@hasna/mementos 0.14.81 → 0.14.82

package/dist/project-registration.js

@@ -965,7 +965,7 @@ var init_storage = __esm(() => {
 
 // src/db/api-mode.ts
 import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 import { writeFileSync as writeFileSync2, unlinkSync } from "fs";
 import { randomUUID } from "crypto";
 function firstEnv(keys) {
@@ -1074,7 +1074,7 @@ x-api-key: ${cfg.apiKey}
   ];
   let bodyFile;
   if (hasBody) {
-    bodyFile = join3(tmpdir(), `mem-req-${process.pid}-${randomUUID()}.json`);
+    bodyFile = join2(tmpdir(), `mem-req-${process.pid}-${randomUUID()}.json`);
     writeFileSync2(bodyFile, JSON.stringify(body), { mode: 384 });
     args.push("--data-binary", `@${bodyFile}`);
   }
@@ -2585,7 +2585,7 @@ __export(exports_database, {
   closeDatabase: () => closeDatabase
 });
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, cpSync } from "fs";
-import { dirname as dirname2, join as join4, resolve } from "path";
+import { dirname, join as join3, resolve } from "path";
 function isInMemoryDb(path) {
   return path === ":memory:" || path.startsWith("file::memory:");
 }
@@ -2594,10 +2594,10 @@ function findNearestMementosDb(startDir) {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
   const legacyHomeDb = resolve(home, ".mementos", "mementos.db");
   while (true) {
-    const candidate = join4(dir, ".mementos", "mementos.db");
+    const candidate = join3(dir, ".mementos", "mementos.db");
     if (existsSync2(candidate) && resolve(candidate) !== legacyHomeDb)
       return candidate;
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -2607,9 +2607,9 @@ function findNearestMementosDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    if (existsSync2(join4(dir, ".git")))
+    if (existsSync2(join3(dir, ".git")))
       return dir;
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir)
       break;
     dir = parent;
@@ -2618,10 +2618,10 @@ function findGitRoot(startDir) {
 }
 function migrateGlobalDir() {
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  const newDir = join4(home, ".hasna", "mementos");
-  const oldDir = join4(home, ".mementos");
+  const newDir = join3(home, ".hasna", "mementos");
+  const oldDir = join3(home, ".mementos");
   if (!existsSync2(newDir) && existsSync2(oldDir)) {
-    mkdirSync2(join4(home, ".hasna"), { recursive: true });
+    mkdirSync2(join3(home, ".hasna"), { recursive: true });
     cpSync(oldDir, newDir, { recursive: true });
   }
 }
@@ -2638,17 +2638,17 @@ function getDbPath() {
   if (process.env["MEMENTOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join4(gitRoot, ".mementos", "mementos.db");
+      return join3(gitRoot, ".mementos", "mementos.db");
     }
   }
   migrateGlobalDir();
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join4(home, ".hasna", "mementos", "mementos.db");
+  return join3(home, ".hasna", "mementos", "mementos.db");
 }
 function ensureDir(filePath) {
   if (isInMemoryDb(filePath))
     return;
-  const dir = dirname2(resolve(filePath));
+  const dir = dirname(resolve(filePath));
   if (!existsSync2(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
@@ -2808,15 +2808,20 @@ var init_database = __esm(() => {
 import { createHash as createHash2 } from "crypto";
 import { resolve as resolve2 } from "path";
 
+// src/db/projects.ts
+init_database();
+init_api_mode();
+import { createHash } from "crypto";
+
 // src/lib/package-version.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function getMementosPackageVersion() {
-  const here = dirname(fileURLToPath2(import.meta.url));
+  const here = dirname2(fileURLToPath2(import.meta.url));
   for (const candidate of [
-    join2(here, "..", "..", "package.json"),
-    join2(here, "..", "package.json")
+    join4(here, "..", "..", "package.json"),
+    join4(here, "..", "package.json")
   ]) {
     try {
       const parsed = JSON.parse(readFileSync2(candidate, "utf8"));
@@ -2827,16 +2832,18 @@ function getMementosPackageVersion() {
   return "0.0.0";
 }
 
-// src/db/projects.ts
-init_database();
-init_api_mode();
-import { createHash } from "crypto";
-
 // src/project-registration/types.ts
 var MEMENTOS_PROJECT_REGISTRATION_ROUTE = "mementos.project-registration.v1";
 var MEMENTOS_PROJECT_REGISTRATION_CALLER_ROUTE = "projects.full-registration.v1";
 var MEMENTOS_PROJECT_REGISTRATION_SCHEMA_VERSION = 1;
 var MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE = "mementos.project-guarded-update.v1";
+var MEMENTOS_PROJECT_RESOURCE_ROUTE = "mementos.project-resources.v1";
+var MEMENTOS_PROJECT_RESOURCE_KINDS = [
+  "project",
+  "knowledge",
+  "memory",
+  "session"
+];
 
 class MementosProjectRegistrationError extends Error {
   code;
@@ -2849,6 +2856,73 @@ class MementosProjectRegistrationError extends Error {
   }
 }
 
+// src/project-registration/identity.ts
+var MEMENTOS_PROJECT_AUTHORITY_ENV = {
+  authorityId: "MEMENTOS_PROJECT_AUTHORITY_ID",
+  tenantId: "MEMENTOS_PROJECT_TENANT_ID",
+  corpusId: "MEMENTOS_PROJECT_CORPUS_ID"
+};
+function configuredValue(override, envKey) {
+  return override?.trim() || process.env[envKey]?.trim() || null;
+}
+
+class MementosProjectAuthorityIdentityError extends Error {
+  missing_env;
+  code = "MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED";
+  constructor(missing_env) {
+    super("Mementos project authority identity is not configured; set " + missing_env.join(", "));
+    this.missing_env = missing_env;
+    this.name = "MementosProjectAuthorityIdentityError";
+  }
+}
+function resolveMementosProjectAuthorityIdentity(options = {}) {
+  const authorityId = configuredValue(options.authorityId, MEMENTOS_PROJECT_AUTHORITY_ENV.authorityId);
+  const tenantId = configuredValue(options.tenantId, MEMENTOS_PROJECT_AUTHORITY_ENV.tenantId);
+  const corpusId = configuredValue(options.corpusId, MEMENTOS_PROJECT_AUTHORITY_ENV.corpusId);
+  if (!authorityId || !tenantId || !corpusId) {
+    const missingEnv = [];
+    if (!authorityId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.authorityId);
+    if (!tenantId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.tenantId);
+    if (!corpusId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.corpusId);
+    throw new MementosProjectAuthorityIdentityError(missingEnv);
+  }
+  return {
+    authority_id: authorityId,
+    tenant_id: tenantId,
+    corpus_id: corpusId
+  };
+}
+function buildMementosProjectRegistrationCapability(options = {}) {
+  const identity = resolveMementosProjectAuthorityIdentity(options);
+  return {
+    authority: "mementos",
+    route: MEMENTOS_PROJECT_REGISTRATION_ROUTE,
+    package_version: options.packageVersion ?? getMementosPackageVersion(),
+    ...identity,
+    supported_resources: ["project"],
+    conditional_create: true,
+    immutable_receipts: true,
+    exact_terminal_lookup: true,
+    exact_readback: true,
+    conditional_inverse: true,
+    ambiguous_outcome_reconciliation: true,
+    guarded_update: true,
+    guarded_update_route: MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
+    no_write_dry_run: true,
+    expected_revision_compare_and_swap: true,
+    caller_idempotency: true,
+    exact_inverse_rollback: true,
+    project_resource_enumeration: true,
+    project_resource_route: MEMENTOS_PROJECT_RESOURCE_ROUTE,
+    project_resource_kinds: ["project", "knowledge", "memory", "session"],
+    stable_keyset_pagination: true,
+    explicit_membership_only: true
+  };
+}
+
 // src/db/projects.ts
 function parseProjectRow(row) {
   return {
@@ -2883,12 +2957,17 @@ class ProjectGuardedUpdateError extends Error {
