@jungjaehoon/mama-core 2.4.1 → 4.1.0

package/dist/memory/provenance-resolver.d.ts

@@ -0,0 +1,191 @@
+/**
+ * Resolve a claim's support back to the events it came from.
+ *
+ * This is the capability the whole "traceable judgment" idea rests on, and until now it
+ * did not exist in any form the agent could reach. Memory records carried model run,
+ * envelope, gateway call and source refs; recall stripped every one of them, so an agent
+ * could read a memory and then had no way to say which memory a statement rested on. A
+ * handle was added upstream; this turns the handle into an answer.
+ *
+ * Two rules shape everything here.
+ *
+ * POSSESSION IS NOT AUTHORIZATION. Holding a memory id proves only that recall returned
+ * it once, under some scope, at some time. Every event is re-checked against the scope
+ * active NOW, and content is withheld when that check fails. A resolver that trusted the
+ * handle would turn recall into a capability leak: read once, cite forever.
+ *
+ * ABSENCE GETS A REASON. Silence is what made the original problem invisible - a report
+ * asserted things with nothing behind them and looked identical to one that was
+ * grounded. Every failure here names itself, so "I cannot support this" is a statement
+ * the agent can make instead of a gap it cannot see.
+ */
+/** Why a claim, or one of its supports, could not be resolved. */
+export type ResolutionFailure = 
+/** The memory carries no source refs at all. */
+'missing_ref'
+/** Provenance exists but predates scoped writes - nothing to re-check against. */
+ | 'legacy_unscoped'
+/** The referenced event is no longer in the index. */
+ | 'event_deleted'
+/** The event exists but is not visible under the scope active now. */
+ | 'outside_scope'
+/** The ref shape is not one this resolver knows how to dereference. */
+ | 'unsupported_ref'
+/**
+ * The claim records provenance, but none of it points at an observed event.
+ * Measured, not hypothetical: of the source refs stored on this machine, 13,403 are
+ * `memory:`, 1,748 are `envelope:`, 9 are `message:` and ZERO are `raw:`. Folding this
+ * into `unsupported_ref` would have reported a parser limitation where the real answer
+ * is that the claim rests on other claims rather than on anything observed.
+ */
+ | 'no_event_refs'
+/** No memory with that id. */
+ | 'unknown_memory';
+export interface ResolvedEvent {
+    connector: string;
+    eventIndexId: string;
+    sourceId: string;
+    channel: string | null;
+    observedAt: string | null;
+    /** Bounded excerpt. Never the whole record: this answers "where from", not "give me". */
+    excerpt: string;
+}
+/**
+ * One support that could not be dereferenced, and why.
+ *
+ * `kind` exists because the other two fields collapse three different situations into
+ * one shape: an unparseable ref, a withheld observation, and a withheld claim all render
+ * as roughly `{null, reason}`. "A supporting observation was withheld" and "a supporting
+ * claim was withheld" are different statements about grounding, and an agent that cannot
+ * tell them apart cannot make either one.
+ */
+export interface UnresolvedSupport {
+    kind: 'event' | 'memory' | 'message' | 'unknown';
+    /** Present only for events. A memory id is withheld deliberately - see below. */
+    eventIndexId: string | null;
+    reason: ResolutionFailure;
+}
+/**
+ * Provenance that was recorded but does not point at an observed event: the memory a
+ * claim was built from, the envelope that authorized the write, the message that
+ * prompted it. Reported rather than discarded - "this rests on three earlier memories
+ * and no observation" is a true and useful answer, and it is the answer for almost
+ * every memory that exists today.
+ */
+export interface RecordedSupport {
+    kind: 'memory' | 'envelope' | 'message';
+    id: string;
+}
+/** A source ref or canonical graph link that can name an observed event. */
+export type ParsedSourceRef = {
+    kind: 'raw';
+    connector: string;
+    eventIndexId: string;
+} | {
+    kind: 'observation';
+    observationId: string;
+} | RecordedSupport | {
+    kind: 'unsupported';
+};
+export interface ProvenanceResolution {
+    memoryId: string;
+    /**
+     * The stored record's own status, and whether the system has retired it.
