@mmnto/cli 1.87.0 → 1.89.0

package/dist/spine-freeze-proof.js

@@ -0,0 +1,237 @@
+// ─── ADR-112 §5.1/§8 R1 — the shared-history freeze proof (topology-first) ────
+//
+// The cli-side git plumbing for the (a) commit-anchored tamper-evidence leg
+// (codex fold-1): TOPOLOGY IS THE PROOF. Every assertion here derives from the
+// SHARED ref (`origin/main` by default) — never HEAD, a local branch, or a
+// local-only ref — because `GIT_COMMITTER_DATE` is trivially settable while a
+// rewrite of shared history is observable. The one timestamp comparison
+// (`frozenAt` ≤ the introducing commit's committer date) is a CONSISTENCY CHECK
+// with its own distinct diagnostic (t2/t8), never the proof.
+//
+// Failure rows are a NON-ALIASING partition (codex fold-4): each row names a
+// distinct way the freeze chain can be broken, with a `freeze-proof[<row>]`
+// prefix so no two failures read alike. "Uncommitted" and "committed locally
+// but not shared" are DIFFERENT rows — only the latter can fool a local
+// HEAD-ancestor proof. Library module (static imports, like
+// authored-rule-intake.ts); command wrappers stay lazy.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { canonicalStringify, FROZEN_SPLIT_FILE, FrozenSplitArtifactSchema, SPLIT_REF_RE, TotemError, verifyFreezeIntegrity, } from '@mmnto/totem';
+/** The shared ref the proof derives from. Tests point this at a real fixture remote. */
+export const DEFAULT_SHARED_REF = 'origin/main';
+/** LF-normalize for blob comparison (the same normalization `generateInputHash` applies). */
+const lf = (s) => s.replace(/\r\n/g, '\n');
+/**
+ * Optional-read `git show <commit>:<path>` — returns `undefined` where the blob
+ * cannot be rendered (a deletion commit in the path's rev-list is the legitimate
+ * case). The optionality is this helper's CONTRACT, not a swallowed failure: the
+ * one caller treats `undefined` as skip-this-commit and keeps its own fail-loud
+ * for the no-commit-matches outcome.
+ */
+function tryGitShow(commit, relPath, cwd, safeExec) {
+    try {
+        // LC_ALL=C pins git's stderr prose — the family regex below parses it, and a
+        // localized message would misclassify blob-absence as a real fault (CR #2293
+        // round 3), resurfacing the deletion-commit crash on non-C locales.
+        return safeExec('git', ['show', `${commit}:${relPath}`], {
+            cwd,
+            env: { ...process.env, LC_ALL: 'C', LANG: 'C' },
+        }).replace(/\r\n/g, '\n');
+    }
+    catch (err) {
+        // ONLY the blob-absent family degrades to undefined (the optional-read
+        // contract); any other git fault propagates — fail loud, never drift.
+        const message = err instanceof Error ? err.message : String(err);
+        if (!/does not exist|exists on disk, but not in|invalid object name|bad revision/i.test(message)) {
+            throw err;
+        }
+        return undefined;
+    }
+}
+/** One fail-loud row of the freeze-proof failure partition — distinct, never aliasing. */
+export function freezeProofFailure(row, detail, fix, cause) {
+    return new TotemError('GATE_INVALID', `freeze-proof[${row}]: ${detail}`, fix, cause);
+}
+function gitText(args, cwd, safeExec, what) {
+    try {
+        return safeExec('git', args, { cwd }).replace(/\r\n/g, '\n');
+    }
+    catch (err) {
+        throw new TotemError('GIT_FAILED', `freeze-proof: git ${what} failed in ${cwd}`, 'Verify git is installed and the repository/ref is valid.', err);
+    }
+}
+/**
+ * Resolve a frozen-split artifact by its content-addressed `splitRef` inside the
+ * tracked freeze home (`<totemDir>/spine/<gate>/frozen-split.json`). Fail-loud
+ * rows: `ref-unresolved` (no artifact carries the ref — including the
+ * artifact-absent case), `ref-ambiguous` (more than one does), and
+ * `artifact-integrity` (an artifact whose recomputed content address or
+ * commitment does not match its own fields — an in-place edit, t7).
