger("solana-client");
     botWallet = null;
-    MEMO_PROGRAM_ID2 = new import_web3.PublicKey(MEMO_PROGRAM_ID);
+    MEMO_PROGRAM_ID2 = new import_web32.PublicKey(MEMO_PROGRAM_ID);
     registryProgramId = null;
     registryInitialized = false;
   }
 });
 
+// packages/tokenization/src/content-hash.ts
+function stableStringify(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return "[" + value.map(stableStringify).join(",") + "]";
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    const pairs = keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k]));
+    return "{" + pairs.join(",") + "}";
+  }
+  throw new Error(`stableStringify: unsupported value of type ${typeof value}`);
+}
+function normaliseString(s) {
+  return s.normalize("NFC").trim();
+}
+function normaliseNullable(s) {
+  return s === null ? null : normaliseString(s);
+}
+function normaliseTags(tags) {
+  const trimmed = tags.map(normaliseString).filter((t) => t.length > 0);
+  return Array.from(new Set(trimmed)).sort();
+}
+function canonicaliseMemory(input) {
+  const normalised = {
+    algorithm: HASH_ALGORITHM,
+    content: normaliseString(input.content),
+    created_at: input.created_at,
+    memory_type: input.memory_type,
+    owner_wallet: normaliseNullable(input.owner_wallet),
+    related_user: normaliseNullable(input.related_user),
+    related_wallet: normaliseNullable(input.related_wallet),
+    source: normaliseNullable(input.source),
+    tags: normaliseTags(input.tags)
+  };
+  return stableStringify(normalised);
+}
+function memoryContentHash(input) {
+  return (0, import_node_crypto.createHash)("sha256").update(canonicaliseMemory(input), "utf8").digest("hex");
+}
+var import_node_crypto, HASH_ALGORITHM;
+var init_content_hash = __esm({
+  "packages/tokenization/src/content-hash.ts"() {
+    "use strict";
+    import_node_crypto = require("node:crypto");
+    HASH_ALGORITHM = "memory-hash-v1";
+  }
+});
+
+// packages/tokenization/src/pack-merkle.ts
+var init_pack_merkle = __esm({
+  "packages/tokenization/src/pack-merkle.ts"() {
+    "use strict";
+  }
+});
+
+// packages/tokenization/src/mint-client.ts
+var init_mint_client = __esm({
+  "packages/tokenization/src/mint-client.ts"() {
+    "use strict";
+  }
+});
+
+// packages/tokenization/src/tokenize-memory.ts
+var init_tokenize_memory = __esm({
+  "packages/tokenization/src/tokenize-memory.ts"() {
+    "use strict";
+    init_content_hash();
+  }
+});
+
+// packages/tokenization/src/tokenize-batch.ts
+var init_tokenize_batch = __esm({
+  "packages/tokenization/src/tokenize-batch.ts"() {
+    "use strict";
+    init_content_hash();
+    init_pack_merkle();
+  }
+});
+
+// packages/tokenization/src/tokenize-pack.ts
+var init_tokenize_pack = __esm({
+  "packages/tokenization/src/tokenize-pack.ts"() {
+    "use strict";
+    init_pack_merkle();
+  }
+});
+
+// packages/tokenization/src/verify.ts
+var init_verify = __esm({
+  "packages/tokenization/src/verify.ts"() {
+    "use strict";
+    init_pack_merkle();
+  }
+});
+
+// packages/tokenization/src/index.ts
+var init_src2 = __esm({
+  "packages/tokenization/src/index.ts"() {
+    "use strict";
+    init_content_hash();
+    init_pack_merkle();
+    init_mint_client();
+    init_tokenize_memory();
+    init_tokenize_batch();
+    init_tokenize_pack();
+    init_verify();
+  }
+});
+
 // packages/shared/src/core/embeddings.ts
 function getCachedEmbedding(text) {
   const key = text.slice(0, 500).toLowerCase().trim();
@@ -4693,6 +5657,221 @@ var init_embeddings = __esm({
   }
 });
 
+// packages/shared/src/wiki-packs.ts
+function getPackManifest(id) {
+  return ALL_PACK_MANIFESTS.find((p) => p.id === id);
+}
+function matchesKeyword(text, phrase) {
+  if (!phrase) return false;
+  const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`(?<![\\w-])${escaped}(?![\\w-])`, "i");
+  return re.test(text);
+}
+function autoCategorizeTags(opts) {
+  const haystack = [
+    opts.content || "",
+    opts.summary || "",
+    ...opts.existingTags || []
+  ].join(" ");
+  const matched = new Set(opts.existingTags || []);
+  const ids = /* @__PURE__ */ new Set([DEFAULT_PACK_ID, ...opts.installedPackIds]);
+  for (const packId of ids) {
+    const pack = getPackManifest(packId);
+    if (!pack) continue;
+    for (const rule of pack.rules) {
+      if (matched.has(rule.topicId)) continue;
+      const hasMatch = rule.keywords.some((kw) => matchesKeyword(haystack, kw));
+      if (!hasMatch) continue;
+      const isVetoed = (rule.excludeKeywords || []).some((kw) => matchesKeyword(haystack, kw));
+      if (isVetoed) continue;
+      matched.add(rule.topicId);
+    }
+  }
+  return Array.from(matched);
+}
+function topicEmbedSources(installedPackIds) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const ids = /* @__PURE__ */ new Set([DEFAULT_PACK_ID, ...installedPackIds]);
+  for (const packId of ids) {
+    const pack = getPackManifest(packId);
+    if (!pack) continue;
+    for (const t of pack.topics) {
+      if (seen.has(t.id)) continue;
+      seen.add(t.id);
+      const sectionTitles = (t.sectionTemplates || []).map((s) => s.title).join(". ");
+      const text = [t.name, t.summary, sectionTitles].filter(Boolean).join(" \u2014 ");
+      out.push({ topicId: t.id, packId, text });
+    }
+  }
+  return out;
+}
+function cosineSimilarity2(a, b) {
+  if (a.length !== b.length || a.length === 0) return 0;
+  let dot = 0;
+  let normA = 0;
+  let normB = 0;
+  for (let i = 0; i < a.length; i++) {
+    dot += a[i] * b[i];
+    normA += a[i] * a[i];
+    normB += b[i] * b[i];
+  }
+  const denom = Math.sqrt(normA) * Math.sqrt(normB);
+  return denom === 0 ? 0 : dot / denom;
+}
+function semanticTagMatches(memoryEmbedding, topicEmbeddings, threshold = EMBEDDING_TAG_THRESHOLD) {
+  const matched = [];
+  for (const { topicId, embedding } of topicEmbeddings) {
+    const sim = cosineSimilarity2(memoryEmbedding, embedding);
+    if (sim >= threshold) matched.push(topicId);
+  }
+  return matched;
+}
+var WORKSPACE_PACK, COMPLIANCE_PACK, SALES_PACK, ALL_PACK_MANIFESTS, DEFAULT_PACK_ID, EMBEDDING_TAG_THRESHOLD;
+var init_wiki_packs = __esm({
+  "packages/shared/src/wiki-packs.ts"() {
+    "use strict";
+    WORKSPACE_PACK = {
+      id: "workspace",
+      name: "Workspace Essentials",
+      vendor: "Clude",
+      vertical: "General",
+      version: "1.0.0",
+      installedByDefault: true,
+      description: "The default knowledge-worker pack. Roadmaps, decisions, customer research, hiring, team process \u2014 everything you'd want a colleague to be able to skim.",
+      topics: [
+        { id: "q3-roadmap", name: "Q3 Roadmap", cluster: "architecture", color: "#2244FF", summary: "What ships this quarter, what got cut, and the calls behind those decisions." },
+        { id: "auth-migration", name: "Auth Migration", cluster: "architecture", color: "#2244FF", summary: "Moving from session cookies to JWT \u2014 incidents, fixes, and the rollback plan." },
+        { id: "customer-research", name: "Customer Research", cluster: "research", color: "#F59E0B", summary: "Patterns surfaced across customer calls." },
+        { id: "pricing-model", name: "Pricing Model", cluster: "product", color: "#10B981", summary: "Per-token vs per-seat \u2014 the active disagreement." },
+        { id: "demo-day-prep", name: "Demo Day Prep", cluster: "product", color: "#10B981", summary: "What works in the live demo, what breaks." },
+        { id: "hiring", name: "Hiring Pipeline", cluster: "product", color: "#10B981", summary: "Candidates in flight and interview-signal patterns." },
+        { id: "team-process", name: "Team Process", cluster: "self", color: "#8B5CF6", summary: "What's working in how the team operates and what isn't." },
+        { id: "design-decisions", name: "Design Decisions", cluster: "research", color: "#F59E0B", summary: "API shapes, naming choices, and the reasons behind them." }
+      ],
+      rules: [
+        { topicId: "q3-roadmap", keywords: ["roadmap", "q3", "quarter", "sprint plan", "priority"] },
+        { topicId: "auth-migration", keywords: ["auth", "jwt", "session cookie", "oauth", "sso", "token migration"] },
+        { topicId: "customer-research", keywords: ["customer call", "interview", "feedback", "user research", "persona"] },
+        { topicId: "pricing-model", keywords: ["pricing", "per-token", "per-seat", "subscription", "billing tier"] },
+        { topicId: "demo-day-prep", keywords: ["demo", "rehearsal", "investor", "pitch"] },
+        {
+          topicId: "hiring",
+          keywords: ["candidate", "interview", "hire", "phone screen", "onsite", "offer"],
+          // Suppress when "hire" is in the wrong context — got fired, rejected an offer,
+          // hire-purchase, etc. The classic substring-match false positive.