+     *
+     * Carried because every read path filters these out and this one did not: 65% of the
+     * live corpus is `superseded`, and without this the tool would report `resolved` for a
+     * retired claim in output identical to a current one. Grounding a statement in a record
+     * the system has explicitly replaced, confidently and invisibly, is the failure this
+     * whole tool exists to prevent.
+     */
+    memoryStatus: string | null;
+    retired: boolean;
+    /**
+     * `resolved` - every support dereferenced and visible.
+     * `partial`  - at least one resolved, at least one not.
+     * `unresolved` - nothing could be shown, and `reason` says why.
+     */
+    status: 'resolved' | 'partial' | 'unresolved';
+    modelRunId: string | null;
+    contextPacketId: string | null;
+    events: ResolvedEvent[];
+    unresolved: UnresolvedSupport[];
+    /** Recorded provenance that is not an observed event. Never a failure. */
+    supports: RecordedSupport[];
+    /** Present only when nothing resolved, so a caller never has to infer the cause. */
+    reason?: ResolutionFailure;
+}
+/** A memory's recorded provenance, reduced to what resolution needs. */
+export interface ProvenanceSubjectRecord {
+    /** Raw status column, e.g. `active`, `superseded`. */
+    status?: string | null;
+    /** True when the reader's status filter, or a supersede link, would exclude it. */
+    retired?: boolean;
+    modelRunId: string | null;
+    contextPacketId: string | null;
+    /** Canonical source refs; empty when the write was not evidence-backed. */
+    sourceRefs: ReadonlyArray<ParsedSourceRef>;
+    /** True when the record predates scoped provenance and cannot be re-checked. */
+    legacyUnscoped?: boolean;
+}
+export interface IndexedEvent {
+    connector: string;
+    eventIndexId: string;
+    sourceId: string;
+    channel: string | null;
+    observedAt: string | null;
+    /** Source/event occurrence time, separate from host capture time. */
+    sourceAt?: string | null;
+    content: string;
+    /**
+     * The scope recorded on the event, or null when it was indexed before scoped
+     * indexing existed. Carried on the event so visibility is a pure function of it -
+     * a caller cannot re-check what it was not given.
+     */
+    memoryScope?: {
+        kind: string;
+        id: string;
+    } | null;
+    /** Project and tenant the event was indexed under; null when it carries neither. */
+    projectId?: string | null;
+    tenantId?: string | null;
+}
+export interface ProvenanceResolverDeps {
+    lookupMemoryProvenance(memoryId: string): ProvenanceSubjectRecord | null;
+    lookupEvent(connector: string, eventIndexId: string): IndexedEvent | null;
+    /** Resolve an exact canonical observation edge without trusting a claimed connector. */
+    lookupObservation?(observationId: string): IndexedEvent | null;
+    /**
+     * Whether this event is visible under the scope active NOW - not the scope that was
+     * active when the memory was written. This is the check that keeps a handle from
+     * becoming a standing capability.
+     */
+    isVisible(event: IndexedEvent): boolean;
+    /**
+     * Whether a recorded support may be named under the authority active now.
+     *
+     * Applies to every non-event support, not just memories. The first version checked
+     * nothing here and the second checked only `memory:`, which left `message:` refs -
+     * built as `source:channelId:turnId` - handing a channel identifier to any caller that
+     * could read the memory. Naming a support is disclosure whatever its kind.
+     *
+     * Optional so the pure module stays usable without a store; when absent, supports are
+     * withheld rather than assumed visible. A check that fails open is not a check.
+     */
+    isSupportVisible?(support: RecordedSupport): boolean;
+    /**
+     * Redaction applied to an excerpt before it leaves. Recall runs its text through a
+     * pattern list (URLs, emails, tokens, key shapes, raw refs); an excerpt path that
+     * skipped it would send connector content out through a surface whose sibling scrubs
+     * it. Optional, and identity when absent - the pure module holds no pattern list.
