@lore-co/cli 0.1.16 → 0.1.18

package/dist/signed-snapshot.js

@@ -0,0 +1,303 @@
+import { createPublicKey, verify } from "node:crypto";
+import { MAX_COMPACT_JWS_BYTES, createCanonicalJsonSha256, } from "@lore-co/core/canonical-json";
+export const SIGNED_SNAPSHOT_CONTRACT_VERSION = "reliability-v1";
+export const DEFAULT_MAX_COMPACT_JWS_BYTES = MAX_COMPACT_JWS_BYTES;
+const MAX_PROTECTED_HEADER_BYTES = 4_096;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/u;
+export class SignedSnapshotError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "SignedSnapshotError";
+        this.code = code;
+    }
+}
+function snapshotError(code, message) {
+    return new SignedSnapshotError(code, message);
+}
+function plainObject(value) {
+    if (typeof value !== "object" ||
+        value === null ||
+        Array.isArray(value) ||
+        (Object.getPrototypeOf(value) !== Object.prototype &&
+            Object.getPrototypeOf(value) !== null)) {
+        throw snapshotError("INVALID_ENVELOPE", "JWS value must be an object");
+    }
+    return value;
+}
+function decodeBase64url(segment, maxBytes, label) {
+    if (segment === "" ||
+        segment.includes("=") ||
+        !BASE64URL_PATTERN.test(segment)) {
+        throw snapshotError("MALFORMED_JWS", `${label} is not canonical base64url`);
+    }
+    const decoded = Buffer.from(segment, "base64url");
+    if (decoded.byteLength > maxBytes ||
+        decoded.toString("base64url") !== segment) {
+        throw snapshotError(decoded.byteLength > maxBytes ? "TOO_LARGE" : "MALFORMED_JWS", `${label} is invalid`);
+    }
+    return decoded;
+}
+function parseJson(buffer, label) {
+    try {
+        return JSON.parse(buffer.toString("utf8"));
+    }
+    catch {
+        throw snapshotError("MALFORMED_JWS", `${label} is not valid JSON`);
+    }
+}
+function parseProtectedHeader(value) {
+    const header = plainObject(value);
+    const fields = Object.keys(header);
+    if (fields.some((field) => !["alg", "kid", "typ"].includes(field))) {
+        throw snapshotError("UNSUPPORTED_HEADER", "JWS protected header contains unsupported fields");
+    }
+    if (header.alg !== "EdDSA" ||
+        typeof header.kid !== "string" ||
+        header.kid.trim() === "" ||
+        Array.from(header.kid).length > 200 ||
+        (header.typ !== undefined &&
+            (typeof header.typ !== "string" ||
+                header.typ.trim() === "" ||
+                Array.from(header.typ).length > 100))) {
+        throw snapshotError("UNSUPPORTED_HEADER", "JWS must use EdDSA and a bounded key ID");
+    }
+    return {
+        alg: "EdDSA",
+        kid: header.kid,
+        ...(typeof header.typ === "string" ? { typ: header.typ } : {}),
+    };
+}
+export function parseCompactJws(compactJws, maxBytes = DEFAULT_MAX_COMPACT_JWS_BYTES) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw snapshotError("TOO_LARGE", "maxBytes must be a positive integer");
+    }
+    if (typeof compactJws !== "string" ||
+        Buffer.byteLength(compactJws) > maxBytes) {
+        throw snapshotError("TOO_LARGE", `Compact JWS exceeds ${maxBytes} bytes`);
+    }
+    if (!/^[\x21-\x7e]+$/u.test(compactJws)) {
+        throw snapshotError("MALFORMED_JWS", "Compact JWS must be ASCII");
+    }
+    const segments = compactJws.split(".");
+    if (segments.length !== 3) {
+        throw snapshotError("MALFORMED_JWS", "Compact JWS must contain three segments");
+    }
+    const protectedSegment = segments[0];
+    const payloadSegment = segments[1];
+    const signatureSegment = segments[2];
+    if (protectedSegment === undefined ||
+        payloadSegment === undefined ||
+        signatureSegment === undefined) {
+        throw snapshotError("MALFORMED_JWS", "Compact JWS is incomplete");
+    }