     this.name = "ProjectGuardedUpdateError";
   }
 }
-var PROJECT_UPDATE_AUTHORITY = {
-  authority_id: "mementos",
-  tenant_id: "default",
-  corpus_id: "default"
-};
 var BOUNDED_IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
+function projectUpdateAuthority() {
+  try {
+    return resolveMementosProjectAuthorityIdentity();
+  } catch (error) {
+    if (error instanceof MementosProjectAuthorityIdentityError) {
+      throw new ProjectGuardedUpdateError("PROJECT_UPDATE_AUTHORITY_MISMATCH", error.message, { authority_code: error.code, missing_env: error.missing_env });
+    }
+    throw error;
+  }
+}
 function canonicalizeProjectUpdateValue(value) {
   if (Array.isArray(value))
     return value.map(canonicalizeProjectUpdateValue);
@@ -2961,7 +3040,7 @@ function normalizeProjectUpdateInput(input) {
   }
   return normalized;
 }
-function assertProjectUpdateIdentity(identity, expectedIdentity = PROJECT_UPDATE_AUTHORITY) {
+function assertProjectUpdateIdentity(identity, expectedIdentity = projectUpdateAuthority()) {
   if (identity.authority_id !== expectedIdentity.authority_id || identity.tenant_id !== expectedIdentity.tenant_id || identity.corpus_id !== expectedIdentity.corpus_id) {
     throw new ProjectGuardedUpdateError("PROJECT_UPDATE_AUTHORITY_MISMATCH", "guarded project update does not match this authority, tenant, and corpus");
   }
@@ -2971,7 +3050,7 @@ function assertBoundedIdentifier(value, field) {
     throw new ProjectGuardedUpdateError("PROJECT_UPDATE_INVALID_INPUT", `${field} must be an 8-128 character bounded identifier`);
   }
 }
-function assertProjectUpdateRequest(request, expectedIdentity = PROJECT_UPDATE_AUTHORITY) {
+function assertProjectUpdateRequest(request, expectedIdentity = projectUpdateAuthority()) {
   assertProjectUpdateIdentity(request, expectedIdentity);
   assertBoundedIdentifier(request.operation_id, "operation_id");
   assertBoundedIdentifier(request.step_id, "step_id");
@@ -3149,7 +3228,7 @@ function listProjects(db) {
   const rows = d.query("SELECT * FROM projects ORDER BY updated_at DESC").all();
   return rows.map(parseProjectRow);
 }
-function previewProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDATE_AUTHORITY) {
+function previewProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority()) {
   assertProjectUpdateRequest(request, expectedIdentity);
   const normalized = normalizeProjectUpdateInput(request.updates);
   if (!db && isApiMode()) {
@@ -3172,7 +3251,7 @@ function previewProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDATE
     receipt: null
   };
 }
-function applyProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDATE_AUTHORITY, resultDigestForProject) {
+function applyProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority(), resultDigestForProject) {
   assertProjectUpdateRequest(request, expectedIdentity);
   const normalized = normalizeProjectUpdateInput(request.updates);
   if (!db && isApiMode()) {
@@ -3241,7 +3320,7 @@ function applyProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDATE_A
     return { dry_run: false, applied: true, project: readback, receipt };
   });
 }
-function rollbackProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDATE_AUTHORITY, resultDigestForProject) {
+function rollbackProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority(), resultDigestForProject) {
   assertProjectUpdateRequest(request, expectedIdentity);
   assertBoundedIdentifier(request.accepted_receipt_id, "accepted_receipt_id");
   if (!db && isApiMode()) {
@@ -3315,7 +3394,7 @@ function rollbackProjectUpdate(id, request, db, expectedIdentity = PROJECT_UPDAT
     return { dry_run: false, applied: true, project: readback, receipt };
   });
 }
-function getProjectUpdateReceipt(id, receiptId, identity = PROJECT_UPDATE_AUTHORITY, db, expectedIdentity = PROJECT_UPDATE_AUTHORITY) {
+function getProjectUpdateReceipt(id, receiptId, identity = projectUpdateAuthority(), db, expectedIdentity = projectUpdateAuthority()) {
   assertProjectUpdateIdentity(identity, expectedIdentity);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", `/projects/${encodeURIComponent(id)}/update-receipts/lookup`, { ...identity, receipt_id: receiptId });
@@ -3954,27 +4033,7 @@ class PackageOwnedMementosProjectRegistrationAuthority {
     this.db = db;
     this.now = options.now ?? (() => new Date().toISOString());
     this.faultInjector = options.faultInjector;
-    this.capabilityValue = {
-      authority: "mementos",
-      route: MEMENTOS_PROJECT_REGISTRATION_ROUTE,
-      package_version: options.packageVersion ?? getMementosPackageVersion(),
-      authority_id: options.authorityId ?? "mementos",
-      tenant_id: options.tenantId ?? "default",
-      corpus_id: options.corpusId ?? "default",
-      supported_resources: ["project"],
-      conditional_create: true,
-      immutable_receipts: true,
-      exact_terminal_lookup: true,
-      exact_readback: true,
-      conditional_inverse: true,
-      ambiguous_outcome_reconciliation: true,
-      guarded_update: true,
-      guarded_update_route: MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
-      no_write_dry_run: true,
-      expected_revision_compare_and_swap: true,
-      caller_idempotency: true,
-      exact_inverse_rollback: true
-    };
+    this.capabilityValue = buildMementosProjectRegistrationCapability(options);
   }
   fault(point, request) {
     this.faultInjector?.(point, {
@@ -4670,26 +4729,1400 @@ class MementosProjectRegistrationHttpClient {
 function createMementosProjectRegistrationHttpClient(options) {
   return new MementosProjectRegistrationHttpClient(options);
 }
+// src/project-registration/project-resources.ts
+init_api_mode();
+init_database();
+
+// src/types/index.ts
+class AgentConflictError extends Error {
+  conflict = true;
+  existing_id;
+  existing_name;
+  last_seen_at;
+  session_hint;
+  working_dir;
+  constructor(opts) {
+    const msg = `Agent "${opts.existing_name}" is already active (session hint: ${opts.session_hint ?? "unknown"}, last seen ${opts.last_seen_at}). Wait 30 minutes or use a different name.`;
+    super(msg);
+    this.name = "AgentConflictError";
+    this.existing_id = opts.existing_id;
+    this.existing_name = opts.existing_name;
+    this.last_seen_at = opts.last_seen_at;
+    this.session_hint = opts.session_hint;
+    this.working_dir = opts.working_dir ?? null;
+  }
+}
+class EntityNotFoundError extends Error {
+  constructor(id) {
+    super(`Entity not found: ${id}`);
+    this.name = "EntityNotFoundError";
+  }
+}
+
+class MemoryNotFoundError extends Error {
+  constructor(id) {
+    super(`Memory not found: ${id}`);
+    this.name = "MemoryNotFoundError";
+  }
+}
+
+class DuplicateMemoryError extends Error {
+  constructor(key, scope) {
+    super(`Memory already exists with key "${key}" in scope "${scope}"`);
+    this.name = "DuplicateMemoryError";
+  }
+}
+
+class MemoryExpiredError extends Error {
+  constructor(id) {
+    super(`Memory has expired: ${id}`);
+    this.name = "MemoryExpiredError";
+  }
+}
+
+class InvalidScopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "InvalidScopeError";
+  }
+}
+
+class VersionConflictError extends Error {
+  expected;
+  actual;
+  constructor(id, expected, actual) {
+    super(`Version conflict for memory ${id}: expected ${expected}, got ${actual}`);
+    this.name = "VersionConflictError";
+    this.expected = expected;
+    this.actual = actual;
+  }
+}
+
+class MemoryConflictError extends Error {
+  existingId;
+  existingAgentId;
+  existingUpdatedAt;
+  constructor(key, existing) {