+          excludeKeywords: ["fired me", "i was fired", "hire purchase", "rejected my offer", "rejected the offer"]
+        },
+        { topicId: "team-process", keywords: ["standup", "retro", "sprint", "1:1", "process", "team"] },
+        { topicId: "design-decisions", keywords: ["api design", "schema", "naming", "rfc", "design doc"] }
+      ]
+    };
+    COMPLIANCE_PACK = {
+      id: "compliance",
+      name: "Clude Compliance",
+      vendor: "Clude",
+      vertical: "Compliance",
+      version: "1.0.0",
+      description: "Auto-organises every compliance-relevant decision your agents make into an audit-ready wiki. Audit logs, evidence collection, regulator asks, policy decisions \u2014 each with a cryptographic receipt anchored to Solana.",
+      topics: [
+        {
+          id: "audit-logs",
+          name: "Audit Logs",
+          cluster: "architecture",
+          color: "#0EA5E9",
+          summary: "Every flagged agent action with attribution, timestamp, and a Solana-anchored hash a regulator can verify without trusting us.",
+          sectionTemplates: [
+            { id: "recent-events", title: "Recent flagged events", kind: "overview" },
+            { id: "anomalies", title: "Anomalies & escalations", kind: "concern" },
+            { id: "retention", title: "Retention policy", kind: "decision" }
+          ]
+        },
+        {
+          id: "evidence",
+          name: "Evidence Collection",
+          cluster: "product",
+          color: "#06B6D4",
+          summary: "Documentation gathered for SOC2, HIPAA, and ISO 27001 \u2014 what we have, what we still need, and what auditors have already accepted.",
+          sectionTemplates: [
+            { id: "have", title: "What we have", kind: "highlight" },
+            { id: "gaps", title: "Gaps to fill", kind: "action" },
+            { id: "accepted", title: "What auditors accepted", kind: "decision" }
+          ]
+        },
+        {
+          id: "regulator-asks",
+          name: "Regulator Asks",
+          cluster: "research",
+          color: "#F59E0B",
+          summary: "Specific requests from regulators \u2014 owner, deadline, response status. Nothing falls through the cracks.",
+          sectionTemplates: [
+            { id: "open", title: "Open requests", kind: "action" },
+            { id: "responded", title: "Responded", kind: "decision" },
+            { id: "patterns", title: "Recurring patterns", kind: "highlight" }
+          ]
+        },
+        {
+          id: "policy-decisions",
+          name: "Policy Decisions",
+          cluster: "self",
+          color: "#8B5CF6",
+          summary: "Calls made about what the agents are allowed to do \u2014 data handling, escalation triggers, redaction rules \u2014 each anchored on-chain.",
+          sectionTemplates: [
+            { id: "standing", title: "Standing policy", kind: "decision" },
+            { id: "changes", title: "Recent changes", kind: "overview" },
+            { id: "open", title: "Open questions", kind: "question" }
+          ]
+        },
+        {
+          id: "soc2-status",
+          name: "SOC2 Status",
+          cluster: "product",
+          color: "#10B981",
+          summary: "Where we are in the SOC2 audit cycle, what controls are passing, what still needs evidence.",
+          sectionTemplates: [
+            { id: "controls", title: "Control status", kind: "overview" },
+            { id: "next", title: "Up next", kind: "action" }
+          ]
+        }
+      ],
+      rules: [
+        { topicId: "audit-logs", keywords: ["audit", "audit log", "trail", "attribution", "flagged"] },
+        { topicId: "evidence", keywords: ["evidence", "soc2", "hipaa", "iso 27001", "compliance evidence", "control"] },
+        { topicId: "regulator-asks", keywords: ["regulator", "subpoena", "compliance request", "data request"] },
+        { topicId: "policy-decisions", keywords: ["policy", "redaction", "pii", "escalation rule", "data handling"] },
+        { topicId: "soc2-status", keywords: ["soc2", "audit cycle", "control test"] }
+      ]
+    };
+    SALES_PACK = {
+      id: "sales",
+      name: "Sales Intelligence",
+      vendor: "Clude",
+      vertical: "Sales",
+      version: "1.0.0",
+      description: "Auto-organises pipeline conversations, deal blockers, objection patterns, and post-call follow-ups. Built for AEs who hate CRM data entry.",
+      topics: [
+        { id: "pipeline", name: "Pipeline", cluster: "product", color: "#10B981", summary: "Active deals, stages, blockers." },
+        { id: "objections", name: "Objections", cluster: "research", color: "#F59E0B", summary: "Patterns across discovery calls." },
+        { id: "follow-ups", name: "Follow-ups", cluster: "product", color: "#10B981", summary: "What you committed to send and to whom." },
+        { id: "champions", name: "Champions", cluster: "self", color: "#8B5CF6", summary: "Who is championing your product internally at each account." }
+      ],
+      rules: [
+        { topicId: "pipeline", keywords: ["deal", "opportunity", "stage", "close date", "mql", "sql"] },
+        { topicId: "objections", keywords: ["objection", "concern raised", "pushback", "competitor mentioned"] },
+        { topicId: "follow-ups", keywords: ["follow up", "send", "next step", "committed to"] },
+        { topicId: "champions", keywords: ["champion", "sponsor", "advocate", "introduced me to"] }
+      ]
+    };
+    ALL_PACK_MANIFESTS = [
+      WORKSPACE_PACK,
+      COMPLIANCE_PACK,
+      SALES_PACK
+    ];
+    DEFAULT_PACK_ID = "workspace";
+    EMBEDDING_TAG_THRESHOLD = 0.78;
+  }
+});
+
 // packages/brain/src/experimental/config.ts
 function envBool(key, fallback) {
   const val = process.env[key];
@@ -5134,6 +6313,7 @@ __export(memory_exports, {
   getSelfModel: () => getSelfModel,
   hydrateMemories: () => hydrateMemories,
   inferConcepts: () => inferConcepts,
+  invalidateInstalledPacksCache: () => invalidateInstalledPacksCache,
   isValidHashId: () => isValidHashId,