+     */
+    redact?(text: string): string;
+    /** Excerpt bound in characters. */
+    excerptChars?: number;
+}
+/**
+ * Resolve one memory's support. Never throws for missing or invisible evidence - those
+ * are answers, not errors, and an agent needs to be able to report them.
+ */
+export declare function resolveMemoryProvenance(memoryId: string, deps: ProvenanceResolverDeps): ProvenanceResolution;
+//# sourceMappingURL=provenance-resolver.d.ts.map

package/dist/memory/provenance-resolver.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Resolve a claim's support back to the events it came from.
+ *
+ * This is the capability the whole "traceable judgment" idea rests on, and until now it
+ * did not exist in any form the agent could reach. Memory records carried model run,
+ * envelope, gateway call and source refs; recall stripped every one of them, so an agent
+ * could read a memory and then had no way to say which memory a statement rested on. A
+ * handle was added upstream; this turns the handle into an answer.
+ *
+ * Two rules shape everything here.
+ *
+ * POSSESSION IS NOT AUTHORIZATION. Holding a memory id proves only that recall returned
+ * it once, under some scope, at some time. Every event is re-checked against the scope
+ * active NOW, and content is withheld when that check fails. A resolver that trusted the
+ * handle would turn recall into a capability leak: read once, cite forever.
+ *
+ * ABSENCE GETS A REASON. Silence is what made the original problem invisible - a report
+ * asserted things with nothing behind them and looked identical to one that was
+ * grounded. Every failure here names itself, so "I cannot support this" is a statement
+ * the agent can make instead of a gap it cannot see.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveMemoryProvenance = resolveMemoryProvenance;
+const DEFAULT_EXCERPT_CHARS = 280;
+function excerptOf(content, limit) {
+    const collapsed = content.replace(/\s+/g, ' ').trim();
+    return collapsed.length <= limit ? collapsed : `${collapsed.slice(0, limit)}…`;
+}
+/**
+ * Resolve one memory's support. Never throws for missing or invisible evidence - those
+ * are answers, not errors, and an agent needs to be able to report them.
+ */
+function resolveMemoryProvenance(memoryId, deps) {
+    const limit = deps.excerptChars ?? DEFAULT_EXCERPT_CHARS;
+    const record = deps.lookupMemoryProvenance(memoryId);
+    if (!record) {
+        return {
+            memoryId,
+            status: 'unresolved',
+            modelRunId: null,
+            contextPacketId: null,
+            events: [],
+            unresolved: [],
+            supports: [],
+            memoryStatus: null,
+            retired: false,
+            reason: 'unknown_memory',
+        };
+    }
+    const base = {
+        memoryId,
+        modelRunId: record.modelRunId,
+        contextPacketId: record.contextPacketId,
+        memoryStatus: record.status ?? null,
+        retired: record.retired ?? false,
+    };
+    if (record.legacyUnscoped) {
+        return {
+            ...base,
+            status: 'unresolved',
+            events: [],
+            unresolved: [],
+            supports: [],
+            reason: 'legacy_unscoped',
+        };
+    }
+    if (record.sourceRefs.length === 0) {
+        // A durable claim with no evidence behind it. Accepted at write time on purpose -
+        // requiring a compiled packet before an agent may record an observation would gate
+        // judgment on paperwork - but it must be visible here rather than look like support.
+        return {
+            ...base,
+            status: 'unresolved',
+            events: [],
+            unresolved: [],
+            supports: [],
+            reason: 'missing_ref',
+        };
+    }
+    const events = [];
+    const unresolved = [];
+    const supports = [];
+    let eventRefCount = 0;
+    for (const ref of record.sourceRefs) {
+        // Recorded provenance that is not an observation. Kept out of `unresolved` on
+        // purpose: counting it as a failure would put a permanent entry at the front of the
+        // failure list, which then decides the reported reason for every memory and buries
+        // the ones that actually explain something.
+        if (ref.kind !== 'raw' && ref.kind !== 'observation') {
+            if (ref.kind === 'unsupported') {
+                unresolved.push({ kind: 'unknown', eventIndexId: null, reason: 'unsupported_ref' });
+            }
+            else if (!(deps.isSupportVisible?.(ref) ?? false)) {
+                // Named as absent, with the id withheld. Disclosing it would confirm that a
+                // specific memory exists just outside the caller's scope - the thing the
+                // top-level `unknown_memory` answer is careful not to do - or hand over the
+                // channel identifier buried in a message ref.
