@open-everywhere/core 0.1.0

package/dist/agent/memory/provenance-mark.js

@@ -0,0 +1,276 @@
+// The pure half of the durable memory provenance mark: a bullet added on a turn that ingested external content is re-cast as an attributed claim and takes a machine-readable suffix.
+// 🔴 The claim is TURN-SCOPED — it never says the read came BEFORE the write — and the re-cast only ever INSERTS, because a mangled bullet corrupts a fact while an unhedged one does not.
+import { createHash } from "node:crypto";
+import { HOST_OWNED_FILES } from "./host-owned-files.js";
+/** The suffix's opening token. Also the idempotence test: a line holding it is never marked again. */
+export const EXTERNAL_PROVENANCE_PREFIX = "[external-provenance:";
+/** The in-sentence attribution's opening token (OPE-1210). Also its own idempotence test: a bullet
+ *  already holding it is never re-cast a second time. */
+export const EXTERNAL_CLAIM_PREFIX = "[unverified claim";
+/**
+ * Each carrier's FULL fixed lead-in, up to the point the kind list begins. The renderers below build from these constants, so a carrier's wording and its lead-in cannot drift apart.
+ * 🔴 {@link provenanceCarrierPattern} builds its one strip/extract pattern from these two; changing the mark's SHAPE (a body holding a bracket, or a third carrier) must update that pattern too.
+ */
+const EXTERNAL_CLAIM_LEAD = `${EXTERNAL_CLAIM_PREFIX}; the turn ingested `;
+const EXTERNAL_PROVENANCE_LEAD = `${EXTERNAL_PROVENANCE_PREFIX} added on a turn that ingested `;
+const UNNAMED_SOURCE = "external content";
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * 🔴 It matches each carrier's FULL lead-in, never the bare opening token: these patterns run over EVERY bullet in a silo, so a line that merely opens with such a token must not be read as a carrier and have its words swallowed up to the next `]`.
+ * A BUILDER, not a shared const: the pattern is global, so a cached instance is safe for `String.replace` and `matchAll` but not for `.test()` or `.exec()`, which advance `lastIndex`.
+ */
+export function provenanceCarrierPattern() {
+    return new RegExp(`${escapeRe(EXTERNAL_CLAIM_LEAD)}[^\\][]*\\]|${escapeRe(EXTERNAL_PROVENANCE_LEAD)}[^\\][]*\\]`, "g");
+}
+/** At most this many ingestion kinds are named in one mark. A turn that read six sources gets the
+ *  first four and a `+n more` tail — the suffix is disclosure, not an inventory. */
+export const MAX_MARKED_KINDS = 4;
+/** A kind name longer than this is truncated. The values are OE-composed constants
+ *  (access/taint-tiers.ts `IngestionKind`), never external bytes, so this is a belt on a seam that
+ *  already cannot carry attacker-chosen text. */
+const MAX_KIND_CHARS = 24;
+/** Only these characters survive into a mark. Anything else is dropped, so no future kind can put a
+ *  bracket, a newline or markdown syntax into a memory file. */
+function sanitiseKind(kind) {
+    return kind.toLowerCase().replace(/[^a-z0-9-]/g, "").slice(0, MAX_KIND_CHARS);
+}
+/**
+ * The suffix a marked bullet carries. `kinds` is `taintKindsThisTurn()` — WHICH classes of source the turn ingested.
+ * An EMPTY list is normal and is not "clean": some taint seeds know a turn is tainted and not by what, so they take the unqualified wording rather than a mark implying nothing was read.
+ */
+export function renderProvenanceMark(kinds = []) {
+    return `${EXTERNAL_PROVENANCE_LEAD}${describeKinds(kinds) ?? UNNAMED_SOURCE}]`;
+}
+function describeKinds(kinds) {
+    const named = kinds.map(sanitiseKind).filter((k) => k.length > 0);
+    if (named.length === 0)
+        return null;
+    const shown = named.slice(0, MAX_MARKED_KINDS);
+    const rest = named.length - shown.length;
+    return `${shown.join(", ")}${rest > 0 ? ` +${rest} more` : ""}`;
+}
+/** The attribution a re-cast bullet carries INSIDE its sentence, ahead of the assertion. Same kinds, same turn-scoped claim and same caps as {@link renderProvenanceMark} — the two wordings differ in where they sit, never in what they say. */
+export function renderClaimAttribution(kinds = []) {
+    return `${EXTERNAL_CLAIM_LEAD}${describeKinds(kinds) ?? UNNAMED_SOURCE}]`;
+}
+export function renderProvenanceWording(kinds = []) {
+    return { mark: renderProvenanceMark(kinds), attribution: renderClaimAttribution(kinds) };
+}
+export function isBulletLine(line) {
+    return /^\s*(?:[-*+]|\d+\.)\s+\S/.test(line);
+}
+/** A fence opener/closer (``` or ~~~). Lines between two of them are code and are never marked. */
+function isFenceLine(line) {
+    return /^\s*(?:```|~~~)/.test(line);
+}
+/**
+ * A bullet split in two: group 1 the indent and the marker, group 2 everything after it.
+ * 🔴 `[^\n]*`, NOT `.*`: JS `.` excludes `\r` and `$` without the `m` flag matches only end of input, so `(.*)$` fails on a CRLF line while {@link isBulletLine} still accepts it — which gave a `\r`-terminated bullet the suffix and no in-sentence attribution.
+ */
+const BULLET_HEAD = /^(\s*(?:[-*+]|\d+\.)\s+)([^\n]*)$/;
+/**
+ * The date stamp the house bullet convention puts first. The attribution goes AFTER it, so the date keeps the scanning position every reader and every dream pass expects.