+    super(`Memory conflict: key "${key}" already exists (last written by ${existing.agent_id ?? "unknown"} at ${existing.updated_at}). Use conflict:"overwrite" to replace it.`);
+    this.name = "MemoryConflictError";
+    this.existingId = existing.id;
+    this.existingAgentId = existing.agent_id;
+    this.existingUpdatedAt = existing.updated_at;
+  }
+}
+
+// src/db/memories.ts
+init_database();
+
+// src/lib/embeddings.ts
+function cosineSimilarity(a, b) {
+  if (a.length !== b.length || a.length === 0)
+    return 0;
+  let dot = 0, magA = 0, magB = 0;
+  for (let i = 0;i < a.length; i++) {
+    dot += a[i] * b[i];
+    magA += a[i] * a[i];
+    magB += b[i] * b[i];
+  }
+  const denom = Math.sqrt(magA) * Math.sqrt(magB);
+  return denom === 0 ? 0 : dot / denom;
+}
+var OPENAI_EMBED_URL = "https://api.openai.com/v1/embeddings";
+var EMBED_MODEL = "text-embedding-3-small";
+var EMBED_DIMENSIONS = 1536;
+async function openAIEmbed(text, apiKey) {
+  const res = await fetch(OPENAI_EMBED_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify({
+      model: EMBED_MODEL,
+      input: text.slice(0, 8192)
+    }),
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (!res.ok) {
+    throw new Error(`OpenAI embedding API ${res.status}: ${await res.text()}`);
+  }
+  const data = await res.json();
+  return data.data[0].embedding;
+}
+function tfidfVector(text) {
+  const DIMS = 512;
+  const vec = new Float32Array(DIMS);
+  const tokens = text.toLowerCase().match(/\b\w+\b/g) ?? [];
+  for (const token of tokens) {
+    let hash = 2166136261;
+    for (let i = 0;i < token.length; i++) {
+      hash ^= token.charCodeAt(i);
+      hash = hash * 16777619 >>> 0;
+    }
+    vec[hash % DIMS] += 1;
+  }
+  let norm = 0;
+  for (let i = 0;i < DIMS; i++)
+    norm += vec[i] * vec[i];
+  norm = Math.sqrt(norm);
+  if (norm > 0)
+    for (let i = 0;i < DIMS; i++)
+      vec[i] /= norm;
+  return Array.from(vec);
+}
+async function generateEmbedding(text) {
+  const apiKey = process.env["OPENAI_API_KEY"];
+  if (apiKey) {
+    try {
+      const embedding2 = await openAIEmbed(text, apiKey);
+      return { embedding: embedding2, model: EMBED_MODEL, dimensions: EMBED_DIMENSIONS };
+    } catch {}
+  }
+  const embedding = tfidfVector(text);
+  return { embedding, model: "tfidf-512", dimensions: 512 };
+}
+function deserializeEmbedding(raw) {
+  return JSON.parse(raw);
+}
+
+// src/lib/redact.ts
+var REDACTED = "[REDACTED]";
+var SECRET_PATTERNS = [
+  { name: "openai_key", pattern: /sk-[a-zA-Z0-9_-]{20,}/g },
+  { name: "anthropic_key", pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/g },
+  { name: "generic_key", pattern: /(?:pk|tok|key|token|api[_-]?key)[_-][a-zA-Z0-9_-]{16,}/gi },
+  { name: "aws_key", pattern: /AKIA[A-Z0-9]{16}/g },
+  { name: "aws_secret", pattern: /(?<=AWS_SECRET_ACCESS_KEY\s*=\s*)[A-Za-z0-9/+=]{40}/g },
+  { name: "github_token", pattern: /gh[ps]_[a-zA-Z0-9]{36,}/g },
+  { name: "github_oauth", pattern: /gho_[a-zA-Z0-9]{36,}/g },
+  { name: "npm_token", pattern: /npm_[a-zA-Z0-9]{36,}/g },
+  { name: "bearer", pattern: /Bearer\s+[a-zA-Z0-9_\-.]{20,}/g },
+  { name: "conn_string", pattern: /(?:postgres|postgresql|mysql|mongodb|redis|amqp|mqtt):\/\/[^\s"'`]+@[^\s"'`]+/gi },
+  { name: "env_secret", pattern: /(?:SECRET|TOKEN|PASSWORD|PASSPHRASE|API_KEY|PRIVATE_KEY|AUTH|CREDENTIAL)[_A-Z]*\s*=\s*["']?[^\s"'\n]{8,}["']?/gi },
+  { name: "stripe_key", pattern: /(?:sk|pk|rk)_(?:test|live)_[a-zA-Z0-9]{20,}/g },
+  { name: "slack_token", pattern: /xox[bpras]-[a-zA-Z0-9-]{20,}/g },
+  { name: "jwt", pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g },
+  { name: "hex_secret", pattern: /(?<=(?:key|token|secret|password|hash)\s*[:=]\s*["']?)[0-9a-f]{32,}(?=["']?)/gi }
+];
+function redactSecrets(text) {
+  let result = text;
+  for (const { pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, REDACTED);
+  }
+  return result;
+}
+function containsSecrets(text) {
+  for (const { pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text))
+      return true;
+  }
+  return false;
+}
+
+// src/lib/hooks.ts
+var _idCounter = 0;
+function generateHookId() {
+  return `hook_${++_idCounter}_${Date.now().toString(36)}`;
+}
+
+class HookRegistry {
+  hooks = new Map;
+  register(reg) {
+    const id = generateHookId();
+    const hook = {
+      ...reg,
+      id,
+      priority: reg.priority ?? 50
+    };
+    this.hooks.set(id, hook);
+    return id;
+  }
+  unregister(hookId) {
+    const hook = this.hooks.get(hookId);
+    if (!hook)
+      return false;
+    if (hook.builtin)
+      return false;
+    this.hooks.delete(hookId);
+    return true;
+  }
+  list(type) {
+    const all = [...this.hooks.values()];
+    if (!type)
+      return all;
+    return all.filter((h) => h.type === type);
+  }
+  async runHooks(type, context) {
+    const matching = this.getMatchingHooks(type, context);
+    if (matching.length === 0)
+      return true;
+    matching.sort((a, b) => a.priority - b.priority);
+    for (const hook of matching) {
+      if (hook.blocking) {
+        try {
+          const result = await hook.handler(context);
+          if (result === false)
+            return false;
+        } catch (err) {
+          console.error(`[hooks] blocking hook ${hook.id} (${type}) threw:`, err);
+        }
+      } else {
+        Promise.resolve().then(() => hook.handler(context)).catch((err) => console.error(`[hooks] non-blocking hook ${hook.id} (${type}) threw:`, err));
+      }
+    }
+    return true;
+  }
+  getMatchingHooks(type, context) {
+    const ctx = context;
+    return [...this.hooks.values()].filter((hook) => {
+      if (hook.type !== type)
+        return false;
+      if (hook.agentId && hook.agentId !== ctx.agentId)
+        return false;
+      if (hook.projectId && hook.projectId !== ctx.projectId)
+        return false;
+      return true;
+    });
+  }
+  stats() {
+    const all = [...this.hooks.values()];
+    const byType = {};
+    for (const hook of all) {
+      byType[hook.type] = (byType[hook.type] ?? 0) + 1;
+    }
+    return {
+      total: all.length,
+      byType,
+      blocking: all.filter((h) => h.blocking).length,
+      nonBlocking: all.filter((h) => !h.blocking).length
+    };
+  }
+}
+var hookRegistry = new HookRegistry;
+
+// src/lib/poisoning.ts
+var INSTRUCTION_PATTERNS = [
+  /\byou\s+must\b/i,
+  /\byou\s+should\b/i,
+  /\byou\s+have\s+to\b/i,
+  /\balways\b/i,
+  /\bnever\b/i
+];
+var PROMOTIONAL_PATTERNS = [
+  /\brecommend\b/i,
+  /\bbuy\b/i,
+  /\bbest\s+product\b/i,
+  /\bpurchase\b/i,
+  /\bdiscount\b/i,
+  /\baffiliate\b/i
+];
+function computeTrustScore(value, key, existingMemories, claimedImportance) {
+  let score = 1;
+  for (const pattern of INSTRUCTION_PATTERNS) {
+    if (pattern.test(value)) {
+      score -= 0.2;
+      break;
+    }
+  }
+  for (const pattern of PROMOTIONAL_PATTERNS) {
+    if (pattern.test(value)) {
+      score -= 0.3;
+      break;
+    }
+  }
+  if (existingMemories && existingMemories.length > 0) {
+    for (const existing of existingMemories) {
+      if (existing.key !== key)
+        continue;
+      if (existing.importance < 7)
+        continue;
+      if (existing.status !== "active")
+        continue;
+      const existingLower = existing.value.toLowerCase().trim();
+      const newLower = value.toLowerCase().trim();
+      if (existingLower === newLower)
+        continue;
+      const existingWords = new Set(existingLower.split(/\s+/));
+      const newWords = new Set(newLower.split(/\s+/));
+      let overlap = 0;