+                unresolved.push({
+                    kind: ref.kind === 'memory' ? 'memory' : 'message',
+                    eventIndexId: null,
+                    reason: 'outside_scope',
+                });
+            }
+            else {
+                supports.push({ kind: ref.kind, id: ref.id });
+            }
+            continue;
+        }
+        eventRefCount += 1;
+        const eventIndexId = ref.kind === 'observation' ? ref.observationId : ref.eventIndexId;
+        const event = ref.kind === 'observation'
+            ? (deps.lookupObservation?.(ref.observationId) ?? null)
+            : deps.lookupEvent(ref.connector, ref.eventIndexId);
+        if (!event) {
+            unresolved.push({ kind: 'event', eventIndexId, reason: 'event_deleted' });
+            continue;
+        }
+        if (!deps.isVisible(event)) {
+            // Named, but nothing about it disclosed - not the channel, not a word of content.
+            unresolved.push({ kind: 'event', eventIndexId, reason: 'outside_scope' });
+            continue;
+        }
+        events.push({
+            connector: event.connector,
+            eventIndexId: event.eventIndexId,
+            sourceId: event.sourceId,
+            channel: event.channel,
+            observedAt: event.observedAt,
+            excerpt: excerptOf(deps.redact ? deps.redact(event.content) : event.content, limit),
+        });
+    }
+    if (events.length === 0) {
+        return {
+            ...base,
+            status: 'unresolved',
+            events,
+            unresolved,
+            supports,
+            // A claim whose provenance points only at other claims is a different fact from a
+            // claim whose evidence went missing, and the agent needs to be able to say which.
+            reason: eventRefCount === 0 && unresolved.length === 0
+                ? 'no_event_refs'
+                : (unresolved[0]?.reason ?? 'missing_ref'),
+        };
+    }
+    return {
+        ...base,
+        status: unresolved.length === 0 ? 'resolved' : 'partial',
+        events,
+        unresolved,
+        supports,
+    };
+}
+//# sourceMappingURL=provenance-resolver.js.map

package/dist/memory/provenance.d.ts

@@ -1,11 +1,4 @@
 import type { MemoryEventRecord, MemoryWriteProvenance, PublicIngestConversationInput, PublicIngestMemoryInput, PublicSaveMemoryInput } from './types.js';
-export interface TrustedProvenanceCapability {
-    readonly __trustedProvenanceCapability: 'mama-core';
-}
-export interface TrustedMemoryWriteOptions {
-    provenance: MemoryWriteProvenance;
-    capability: TrustedProvenanceCapability;
-}
 export interface NormalizedMemoryProvenance {
     actor: MemoryEventRecord['actor'];
     agent_id: string | null;
@@ -18,12 +11,9 @@ export interface NormalizedMemoryProvenance {
     source_refs: string[];
     provenance: Record<string, unknown>;
 }
-export declare function createTrustedProvenanceCapability(): TrustedProvenanceCapability;
-export declare function assertTrustedProvenanceCapability(capability: TrustedProvenanceCapability | undefined): asserts capability is TrustedProvenanceCapability;
 export declare function stripCallerProvenance<T extends Record<string, unknown>>(input: T): T;
 export declare function sanitizePublicSaveMemoryInput(input: PublicSaveMemoryInput): PublicSaveMemoryInput;
 export declare function sanitizePublicIngestMemoryInput(input: PublicIngestMemoryInput): PublicIngestMemoryInput;
 export declare function sanitizePublicIngestConversationInput(input: PublicIngestConversationInput): PublicIngestConversationInput;
-export declare function normalizeMemoryWriteProvenance(options?: TrustedMemoryWriteOptions): NormalizedMemoryProvenance;
-export declare function appendProvenanceSourceRefs(options: TrustedMemoryWriteOptions | undefined, refs: string[]): TrustedMemoryWriteOptions | undefined;