+ * 🔴 This must stay AT LEAST AS WIDE as `dream/ops.ts` DATE_PREFIX, which makes the colon optional: a dated shape that parser reads and this one misses takes the attribution ahead of its date, and `bulletDate` then answers null for the rest of the bullet's life.
+ */
+const DATE_LEAD = /^(\d{4}-\d{2}-\d{2}(?:\s*:\s*|\s+))([^\n]*)$/;
+/**
+ * Any leading date stamp at all, tested on what is left AFTER {@link DATE_LEAD} had its turn.
+ * It refuses a date DATE_LEAD could not split (`2026-08-2299 items`), which would otherwise be hedged mid-token, and a statement whose own first word is a SECOND date — both then take the suffix and nothing more.
+ */
+const ANY_DATE_LEAD = /^\d{4}-\d{2}-\d{2}/;
+/** A statement that already names a source, or already hedges. A second hedge reads as a defect and
+ *  teaches a reader that the wording is noise, so these keep the suffix and nothing more. */
+const ATTRIBUTED_LEAD = /^(?:per\b|according to\b|reportedly\b|alleged(?:ly)?\b|claim(?:s|ed)?\b|unverified\b|rumou?r\b|says?\b|said\b|source\s*:)/i;
+/** A statement that asserts nothing: a task, a reminder or an open question in bullet form. Calling
+ *  one an unverified claim is the mangling this transform refuses, so these keep the suffix only.
+ *  The list is a heuristic and it is deliberately over-broad — every miss lands on tag-only. */
+const NON_ASSERTION_LEAD = /^(?:todo\b|fixme\b|tbd\b|ask\b|check\b|confirm\b|verify\b|chase\b|ping\b|draft\b|review\b|send\b|schedule\b|follow[- ]up\b|remember to\b|note to self\b)/i;
+/**
+ * Below this many words the line is a fragment, not a sentence, and a hedge in front of it reads as nonsense.
+ * A word is a whitespace-separated token holding a letter in ANY script (`\p{L}`), so a script that does not space its words counts as ONE token and such a bullet lands tag-only.
+ */
+const MIN_ASSERTION_WORDS = 3;
+/**
+ * Does this bullet's statement ASSERT something a later reader could absorb as fact? A BLOCKLIST: the rules below name the refused shapes and re-cast everything else, so a shell command or a table row in bullet form does take the hedge.
+ * The insert-only rule bounds that — the worst such a line suffers is a hedge it did not need, never a corrupted fact.
+ */
+function isAssertionShaped(statement) {
+    const text = statement.trim();
+    if (text.endsWith("?"))
+        return false; // a question asserts nothing
+    if (/^\[[ xX]?\]/.test(text))
+        return false; // a task checkbox
+    if (ANY_DATE_LEAD.test(text))
+        return false; // a dated shape DATE_LEAD could not split
+    if (ATTRIBUTED_LEAD.test(text))
+        return false;
+    if (NON_ASSERTION_LEAD.test(text))
+        return false;
+    return text.split(/\s+/).filter((w) => /\p{L}/u.test(w)).length >= MIN_ASSERTION_WORDS;
+}
+/**
+ * Re-cast one assertion-shaped bullet by INSERTING `attribution` ahead of the statement. Returns `line` UNCHANGED for anything else — a non-bullet, a bullet already re-cast, or a statement {@link isAssertionShaped} declines.
+ * Insert-only: no word of the original is dropped, moved or rewritten.
+ */
+export function recastAsAttributedClaim(line, attribution) {
+    if (attribution.length === 0)
+        return line;
+    const head = BULLET_HEAD.exec(line);
+    if (head === null)
+        return line;
+    const rest = head[2];
+    if (rest.includes(EXTERNAL_CLAIM_PREFIX))
+        return line;
+    const dated = DATE_LEAD.exec(rest);
+    const lead = dated?.[1] ?? "";
+    const statement = dated?.[2] ?? rest;
+    if (!isAssertionShaped(statement))
+        return line;
+    return `${head[1]}${lead}${attribution} ${statement}`;
+}
+function carriersOf(line) {
+    let attribution = null;
+    let mark = null;
+    for (const [found] of line.matchAll(provenanceCarrierPattern())) {
+        if (attribution === null && found.startsWith(EXTERNAL_CLAIM_LEAD))
+            attribution = found;
+        if (mark === null && found.startsWith(EXTERNAL_PROVENANCE_LEAD))
+            mark = found;
+    }
+    return { attribution, mark };
+}
+/**
+ * THE DONOR: the FIRST source in `sources` order that holds either carrier, or `undefined` when none does.
+ * ONE definition on purpose — {@link conserveProvenanceOnMerge} copies this source's carriers and `dream/ops.ts` `restatesDonor` tests the survivor against the same answer, and a second donor rule would let the two disagree.
+ */
+export function donorOf(sources) {
+    return sources.find((source) => {
+        const carriers = carriersOf(source);
+        return carriers.attribution !== null || carriers.mark !== null;
+    });
+}
+/**
+ * Returns `survivor` carrying the DONOR's carriers — the FIRST source that discloses. 🔴 NOT a "strictest wins" rule: it compares no two sources, and a survivor already holding EITHER carrier is returned untouched, so such a line can end with half the disclosure.
+ * It never asks whether the survivor restates the donor — the caller decides that — and a survivor whose shape {@link recastAsAttributedClaim} declines takes the donor's suffix alone.
+ */
+export function conserveProvenanceOnMerge(survivor, sources) {
+    const source = donorOf(sources);
+    if (source === undefined)
+        return survivor; // no source disclosed anything
+    const donor = carriersOf(source);
+    const held = carriersOf(survivor);
+    if (held.attribution !== null || held.mark !== null)