+    const protectedHeader = parseProtectedHeader(parseJson(decodeBase64url(protectedSegment, MAX_PROTECTED_HEADER_BYTES, "Protected header"), "Protected header"));
+    const payload = parseJson(decodeBase64url(payloadSegment, maxBytes, "Payload"), "Payload");
+    const signature = decodeBase64url(signatureSegment, 64, "Signature");
+    if (signature.byteLength !== 64) {
+        throw snapshotError("MALFORMED_JWS", "Ed25519 signatures must contain 64 bytes");
+    }
+    return {
+        protectedHeader,
+        payload,
+        signingInput: `${protectedSegment}.${payloadSegment}`,
+        signature,
+    };
+}
+function canonicalPublicKey(value) {
+    const record = value;
+    if (record.kty !== "OKP" ||
+        record.crv !== "Ed25519" ||
+        typeof record.kid !== "string" ||
+        record.kid.trim() === "" ||
+        typeof record.x !== "string" ||
+        record.x.includes("=") ||
+        !BASE64URL_PATTERN.test(record.x) ||
+        Buffer.from(record.x, "base64url").byteLength !== 32 ||
+        Buffer.from(record.x, "base64url").toString("base64url") !== record.x ||
+        (record.alg !== undefined && record.alg !== "EdDSA") ||
+        (record.use !== undefined && record.use !== "sig") ||
+        "d" in record) {
+        throw snapshotError("UNTRUSTED_KEY", "Pinned key is not public Ed25519");
+    }
+    return value;
+}
+function resolvePinnedKey(keys, workspaceId, kid) {
+    const keySet = "workspaceId" in keys
+        ? keys
+        : {
+            workspaceId,
+            keys: keys.filter((key) => key.workspaceId === undefined ||
+                key.workspaceId === workspaceId),
+        };
+    if (keySet.workspaceId !== workspaceId) {
+        throw snapshotError("WORKSPACE_MISMATCH", "Pinned key set belongs to another workspace");
+    }
+    const matches = keySet.keys.filter((key) => key.kid === kid);
+    if (matches.length !== 1) {
+        throw snapshotError("UNTRUSTED_KEY", "JWS key ID is not uniquely pinned for this workspace");
+    }
+    const key = matches[0];
+    if (key === undefined) {
+        throw snapshotError("UNTRUSTED_KEY", "JWS key is not pinned");
+    }
+    if (key.workspaceId !== undefined && key.workspaceId !== workspaceId) {
+        throw snapshotError("WORKSPACE_MISMATCH", "Pinned key belongs to another workspace");
+    }
+    return canonicalPublicKey(key);
+}
+function strictIso(value, field) {
+    if (typeof value !== "string" ||
+        !Number.isFinite(Date.parse(value)) ||
+        new Date(value).toISOString() !== value) {
+        throw snapshotError("INVALID_ENVELOPE", `${field} must be a canonical ISO timestamp`);
+    }
+    return value;
+}
+function validateKindPayload(payload, asOf) {
+    if (payload.kind === "context") {
+        const request = typeof payload.request === "object" &&
+            payload.request !== null &&
+            !Array.isArray(payload.request)
+            ? payload.request
+            : null;
+        let requestHash = "";
+        if (request !== null) {
+            try {
+                requestHash = createCanonicalJsonSha256(request);
+            }
+            catch {
+                throw snapshotError("INVALID_ENVELOPE", "Context snapshot request is not bounded JSON");
+            }
+        }
+        if (payload.snapshotVersion !== "context-snapshot-v1" ||
+            typeof payload.requestId !== "string" ||
+            payload.requestId.trim() === "" ||
+            Array.from(payload.requestId).length > 128 ||
+            typeof payload.requestHash !== "string" ||
+            !/^[a-f0-9]{64}$/u.test(payload.requestHash) ||
+            payload.requestHash !== requestHash ||
+            request === null ||
+            typeof payload.eventId !== "string" ||
+            typeof payload.receiptId !== "string" ||
+            strictIso(payload.deliveredAt, "deliveredAt") !== asOf ||
+            typeof payload.context !== "string" ||