+      for (const w of newWords) {
+        if (existingWords.has(w))
+          overlap++;
+      }
+      const totalUnique = new Set([...newWords, ...existingWords]).size;
+      const overlapRatio = totalUnique > 0 ? overlap / totalUnique : 0;
+      if (overlapRatio < 0.3) {
+        score -= 0.3;
+        break;
+      }
+    }
+  }
+  if (value.length < 10 && (claimedImportance ?? 5) >= 8) {
+    score -= 0.1;
+  }
+  return Math.max(0, Math.min(1, score));
+}
+
+// src/db/entity-memories.ts
+init_database();
+init_api_mode();
+function parseEntityRow(row) {
+  return {
+    id: row["id"],
+    name: row["name"],
+    type: row["type"],
+    description: row["description"] || null,
+    metadata: JSON.parse(row["metadata"] || "{}"),
+    project_id: row["project_id"] || null,
+    created_at: row["created_at"],
+    updated_at: row["updated_at"]
+  };
+}
+function parseEntityMemoryRow(row) {
+  return {
+    entity_id: row["entity_id"],
+    memory_id: row["memory_id"],
+    role: row["role"],
+    created_at: row["created_at"]
+  };
+}
+function linkEntityToMemory(entityId, memoryId, role = "context", db) {
+  if (!db && isApiMode()) {
+    const { data } = apiJson("POST", `/entities/${encodeURIComponent(entityId)}/memories`, {
+      memory_id: memoryId,
+      role
+    });
+    return data;
+  }
+  const d = db || getDatabase();
+  const timestamp = now();
+  d.run(`INSERT OR IGNORE INTO entity_memories (entity_id, memory_id, role, created_at)
+     VALUES (?, ?, ?, ?)`, [entityId, memoryId, role, timestamp]);
+  const row = d.query("SELECT * FROM entity_memories WHERE entity_id = ? AND memory_id = ?").get(entityId, memoryId);
+  return parseEntityMemoryRow(row);
+}
+function unlinkEntityFromMemory(entityId, memoryId, db) {
+  if (!db && isApiMode()) {
+    apiJson("DELETE", `/entities/${encodeURIComponent(entityId)}/memories/${encodeURIComponent(memoryId)}`);
+    return;
+  }
+  const d = db || getDatabase();
+  d.run("DELETE FROM entity_memories WHERE entity_id = ? AND memory_id = ?", [entityId, memoryId]);
+}
+function getMemoriesForEntity(entityId, db) {
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/entities/${encodeURIComponent(entityId)}/memories`);
+    return data?.memories ?? [];
+  }
+  const d = db || getDatabase();
+  const rows = d.query(`SELECT m.* FROM memories m
+       INNER JOIN entity_memories em ON em.memory_id = m.id
+       WHERE em.entity_id = ?
+       ORDER BY m.importance DESC, m.created_at DESC`).all(entityId);
+  return rows.map(parseMemoryRow);
+}
+function getEntitiesForMemory(memoryId, db) {
+  const d = db || getDatabase();
+  const rows = d.query(`SELECT e.* FROM entities e
+       INNER JOIN entity_memories em ON em.entity_id = e.id
+       WHERE em.memory_id = ?
+       ORDER BY e.name ASC`).all(memoryId);
+  return rows.map(parseEntityRow);
+}
+function bulkLinkEntities(entityIds, memoryId, role = "context", db) {
+  const d = db || getDatabase();
+  const timestamp = now();
+  d.transaction(() => {
+    const stmt = d.prepare(`INSERT OR IGNORE INTO entity_memories (entity_id, memory_id, role, created_at)
+       VALUES (?, ?, ?, ?)`);
+    for (const entityId of entityIds) {
+      stmt.run(entityId, memoryId, role, timestamp);
+    }
+  });
+}
+function getEntityMemoryLinks(entityId, memoryId, db) {
+  const d = db || getDatabase();
+  const conditions = [];
+  const params = [];
+  if (entityId) {
+    conditions.push("entity_id = ?");
+    params.push(entityId);
+  }
+  if (memoryId) {
+    conditions.push("memory_id = ?");
+    params.push(memoryId);
+  }
+  let sql = "SELECT * FROM entity_memories";
+  if (conditions.length > 0) {
+    sql += ` WHERE ${conditions.join(" AND ")}`;
+  }
+  sql += " ORDER BY created_at DESC";
+  const rows = d.query(sql).all(...params);
+  return rows.map(parseEntityMemoryRow);
+}
+
+// src/db/memories.ts
+init_api_mode();
+function runEntityExtraction(_memory, _projectId, _d) {}
+function applyContentType(d, id, memory, contentType) {
+  if (!contentType || contentType === "text")
+    return;
+  try {
+    d.run("UPDATE memories SET content_type = ? WHERE id = ?", [contentType, id]);
+    memory.content_type = contentType;
+  } catch {}
+}
+function parseMemoryRow(row) {
+  return {
+    id: row["id"],
+    key: row["key"],
+    value: row["value"],
+    category: row["category"],
+    scope: row["scope"],
+    summary: row["summary"] || null,
+    tags: JSON.parse(row["tags"] || "[]"),
+    importance: row["importance"],
+    source: row["source"],
+    status: row["status"],
+    pinned: !!row["pinned"],
+    agent_id: row["agent_id"] || null,
+    project_id: row["project_id"] || null,
+    session_id: row["session_id"] || null,
+    machine_id: row["machine_id"] || null,
+    flag: row["flag"] || null,
+    when_to_use: row["when_to_use"] || null,
+    sequence_group: row["sequence_group"] || null,
+    sequence_order: row["sequence_order"] ?? null,
+    content_type: row["content_type"] || "text",
+    namespace: row["namespace"] || null,
+    created_by_agent: row["created_by_agent"] || null,
+    updated_by_agent: row["updated_by_agent"] || null,
+    trust_score: row["trust_score"] != null ? row["trust_score"] : null,
+    metadata: JSON.parse(row["metadata"] || "{}"),
+    access_count: row["access_count"],
+    version: row["version"],
+    expires_at: row["expires_at"] || null,
+    valid_from: row["valid_from"] || null,
+    valid_until: row["valid_until"] || null,
+    ingested_at: row["ingested_at"] || null,
+    created_at: row["created_at"],
+    updated_at: row["updated_at"],
+    accessed_at: row["accessed_at"] || null
+  };
+}
+function createMemory(input, dedupeMode = "merge", db) {
+  if (!db && isApiMode()) {
+    const { status, data } = apiJson("POST", "/memories", { ...input, dedupe: dedupeMode });
+    if (!data || !data.id) {
+      throw new ApiRequestError(`mementos cloud POST /memories \u2192 ${status} but no memory was returned; the write did not persist (key: ${input.key})`, status, "");
+    }
+    return data;
+  }
+  const d = db || getDatabase();
+  const timestamp = now();
+  if (input.project_id) {
+    const resolved = resolvePartialId(d, "projects", input.project_id);
+    if (resolved) {
+      input = { ...input, project_id: resolved };
+    }
+  }
+  let expiresAt = input.expires_at || null;
+  if (input.ttl_ms && !expiresAt) {
+    expiresAt = new Date(Date.now() + input.ttl_ms).toISOString();
+  }
+  if (input.scope === "working" && !expiresAt) {
+    expiresAt = new Date(Date.now() + 60 * 60 * 1000).toISOString();
+  }
+  const id = uuid();
+  const tags = input.tags || [];
+  const tagsJson = JSON.stringify(tags);
+  const metadataJson = JSON.stringify(input.metadata || {});
+  const safeValue = redactSecrets(input.value);
+  const safeSummary = input.summary ? redactSecrets(input.summary) : null;
+  const effectiveMode = dedupeMode === "overwrite" ? "merge" : dedupeMode === "version-fork" ? "create" : dedupeMode;
+  if (effectiveMode === "error") {
+    const existing = d.query(`SELECT id, agent_id, updated_at FROM memories
+       WHERE key = ? AND scope = ? AND COALESCE(project_id, '') = ? AND status = 'active'
+       LIMIT 1`).get(input.key, input.scope || "private", input.project_id || "");
+    if (existing) {
+      throw new MemoryConflictError(input.key, existing);
+    }
+  }
+  if (effectiveMode === "merge") {
+    const existing = d.query(`SELECT id, version FROM memories
+         WHERE key = ? AND scope = ?
+           AND COALESCE(agent_id, '') = ?
+           AND COALESCE(project_id, '') = ?