+        return survivor; // already discloses
+    let out = survivor;
+    // The attribution goes in FIRST: `recastAsAttributedClaim` inserts ahead of the statement, and
+    // appending the suffix first would leave that suffix inside the sentence it re-casts.
+    if (donor.attribution !== null)
+        out = recastAsAttributedClaim(out, donor.attribution);
+    if (donor.mark !== null)
+        out = `${out.trimEnd()}  ${donor.mark}`;
+    return out;
+}
+/**
+ * A short digest of a line's TRIMMED text, so re-indenting or re-wrapping a file does not read as a tree of new bullets.
+ * Truncated to keep a whole tier's baseline small enough to ride eve `defineState`; a digest collision reads as "this line was already there" ⇒ NO mark, the under-marking direction.
+ */
+export function lineDigest(line) {
+    return createHash("sha1").update(line.trim()).digest("hex").slice(0, 12);
+}
+export function baselineOf(files) {
+    const out = {};
+    for (const [rel, content] of Object.entries(files)) {
+        if (typeof content !== "string")
+            continue;
+        out[rel] = [...new Set(content.split("\n").map(lineDigest))];
+    }
+    return out;
+}
+/** A file the host owns or minted, which the agent's sandbox copy must never be annotated for. */
+function isUnmarkableFile(rel) {
+    return HOST_OWNED_FILES.has(rel) || rel.includes(".conflict-") || rel.includes(".rejected-");
+}
+/**
+ * How many DISTINCT marked lines one file holds, counted ONCE PER CARRIER: {@link guardProvenanceMarks} refuses a rewrite that loses a mark, so a rewrite stripping the in-sentence attribution while keeping the suffix must not read as conserved.
+ * DISTINCT rather than raw, per carrier: dropping one of two byte-identical marked bullets loses no disclosure and must not be refused for it.
+ */
+function distinctMarkedLines(content) {
+    const suffixed = new Set();
+    const attributed = new Set();
+    let fenced = false;
+    for (const line of content.split("\n")) {
+        // FENCE-AWARE, exactly like {@link markAddedBullets}: inside a fence a `- ` line is code, so the
+        // pass never wrote a mark there and this must not read one. Otherwise a file whose code block
+        // happens to hold the token would freeze against every tidy for the rest of its life.
+        if (isFenceLine(line)) {
+            fenced = !fenced;
+            continue;
+        }
+        if (fenced || !isBulletLine(line))
+            continue;
+        if (line.includes(EXTERNAL_PROVENANCE_PREFIX))
+            suffixed.add(line.trim());
+        if (line.includes(EXTERNAL_CLAIM_PREFIX))
+            attributed.add(line.trim());
+    }
+    return suffixed.size + attributed.size;
+}
+/**
+ * REFUSE ANY REWRITE THAT LOSES A PROVENANCE MARK: per file, when the rewrite holds fewer DISTINCT marked carriers than the before bytes, the BEFORE bytes are kept and the file is named in `reverted`.
+ * CONSERVATION, not preservation — it never re-attaches a mark to a line another pass rewrote, so a reorder or a `[[link]]` fix inside a marked bullet is admitted, while stripping a carrier, deleting a marked bullet or merging two distinct ones is refused.
+ */
+export function guardProvenanceMarks(before, after) {
+    const files = {};
+    const reverted = [];
+    for (const [rel, content] of Object.entries(after)) {
+        const was = before[rel];
+        if (typeof content !== "string" || typeof was !== "string" || was === content) {
+            files[rel] = content;
+            continue;
+        }
+        if (distinctMarkedLines(content) < distinctMarkedLines(was)) {
+            files[rel] = was;
+            reverted.push(rel);
+            continue;
+        }
+        files[rel] = content;
+    }
+    return { files, reverted };
+}
+/**
+ * Re-cast and mark every bullet the `baseline` did not hold: the attribution goes into the sentence where the shape allows it, and the mark is appended either way.
+ * A file ABSENT from the baseline counts as created this turn, so every bullet in it is new — the one place a baseline gap over-marks rather than under-marks.
+ */
+export function markAddedBullets(baseline, files, wording) {
+    const changed = {};
+    let marked = 0;
+    for (const [rel, content] of Object.entries(files)) {
+        if (typeof content !== "string" || isUnmarkableFile(rel))
+            continue;
+        const held = new Set(baseline[rel] ?? []);
+        const lines = content.split("\n");
+        const out = [];
+        let fenced = false;
+        let fileChanged = false;
+        for (const line of lines) {
+            if (isFenceLine(line)) {
+                fenced = !fenced;
+                out.push(line);
+                continue;
+            }
+            if (fenced || !isBulletLine(line) || line.includes(EXTERNAL_PROVENANCE_PREFIX) || held.has(lineDigest(line))) {
+                out.push(line);
+                continue;
+            }
+            out.push(`${recastAsAttributedClaim(line, wording.attribution).trimEnd()}  ${wording.mark}`);
+            fileChanged = true;
+            marked++;
+        }
+        if (fileChanged)
+            changed[rel] = out.join("\n");
+    }
+    return { files: changed, marked };
+}
+//# sourceMappingURL=provenance-mark.js.map

