@pyxmate/memory 1.26.6 → 1.27.1

package/dist/cli/pyx-mem.mjs

@@ -1,4185 +1,7 @@
 #!/usr/bin/env node
-import "../chunk-6EEEOV6B.mjs";
 import {
-  PERSISTENT_MEMORY_SECTION,
-  buildDesignGuide
-} from "../chunk-QD7G23CN.mjs";
-import {
-  MEMORY_PROJECT_LABEL_MAX_CHARS,
-  TAXONOMY_MAX_CATEGORIES,
-  TAXONOMY_MAX_PROJECTS,
-  TAXONOMY_MAX_SAMPLE_TOPICS,
-  TAXONOMY_MAX_TOP_ENTITIES
-} from "../chunk-KZKGRND2.mjs";
-import {
-  HOSTED_FILE_INGEST_PROTOCOL,
-  HOSTED_FILE_INGEST_RETRYABLE_CODES,
-  parseHostedFileIngestAuthorization,
-  parseHostedFileIngestCommitResult,
-  parseHostedFileIngestJobView,
-  parseHostedFileIngestPublishResult,
-  requireHostedFileIngestFilename
-} from "../chunk-HTQBKJTD.mjs";
-
-// src/cli/exit-codes.ts
-var EXIT = {
-  OK: 0,
-  DOCTOR_FAIL: 1,
-  USAGE: 2,
-  NOT_LOGGED_IN: 3,
-  CRED_UNAVAILABLE: 4,
-  PROVIDER_BROKEN: 5,
-  BUSY: 6,
-  CLEANUP_PENDING: 7,
-  CANCELLED: 8
-};
-
-// src/cli/lifecycle/journal.ts
-import { createHash } from "crypto";
-
-// src/cli/keychain/errors.ts
-var PLATFORM_GUIDANCE = {
-  darwin: {
-    code: "macos-keychain-denied",
-    message: "macOS Keychain is locked or access was denied.",
-    guidance: "Unlock Keychain Access, approve the pyx-mem prompt, then run: pyx-mem login"
-  },
-  linuxMissing: {
-    code: "linux-secret-service-missing",
-    message: "Linux Secret Service is unavailable.",
-    guidance: "Install and start a Secret Service provider such as gnome-keyring or KWallet, then run: pyx-mem login"
-  },
-  linuxDaemon: {
-    code: "linux-secret-service-not-running",
-    message: "Linux Secret Service is installed but no keyring daemon is reachable.",
-    guidance: "Start a DBus session and unlock gnome-keyring or KWallet, then run: pyx-mem login"
-  },
-  win32: {
-    code: "windows-credential-manager-unavailable",
-    message: "Windows Credential Manager is unavailable for this user session.",
-    guidance: "Enable Credential Manager and run pyx-mem from a normal Windows user session, then run: pyx-mem login"
-  }
-};
-var PROVIDER_IMPORT = {
-  code: "provider-import-failed",
-  message: "pyx-mem credential provider failed to load (@napi-rs/keyring).",
-  guidance: "Reinstall @pyxmate/memory; optional native keyring binaries may be missing for this platform. Re-run with `npm install --include=optional` if a package manager omitted them."
-};
-var RECORD_INVALID = {
-  code: "credential-record-invalid",
-  message: "Stored pyx-memory credentials are unreadable (schema mismatch or JSON corruption).",
-  guidance: "Run: pyx-mem logout && pyx-mem login"
-};
-var KeychainError = class extends Error {
-  code;
-  guidance;
-  exit;
-  constructor(args) {
-    super(args.message);
-    this.name = "KeychainError";
-    this.code = args.code;
-    this.guidance = args.guidance;
-    this.exit = args.exit;
-    if (args.cause !== void 0) this.cause = args.cause;
-  }
-};
-function platformAccessError(cause) {
-  const platform = process.platform;
-  const profile = platform === "darwin" ? PLATFORM_GUIDANCE.darwin : platform === "win32" ? PLATFORM_GUIDANCE.win32 : isHeadlessLinuxDaemon(cause) ? PLATFORM_GUIDANCE.linuxDaemon : PLATFORM_GUIDANCE.linuxMissing;
-  return new KeychainError({ ...profile, exit: EXIT.CRED_UNAVAILABLE, cause });
-}
-function providerImportError(cause) {
-  return new KeychainError({ ...PROVIDER_IMPORT, exit: EXIT.PROVIDER_BROKEN, cause });
-}
-function recordInvalidError(cause) {
-  return new KeychainError({ ...RECORD_INVALID, exit: EXIT.NOT_LOGGED_IN, cause });
-}
-function isHeadlessLinuxDaemon(cause) {
-  if (process.platform !== "linux") return false;
-  const msg = causeMessage(cause).toLowerCase();
-  return msg.includes("dbus") || msg.includes("session bus") || msg.includes("no such interface");
-}
-function causeMessage(cause) {
-  if (cause instanceof Error) return cause.message;
-  if (typeof cause === "string") return cause;
-  return "";
-}
-
-// src/cli/lifecycle/api.ts
-var REQUEST_TIMEOUT_MS = 15e3;
-var MAX_RESPONSE_BYTES = 64 * 1024;
-var MAX_ENDPOINT_CHARS = 256;
-var REQUEST_ID_RE = /^[A-Za-z0-9_-]{43}$/;
-var PROJECT_KEY_RE = /^pyx_proj_[A-Za-z0-9_-]{16,160}$/;
-var ERROR_MESSAGES = {
-  busy: { message: "Another pyx-mem sign-in or sign-out is in progress.", retryable: true },
-  cleanup_pending: {
-    message: "Cleanup of an earlier sign-in or sign-out is still pending. Run: pyx-mem login-recovery",
-    retryable: true
-  },
-  invalid_endpoint: {
-    message: "Endpoint must be an https URL (http only for loopback) without credentials, query or fragment.",
-    retryable: false
-  },
-  untrusted_authorization_url: {
-    message: "The server returned a browser sign-in address that is not trusted for this endpoint.",
-    retryable: false
-  },
-  browser_login_unsupported: {
-    message: "This endpoint does not support browser sign-in. Use: pyx-mem login --api-key",
-    retryable: false
-  },
-  network_error: { message: "Could not reach the pyx-memory server.", retryable: true },
-  rate_limited: { message: "Too many sign-in attempts. Wait a minute and retry.", retryable: true },
-  expired: { message: "The sign-in request expired before it was completed.", retryable: true },
-  project_not_eligible: {
-    message: "That project can no longer be connected from this account.",
-    retryable: true
-  },
-  credential_changed: {
-    message: "The stored pyx-memory credential was changed by another program. Nothing was overwritten.",
-    retryable: true
-  },
-  lock_lost: {
-    message: "The sign-in was interrupted. Run: pyx-mem login-recovery",
-    retryable: true
-  },
-  credential_store_unavailable: {
-    message: "The OS credential store is unavailable.",
-    retryable: false
-  },
-  journal_invalid: {
-    message: 'The pending-cleanup record in the OS credential store is unreadable. Nothing was deleted, and pyx-memory stays blocked on this computer. To reset: revoke unexpected "Pyx CLI" keys in the dashboard, then run: pyx-mem login-recovery --discard-unreadable-journal (this signs this computer out).',
-    retryable: false
-  },
-  login_failed: { message: "Browser sign-in failed.", retryable: true }
-};
-var SERVER_CODES = {
-  rate_limited: "rate_limited",
-  cli_login_expired_or_unknown: "expired",
-  cli_login_project_not_eligible: "project_not_eligible",
-  cli_login_cancelled: "cancelled",
-  cli_login_denied: "cancelled"
-};
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "[::1]"]);
-var BROWSER_ORIGINS = {
-  "https://memory.api.pyxmate.com": "https://memory.pyxmate.com"
-};
-function parseSafeUrl(input) {
-  let url;
-  try {
-    url = new URL(input);
-  } catch {
-    return null;
-  }
-  const secure = url.protocol === "https:" || url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname);
-  if (!secure || url.username !== "" || url.password !== "" || url.hash !== "") return null;
-  return url;
-}
-function parseEndpoint(input) {
-  const url = parseSafeUrl(input);
-  if (url === null || url.search !== "" || input.includes("?") || input.includes("#")) return null;
-  const normalized = url.href.replace(/\/+$/, "");
-  return normalized.length <= MAX_ENDPOINT_CHARS ? normalized : null;
-}
-function boundLabel(value, maxChars) {
-  let label2 = value.replace(/\p{Cc}/gu, "").slice(0, maxChars);
-  while (JSON.stringify(label2).length - 2 > maxChars) label2 = label2.slice(0, -1);
-  return label2;
-}
-function isTrustedAuthorizationUrl(authorizationUrl, endpoint, requestId) {
-  const url = parseSafeUrl(authorizationUrl);
-  if (url === null) return false;
-  const api = new URL(endpoint);
-  const trustedOrigin = LOOPBACK_HOSTS.has(api.hostname) ? LOOPBACK_HOSTS.has(url.hostname) : url.origin === (BROWSER_ORIGINS[api.origin] ?? api.origin);
-  const params = [...url.searchParams];
-  return trustedOrigin && url.pathname === "/cli/authorize" && params.length === 1 && params[0]?.[0] === "request" && params[0][1] === requestId;
-}
-async function readBounded(res) {
-  const reader = res.body?.getReader();
-  if (!reader) return void 0;
-  const chunks = [];
-  let size = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > MAX_RESPONSE_BYTES) {
-      await reader.cancel();
-      return void 0;
-    }
-    chunks.push(value);
-  }
-  try {
-    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
-  } catch {
-    return void 0;
-  }
-}
-function field(json, key) {
-  return typeof json === "object" && json !== null ? json[key] : void 0;
-}
-function failure(status, json) {
-  const serverCode = field(field(json, "error"), "code");
-  const mapped = typeof serverCode === "string" ? SERVER_CODES[serverCode] : void 0;
-  return { ok: false, code: mapped ?? (status === 429 ? "rate_limited" : "login_failed") };
-}
-function createCliLoginApi(fetchImpl = fetch) {
-  async function post(url, body, bearer, signal) {
-    const ctl = new AbortController();
-    const abort = () => ctl.abort();
-    const timer = setTimeout(abort, REQUEST_TIMEOUT_MS);
-    signal?.addEventListener("abort", abort);
-    try {
-      if (signal?.aborted) return null;
-      const res = await fetchImpl(url, {
-        method: "POST",
-        headers: {
-          Accept: "application/json",
-          "Content-Type": "application/json",
-          ...bearer === void 0 ? {} : { Authorization: `Bearer ${bearer}` }
-        },
-        body: JSON.stringify(body),
-        // A redirect would forward the proof or the key to another origin.
