@intentface/latch-memory 0.9.1

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmC9D,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAI,IAA8B;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqD,CAAC;IAE3E,SAAS,UAAU,CAAC,QAAgB;QAClC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,SAAY,EAAE,KAAe;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,KAAK,CAAC,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK;gBAAE,IAAI,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG;oBAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0FAA0F;IAC1F,SAAS,WAAW,CAAC,IAIpB;QACC,MAAM,GAAG,GAAkE,EAAE,CAAC;QAC9E,KAAK,MAAM,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,KAAK,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;YAChD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAC1C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC7C,KAAK;oBACL,UAAU,EAAE,KAAK;oBACjB,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC;iBAC3C,CAAC,CAAC,CACJ,CAAC;gBACF,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1E,OAAO,2BAA2B,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;YACnC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,CAAC;YACxB,MAAM,aAAa,GAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBAC5E,KAAK;gBACL,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE;aAC/C,CAAC,CAAC,CAAC;YACJ,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YACrE,OAAO;gBACL,aAAa,EAAE,gBAAgB,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjF,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE;oBACjC,KAAK;oBACL,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC;oBAC/C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;wBACrC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CACjB,IAAI,CAAC,gBAAiB,CAAC;4BACrB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG;4BAC3B,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU;4BACpC,KAAK;4BACL,SAAS;4BACT,IAAI;4BACJ,IAAI;yBACL,CAAC;wBACN,CAAC,CAAC,SAAS;iBACd,CAAC;aACH,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/sanitize.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Injection hardening for memory-derived text.
+ *
+ * Everything under a memory scope is LLM-authored from user conversation
+ * (extraction/consolidation), which makes stored memory a prompt-injection
+ * PERSISTENCE vector: a hostile conversation can plant text that later lands
+ * verbatim in another turn's system prompt (the injected index block) or in
+ * tool results (search snippets). Two layers, applied at injection time:
+ *
+ *  1. envelope integrity — tag-shaped text that could close/reopen the
+ *     `<memory>` data envelope or fake system/instruction framing is removed;
+ *  2. a NAMED blocklist of well-known injection phrasings is replaced with
+ *     `[filtered]`.
+ *
+ * HONESTY: this is volume reduction, NOT a guarantee. A blocklist cannot
+ * enumerate every phrasing, and a determined attacker will word around it.
+ * The durable defenses are the data envelope plus the standing "memory is
+ * data, not instructions" instruction — this pass just removes the cheap,
+ * well-known payloads. Patterns are kept tight so benign memory text
+ * (including text that merely MENTIONS instructions) passes unchanged.
+ */
+/**
+ * Neutralize envelope breakouts and strip known injection phrasings from
+ * memory-derived text. Apply wherever stored memory re-enters a prompt (the
+ * compiled index block, search snippets). Idempotent; leaves benign text —
+ * including ordinary mentions of "instructions" — untouched.
+ */
+export declare function sanitizeMemoryText(text: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA+CH;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAevD"}

package/dist/sanitize.js

@@ -0,0 +1,88 @@
+/**
+ * Injection hardening for memory-derived text.
+ *
+ * Everything under a memory scope is LLM-authored from user conversation
+ * (extraction/consolidation), which makes stored memory a prompt-injection
+ * PERSISTENCE vector: a hostile conversation can plant text that later lands
+ * verbatim in another turn's system prompt (the injected index block) or in
+ * tool results (search snippets). Two layers, applied at injection time:
+ *
+ *  1. envelope integrity — tag-shaped text that could close/reopen the
+ *     `<memory>` data envelope or fake system/instruction framing is removed;
+ *  2. a NAMED blocklist of well-known injection phrasings is replaced with
+ *     `[filtered]`.
+ *
+ * HONESTY: this is volume reduction, NOT a guarantee. A blocklist cannot
+ * enumerate every phrasing, and a determined attacker will word around it.
+ * The durable defenses are the data envelope plus the standing "memory is
+ * data, not instructions" instruction — this pass just removes the cheap,
+ * well-known payloads. Patterns are kept tight so benign memory text
+ * (including text that merely MENTIONS instructions) passes unchanged.
+ */
+/**
+ * Tag-shaped text that could terminate/forge the data envelope or smuggle
+ * role framing: `</memory>`, `<system>`, `<instructions>`, chat-template
+ * markers (`<|im_start|>`, `[INST]`, `<<SYS>>`), etc. Removed outright —
+ * memory content has no legitimate use for these.
+ */
+const ENVELOPE_BREAK_PATTERNS = [
+    // XML-ish open/close tags for the envelope and role/instruction framing.