+ */
+export function resolveFrozenSplitByRef(totemDir, repoRoot, splitRef) {
+    const spineDir = path.join(totemDir, 'spine');
+    const candidates = [];
+    if (fs.existsSync(spineDir)) {
+        for (const entry of fs.readdirSync(spineDir, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const p = path.join(spineDir, entry.name, FROZEN_SPLIT_FILE);
+            if (fs.existsSync(p))
+                candidates.push(p);
+        }
+    }
+    const matches = [];
+    for (const absPath of candidates) {
+        let parsed;
+        try {
+            parsed = FrozenSplitArtifactSchema.parse(JSON.parse(fs.readFileSync(absPath, 'utf-8')));
+        }
+        catch (err) {
+            throw freezeProofFailure('artifact-integrity', `frozen split at ${absPath} is malformed or violates the artifact schema`, 'A frozen artifact is never hand-edited; restore it from shared history.', err);
+        }
+        if (parsed.splitRef !== splitRef)
+            continue;
+        const integrity = verifyFreezeIntegrity(parsed);
+        if (!integrity.ok) {
+            throw freezeProofFailure('artifact-integrity', `frozen split at ${absPath} fails its own content address/commitment — expected splitRef ${integrity.expectedSplitRef} / commitment ${integrity.expectedCommitment}, artifact carries ${parsed.splitRef} / ${parsed.freezeCommitment} (in-place edit, t7)`, 'A frozen artifact is never edited after freeze; restore it from shared history or re-freeze via a new PR.');
+        }
+        matches.push({
+            artifact: parsed,
+            absPath,
+            relPath: path.relative(repoRoot, absPath).replace(/\\/g, '/'),
+        });
+    }
+    if (matches.length === 0) {
+        throw freezeProofFailure('ref-unresolved', `no frozen split artifact under ${spineDir} carries splitRef ${splitRef}`, `Run \`totem spine freeze-split\` and land the artifact (${FROZEN_SPLIT_FILE}) via the freeze PR before authoring.`);
+    }
+    if (matches.length > 1) {
+        throw freezeProofFailure('ref-ambiguous', `${matches.length} frozen split artifacts carry splitRef ${splitRef}: ${matches.map((m) => m.relPath).join(', ')}`, 'A content-addressed ref must resolve to exactly one tracked artifact; remove the duplicates.');
+    }
+    return matches[0];
+}
+/**
+ * The (a)-leg shared-history proof for a frozen split artifact. Topology rows:
+ * `artifact-uncommitted` (working tree only) · `artifact-not-shared` (committed
+ * locally, absent from the shared ref's ancestry — the row a HEAD-ancestor proof
+ * would miss) · `artifact-blob-differs` (current bytes ≠ the blob at the shared
+ * introducing commit — covers post-freeze edits whether or not committed) ·
+ * `temporal-consistency` (frozenAt postdates the introducing commit's committer
+ * date — t2/t8's distinct diagnostic; a consistency check, never the proof).
+ */
+export function verifySharedFrozenSplit(args) {
+    const { repoRoot, resolved, safeExec } = args;
+    const sharedRef = args.sharedRef ?? DEFAULT_SHARED_REF;
+    const { relPath, absPath, artifact } = resolved;
+    try {
+        safeExec('git', ['ls-files', '--error-unmatch', '--', relPath], { cwd: repoRoot });
+    }
+    catch (err) {
+        throw freezeProofFailure('artifact-uncommitted', `frozen split ${relPath} is not tracked — it exists in the working tree only, so the commit-anchor has nothing to anchor to (t5)`, 'Commit the frozen artifact and land it on the shared ref via the freeze PR before authoring.', err);
+    }
+    // The anchor is the first shared commit carrying THIS CONTENT — not merely the
+    // first commit touching the path: a legitimate re-freeze reuses the path with
+    // new content, and its anchor is the re-freeze commit, while the superseded
+    // version keeps its own (older) anchor in history.
+    const pathCommits = gitText(['rev-list', '--reverse', sharedRef, '--', relPath], repoRoot, safeExec, `rev-list ${sharedRef} -- ${relPath}`)
+        .split('\n')
+        .filter((l) => l.trim().length > 0);
+    if (pathCommits.length === 0) {
+        throw freezeProofFailure('artifact-not-shared', `frozen split ${relPath} is tracked locally but absent from ${sharedRef} ancestry — a local commit is not a shared anchor (back-dating it would be unobservable)`, `Push/merge the freeze PR so the artifact lands on ${sharedRef}, then author.`);
+    }
+    const currentBytes = lf(fs.readFileSync(absPath, 'utf-8')).trim();
+    let introducing;
+    for (const commit of pathCommits) {
+        // Optional read by CONTRACT: `rev-list -- <path>` includes commits that DELETE
+        // the path, and `git show` legitimately cannot render the blob there (GCA #2293
+        // round 2). An unreadable commit simply cannot be the introducing match — skipping
+        // is the detector's correct read, and a fully-unmatched artifact still fail-louds
+        // as artifact-blob-differs below (the conservative direction is preserved).