+            !Array.isArray(payload.memories) ||
+            !Array.isArray(payload.hits) ||
+            typeof payload.packing !== "object" ||
+            payload.packing === null ||
+            Array.isArray(payload.packing)) {
+            throw snapshotError("INVALID_ENVELOPE", "Context snapshot payload is incomplete or inconsistent");
+        }
+        return;
+    }
+    if (payload.snapshotVersion !== "guard-policy-snapshot-v1" ||
+        !["off", "assist", "enforce"].includes(String(payload.mode)) ||
+        !Array.isArray(payload.overrides) ||
+        !Array.isArray(payload.requiredRules)) {
+        throw snapshotError("INVALID_ENVELOPE", "Guard policy snapshot payload is incomplete");
+    }
+}
+function validateEnvelope(value, options) {
+    const payload = plainObject(value);
+    if (payload.contractVersion !== SIGNED_SNAPSHOT_CONTRACT_VERSION) {
+        throw snapshotError("INVALID_ENVELOPE", "Snapshot contract version is unsupported");
+    }
+    if (payload.workspaceId !== options.workspaceId) {
+        throw snapshotError("WORKSPACE_MISMATCH", "Snapshot belongs to another workspace");
+    }
+    if (payload.kind !== "context" && payload.kind !== "guard_policy") {
+        throw snapshotError("INVALID_ENVELOPE", "Snapshot kind is invalid");
+    }
+    if (payload.kind !== options.kind) {
+        throw snapshotError("KIND_MISMATCH", `Expected a ${options.kind} snapshot`);
+    }
+    if (typeof payload.policyVersion !== "string" ||
+        payload.policyVersion.trim() === "" ||
+        Array.from(payload.policyVersion).length > 200) {
+        throw snapshotError("INVALID_ENVELOPE", "Snapshot policyVersion is invalid");
+    }
+    const issuedAt = strictIso(payload.issuedAt, "issuedAt");
+    const asOf = strictIso(payload.asOf, "asOf");
+    const validUntil = strictIso(payload.validUntil, "validUntil");
+    const issuedAtMs = Date.parse(issuedAt);
+    const asOfMs = Date.parse(asOf);
+    const validUntilMs = Date.parse(validUntil);
+    if (validUntilMs <= asOfMs ||
+        (payload.kind === "guard_policy" && validUntilMs <= issuedAtMs)) {
+        throw snapshotError("INVALID_ENVELOPE", "Snapshot validity is inconsistent with its kind and source time");
+    }
+    const now = options.now ?? new Date();
+    if (!Number.isFinite(now.getTime())) {
+        throw snapshotError("INVALID_ENVELOPE", "Verification time is invalid");
+    }
+    const tolerance = options.clockToleranceMs ?? 5 * 60_000;
+    if (!Number.isSafeInteger(tolerance) || tolerance < 0) {
+        throw snapshotError("INVALID_ENVELOPE", "clockToleranceMs must be a non-negative integer");
+    }
+    if (asOfMs > issuedAtMs) {
+        throw snapshotError("INVALID_ENVELOPE", "Snapshot source time cannot be after issuance");
+    }
+    if (issuedAtMs > now.getTime() + tolerance) {
+        throw snapshotError("NOT_YET_VALID", "Snapshot is not yet valid");
+    }
+    if (validUntilMs <= now.getTime() && options.allowExpired !== true) {
+        throw snapshotError("EXPIRED", "Snapshot has expired");
+    }
+    validateKindPayload(payload, asOf);
+    return payload;
+}
+export function verifySignedSnapshot(compactJws, options) {
+    const workspaceId = options.workspaceId.trim();
+    if (workspaceId === "") {
+        throw snapshotError("INVALID_ENVELOPE", "workspaceId must not be empty");
+    }
+    const parsed = parseCompactJws(compactJws, options.maxBytes ?? DEFAULT_MAX_COMPACT_JWS_BYTES);
+    const pinned = resolvePinnedKey(options.keys, workspaceId, parsed.protectedHeader.kid);
+    let publicKey;
+    try {
+        publicKey = createPublicKey({
+            key: {
+                kty: "OKP",
+                crv: "Ed25519",
+                x: pinned.x,
+            },
+            format: "jwk",
+        });
+    }
+    catch {
