@nxuss/lemma 1.17.0 → 1.18.0

package/dist/esm/cloud/scrub/StatelessScrubber.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Lemma API v2 — StatelessScrubber (Lane F)
+ *
+ * Stateless privacy firewall over raw text and serialized agent tool-call JSON.
+ *
+ * Contract (src/contracts/api-v2.types.ts):
+ *   scrubText(text, mode)                    -> { text, findings }   text input
+ *   scrubToolCallJson(raw, mode)             -> { toolCallJson, findings }
+ *
+ * Invariants:
+ *   - DETECTED VALUES ARE NEVER RETURNED. The response carries only the masked
+ *     text and an inventory of `{ type, offset, length }` findings. Nothing the
+ *     caller passed in is echoed back except by design.
+ *   - STATELESS: the constructor does NO I/O (unlike SemanticScrubber, whose
+ *     constructor reads lemma.config.json from cwd). Fresh RegExps are compiled
+ *     per call so `lastIndex` never leaks across concurrent requests. Nothing is
+ *     persisted.
+ *   - No `console.*` logging of the payload.
+ *
+ * This is the lane's adapted "wrap" of SemanticScrubber (which we cannot reuse
+ * verbatim: it exposes no per-finding offsets, has no DSN coverage, and loads
+ * config from cwd at construct time). See lane-notes/F.md ## decisions.
+ *
+ * Ownership: Lane F.
+ */
+import type { ScrubFinding } from "../../contracts/api-v2.types";
+export type ScrubMode = "mask" | "detect";
+export declare class StatelessScrubber {
+    readonly lane = "F";
+    /** Scrub a raw text string. Offsets in findings are relative to `text`. */
+    scrubText(text: string, mode?: ScrubMode): {
+        text: string;
+        findings: ScrubFinding[];
+    };
+    /**
+     * Scrub a serialized agent tool-call JSON string. The JSON structure is
+     * preserved (always valid JSON on output). Each string leaf's text content is
+     * scrubbed in-place; findings offsets are relative to the ORIGINAL `raw`
+     * string the client sent. In detect mode the original string is returned
+     * byte-for-byte untouched (findings only).
+     */
+    scrubToolCallJson(raw: string, mode?: ScrubMode): {
+        toolCallJson: string;
+        findings: ScrubFinding[];
+    };
+    /** Backwards-compatible alias: scrubText. */
+    scrub(text: string, mode?: ScrubMode): {
+        text: string;
+        findings: ScrubFinding[];
+    };
+}
+export default StatelessScrubber;
+//# sourceMappingURL=StatelessScrubber.d.ts.map

package/dist/esm/cloud/scrub/StatelessScrubber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatelessScrubber.d.ts","sourceRoot":"","sources":["../../../../src/cloud/scrub/StatelessScrubber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEjE,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAwJ1C,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,IAAI,OAAO;IAEpB,2EAA2E;IAC3E,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,SAAkB,GACvB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;IAc7C;;;;;;OAMG;IACH,iBAAiB,CACf,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,SAAkB,GACvB;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;IAqCrD,6CAA6C;IAC7C,KAAK,CACH,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,SAAkB,GACvB;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;KAAE;CAG9C;AAED,eAAe,iBAAiB,CAAC"}