-        redirect: "error",
-        signal: ctl.signal
-      });
-      return { status: res.status, json: await readBounded(res) };
-    } catch {
-      return null;
-    } finally {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", abort);
-    }
-  }
-  const base = (endpoint) => `${endpoint}/auth/cli-login`;
-  return {
-    async start(endpoint, body, signal) {
-      const res = await post(`${base(endpoint)}/start`, body, void 0, signal);
-      if (res === null) return { ok: false, code: "network_error" };
-      if (res.status === 404) return { ok: false, code: "browser_login_unsupported" };
-      if (res.status !== 201) return failure(res.status, res.json);
-      const requestId = field(res.json, "requestId");
-      const authorizationUrl = field(res.json, "authorizationUrl");
-      const expiresAt = new Date(String(field(res.json, "expiresAt")));
-      if (typeof requestId !== "string" || !REQUEST_ID_RE.test(requestId) || typeof authorizationUrl !== "string" || Number.isNaN(expiresAt.getTime())) {
-        return { ok: false, code: "login_failed" };
-      }
-      if (!isTrustedAuthorizationUrl(authorizationUrl, endpoint, requestId)) {
-        return { ok: false, code: "untrusted_authorization_url" };
-      }
-      return { ok: true, requestId, authorizationUrl, expiresAt };
-    },
-    async redeem(login, code, signal) {
-      const res = await post(
-        `${base(login.endpoint)}/${login.requestId}/redeem`,
-        { code, codeVerifier: login.codeVerifier },
-        void 0,
-        signal
-      );
-      if (res === null) return { ok: false, code: "network_error" };
-      if (res.status !== 200) return failure(res.status, res.json);
-      const credential = field(res.json, "credential");
-      const apiKey = field(credential, "apiKey");
-      const connection = field(credential, "connection");
-      const accountLabel = field(connection, "accountLabel");
-      const projectId = field(connection, "projectId");
-      const projectName = field(connection, "projectName");
-      if (typeof apiKey !== "string" || !PROJECT_KEY_RE.test(apiKey) || typeof accountLabel !== "string" || typeof projectId !== "string" || typeof projectName !== "string") {
-        return { ok: false, code: "login_failed" };
-      }
-      return {
-        ok: true,
-        apiKey,
-        // Display metadata only; bounded so the shared record fits every OS store.
-        connection: {
-          accountLabel: boundLabel(accountLabel, 254),
-          projectId: boundLabel(projectId, 64),
-          projectName: boundLabel(projectName, 128)
-        }
-      };
-    },
-    async confirm(login, signal) {
-      const res = await post(
-        `${base(login.endpoint)}/${login.requestId}/confirm`,
-        { codeVerifier: login.codeVerifier },
-        login.apiKey,
-        signal
-      );
-      if (res === null) return { ok: false, code: "network_error" };
-      if (res.status !== 200 || field(res.json, "status") !== "confirmed") {
-        return failure(res.status, res.json);
-      }
-      return { ok: true };
-    },
-    async cancel(login) {
-      const res = await post(`${base(login.endpoint)}/${login.requestId}/cancel`, {
-        codeVerifier: login.codeVerifier
-      });
-      if (res === null) return false;
-      if (res.status === 200) return field(res.json, "status") === "cancelled";
-      return res.status === 404 && field(field(res.json, "error"), "code") === "cli_login_expired_or_unknown";
-    },
-    async revoke(key) {
-      const res = await post(`${base(key.endpoint)}/revoke`, {}, key.apiKey);
-      return res !== null && res.status === 200 && field(res.json, "status") === "revoked";
-    }
-  };
-}
-
-// src/cli/lifecycle/journal.ts
-var MAX_STORE_CHARS = 1200;
-var MAX_REVOKE_ENTRIES = 8;
-var TOKEN_RE = /^[A-Za-z0-9_-]{43}$/;
-var FINGERPRINT_RE = /^[0-9a-f]{16}$/;
-var PLACEHOLDER_KEY = `pyx_proj_${"x".repeat(160)}`;
-var SERVER_CONVERGENCE_SECONDS = 30;
-var JournalInvalidError = class extends Error {
-};
-var JournalFullError = class extends Error {
-};
-function credentialFingerprint(endpoint, apiKey) {
-  return createHash("sha256").update(`${endpoint}
-${apiKey}`).digest("hex").slice(0, 16);
-}
-function isEmpty(journal) {
-  return journal.login === null && journal.logout === null && journal.revoke.length === 0;
-}
-function emptyJournal() {
-  return { schemaVersion: 1, login: null, logout: null, revoke: [] };
-}
-function convergenceSeconds(journal, now = Date.now()) {
-  if (journal.revokedAt === void 0) return null;
-  const elapsed = Math.max(now - journal.revokedAt, 0);
-  const left = Math.ceil(SERVER_CONVERGENCE_SECONDS - elapsed / 1e3);
-  return left > 0 ? left : null;
-}
-function isExactObject(value, required, optional = []) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-  const keys = Object.keys(value);
-  return required.every((key) => keys.includes(key)) && keys.every((key) => required.includes(key) || optional.includes(key));
-}
-function isKeyRef(value) {
-  if (!isExactObject(value, ["endpoint", "apiKey"])) return false;
-  const v = value;
-  return typeof v.endpoint === "string" && parseEndpoint(v.endpoint) === v.endpoint && typeof v.apiKey === "string" && PROJECT_KEY_RE.test(v.apiKey);
-}
-function isLoginRecord(value) {
-  if (!isExactObject(
-    value,
-    ["phase", "endpoint", "requestId", "codeVerifier", "expiresAt"],
-    ["apiKey", "previous"]
-  )) {
-    return false;
-  }
-  const v = value;
-  const held = v.phase === "issued" || v.phase === "committing";
-  return (held || v.phase === "started") && typeof v.requestId === "string" && TOKEN_RE.test(v.requestId) && typeof v.codeVerifier === "string" && TOKEN_RE.test(v.codeVerifier) && Number.isSafeInteger(v.expiresAt) && (held ? isKeyRef({ endpoint: v.endpoint, apiKey: v.apiKey }) : v.apiKey === void 0 && isKeyRef({ endpoint: v.endpoint, apiKey: PLACEHOLDER_KEY })) && (v.previous === void 0 || v.phase === "committing" && isKeyRef(v.previous));
-}
-function isLogoutRecord(value) {
-  if (!isExactObject(value, ["fingerprint", "revoke"])) return false;
-  const v = value;
-  return typeof v.fingerprint === "string" && FINGERPRINT_RE.test(v.fingerprint) && (v.revoke === null || isKeyRef(v.revoke));
-}
-function isJournal(value) {
-  if (!isExactObject(value, ["schemaVersion", "login", "logout", "revoke"], ["revokedAt"])) {
-    return false;
-  }
-  const v = value;
-  return v.schemaVersion === 1 && (v.login === null || isLoginRecord(v.login)) && (v.logout === null || isLogoutRecord(v.logout)) && Array.isArray(v.revoke) && v.revoke.length <= MAX_REVOKE_ENTRIES && v.revoke.every(isKeyRef) && (v.revokedAt === void 0 || Number.isSafeInteger(v.revokedAt) && v.revokedAt >= 0);
-}
-function hasRoomForLogin(journal, endpoint, previous) {
-  const largest = {
-    ...journal,
-    login: {
-      phase: "committing",
-      endpoint,
-      requestId: "x".repeat(43),
-      codeVerifier: "x".repeat(43),
-      expiresAt: Number.MAX_SAFE_INTEGER,
-      apiKey: PLACEHOLDER_KEY,
-      ...previous ? { previous } : {}
-    },
-    revokedAt: Number.MAX_SAFE_INTEGER
-  };
-  return JSON.stringify(largest).length <= MAX_STORE_CHARS;
-}
-async function loadJournal(provider) {
-  const raw = await provider.readJournal();
-  if (raw === null) return emptyJournal();
-  if (raw.length > MAX_STORE_CHARS) throw new JournalInvalidError();
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new JournalInvalidError();
-  }
-  if (!isJournal(parsed)) throw new JournalInvalidError();
-  return parsed;
-}
-async function saveJournal(provider, journal) {
-  if (isEmpty(journal) && convergenceSeconds(journal) === null) return provider.clearJournal();
-  const raw = JSON.stringify(journal);
-  if (raw.length > MAX_STORE_CHARS) throw new JournalFullError();
-  if (!isJournal(JSON.parse(raw))) throw new Error("refusing to write an invalid journal");
-  await provider.writeJournal(raw);
-}
-async function supersedeLogout(provider, endpoint, apiKey) {
-  let journal;
-  try {
-    journal = await loadJournal(provider);
-  } catch (err) {
-    if (err instanceof JournalInvalidError) return;
-    throw err;
-  }
-  if (journal.logout?.fingerprint !== credentialFingerprint(endpoint, apiKey)) return;