+        throw snapshotError("UNTRUSTED_KEY", "Pinned public key is invalid");
+    }
+    if (!verify(null, Buffer.from(parsed.signingInput, "ascii"), publicKey, parsed.signature)) {
+        throw snapshotError("INVALID_SIGNATURE", "Snapshot signature is invalid");
+    }
+    const payload = validateEnvelope(parsed.payload, {
+        ...options,
+        workspaceId,
+    });
+    const expectedType = payload.kind === "context"
+        ? "lore-context-snapshot+jws"
+        : "lore-guard-policy-snapshot+jws";
+    if (parsed.protectedHeader.typ !== expectedType) {
+        throw snapshotError("KIND_MISMATCH", "Snapshot protected type does not match its payload");
+    }
+    const issuedAtMs = Date.parse(payload.issuedAt);
+    if (pinned.notBefore !== undefined) {
+        const notBefore = strictIso(pinned.notBefore, "key.notBefore");
+        const tolerance = options.clockToleranceMs ?? 5 * 60_000;
+        if (issuedAtMs + tolerance < Date.parse(notBefore)) {
+            throw snapshotError("INVALID_SIGNATURE", "Snapshot predates its signing key");
+        }
+    }
+    if (pinned.retiredAt !== undefined && pinned.retiredAt !== null) {
+        const retiredAt = strictIso(pinned.retiredAt, "key.retiredAt");
+        if (issuedAtMs > Date.parse(retiredAt)) {
+            throw snapshotError("INVALID_SIGNATURE", "Snapshot postdates its signing key");
+        }
+    }
+    return {
+        header: parsed.protectedHeader,
+        payload: payload,
+    };
+}
+//# sourceMappingURL=signed-snapshot.js.map

package/dist/signed-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signed-snapshot.js","sourceRoot":"","sources":["../src/signed-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,CAAC,MAAM,gCAAgC,GAAG,gBAAyB,CAAC;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAC;AAEnE,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAwE9C,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAA0B;IAEvC,YAAY,IAA6B,EAAE,OAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,aAAa,CACpB,IAA6B,EAC7B,OAAe;IAEf,OAAO,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS;YAChD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,EACxC,CAAC;QACD,MAAM,aAAa,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CACtB,OAAe,EACf,QAAgB,EAChB,KAAa;IAEb,IACE,OAAO,KAAK,EAAE;QACd,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAChC,CAAC;QACD,MAAM,aAAa,CAAC,eAAe,EAAE,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAClD,IACE,OAAO,CAAC,UAAU,GAAG,QAAQ;QAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,OAAO,EACzC,CAAC;QACD,MAAM,aAAa,CACjB,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,EAC7D,GAAG,KAAK,aAAa,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,eAAe,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,aAAa,CACjB,oBAAoB,EACpB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,IACE,MAAM,CAAC,GAAG,KAAK,OAAO;QACtB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG;QACnC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS;YACvB,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBACxB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,EACzC,CAAC;QACD,MAAM,aAAa,CACjB,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,CAAC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,QAAQ,GAAG,6BAA6B;IAExC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,aAAa,CAAC,WAAW,EAAE,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,QAAQ,EACxC,CAAC;QACD,MAAM,aAAa,CAAC,WAAW,EAAE,uBAAuB,QAAQ,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,aAAa,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,aAAa,CACjB,eAAe,EACf,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrC,IACE,gBAAgB,KAAK,SAAS;QAC9B,cAAc,KAAK,SAAS;QAC5B,gBAAgB,KAAK,SAAS,EAC9B,CAAC;QACD,MAAM,aAAa,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,SAAS,CACP,eAAe,CACb,gBAAgB,EAChB,0BAA0B,EAC1B,kBAAkB,CACnB,EACD,kBAAkB,CACnB,CACF,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CACvB,eAAe,CAAC,cAAc,EAAE,QAAQ,EAAE,SAAS,CAAC,EACpD,SAAS,CACV,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,gBAAgB,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChC,MAAM,aAAa,CACjB,eAAe,EACf,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,eAAe;QACf,OAAO;QACP,YAAY,EAAE,GAAG,gBAAgB,IAAI,cAAc,EAAE;QACrD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA6B;IAE7B,MAAM,MAAM,GAAG,KAAyD,CAAC;IACzE,IACE,MAAM,CAAC,GAAG,KAAK,KAAK;QACpB,MAAM,CAAC,GAAG,KAAK,SAAS;QACxB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QACxB,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,UAAU,KAAK,EAAE;QACpD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,CAAC;QACrE,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC;QACpD,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC;QAClD,GAAG,IAAI,MAAM,EACb,CAAC;QACD,MAAM,aAAa,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAyC,EACzC,WAAmB,EACnB,GAAW;IAEX,MAAM,MAAM,GACV,aAAa,IAAI,IAAI;QACnB,CAAC,CAAC,IAAI;QACN,CAAC,CAAC;YACE,WAAW;YACX,IAAI,EAAE,IAAI,CAAC,MAAM,CACf,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,WAAW,KAAK,SAAS;gBAC7B,GAAG,CAAC,WAAW,KAAK,WAAW,CAClC;SACF,CAAC;IACR,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACvC,MAAM,aAAa,CACjB,oBAAoB,EACpB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,aAAa,CACjB,eAAe,EACf,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,aAAa,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACrE,MAAM,aAAa,CACjB,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,EACvC,CAAC;QACD,MAAM,aAAa,CACjB,kBAAkB,EAClB,GAAG,KAAK,oCAAoC,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgC,EAChC,IAAY;IAEZ,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GACX,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,OAAO,CAAC,OAAO,KAAK,IAAI;YACxB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,aAAa,CACjB,kBAAkB,EAClB,8CAA8C,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IACE,OAAO,CAAC,eAAe,KAAK,qBAAqB;YACjD,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;YAC/B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,GAAG;YAC1C,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;YACvC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5C,OAAO,CAAC,WAAW,KAAK,WAAW;YACnC,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;YACrC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,KAAK,IAAI;YACtD,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAC5B,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YACnC,OAAO,CAAC,OAAO,KAAK,IAAI;YACxB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAC9B,CAAC;YACD,MAAM,aAAa,CACjB,kBAAkB,EAClB,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IACE,OAAO,CAAC,eAAe,KAAK,0BAA0B;QACtD,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QACjC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EACrC,CAAC;QACD,MAAM,aAAa,CACjB,kBAAkB,EAClB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAAoC;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,eAAe,KAAK,gCAAgC,EAAE,CAAC;QACjE,MAAM,aAAa,CACjB,kBAAkB,EAClB,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,aAAa,CACjB,oBAAoB,EACpB,uCAAuC,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClE,MAAM,aAAa,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,CACjB,eAAe,EACf,cAAc,OAAO,CAAC,IAAI,WAAW,CACtC,CAAC;IACJ,CAAC;IACD,IACE,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,GAAG,EAC9C,CAAC;QACD,MAAM,aAAa,CACjB,kBAAkB,EAClB,mCAAmC,CACpC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5C,IACE,YAAY,IAAI,MAAM;QACtB,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,YAAY,IAAI,UAAU,CAAC,EAC/D,CAAC;QACD,MAAM,aAAa,CACjB,kBAAkB,EAClB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACpC,MAAM,aAAa,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,MAAM,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