+    /<\s*\/?\s*(?:memory|system|instructions?|assistant|developer|prompt|sys)\b[^>]*>/gi,
+    // ChatML-style special tokens: <|im_start|>, <|system|>, <|endoftext|>, …
+    /<\|[^|>]{1,32}\|>/g,
+    // Llama-style framing: [INST] … [/INST], <<SYS>> … <</SYS>>.
+    /\[\s*\/?\s*INST\s*\]/gi,
+    /<<\s*\/?\s*SYS\s*>>/gi,
+];
+/**
+ * Known injection phrasings, each named so the corpus test pins them
+ * one-by-one. Every pattern requires imperative/role context — "ignore" or
+ * "instructions" alone never match.
+ */
+const INJECTION_PATTERNS = [
+    {
+        // "ignore/disregard/forget/override/bypass [all/any/the/your]
+        //  [previous/prior/above/…] instructions/prompt/rules/…"
+        name: "override-prior-instructions",
+        pattern: /\b(?:ignore|disregard|forget|override|bypass)\s+(?:(?:all|any|the|your|every)\s+)?(?:(?:previous|prior|above|earlier|preceding|original|initial|system|safety)\s+)?(?:instructions?|prompts?|directives?|rules?|guidelines?|context|messages?)\b/gi,
+    },
+    { name: "new-instructions-colon", pattern: /\bnew\s+instructions?\s*:/gi },
+    {
+        name: "your-instructions-are",
+        pattern: /\byour\s+(?:real\s+|true\s+|actual\s+|new\s+)?instructions?\s+are\b/gi,
+    },
+    { name: "system-role-claim", pattern: /\bsystem\s*:\s*you\s+are\b/gi },
+    { name: "you-are-now", pattern: /\byou\s+are\s+now\b/gi },
+    { name: "developer-mode", pattern: /\bdeveloper\s+mode\b/gi },
+    { name: "dan-do-anything-now", pattern: /\bdo\s+anything\s+now\b/gi },
+    { name: "dan-persona", pattern: /\b(?:you\s+are|act\s+as)\s+DAN\b/gi },
+    { name: "dan-mode", pattern: /\bDAN\s+mode\b/g },
+    { name: "jailbreak-mode", pattern: /\bjailbreak\s+(?:mode|prompt)\b/gi },
+];
+const FILTERED = "[filtered]";
+/**
+ * Neutralize envelope breakouts and strip known injection phrasings from
+ * memory-derived text. Apply wherever stored memory re-enters a prompt (the
+ * compiled index block, search snippets). Idempotent; leaves benign text —
+ * including ordinary mentions of "instructions" — untouched.
+ */
+export function sanitizeMemoryText(text) {
+    let out = text;
+    // To a fixpoint (bounded): stripping can reassemble a payload from its
+    // halves ("<sys<system>tem>" → "<system>"), so one pass is bypassable.
+    for (let i = 0; i < 8; i++) {
+        const before = out;
+        // Tags are replaced with a space, not "": removing them outright would
+        // splice their neighbors together, both reassembling split tags and
+        // fusing words across a stripped tag so phrase patterns miss them.
+        for (const pattern of ENVELOPE_BREAK_PATTERNS)
+            out = out.replace(pattern, " ");
+        for (const { pattern } of INJECTION_PATTERNS)
+            out = out.replace(pattern, FILTERED);
+        if (out === before)
+            return out;
+    }
+    // Still churning after the bound — refuse to inject what we can't settle.
+    return "(memory text withheld: sanitizer did not converge)";
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAsB;IACjD,yEAAyE;IACzE,oFAAoF;IACpF,0EAA0E;IAC1E,oBAAoB;IACpB,6DAA6D;IAC7D,wBAAwB;IACxB,uBAAuB;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAqD;IAC3E;QACE,8DAA8D;QAC9D,yDAAyD;QACzD,IAAI,EAAE,6BAA6B;QACnC,OAAO,EACL,oPAAoP;KACvP;IACD,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC1E;QACE,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,uEAAuE;KACjF;IACD,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,8BAA8B,EAAE;IACtE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,EAAE;IACzD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAC7D,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACrE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,oCAAoC,EAAE;IACtE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mCAAmC,EAAE;CACzE,CAAC;AAEF,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,uEAAuE;IACvE,uEAAuE;IACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,uEAAuE;QACvE,oEAAoE;QACpE,mEAAmE;QACnE,KAAK,MAAM,OAAO,IAAI,uBAAuB;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/E,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,kBAAkB;YAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnF,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;IACjC,CAAC;IACD,0EAA0E;IAC1E,OAAO,oDAAoD,CAAC;AAC9D,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,60 @@
+import type { MemoryScope } from "@intentface/latch-core";
+/**
+ * Memory index schemas: markdown outlines (top-level `##` headings, optional
+ * description bullets) that steer WHAT the background extractor captures per
+ * level and HOW the consolidator organizes that level's MEMORY.md.