+        const blob = tryGitShow(commit, relPath, repoRoot, safeExec);
+        if (blob !== undefined && lf(blob).trim() === currentBytes) {
+            introducing = commit;
+            break;
+        }
+    }
+    if (introducing === undefined) {
+        throw freezeProofFailure('artifact-blob-differs', `frozen split ${relPath} matches NO shared version of the path on ${sharedRef} — the working copy was modified after freeze, or this freeze never landed (t7)`, 'Restore the artifact from shared history; a legitimate re-freeze lands via a new PR before authoring.');
+    }
+    const committerDate = gitText(['show', '-s', '--format=%cI', introducing], repoRoot, safeExec, `show -s ${introducing}`).trim();
+    // Schema construction enforces presence, but a schema-bypassed artifact must
+    // fail LOUD here — `Date.parse('')` is NaN and every NaN comparison is false,
+    // which would silently no-op the consistency row (greptile #2293 round 1).
+    const frozenAt = artifact.split.frozenAt;
+    if (frozenAt === undefined) {
+        throw freezeProofFailure('artifact-integrity', `frozen split ${relPath} carries no split.frozenAt — the temporal-consistency check cannot run on a stampless artifact`, 'A frozen artifact always carries its freeze instant; restore it from shared history.');
+    }
+    // Git committer dates are SECOND-granular while frozenAt carries milliseconds —
+    // a freeze committed within the same second must not false-positive. The row
+    // fires only when frozenAt exceeds the committer date's whole second.
+    const GIT_TIMESTAMP_GRANULARITY_MS = 1000;
+    const frozenAtMs = Date.parse(frozenAt);
+    const committerDateMs = Date.parse(committerDate);
+    // An unparseable instant on EITHER side would make every comparison false and
+    // silently no-op the row (GCA #2293 round 3 — the same NaN class as the
+    // stampless case above, on the parse leg).
+    if (Number.isNaN(frozenAtMs) || Number.isNaN(committerDateMs)) {
+        throw freezeProofFailure('temporal-consistency', `temporal-consistency inputs unparseable: frozenAt "${frozenAt}" / committerDate "${committerDate}" (${introducing.slice(0, 12)}) — the row cannot run on malformed instants`, 'Both the artifact frozenAt and the commit date must be valid ISO-8601 instants; restore the artifact from shared history.');
+    }
+    if (frozenAtMs >= committerDateMs + GIT_TIMESTAMP_GRANULARITY_MS) {
+        throw freezeProofFailure('temporal-consistency', `temporal regression: frozenAt ${frozenAt} postdates the introducing commit's committer date ${committerDate} (${introducing.slice(0, 12)}) — the stamp claims a freeze AFTER the commit that carries it. Topology remains the proof; this consistency check names clock skew or a doctored stamp (t2/t8)`, 'Re-freeze via a new PR with an honestly-stamped instant; never edit the artifact in place.');
+    }
+    return { introducingCommit: introducing, committerDate };
+}
+/**
+ * Resolve + PROVE the freeze binding for a splitRef, in one home. Returns
+ * `undefined` for a legacy free-text ref (no artifact exists to bind — the
+ * pre-R1 adherence-class shape); for a content-addressed ref it resolves the
+ * artifact (integrity-checked) AND runs the shared-history proof, so a binding
+ * NEVER enters a consumer unproven regardless of which boundary constructs it
+ * (authoring intake, cert-run resolve, or the labels deriver).
+ */
+export function resolveProvenFreezeBinding(args) {
+    if (!SPLIT_REF_RE.test(args.splitRef))
+        return undefined;
+    const resolved = resolveFrozenSplitByRef(args.totemDir, args.repoRoot, args.splitRef);
+    verifySharedFrozenSplit({
+        repoRoot: args.repoRoot,
+        resolved,
+        safeExec: args.safeExec,
+        ...(args.sharedRef !== undefined ? { sharedRef: args.sharedRef } : {}),
+    });
+    return { artifact: resolved.artifact };
+}
+/**
+ * The ledger half of the (a) leg: every EFFECTIVE authoring-ledger entry must
+ * have entered shared history STRICTLY LATER than the freeze artifact — by
+ * ancestry, not timestamps (t3). Rows: `entry-not-shared` (the row is not in the
+ * shared ref's history of the ledger file — uncommitted, dirty, or local-only) ·
+ * `entry-not-after-freeze` (introduced in the same commit as, or not a
+ * descendant of, the freeze's introducing commit).