-  journal.logout = null;
-  await saveJournal(provider, journal);
-}
-function guardKeychain(provider) {
-  return {
-    write: (credentials) => provider.write(credentials),
-    delete: () => provider.delete(),
-    check: () => provider.check(),
-    readJournal: () => provider.readJournal(),
-    writeJournal: (raw) => provider.writeJournal(raw),
-    clearJournal: () => provider.clearJournal(),
-    acquireLock: (onLost) => provider.acquireLock(onLost),
-    isLocked: () => provider.isLocked(),
-    async read() {
-      const credentials = await provider.read();
-      if (credentials === null) return null;
-      let blocked;
-      try {
-        const { logout } = await loadJournal(provider);
-        blocked = logout?.fingerprint === credentialFingerprint(credentials.endpoint, credentials.apiKey);
-      } catch (err) {
-        if (!(err instanceof JournalInvalidError)) throw err;
-        blocked = true;
-      }
-      if (blocked) {
-        throw new KeychainError({
-          code: "logout-incomplete",
-          message: "A pyx-memory sign-out did not finish on this computer.",
-          guidance: "Run: pyx-mem login-recovery",
-          exit: EXIT.NOT_LOGGED_IN
-        });
-      }
-      return credentials;
-    }
-  };
-}
-
-// src/cli/keychain/napi-provider.ts
-import { homedir } from "os";
-import { join } from "path";
-
-// src/cli/lifecycle/lock.ts
-import { mkdir } from "fs/promises";
-import { dirname } from "path";
-import lockfile from "proper-lockfile";
-var LOCK_OPTIONS = { realpath: false, stale: 15e3 };
-function createFileLock(file) {
-  return {
-    async acquire(onLost) {
-      await mkdir(dirname(file), { recursive: true, mode: 448 });
-      let release;
-      try {
-        release = await lockfile.lock(file, { ...LOCK_OPTIONS, onCompromised: () => onLost() });
-      } catch (err) {
-        if (err.code === "ELOCKED") return null;
-        throw err;
-      }
-      return async () => {
-        try {
-          await release();
-        } catch (err) {
-          const code = err.code;
-          if (code !== "ERELEASED" && code !== "ENOTACQUIRED") throw err;
-        }
-      };
-    },
-    isLocked: () => lockfile.check(file, LOCK_OPTIONS)
-  };
-}
-var BUSY = /* @__PURE__ */ Symbol("lifecycle-lock-busy");
-var LockLostError = class extends Error {
-};
-async function releaseLifecycleLock(release) {
-  try {
-    await release();
-  } catch (err) {
-    const code = err?.code;
-    const reason = typeof code === "string" && /^[A-Z_]{1,32}$/.test(code) ? code : "unknown";
-    process.stderr.write(
-      `Warning: the pyx-mem lifecycle lock could not be released (${reason}). The reported result stands; other pyx-mem sign-in or sign-out commands may answer busy for up to ${LOCK_OPTIONS.stale / 1e3} seconds.
-`
-    );
-  }
-}
-async function withLifecycleLock(provider, fn) {
-  let lost = false;
-  const release = await provider.acquireLock(() => {
-    lost = true;
-  });
-  if (release === null) return BUSY;
-  try {
-    return await fn(() => lost);
-  } finally {
-    await releaseLifecycleLock(release);
-  }
-}
-
-// src/cli/keychain/types.ts
-var KEYCHAIN_SERVICE = "pyx-memory";
-var KEYCHAIN_ACCOUNT = "default";
-var CREDENTIAL_SCHEMA_VERSION = 1;
-var JOURNAL_ACCOUNT = "lifecycle-journal";
-
-// src/cli/keychain/napi-provider.ts
-var cached = /* @__PURE__ */ new Map();
-async function loadEntry(account = KEYCHAIN_ACCOUNT) {
-  const hit = cached.get(account);
-  if (hit) return hit;
-  try {
-    const mod = await import("@napi-rs/keyring");
-    const entry = new mod.Entry(KEYCHAIN_SERVICE, account);
-    cached.set(account, entry);
-    return entry;
-  } catch (err) {
-    throw providerImportError(err);
-  }
-}
-function parseRecord(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw recordInvalidError(err);
-  }
-  if (!isValidRecord(parsed)) throw recordInvalidError();
-  return parsed;
-}
-function isValidRecord(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return v.schemaVersion === CREDENTIAL_SCHEMA_VERSION && typeof v.endpoint === "string" && v.endpoint.length > 0 && typeof v.apiKey === "string" && v.apiKey.length > 0 && (v.provenance === void 0 || v.provenance === "browser-login" && isConnection(v.connection));
-}
-function isConnection(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const c = value;
-  return typeof c.accountLabel === "string" && typeof c.projectId === "string" && typeof c.projectName === "string";
-}
-var NapiKeychainProvider = class {
-  // The lock file holds no secrets; credentials and the journal stay in the OS store.
-  lock = createFileLock(join(homedir(), ".pyx-memory", "lifecycle"));
-  async read() {
-    const entry = await loadEntry();
-    let raw;
-    try {
-      raw = entry.getPassword();
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-    if (raw === null) return null;
-    return parseRecord(raw);
-  }
-  async write(credentials) {
-    const entry = await loadEntry();
-    const payload = JSON.stringify({
-      schemaVersion: CREDENTIAL_SCHEMA_VERSION,
-      endpoint: credentials.endpoint,
-      apiKey: credentials.apiKey,
-      ...credentials.provenance === "browser-login" ? { connection: credentials.connection, provenance: credentials.provenance } : {}
-    });
-    try {
-      entry.setPassword(payload);
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-  }
-  async delete() {
-    const entry = await loadEntry();
-    try {
-      entry.deletePassword();
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-  }
-  async readJournal() {
-    const entry = await loadEntry(JOURNAL_ACCOUNT);
-    try {
-      return entry.getPassword();
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-  }
-  async writeJournal(raw) {
-    const entry = await loadEntry(JOURNAL_ACCOUNT);
-    try {
-      entry.setPassword(raw);
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-  }
-  async clearJournal() {
-    const entry = await loadEntry(JOURNAL_ACCOUNT);
-    try {
-      entry.deletePassword();
-    } catch (err) {
-      throw platformAccessError(err);
-    }
-  }
-  acquireLock(onLost) {
-    return this.lock.acquire(onLost);
-  }
-  isLocked() {
-    return this.lock.isLocked();
-  }
-  async check() {
-    try {
-      const entry = await loadEntry();
-      entry.getPassword();
-      return { ok: true, message: "OS credential store reachable" };
-    } catch (err) {
-      if (err instanceof Error && "code" in err && "guidance" in err) {
-        const ke = err;
-        return { ok: false, code: ke.code, message: ke.message, guidance: ke.guidance };
-      }
-      return { ok: false, message: err instanceof Error ? err.message : String(err) };
-    }
-  }
-};
-
-// src/cli/keychain/index.ts
-function getDefaultKeychain() {
-  return guardKeychain(new NapiKeychainProvider());
-}
-function getLifecycleKeychain() {
-  return new NapiKeychainProvider();
-}
-
-// src/cli/probe.ts
-import { randomUUID } from "crypto";
-var PROBE_PATH = "/api/memory/entries?limit=1";
-var PROBE_TIMEOUT_MS = 8e3;
-async function probeCredentials(args) {
-  const fetcher = args.fetcher ?? fetch;
-  const url = `${args.endpoint}${PROBE_PATH}`;
-  const ctl = new AbortController();
-  const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
-  const idempotencyKey = `cli-probe-${randomUUID()}`;
-  try {
-    const res = await fetcher(url, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${args.apiKey}`,
-        Accept: "application/json",
-        "Idempotency-Key": idempotencyKey
-      },
-      signal: ctl.signal
-    });
-    if (res.status === 401 || res.status === 403) return { kind: "invalid", status: res.status };
-    if (res.ok) return { kind: "ok", status: res.status };
-    return { kind: "unreachable", reason: `HTTP ${res.status}` };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { kind: "unreachable", reason: msg };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/cli/commands/doctor.ts
-async function doctorCommand(opts = {}) {
-  const provider = opts.keychain ?? getDefaultKeychain();
-  const fetcher = opts.fetchImpl ?? fetch;
-  const checks = [];
-  const accessCheck = await provider.check();
-  if (accessCheck.ok) {