   listMemories: () => listMemories,
   markJepaQueried: () => markJepaQueried,
@@ -5236,13 +6416,83 @@ function isDuplicateWrite(source, summary) {
   }
   return false;
 }
+async function getInstalledPackIdsCached(ownerWallet) {
+  const key = ownerWallet ?? "__no_owner__";
+  const now = Date.now();
+  const cached = installedPacksCache.get(key);
+  if (cached && cached.expiresAt > now) return cached.ids;
+  let ids = [DEFAULT_PACK_ID];
+  if (ownerWallet) {
+    try {
+      const db = getDb();
+      const { data, error } = await db.from("wiki_pack_installations").select("pack_id").eq("owner_wallet", ownerWallet);
+      if (!error && data) {
+        const fromDb = data.map((r) => r.pack_id);
+        ids = Array.from(/* @__PURE__ */ new Set([DEFAULT_PACK_ID, ...fromDb]));
+      }
+    } catch (err) {
+      log11.debug({ err }, "Failed to fetch installed packs (using default only)");
+    }
+  }
+  installedPacksCache.set(key, { ids, expiresAt: now + INSTALLED_PACKS_TTL_MS });
+  if (installedPacksCache.size > 200) {
+    for (const [k, v] of installedPacksCache) {
+      if (v.expiresAt <= now) installedPacksCache.delete(k);
+    }
+  }
+  return ids;
+}
+function invalidateInstalledPacksCache(ownerWallet) {
+  if (ownerWallet) installedPacksCache.delete(ownerWallet);
+  else installedPacksCache.clear();
+}
+async function ensureTopicEmbeddings(installedPackIds) {
+  const sources = topicEmbedSources(installedPackIds);
+  const missing = sources.filter((s) => !topicEmbeddingCache.has(s.topicId));
+  if (missing.length === 0) {
+    return new Map(sources.map((s) => [s.topicId, topicEmbeddingCache.get(s.topicId)]));
+  }
+  if (topicEmbeddingPopulationLock) {
+    await topicEmbeddingPopulationLock;
+  }
+  const stillMissing = sources.filter((s) => !topicEmbeddingCache.has(s.topicId));
+  if (stillMissing.length === 0) {
+    return new Map(sources.map((s) => [s.topicId, topicEmbeddingCache.get(s.topicId)]));
+  }
+  topicEmbeddingPopulationLock = (async () => {
+    try {
+      const texts = stillMissing.map((s) => s.text);
+      const embeddings = await generateEmbeddings(texts);
+      stillMissing.forEach((s, i) => {
+        const emb = embeddings[i];
+        if (emb) topicEmbeddingCache.set(s.topicId, emb);
+      });
+    } catch (err) {
+      log11.warn({ err }, "Failed to populate topic embeddings cache");
+    } finally {
+      topicEmbeddingPopulationLock = null;
+    }
+  })();
+  await topicEmbeddingPopulationLock;
+  return new Map(
+    sources.filter((s) => topicEmbeddingCache.has(s.topicId)).map((s) => [s.topicId, topicEmbeddingCache.get(s.topicId)])
+  );
+}
 async function storeMemory(opts) {
   if (opts.source.startsWith("shiro_") && isDuplicateWrite(opts.source, opts.summary)) {
     log11.debug({ source: opts.source, summary: opts.summary.slice(0, 60) }, "Skipping duplicate memory write");
     return null;
   }
   const db = getDb();
+  const ownerWallet = getOwnerWallet();
   const concepts = opts.concepts || inferConcepts(opts.summary, opts.source, opts.tags || []);
+  const installedPackIds = await getInstalledPackIdsCached(ownerWallet);
+  const taggedTags = autoCategorizeTags({
+    content: opts.content,
+    summary: opts.summary,
+    existingTags: opts.tags || [],
+    installedPackIds
+  });
   const hashId = generateHashId();
   try {
     const plaintextContent = opts.content.slice(0, MEMORY_MAX_CONTENT_LENGTH);
@@ -5253,7 +6503,7 @@ async function storeMemory(opts) {
       memory_type: opts.type,
       content: storedContent,
       summary: opts.summary.slice(0, MEMORY_MAX_SUMMARY_LENGTH),
-      tags: opts.tags || [],
+      tags: taggedTags,
       concepts,
       emotional_valence: clamp(opts.emotionalValence ?? 0, -1, 1),
       importance: clamp(opts.importance ?? 0.5, 0, 1),
@@ -5266,8 +6516,8 @@ async function storeMemory(opts) {
       compacted: false,
       encrypted: shouldEncrypt,
       encryption_pubkey: shouldEncrypt ? getEncryptionPubkey() : null,
-      owner_wallet: getOwnerWallet() || null
-    }).select("id, hash_id").single();
+      owner_wallet: ownerWallet || null
+    }).select("id, hash_id, content, memory_type, owner_wallet, created_at, tags, source, related_user, related_wallet").single();
     if (error) {
       log11.error({ error: error.message }, "Failed to store memory");
       return null;
@@ -5285,7 +6535,9 @@ async function storeMemory(opts) {
       memoryType: opts.type,
       source: opts.source
     });
-    commitMemoryToChain(data.id, opts).catch((err) => log11.warn({ err }, "On-chain memory commit failed"));
+    commitMemoryToChain(data.id, opts, data).catch(
+      (err) => log11.warn({ err }, "On-chain memory commit failed")
+    );
     embedMemory(data.id, opts).catch((err) => log11.warn({ err }, "Embedding generation failed"));
     autoLinkMemory(data.id, opts).catch((err) => log11.warn({ err }, "Auto-linking failed"));
     extractAndLinkEntitiesForMemory(data.id, opts).catch((err) => log11.debug({ err }, "Entity extraction failed"));
@@ -5295,9 +6547,19 @@ async function storeMemory(opts) {
     return null;
   }
 }
-async function commitMemoryToChain(memoryId, opts) {
-  if (opts.source === "demo" || opts.source === "demo-maas" || opts.source === "locomo-benchmark" || opts.source === "longmemeval-benchmark") return;
-  const contentHashBuf = (0, import_crypto3.createHash)("sha256").update(opts.content).digest();
+async function commitMemoryToChain(memoryId, opts, row) {
+  if (TOKENISATION_SKIP_SOURCES.has(opts.source)) return;
+  const canonicalHash = memoryContentHash({
+    content: row.content,
+    memory_type: row.memory_type,
+    owner_wallet: row.owner_wallet,
+    created_at: row.created_at,
+    tags: row.tags ?? [],
+    source: row.source,
+    related_user: row.related_user,
+    related_wallet: row.related_wallet
+  });
+  const contentHashBuf = Buffer.from(canonicalHash, "hex");
   let signature = null;
   if (isRegistryEnabled()) {
     const encrypted = isEncryptionEnabled();
@@ -5310,22 +6572,61 @@ async function commitMemoryToChain(memoryId, opts) {