package/dist/agent/memory/provenance-mark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance-mark.js","sourceRoot":"","sources":["../../../agent/memory/provenance-mark.ts"],"names":[],"mappings":"AAAA,sLAAsL;AACtL,2LAA2L;AAE3L,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGzD,sGAAsG;AACtG,MAAM,CAAC,MAAM,0BAA0B,GAAG,uBAAuB,CAAC;AAElE;yDACyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAEzD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,GAAG,qBAAqB,sBAAsB,CAAC;AAC3E,MAAM,wBAAwB,GAAG,GAAG,0BAA0B,iCAAiC,CAAC;AAEhG,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAE1C,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,IAAI,MAAM,CAAC,GAAG,QAAQ,CAAC,mBAAmB,CAAC,eAAe,QAAQ,CAAC,wBAAwB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AACzH,CAAC;AAED;oFACoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC;;iDAEiD;AACjD,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;gEACgE;AAChE,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAK,GAAsB,EAAE;IAChE,OAAO,GAAG,wBAAwB,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,cAAc,GAAG,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,KAAwB;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IACzC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,kPAAkP;AAClP,MAAM,UAAU,sBAAsB,CAAC,KAAK,GAAsB,EAAE;IAClE,OAAO,GAAG,mBAAmB,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,cAAc,GAAG,CAAC;AAC5E,CAAC;AAUD,MAAM,UAAU,uBAAuB,CAAC,KAAK,GAAsB,EAAE;IACnE,OAAO,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,mGAAmG;AACnG,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAExD;;;GAGG;AACH,MAAM,SAAS,GAAG,8CAA8C,CAAC;AAEjE;;;GAGG;AACH,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C;6FAC6F;AAC7F,MAAM,eAAe,GAAG,4HAA4H,CAAC;AAErJ;;gGAEgG;AAChG,MAAM,kBAAkB,GAAG,2JAA2J,CAAC;AAEvL;;;GAGG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,6BAA6B;IACnE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;IAC9D,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,0CAA0C;IACtF,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,mBAAmB,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,WAAmB;IACvE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACrC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,IAAI,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;AACzD,CAAC;AAOD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,WAAW,GAAG,KAAK,CAAC;QACvF,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC;YAAE,IAAI,GAAG,KAAK,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAA0B;IAChD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC,WAAW,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB,EAAE,OAA0B;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,CAAC,+BAA+B;IAC1E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,CAAC,oBAAoB;IAC1F,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,+FAA+F;IAC/F,sFAAsF;IACtF,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;QAAE,GAAG,GAAG,uBAAuB,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtF,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;QAAE,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAKD,MAAM,UAAU,UAAU,CAAC,KAAkB;IAC3C,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,GAAW;IACnC,OAAO,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AAC/F,CAAC;AAUD;;;GAGG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,iGAAiG;QACjG,8FAA8F;QAC9F,sFAAsF;QACtF,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;AACzC,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAmB,EAAE,KAAkB;IAC1E,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,mBAAmB,CAAC,OAAO,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B,EAAE,KAAkB,EAAE,OAA0B;IAC3G,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC;YAAE,SAAS;QACnE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,MAAM,GAAG,CAAC,MAAM,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7G,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7F,WAAW,GAAG,IAAI,CAAC;YACnB,MAAM,EAAE,CAAC;QACX,CAAC;QACD,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC"}