,aAAa,CACjB,kBAAkB,EAClB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,GAAG,UAAU,EAAE,CAAC;QACxB,MAAM,aAAa,CACjB,kBAAkB,EAClB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;QAC3C,MAAM,aAAa,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,YAAY,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,aAAa,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACzD,CAAC;IACD,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,OAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAGlC,UAAkB,EAClB,OAAoC;IAEpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,aAAa,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAC5B,UAAU,EACV,OAAO,CAAC,QAAQ,IAAI,6BAA6B,CAClD,CAAC;IACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,OAAO,CAAC,IAAI,EACZ,WAAW,EACX,MAAM,CAAC,eAAe,CAAC,GAAG,CAC3B,CAAC;IACF,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE;gBACH,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,SAAS;gBACd,CAAC,EAAE,MAAM,CAAC,CAAC;aACZ;YACD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACvE,CAAC;IACD,IACE,CAAC,MAAM,CACL,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,EACzC,SAAS,EACT,MAAM,CAAC,SAAS,CACjB,EACD,CAAC;QACD,MAAM,aAAa,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE;QAC/C,GAAG,OAAO;QACV,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,gCAAgC,CAAC;IACvC,IAAI,MAAM,CAAC,eAAe,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QAChD,MAAM,aAAa,CACjB,eAAe,EACf,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,MAAM,CAAC;QACzD,IAAI,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,aAAa,CACjB,mBAAmB,EACnB,mCAAmC,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,aAAa,CACjB,mBAAmB,EACnB,oCAAoC,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,eAAe;QAC9B,OAAO,EAAE,OAAY;KACtB,CAAC;AACJ,CAAC"}

package/dist/update.js

@@ -22,7 +22,7 @@ Usage:
   lore update [--version <tag>]
 
 Options:
-  --version <tag>  Release tag to install, for example v0.1.16
+  --version <tag>  Release tag to install, for example v0.1.18
   -h, --help       Show this help
 
 Environment:
@@ -32,7 +32,7 @@ Environment:
 
 Examples:
   lore update
-  lore update --version v0.1.16
+  lore update --version v0.1.18
 `;
 export function isReleaseTag(value) {
     return RELEASE_TAG_PATTERN.test(value);
@@ -50,7 +50,7 @@ export function parseUpdateVersion(args) {
         if (version !== undefined && isReleaseTag(version)) {
             return version;
         }
-        throw new Error("--version must be a release tag such as v0.1.16");
+        throw new Error("--version must be a release tag such as v0.1.18");
     }
     throw new Error("Unknown update options. Try: lore update --help");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lore-co/cli",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Connect Claude Code, Codex, Cursor, OpenCode, Polytoken, and T3 Code to Lore shared engineering memory",
   "type": "module",
   "main": "./dist/index.js",
@@ -12,6 +12,22 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./reliability-store": {
+      "types": "./dist/reliability-store.d.ts",
+      "import": "./dist/reliability-store.js"
+    },
+    "./signed-snapshot": {
+      "types": "./dist/signed-snapshot.d.ts",
+      "import": "./dist/signed-snapshot.js"
+    },
+    "./context-fallback": {
+      "types": "./dist/context-fallback.d.ts",
+      "import": "./dist/context-fallback.js"
+    },
+    "./invocation-health-writer": {
+      "types": "./dist/invocation-health-writer.d.ts",
+      "import": "./dist/invocation-health-writer.js"
     }
   },
   "files": [
@@ -44,8 +60,8 @@
   "dependencies": {
     "ws": "^8.21.3",
     "zod": "^4.4.3",
-    "@lore-co/core": "0.1.16",
-    "@lore-co/sdk": "0.1.16"
+    "@lore-co/sdk": "0.1.18",
+    "@lore-co/core": "0.1.18"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"