+ *
+ * Schemas are ADVISORY: they enter the extraction/consolidation prompts and
+ * `memory_write_index` nudges one self-correction round on sections outside
+ * the outline (`schemaSectionWarnings`), but a rewrite is never hard-failed
+ * over schema drift — sweeps must not wedge on model non-compliance.
+ *
+ * Two homes:
+ * - agent-held levels (`agent-user`, `agent-org`): `MemoryConfig.schemas`.
+ * - the cross-agent `user` level: one shared workspace file per connection at
+ *   `USER_SCHEMA_PATH` — deliberately OUTSIDE the private root (schemas carry
+ *   no PII, and an org-wide file must resolve identically for every caller;
+ *   `__private_root` is caller-relative). User memory DATA stays private.
+ */
+export declare const MEMORY_SCHEMA_FILENAME = "SCHEMA.md";
+/**
+ * Workspace path of the shared, org-wide `user`-level schema file — anchored
+ * at the shared root so it resolves to ONE physical file for every caller
+ * (see LOREDEX_SHARED_ROOT for the caller-relative resolution hazard).
+ */
+export declare const USER_SCHEMA_PATH = "__shared_root/_memory/_user/SCHEMA.md";
+/**
+ * The non-negotiable per-level policy floor. Always present in extraction and
+ * consolidation prompts, independent of (and above) any configured schema —
+ * editing or deleting a schema can never relax it.
+ */
+export declare const MEMORY_POLICY_FLOOR: Record<MemoryScope, string>;
+/** Fallback outlines used whenever a level has no configured schema. */
+export declare const DEFAULT_MEMORY_SCHEMAS: Record<MemoryScope, string>;
+/** The section outline of a schema: its top-level `##` headings, in order. */
+export declare function schemaSections(schema: string): string[];
+/**
+ * Short stable fingerprint of one schema's normalized text (trailing
+ * whitespace and blank-line runs ignored). `"0"` for undefined/blank —
+ * "no schema" fingerprints identically everywhere.
+ */
+export declare function schemaFingerprint(schema: string | undefined): string;
+/**
+ * Combined fingerprint over every participating level and its schema. Folded
+ * into extraction idempotency keys: editing any level's schema — or adding/
+ * removing a level — changes the key, so tombstoned windows become
+ * re-extractable under the new configuration. Order-independent (levels are
+ * sorted) so callers need not care about target ordering.
+ */
+export declare function schemasFingerprint(targets: ReadonlyArray<{
+    level: MemoryScope;
+    schema: string | undefined;
+}>): string;
+/**
+ * Advisory schema check for an index rewrite: top-level `##` sections in
+ * `content` that are neither in the schema's outline nor `## Archive`
+ * (case-insensitive). Returns problem strings for the tool's self-correction
+ * loop — NEVER used to hard-fail a write.
+ */
+export declare function schemaSectionWarnings(schema: string, content: string): string[];
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,0CAAiF,CAAC;AAE/G;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAY3D,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CA2B9D,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAOvD;AAcD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASpE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,aAAa,CAAC;IAAE,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC,GACzE,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAgB/E"}

package/dist/schema.js

@@ -0,0 +1,144 @@
+import { LOREDEX_SHARED_ROOT, MEMORY_ROOT_PREFIX } from "./scope.js";
+/**
+ * Memory index schemas: markdown outlines (top-level `##` headings, optional
+ * description bullets) that steer WHAT the background extractor captures per
+ * level and HOW the consolidator organizes that level's MEMORY.md.
+ *
+ * Schemas are ADVISORY: they enter the extraction/consolidation prompts and
+ * `memory_write_index` nudges one self-correction round on sections outside
+ * the outline (`schemaSectionWarnings`), but a rewrite is never hard-failed
+ * over schema drift — sweeps must not wedge on model non-compliance.
+ *
+ * Two homes:
+ * - agent-held levels (`agent-user`, `agent-org`): `MemoryConfig.schemas`.
+ * - the cross-agent `user` level: one shared workspace file per connection at
+ *   `USER_SCHEMA_PATH` — deliberately OUTSIDE the private root (schemas carry
+ *   no PII, and an org-wide file must resolve identically for every caller;
+ *   `__private_root` is caller-relative). User memory DATA stays private.