package/dist/esm/cloud/scrub/StatelessScrubber.js

@@ -0,0 +1,199 @@
+/**
+ * Pattern table. Mirrors SemanticScrubber's built-in defaults (so behavior is
+ * consistent with the rest of the product) plus a connection-DSN pattern that
+ * SemanticScrubber lacks — DSN coverage is a hard acceptance criterion for this
+ * lane. Compiled fresh per call for statelessness.
+ */
+const PATTERNS = [
+    {
+        name: "OPENAI_ANTHROPIC_KEY",
+        whole: true,
+        source: String.raw `\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b`,
+        flags: "g",
+    },
+    {
+        name: "STRIPE_KEY",
+        whole: true,
+        source: String.raw `\b(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{10,}\b|\bwhsec_[A-Za-z0-9]{20,}\b`,
+        flags: "g",
+    },
+    {
+        name: "AWS_ACCESS_KEY",
+        whole: true,
+        source: String.raw `\bAKIA[0-9A-Z]{16}\b`,
+        flags: "g",
+    },
+    {
+        name: "GITHUB_TOKEN",
+        whole: true,
+        source: String.raw `\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b`,
+        flags: "g",
+    },
+    {
+        name: "GOOGLE_API_KEY",
+        whole: true,
+        source: String.raw `\bAIza[0-9A-Za-z_-]{35}\b`,
+        flags: "g",
+    },
+    {
+        name: "SLACK_TOKEN",
+        whole: true,
+        source: String.raw `\bxox[baprs]-[A-Za-z0-9-]{10,}\b`,
+        flags: "g",
+    },
+    {
+        name: "JWT",
+        whole: true,
+        source: String.raw `\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b`,
+        flags: "g",
+    },
+    {
+        name: "PRIVATE_KEY_BLOCK",
+        whole: true,
+        source: String.raw `-----BEGIN[ A-Z]*PRIVATE KEY-----[\s\S]+?-----END[ A-Z]*PRIVATE KEY-----`,
+        flags: "g",
+    },
+    {
+        name: "BEARER_TOKEN",
+        whole: true,
+        source: String.raw `Bearer\s+[a-zA-Z0-9\-._~+/]+=*`,
+        flags: "gi",
+    },
+    // Connection DSN: masks the credentials (up to & including '@') and nothing else.
+    {
+        name: "CONNECTION_DSN",
+        whole: false,
+        source: String.raw `\b(?:postgres(?:ql)?|mysql|redis|rediss|mongodb(?:\+srv)?|amqp|ldaps?|mssql|oracle)://(?<secret>[A-Za-z0-9._~%+\-:]*@)`,
+        flags: "gi",
+    },
+    {
+        name: "ENV_SECRET",
+        whole: false,
+        // Mirrors SemanticScrubber's env-style catch-all. Named group `secret` is
+        // the value only, so findings point at the secret (never the name) and
+        // masking redacts only the value while keeping `VAR_NAME=` readable.
+        source: String.raw `[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_?KEY|API_?KEY|CREDENTIALS?|SALT|WEBHOOK|ACCESS_?KEY|CLIENT_?SECRET)[A-Z0-9_]*\s*[:=]\s*(?<secret>['"]?[^\s'"#]{4,}['"]?)`,
+        flags: "gm",
+    },
+    {
+        name: "EMAIL",
+        whole: true,
+        source: String.raw `[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+`,
+        flags: "g",
+    },
+];
+/** Mask a raw string by replacing each accepted span with a [TYPE_n] token. */
+function maskSpans(input, spans) {
+    let masked = input;
+    for (let i = spans.length - 1; i >= 0; i--) {
+        const s = spans[i];
+        const n = spans.slice(0, i + 1).filter((x) => x.type === s.type).length;
+        masked =
+            masked.slice(0, s.start) + `[${s.type}_${n}]` + masked.slice(s.end);
+    }
+    return masked;
+}
+/**
+ * Scan the input for all non-overlapping secret spans, left to right.
+ * Offsets/lengths are relative to `input`.
+ */
+function scanSecrets(input) {
+    const hits = [];
+    for (const p of PATTERNS) {
+        const re = new RegExp(p.source, p.flags);
+        let m;
+        while ((m = re.exec(input)) !== null) {
+            const full = m[0];
+            let start = m.index;
+            let end = m.index + full.length;
+            if (!p.whole &&
+                m.groups &&
+                typeof m.groups.secret === "string" &&
+                m.groups.secret.length > 0) {
+                start = m.index + full.indexOf(m.groups.secret);
+                end = start + m.groups.secret.length;
+            }
+            hits.push({ type: p.name, start, end });
+            if (full.length === 0)
+                re.lastIndex++; // guard against zero-length loops
+            if (start >= input.length)
+                break;
+        }
+    }
+    hits.sort((a, b) => a.start - b.start || b.end - a.end);
+    const merged = [];
+    for (const h of hits) {
+        const last = merged[merged.length - 1];
+        if (last && h.start < last.end)
+            continue; // overlapping earlier span wins
+        merged.push(h);
+    }
+    return merged;
+}
+export class StatelessScrubber {
+    constructor() {
+        this.lane = "F";
+    }
+    /** Scrub a raw text string. Offsets in findings are relative to `text`. */
+    scrubText(text, mode = "mask") {
+        const spans = scanSecrets(text);
+        const findings = spans.map((s) => ({
+            type: s.type,
+            offset: s.start,
+            length: s.end - s.start,
+        }));
+        if (spans.length === 0 || mode === "detect") {
+            return { text, findings };
+        }
+        return { text: maskSpans(text, spans), findings };
+    }
+    /**
+     * Scrub a serialized agent tool-call JSON string. The JSON structure is
+     * preserved (always valid JSON on output). Each string leaf's text content is
+     * scrubbed in-place; findings offsets are relative to the ORIGINAL `raw`
+     * string the client sent. In detect mode the original string is returned
+     * byte-for-byte untouched (findings only).
+     */
+    scrubToolCallJson(raw, mode = "mask") {
+        const spans = scanSecrets(raw);
+        const findings = spans.map((s) => ({
+            type: s.type,
+            offset: s.start,
+            length: s.end - s.start,
+        }));
+        if (mode === "detect") {
+            return { toolCallJson: raw, findings };
+        }
+        // Re-serialize with every string leaf's text masked, so the JSON stays valid.
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new TypeError("toolCallJson must be valid JSON");
+        }
+        const walk = (node) => {
+            if (typeof node === "string") {
+                return this.scrubText(node, "mask").text;
+            }
+            if (Array.isArray(node))
+                return node.map(walk);
+            if (node !== null && typeof node === "object") {
+                const out = {};
+                for (const k of Object.keys(node)) {
+                    out[k] = walk(node[k]);
+                }
+                return out;
+            }
+            return node;
+        };
+        const masked = JSON.stringify(walk(parsed));
+        return { toolCallJson: masked, findings };
+    }
+    /** Backwards-compatible alias: scrubText. */
+    scrub(text, mode = "mask") {
+        return this.scrubText(text, mode);
+    }
+}
+export default StatelessScrubber;
+//# sourceMappingURL=StatelessScrubber.js.map