-    checks.push({ id: "provider.import", status: "pass", message: "native keyring module loaded" });
-    checks.push({ id: "keychain.access", status: "pass", message: accessCheck.message });
-  } else if (accessCheck.code === "provider-import-failed") {
-    checks.push({
-      id: "provider.import",
-      status: "fail",
-      code: accessCheck.code,
-      message: accessCheck.message,
-      guidance: accessCheck.guidance
-    });
-    checks.push({
-      id: "keychain.access",
-      status: "skip",
-      message: "skipped \u2014 provider import failed"
-    });
-  } else {
-    checks.push({ id: "provider.import", status: "pass", message: "native keyring module loaded" });
-    checks.push({
-      id: "keychain.access",
-      status: "fail",
-      code: accessCheck.code,
-      message: accessCheck.message,
-      guidance: accessCheck.guidance
-    });
-  }
-  const accessOk = accessCheck.ok;
-  let creds = null;
-  if (accessOk) {
-    try {
-      creds = await provider.read();
-      if (creds) {
-        checks.push({
-          id: "credentials.present",
-          status: "pass",
-          message: "credentials present in keychain",
-          endpoint: creds.endpoint
-        });
-      } else {
-        checks.push({
-          id: "credentials.present",
-          status: "fail",
-          code: "not-logged-in",
-          message: "no pyx-memory credentials stored",
-          guidance: "Run: pyx-mem login"
-        });
-      }
-    } catch (err) {
-      if (err instanceof KeychainError) {
-        checks.push({
-          id: "credentials.present",
-          status: "fail",
-          code: err.code,
-          message: err.message,
-          guidance: err.guidance
-        });
-      } else {
-        throw err;
-      }
-    }
-  } else {
-    checks.push({
-      id: "credentials.present",
-      status: "skip",
-      message: "skipped \u2014 keychain access failed"
-    });
-  }
-  if (creds) {
-    const probe = await probeCredentials({
-      endpoint: creds.endpoint,
-      apiKey: creds.apiKey,
-      fetcher
-    });
-    if (probe.kind === "ok") {
-      checks.push({
-        id: "backend.reachable",
-        status: "pass",
-        message: `pyx-memory API reachable (HTTP ${probe.status})`,
-        endpoint: creds.endpoint
-      });
-    } else if (probe.kind === "invalid") {
-      checks.push({
-        id: "backend.reachable",
-        status: "fail",
-        code: "key-rejected",
-        message: `API key rejected (HTTP ${probe.status})`,
-        endpoint: creds.endpoint,
-        guidance: "Re-login with a valid key: pyx-mem login"
-      });
-    } else {
-      checks.push({
-        id: "backend.reachable",
-        status: "fail",
-        code: "unreachable",
-        message: `no pyx-memory API at this endpoint (${probe.reason})`,
-        endpoint: creds.endpoint,
-        guidance: "Verify the endpoint is the API backend, not a web UI: pyx-mem login --endpoint <API_URL>"
-      });
-    }
-  } else {
-    checks.push({
-      id: "backend.reachable",
-      status: "skip",
-      message: "skipped \u2014 no credentials to probe"
-    });
-  }
-  const ok = checks.every((c) => c.status !== "fail");
-  if (opts.json) {
-    process.stdout.write(`${JSON.stringify({ ok, checks })}
-`);
-  } else {
-    for (const c of checks) {
-      const tag = c.status === "pass" ? "OK  " : c.status === "skip" ? "SKIP" : "FAIL";
-      process.stdout.write(`[${tag}] ${c.id}: ${c.message}
-`);
-      if (c.endpoint) process.stdout.write(`       endpoint: ${c.endpoint}
-`);
-      if (c.status === "fail" && c.guidance) process.stdout.write(`       ${c.guidance}
-`);
-    }
-  }
-  return ok ? EXIT.OK : EXIT.DOCTOR_FAIL;
-}
-
-// src/cli/commands/insights.ts
-import { z } from "zod";
-
-// src/cli/commands/read-surface.ts
-import { randomUUID as randomUUID2 } from "crypto";
-
-// src/mcp/errors.ts
-var RUN_LOGIN = "Run: pyx-mem login";
-var RUN_DOCTOR = "Run: pyx-mem doctor";
-function mcpText(text2, isError = false) {
-  return { isError, content: [{ type: "text", text: text2 }] };
-}
-function mcpMissingCredentials() {
-  return mcpText(`pyx-memory credentials are not configured.
-${RUN_LOGIN}`, true);
-}
-function mcpKeychainError(message, guidance) {
-  const lines = ["pyx-memory credentials could not be read from the OS credential store."];
-  if (message) lines.push(message);
-  if (guidance) lines.push(guidance);
-  lines.push(RUN_LOGIN);
-  return mcpText(lines.join("\n"), true);
-}
-function mcpAuthFailed(status) {
-  return mcpText(`Authentication failed (HTTP ${status}).
-${RUN_LOGIN}`, true);
-}
-function mcpUnreachable(endpoint, reason) {
-  return mcpText(`Unable to reach pyx-memory at ${endpoint}: ${reason}.
-${RUN_DOCTOR}`, true);
-}
-function mcpHttpError(status, body) {
-  return mcpText(`${status}: ${body}`, true);
-}
-function mcpServerError(status, body) {
-  return mcpText(`pyx-memory server error (HTTP ${status}): ${body || "no body"}`, true);
-}
-function mcpEnvelopeError(message) {
-  return mcpText(message, true);
-}
-function mcpJson(payload) {
-  return mcpText(JSON.stringify(payload));
-}
-
-// src/mcp/http-client.ts
-var DEFAULT_TIMEOUT_MS = 15e3;
-function parseRetryAfterSeconds(header) {
-  const value = header?.trim() ?? "";
-  return /^\d+$/.test(value) ? Number(value) : void 0;
-}
-var HTTP_DATE = /^(?:[A-Z][a-z]{2}, \d{2} [A-Z][a-z]{2} \d{4} \d{2}:\d{2}:\d{2} GMT|[A-Z][a-z]{5,8}, \d{2}-[A-Z][a-z]{2}-\d{2} \d{2}:\d{2}:\d{2} GMT|[A-Z][a-z]{2} [A-Z][a-z]{2} [ \d]\d \d{2}:\d{2}:\d{2} \d{4})$/;
-function parseRetryAfterMs(header) {
-  const seconds = parseRetryAfterSeconds(header);
-  if (seconds !== void 0) return seconds * 1e3;
-  const value = header?.trim() ?? "";
-  if (!HTTP_DATE.test(value)) return void 0;
-  const at = Date.parse(value.endsWith(" GMT") ? value : `${value} GMT`);
-  return Number.isNaN(at) ? void 0 : Math.max(0, at - Date.now());
-}
-function validateIdempotencyKey(key) {
-  if (key.length === 0 || !key.isWellFormed() || new TextEncoder().encode(key).byteLength > 256) {
-    throw new Error("idempotencyKey must be 1-256 well-formed UTF-8 bytes");
-  }
-  return key;
-}
-function createHttpClient(credentials, fetchImpl = fetch) {
-  const baseUrl = credentials.endpoint.replace(/\/+$/, "");
-  function buildUrl(path, query) {
-    const url = new URL(`${baseUrl}${path}`);
-    if (query) {
-      for (const [k, v] of Object.entries(query)) {
-        if (v === void 0) continue;
-        url.searchParams.set(k, String(v));
-      }
-    }
-    return url.toString();
-  }
-  function buildHeaders(scope, contentType, idempotencyKey) {
-    const headers = new Headers();
-    headers.set("Authorization", `Bearer ${credentials.apiKey}`);
-    headers.set("Accept", "application/json");
-    if (contentType) headers.set("Content-Type", contentType);
-    if (scope?.tenantId) headers.set("X-Tenant-Id", scope.tenantId);
-    if (scope?.namespaceId) headers.set("X-Namespace-Id", scope.namespaceId);
-    if (scope?.userId) headers.set("X-User-Id", scope.userId);
-    if (scope?.teamId) headers.set("X-Team-Id", scope.teamId);
-    if (scope?.callerAccessLevel) headers.set("X-Caller-Access-Level", scope.callerAccessLevel);
-    if (idempotencyKey !== void 0) {
-      headers.set("Idempotency-Key", validateIdempotencyKey(idempotencyKey));
-    }
-    return headers;
-  }
-  async function send(url, method, headers, body, deadline = {}) {
-    const { timeoutMs, signal } = deadline;
-    const ctl = new AbortController();
-    const timer = setTimeout(
-      () => timeoutMs === void 0 ? ctl.abort() : ctl.abort(
-        new DOMException(`no complete response within ${timeoutMs / 1e3} s`, "TimeoutError")
-      ),
-      timeoutMs ?? DEFAULT_TIMEOUT_MS
-    );
-    try {
-      let res;
-      try {
-        res = await fetchImpl(url, {
-          method,
-          headers,
-          body,
-          signal: signal ? AbortSignal.any([ctl.signal, signal]) : ctl.signal
-        });
-      } catch (err) {
-        return {
-          ok: false,
-          result: mcpUnreachable(baseUrl, err instanceof Error ? err.message : String(err))
-        };
-      } finally {
-        if (timeoutMs === void 0) clearTimeout(timer);
-      }