+ */
+export const MEMORY_SCHEMA_FILENAME = "SCHEMA.md";
+/**
+ * Workspace path of the shared, org-wide `user`-level schema file — anchored
+ * at the shared root so it resolves to ONE physical file for every caller
+ * (see LOREDEX_SHARED_ROOT for the caller-relative resolution hazard).
+ */
+export const USER_SCHEMA_PATH = `${LOREDEX_SHARED_ROOT}/${MEMORY_ROOT_PREFIX}/_user/${MEMORY_SCHEMA_FILENAME}`;
+/**
+ * The non-negotiable per-level policy floor. Always present in extraction and
+ * consolidation prompts, independent of (and above) any configured schema —
+ * editing or deleting a schema can never relax it.
+ */
+export const MEMORY_POLICY_FLOOR = {
+    "agent-user": "Private per-user memory: personal detail relevant to this agent is allowed. " +
+        "NEVER store credentials, secrets, tokens, one-time codes, or full account/ID numbers.",
+    "agent-org": "Organization-shared memory: NO personally identifying information and NO facts " +
+        "attributed to named or identifiable individuals — store aggregate patterns, team-level " +
+        "observations, process decisions, and org-level facts only.",
+    user: "Cross-agent user profile: profile-level facts about the user only (identity, stable " +
+        "preferences, expertise, life/work context) — no agent-domain specifics, and never " +
+        "credentials, secrets, or account numbers.",
+};
+/** Fallback outlines used whenever a level has no configured schema. */
+export const DEFAULT_MEMORY_SCHEMAS = {
+    "agent-user": [
+        "## Identity & preferences",
+        "- Who the user is to this agent; how they like to work with it",
+        "## Projects & context",
+        "- Ongoing work, goals, and constraints that persist across sessions",
+        "## Working agreements",
+        "- Decisions, commitments, and standing instructions",
+        "## Open loops",
+        "- Unfinished threads future sessions must pick up",
+    ].join("\n"),
+    "agent-org": [
+        "## Team patterns",
+        "- Aggregate observations about how teams work and respond (no individuals)",
+        "## Process decisions",
+        "- Org-level decisions and conventions this agent should honor",
+        "## Recurring topics",
+        "- Themes that keep coming up across the organization",
+    ].join("\n"),
+    user: [
+        "## Profile",
+        "- Who the user is: role, background, expertise level",
+        "## Preferences",
+        "- Stable cross-agent preferences (tone, language, formats)",
+        "## Life & work context",
+        "- Durable context any of the user's agents may need",
+    ].join("\n"),
+};
+/** The section outline of a schema: its top-level `##` headings, in order. */
+export function schemaSections(schema) {
+    const out = [];
+    for (const line of schema.split("\n")) {
+        const m = /^##(?!#)\s*(.+?)\s*$/.exec(line.trim());
+        if (m && m[1])
+            out.push(m[1]);
+    }
+    return out;
+}
+/** FNV-1a 64-bit, hex — deterministic, dependency-free (mirrors extraction-key). */
+function fnv1a64(input) {
+    let h = 0xcbf29ce484222325n;
+    const prime = 0x100000001b3n;
+    const mask = 0xffffffffffffffffn;
+    for (let i = 0; i < input.length; i++) {
+        h ^= BigInt(input.charCodeAt(i));
+        h = (h * prime) & mask;
+    }
+    return h.toString(16).padStart(16, "0");
+}
+/**
+ * Short stable fingerprint of one schema's normalized text (trailing
+ * whitespace and blank-line runs ignored). `"0"` for undefined/blank —
+ * "no schema" fingerprints identically everywhere.
+ */
+export function schemaFingerprint(schema) {
+    const normalized = (schema ?? "")
+        .split("\n")
+        .map((l) => l.trimEnd())
+        .join("\n")
+        .replace(/\n{2,}/g, "\n")
+        .trim();
+    if (!normalized)
+        return "0";
+    return fnv1a64(normalized);
+}
+/**
+ * Combined fingerprint over every participating level and its schema. Folded
+ * into extraction idempotency keys: editing any level's schema — or adding/
+ * removing a level — changes the key, so tombstoned windows become
+ * re-extractable under the new configuration. Order-independent (levels are
+ * sorted) so callers need not care about target ordering.
+ */
+export function schemasFingerprint(targets) {
+    const parts = targets
+        .map((t) => `${t.level}:${schemaFingerprint(t.schema)}`)
+        .sort()
+        .join("|");
+    return fnv1a64(parts);
+}
+/**
+ * Advisory schema check for an index rewrite: top-level `##` sections in
+ * `content` that are neither in the schema's outline nor `## Archive`
+ * (case-insensitive). Returns problem strings for the tool's self-correction
+ * loop — NEVER used to hard-fail a write.