+           AND COALESCE(session_id, '') = ?`).get(input.key, input.scope || "private", input.agent_id || "", input.project_id || "", input.session_id || "");
+    if (existing) {
+      d.run(`UPDATE memories SET
+           value = ?, category = ?, summary = ?, tags = ?,
+           importance = ?, metadata = ?, expires_at = ?,
+           when_to_use = ?,
+           pinned = COALESCE(pinned, 0),
+           version = version + 1, updated_at = ?
+         WHERE id = ?`, [
+        safeValue,
+        input.category || "knowledge",
+        safeSummary,
+        tagsJson,
+        input.importance ?? 5,
+        metadataJson,
+        expiresAt,
+        input.when_to_use || null,
+        timestamp,
+        existing.id
+      ]);
+      d.run("DELETE FROM memory_tags WHERE memory_id = ?", [existing.id]);
+      const insertTag2 = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+      for (const tag of tags) {
+        insertTag2.run(existing.id, tag);
+      }
+      const merged = getMemory(existing.id, d);
+      applyContentType(d, existing.id, merged, input.content_type);
+      try {
+        const existingMemories = listMemoriesByKey(input.key, d);
+        const trustScore = computeTrustScore(safeValue, input.key, existingMemories, input.importance);
+        d.run("UPDATE memories SET trust_score = ? WHERE id = ?", [trustScore, existing.id]);
+      } catch {}
+      try {
+        const oldLinks = getEntityMemoryLinks(undefined, merged.id, d);
+        for (const link of oldLinks) {
+          unlinkEntityFromMemory(link.entity_id, merged.id, d);
+        }
+        runEntityExtraction(merged, input.project_id, d);
+      } catch {}
+      return merged;
+    }
+  }
+  ensureMemoryReferences(d, input);
+  d.run(`INSERT INTO memories (id, key, value, category, scope, summary, tags, importance, source, status, pinned, agent_id, project_id, session_id, machine_id, namespace, created_by_agent, when_to_use, sequence_group, sequence_order, metadata, access_count, version, expires_at, valid_from, valid_until, ingested_at, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', FALSE, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 1, ?, ?, ?, ?, ?, ?)`, [
+    id,
+    input.key,
+    safeValue,
+    input.category || "knowledge",
+    input.scope || "private",
+    input.summary || null,
+    tagsJson,
+    input.importance ?? 5,
+    input.source || "agent",
+    input.agent_id || null,
+    input.project_id || null,
+    input.session_id || null,
+    input.machine_id || null,
+    input.namespace || null,
+    input.agent_id || null,
+    input.when_to_use || null,
+    input.sequence_group || null,
+    input.sequence_order ?? null,
+    metadataJson,
+    expiresAt,
+    input.metadata?.valid_from ?? timestamp,
+    input.metadata?.valid_until ?? null,
+    timestamp,
+    timestamp,
+    timestamp
+  ]);
+  const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+  for (const tag of tags) {
+    insertTag.run(id, tag);
+  }
+  const memory = getMemory(id, d);
+  applyContentType(d, id, memory, input.content_type);
+  try {
+    const existingMemories = listMemoriesByKey(input.key, d);
+    const trustScore = computeTrustScore(safeValue, input.key, existingMemories, input.importance);
+    d.run("UPDATE memories SET trust_score = ? WHERE id = ?", [trustScore, id]);
+  } catch {}
+  runEntityExtraction(memory, input.project_id, d);
+  hookRegistry.runHooks("PostMemorySave", {
+    memory,
+    wasUpdated: false,
+    agentId: input.agent_id,
+    projectId: input.project_id,
+    sessionId: input.session_id,
+    timestamp: Date.now()
+  });
+  return memory;
+}
+function ensureMemoryReferences(d, input) {
+  const t = now();
+  const tryRun = (sql, params) => {
+    try {
+      d.run(sql, params);
+    } catch {}
+  };
+  if (input.agent_id) {
+    tryRun("INSERT OR IGNORE INTO agents (id, name, role, created_at, last_seen_at) VALUES (?, ?, 'agent', ?, ?)", [input.agent_id, `imported-${input.agent_id}`, t, t]);
+  }
+  if (input.project_id) {
+    tryRun("INSERT OR IGNORE INTO projects (id, name, path, created_at, updated_at) VALUES (?, ?, ?, ?, ?)", [input.project_id, `imported-${input.project_id}`, `imported://${input.project_id}`, t, t]);
+  }
+  if (input.machine_id) {
+    tryRun("INSERT OR IGNORE INTO machines (id, name, hostname, platform, created_at, last_seen_at) VALUES (?, ?, ?, 'unknown', ?, ?)", [input.machine_id, `imported-${input.machine_id}`, `imported-${input.machine_id}`, t, t]);
+  }
+  if (input.session_id) {
+    tryRun("INSERT OR IGNORE INTO sessions (id, agent_id, project_id, started_at, last_activity) VALUES (?, ?, ?, ?, ?)", [input.session_id, input.agent_id ?? null, input.project_id ?? null, t, t]);
+  }
+}
+function listMemoriesByKey(key, db) {
+  const rows = db.query("SELECT * FROM memories WHERE key = ? AND status = 'active' ORDER BY importance DESC LIMIT 10").all(key);
+  return rows.map(parseMemoryRow);
+}
+function getMemory(id, db) {
+  if (!db && isApiMode()) {
+    const { status, data } = apiJson("GET", `/memories/${encodeURIComponent(id)}`, undefined, { allow404: true });
+    return status === 404 ? null : data ?? null;
+  }
+  const d = db || getDatabase();
+  const resolvedId = resolvePartialId(d, "memories", id) ?? id;
+  const row = d.query("SELECT * FROM memories WHERE id = ?").get(resolvedId);
+  if (!row)
+    return null;
+  return parseMemoryRow(row);
+}
+function getMemoryByKey(key, scope, agentId, projectId, sessionId, db, as_of) {
+  if (!db && isApiMode()) {
+    const q = toQuery({ key, scope, agent_id: agentId, project_id: projectId, session_id: sessionId, as_of, status: "active", limit: 1 });
+    const { data } = apiJson("GET", `/memories${q}`);
+    return data?.memories?.[0] ?? null;
+  }
+  const d = db || getDatabase();
+  let sql = "SELECT * FROM memories WHERE key = ?";
+  const params = [key];
+  if (scope) {
+    sql += " AND scope = ?";
+    params.push(scope);
+  }
+  if (agentId) {
+    sql += " AND agent_id = ?";
+    params.push(agentId);
+  }
+  if (projectId) {
+    sql += " AND project_id = ?";
+    params.push(projectId);
+  }
+  if (sessionId) {
+    sql += " AND session_id = ?";
+    params.push(sessionId);
+  }
+  if (as_of) {
+    sql += " AND (valid_from IS NULL OR valid_from <= ?)";
+    params.push(as_of);
+    sql += " AND (valid_until IS NULL OR valid_until > ?)";
+    params.push(as_of);
+  }
+  sql += " AND status = 'active' ORDER BY importance DESC LIMIT 1";
+  const row = d.query(sql).get(...params);
+  if (!row)
+    return null;
+  return parseMemoryRow(row);
+}
+function getMemoriesByKey(key, scope, agentId, projectId, db) {
+  if (!db && isApiMode()) {
+    const q = toQuery({ key, scope, agent_id: agentId, project_id: projectId, status: "active" });
+    const { data } = apiJson("GET", `/memories${q}`);
+    return data?.memories ?? [];
+  }
+  const d = db || getDatabase();
+  let sql = "SELECT * FROM memories WHERE key = ?";
+  const params = [key];
+  if (scope) {
+    sql += " AND scope = ?";
+    params.push(scope);
+  }
+  if (agentId) {
+    sql += " AND agent_id = ?";
+    params.push(agentId);
+  }
+  if (projectId) {
+    sql += " AND project_id = ?";
+    params.push(projectId);
+  }
+  sql += " AND status = 'active' ORDER BY importance DESC";
+  const rows = d.query(sql).all(...params);
+  return rows.map(parseMemoryRow);
+}
+function listMemories(filter, db) {
+  if (!db && isApiMode()) {
+    const f = filter || {};
+    const q = toQuery({
+      key: f.key,
+      scope: f.scope,
+      category: f.category,
+      status: f.status,
+      tags: f.tags,
+      min_importance: f.min_importance,
+      pinned: f.pinned,
+      agent_id: f.agent_id,
+      project_id: f.project_id,
+      session_id: f.session_id,
+      namespace: f.namespace,
+      as_of: f.as_of,
+      limit: f.limit,
+      offset: f.offset
+    });
+    const { data } = apiJson("GET", `/memories${q}`);
+    return data?.memories ?? [];
+  }
+  const d = db || getDatabase();
+  const conditions = [];
+  const params = [];
+  if (filter) {
+    if (filter.key) {
+      conditions.push("key = ?");
+      params.push(filter.key);
+    }
+    if (filter.scope) {