package/dist/esm/cloud/scrub/StatelessScrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StatelessScrubber.js","sourceRoot":"","sources":["../../../../src/cloud/scrub/StatelessScrubber.ts"],"names":[],"mappings":"AAqCA;;;;;GAKG;AACH,MAAM,QAAQ,GAAsB;IAClC;QACE,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,0CAA0C;QAC5D,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,4EAA4E;QAC9F,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,sBAAsB;QACxC,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,iEAAiE;QACnF,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,2BAA2B;QAC7C,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,kCAAkC;QACpD,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,uDAAuD;QACzE,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,0EAA0E;QAC5F,KAAK,EAAE,GAAG;KACX;IACD;QACE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,gCAAgC;QAClD,KAAK,EAAE,IAAI;KACZ;IACD,kFAAkF;IAClF;QACE,IAAI,EAAE,gBAAgB;QACtB,KAAK,EAAE,KAAK;QACZ,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,wHAAwH;QAC1I,KAAK,EAAE,IAAI;KACZ;IACD;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,KAAK;QACZ,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,4KAA4K;QAC9L,KAAK,EAAE,IAAI;KACZ;IACD;QACE,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM,CAAC,GAAG,CAAA,iDAAiD;QACnE,KAAK,EAAE,GAAG;KACX;CACF,CAAC;AAQF,+EAA+E;AAC/E,SAAS,SAAS,CAAC,KAAa,EAAE,KAAiB;IACjD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM;YACJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,IAAI,GAAe,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACpB,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;YAChC,IACE,CAAC,CAAC,CAAC,KAAK;gBACR,CAAC,CAAC,MAAM;gBACR,OAAO,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAC1B,CAAC;gBACD,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChD,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,kCAAkC;YACzE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM;QACnC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG;YAAE,SAAS,CAAC,gCAAgC;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAA9B;QACW,SAAI,GAAG,GAAG,CAAC;IA0EtB,CAAC;IAxEC,2EAA2E;IAC3E,SAAS,CACP,IAAY,EACZ,OAAkB,MAAM;QAExB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,KAAK;YACf,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;SACxB,CAAC,CAAC,CAAC;QAEJ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CACf,GAAW,EACX,OAAkB,MAAM;QAExB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAmB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,KAAK;YACf,MAAM,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;SACxB,CAAC,CAAC,CAAC;QAEJ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC;QAED,8EAA8E;QAC9E,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,IAAa,EAAW,EAAE;YACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;YAC3C,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;gBACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAA+B,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAE,IAAgC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAED,6CAA6C;IAC7C,KAAK,CACH,IAAY,EACZ,OAAkB,MAAM;QAExB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;CACF;AAED,eAAe,iBAAiB,CAAC"}