     );
   }
   if (!signature) {
-    const contentHashHex = contentHashBuf.toString("hex");
-    const memo = `clude:v1:sha256:${contentHashHex}`;
+    const memo = `clude:v1:sha256:${canonicalHash}`;
     signature = await writeMemo(memo);
   }
-  if (!signature) return;
   const db = getDb();
-  await db.from("memories").update({ solana_signature: signature }).eq("id", memoryId);
-  log11.debug({ memoryId, signature: signature.slice(0, 16) }, "Memory committed on-chain");
+  if (!signature) {
+    await db.from("memories").update({ content_hash: canonicalHash, tokenization_status: "failed" }).eq("id", memoryId);
+    return;
+  }
+  await db.from("memories").update({
+    solana_signature: signature,
+    content_hash: canonicalHash,
+    cnft_address: signature,
+    // PDA-based v0.1 — assetId = tx sig; LightMintClient (v0.2) will use real cNFT mints
+    cnft_tx_sig: signature,
+    cnft_tree: null,
+    cnft_leaf_index: null,
+    tokenization_status: "minted",
+    tokenized_at: (/* @__PURE__ */ new Date()).toISOString()
+  }).eq("id", memoryId);
+  log11.debug({ memoryId, signature: signature.slice(0, 16) }, "Memory committed on-chain (PMP + legacy)");
 }
 async function embedMemory(memoryId, opts) {
   if (!isEmbeddingEnabled()) return;
   const db = getDb();
   const embeddings = await generateEmbeddings([opts.summary]);
   const summaryEmbedding = embeddings[0];
-  if (summaryEmbedding) {
-    await db.from("memories").update({ embedding: JSON.stringify(summaryEmbedding) }).eq("id", memoryId);
+  if (!summaryEmbedding) {
+    log11.debug({ memoryId }, "No embedding generated; skipping semantic tagging");
+    return;
+  }
+  await db.from("memories").update({ embedding: JSON.stringify(summaryEmbedding) }).eq("id", memoryId);
+  try {
+    const ownerWallet = getOwnerWallet();
+    const installedPacks = await getInstalledPackIdsCached(ownerWallet);
+    const topicEmbeddings = await ensureTopicEmbeddings(installedPacks);
+    if (topicEmbeddings.size > 0) {
+      const semantic = semanticTagMatches(
+        summaryEmbedding,
+        Array.from(topicEmbeddings, ([topicId, embedding]) => ({ topicId, embedding }))
+      );
+      if (semantic.length > 0) {
+        const { data: row } = await db.from("memories").select("tags").eq("id", memoryId).maybeSingle();
+        const existing = row?.tags ?? [];
+        const merged = Array.from(/* @__PURE__ */ new Set([...existing, ...semantic]));
+        if (merged.length !== existing.length) {
+          await db.from("memories").update({ tags: merged }).eq("id", memoryId);
+          log11.debug({
+            memoryId,
+            added: semantic.filter((t) => !existing.includes(t))
+          }, "Semantic pack tags appended");
+        }
+      }
+    }
+  } catch (err) {
+    log11.debug({ err, memoryId }, "Semantic tagging skipped");
   }
   log11.debug({ memoryId }, "Memory embedded");
 }
@@ -5528,9 +6829,9 @@ async function recallMemories(opts) {
     }
     if (candidates.length === 0) return [];
     const linkPathMap = /* @__PURE__ */ new Map();
-    const addLinkPath = (id, path8) => {
+    const addLinkPath = (id, path9) => {
       if (!linkPathMap.has(id)) linkPathMap.set(id, /* @__PURE__ */ new Set());
-      linkPathMap.get(id).add(path8);
+      linkPathMap.get(id).add(path9);
     };
     for (const id of vectorScores.keys()) addLinkPath(id, "vector");
     for (const id of bm25Scores.keys()) addLinkPath(id, "bm25");
@@ -6047,25 +7348,31 @@ async function getMemoryStats() {
     embeddedCount: 0
   };
   try {
-    let countQuery = db.from("memories").select("id", { count: "exact", head: true }).gt("decay_factor", MEMORY_MIN_DECAY);
+    let countQuery = db.from("memories").select("id", { count: "exact", head: true });
     countQuery = scopeToOwner(countQuery);
     const { count: totalCount } = await countQuery;
     stats.total = totalCount || 0;
-    let embeddedQuery = db.from("memories").select("id", { count: "exact", head: true }).gt("decay_factor", MEMORY_MIN_DECAY).not("embedding", "is", null);
+    let embeddedQuery = db.from("memories").select("id", { count: "exact", head: true }).not("embedding", "is", null);
     embeddedQuery = scopeToOwner(embeddedQuery);
     const { count: embCount } = await embeddedQuery;
     stats.embeddedCount = embCount || 0;
-    const PAGE_SIZE = 5e3;
+    const TYPES = ["episodic", "semantic", "procedural", "self_model", "introspective"];
+    await Promise.all(TYPES.map(async (type) => {
+      let q = db.from("memories").select("id", { count: "exact", head: true }).eq("memory_type", type);
+      q = scopeToOwner(q);
+      const { count: count2 } = await q;
+      stats.byType[type] = count2 || 0;
+    }));
+    const PAGE_SIZE = 1e3;
+    const MAX_PAGES = 20;
     let allMemories = [];
-    let page = 0;
-    while (true) {
-      let pageQuery = db.from("memories").select("memory_type, importance, decay_factor, created_at, related_user, tags, concepts").gt("decay_factor", MEMORY_MIN_DECAY).range(page * PAGE_SIZE, (page + 1) * PAGE_SIZE - 1);
+    for (let page = 0; page < MAX_PAGES; page++) {
+      let pageQuery = db.from("memories").select("importance, decay_factor, created_at, related_user, tags, concepts").order("id", { ascending: true }).range(page * PAGE_SIZE, (page + 1) * PAGE_SIZE - 1);
       pageQuery = scopeToOwner(pageQuery);
       const { data: pageData } = await pageQuery;
       if (!pageData || pageData.length === 0) break;
       allMemories = allMemories.concat(pageData);
       if (pageData.length < PAGE_SIZE) break;
-      page++;
     }
     if (allMemories.length > 0) {
       let impSum = 0;
@@ -6074,8 +7381,6 @@ async function getMemoryStats() {
       const conceptCounts = {};
       const users = /* @__PURE__ */ new Set();
       for (const m of allMemories) {
-        const type = m.memory_type;
-        if (type in stats.byType) stats.byType[type]++;
         impSum += m.importance;
         decaySum += m.decay_factor;
         if (m.related_user) users.add(m.related_user);