+ */
+export function assertLedgerEntriesAfterFreeze(args) {
+    const { repoRoot, ledgerRelPath, entries, freezeIntroducingCommit, safeExec } = args;
+    const sharedRef = args.sharedRef ?? DEFAULT_SHARED_REF;
+    for (const { ruleId, entry } of entries) {
+        const line = canonicalStringify(entry);
+        const introducing = gitText(['log', '--format=%H', '--reverse', `-S${line}`, sharedRef, '--', ledgerRelPath], repoRoot, safeExec, `log -S<entry ${ruleId}> ${sharedRef} -- ${ledgerRelPath}`)
+            .split('\n')
+            .filter((l) => l.trim().length > 0)[0];
+        if (introducing === undefined) {
+            throw freezeProofFailure('entry-not-shared', `authoring-ledger entry for '${ruleId}' is not in ${sharedRef}'s history of ${ledgerRelPath} — uncommitted, dirty, or local-only rows cannot anchor the freeze→author chronology`, 'Land the authoring commit on the shared ref; the cert chain reads shared history only.');
+        }
+        if (introducing === freezeIntroducingCommit) {
+            throw freezeProofFailure('entry-not-after-freeze', `authoring-ledger entry for '${ruleId}' entered shared history in the SAME commit as the freeze artifact (${introducing.slice(0, 12)}) — authoring must be strictly later than the freeze (t3)`, 'Freeze first (one PR), author after (a later PR); never combine them in one commit.');
+        }
+        try {
+            safeExec('git', ['merge-base', '--is-ancestor', freezeIntroducingCommit, introducing], {
+                cwd: repoRoot,
+            });
+        }
+        catch (err) {
+            // Non-zero exit = not-an-ancestor (or a git fault) — both honestly fail the row
+            // (conservative: an unprovable ordering never passes).
+            throw freezeProofFailure('entry-not-after-freeze', `authoring-ledger entry for '${ruleId}' (introduced ${introducing.slice(0, 12)}) does not descend from the freeze artifact's introducing commit ${freezeIntroducingCommit.slice(0, 12)} — not strictly later by ancestry (t3; timestamps are not consulted)`, 'The entry predates the freeze or lives on a divergent line; re-author under the frozen split.', err);
+        }
+    }
+}
+//# sourceMappingURL=spine-freeze-proof.js.map

package/dist/spine-freeze-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spine-freeze-proof.js","sourceRoot":"","sources":["../src/spine-freeze-proof.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,gFAAgF;AAChF,6DAA6D;AAC7D,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,4DAA4D;AAC5D,wDAAwD;AAExD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EAEjB,yBAAyB,EACzB,YAAY,EACZ,UAAU,EACV,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAItB,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,6FAA6F;AAC7F,MAAM,EAAE,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAE3D;;;;;;GAMG;AACH,SAAS,UAAU,CACjB,MAAc,EACd,OAAe,EACf,GAAW,EACX,QAAoB;IAEpB,IAAI,CAAC;QACH,6EAA6E;QAC7E,6EAA6E;QAC7E,oEAAoE;QACpE,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,EAAE;YACvD,GAAG;YACH,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE;SAChD,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IACE,CAAC,6EAA6E,CAAC,IAAI,CAAC,OAAO,CAAC,EAC5F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,MAAc,EACd,GAAW,EACX,KAAe;IAEf,OAAO,IAAI,UAAU,CAAC,cAAc,EAAE,gBAAgB,GAAG,MAAM,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,GAAW,EAAE,QAAoB,EAAE,IAAY;IAC9E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAClB,YAAY,EACZ,qBAAqB,IAAI,cAAc,GAAG,EAAE,EAC5C,0DAA0D,EAC1D,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,MAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,kBAAkB,CACtB,oBAAoB,EACpB,mBAAmB,OAAO,+CAA+C,EACzE,yEAAyE,EACzE,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,SAAS;QAC3C,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,kBAAkB,CACtB,oBAAoB,EACpB,mBAAmB,OAAO,iEAAiE,SAAS,CAAC,gBAAgB,iBAAiB,SAAS,CAAC,kBAAkB,sBAAsB,