package/dist/esm/cloud/scrub/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Lemma API v2 — stateless scrub (Lane F)
+ */
+export * from "./StatelessScrubber";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/cloud/scrub/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cloud/scrub/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,cAAc,qBAAqB,CAAC"}

package/dist/esm/cloud/scrub/index.js

@@ -0,0 +1,5 @@
+/**
+ * Lemma API v2 — stateless scrub (Lane F)
+ */
+export * from "./StatelessScrubber";
+//# sourceMappingURL=index.js.map

package/dist/esm/cloud/scrub/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cloud/scrub/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,cAAc,qBAAqB,CAAC"}

package/dist/esm/cloud/server.d.ts

@@ -8,9 +8,9 @@
  * Start: node dist/cloud/server.js
  * Or: npm run cloud:start
  */
-import { KeyManager } from './KeyManager.js';
-import { TenantCache } from './TenantCache.js';
-import { PostgresQuotaLimiter } from './PostgresQuotaLimiter.js';
+import { KeyManager } from './KeyManager';
+import { TenantCache } from './TenantCache';
+import { PostgresQuotaLimiter } from './PostgresQuotaLimiter';
 declare const app: import("express-serve-static-core").Express;
 declare const keyManager: KeyManager;
 declare const tenantCaches: Map<string, TenantCache>;

package/dist/esm/cloud/server.js

@@ -10,12 +10,12 @@
  */
 import express from 'express';
 import crypto from 'crypto';
-import { KeyManager } from './KeyManager.js';
-import { TenantCache } from './TenantCache.js';
-import { PLAN_LIMITS } from './types.js';
-import { BurstRateLimiter } from './BurstRateLimiter.js';
+import { KeyManager } from './KeyManager';
+import { TenantCache } from './TenantCache';
+import { PLAN_LIMITS } from './types';
+import { BurstRateLimiter } from './BurstRateLimiter';
 import { Pool } from 'pg';
-import { PostgresQuotaLimiter } from './PostgresQuotaLimiter.js';
+import { PostgresQuotaLimiter } from './PostgresQuotaLimiter';
 const app = express();
 // ─── Bind config ─────────────────────────────────────────────────────────────
 const BIND_HOST = process.env.LEMMA_BIND_HOST || '127.0.0.1';

package/dist/esm/cloud/store/FileBrainStore.d.ts

@@ -0,0 +1,26 @@
+import { BrainStore, Candidate } from '../../contracts/store';
+export interface FileBrainStoreOptions {
+    dir?: string;
+    filename?: string;
+}
+export declare class FileBrainStore implements BrainStore {
+    private options;
+    readonly lane = "B";
+    private readonly file;
+    private cache;
+    constructor(options?: FileBrainStoreOptions);
+    private load;
+    /** Reescribe el archivo entero, fusionando lo que quedó en disco con lo nuevo
+     * (mismo merge-before-write que usa el Brain para no clobberear un peer).
+     * `terms` se omite al serializar (igual que el Brain) pero se conserva en el
+     * registro en memoria para que la búsqueda funcione sin re-leer el archivo. */
+    private save;
+    private inTenant;
+    put(tenantId: string, memory: unknown): Promise<string>;
+    get(tenantId: string, id: string): Promise<unknown | null>;
+    searchCandidates(tenantId: string, query: string, limit: number): Promise<Candidate[]>;
+    listByIds(tenantId: string, ids: string[]): Promise<Map<string, unknown>>;
+    delete(tenantId: string, id: string): Promise<boolean>;
+}
+export default FileBrainStore;
+//# sourceMappingURL=FileBrainStore.d.ts.map