+ */
+export function schemaSectionWarnings(schema, content) {
+    const allowed = new Set(schemaSections(schema).map((s) => s.toLowerCase()));
+    allowed.add("archive");
+    if (allowed.size <= 1)
+        return []; // no outline configured — nothing to check
+    const outline = schemaSections(schema)
+        .map((s) => `## ${s}`)
+        .join(", ");
+    const problems = [];
+    for (const section of schemaSections(content)) {
+        if (allowed.has(section.toLowerCase()))
+            continue;
+        problems.push(`unexpected top-level section "## ${section}" — this index's schema sections are: ` +
+            `${outline} (plus ## Archive); move its entries under one of those`);
+    }
+    return problems;
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErE;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,mBAAmB,IAAI,kBAAkB,UAAU,sBAAsB,EAAE,CAAC;AAE/G;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D,YAAY,EACV,8EAA8E;QAC9E,uFAAuF;IACzF,WAAW,EACT,iFAAiF;QACjF,yFAAyF;QACzF,4DAA4D;IAC9D,IAAI,EACF,sFAAsF;QACtF,oFAAoF;QACpF,2CAA2C;CAC9C,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAgC;IACjE,YAAY,EAAE;QACZ,2BAA2B;QAC3B,gEAAgE;QAChE,uBAAuB;QACvB,qEAAqE;QACrE,uBAAuB;QACvB,qDAAqD;QACrD,eAAe;QACf,mDAAmD;KACpD,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,WAAW,EAAE;QACX,kBAAkB;QAClB,4EAA4E;QAC5E,sBAAsB;QACtB,+DAA+D;QAC/D,qBAAqB;QACrB,sDAAsD;KACvD,CAAC,IAAI,CAAC,IAAI,CAAC;IACZ,IAAI,EAAE;QACJ,YAAY;QACZ,sDAAsD;QACtD,gBAAgB;QAChB,4DAA4D;QAC5D,wBAAwB;QACxB,qDAAqD;KACtD,CAAC,IAAI,CAAC,IAAI,CAAC;CACb,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC,GAAG,mBAAmB,CAAC;IAC5B,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B;IAC1D,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACvB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;SACxB,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,UAAU;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA0E;IAE1E,MAAM,KAAK,GAAG,OAAO;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;SACvD,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,OAAe;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,CAAC,2CAA2C;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;SACrB,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YAAE,SAAS;QACjD,QAAQ,CAAC,IAAI,CACX,oCAAoC,OAAO,wCAAwC;YACjF,GAAG,OAAO,yDAAyD,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,62 @@
+import type { MemoryConfig, MemoryScope } from "@intentface/latch-core";
+import type { ScopeRef } from "./types.js";
+export declare const MEMORY_ROOT_PREFIX = "_memory";
+/**
+ * Loredex's per-user private root folder (`is_root=1`, `visibility='private'`,
+ * owner-only ACL). Every workspace member has exactly one; the server creates
+ * it on join (`ensureUserPrivateRoot`), so it always exists and is never
+ * created by us. Folders created under it inherit `private` visibility, which
+ * is what makes per-user memory scopes actually private — unlike the shared
+ * `_memory/**` tree, where per-user separation is only a folder convention.
+ *
+ * The path segment is caller-relative: the same literal resolves to a
+ * DIFFERENT physical folder per authenticated user. Scope roots under it keep
+ * their `u-<id>` leaf anyway — see `scopeRefOf` for why.
+ */
+export declare const LOREDEX_PRIVATE_ROOT = "__private_root";
+/**
+ * Loredex's workspace-shared root folder (`is_root=1`, `visibility='shared'`,
+ * unowned). Exactly one per workspace, provisioned by the server, rendered as
+ * "Shared" in the UI — never created by us.
+ *
+ * Shared memory paths MUST anchor here. Loredex resolves bare path heads
+ * caller-relatively (any accessible folder of that name, oldest first), so an
+ * unanchored `_memory/...` can silently resolve to the CALLER'S OWN
+ * `__private_root/_memory` — fragmenting "org" memory into per-user private
+ * copies with no visible error (each user reads their own copy back
+ * consistently). Found live 2026-08-13; anchoring the head is the fix on our
+ * side of the seam.