@@ -6263,7 +7568,7 @@ function moodToValence(mood) {
       return 0;
   }
 }
-var import_crypto3, EMBED_CACHE_MAX, embeddingCache, _ownerWallet, SCOPE_BOT_OWN, HASH_ID_PREFIX, log11, DEDUP_TTL_MS, dedupCache, STOPWORDS;
+var import_crypto3, EMBED_CACHE_MAX, embeddingCache, _ownerWallet, SCOPE_BOT_OWN, HASH_ID_PREFIX, log11, DEDUP_TTL_MS, dedupCache, installedPacksCache, INSTALLED_PACKS_TTL_MS, topicEmbeddingCache, topicEmbeddingPopulationLock, TOKENISATION_SKIP_SOURCES, STOPWORDS;
 var init_memory = __esm({
   "packages/brain/src/memory/memory.ts"() {
     "use strict";
@@ -6272,7 +7577,9 @@ var init_memory = __esm({
     init_utils();
     init_claude_client();
     init_solana_client();
+    init_src2();
     init_embeddings();
+    init_wiki_packs();
     init_config2();
     init_bm25_search();
     init_openrouter_client();
@@ -6289,6 +7596,16 @@ var init_memory = __esm({
     log11 = createChildLogger("memory");
     DEDUP_TTL_MS = 10 * 60 * 1e3;
     dedupCache = /* @__PURE__ */ new Map();
+    installedPacksCache = /* @__PURE__ */ new Map();
+    INSTALLED_PACKS_TTL_MS = 6e4;
+    topicEmbeddingCache = /* @__PURE__ */ new Map();
+    topicEmbeddingPopulationLock = null;
+    TOKENISATION_SKIP_SOURCES = /* @__PURE__ */ new Set([
+      "demo",
+      "demo-maas",
+      "locomo-benchmark",
+      "longmemeval-benchmark"
+    ]);
     STOPWORDS = /* @__PURE__ */ new Set([
       "the",
       "a",
@@ -6394,6 +7711,7 @@ __export(memory_exports2, {
   getSelfModel: () => getSelfModel,
   hydrateMemories: () => hydrateMemories,
   inferConcepts: () => inferConcepts,
+  invalidateInstalledPacksCache: () => invalidateInstalledPacksCache,
   isValidHashId: () => isValidHashId,
   listMemories: () => listMemories,
   moodToValence: () => moodToValence,
@@ -6778,7 +8096,7 @@ async function runExport() {
     writeMemoryPack(outputDir, records, {
       producer: {
         name: "clude",
-        version: "3.0.3",
+        version: "3.1.0",
         agent_id: config3?.agent?.id,
         public_key: publicKey
       },
@@ -6851,7 +8169,7 @@ var init_export = __esm({
     "use strict";
     import_fs5 = require("fs");
     init_banner();
-    init_memorypack();
+    init_src();
   }
 });
 
@@ -6863,9 +8181,9 @@ __export(import_exports, {
 function hasFlag2(args, flag) {
   return args.includes(flag);
 }
-function isMemoryPackDir(path8) {
+function isMemoryPackDir(path9) {
   try {
-    return (0, import_fs6.statSync)(path8).isDirectory() && (0, import_fs6.existsSync)((0, import_path6.join)(path8, "manifest.json"));
+    return (0, import_fs6.statSync)(path9).isDirectory() && (0, import_fs6.existsSync)((0, import_path6.join)(path9, "manifest.json"));
   } catch {
     return false;
   }
@@ -6889,19 +8207,19 @@ function parseMemoryPackDir(dir) {
     source: r.source || "memorypack"
   }));
 }
-function isZipFile(path8) {
+function isZipFile(path9) {
   try {
-    const buf = (0, import_fs6.readFileSync)(path8);
+    const buf = (0, import_fs6.readFileSync)(path9);
     return buf[0] === 80 && buf[1] === 75;
   } catch {
     return false;
   }
 }
-function isJsonFile(path8) {
-  return path8.endsWith(".json");
+function isJsonFile(path9) {
+  return path9.endsWith(".json");
 }
-function isMarkdownOrText(path8) {
-  return path8.endsWith(".md") || path8.endsWith(".txt") || path8.endsWith(".markdown");
+function isMarkdownOrText(path9) {
+  return path9.endsWith(".md") || path9.endsWith(".txt") || path9.endsWith(".markdown");
 }
 function isSubstantive(text) {
   if (!text || text.length < 20) return false;
@@ -7018,18 +8336,18 @@ function extractFromChatGPTConversations(conversations) {
 }
 async function parseChatGPTZip(filePath) {
   const { execSync: execSync2 } = require("child_process");
-  const { mkdtempSync, readdirSync: readdirSync2 } = require("fs");
-  const { join: join11 } = require("path");
-  const os5 = require("os");
-  const tmpDir = mkdtempSync(join11(os5.tmpdir(), "clude-import-"));
+  const { mkdtempSync: mkdtempSync3, readdirSync: readdirSync3 } = require("fs");
+  const { join: join13 } = require("path");
+  const os6 = require("os");
+  const tmpDir = mkdtempSync3(join13(os6.tmpdir(), "clude-import-"));
   try {
     execSync2(`unzip -o -q "${filePath}" -d "${tmpDir}"`);
   } catch {
     printError('Failed to unzip file. Make sure "unzip" is installed.');
     process.exit(1);
   }
-  const files = readdirSync2(tmpDir);
-  const convFile = files.find((f) => f === "conversations.json") ? join11(tmpDir, "conversations.json") : null;
+  const files = readdirSync3(tmpDir);
+  const convFile = files.find((f) => f === "conversations.json") ? join13(tmpDir, "conversations.json") : null;
   if (!convFile) {
     const { execSync: exec2 } = require("child_process");
     try {
@@ -7272,7 +8590,7 @@ var init_import = __esm({
     import_fs6 = require("fs");
     import_path6 = require("path");
     init_banner();
-    init_memorypack();
+    init_src();
   }
 });
 
@@ -7423,13 +8741,13 @@ async function runInjectInstructions() {
   const forceAgents = args.includes("--agents");
   const forceClaude = args.includes("--claude");
   const dirFlag = args.find((a) => a.startsWith("--dir="));
-  const dir = dirFlag ? path5.resolve(dirFlag.slice(6)) : process.cwd();
+  const dir = dirFlag ? path6.resolve(dirFlag.slice(6)) : process.cwd();
   let useAgentsmd = forceAgents;
   if (!forceAgents && !forceClaude) {
-    useAgentsmd = fs3.existsSync(path5.join(dir, "AGENTS.md")) || fs3.existsSync(path5.join(dir, "agents"));
+    useAgentsmd = fs4.existsSync(path6.join(dir, "AGENTS.md")) || fs4.existsSync(path6.join(dir, "agents"));
   }
   const targetFile = useAgentsmd ? "AGENTS.md" : "CLAUDE.md";
-  printInfo(`Target: ${path5.join(dir, targetFile)}`);
+  printInfo(`Target: ${path6.join(dir, targetFile)}`);
   console.log("");
   const result = injectInstructions(dir, { agentsmd: useAgentsmd });
   if (result) {
@@ -7448,12 +8766,12 @@ async function runInjectInstructions() {
   printDivider();
   console.log("");
 }
-var path5, fs3;
+var path6, fs4;