package/dist/agent/memory/provenance.d.ts

@@ -0,0 +1,8 @@
+/** Idempotent on re-stamping: a second admin write on an already-marked file replaces the marker with a fresh timestamp rather than stacking a second one. */
+export declare function stampHumanEdit(content: string, at?: Date): string;
+export declare function isHumanEdited(content: string): boolean;
+export declare function humanEditedAt(content: string): string | null;
+/** The subset of `files`' relPaths that carry the human-edit marker — the dream cycle's
+ *  skip-set for destructive (propose-only) detection (memory/dream/tidy.ts). */
+export declare function humanEditedFiles(files: Readonly<Record<string, string>>): ReadonlySet<string>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/agent/memory/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../agent/memory/provenance.ts"],"names":[],"mappings":"AAKA,8JAA8J;AAC9J,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,MAAM,CAG7E;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5D;AAED;gFACgF;AAChF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAM7F"}

package/dist/agent/memory/provenance.js

@@ -0,0 +1,25 @@
+// An in-file human-edit marker, stamped only by the memory-admin direct write path: the dream cycle never reads the audit log, so without this signal its destructive detectors could propose correcting a human's just-written fact back out.
+// An HTML comment, not frontmatter, so it is inert to every existing reader — not a bullet, not a `[[link]]` — and it roundtrips through the safe tidy ops.
+const MARKER_RE = /^<!-- oe:human-edit edited_by="human" edited_at="([^"]*)" -->\n?/;
+/** Idempotent on re-stamping: a second admin write on an already-marked file replaces the marker with a fresh timestamp rather than stacking a second one. */
+export function stampHumanEdit(content, at = new Date()) {
+    const stripped = content.replace(MARKER_RE, "");
+    return `<!-- oe:human-edit edited_by="human" edited_at="${at.toISOString()}" -->\n${stripped}`;
+}
+export function isHumanEdited(content) {
+    return MARKER_RE.test(content);
+}
+export function humanEditedAt(content) {
+    return content.match(MARKER_RE)?.[1] ?? null;
+}
+/** The subset of `files`' relPaths that carry the human-edit marker — the dream cycle's
+ *  skip-set for destructive (propose-only) detection (memory/dream/tidy.ts). */
+export function humanEditedFiles(files) {
+    const out = new Set();
+    for (const [rel, content] of Object.entries(files)) {
+        if (isHumanEdited(content))
+            out.add(rel);
+    }
+    return out;
+}
+//# sourceMappingURL=provenance.js.map

package/dist/agent/memory/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../agent/memory/provenance.ts"],"names":[],"mappings":"AAAA,+OAA+O;AAC/O,4JAA4J;AAE5J,MAAM,SAAS,GAAG,kEAAkE,CAAC;AAErF,8JAA8J;AAC9J,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,mDAAmD,EAAE,CAAC,WAAW,EAAE,UAAU,QAAQ,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/C,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,KAAuC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,IAAI,aAAa,CAAC,OAAO,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/agent/memory/provider.d.ts

@@ -0,0 +1,76 @@
+import type { Partition } from "./partition.js";
+import type { MemorySilo } from "./silo.js";
+import type { CredentialBoundDomain } from "../access/domain-credentials.js";
+import { type PgClient } from "./postgres.js";
+import { type MemoryFiles, type Tier } from "./store.js";
+/**
+ * Whose credential a call runs under: the seam carries the DOMAIN rather than a credential id, so each backing resolves its own role and core stays vendor-string-free.
+ * An absent `domain` must read as the ORG DEFAULT, never as a refusal; a binding naming a credential the provider does not carry fails CLOSED in the backing.
+ */
+export interface MemoryAccess {
+    /** The domain whose memory list named this silo, when exactly one is known. */
+    readonly domain?: CredentialBoundDomain;
+}
+/**
+ * A durable, host-side memory backend, scoped by (Partition, Tier). All methods are
+ * tier-scoped — isolation between surfaces/workspaces/DMs is the caller's partition,
+ * which a multi-tenant provider additionally enforces at rest (org_id + RLS).
+ */
+export interface MemoryProvider {
+    readonly id: string;
+    /**
+     * Read one tier's files — an empty object when the tier does not exist yet.
+     * `silo` carries the container and path for backends whose location is not derivable from the partition and tier (github, notion); the local backends ignore it.
+     */
+    readTier(p: Partition, tier: Tier, silo?: MemorySilo, access?: MemoryAccess): Promise<MemoryFiles>;
+    /** Ensure a tier exists (seeding on first sight); return its current files. */
+    ensureTier(p: Partition, tier: Tier, silo?: MemorySilo, access?: MemoryAccess): Promise<MemoryFiles>;
+    /**
+     * Upsert a full file set for one tier. Returns an opaque version token (a git sha
+     * today, a row/version id under SQL) or null when nothing changed.
+     */
+    writeTier(p: Partition, tier: Tier, files: MemoryFiles, message: string, silo?: MemorySilo, access?: MemoryAccess): Promise<string | null>;
+    /**
+     * Erase a tier. Under SQL this is a real DELETE (true erasure); the git/github
+     * providers remove the working files but history retains them (documented).
+     * Idempotent — deleting an absent tier is a no-op.
+     */
+    deleteTier(p: Partition, tier: Tier, silo?: MemorySilo, access?: MemoryAccess): Promise<void>;
+    /**
+     * A CHEAP probe of a tier's current version — an opaque token from `writeTier`'s family that changes whenever the tier's durable content changes, without reading the files. `null` when the tier does not exist.
+     * OPTIONAL: hooks/memory.ts never re-pulls a silo mid-session on a backend that omits it.
+     */
+    tierVersion?(p: Partition, tier: Tier, silo?: MemorySilo, access?: MemoryAccess): Promise<string | null>;
+    /**
+     * Delete ONE file from a tier, returning an opaque version token or `null` when the file was not there.
+     * Separate because `writeTier` is UPSERT-ONLY — no implementation removes a file just because a call omits it — so a caller that needs real per-file deletion checks for this method and fails loud.
+     */
+    deleteFile?(p: Partition, tier: Tier, relPath: string, silo?: MemorySilo, access?: MemoryAccess): Promise<string | null>;
+    /** Inspectable backends (git/sqlite) expose a path; remote ones may not. */
+    root?(): string;
+}
+export declare const gitProvider: MemoryProvider;
+/**
+ * Register the Postgres provider with a deploy-supplied client (Neon serverless,
+ * node-postgres, or pglite — anything matching {@link PgClient}). Call once at
+ * startup, then select it with `OE_MEMORY_PROVIDER=postgres`. Run
+ * `initPostgresSchema(client)` first (and, for RLS, connect as an app role).
+ */
+export declare function registerPostgres(client: PgClient): MemoryProvider;
+/** The active durable memory backend (singleton, env-selected). */
+export declare function getProvider(): MemoryProvider;
+export declare function registerProvider(provider: MemoryProvider): void;
+/**
+ * Resolve a provider by id — the per-SILO selector, distinct from the env-selected {@link getProvider} singleton, because one deployment can run silos on different backends at once.
+ * Throws for an unknown or unregistered id rather than silently dropping memory.
+ */
+export declare function providerById(id: string | undefined): MemoryProvider;
+/**
+ * The id of the DURABLE DB provider — where DM/personal memory is HARD-pinned (it must
+ * never land in git/Notion). "postgres" when it's the selected, registered backend;
+ * otherwise "sqlite" (the local DB floor). Never returns "git".
+ */
+export declare function dbProviderId(): string;
+/** Test seam: reset the memoized selection. */
+export declare function resetProvider(): void;
+//# sourceMappingURL=provider.d.ts.map