+ */
+export declare const LOREDEX_SHARED_ROOT = "__shared_root";
+/**
+ * Boundary-aware containment check for workspace paths: `path` must sit
+ * strictly under `root`, segment-by-segment, with no `.`/`..`/empty segments —
+ * so `root/../elsewhere` can't escape and `${root}-evil/x` can't prefix-match.
+ */
+export declare function isUnderScopeRoot(root: string, path: string): boolean;
+/**
+ * Resolve the scope folder for a caller, or undefined when the scope needs a
+ * user but the principal carries none (e.g. an org-only principal hitting a
+ * per-user scope) — memory is simply unavailable for that turn.
+ */
+export declare function scopeRefOf(args: {
+    agent: string;
+    memory: MemoryConfig;
+    userId?: string;
+}): ScopeRef | undefined;
+/**
+ * The levels this agent's memory participates in: `extractTo` normalized —
+ * deduplicated, primary scope first, and always containing the primary scope
+ * whether or not the stored config lists it. Every multi-level reader
+ * (provider injection/search, sweep extraction) derives its level set here so
+ * a denormalized stored config can't split behavior.
+ */
+export declare function extractionLevelsOf(memory: MemoryConfig): MemoryScope[];
+/**
+ * The per-level view of a memory config: same connection and tuning, `scope`
+ * swapped to `level` — so `scopeRefOf`/`scopeLabelOf` work per level for free.
+ */
+export declare function levelConfigOf(memory: MemoryConfig, level: MemoryScope): MemoryConfig;
+/** Human-readable scope label for prompts and UI. */
+export declare function scopeLabelOf(memory: MemoryConfig): string;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAmC3C,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,QAAQ,GAAG,SAAS,CAuBvB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,EAAE,CAMtE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,GAAG,YAAY,CAEpF;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CASzD"}

package/dist/scope.js

@@ -0,0 +1,136 @@
+/**
+ * Scope derivation: pure functions from (agent, memory config, caller
+ * identity) to the folder a store lives in. Consolidation and search never
+ * cross a scope boundary, so everything downstream keys off `ScopeRef.key`.
+ */
+/** FNV-1a 32-bit, hex — a short stable fingerprint (no crypto dependency). */
+function fnv1a(input) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        h ^= input.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return (h >>> 0).toString(16).padStart(8, "0");
+}
+/**
+ * Keep path segments filesystem/URL-safe and boundary-proof (no `/` or `..`).
+ * Sanitization is many-to-one ("a/b" and "a-b" would collapse), and `key` is
+ * the storage boundary — so whenever cleaning changed ANYTHING, a short hash
+ * of the raw id is appended to keep distinct ids distinct. Already-clean ids
+ * (the normal case: kebab agent names, alphanumeric user ids) pass through
+ * untouched, so existing scope roots are stable.
+ */
+function seg(raw) {
+    const cleaned = raw
+        .replace(/[^a-zA-Z0-9_-]/g, "-")
+        .replace(/-{2,}/g, "-")
+        .replace(/^-+|-+$/g, "");
+    if (cleaned === raw && cleaned)
+        return cleaned;
+    return `${cleaned || "x"}-${fnv1a(raw)}`;
+}
+export const MEMORY_ROOT_PREFIX = "_memory";
+/**
+ * Loredex's per-user private root folder (`is_root=1`, `visibility='private'`,
+ * owner-only ACL). Every workspace member has exactly one; the server creates
+ * it on join (`ensureUserPrivateRoot`), so it always exists and is never
+ * created by us. Folders created under it inherit `private` visibility, which
+ * is what makes per-user memory scopes actually private — unlike the shared
+ * `_memory/**` tree, where per-user separation is only a folder convention.
+ *
+ * The path segment is caller-relative: the same literal resolves to a
+ * DIFFERENT physical folder per authenticated user. Scope roots under it keep
+ * their `u-<id>` leaf anyway — see `scopeRefOf` for why.
+ */
+export const LOREDEX_PRIVATE_ROOT = "__private_root";
+/**
+ * Loredex's workspace-shared root folder (`is_root=1`, `visibility='shared'`,
+ * unowned). Exactly one per workspace, provisioned by the server, rendered as
+ * "Shared" in the UI — never created by us.
+ *
+ * Shared memory paths MUST anchor here. Loredex resolves bare path heads
+ * caller-relatively (any accessible folder of that name, oldest first), so an
+ * unanchored `_memory/...` can silently resolve to the CALLER'S OWN
+ * `__private_root/_memory` — fragmenting "org" memory into per-user private
+ * copies with no visible error (each user reads their own copy back
+ * consistently). Found live 2026-08-13; anchoring the head is the fix on our
+ * side of the seam.