 var init_inject_instructions = __esm({
   "packages/brain/src/cli/inject-instructions.ts"() {
     "use strict";
-    path5 = __toESM(require("path"));
-    fs3 = __toESM(require("fs"));
+    path6 = __toESM(require("path"));
+    fs4 = __toESM(require("fs"));
     init_banner();
     init_setup();
   }
@@ -7466,13 +8784,13 @@ __export(doctor_exports, {
 });
 async function runDoctor() {
   console.log("\n  CLUDE DIAGNOSTICS\n");
-  const dbPath = path6.join(os3.homedir(), ".clude", "brain.db");
-  if (fs4.existsSync(dbPath)) {
+  const dbPath = path7.join(os4.homedir(), ".clude", "brain.db");
+  if (fs5.existsSync(dbPath)) {
     try {
       const Database2 = require("better-sqlite3");
       const db = new Database2(dbPath, { readonly: true });
       const count = db.prepare("SELECT COUNT(*) as c FROM memories").get().c;
-      const stats = fs4.statSync(dbPath);
+      const stats = fs5.statSync(dbPath);
       const sizeMB = (stats.size / 1024 / 1024).toFixed(1);
       console.log(`  \u2713 Database      ${dbPath} (${count} memories, ${sizeMB} MB)`);
       db.close();
@@ -7482,15 +8800,15 @@ async function runDoctor() {
   } else {
     console.log(`  \u2717 Database      Not found (run 'npx @clude/sdk setup')`);
   }
-  const modelDir = path6.join(os3.homedir(), ".clude", "models");
-  const modelCached = fs4.existsSync(modelDir) && fs4.readdirSync(modelDir).length > 0;
+  const modelDir = path7.join(os4.homedir(), ".clude", "models");
+  const modelCached = fs5.existsSync(modelDir) && fs5.readdirSync(modelDir).length > 0;
   console.log(
     modelCached ? "  \u2713 Embeddings    all-MiniLM-L6-v2 (cached)" : "  \u2717 Embeddings    Model not cached (will download on first use)"
   );
-  const configPath = path6.join(os3.homedir(), ".clude", "config.json");
-  if (fs4.existsSync(configPath)) {
+  const configPath = path7.join(os4.homedir(), ".clude", "config.json");
+  if (fs5.existsSync(configPath)) {
     try {
-      const config3 = JSON.parse(fs4.readFileSync(configPath, "utf-8"));
+      const config3 = JSON.parse(fs5.readFileSync(configPath, "utf-8"));
       console.log(
         config3.apiKey ? `  \u2713 Cloud         ${config3.apiKey.slice(0, 8)}... (configured)` : "  \u2717 Cloud         No API key configured"
       );
@@ -7513,13 +8831,13 @@ async function runDoctor() {
     console.log("  \u2717 Ollama        Not running");
   }
   const mcpPaths = [
-    { name: "Claude Code", path: path6.join(os3.homedir(), ".claude", ".mcp.json") },
-    { name: "Cursor", path: path6.join(os3.homedir(), ".cursor", "mcp.json") }
+    { name: "Claude Code", path: path7.join(os4.homedir(), ".claude", ".mcp.json") },
+    { name: "Cursor", path: path7.join(os4.homedir(), ".cursor", "mcp.json") }
   ];
   for (const mcp of mcpPaths) {
-    if (fs4.existsSync(mcp.path)) {
+    if (fs5.existsSync(mcp.path)) {
       try {
-        const config3 = JSON.parse(fs4.readFileSync(mcp.path, "utf-8"));
+        const config3 = JSON.parse(fs5.readFileSync(mcp.path, "utf-8"));
         const hasClude = config3.mcpServers?.["clude-memory"] !== void 0;
         console.log(
           hasClude ? `  \u2713 MCP           ${mcp.name}` : `  - MCP           ${mcp.name} (no clude-memory entry)`
@@ -7531,7 +8849,7 @@ async function runDoctor() {
       console.log(`  \u2717 MCP           ${mcp.name} (not detected)`);
     }
   }
-  if (fs4.existsSync(dbPath)) {
+  if (fs5.existsSync(dbPath)) {
     try {
       const Database2 = require("better-sqlite3");
       const db = new Database2(dbPath, { readonly: true });
@@ -7543,13 +8861,13 @@ async function runDoctor() {
   }
   console.log("");
 }
-var path6, os3, fs4;
+var path7, os4, fs5;
 var init_doctor = __esm({
   "packages/brain/src/cli/doctor.ts"() {
     "use strict";
-    path6 = __toESM(require("path"));
-    os3 = __toESM(require("os"));
-    fs4 = __toESM(require("fs"));
+    path7 = __toESM(require("path"));
+    os4 = __toESM(require("os"));
+    fs5 = __toESM(require("fs"));
   }
 });
 
@@ -7819,8 +9137,8 @@ __export(dream_exports, {
 });
 async function runDream() {
   console.log("\n  DREAM CYCLE\n");
-  const dbPath = path7.join(os4.homedir(), ".clude", "brain.db");
-  if (!fs5.existsSync(dbPath)) {
+  const dbPath = path8.join(os5.homedir(), ".clude", "brain.db");
+  if (!fs6.existsSync(dbPath)) {
     console.log('  \u2717 No database found. Run "npx @clude/sdk setup" first.\n');
     return;
   }
@@ -7850,13 +9168,300 @@ async function runDream() {
   store.close();
   console.log("\n  Dream cycle complete.\n");
 }
-var path7, os4, fs5;
+var path8, os5, fs6;
 var init_dream = __esm({
   "packages/brain/src/cli/dream.ts"() {
     "use strict";
-    path7 = __toESM(require("path"));
-    os4 = __toESM(require("os"));
-    fs5 = __toESM(require("fs"));
+    path8 = __toESM(require("path"));
+    os5 = __toESM(require("os"));
+    fs6 = __toESM(require("fs"));
+  }
+});
+
+// packages/brain/src/cli/verify.ts
+var verify_exports = {};
+__export(verify_exports, {
+  runVerify: () => runVerify
+});
+function parseArgs() {
+  const argv = process.argv.slice(3);
+  const args = {
+    path: "",
+    strictSignatures: false,
+    verifyChain: false,
+    strictChain: false,
+    rpcUrl: process.env.SOLANA_RPC_URL || "https://api.mainnet-beta.solana.com",
+    showHelp: false
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") args.showHelp = true;
+    else if (a === "--public-key") args.publicKey = argv[++i];
+    else if (a === "--strict-signatures") args.strictSignatures = true;
+    else if (a === "--strict-chain") args.strictChain = true;
+    else if (a === "--verify-chain") args.verifyChain = true;
+    else if (a === "--rpc-url") args.rpcUrl = argv[++i];
+    else if (a === "--cluster") args.cluster = argv[++i];
+    else if (a === "--decrypt-key") args.decryptKey = argv[++i];
+    else if (!a.startsWith("--") && !args.path) args.path = a;
+  }
+  return args;
+}
+function printUsage() {
+  console.log(`Usage: clude verify <pack> [options]
+
+  Validates a MemoryPack directory or .tar.zst tarball.