package/dist/agent/memory/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../agent/memory/provider.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEpE,OAAO,EAQL,KAAK,WAAW,EAChB,KAAK,IAAI,EACV,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEnG,+EAA+E;IAC/E,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAErG;;;OAGG;IACH,SAAS,CACP,CAAC,EAAE,SAAS,EACZ,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,UAAU,EACjB,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAE1B;;;;OAIG;IACH,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9F;;;OAGG;IACH,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzG;;;OAGG;IACH,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEzH,4EAA4E;IAC5E,IAAI,CAAC,IAAI,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,WAAW,EAAE,cASzB,CAAC;AASF;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,QAAQ,GAAG,cAAc,CAIjE;AAID,mEAAmE;AACnE,wBAAgB,WAAW,IAAI,cAAc,CAiB5C;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,cAAc,CAenE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAerC;AAED,+CAA+C;AAC/C,wBAAgB,aAAa,IAAI,IAAI,CAEpC"}

package/dist/agent/memory/provider.js

@@ -0,0 +1,96 @@
+// The MemoryProvider seam: where a tier's files DURABLY live between sessions, swappable without the agent or its callers changing. The agent always works against the `/workspace/memory/<tier>/` files a session materialises.
+// DM/personal memory must never land in git — see {@link dbProviderId}.
+import { sqliteProvider } from "./sqlite.js";
+import { makePostgresProvider } from "./postgres.js";
+import { onVercel } from "../access/platform.js";
+import { deleteTier as gitDeleteTier, deleteFile as gitDeleteFile, ensureTier as gitEnsureTier, readTier as gitReadTier, storeRoot as gitStoreRoot, tierVersion as gitTierVersion, writeTier as gitWriteTier, } from "./store.js";
+export const gitProvider = {
+    id: "git",
+    readTier: gitReadTier,
+    ensureTier: gitEnsureTier,
+    writeTier: gitWriteTier,
+    tierVersion: gitTierVersion,
+    deleteTier: gitDeleteTier,
+    deleteFile: gitDeleteFile,
+    root: gitStoreRoot,
+};
+// Provider registry, selected by `OE_MEMORY_PROVIDER`.
+// postgres is NOT pre-registered: it needs a deploy-supplied client, so startup wiring must call `registerPostgres(client)`.
+const REGISTRY = {
+    git: gitProvider,
+    sqlite: sqliteProvider,
+};
+/**
+ * Register the Postgres provider with a deploy-supplied client (Neon serverless,
+ * node-postgres, or pglite — anything matching {@link PgClient}). Call once at
+ * startup, then select it with `OE_MEMORY_PROVIDER=postgres`. Run
+ * `initPostgresSchema(client)` first (and, for RLS, connect as an app role).
+ */
+export function registerPostgres(client) {
+    const provider = makePostgresProvider(client);
+    registerProvider(provider);
+    return provider;
+}
+let active = null;
+/** The active durable memory backend (singleton, env-selected). */
+export function getProvider() {
+    if (active)
+        return active;
+    const id = process.env.OE_MEMORY_PROVIDER ?? "git";
+    const provider = REGISTRY[id];
+    if (!provider) {
+        if (id === "postgres") {
+            throw new Error('OE_MEMORY_PROVIDER="postgres" but no client is registered — call ' +
+                "registerPostgres(client) at startup (see docs/setup.md).");
+        }
+        throw new Error(`unknown OE_MEMORY_PROVIDER "${id}" (have: ${Object.keys(REGISTRY).join(", ")})`);
+    }
+    active = provider;
+    return provider;
+}
+export function registerProvider(provider) {
+    REGISTRY[provider.id] = provider;
+}
+/**
+ * Resolve a provider by id — the per-SILO selector, distinct from the env-selected {@link getProvider} singleton, because one deployment can run silos on different backends at once.
+ * Throws for an unknown or unregistered id rather than silently dropping memory.
+ */
+export function providerById(id) {
+    if (!id) {
+        // Every silo is materialized and `provider` is required (memory/silo.ts) — reaching here
+        // with no id means a malformed silo slipped past assertSilosValid. Fail loud.
+        throw new Error("memory provider requested for a silo with no provider — malformed silo (wiring bug).");
+    }
+    const provider = REGISTRY[id];
+    if (!provider) {
+        throw new Error(`unknown memory provider "${id}" — a silo references it but it isn't registered ` +
+            `(have: ${Object.keys(REGISTRY).join(", ")}). For "postgres" call registerPostgres(); ` +
+            `for "github"/"notion" wire the adapter (docs/capabilities/memory.md).`);
+    }
+    return provider;
+}
+/**
+ * The id of the DURABLE DB provider — where DM/personal memory is HARD-pinned (it must
+ * never land in git/Notion). "postgres" when it's the selected, registered backend;