-      return await readResponse(res);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  return {
-    async requestJson(input) {
-      const url = buildUrl(input.path, input.query);
-      const hasBody = input.body !== void 0;
-      const headers = buildHeaders(
-        input.scope,
-        hasBody ? "application/json" : void 0,
-        input.idempotencyKey
-      );
-      return send(
-        url,
-        input.method,
-        headers,
-        hasBody ? JSON.stringify(input.body) : void 0,
-        input
-      );
-    },
-    async requestMultipart(input) {
-      const url = buildUrl(input.path);
-      const headers = buildHeaders(input.scope, void 0, input.idempotencyKey);
-      const form = await input.formData();
-      return send(url, "POST", headers, form);
-    },
-    async requestBytes(input) {
-      const headers = buildHeaders(input.scope, "application/octet-stream", input.idempotencyKey);
-      for (const [name, value] of Object.entries(input.headers)) headers.set(name, value);
-      return send(buildUrl(input.path), input.method, headers, input.body, input);
-    }
-  };
-}
-async function readResponse(res) {
-  if (res.status === 401 || res.status === 403) {
-    return { ok: false, status: res.status, result: mcpAuthFailed(res.status) };
-  }
-  let text2;
-  try {
-    text2 = await res.text();
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    return {
-      ok: false,
-      status: res.status,
-      result: mcpEnvelopeError(
-        `Failed to read pyx-memory response (HTTP ${res.status}): ${reason}`
-      )
-    };
-  }
-  return parseHttpResponse(res, text2);
-}
-function parseHttpResponse(res, text2) {
-  if (res.ok && res.headers.get("content-type")?.includes("application/x-ndjson")) {
-    return parseNdjsonOutcome(res.status, text2);
-  }
-  const parsed = parseJsonText(text2);
-  const gateway = parsed.ok ? gatewayError(parsed.value) : void 0;
-  const failure2 = {
-    ok: false,
-    status: res.status,
-    code: parsed.ok ? extractEnvelopeCode(parsed.value) : void 0,
-    retryAfter: res.headers.get("retry-after") ?? void 0
-  };
-  if (res.status >= 500) {
-    return { ...failure2, result: mcpServerError(res.status, gateway?.message ?? text2) };
-  }
-  if (!parsed.ok) {
-    if (!res.ok) {
-      return { ...failure2, result: mcpHttpError(res.status, text2 || "no body") };
-    }
-    return { ok: true, status: res.status, data: text2 };
-  }
-  if (!res.ok) {
-    const message = extractEnvelopeError(parsed.value) ?? gateway?.message ?? text2 ?? `HTTP ${res.status}`;
-    return { ...failure2, result: mcpHttpError(res.status, message) };
-  }
-  const envelopeError = extractEnvelopeError(parsed.value);
-  if (envelopeError) {
-    return { ...failure2, result: mcpEnvelopeError(envelopeError) };
-  }
-  return { ok: true, status: res.status, data: parsed.value };
-}
-function parseNdjsonOutcome(status, text2) {
-  for (const line of text2.split("\n")) {
-    if (!line.trim()) continue;
-    let frame;
-    try {
-      frame = JSON.parse(line);
-    } catch (err) {
-      const reason = err instanceof Error ? err.message : String(err);
-      return {
-        ok: false,
-        status,
-        result: mcpEnvelopeError(`pyx-memory sent an invalid NDJSON line: ${reason}`)
-      };
-    }
-    if (frame?.type === "result") return { ok: true, status, data: frame };
-    if (frame?.type === "error") {
-      return { ok: false, status, result: mcpEnvelopeError(JSON.stringify(frame)) };
-    }
-  }
-  return {
-    ok: false,
-    status,
-    result: mcpEnvelopeError("File ingest stream ended without a server result")
-  };
-}
-function parseJsonText(text2) {
-  if (text2.length === 0) return { ok: true, value: void 0 };
-  try {
-    return { ok: true, value: JSON.parse(text2) };
-  } catch {
-    return { ok: false };
-  }
-}
-function gatewayError(parsed) {
-  if (parsed === null || typeof parsed !== "object") return void 0;
-  const error = parsed.error;
-  if (error === null || typeof error !== "object") return void 0;
-  const { code, message } = error;
-  return typeof code === "string" && typeof message === "string" ? { code, message } : void 0;
-}
-function extractEnvelopeCode(parsed) {
-  if (parsed === null || typeof parsed !== "object") return void 0;
-  const obj = parsed;
-  if (obj.success === false && typeof obj.code === "string") return obj.code;
-  return gatewayError(parsed)?.code;
-}
-function extractEnvelopeError(parsed) {
-  if (parsed === null || typeof parsed !== "object") return null;
-  const obj = parsed;
-  if (obj.success === false) {
-    if (typeof obj.error === "string") return obj.error;
-    if (typeof obj.message === "string") return obj.message;
-    return "pyx-memory returned success: false";
-  }
-  return null;
-}
-
-// src/cli/commands/read-surface.ts
-async function readSurface(opts) {
-  const provider = opts.keychain ?? getDefaultKeychain();
-  let credentials;
-  try {
-    credentials = await provider.read();
-  } catch (error) {
-    return {
-      ok: false,
-      exit: error instanceof KeychainError ? error.exit : EXIT.CRED_UNAVAILABLE,
-      state: "error",
-      endpoint: null,
-      keySource: null,
-      credentialFingerprint: null,
-      problem: error instanceof KeychainError ? [error.message, error.guidance].filter(Boolean).join(" ") : "The OS credential store could not be read."
-    };
-  }
-  if (!credentials) {
-    return {
-      ok: false,
-      exit: EXIT.NOT_LOGGED_IN,
-      state: "signed_out",
-      endpoint: null,
-      keySource: null,
-      credentialFingerprint: null,
-      problem: null
-    };
-  }
-  const fingerprint = credentialFingerprint(credentials.endpoint, credentials.apiKey);
-  if (!isHttpUrl(credentials.endpoint)) {
-    return {
-      ok: false,
-      exit: EXIT.DOCTOR_FAIL,
-      state: "error",
-      endpoint: null,
-      keySource: "keychain",
-      credentialFingerprint: fingerprint,
-      problem: "The stored pyx-memory endpoint is invalid. Run: pyx-mem login"
-    };
-  }
-  const http = createHttpClient(credentials, opts.fetchImpl ?? fetch);
-  const response = await http.requestJson({
-    ...opts.request,
-    idempotencyKey: `cli-${opts.surface}-${randomUUID2()}`
-  });
-  if (!response.ok) {
-    return failedSurfaceRequest(
-      opts.surface,
-      response.status,
-      credentials.endpoint,
-      fingerprint,
-      opts.minimumServiceVersion,
-      http
-    );
-  }
-  const parsed = opts.schema.safeParse(response.data);
-  if (!parsed.success) {
-    return {
-      ok: false,
-      exit: EXIT.DOCTOR_FAIL,
-      state: "error",
-      endpoint: credentials.endpoint,
-      keySource: "keychain",
-      credentialFingerprint: fingerprint,
-      problem: `pyx-memory returned an invalid ${opts.surface} response. Run: pyx-mem doctor`
-    };
-  }
-  return {
-    ok: true,
-    endpoint: credentials.endpoint,
-    credentialFingerprint: fingerprint,
-    data: parsed.data
-  };
-}
-async function failedSurfaceRequest(surface, status, endpoint, credentialFingerprint2, minimumServiceVersion, http) {
-  if (status === 401) {
-    return {
-      ok: false,
-      exit: EXIT.NOT_LOGGED_IN,
-      state: "signed_out",
-      endpoint,
-      keySource: "keychain",
-      credentialFingerprint: credentialFingerprint2,
-      problem: requestFailure(surface, status)
-    };
-  }
-  const serviceVersion = minimumServiceVersion ? await probeServiceVersion(http) : null;
-  const serviceOutdated = serviceVersion !== null && minimumServiceVersion !== void 0 && isVersionOlder(serviceVersion, minimumServiceVersion);
-  return {
-    ok: false,
-    exit: EXIT.DOCTOR_FAIL,
-    state: serviceOutdated ? "service_outdated" : "error",
-    endpoint,
-    keySource: "keychain",
-    credentialFingerprint: credentialFingerprint2,
-    problem: serviceOutdated ? `pyx-memory ${surface} requires service ${minimumServiceVersion} or newer; the connected service reports ${serviceVersion}. Update the hosted pyx-memory service or dashboard integration, then retry.` : requestFailure(surface, status)
-  };
-}
-async function probeServiceVersion(http) {
-  const response = await http.requestJson({ method: "GET", path: "/status" });
-  if (!response.ok) return null;