+
+Options:
+  --public-key <base58>     Override the public key (default: from manifest)
+  --strict-signatures       Fail if any record is unsigned
+  --verify-chain            Also verify Solana on-chain anchors
+  --strict-chain            Fail on any chain verification mismatch
+  --rpc-url <url>           Solana RPC URL for chain verification
+                            (default: SOLANA_RPC_URL env or mainnet-beta)
+  --cluster <name>          Cross-check RPC genesis hash against this
+                            cluster (mainnet | devnet | testnet)
+  --decrypt-key <base64>    Pack-level decryption key (32 bytes, base64)
+
+Exit code: 0 if valid, 1 if any check failed.`);
+}
+async function runVerify() {
+  const args = parseArgs();
+  if (args.showHelp || !args.path) {
+    printUsage();
+    process.exit(args.showHelp ? 0 : 1);
+  }
+  console.log(`${c.bold}MemoryPack verify${c.reset}  ${c.dim}${args.path}${c.reset}
+`);
+  let decryptionKey;
+  if (args.decryptKey) {
+    const buf = Buffer.from(args.decryptKey, "base64");
+    decryptionKey = new Uint8Array(buf);
+  }
+  let result;
+  try {
+    result = readMemoryPack(args.path, {
+      publicKey: args.publicKey,
+      strictSignatures: args.strictSignatures,
+      decryptionKey
+    });
+  } catch (e) {
+    console.error(`${c.red}REJECTED${c.reset}: ${e.message}`);
+    process.exit(1);
+  }
+  const {
+    manifest,
+    records,
+    verifiedRecords,
+    unsignedRecords,
+    anchors,
+    verifiedBlobs,
+    minimalRecords,
+    warnings
+  } = result;
+  console.log(`  ${c.dim}producer:${c.reset}        ${manifest.producer.name} ${manifest.producer.version}`);
+  if (manifest.producer.did) console.log(`  ${c.dim}did:${c.reset}             ${manifest.producer.did}`);
+  if (manifest.producer.public_key) console.log(`  ${c.dim}public_key:${c.reset}      ${manifest.producer.public_key}`);
+  console.log(`  ${c.dim}created_at:${c.reset}      ${manifest.created_at}`);
+  console.log(`  ${c.dim}records:${c.reset}         ${records.length}`);
+  console.log(`  ${c.dim}schema:${c.reset}          ${manifest.record_schema}`);
+  console.log(`  ${c.dim}encryption:${c.reset}      ${manifest.encryption ? `${manifest.encryption.algorithm} (scope=${manifest.encryption.scope})` : "none"}`);
+  console.log(`  ${c.dim}pack_format:${c.reset}     ${manifest.pack_format ?? "directory"}`);
+  console.log();
+  console.log(`  ${c.bold}Signatures${c.reset}`);
+  console.log(`    verified:    ${c.green}${verifiedRecords.size}${c.reset}`);
+  console.log(`    unsigned:    ${unsignedRecords.size}`);
+  console.log();
+  if (verifiedBlobs.size > 0 || manifest.blobs_count) {
+    console.log(`  ${c.bold}Blobs${c.reset}`);
+    const declared = manifest.blobs_count ?? "?";
+    console.log(`    verified:    ${c.green}${verifiedBlobs.size}${c.reset} of ${declared}`);
+    console.log();
+  }
+  console.log(`  ${c.bold}Anchors${c.reset}`);
+  console.log(`    declared:    ${anchors.length}`);
+  let chainFailed = false;
+  if (args.verifyChain && anchors.length > 0) {
+    process.stdout.write(`    fetching:    `);
+    try {
+      const expectedSigner = args.publicKey ?? manifest.producer.public_key;
+      const { verified, warnings: chainWarnings } = await verifyChainAnchors(anchors, {
+        rpcUrl: args.rpcUrl,
+        cluster: args.cluster,
+        expectedSigner,
+        strict: args.strictChain
+      });
+      const ok = verified.size;
+      console.log(`${c.green}${ok}${c.reset}/${anchors.length} verified on-chain`);
+      if (chainWarnings.length > 0) {
+        for (const w of chainWarnings) console.log(`    ${c.yellow}warn:${c.reset} ${w}`);
+      }
+      if (ok < anchors.length) chainFailed = true;
+    } catch (e) {
+      console.log(`${c.red}FAILED${c.reset}`);
+      console.error(`    ${c.red}${e.message}${c.reset}`);
+      chainFailed = true;
+    }
+  }
+  console.log();
+  if (manifest.encryption) {
+    console.log(`  ${c.bold}Encryption${c.reset}`);
+    if (decryptionKey) {
+      const decrypted = records.filter((r) => !r.encrypted).length;
+      console.log(`    decrypted:   ${c.green}${decrypted}${c.reset} of ${records.length}`);
+    } else {
+      console.log(`    ${c.yellow}no --decrypt-key supplied; ${records.length - minimalRecords.length} record(s) excluded from minimalRecords${c.reset}`);
+    }
+    console.log();
+  }
+  if (warnings.length > 0) {
+    console.log(`  ${c.bold}Warnings${c.reset}`);
+    for (const w of warnings) console.log(`    ${c.yellow}!${c.reset} ${w}`);
+    console.log();
+  }
+  if (chainFailed) {
+    console.log(`${c.red}REJECTED${c.reset}  Chain verification incomplete.`);
+    process.exit(1);
+  }
+  console.log(`${c.green}OK${c.reset}  Pack is valid.`);
+}
+var init_verify2 = __esm({
+  "packages/brain/src/cli/verify.ts"() {
+    "use strict";
+    init_src();
+    init_banner();
+  }
+});
+
+// packages/brain/src/cli/snapshot.ts
+var snapshot_exports = {};
+__export(snapshot_exports, {
+  runSnapshot: () => runSnapshot
+});
+function parseArgs2() {
+  const argv = process.argv.slice(3);
+  const args = { showHelp: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") args.showHelp = true;
+    else if (a === "--out") args.out = argv[++i];
+    else if (a === "--encrypt-key") args.encryptKey = argv[++i];
+  }
+  return args;
+}
+function printUsage2() {
+  console.log(`Usage: clude snapshot [options]
+
+  Writes a dated MemoryPack tarball of your local memories.
+
+Options:
+  --out <path>              Output path (default:
+                            ~/.clude/snapshots/clude-YYYYMMDD-HHMMSS.tar.zst)
+  --encrypt-key <base64>    Encrypt the snapshot (32 bytes, base64).
+                            Without this, the snapshot is plaintext on
+                            disk \u2014 fine for personal local backups,
+                            but encrypt for anything you'll move off-host.
+
+Cron example (daily 03:00):
+  0 3 * * * /usr/local/bin/node /usr/local/lib/node_modules/@clude/sdk/dist/cli/index.js snapshot
+
+Exit code: 0 on success, 1 on failure. Single-line stdout on success
+(the snapshot path); errors go to stderr.`);
+}
+function timestamp() {
+  const d = /* @__PURE__ */ new Date();
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}-${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}`;
+}
+function defaultOutPath() {
+  const dir = (0, import_path7.join)((0, import_os2.homedir)(), ".clude", "snapshots");
+  if (!(0, import_fs8.existsSync)(dir)) (0, import_fs8.mkdirSync)(dir, { recursive: true });
+  return (0, import_path7.join)(dir, `clude-${timestamp()}.tar.zst`);
+}
+async function runSnapshot() {
+  const args = parseArgs2();
+  if (args.showHelp) {
+    printUsage2();
+    process.exit(0);
+  }
+  let raw;
+  try {
+    const { localRecall: localRecall2, localStats: localStats2 } = (init_local_store(), __toCommonJS(local_store_exports));
+    const stats = localStats2();
+    if (stats.total_memories === 0) {
+      console.error("clude snapshot: no local memories found in ~/.clude/memories.json");
+      process.exit(1);
+    }
+    raw = localRecall2({ query: "", limit: 1e4 });
+  } catch (err) {
+    console.error(`clude snapshot: failed to read local store: ${err.message}`);
+    process.exit(1);
+  }
+  const records = raw.map((m, i) => {