+ * otherwise "sqlite" (the local DB floor). Never returns "git".
+ */
+export function dbProviderId() {
+    if (process.env.OE_MEMORY_PROVIDER === "postgres" && REGISTRY["postgres"])
+        return "postgres";
+    // FAIL-LOUD on serverless: falling back to sqlite for DM/personal memory on Vercel means
+    // writing to a per-instance, ephemeral file — a memory write reports success and the fact
+    // vanishes on the next cold start (silent data loss on the one memory the user most expects
+    // to persist). Refuse rather than pretend. Locally (off Vercel) sqlite is the correct floor.
+    if (onVercel() && process.env.OE_ALLOW_EPHEMERAL_MEMORY !== "1") {
+        throw new Error("DM/personal memory has no durable backing on Vercel — sqlite is per-instance and ephemeral " +
+            "(a memory write would report success but be lost on the next cold start). Set " +
+            "OE_MEMORY_PROVIDER=postgres and register a client (docs/deploy/setup-runbook.md), or " +
+            "OE_ALLOW_EPHEMERAL_MEMORY=1 to accept ephemeral personal memory on a single-instance host.");
+    }
+    return "sqlite";
+}
+/** Test seam: reset the memoized selection. */
+export function resetProvider() {
+    active = null;
+}
+//# sourceMappingURL=provider.js.map

package/dist/agent/memory/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../agent/memory/provider.ts"],"names":[],"mappings":"AAAA,iOAAiO;AACjO,wEAAwE;AAKxE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAiB,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EACL,UAAU,IAAI,aAAa,EAC3B,UAAU,IAAI,aAAa,EAC3B,UAAU,IAAI,aAAa,EAC3B,QAAQ,IAAI,WAAW,EACvB,SAAS,IAAI,YAAY,EACzB,WAAW,IAAI,cAAc,EAC7B,SAAS,IAAI,YAAY,GAG1B,MAAM,YAAY,CAAC;AAgEpB,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,EAAE,EAAE,KAAK;IACT,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,SAAS,EAAE,YAAY;IACvB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,YAAY;CACnB,CAAC;AAEF,uDAAuD;AACvD,6HAA6H;AAC7H,MAAM,QAAQ,GAAmC;IAC/C,GAAG,EAAE,WAAW;IAChB,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgB;IAC/C,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,IAAI,MAAM,GAA0B,IAAI,CAAC;AAEzC,mEAAmE;AACnE,MAAM,UAAU,WAAW;IACzB,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,EAAE,KAAK,UAAU,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,mEAAmE;gBACjE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+BAA+B,EAAE,YAAY,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,QAAQ,CAAC;IAClB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,EAAsB;IACjD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,4BAA4B,EAAE,mDAAmD;YAC/E,UAAU,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C;YACvF,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7F,yFAAyF;IACzF,0FAA0F;IAC1F,4FAA4F;IAC5F,6FAA6F;IAC7F,IAAI,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,6FAA6F;YAC3F,gFAAgF;YAChF,uFAAuF;YACvF,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/agent/memory/purge-redaction.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SHA-256 hex over the line with TRAILING whitespace trimmed — the same normalisation removeBulletLine and removeBulletLineWhere apply before comparing.
+ * Hashing a line and hashing what the remover matched can therefore never disagree over trailing spaces.
+ */
+export declare function bulletSha256(bullet: string): string;
+/** The display form wherever a durable or derived surface would otherwise show the verbatim bullet: a short hash prefix to correlate with the audit row, never the content. */
+export declare function redactedBulletLabel(sha256: string, chars?: number): string;
+/** The digest-only counterpart of memory/markdown.ts's removeBulletLine, so the purge execute path's frozen args never need the verbatim bullet to locate the line. */
+export declare function removeBulletLineBySha(content: string, sha256: string): {
+    content: string;
+    removed: boolean;
+};
+/**
+ * Removes EVERY line hashing to one of the digests — one purge may span several bullets, files and silos.
+ * Returns the count removed, so the caller can audit how many lines went without ever holding the lines.
+ */
+export declare function removeBulletLinesBySha(content: string, sha256s: readonly string[]): {
+    content: string;
+    removed: number;
+};
+/**
+ * The digests of the non-blank lines host had that next no longer contains anywhere — the deletion audit records hash and length, never the removed content.
+ * Membership, not position, is the measure: a reorder or a re-format drops nothing, and only genuine subtraction shows up here.
+ */
+export declare function removedLineDigests(host: string, next: string): readonly {
+    sha256: string;
+    chars: number;
+}[];
+//# sourceMappingURL=purge-redaction.d.ts.map