-  const payload = plainObject(response.data);
-  const topology = plainObject(payload?.success === true ? plainObject(payload.data) : payload);
-  const version = payload?.version ?? plainObject(topology?.service)?.version;
-  return typeof version === "string" && parseVersion(version) ? version : null;
-}
-function plainObject(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function isVersionOlder(actual, minimum) {
-  const left = parseVersion(actual);
-  const right = parseVersion(minimum);
-  if (!left || !right) return false;
-  if (left.core[0] !== right.core[0]) return left.core[0] < right.core[0];
-  if (left.core[1] !== right.core[1]) return left.core[1] < right.core[1];
-  if (left.core[2] !== right.core[2]) return left.core[2] < right.core[2];
-  return left.prerelease !== null && right.prerelease === null;
-}
-function parseVersion(value) {
-  if (value.length > 64) return null;
-  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
-  if (!match) return null;
-  const core = [Number(match[1]), Number(match[2]), Number(match[3])];
-  return core.every(Number.isSafeInteger) ? { core, prerelease: match[4] ?? null } : null;
-}
-function requestFailure(surface, status) {
-  if (status === 401) {
-    return "Stored pyx-memory credentials were rejected. Run: pyx-mem login";
-  }
-  if (status === 403) {
-    return "pyx-memory denied access (HTTP 403). Check the key scope and project access.";
-  }
-  if (status === void 0) {
-    return "Unable to reach pyx-memory. Run: pyx-mem doctor";
-  }
-  if (status >= 500) {
-    return `pyx-memory is unavailable (HTTP ${status}). Run: pyx-mem doctor`;
-  }
-  return `pyx-memory ${surface} failed (HTTP ${status}). Run: pyx-mem doctor`;
-}
-function isHttpUrl(value) {
-  try {
-    const url = new URL(value);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-// src/cli/commands/insights.ts
-var INSIGHTS_SCHEMA_VERSION = 1;
-var metricsSchema = z.object({
-  activeEntries: z.number().int().nonnegative(),
-  retainedAdditions7d: z.number().int().nonnegative(),
-  appliedRecalls: z.number().int().nonnegative(),
-  reinforcedEntries: z.number().int().nonnegative(),
-  retrievedEntries: z.number().int().nonnegative(),
-  retrievals: z.number().int().nonnegative(),
-  lastAppliedAt: z.string().nullable(),
-  lastRetrievedAt: z.string().nullable()
-});
-var insightsSchema = z.object({
-  generatedAt: z.string(),
-  scope: z.literal("connected_memory"),
-  coverage: z.object({
-    retainedAdditions: z.object({
-      state: z.enum(["measured", "partial"]),
-      trackingSince: z.string().nullable(),
-      trackedEntries: z.number().int().nonnegative(),
-      totalEntries: z.number().int().nonnegative(),
-      reason: z.string().nullable()
-    }),
-    projectLabels: z.object({ state: z.literal("measured") }),
-    retrievalUsage: z.object({ state: z.literal("partial"), reason: z.string() }),
-    tokenEfficiency: z.object({ state: z.literal("not_instrumented"), reason: z.string() }),
-    contextAccuracy: z.object({ state: z.literal("not_instrumented"), reason: z.string() })
-  }),
-  summary: z.object({
-    activeEntries: z.number().int().nonnegative(),
-    observedProjectLabels: z.number().int().nonnegative(),
-    retainedAdditions7d: z.number().int().nonnegative().nullable(),
-    trackedEntries: z.number().int().nonnegative(),
-    appliedRecalls: z.number().int().nonnegative(),
-    reinforcedEntries: z.number().int().nonnegative(),
-    retrievedEntries: z.number().int().nonnegative(),
-    retrievals: z.number().int().nonnegative()
-  }),
-  projects: z.array(
-    metricsSchema.extend({
-      label: z.string().min(1).max(MEMORY_PROJECT_LABEL_MAX_CHARS)
-    })
-  ).max(TAXONOMY_MAX_PROJECTS),
-  other: metricsSchema.nullable(),
-  recentApplied: z.array(
-    z.object({
-      topic: z.string().min(1).max(MEMORY_PROJECT_LABEL_MAX_CHARS).nullable(),
-      project: z.string().min(1).max(MEMORY_PROJECT_LABEL_MAX_CHARS).nullable(),
-      at: z.string()
-    })
-  ).max(5)
-});
-var insightsResponseSchema = z.union([
-  insightsSchema,
-  z.object({ success: z.literal(true), data: insightsSchema }).transform(({ data }) => data)
-]);
-async function insightsCommand(opts = {}) {
-  const result = await readSurface({
-    surface: "insights",
-    request: { method: "GET", path: "/api/memory/insights" },
-    schema: insightsResponseSchema,
-    minimumServiceVersion: "1.19.0",
-    keychain: opts.keychain,
-    fetchImpl: opts.fetchImpl
-  });
-  const withIdentity = opts.withIdentity === true;
-  if (!result.ok) {
-    emit(
-      report(result.state, result.endpoint, result.keySource, result.problem, {
-        withIdentity,
-        credentialFingerprint: result.credentialFingerprint
-      })
-    );
-    return result.exit;
-  }
-  emit({
-    schemaVersion: INSIGHTS_SCHEMA_VERSION,
-    state: "ready",
-    endpoint: result.endpoint,
-    keySource: "keychain",
-    ...identityField({ withIdentity, credentialFingerprint: result.credentialFingerprint }),
-    ...result.data,
-    problem: null
-  });
-  return EXIT.OK;
-}
-function identityField(identity) {
-  return identity.withIdentity ? { credentialFingerprint: identity.credentialFingerprint } : {};
-}
-function report(state, endpoint, keySource, problem, identity) {
-  return {
-    schemaVersion: INSIGHTS_SCHEMA_VERSION,
-    state,
-    endpoint,
-    keySource,
-    ...identityField(identity),
-    generatedAt: null,
-    scope: "connected_memory",
-    coverage: null,
-    summary: null,
-    projects: [],
-    other: null,
-    recentApplied: [],
-    problem
-  };
-}
-function emit(value) {
-  process.stdout.write(`${JSON.stringify(value)}
-`);
-}
-
-// src/cli/prompt.ts
-async function readApiKeySecret() {
-  if (process.stdin.isTTY) {
-    return promptMasked("API key: ");
-  }
-  return readSingleLineFromStdin();
-}
-async function promptMasked(label2) {
-  const { stdin, stdout } = process;
-  stdout.write(label2);
-  const hadRawMode = typeof stdin.setRawMode === "function";
-  if (!hadRawMode) {
-    const value = await readSingleLineFromStdin();
-    stdout.write(`${"\u2022".repeat(Math.min(value.length, 80))}
-`);
-    return value;
-  }
-  return new Promise((resolve4, reject) => {
-    const previousEncoding = stdin.readableEncoding;
-    stdin.setEncoding("utf8");
-    stdin.setRawMode(true);
-    stdin.resume();
-    let buf = "";
-    const cleanup = () => {
-      stdin.removeListener("data", onData);
-      stdin.removeListener("error", onError);
-      stdin.setRawMode(false);
-      stdin.pause();
-      if (previousEncoding) stdin.setEncoding(previousEncoding);
-    };
-    const onData = (chunk) => {
-      for (const ch of chunk) {
-        if (ch === "\n" || ch === "\r") {
-          cleanup();
-          stdout.write("\n");
-          resolve4(buf.trim());
-          return;
-        }
-        if (ch === "") {
-          cleanup();
-          stdout.write("\n");
-          process.exit(130);
-        }
-        if (ch === "\x7F" || ch === "\b") {
-          if (buf.length > 0) {
-            buf = buf.slice(0, -1);
-            stdout.write("\b \b");
-          }
-          continue;
-        }
-        if (ch < " ") {
-          continue;
-        }
-        buf += ch;
-        stdout.write("\u2022");
-      }
-    };
-    const onError = (err) => {
-      cleanup();
-      reject(err instanceof Error ? err : new Error(String(err)));
-    };
-    stdin.on("data", onData);
-    stdin.on("error", onError);
-  });
-}
-async function readSingleLineFromStdin() {
-  let buf = "";
-  for await (const chunk of process.stdin) {
-    buf += chunk.toString("utf8");
-    const nl = buf.indexOf("\n");
-    if (nl >= 0) return buf.slice(0, nl).trim();
-  }
-  return buf.trim();
-}
-
-// src/cli/commands/login.ts
-var DEFAULT_ENDPOINT = "https://memory.api.pyxmate.com";
-async function loginCommand(opts = {}) {
-  const provider = opts.keychain ?? getLifecycleKeychain();
-  const fetcher = opts.fetchImpl ?? fetch;
-  const endpoint = normalizeEndpoint(
-    opts.endpoint ?? await readExistingEndpoint(provider) ?? DEFAULT_ENDPOINT
-  );
-  if (!isHttpUrl2(endpoint)) {
-    process.stderr.write(`Error: invalid --endpoint \`${endpoint}\` (expected http(s) URL).