+      if (Array.isArray(filter.scope)) {
+        conditions.push(`scope IN (${filter.scope.map(() => "?").join(",")})`);
+        params.push(...filter.scope);
+      } else {
+        conditions.push("scope = ?");
+        params.push(filter.scope);
+      }
+    }
+    if (filter.category) {
+      if (Array.isArray(filter.category)) {
+        conditions.push(`category IN (${filter.category.map(() => "?").join(",")})`);
+        params.push(...filter.category);
+      } else {
+        conditions.push("category = ?");
+        params.push(filter.category);
+      }
+    }
+    if (filter.source) {
+      if (Array.isArray(filter.source)) {
+        conditions.push(`source IN (${filter.source.map(() => "?").join(",")})`);
+        params.push(...filter.source);
+      } else {
+        conditions.push("source = ?");
+        params.push(filter.source);
+      }
+    }
+    if (filter.status) {
+      if (Array.isArray(filter.status)) {
+        conditions.push(`status IN (${filter.status.map(() => "?").join(",")})`);
+        params.push(...filter.status);
+      } else {
+        conditions.push("status = ?");
+        params.push(filter.status);
+      }
+    } else {
+      conditions.push("status = 'active'");
+    }
+    if (filter.project_id) {
+      conditions.push("project_id = ?");
+      params.push(filter.project_id);
+    }
+    if (filter.agent_id) {
+      conditions.push("agent_id = ?");
+      params.push(filter.agent_id);
+    }
+    if (filter.session_id) {
+      conditions.push("session_id = ?");
+      params.push(filter.session_id);
+    }
+    if ("machine_id" in filter) {
+      if (filter.machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.machine_id) {
+        conditions.push("machine_id = ?");
+        params.push(filter.machine_id);
+      }
+    }
+    if ("visible_to_machine_id" in filter) {
+      if (filter.visible_to_machine_id === null) {
+        conditions.push("machine_id IS NULL");
+      } else if (filter.visible_to_machine_id !== undefined) {
+        conditions.push("(machine_id IS NULL OR machine_id = ?)");
+        params.push(filter.visible_to_machine_id);
+      }
+    }
+    if (filter.min_importance) {
+      conditions.push("importance >= ?");
+      params.push(filter.min_importance);
+    }
+    if (filter.pinned !== undefined) {
+      conditions.push("pinned = ?");
+      params.push(filter.pinned ? 1 : 0);
+    }
+    if (filter.flagged === true) {
+      conditions.push("flag IS NOT NULL");
+    } else if (filter.flag) {
+      conditions.push("flag = ?");
+      params.push(filter.flag);
+    }
+    if (filter.tags && filter.tags.length > 0) {
+      for (const tag of filter.tags) {
+        conditions.push("id IN (SELECT memory_id FROM memory_tags WHERE tag = ?)");
+        params.push(tag);
+      }
+    }
+    if (filter.namespace) {
+      conditions.push("namespace = ?");
+      params.push(filter.namespace);
+    }
+    if (filter.search) {
+      conditions.push("(key LIKE ? OR value LIKE ? OR summary LIKE ?)");
+      const term = `%${filter.search}%`;
+      params.push(term, term, term);
+    }
+    if (filter.as_of) {
+      conditions.push("(valid_from IS NULL OR valid_from <= ?)");
+      params.push(filter.as_of);
+      conditions.push("(valid_until IS NULL OR valid_until > ?)");
+      params.push(filter.as_of);
+    }
+  } else {
+    conditions.push("status = 'active'");
+  }
+  let sql = "SELECT * FROM memories";
+  if (conditions.length > 0) {
+    sql += ` WHERE ${conditions.join(" AND ")}`;
+  }
+  sql += " ORDER BY importance DESC, created_at DESC";
+  if (filter?.limit) {
+    sql += " LIMIT ?";
+    params.push(filter.limit);
+  }
+  if (filter?.offset) {
+    sql += " OFFSET ?";
+    params.push(filter.offset);
+  }
+  const rows = d.query(sql).all(...params);
+  return rows.map(parseMemoryRow);
+}
+function updateMemory(id, input, db) {
+  if (!db && isApiMode()) {
+    const { status, data } = apiJson("PATCH", `/memories/${encodeURIComponent(id)}`, input, { allow404: true });
+    if (status === 404)
+      throw new MemoryNotFoundError(id);
+    if (data && typeof input.version === "number" && typeof data.version === "number" && data.version <= input.version) {
+      throw new Error(`Update did not persist for memory ${id}: the server returned success but the record is unchanged ` + `(version still ${data.version}). Your data was NOT written. ` + `The server is likely running a build predating the partial-id fix \u2014 pass the full 36-character id as a workaround.`);
+    }
+    return data;
+  }
+  const d = db || getDatabase();
+  const existing = getMemory(id, d);
+  if (!existing)
+    throw new MemoryNotFoundError(id);
+  const memoryId = existing.id;
+  if (existing.version !== input.version) {
+    throw new VersionConflictError(id, input.version, existing.version);
+  }
+  const sets = ["version = version + 1", "updated_at = ?"];
+  const params = [now()];
+  if (input.value !== undefined) {
+    sets.push("value = ?");
+    params.push(redactSecrets(input.value));
+  }
+  if (input.category !== undefined) {
+    sets.push("category = ?");
+    params.push(input.category);
+  }
+  if (input.scope !== undefined) {
+    sets.push("scope = ?");
+    params.push(input.scope);
+  }
+  if (input.summary !== undefined) {
+    sets.push("summary = ?");
+    params.push(input.summary);
+  }
+  if (input.importance !== undefined) {
+    sets.push("importance = ?");
+    params.push(input.importance);
+  }
+  if (input.pinned !== undefined) {
+    sets.push("pinned = ?");
+    params.push(input.pinned ? 1 : 0);
+  }
+  if (input.status !== undefined) {
+    sets.push("status = ?");
+    params.push(input.status);
+  }
+  if (input.metadata !== undefined) {
+    sets.push("metadata = ?");
+    params.push(JSON.stringify(input.metadata));
+  }
+  if (input.expires_at !== undefined) {
+    sets.push("expires_at = ?");
+    params.push(input.expires_at);
+  }
+  if (input.flag !== undefined) {
+    sets.push("flag = ?");
+    params.push(input.flag ?? null);
+  }
+  if (input.when_to_use !== undefined) {
+    sets.push("when_to_use = ?");
+    params.push(input.when_to_use ?? null);
+  }
+  if (input.tags !== undefined) {
+    sets.push("tags = ?");
+    params.push(JSON.stringify(input.tags));
+    d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
+    const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+    for (const tag of input.tags) {
+      insertTag.run(memoryId, tag);
+    }
+  }
+  params.push(memoryId);
+  const result = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
+  if (result.changes === 0) {
+    throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
+  }
+  const updated = getMemory(memoryId, d);
+  if (input.value !== undefined) {
+    try {
+      const oldLinks = getEntityMemoryLinks(undefined, updated.id, d);
+      for (const link of oldLinks) {
+        unlinkEntityFromMemory(link.entity_id, updated.id, d);
+      }
+    } catch {}
+  }
+  hookRegistry.runHooks("PostMemoryUpdate", {
+    memory: updated,
+    previousValue: existing.value,
+    agentId: existing.agent_id ?? undefined,
+    projectId: existing.project_id ?? undefined,
+    sessionId: existing.session_id ?? undefined,
+    timestamp: Date.now()
+  });
+  return updated;
+}
+function deleteMemory(id, db) {
+  if (!db && isApiMode()) {
+    const { status } = apiJson("DELETE", `/memories/${encodeURIComponent(id)}`, undefined, { allow404: true });
+    return status !== 404;
+  }
+  const d = db || getDatabase();
+  const memoryId = resolvePartialId(d, "memories", id) ?? id;
+  const result = d.run("DELETE FROM memories WHERE id = ?", [memoryId]);
+  if (result.changes > 0) {
+    hookRegistry.runHooks("PostMemoryDelete", {
+      memoryId,
+      timestamp: Date.now()
+    });
+  }
+  return result.changes > 0;
+}
+function bulkDeleteMemories(ids, db) {
+  if (ids.length === 0)
+    return 0;
+  if (!db && isApiMode()) {
+    const { data } = apiJson("POST", "/memories/bulk-forget", { ids });
+    return data?.deleted ?? 0;
+  }
+  const d = db || getDatabase();
+  const resolvedIds = ids.map((id) => resolvePartialId(d, "memories", id) ?? id);