package/dist/esm/cloud/store/FileBrainStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileBrainStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/store/FileBrainStore.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAW9D,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4CD,qBAAa,cAAe,YAAW,UAAU;IAMnC,OAAO,CAAC,OAAO;IAL3B,QAAQ,CAAC,IAAI,OAAO;IAEpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAoG;gBAE7F,OAAO,GAAE,qBAA0B;IAKvD,OAAO,CAAC,IAAI;IAoBZ;;;mFAG+E;IAC/E,OAAO,CAAC,IAAI;IAcZ,OAAO,CAAC,QAAQ;IAIV,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAsCvD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAmDtF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAczE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAU7D;AAED,eAAe,cAAc,CAAC"}

package/dist/esm/cloud/store/FileBrainStore.js

@@ -0,0 +1,212 @@
+/**
+ * FileBrainStore — adaptador del contrato BrainStore sobre el NDJSON local del
+ * Brain (entries.ndjson). Mantiene funcionando el modo local / MCP a través del
+ * mismo contrato que usa PostgresBrainStore en la nube.
+ *
+ * Formato de disco: una línea JSON por memoria (el mismo `entries.ndjson` que
+ * TheBrainV2 ya escribe y lee). Igual que el Brain, `terms` NO se persiste —
+ * load() lo reconstruye desde el termFreq — y cada línea puede llevar un campo
+ * extra `tenant_id` que el Brain ignora al leer, así que un archivo escrito por
+ * este store sigue siendo legible por TheBrainV2 y viceversa.
+ *
+ * Aislamiento por tenant: una línea sin `tenant_id` pertenece al tenant
+ * `default` (escritas antes de que exista la tenancy). Eso es fail-closed — el
+ * tenant `default` es el único que puede leerlas; un tenant B con otro id jamás
+ * ve una línea que no lleva su tenant_id.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import crypto from 'crypto';
+import { tokenize, termFrequencies, bm25Score, jaccardSimilarity, } from '../../subconscious/TheBrainV2';
+const DEFAULT_TENANT = 'default';
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function generateId(query) {
+    const queryKey = query.trim().toLowerCase().substring(0, 200);
+    return crypto
+        .createHash('sha1')
+        .update(queryKey + Date.now() + crypto.randomBytes(8).toString('hex'))
+        .digest('hex')
+        .substring(0, 12);
+}
+/** Lee el NDJSON tal cual lo lee TheBrainV2 (readEntriesFile), reconstruyendo
+ * `terms` desde termFreq para las líneas que no lo persistieron. */
+function parseNdjson(raw) {
+    const out = [];
+    for (const line of raw.split('\n')) {
+        if (!line)
+            continue;
+        try {
+            const rec = JSON.parse(line);
+            if (!rec || typeof rec.id !== 'string')
+                continue;
+            if (!Array.isArray(rec.terms))
+                rec.terms = Object.keys(rec.termFreq || {});
+            out.push(rec);
+        }
+        catch {
+            // Líneas corruptas: se conservan byte a byte al reescribir (no se pierde nada).
+            out.push({ __raw__: line });
+        }
+    }
+    return out;
+}
+export class FileBrainStore {
+    constructor(options = {}) {
+        this.options = options;
+        this.lane = 'B';
+        this.cache = null;
+        const dir = options.dir || process.env.LEMMA_BRAIN_DIR || path.join(os.homedir(), '.lemma-cache', 'brain');
+        this.file = path.join(dir, options.filename || 'entries.ndjson');
+    }
+    load() {
+        let stat;
+        try {
+            stat = fs.statSync(this.file);
+        }
+        catch {
+            return [];
+        }
+        if (this.cache &&
+            this.cache.mtimeMs === stat.mtimeMs &&
+            this.cache.size === stat.size) {
+            return this.cache.records;
+        }
+        const raw = fs.readFileSync(this.file, 'utf8');
+        const records = parseNdjson(raw);
+        this.cache = { mtimeMs: stat.mtimeMs, size: stat.size, records };
+        return records;
+    }
+    /** Reescribe el archivo entero, fusionando lo que quedó en disco con lo nuevo
+     * (mismo merge-before-write que usa el Brain para no clobberear un peer).
+     * `terms` se omite al serializar (igual que el Brain) pero se conserva en el
+     * registro en memoria para que la búsqueda funcione sin re-leer el archivo. */
+    save(records) {
+        fs.mkdirSync(path.dirname(this.file), { recursive: true });
+        const tmp = `${this.file}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+        const lines = records.map((r) => {
+            if ('__raw__' in r && r.__raw__ !== undefined)
+                return r.__raw__;
+            const { terms: _persistedOnDiskOnly, ...rest } = r;
+            return JSON.stringify(rest);
+        }).filter((l) => l.length > 0);
+        fs.writeFileSync(tmp, lines.join('\n') + '\n', 'utf8');
+        fs.renameSync(tmp, this.file);
+        const stat = fs.statSync(this.file);
+        this.cache = { mtimeMs: stat.mtimeMs, size: stat.size, records };
+    }
+    inTenant(r, tenantId) {