+export declare function normalizeMemoryWriteProvenance(provenance?: MemoryWriteProvenance): NormalizedMemoryProvenance;
 //# sourceMappingURL=provenance.d.ts.map

package/dist/memory/provenance.js

@@ -1,14 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTrustedProvenanceCapability = createTrustedProvenanceCapability;
-exports.assertTrustedProvenanceCapability = assertTrustedProvenanceCapability;
 exports.stripCallerProvenance = stripCallerProvenance;
 exports.sanitizePublicSaveMemoryInput = sanitizePublicSaveMemoryInput;
 exports.sanitizePublicIngestMemoryInput = sanitizePublicIngestMemoryInput;
 exports.sanitizePublicIngestConversationInput = sanitizePublicIngestConversationInput;
 exports.normalizeMemoryWriteProvenance = normalizeMemoryWriteProvenance;
-exports.appendProvenanceSourceRefs = appendProvenanceSourceRefs;
-const issuedCapabilities = new WeakSet();
 const ALLOWED_PROVENANCE_FIELDS = new Set([
     'actor',
     'agent_id',
@@ -21,18 +17,6 @@ const ALLOWED_PROVENANCE_FIELDS = new Set([
     'source_message_ref',
     'source_refs',
 ]);
-function createTrustedProvenanceCapability() {
-    const capability = Object.freeze({
-        __trustedProvenanceCapability: 'mama-core',
-    });
-    issuedCapabilities.add(capability);
-    return capability;
-}
-function assertTrustedProvenanceCapability(capability) {
-    if (!capability || typeof capability !== 'object' || !issuedCapabilities.has(capability)) {
-        throw new Error('Invalid trusted provenance capability');
-    }
-}
 function stripCallerProvenance(input) {
     if (!Object.prototype.hasOwnProperty.call(input, 'provenance')) {
         return input;
@@ -49,12 +33,10 @@ function sanitizePublicIngestMemoryInput(input) {
 function sanitizePublicIngestConversationInput(input) {
     return stripCallerProvenance(input);
 }
-function normalizeMemoryWriteProvenance(options) {
-    if (!options) {
+function normalizeMemoryWriteProvenance(provenance) {
+    if (!provenance) {
         return buildFallbackProvenance();
     }
-    assertTrustedProvenanceCapability(options.capability);
-    const provenance = options.provenance ?? {};
     const actor = provenance.actor ?? 'main_agent';
     const sourceRefs = normalizeStringArray(provenance.source_refs);
     const compact = {
@@ -85,19 +67,6 @@ function normalizeMemoryWriteProvenance(options) {
         provenance: compact,
     };
 }
-function appendProvenanceSourceRefs(options, refs) {
-    if (!options) {
-        return undefined;
-    }
-    assertTrustedProvenanceCapability(options.capability);
-    return {
-        capability: options.capability,
-        provenance: {
-            ...options.provenance,
-            source_refs: [...(options.provenance.source_refs ?? []), ...refs],
-        },
-    };
-}
 function buildFallbackProvenance() {
     const actor = 'actor:direct_client';
     return {

package/dist/memory/recall-sanitize.d.ts

@@ -0,0 +1,55 @@
+export declare function sanitizeRecallText(value: string | undefined): string | undefined;
+/**
+ * The shape a recall answers in.
+ *
+ * memory.read:topic returned recallMemory's records verbatim; the scrub and this
+ * narrowing lived in a host tool case that wrapped the action, so a caller
+ * naming the action got unredacted full records. Provenance already scrubbed its
+ * excerpts - topic simply did not - and the two read surfaces have to answer the
+ * same way.
+ */
+export interface SafeRecallMemory {
+    /**
+     * Handle for the recalled record.
+     *
+     * Without this the agent receives prose it cannot point at: it can read a
+     * memory and then has no way to say WHICH memory a statement rests on, so a
+     * claim can never be traced back to its evidence and a correction has no
+     * address. The id is an opaque identifier, not content, so returning it
+     * discloses nothing the summary does not.