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,gBAAgB,sBAAsB,EAC1P,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,MAAM;YAChB,OAAO;YACP,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,kBAAkB,CACtB,gBAAgB,EAChB,kCAAkC,QAAQ,qBAAqB,QAAQ,EAAE,EACzE,2DAA2D,iBAAiB,uCAAuC,CACpH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,kBAAkB,CACtB,eAAe,EACf,GAAG,OAAO,CAAC,MAAM,0CAA0C,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClH,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AAQD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;IAEhD,IAAI,CAAC;QACH,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,kBAAkB,CACtB,sBAAsB,EACtB,gBAAgB,OAAO,0GAA0G,EACjI,8FAA8F,EAC9F,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,WAAW,GAAG,OAAO,CACzB,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,EACnD,QAAQ,EACR,QAAQ,EACR,YAAY,SAAS,OAAO,OAAO,EAAE,CACtC;SACE,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,kBAAkB,CACtB,qBAAqB,EACrB,gBAAgB,OAAO,uCAAuC,SAAS,0FAA0F,EACjK,qDAAqD,SAAS,gBAAgB,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,WAA+B,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,+EAA+E;QAC/E,gFAAgF;QAChF,mFAAmF;QACnF,kFAAkF;QAClF,4EAA4E;QAC5E,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,YAAY,EAAE,CAAC;YAC3D,WAAW,GAAG,MAAM,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,kBAAkB,CACtB,uBAAuB,EACvB,gBAAgB,OAAO,6CAA6C,SAAS,iFAAiF,EAC9J,uGAAuG,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAC3B,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,CAAC,EAC3C,QAAQ,EACR,QAAQ,EACR,WAAW,WAAW,EAAE,CACzB,CAAC,IAAI,EAAE,CAAC;IACT,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;IACzC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,kBAAkB,CACtB,oBAAoB,EACpB,gBAAgB,OAAO,gGAAgG,EACvH,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,4BAA4B,GAAG,IAAI,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClD,8EAA8E;IAC9E,wEAAwE;IACxE,2CAA2C;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,kBAAkB,CACtB,sBAAsB,EACtB,sDAAsD,QAAQ,sBAAsB,aAAa,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8CAA8C,EAC7K,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,eAAe,GAAG,4BAA4B,EAAE,CAAC;QACjE,MAAM,kBAAkB,CACtB,sBAAsB,EACtB,iCAAiC,QAAQ,sDAAsD,aAAa,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iKAAiK,EAC1S,4FAA4F,CAC7F,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAM1C;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtF,uBAAuB,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ;QACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAS9C;IACC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,OAAO,CACzB,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,CAAC,EAChF,QAAQ,EACR,QAAQ,EACR,gBAAgB,MAAM,KAAK,SAAS,OAAO,aAAa,EAAE,CAC3D;aACE,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,kBAAkB,CACtB,kBAAkB,EAClB,+BAA+B,MAAM,eAAe,SAAS,iBAAiB,aAAa,sFAAsF,EACjL,wFAAwF,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,KAAK,uBAAuB,EAAE,CAAC;YAC5C,MAAM,kBAAkB,CACtB,wBAAwB,EACxB,+BAA+B,MAAM,uEAAuE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,2DAA2D,EAC/L,qFAAqF,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,WAAW,CAAC,EAAE;gBACrF,GAAG,EAAE,QAAQ;aACd,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gFAAgF;YAChF,uDAAuD;YACvD,MAAM,kBAAkB,CACtB,wBAAwB,EACxB,+BAA+B,MAAM,iBAAiB,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,oEAAoE,uBAAuB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,sEAAsE,EAC5P,+FAA+F,EAC/F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmnto/cli",
-  "version": "1.87.0",
+  "version": "1.89.0",
   "description": "CLI for Totem — AI persistent memory and context layer",
   "type": "module",
   "engines": {
@@ -28,7 +28,7 @@
     "smol-toml": "^1.6.1",
     "yaml": "^2.4.0",
     "zod": "^3.24.0",
-    "@mmnto/totem": "1.87.0"
+    "@mmnto/totem": "1.89.0"
   },
   "devDependencies": {
     "@anthropic-ai/sdk": "^0.98.0",