-`);
-    return EXIT.USAGE;
-  }
-  let apiKey;
-  try {
-    apiKey = opts.apiKey?.trim() || await readApiKeySecret();
-  } catch (err) {
-    process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
-`);
-    return EXIT.USAGE;
-  }
-  if (!apiKey) {
-    process.stderr.write("Error: API key is empty.\n");
-    return EXIT.USAGE;
-  }
-  const probe = await probeCredentials({ endpoint, apiKey, fetcher });
-  if (probe.kind === "invalid") {
-    process.stderr.write(
-      `Error: API key was rejected by ${endpoint} (HTTP ${probe.status}).
-No credentials were written.
-`
-    );
-    return EXIT.NOT_LOGGED_IN;
-  }
-  try {
-    const written = await withLifecycleLock(provider, async () => {
-      await supersedeLogout(provider, endpoint, apiKey);
-      await provider.write({ schemaVersion: 1, endpoint, apiKey });
-    });
-    if (written === BUSY) {
-      process.stderr.write(
-        "Error: another pyx-mem sign-in or sign-out is in progress. Retry in a moment.\nNo credentials were written.\n"
-      );
-      return EXIT.BUSY;
-    }
-  } catch (err) {
-    if (err instanceof KeychainError) {
-      process.stderr.write(
-        `Error: ${err.message}
-${err.guidance}
-No credentials were written. pyx-mem does not write plaintext token files.
-`
-      );
-      return err.exit;
-    }
-    throw err;
-  }
-  if (probe.kind === "unreachable") {
-    process.stdout.write(
-      `Stored credentials for ${endpoint}. Warning: validation probe failed (${probe.reason}). Run: pyx-mem doctor
-`
-    );
-  } else {
-    process.stdout.write(`Logged in to ${endpoint}. Run: pyx-mem doctor
-`);
-  }
-  return EXIT.OK;
-}
-async function readExistingEndpoint(provider) {
-  try {
-    const creds = await provider.read();
-    return creds?.endpoint ?? null;
-  } catch {
-    return null;
-  }
-}
-function normalizeEndpoint(input) {
-  return input.replace(/\/+$/, "");
-}
-function isHttpUrl2(value) {
-  try {
-    const u = new URL(value);
-    return u.protocol === "http:" || u.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-
-// src/cli/commands/login-browser.ts
-import { spawn } from "child_process";
-import { createHash as createHash3, randomBytes } from "crypto";
-import { hostname } from "os";
-import { createInterface } from "readline";
-
-// src/cli/lifecycle/callback-server.ts
-import { createHash as createHash2, timingSafeEqual } from "crypto";
-import { createServer } from "http";
-var CALLBACK_PATH = "/pyx-memory/callback";
-var CODE_RE = /^[A-Za-z0-9_-]{43}$/;
-var STYLES = `
-:root { color-scheme: dark; font-family: "Avenir Next", "Trebuchet MS", sans-serif; }
-* { box-sizing: border-box; }
-body {
-  margin: 0; min-height: 100vh; min-height: 100svh; padding: 32px 20px;
-  display: flex; color: #f7f8fb; background: #0b0b0e;
-  background-image: radial-gradient(ellipse at 50% 55%, #0071e31c, transparent 65%);
-}
-main { width: 100%; max-width: 496px; margin: auto; }
-.brand { margin: 0 0 20px 8px; font-size: 15px; font-weight: 600; letter-spacing: -.02em; }
-.brand span { margin-left: 8px; color: #a9adb8; font-weight: 400; }
-.card {
-  padding: clamp(24px, 6vw, 40px); border: 1px solid #30333c; border-radius: 28px;
-  background: #15161c; box-shadow: 0 24px 80px #0006;
-}
-.symbol {
-  display: grid; place-items: center; width: 64px; height: 64px; margin-bottom: 32px;
-  border: 1px solid #2c4059; border-radius: 20px; color: #6ab4ff; background: #12263a;
-}
-.continue .symbol { animation: arrive 360ms cubic-bezier(.22, 1, .36, 1); }
-.cancelled .symbol { color: #a9adb8; background: #20222b; border-color: #383b47; }
-.invalid .symbol { color: #f4bd7a; background: #302719; border-color: #59462d; }
-h1 {
-  margin: 0 0 20px; font-size: clamp(28px, 6vw, 40px); font-weight: 600;
-  line-height: 1.12; letter-spacing: -.035em; overflow-wrap: break-word;
-}
-p { margin: 0; color: #a9adb8; font-size: 16px; line-height: 1.65; }
-.note { margin-top: 32px; padding-top: 24px; border-top: 1px solid #30333c; font-size: 14px; }
-@keyframes arrive { from { opacity: .65; transform: translateY(4px); } }
-@media (prefers-reduced-motion: reduce) { .continue .symbol { animation: none; } }
-`;
-var PAGE_CSP = `default-src 'none'; style-src 'sha256-${createHash2("sha256").update(STYLES).digest("base64")}'; base-uri 'none'; form-action 'none'`;
-var page = (state, title, text2, icon) => `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>${title} \xB7 Pyx Memory</title>
-<style>${STYLES}</style>
-</head>
-<body>
-<main class="${state}">
-<div class="brand">pyx<span>Memory</span></div>
-<section class="card" aria-labelledby="title">
-<div class="symbol" aria-hidden="true"><svg width="30" height="30" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round">${icon}</svg></div>
-<h1 id="title">${title}</h1>
-<p>${text2}</p>
-<p class="note">You can close this tab.</p>
-</section>
-</main>
-</body>
-</html>`;
-var ACCEPTED_PAGE = page(
-  "continue",
-  "Continue in your app",
-  "Your approval was received. Return to the app that started this sign-in to finish connecting.",
-  '<path d="m9 4-5 5 5 5M4 9h10a6 6 0 0 1 0 12h-2"/>'
-);
-var DENIED_PAGE = page(
-  "cancelled",
-  "Sign-in cancelled",
-  "Return to the app that started this sign-in. You can try again there whenever you\u2019re ready.",
-  '<path d="m7 7 10 10M17 7 7 17"/>'
-);
-var REJECTED_PAGE = page(
-  "invalid",
-  "This sign-in link isn\u2019t valid",
-  "Return to the app that started this sign-in to continue or try again.",
-  '<path d="M12 6v7m0 4v.01"/><circle cx="12" cy="12" r="10"/>'
-);
-function sameSecret(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function single(params, key) {
-  const values = params.getAll(key);
-  return values.length === 1 ? values[0] : null;
-}
-async function startCallbackServer() {
-  let expected = null;
-  let settle2 = () => {
-  };
-  const result = new Promise((resolve4) => {
-    settle2 = resolve4;
-  });
-  function accept(method, host, rawUrl) {
-    if (method !== "GET" || expected === null || host !== `127.0.0.1:${port}`) return null;
-    const url = new URL(rawUrl, `http://127.0.0.1:${port}`);
-    if (url.pathname !== CALLBACK_PATH) return null;
-    const params = url.searchParams;
-    const keys = new Set(params.keys());
-    const code = single(params, "code");
-    const error = single(params, "error");
-    if (keys.size !== 3 || single(params, "request") !== expected.requestId || !sameSecret(single(params, "state") ?? "", expected.state)) {
-      return null;
-    }
-    if (code !== null && CODE_RE.test(code)) return { code };
-    if (error === "access_denied") return { denied: true };
-    return null;
-  }
-  const server = createServer({ maxHeaderSize: 8192 }, (req, res) => {
-    const accepted = accept(req.method, req.headers.host, req.url ?? "");
-    if (accepted !== null) {
-      expected = null;
-      settle2(accepted);
-    }
-    res.writeHead(accepted === null ? 400 : 200, {
-      "Content-Type": "text/html; charset=utf-8",
-      "Cache-Control": "no-store",
-      "Content-Security-Policy": PAGE_CSP,
-      "Referrer-Policy": "no-referrer",
-      "X-Content-Type-Options": "nosniff",
-      Connection: "close"
-    });
-    res.end(accepted === null ? REJECTED_PAGE : "denied" in accepted ? DENIED_PAGE : ACCEPTED_PAGE);
-  });
-  server.requestTimeout = 5e3;
-  server.headersTimeout = 5e3;
-  await new Promise((resolve4, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve4);
-  });
-  const port = server.address().port;
-  return {
-    port,
-    expect(requestId, state) {
-      expected = { requestId, state };
-    },
-    result,
-    close() {
-      server.close();
-      server.closeAllConnections();
-    }
-  };
-}
-
-// src/cli/lifecycle/settle.ts
-var STARTED_EXPIRY_MARGIN_MS = 15 * 6e4;
-async function settle(keychain, api, journal, lockLost) {
-  const holdsLock = () => {
-    if (lockLost()) throw new LockLostError();
-  };
-  const save = async () => {
-    holdsLock();
-    await saveJournal(keychain, journal);
-  };
-  const readShared = () => keychain.read().catch((err) => {
-    if (err instanceof KeychainError && err.code === "credential-record-invalid") return null;
-    throw err;
-  });
-  const queueRevoke = (key) => {
-    const queued = journal.revoke.some(