+  const placeholders = resolvedIds.map(() => "?").join(",");
+  const countRow = d.query(`SELECT COUNT(*) as c FROM memories WHERE id IN (${placeholders})`).get(...resolvedIds);
+  const count = countRow.c;
+  if (count > 0) {
+    d.run(`DELETE FROM memories WHERE id IN (${placeholders})`, resolvedIds);
+  }
+  return count;
+}
+function touchMemory(id, db) {
+  if (!db && isApiMode())
+    return;
+  const d = db || getDatabase();
+  d.run("UPDATE memories SET access_count = access_count + 1, accessed_at = ? WHERE id = ?", [now(), id]);
+}
+var RECALL_PROMOTE_THRESHOLD = 3;
+function incrementRecallCount(id, db) {
+  if (!db && isApiMode())
+    return;
+  const d = db || getDatabase();
+  try {
+    d.run("UPDATE memories SET recall_count = recall_count + 1, access_count = access_count + 1, accessed_at = ? WHERE id = ?", [now(), id]);
+    const row = d.query("SELECT recall_count, importance FROM memories WHERE id = ?").get(id);
+    if (!row)
+      return;
+    const promotions = Math.floor(row.recall_count / RECALL_PROMOTE_THRESHOLD);
+    if (promotions > 0 && row.importance < 10) {
+      const newImportance = Math.min(10, row.importance + 1);
+      d.run("UPDATE memories SET importance = ? WHERE id = ? AND importance < 10", [newImportance, id]);
+    }
+  } catch {}
+}
+function cleanExpiredMemories(db) {
+  if (!db && isApiMode()) {
+    const { data } = apiJson("POST", "/memories/clean");
+    return data?.cleaned ?? 0;
+  }
+  const d = db || getDatabase();
+  const timestamp = now();
+  const countRow = d.query("SELECT COUNT(*) as c FROM memories WHERE expires_at IS NOT NULL AND expires_at < ?").get(timestamp);
+  const count = countRow.c;
+  if (count > 0) {
+    d.run("DELETE FROM memories WHERE expires_at IS NOT NULL AND expires_at < ?", [timestamp]);
+  }
+  return count;
+}
+function getMemoryVersions(memoryId, db) {
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/memories/${encodeURIComponent(memoryId)}/versions`);
+    return data?.versions ?? [];
+  }
+  const d = db || getDatabase();
+  try {
+    const rows = d.query("SELECT * FROM memory_versions WHERE memory_id = ? ORDER BY version ASC").all(memoryId);
+    return rows.map((row) => ({
+      id: row["id"],
+      memory_id: row["memory_id"],
+      version: row["version"],
+      value: row["value"],
+      importance: row["importance"],
+      scope: row["scope"],
+      category: row["category"],
+      tags: JSON.parse(row["tags"] || "[]"),
+      summary: row["summary"] || null,
+      pinned: !!row["pinned"],
+      status: row["status"],
+      created_at: row["created_at"]
+    }));
+  } catch {
+    return [];
+  }
+}
+
+// src/project-registration/project-resources.ts
+var DEFAULT_PAGE_LIMIT = 100;
+var MAX_PAGE_LIMIT = 1000;
+var CURSOR_SCHEMA = "mementos.project-resources.cursor.v1";
+
+class MementosProjectResourceError extends Error {
+  code;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "MementosProjectResourceError";
+  }
+}
+function timestamp(value) {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+function normalizeSqlValue(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map(normalizeSqlValue);
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizeSqlValue(item)]));
+}
+function exactProject(db, projectId) {
+  const row = db.get("SELECT id, name, path, description, memory_prefix, created_at, updated_at FROM projects WHERE id = ? LIMIT 1", projectId);
+  if (!row) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_PROJECT_NOT_FOUND", `Mementos project not found: ${projectId}`, { project_id: projectId });
+  }
+  return row;
+}
+function resourceKey(resource) {
+  const rank = MEMENTOS_PROJECT_RESOURCE_KINDS.indexOf(resource.resource_kind);
+  return `${String(rank).padStart(2, "0")}:${resource.stable_id}`;
+}
+function projectResource(project) {
+  const normalized = normalizeSqlValue(project);
+  return {
+    authority: "mementos",
+    source_package: "@hasna/mementos",
+    project_id: project.id,
+    resource_kind: "project",
+    stable_id: project.id,
+    revision: timestamp(project.updated_at),
+    digest: digestMementosProjectRegistrationValue(normalized),
+    membership: "project_aggregate"
+  };
+}
+function memoryResources(db, projectId) {
+  const rows = db.all("SELECT * FROM memories WHERE project_id = ? ORDER BY id ASC", projectId);
+  return rows.map((row) => {
+    const memory = normalizeSqlValue(parseMemoryRow(row));
+    return {
+      authority: "mementos",
+      source_package: "@hasna/mementos",
+      project_id: projectId,
+      resource_kind: row["category"] === "knowledge" ? "knowledge" : "memory",
+      stable_id: String(row["id"]),
+      revision: timestamp(row["updated_at"]),
+      digest: digestMementosProjectRegistrationValue(memory),
+      membership: "explicit_project_id_or_focus"
+    };
+  });
+}
+function sessionResources(db, projectId) {
+  const rows = db.all("SELECT * FROM session_memory_jobs WHERE project_id = ? ORDER BY id ASC", projectId);
+  return rows.map((row) => {
+    const normalized = {
+      id: String(row["id"]),
+      session_id: String(row["session_id"]),
+      agent_id: row["agent_id"] === null ? null : String(row["agent_id"] ?? "") || null,
+      project_id: row["project_id"] === null ? null : String(row["project_id"] ?? "") || null,
+      source: String(row["source"]),
+      status: String(row["status"]),
+      transcript: String(row["transcript"]),
+      chunk_count: Number(row["chunk_count"]),
+      memories_extracted: Number(row["memories_extracted"]),
+      error: row["error"] === null ? null : String(row["error"] ?? "") || null,
+      metadata: typeof row["metadata"] === "string" ? JSON.parse(row["metadata"] || "{}") : normalizeSqlValue(row["metadata"] ?? {}),
+      created_at: timestamp(row["created_at"]),
+      started_at: row["started_at"] === null ? null : timestamp(row["started_at"]),
+      completed_at: row["completed_at"] === null ? null : timestamp(row["completed_at"])
+    };
+    return {
+      authority: "mementos",
+      source_package: "@hasna/mementos",
+      project_id: projectId,
+      resource_kind: "session",
+      stable_id: String(row["id"]),
+      revision: timestamp(row["completed_at"] ?? row["started_at"] ?? row["created_at"]),
+      digest: digestMementosProjectRegistrationValue(normalized),
+      membership: "explicit_project_id_or_focus"
+    };
+  });
+}
+function normalizeResourceKinds(value) {
+  if (!value)
+    return [...MEMENTOS_PROJECT_RESOURCE_KINDS];
+  if (value.length === 0) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "resource_kinds must contain at least one supported resource kind");
+  }
+  const requested = new Set(value);
+  for (const kind of requested) {
+    if (!MEMENTOS_PROJECT_RESOURCE_KINDS.includes(kind)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `Unsupported Mementos project resource kind: ${kind}`);
+    }
+  }
+  return MEMENTOS_PROJECT_RESOURCE_KINDS.filter((kind) => requested.has(kind));
+}
+function normalizeLimit(value) {
+  const limit = value ?? DEFAULT_PAGE_LIMIT;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `limit must be an integer between 1 and ${MAX_PAGE_LIMIT}`);
+  }
+  return limit;
+}
+function encodeCursor(cursor) {
+  return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+function decodeCursor(raw) {
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+    if (parsed.schema !== CURSOR_SCHEMA || typeof parsed.project_id !== "string" || typeof parsed.collection_revision !== "string" || !Array.isArray(parsed.resource_kinds) || typeof parsed.after_key !== "string") {
+      throw new Error("invalid cursor shape");
+    }
+    return parsed;
+  } catch {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "cursor is not a valid Mementos project-resource cursor");
+  }
+}
+function localPopulation(projectId, db, resourceKinds) {
+  const project = exactProject(db, projectId);
+  const selected = new Set(resourceKinds);
+  const resources = [
+    ...selected.has("project") ? [projectResource(project)] : [],
+    ...memoryResources(db, projectId).filter((resource) => selected.has(resource.resource_kind)),