+        return (r.tenant_id ?? DEFAULT_TENANT) === tenantId;
+    }
+    async put(tenantId, memory) {
+        const m = isRecord(memory) ? memory : {};
+        const query = typeof m.query === 'string' ? m.query : '';
+        const response = typeof m.response === 'string' ? m.response : '';
+        const id = typeof m.id === 'string' && m.id.length > 0 ? m.id : generateId(query || response);
+        const terms = Array.isArray(m.terms) && m.terms.length > 0
+            ? [...new Set(m.terms.filter((t) => typeof t === 'string'))]
+            : tokenize([query, response].join(' '));
+        const termFreq = isRecord(m.termFreq) ? m.termFreq : termFrequencies(terms);
+        // El Brain no persiste `terms` pero sí termFreq; save() lo omite al serializar
+        // y el registro en memoria lo conserva para la búsqueda. `hits`, `demerits` y
+        // las demás señales que el Brain espera en la búsqueda (Math.log2(hits+1), etc.)
+        // se fijan a sus defaults si la memoria no las trae, para que un archivo escrito
+        // por este store sea leído e indexado sin NaN por TheBrainV2.
+        const line = {
+            ...(isRecord(memory) ? memory : {}),
+            id,
+            query,
+            response,
+            terms,
+            termFreq,
+            hits: typeof (isRecord(memory) ? memory : {}).hits === 'number' ? memory.hits : 0,
+            demerits: typeof (isRecord(memory) ? memory : {}).demerits === 'number' ? memory.demerits : 0,
+            tenant_id: tenantId,
+        };
+        const records = this.load();
+        const idx = records.findIndex((r) => !('__raw__' in r) && r.id === id && this.inTenant(r, tenantId));
+        if (idx >= 0)
+            records[idx] = line;
+        else
+            records.push(line);
+        this.save(records);
+        return id;
+    }
+    async get(tenantId, id) {
+        const rec = this.load().find((r) => !('__raw__' in r) && r.id === id && this.inTenant(r, tenantId));
+        if (!rec)
+            return null;
+        const { tenant_id: _t, ...memory } = rec;
+        return memory;
+    }
+    async searchCandidates(tenantId, query, limit) {
+        const queryTerms = tokenize(query);
+        if (queryTerms.length === 0)
+            return [];
+        const docs = this.load()
+            .filter((r) => !('__raw__' in r) && this.inTenant(r, tenantId))
+            .filter((r) => Array.isArray(r.terms));
+        if (docs.length === 0)
+            return [];
+        const N = docs.length;
+        const idf = {};
+        for (const term of queryTerms) {
+            const df = docs.filter((d) => d.terms.includes(term)).length;
+            idf[term] = df > 0 ? Math.log((N - df + 0.5) / (df + 0.5) + 1) : 0;
+        }
+        const queryTermSet = new Set(queryTerms);
+        const avgDocLength = docs.reduce((acc, d) => acc + d.terms.length, 0) / Math.max(N, 1);
+        const scored = [];
+        for (const doc of docs) {
+            const terms = doc.terms;
+            if (!terms.some((t) => queryTermSet.has(t)))
+                continue;
+            const bm25 = bm25Score(queryTerms, (doc.termFreq || termFrequencies(terms)), terms.length, avgDocLength || 10, idf);
+            const jaccard = jaccardSimilarity(queryTermSet, new Set(terms));
+            scored.push({ id: doc.id, bm25, jaccard, hits: doc.hits, outcome: doc.outcome, demerits: doc.demerits });
+        }
+        if (scored.length === 0)
+            return [];
+        const maxBm25 = Math.max(...scored.map((s) => s.bm25), 1);
+        const ranked = scored
+            .map((s) => {
+            let similarity = (s.bm25 / maxBm25) * 0.7 + s.jaccard * 0.3;
+            similarity += Math.min(Math.log2((s.hits || 0) + 1) * 0.02, 0.08);
+            if (s.outcome === 'failed')
+                similarity -= 0.15;
+            if (s.demerits)
+                similarity -= Math.min(s.demerits * 0.06, 0.25);
+            return { id: s.id, score: Math.max(similarity, 0) };
+        })
+            .sort((a, b) => b.score - a.score)
+            .slice(0, Math.max(1, limit));
+        return ranked;
+    }
+    async listByIds(tenantId, ids) {
+        const want = new Set(ids);
+        const out = new Map();
+        for (const r of this.load()) {
+            if ('__raw__' in r)
+                continue;
+            const rec = r;
+            if (rec.id && want.has(rec.id) && this.inTenant(rec, tenantId)) {
+                const { tenant_id: _t, ...memory } = rec;
+                out.set(rec.id, memory);
+            }
+        }
+        return out;
+    }
+    async delete(tenantId, id) {
+        const records = this.load();
+        const before = records.length;
+        const kept = records.filter((r) => '__raw__' in r || !(r.id === id && this.inTenant(r, tenantId)));
+        if (kept.length === before)
+            return false;
+        this.save(kept);
+        return true;
+    }
+}
+export default FileBrainStore;
+//# sourceMappingURL=FileBrainStore.js.map