+ */
+export const LOREDEX_SHARED_ROOT = "__shared_root";
+/**
+ * Boundary-aware containment check for workspace paths: `path` must sit
+ * strictly under `root`, segment-by-segment, with no `.`/`..`/empty segments —
+ * so `root/../elsewhere` can't escape and `${root}-evil/x` can't prefix-match.
+ */
+export function isUnderScopeRoot(root, path) {
+    const rootParts = root.split("/").filter(Boolean);
+    const parts = path.split("/");
+    if (parts.some((p) => p === "" || p === "." || p === ".."))
+        return false;
+    if (parts.length <= rootParts.length)
+        return false;
+    return rootParts.every((p, i) => parts[i] === p);
+}
+/**
+ * Resolve the scope folder for a caller, or undefined when the scope needs a
+ * user but the principal carries none (e.g. an org-only principal hitting a
+ * per-user scope) — memory is simply unavailable for that turn.
+ */
+export function scopeRefOf(args) {
+    const { agent, memory, userId } = args;
+    const needsUser = memory.scope === "agent-user" || memory.scope === "user";
+    if (needsUser && !userId)
+        return undefined;
+    // Per-user scopes are stored under the caller's PRIVATE root so only that
+    // user (and connections acting as them) can read them. The layout mirrors
+    // the shared tree (`<agent>` per agent, the literal `_user` for the
+    // cross-agent scope) so subtrees stay disjoint (hard boundary). The
+    // `u-<id>` leaf is kept even though the private root is already per-user:
+    // it makes the root globally unique (the key stays `${connection}:${root}`)
+    // and, on a workspace-SHARED connection — where every caller resolves the
+    // connection identity's one private root — it keeps users' stores from
+    // merging into a single MEMORY.md.
+    const root = memory.scope === "agent-user"
+        ? `${LOREDEX_PRIVATE_ROOT}/${MEMORY_ROOT_PREFIX}/${seg(agent)}/u-${seg(userId)}`
+        : memory.scope === "agent-org"
+            ? // Anchored at the shared root — an unanchored `_memory/...` head
+                // resolves caller-relatively and can land in the caller's private
+                // tree (see LOREDEX_SHARED_ROOT).
+                `${LOREDEX_SHARED_ROOT}/${MEMORY_ROOT_PREFIX}/${seg(agent)}/org`
+            : `${LOREDEX_PRIVATE_ROOT}/${MEMORY_ROOT_PREFIX}/_user/u-${seg(userId)}`;
+    return { key: `${memory.connection}:${root}`, connection: memory.connection, root };
+}
+/**
+ * The levels this agent's memory participates in: `extractTo` normalized —
+ * deduplicated, primary scope first, and always containing the primary scope
+ * whether or not the stored config lists it. Every multi-level reader
+ * (provider injection/search, sweep extraction) derives its level set here so
+ * a denormalized stored config can't split behavior.
+ */
+export function extractionLevelsOf(memory) {
+    const out = [memory.scope];
+    for (const level of memory.extractTo ?? []) {
+        if (!out.includes(level))
+            out.push(level);
+    }
+    return out;
+}
+/**
+ * The per-level view of a memory config: same connection and tuning, `scope`
+ * swapped to `level` — so `scopeRefOf`/`scopeLabelOf` work per level for free.
+ */
+export function levelConfigOf(memory, level) {
+    return level === memory.scope ? memory : { ...memory, scope: level };
+}
+/** Human-readable scope label for prompts and UI. */
+export function scopeLabelOf(memory) {
+    switch (memory.scope) {
+        case "agent-user":
+            return "this agent's private memory of this user";
+        case "agent-org":
+            return "this agent's shared memory for the whole organization";
+        case "user":
+            return "this user's private memory, shared across their agents";
+    }
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,8EAA8E;AAC9E,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,GAAG,CAAC,GAAW;IACtB,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;SAC/B,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC/C,OAAO,GAAG,OAAO,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAEnD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAI1B;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC;IAC3E,IAAI,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC3C,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,oEAAoE;IACpE,0EAA0E;IAC1E,4EAA4E;IAC5E,0EAA0E;IAC1E,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,IAAI,GACR,MAAM,CAAC,KAAK,KAAK,YAAY;QAC3B,CAAC,CAAC,GAAG,oBAAoB,IAAI,kBAAkB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,MAAO,CAAC,EAAE;QACjF,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW;YAC5B,CAAC,CAAC,iEAAiE;gBACjE,kEAAkE;gBAClE,kCAAkC;gBAClC,GAAG,mBAAmB,IAAI,kBAAkB,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM;YAClE,CAAC,CAAC,GAAG,oBAAoB,IAAI,kBAAkB,YAAY,GAAG,CAAC,MAAO,CAAC,EAAE,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,MAAM,GAAG,GAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoB,EAAE,KAAkB;IACpE,OAAO,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,YAAY,CAAC,MAAoB;IAC/C,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,YAAY;YACf,OAAO,0CAA0C,CAAC;QACpD,KAAK,WAAW;YACd,OAAO,uDAAuD,CAAC;QACjE,KAAK,MAAM;YACT,OAAO,wDAAwD,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/search-evidence.d.ts

@@ -0,0 +1,34 @@
+import type { IndexEntry } from "./index-file.js";
+/**
+ * Match evidence for `memory_search` results: WHY a result matched, so the
+ * agent can judge whether a memory already exists before creating one with
+ * `memory_save`.