+    ...selected.has("session") ? sessionResources(db, projectId) : []
+  ].sort((left, right) => resourceKey(left).localeCompare(resourceKey(right)));
+  const collectionRevision = digestMementosProjectRegistrationValue({
+    schema: MEMENTOS_PROJECT_RESOURCE_ROUTE,
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    resource_kinds: resourceKinds,
+    resources: resources.map((resource) => ({
+      resource_kind: resource.resource_kind,
+      stable_id: resource.stable_id,
+      revision: resource.revision,
+      digest: resource.digest
+    }))
+  });
+  return { project, resources, collectionRevision };
+}
+function readMementosProjectResourcePage(projectId, options = {}, db, authorityOptions = {}) {
+  const resourceKinds = normalizeResourceKinds(options.resource_kinds);
+  const limit = normalizeLimit(options.limit);
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/projects/${encodeURIComponent(projectId)}/resources${toQuery({
+      limit,
+      cursor: options.cursor ?? undefined,
+      resource_kinds: resourceKinds.join(",")
+    })}`);
+    return data;
+  }
+  const d = db ?? getDatabase();
+  const { project, resources, collectionRevision } = localPopulation(projectId, d, resourceKinds);
+  let start = 0;
+  if (options.cursor) {
+    const cursor = decodeCursor(options.cursor);
+    if (cursor.project_id !== projectId || JSON.stringify(cursor.resource_kinds) !== JSON.stringify(resourceKinds)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "cursor does not belong to this project and resource-kind selection");
+    }
+    if (cursor.collection_revision !== collectionRevision) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource collection changed; restart from the first page", {
+        cursor_collection_revision: cursor.collection_revision,
+        current_collection_revision: collectionRevision
+      });
+    }
+    const afterIndex = resources.findIndex((resource) => resourceKey(resource) === cursor.after_key);
+    if (afterIndex < 0) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource cursor no longer names a member; restart from the first page");
+    }
+    start = afterIndex + 1;
+  }
+  const pageResources = resources.slice(start, start + limit);
+  const hasMore = start + pageResources.length < resources.length;
+  const nextCursor = hasMore && pageResources.length > 0 ? encodeCursor({
+    schema: CURSOR_SCHEMA,
+    project_id: projectId,
+    collection_revision: collectionRevision,
+    resource_kinds: resourceKinds,
+    after_key: resourceKey(pageResources[pageResources.length - 1])
+  }) : null;
+  const capability = buildMementosProjectRegistrationCapability(authorityOptions);
+  return {
+    schema: "mementos.project-resources.v1",
+    authority: {
+      authority: capability.authority,
+      authority_id: capability.authority_id,
+      tenant_id: capability.tenant_id,
+      corpus_id: capability.corpus_id,
+      package_version: capability.package_version
+    },
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    collection_revision: collectionRevision,
+    resource_kinds: resourceKinds,
+    resources: pageResources,
+    count: pageResources.length,
+    total: resources.length,
+    limit,
+    cursor: options.cursor ?? null,
+    next_cursor: nextCursor,
+    has_more: hasMore,
+    complete: true,
+    truncated: false
+  };
+}
+function readAllMementosProjectResources(projectId, options = {}, db, authorityOptions = {}) {
+  const pageSize = normalizeLimit(options.page_size);
+  let cursor = null;
+  let first = null;
+  const resources = [];
+  const seen = new Set;
+  do {
+    const page = readMementosProjectResourcePage(projectId, {
+      limit: pageSize,
+      cursor,
+      resource_kinds: options.resource_kinds
+    }, db, authorityOptions);
+    if (!first)
+      first = page;
+    if (page.collection_revision !== first.collection_revision || page.total !== first.total || JSON.stringify(page.resource_kinds) !== JSON.stringify(first.resource_kinds)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource collection changed during complete traversal");
+    }
+    for (const resource of page.resources) {
+      const key = resourceKey(resource);
+      if (seen.has(key)) {
+        throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", `Mementos project resource traversal returned duplicate stable ID: ${key}`);
+      }
+      seen.add(key);
+      resources.push(resource);
+    }
+    if (page.has_more && !page.next_cursor) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", "Mementos project resource page claimed more results without a continuation cursor");
+    }
+    cursor = page.next_cursor;
+  } while (cursor);
+  if (!first) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", "Mementos project resource traversal returned no first page");
+  }
+  if (resources.length !== first.total) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", `Mementos project resource traversal returned ${resources.length} of ${first.total} resources`);
+  }
+  return {
+    ...first,
+    resources,
+    count: resources.length,
+    total: resources.length,
+    limit: pageSize,
+    cursor: null,
+    next_cursor: null,
+    has_more: false,
+    complete: true,
+    truncated: false
+  };
+}
+function getMementosProjectResourceExact(projectId, resourceKind, stableId, db, authorityOptions = {}) {
+  if (!MEMENTOS_PROJECT_RESOURCE_KINDS.includes(resourceKind)) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `Unsupported Mementos project resource kind: ${resourceKind}`);
+  }
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/projects/${encodeURIComponent(projectId)}/resources/${encodeURIComponent(resourceKind)}/${encodeURIComponent(stableId)}`);
+    return data;
+  }
+  const d = db ?? getDatabase();
+  const { project, resources, collectionRevision } = localPopulation(projectId, d, [
+    resourceKind
+  ]);
+  const resource = resources.find((candidate) => candidate.stable_id === stableId);
+  if (!resource) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_NOT_FOUND", `Mementos ${resourceKind} resource not found in project ${projectId}: ${stableId}`, { project_id: projectId, resource_kind: resourceKind, stable_id: stableId });
+  }
+  const capability = buildMementosProjectRegistrationCapability(authorityOptions);
+  return {
+    schema: "mementos.project-resource.v1",
+    authority: {
+      authority: capability.authority,
+      authority_id: capability.authority_id,
+      tenant_id: capability.tenant_id,
+      corpus_id: capability.corpus_id,
+      package_version: capability.package_version
+    },
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    collection_revision: collectionRevision,
+    resource,
+    complete: true,
+    truncated: false
+  };
+}
 export {
   sqliteMementosProjectRegistrationSchemaSql,
   sqliteMementosProjectGuardedUpdateSchemaSql,
+  resolveMementosProjectAuthorityIdentity,
+  readMementosProjectResourcePage,
+  readAllMementosProjectResources,
   postgresMementosProjectRegistrationSchemaSql,
   postgresMementosProjectGuardedUpdateSchemaSql,
   mementosProjectReferenceCounts,
   hasMementosProjectReferences,
   handleMementosProjectRegistrationHttpRequest,
+  getMementosProjectResourceExact,
   digestMementosProjectRegistrationValue,
   deriveMementosProjectRegistrationIdempotencyKey,
   createMementosProjectRegistrationHttpClient,
   createMementosProjectRegistrationAuthority,
   createLocalMementosProjectRegistrationAuthority,
   canonicalMementosProjectRegistrationJson,
+  buildMementosProjectRegistrationCapability,
   PackageOwnedMementosProjectRegistrationAuthority,
+  MementosProjectResourceError,
   MementosProjectRegistrationHttpClient,
   MementosProjectRegistrationError,
+  MementosProjectAuthorityIdentityError,
+  MEMENTOS_PROJECT_RESOURCE_ROUTE,
+  MEMENTOS_PROJECT_RESOURCE_KINDS,
   MEMENTOS_PROJECT_REGISTRATION_SCHEMA_VERSION,
   MEMENTOS_PROJECT_REGISTRATION_ROUTE,
   MEMENTOS_PROJECT_REGISTRATION_CALLER_ROUTE,
   MEMENTOS_PROJECT_REFERENCE_SURFACES,
-  MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE
+  MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
+  MEMENTOS_PROJECT_AUTHORITY_ENV
 };