package/dist/esm/cloud/store/FileBrainStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileBrainStore.js","sourceRoot":"","sources":["../../../../src/cloud/store/FileBrainStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,OAAO,EACL,QAAQ,EACR,eAAe,EACf,SAAS,EACT,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,cAAc,GAAG,SAAS,CAAC;AAiBjC,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,MAAM;SACV,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;SACrE,MAAM,CAAC,KAAK,CAAC;SACb,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;oEACoE;AACpE,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAe,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;gBAAE,SAAS;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;YAChF,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,cAAc;IAMzB,YAAoB,UAAiC,EAAE;QAAnC,YAAO,GAAP,OAAO,CAA4B;QAL9C,SAAI,GAAG,GAAG,CAAC;QAGZ,UAAK,GAA+F,IAAI,CAAC;QAG/G,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;QAC3G,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IACnE,CAAC;IAEO,IAAI;QACV,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IACE,IAAI,CAAC,KAAK;YACV,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YACnC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAC7B,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;mFAG+E;IACvE,IAAI,CAAC,OAAgD;QAC3D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9B,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAQ,CAAyB,CAAC,OAAO,CAAC;YACzF,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,GAAG,CAAe,CAAC;YACjE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/B,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACvD,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAEO,QAAQ,CAAC,CAAa,EAAE,QAAgB;QAC9C,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,cAAc,CAAC,KAAK,QAAQ,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,MAAe;QACzC,MAAM,CAAC,GAAe,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC;QAE9F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACxD,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,QAAmC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAExG,+EAA+E;QAC/E,8EAA8E;QAC9E,iFAAiF;QACjF,iFAAiF;QACjF,8DAA8D;QAC9D,MAAM,IAAI,GAAe;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,EAAE;YACF,KAAK;YACL,QAAQ;YACR,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjG,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC7G,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAK,CAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAe,EAAE,QAAQ,CAAC,CACpG,CAAC;QACF,IAAI,GAAG,IAAI,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;;YAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,EAAU;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAK,CAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAe,EAAE,QAAQ,CAAC,CAC1E,CAAC;QAC5B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa;QACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE;aACrB,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;aAC/E,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEjC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,KAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAI,CAAC,CAAC,KAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAErG,MAAM,MAAM,GAOP,EAAE,CAAC;QACR,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAiB,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,eAAe,CAAC,KAAK,CAAC,CAA2B,EAAE,KAAK,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9I,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAY,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAc,EAAE,OAAO,EAAE,GAAG,CAAC,OAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAkB,EAAE,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC;YAC5D,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ;gBAAE,UAAU,IAAI,IAAI,CAAC;YAC/C,IAAI,CAAC,CAAC,QAAQ;gBAAE,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;aACjC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QAEhC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAgB,EAAE,GAAa;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,SAAS,IAAI,CAAC;gBAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,CAAe,CAAC;YAC5B,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/D,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,GAAG,CAAC;gBACzC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,EAAU;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,CAAE,CAAgB,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAe,EAAE,QAAQ,CAAC,CAAC,CACpG,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,eAAe,cAAc,CAAC"}