+    const rec = {
+      id: m.id ? String(m.id) : String(i + 1),
+      created_at: m.created_at || (/* @__PURE__ */ new Date()).toISOString(),
+      kind: m.type || m.memory_type || "episodic",
+      content: m.content || "",
+      tags: m.tags || [],
+      importance: typeof m.importance === "number" ? m.importance : 0.5,
+      source: m.source || ""
+    };
+    if (m.summary) rec.summary = m.summary;
+    if (m.access_count != null) rec.access_count = m.access_count;
+    if (m.last_accessed_at) rec.last_accessed_at = m.last_accessed_at;
+    return rec;
+  });
+  let secretKey;
+  let publicKey;
+  try {
+    const { getBotWallet: getBotWallet2 } = (init_solana_client(), __toCommonJS(solana_client_exports));
+    const wallet = getBotWallet2();
+    if (wallet) {
+      secretKey = wallet.secretKey;
+      publicKey = wallet.publicKey.toBase58();
+    }
+  } catch {
+  }
+  let encryption;
+  if (args.encryptKey) {
+    const buf = Buffer.from(args.encryptKey, "base64");
+    if (buf.length !== ENCRYPTION_KEY_BYTES) {
+      console.error(
+        `clude snapshot: --encrypt-key must decode to ${ENCRYPTION_KEY_BYTES} bytes (got ${buf.length})`
+      );
+      process.exit(1);
+    }
+    encryption = { key: new Uint8Array(buf) };
+  }
+  const outPath = args.out || defaultOutPath();
+  try {
+    writeMemoryPack(outPath, records, {
+      producer: {
+        name: "clude",
+        version: "3.1.0",
+        public_key: publicKey
+      },
+      record_schema: "clude-memory-v3",
+      secretKey,
+      anchor_chain: "solana-mainnet",
+      format: "tarball",
+      encryption
+    });
+  } catch (err) {
+    console.error(`clude snapshot: write failed: ${err.message}`);
+    process.exit(1);
+  }
+  console.log(outPath);
+}
+var import_fs8, import_os2, import_path7;
+var init_snapshot = __esm({
+  "packages/brain/src/cli/snapshot.ts"() {
+    "use strict";
+    import_fs8 = require("fs");
+    import_os2 = require("os");
+    import_path7 = require("path");
+    init_src();
   }
 });
 
@@ -8050,23 +9655,23 @@ var init_clinamen = __esm({
 var server_exports = {};
 async function getSqliteStore() {
   if (_sqliteStore) return _sqliteStore;
-  const path8 = require("path");
-  const os5 = require("os");
-  const fs6 = require("fs");
+  const path9 = require("path");
+  const os6 = require("os");
+  const fs7 = require("fs");
   const { SqliteStore: SqliteStore2 } = (init_sqlite_store(), __toCommonJS(sqlite_store_exports));
   const { LocalEmbedder: LocalEmbedder2 } = (init_embedder(), __toCommonJS(embedder_exports));
-  const dbDir = path8.join(os5.homedir(), ".clude");
-  fs6.mkdirSync(dbDir, { recursive: true });
+  const dbDir = path9.join(os6.homedir(), ".clude");
+  fs7.mkdirSync(dbDir, { recursive: true });
   const embedder = new LocalEmbedder2();
   const store = new SqliteStore2({
-    dbPath: path8.join(dbDir, "brain.db"),
+    dbPath: path9.join(dbDir, "brain.db"),
     embedder
   });
   _sqliteStore = store;
   return store;
 }
-async function cortexFetch(method, path8, body) {
-  const url = `${CORTEX_HOST_URL}${path8}`;
+async function cortexFetch(method, path9, body) {
+  const url = `${CORTEX_HOST_URL}${path9}`;
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
@@ -8086,7 +9691,7 @@ async function cortexFetch(method, path8, body) {
     return await res.json();
   } catch (err) {
     if (err.name === "AbortError") {
-      throw new Error(`Cortex API timeout after ${FETCH_TIMEOUT_MS / 1e3}s: ${method} ${path8}`);
+      throw new Error(`Cortex API timeout after ${FETCH_TIMEOUT_MS / 1e3}s: ${method} ${path9}`);
     }
     throw err;
   } finally {
@@ -8962,7 +10567,9 @@ var require_package = __commonJS({
         "@ai-sdk/openai": "^3.0.49",
         "@ai-sdk/xai": "^3.0.75",
         "@anthropic-ai/sdk": "^0.39.0",
+        "@clude/memorypack": "workspace:*",
         "@clude/shared": "workspace:*",
+        "@clude/tokenization": "workspace:*",
         "@huggingface/transformers": "^4.1.0",
         "@modelcontextprotocol/sdk": "^1.26.0",
         "@openrouter/ai-sdk-provider": "^2.3.3",
@@ -9019,6 +10626,12 @@ if (command === "setup") {
     console.error("MCP install failed:", err.message);
     process.exit(1);
   });
+} else if (command === "connect") {
+  const { runConnect: runConnect2 } = (init_connect(), __toCommonJS(connect_exports));
+  runConnect2().catch((err) => {
+    console.error("Connect failed:", err.message);
+    process.exit(1);
+  });
 } else if (command === "ship") {
   const message = process.argv.slice(3).join(" ");
   const { runShip: runShip2 } = (init_ship(), __toCommonJS(ship_exports));
@@ -9068,6 +10681,28 @@ if (command === "setup") {
     console.error("Dream failed:", err.message);
     process.exit(1);
   });
+} else if (command === "verify") {
+  try {
+    const { runVerify: runVerify2 } = (init_verify2(), __toCommonJS(verify_exports));
+    runVerify2().catch((err) => {
+      console.error("Verify failed:", err.message);
+      process.exit(1);
+    });
+  } catch (err) {
+    console.error("Verify failed:", err.message);
+    process.exit(1);
+  }
+} else if (command === "snapshot") {
+  try {
+    const { runSnapshot: runSnapshot2 } = (init_snapshot(), __toCommonJS(snapshot_exports));
+    runSnapshot2().catch((err) => {
+      console.error("Snapshot failed:", err.message);
+      process.exit(1);
+    });
+  } catch (err) {
+    console.error("Snapshot failed:", err.message);
+    process.exit(1);
+  }
 } else if (command === "mcp-serve") {
   init_server();
 } else if (command === "start" || command === "bot") {
@@ -9089,10 +10724,13 @@ if (command === "setup") {
   console.log(`    ${c2.cyan}npx @clude/sdk status${c2.reset}        Check if Clude is active + memory stats`);
   console.log(`    ${c2.cyan}npx @clude/sdk init${c2.reset}          Advanced setup (self-hosted options)`);
   console.log(`    ${c2.cyan}npx @clude/sdk register${c2.reset}      Get an API key only`);
-  console.log(`    ${c2.cyan}npx @clude/sdk mcp-install${c2.reset}   Install MCP server for your IDE`);
+  console.log(`    ${c2.cyan}npx @clude/sdk connect${c2.reset}       Connect to Claude Desktop as a remote connector`);
+  console.log(`    ${c2.cyan}npx @clude/sdk mcp-install${c2.reset}   Install MCP server for your IDE (local stdio)`);
   console.log(`    ${c2.cyan}npx @clude/sdk inject-instructions${c2.reset}  Write usage instructions to CLAUDE.md`);
-  console.log(`    ${c2.cyan}npx @clude/sdk export${c2.reset}        Export memories (json/md/chatgpt/gemini)`);
+  console.log(`    ${c2.cyan}npx @clude/sdk export${c2.reset}        Export memories (json/md/chatgpt/gemini/memorypack)`);
   console.log(`    ${c2.cyan}npx @clude/sdk import${c2.reset}        Import from ChatGPT export, markdown, JSON`);
+  console.log(`    ${c2.cyan}npx @clude/sdk verify${c2.reset}        Verify a MemoryPack (.tar.zst or directory)`);
+  console.log(`    ${c2.cyan}npx @clude/sdk snapshot${c2.reset}      Cron-friendly tarball of local memories`);
   console.log(`    ${c2.cyan}npx @clude/sdk sync${c2.reset}          Auto-update system prompt file`);
   console.log(`    ${c2.cyan}npx @clude/sdk ship "msg"${c2.reset}    Broadcast to Telegram channel`);
   console.log(`    ${c2.cyan}npx @clude/sdk doctor${c2.reset}        Run diagnostics`);