+     */
+    memoryId?: string;
+    topic?: string;
+    kind?: string;
+    summary?: string;
+    confidence?: number;
+    status?: string;
+    /**
+     * SUCCESS / FAILED / PARTIAL, or null.
+     *
+     * Not free text, so it discloses nothing the summary does not - and a reader
+     * that cannot see it presents a failed decision as if it still held. The
+     * projection was tuned to one consumer before it became the action's answer
+     * for all of them, and dropping this is what that cost.
+     */
+    outcome?: string;
+}
+export interface SafeRecallProfileEvidence {
+    topic?: string;
+}
+export interface SafeRecallBundle {
+    profile: {
+        static: SafeRecallMemory[];
+        dynamic: SafeRecallMemory[];
+        evidence: SafeRecallProfileEvidence[];
+    };
+    memories: SafeRecallMemory[];
+    graph_context: {
+        primary: SafeRecallMemory[];
+        expanded: SafeRecallMemory[];
+        edge_count: number;
+    };
+}
+/** Scrub a recall bundle and narrow it to the fields a read may answer with. */
+export declare function sanitizeRecallBundle(bundle: unknown): SafeRecallBundle;
+//# sourceMappingURL=recall-sanitize.d.ts.map

package/dist/memory/recall-sanitize.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeRecallText = sanitizeRecallText;
+exports.sanitizeRecallBundle = sanitizeRecallBundle;
+/**
+ * Recall-surface text redaction, owned by the core so every read surface scrubs
+ * the same way. The provenance action passes this as its `redact` - a caller
+ * never supplies the scrub, because a citation that lets the caller choose the
+ * redaction would let them choose none.
+ */
+const RECALL_TEXT_REDACTION_PATTERNS = [
+    /MAMA_SYNTHETIC_[A-Z0-9_]+_DO_NOT_LEAK/g,
+    /synthetic:\/\/raw[^\s"']*/g,
+    /raw:[^\s"']*/g,
+    /\bhttps?:\/\/[^\s"'<>()]+/gi,
+    /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,
+    /\b(?:Bearer|Token|Authorization)\s*[:=]?\s*[A-Za-z0-9._~+/=-]{8,}/gi,
+    /\b(?:api[_-]?key|token|secret|password)\s*[:=]\s*[^\s"']{8,}/gi,
+    /(?:ghp|gho|ghu|ghs|ghr|github_pat)_[A-Za-z0-9_]{8,}\b/g,
+    /xox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+    /sk-[A-Za-z0-9_-]{20,}\b/g,
+    /\b[CU][A-Z0-9]{8,}\b/g,
+    /\b[0-9]{17,20}\b/g,
+    /(?:\/Users|\/home|\/tmp)\/[^\s"']*/g,
+    /[A-Za-z]:\\Users\\[^\s"']*/g,
+];
+const MAX_RECALL_TEXT_LENGTH = 280;
+const RECALL_TEXT_REDACTION_SCAN_LIMIT = MAX_RECALL_TEXT_LENGTH + 2048;
+function sanitizeRecallText(value) {
+    if (!value) {
+        return undefined;
+    }
+    let sanitized = value.length > RECALL_TEXT_REDACTION_SCAN_LIMIT
+        ? value.slice(0, RECALL_TEXT_REDACTION_SCAN_LIMIT)
+        : value;
+    for (const pattern of RECALL_TEXT_REDACTION_PATTERNS) {
+        sanitized = sanitized.replace(pattern, '[redacted]');
+    }
+    const wasTruncated = value.length > MAX_RECALL_TEXT_LENGTH || sanitized.length > MAX_RECALL_TEXT_LENGTH;
+    if (sanitized.length > MAX_RECALL_TEXT_LENGTH) {
+        sanitized = sanitized.slice(0, MAX_RECALL_TEXT_LENGTH);
+    }
+    if (wasTruncated) {
+        sanitized = `${sanitized} [truncated]`;
+    }
+    return sanitized;
+}
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringField(record, field) {
+    const value = record[field];
+    return typeof value === 'string' ? value : undefined;
+}
+function numberField(record, field) {
+    const value = record[field];
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function sanitizeRecallMemory(value) {
+    const record = asRecord(value);
+    if (!record) {
+        return null;
+    }
+    const safe = {};
+    const memoryId = stringField(record, 'id');
+    if (memoryId) {
+        safe.memoryId = memoryId;
+    }
+    const topic = sanitizeRecallText(stringField(record, 'topic'));
+    const kind = sanitizeRecallText(stringField(record, 'kind'));