package/dist/esm/cloud/store/PostgresBrainStore.d.ts

@@ -0,0 +1,50 @@
+/**
+ * PostgresBrainStore — implementación multi-tenant del contrato BrainStore
+ * (src/contracts/store.ts) sobre PostgreSQL.
+ *
+ * Tablas (ver db/migrations/001_memories.sql): `memories`, `claims`,
+ * `evidence_hashes`, `memory_edges` (derivedFrom).
+ *
+ * SECURITY — regla de oro del lane: TODA consulta sobre tablas protegidas lleva
+ * `tenant_id` en el WHERE. Ninguna fila de un tenant puede ser leída, verificada
+ * ni borrada sin que el tenant llamante forme parte del filtro. El static-grep
+ * test (tests/unit/lane-b-static-grep.test.ts) revienta si aparece un SELECT
+ * sobre estas tablas sin filtro de tenant.
+ *
+ * Búsqueda: BM25 (Okapi, K1=1.5, B=0.75 — los mismos constantes que TheBrainV2)
+ * + re-rank de Jaccard, calculados en SQL sobre el conjunto candidato que arroja
+ * el índice GIN de `terms` (memories.terms && <query terms>), nunca sobre el
+ * corpus entero.
+ */
+import { Pool } from 'pg';
+import { BrainStore, Candidate } from '../../contracts/store';
+export type EvidenceKind = 'file' | 'symbol' | 'symbol_normalized';
+export interface NormalizedMemory {
+    id: string;
+    query: string;
+    response: string;
+    projectId: string | null;
+    terms: string[];
+    termFreq: Record<string, number>;
+    payload: unknown;
+}
+/** Normaliza una memoria arbitraria a la forma persistible, enriqueciéndola con
+ * termes/termFreq si no venía de un Brain que ya las computara. */
+export declare function normalizeMemory(memory: unknown): NormalizedMemory;
+export interface PostgresBrainStoreOptions {
+    /** Máx. candidatos que la búsqueda considera antes de rankear (cota de seguridad). */
+    maxCandidates?: number;
+}
+export declare class PostgresBrainStore implements BrainStore {
+    private pool;
+    private opts;
+    readonly lane = "B";
+    constructor(pool: Pool, opts?: PostgresBrainStoreOptions);
+    put(tenantId: string, memory: unknown): Promise<string>;
+    get(tenantId: string, id: string): Promise<unknown | null>;
+    searchCandidates(tenantId: string, query: string, limit: number): Promise<Candidate[]>;
+    listByIds(tenantId: string, ids: string[]): Promise<Map<string, unknown>>;
+    delete(tenantId: string, id: string): Promise<boolean>;
+}
+export default PostgresBrainStore;
+//# sourceMappingURL=PostgresBrainStore.d.ts.map

package/dist/esm/cloud/store/PostgresBrainStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgresBrainStore.d.ts","sourceRoot":"","sources":["../../../../src/cloud/store/PostgresBrainStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE1B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAI9D,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,mBAAmB,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;CAClB;AAwCD;mEACmE;AACnE,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAwBjE;AAED,MAAM,WAAW,yBAAyB;IACxC,sFAAsF;IACtF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsCD,qBAAa,kBAAmB,YAAW,UAAU;IAGvC,OAAO,CAAC,IAAI;IAAQ,OAAO,CAAC,IAAI;IAF5C,QAAQ,CAAC,IAAI,OAAO;gBAEA,IAAI,EAAE,IAAI,EAAU,IAAI,GAAE,yBAA8B;IAEtE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAsDvD,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAM1D,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAQtF,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQzE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB7D;AAED,eAAe,kBAAkB,CAAC"}