package/dist/agent/memory/purge-redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-redaction.d.ts","sourceRoot":"","sources":["../../../agent/memory/purge-redaction.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,+KAA+K;AAC/K,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1E;AAED,uKAAuK;AACvK,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAE5G;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAaxH;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,CAmB3G"}

package/dist/agent/memory/purge-redaction.js

@@ -0,0 +1,65 @@
+// The verbatim bullet must NEVER reach a durable store. The audit log sits outside the erasure path, so only a SHA-256 of the line and its length are stored.
+// Honest scope: a hash of a low-entropy fact is brute-forceable, and a git-backed silo keeps the pre-purge content in commit history — true erasure needs the SQL backings.
+import { createHash } from "node:crypto";
+import { removeBulletLineWhere } from "./markdown.js";
+/**
+ * SHA-256 hex over the line with TRAILING whitespace trimmed — the same normalisation removeBulletLine and removeBulletLineWhere apply before comparing.
+ * Hashing a line and hashing what the remover matched can therefore never disagree over trailing spaces.
+ */
+export function bulletSha256(bullet) {
+    return createHash("sha256").update(bullet.replace(/[ \t]+$/, "")).digest("hex");
+}
+/** The display form wherever a durable or derived surface would otherwise show the verbatim bullet: a short hash prefix to correlate with the audit row, never the content. */
+export function redactedBulletLabel(sha256, chars) {
+    const size = typeof chars === "number" && chars > 0 ? `, ${chars} chars` : "";
+    return `(content redacted — sha256 ${sha256.slice(0, 12)}…${size})`;
+}
+/** The digest-only counterpart of memory/markdown.ts's removeBulletLine, so the purge execute path's frozen args never need the verbatim bullet to locate the line. */
+export function removeBulletLineBySha(content, sha256) {
+    return removeBulletLineWhere(content, (line) => bulletSha256(line) === sha256);
+}
+/**
+ * Removes EVERY line hashing to one of the digests — one purge may span several bullets, files and silos.
+ * Returns the count removed, so the caller can audit how many lines went without ever holding the lines.
+ */
+export function removeBulletLinesBySha(content, sha256s) {
+    const wanted = new Set(sha256s);
+    let out = content;
+    let removed = 0;
+    // Loop per digest: removeBulletLineWhere strips the FIRST match, and the same fact can be
+    // duplicated within one file, so keep going until a pass removes nothing.
+    for (;;) {
+        const next = removeBulletLineWhere(out, (line) => wanted.has(bulletSha256(line)));
+        if (!next.removed)
+            break;
+        out = next.content;
+        removed++;
+    }
+    return { content: out, removed };
+}
+/**
+ * The digests of the non-blank lines host had that next no longer contains anywhere — the deletion audit records hash and length, never the removed content.
+ * Membership, not position, is the measure: a reorder or a re-format drops nothing, and only genuine subtraction shows up here.
+ */
+export function removedLineDigests(host, next) {
+    if (typeof host !== "string" || typeof next !== "string")
+        return [];
+    const kept = new Set(next
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0));
+    const seen = new Set();
+    const out = [];
+    for (const raw of host.split("\n")) {
+        const line = raw.trim();
+        if (line.length === 0 || kept.has(line))
+            continue;
+        const sha256 = bulletSha256(line);
+        if (seen.has(sha256))
+            continue;
+        seen.add(sha256);
+        out.push({ sha256, chars: line.length });
+    }
+    return out;
+}
+//# sourceMappingURL=purge-redaction.js.map

package/dist/agent/memory/purge-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge-redaction.js","sourceRoot":"","sources":["../../../agent/memory/purge-redaction.ts"],"names":[],"mappings":"AAAA,8JAA8J;AAC9J,4KAA4K;AAE5K,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,+KAA+K;AAC/K,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAc;IAChE,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,8BAA8B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;AACtE,CAAC;AAED,uKAAuK;AACvK,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAAc;IACnE,OAAO,qBAAqB,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,OAA0B;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,0FAA0F;IAC1F,0EAA0E;IAC1E,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM;QACzB,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAY;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,IAAI;SACD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAC/B,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAwC,EAAE,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}