+ *
+ * Index entries have no separate "name" field — an entry's `aka:` alias list
+ * IS its set of names — so the spec's name-exact/alias-exact collapse into
+ * one `alias-exact` level. The one-line fact text plays the "description"
+ * role; anything the backend search surfaced without index evidence is
+ * `body`.
+ */
+export type MatchEvidence = "alias-exact" | "description" | "body";
+/** How safe it is to CREATE a new memory for the searched subject. */
+export type CreateSafety = "exists" | "probable" | "unknown";
+/** Strongest-first ranking for strongest-signal-wins merging. */
+export declare const EVIDENCE_RANK: Record<MatchEvidence, number>;
+/** Normalize for matching: NFKC, lowercase, collapsed whitespace. */
+export declare function normalizeForMatch(text: string): string;
+/**
+ * Strongest evidence one ACTIVE index entry offers for `query`, or undefined
+ * when it offers none. Exact (normalized) equality against an alias is the
+ * strongest signal; a substring hit in the entry's fact text is descriptive
+ * evidence. Very short queries (< 3 chars) skip the substring check — they
+ * match everything and prove nothing.
+ */
+export declare function entryEvidence(query: string, entry: Pick<IndexEntry, "aliases" | "text">): Exclude<MatchEvidence, "body"> | undefined;
+/**
+ * Derive the response-level `create_safety` from all result evidence:
+ * an exact alias match proves the memory exists; descriptive evidence makes
+ * it probable; body-only hits (or none at all) prove nothing either way.
+ */
+export declare function createSafetyOf(evidence: readonly MatchEvidence[]): CreateSafety;
+//# sourceMappingURL=search-evidence.d.ts.map

package/dist/search-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-evidence.d.ts","sourceRoot":"","sources":["../src/search-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,aAAa,GAAG,MAAM,CAAC;AAEnE,sEAAsE;AACtE,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7D,iEAAiE;AACjE,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAIvD,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,MAAM,CAAC,GAC1C,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,SAAS,CAM5C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,YAAY,CAI/E"}

package/dist/search-evidence.js

@@ -0,0 +1,40 @@
+/** Strongest-first ranking for strongest-signal-wins merging. */
+export const EVIDENCE_RANK = {
+    "alias-exact": 3,
+    description: 2,
+    body: 1,
+};
+/** Normalize for matching: NFKC, lowercase, collapsed whitespace. */
+export function normalizeForMatch(text) {
+    return text.normalize("NFKC").toLowerCase().replace(/\s+/g, " ").trim();
+}
+/**
+ * Strongest evidence one ACTIVE index entry offers for `query`, or undefined
+ * when it offers none. Exact (normalized) equality against an alias is the
+ * strongest signal; a substring hit in the entry's fact text is descriptive
+ * evidence. Very short queries (< 3 chars) skip the substring check — they
+ * match everything and prove nothing.
+ */
+export function entryEvidence(query, entry) {
+    const q = normalizeForMatch(query);
+    if (!q)
+        return undefined;
+    if (entry.aliases.some((a) => normalizeForMatch(a) === q))
+        return "alias-exact";
+    if (q.length >= 3 && normalizeForMatch(entry.text).includes(q))
+        return "description";
+    return undefined;
+}
+/**
+ * Derive the response-level `create_safety` from all result evidence:
+ * an exact alias match proves the memory exists; descriptive evidence makes
+ * it probable; body-only hits (or none at all) prove nothing either way.
+ */
+export function createSafetyOf(evidence) {
+    if (evidence.includes("alias-exact"))
+        return "exists";
+    if (evidence.includes("description"))
+        return "probable";
+    return "unknown";
+}
+//# sourceMappingURL=search-evidence.js.map