+    const summary = sanitizeRecallText(stringField(record, 'summary'));
+    const status = sanitizeRecallText(stringField(record, 'status'));
+    const outcome = sanitizeRecallText(stringField(record, 'outcome'));
+    const confidence = numberField(record, 'confidence');
+    if (topic) {
+        safe.topic = topic;
+    }
+    if (kind) {
+        safe.kind = kind;
+    }
+    if (summary) {
+        safe.summary = summary;
+    }
+    if (status) {
+        safe.status = status;
+    }
+    if (outcome) {
+        safe.outcome = outcome;
+    }
+    if (confidence !== undefined) {
+        safe.confidence = confidence;
+    }
+    return Object.keys(safe).length > 0 ? safe : null;
+}
+function sanitizeRecallMemories(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .map((memory) => sanitizeRecallMemory(memory))
+        .filter((memory) => memory !== null);
+}
+function sanitizeProfileEvidence(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .map((item) => {
+        const record = asRecord(item);
+        if (!record) {
+            return null;
+        }
+        const evidence = {};
+        const topic = sanitizeRecallText(stringField(record, 'topic'));
+        if (topic) {
+            evidence.topic = topic;
+        }
+        return Object.keys(evidence).length > 0 ? evidence : null;
+    })
+        .filter((evidence) => evidence !== null);
+}
+/** Scrub a recall bundle and narrow it to the fields a read may answer with. */
+function sanitizeRecallBundle(bundle) {
+    const record = asRecord(bundle) ?? {};
+    const profile = asRecord(record.profile) ?? {};
+    const graphContext = asRecord(record.graph_context) ?? {};
+    const edges = Array.isArray(graphContext.edges) ? graphContext.edges : [];
+    return {
+        profile: {
+            static: sanitizeRecallMemories(profile.static),
+            dynamic: sanitizeRecallMemories(profile.dynamic),
+            evidence: sanitizeProfileEvidence(profile.evidence),
+        },
+        memories: sanitizeRecallMemories(record.memories),
+        graph_context: {
+            primary: sanitizeRecallMemories(graphContext.primary),
+            expanded: sanitizeRecallMemories(graphContext.expanded),
+            edge_count: edges.length,
+        },
+    };
+}
+//# sourceMappingURL=recall-sanitize.js.map

package/dist/memory/secret-filter.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Secret-pattern filter for recallable writes.
+ *
+ * The one real leak path a chat-reachable caller has is memory: a secret saved
+ * as a "decision" resurfaces later through search or recall. This filter
+ * refuses the write at the choke point, which is the action contract — every
+ * write that recall can return passes through here. Minimal gitleaks-style
+ * set: shapes, not entropy heuristics, so false positives stay near zero.
+ *
+ * It lives in core because the contract does. The patterns name provider key
+ * shapes and prompt-injection phrasing; nothing here knows a product.
+ */
+export interface SecretScanResult {
+    clean: boolean;
+    matches: string[];
+    warnings: string[];
+}
+export declare class SecretMaterialRefusedError extends Error {
+    constructor(matches: readonly string[]);
+}
+/** Scan text for secret-shaped material. */
+export declare function scanForSecrets(text: string): SecretScanResult;
+/**
+ * Scan every string reachable in a memory-write input (nested objects and
+ * arrays included, container-depth-capped): open_files arrays, scope ids, and source
+ * objects are persisted too and must not smuggle secrets past a top-level
+ * scan (review m1).
+ */
+export declare function scanMemoryWriteInput(input: Record<string, unknown>): SecretScanResult;
+/** Mask the same credential shapes in observations without treating hashes as tokens. */
+export declare function redactSecretPatterns(text: string): string;
+//# sourceMappingURL=secret-filter.d.ts.map