-      (pending) => pending.endpoint === key.endpoint && pending.apiKey === key.apiKey
-    );
-    if (!queued) journal.revoke.push(key);
-  };
-  const login = journal.login;
-  if (login?.phase === "started") {
-    holdsLock();
-    if (Date.now() > login.expiresAt + STARTED_EXPIRY_MARGIN_MS || await api.cancel(login)) {
-      journal.login = null;
-      await save();
-    }
-  } else if (login?.apiKey !== void 0) {
-    const own = { endpoint: login.endpoint, apiKey: login.apiKey };
-    const shared = login.phase === "committing" ? await readShared() : null;
-    const committed = shared !== null && credentialFingerprint(shared.endpoint, shared.apiKey) === credentialFingerprint(own.endpoint, own.apiKey);
-    journal.login = null;
-    if (!committed) queueRevoke(own);
-    if (login.previous !== void 0 && shared?.apiKey !== login.previous.apiKey) {
-      queueRevoke(login.previous);
-    }
-    await save();
-  }
-  if (journal.logout !== null) {
-    const { fingerprint, revoke } = journal.logout;
-    const shared = await readShared();
-    if (shared !== null && credentialFingerprint(shared.endpoint, shared.apiKey) === fingerprint) {
-      holdsLock();
-      await keychain.delete();
-    }
-    journal.logout = null;
-    if (revoke !== null) queueRevoke(revoke);
-    await save();
-  }
-  for (const key of [...journal.revoke]) {
-    holdsLock();
-    if (await api.revoke(key)) {
-      journal.revoke = journal.revoke.filter((pending) => pending !== key);
-      journal.revokedAt = Date.now();
-      await save();
-    }
-  }
-  return journal;
-}
-
-// src/cli/commands/login-browser.ts
-var DEFAULT_ENDPOINT2 = "https://memory.api.pyxmate.com";
-var MAX_STDIN_LINE = 1024;
-var Stop = class extends Error {
-  constructor(outcome) {
-    super(outcome);
-    this.outcome = outcome;
-  }
-  outcome;
-};
-function stopFor(failure2) {
-  return new Stop(failure2.code === "cancelled" ? "requested" : failure2.code);
-}
-function printHuman(e) {
-  if (e.event === "awaiting_browser") {
-    process.stdout.write(`Sign in with your browser:
-${e.authorizationUrl}
-`);
-  } else if (e.event === "connecting") {
-    process.stdout.write("Finishing sign-in\u2026\n");
-  } else if (e.event === "connected") {
-    process.stdout.write(
-      `Connected to ${e.connection.projectName} as ${e.connection.accountLabel}. Run: pyx-mem doctor
-`
-    );
-  } else if (e.event === "cancelled") {
-    process.stdout.write("Sign-in cancelled. Stored credentials were not changed.\n");
-  } else {
-    process.stderr.write(`Error: ${e.message}
-`);
-  }
-  if ("cleanupPending" in e && e.cleanupPending && e.event !== "error") {
-    process.stderr.write("Server-side cleanup is pending. Run: pyx-mem login-recovery\n");
-  }
-}
-function openInBrowser(url) {
-  const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
-  const child = spawn(command, args, { stdio: "ignore", detached: true });
-  child.on("error", () => {
-    process.stderr.write(
-      "Could not open a browser automatically. Open the sign-in URL yourself.\n"
-    );
-  });
-  child.unref();
-}
-function exitFor(outcome) {
-  if (outcome === "requested" || outcome === "denied") return EXIT.CANCELLED;
-  if (outcome === "busy") return EXIT.BUSY;
-  if (outcome === "cleanup_pending") return EXIT.CLEANUP_PENDING;
-  if (outcome === "invalid_endpoint") return EXIT.USAGE;
-  return EXIT.DOCTOR_FAIL;
-}
-async function snapshot(keychain) {
-  try {
-    const credentials = await keychain.read();
-    return {
-      token: credentials === null ? "none" : credentialFingerprint(credentials.endpoint, credentials.apiKey),
-      credentials
-    };
-  } catch (err) {
-    if (err instanceof KeychainError && err.code === "credential-record-invalid") {
-      return { token: "invalid", credentials: null };
-    }
-    throw err;
-  }
-}
-async function browserLoginCommand(opts) {
-  const keychain = opts.keychain ?? getLifecycleKeychain();
-  const api = createCliLoginApi(opts.fetchImpl);
-  const emit4 = opts.json ? (e) => process.stdout.write(`${JSON.stringify(e)}
-`) : printHuman;
-  const stop = new AbortController();
-  let lockLost = false;
-  const cancel = () => stop.abort();
-  const stopped = new Promise((_, reject) => {
-    stop.signal.addEventListener("abort", () => reject(new Stop("requested")));
-  });
-  stopped.catch(() => {
-  });
-  const check = () => {
-    if (lockLost) throw new Stop("lock_lost");
-    if (stop.signal.aborted) throw new Stop("requested");
-  };
-  process.once("SIGINT", cancel);
-  process.once("SIGTERM", cancel);
-  const lines = opts.json ? createInterface({ input: opts.input ?? process.stdin }) : null;
-  lines?.on("line", (line) => {
-    if (line.length > MAX_STDIN_LINE) return;
-    try {
-      if (JSON.parse(line)?.action === "cancel") cancel();
-    } catch {
-    }
-  });
-  if (opts.noOpen) lines?.on("close", cancel);
-  let release = null;
-  let listener = null;
-  let journal = null;
-  let connected = null;
-  let outcome = null;
-  let storeError = null;
-  try {
-    release = await keychain.acquireLock(() => {
-      lockLost = true;
-      cancel();
-    });
-    if (release === null) throw new Stop("busy");
-    journal = await settle(keychain, api, await loadJournal(keychain), () => lockLost);
-    if (journal.login !== null) throw new Stop("cleanup_pending");
-    const base = await snapshot(keychain);
-    const endpoint = parseEndpoint(opts.endpoint ?? base.credentials?.endpoint ?? DEFAULT_ENDPOINT2);
-    if (endpoint === null) throw new Stop("invalid_endpoint");
-    const replaced = base.credentials ? { endpoint: base.credentials.endpoint, apiKey: base.credentials.apiKey } : null;
-    const previous = replaced !== null && base.credentials?.provenance === "browser-login" && isKeyRef(replaced) ? replaced : void 0;
-    if (!hasRoomForLogin(journal, endpoint, previous)) throw new Stop("cleanup_pending");
-    listener = await startCallbackServer();
-    const codeVerifier = randomBytes(32).toString("base64url");
-    const state = randomBytes(32).toString("base64url");
-    const started = await api.start(
-      endpoint,
-      {
-        codeChallenge: createHash3("sha256").update(codeVerifier).digest("base64url"),
-        callbackPort: listener.port,
-        state,
-        deviceLabel: hostname().replace(/\p{Cc}/gu, "").trim().slice(0, 64) || "this computer"
-      },
-      stop.signal
-    );
-    check();
-    if (!started.ok) throw stopFor(started);
-    const login = {
-      phase: "started",
-      endpoint,
-      requestId: started.requestId,
-      codeVerifier,
-      expiresAt: started.expiresAt.getTime()
-    };
-    journal.login = login;
-    await saveJournal(keychain, journal);
-    check();
-    listener.expect(started.requestId, state);
-    emit4({
-      event: "awaiting_browser",
-      authorizationUrl: started.authorizationUrl,
-      expiresAt: started.expiresAt.toISOString()
-    });
-    if (!opts.noOpen) (opts.openBrowser ?? openInBrowser)(started.authorizationUrl);
-    let expiry;
-    const expired = new Promise((_, reject) => {
-      const ms = Math.min(Math.max(started.expiresAt.getTime() - Date.now(), 0), 6e5);
-      expiry = setTimeout(() => reject(new Stop("expired")), ms);
-    });
-    const callback = await Promise.race([listener.result, stopped, expired]).finally(
-      () => clearTimeout(expiry)
-    );
-    check();
-    if ("denied" in callback) throw new Stop("denied");
-    emit4({ event: "connecting" });
-    const redeemed = await api.redeem(login, callback.code, stop.signal);
-    check();
-    if (!redeemed.ok) throw stopFor(redeemed);
-    const issued = { ...login, phase: "issued", apiKey: redeemed.apiKey };
-    journal.login = issued;
-    await saveJournal(keychain, journal);
-    check();
-    const confirmed = await api.confirm(issued, stop.signal);
-    check();
-    if (!confirmed.ok) throw stopFor(confirmed);
-    const current = (await loadJournal(keychain)).login;
-    if (current?.requestId !== issued.requestId || current.phase !== "issued") {
-      throw new Stop("lock_lost");
-    }
-    journal.login = { ...issued, phase: "committing", ...previous ? { previous } : {} };
-    await saveJournal(keychain, journal);
-    check();
-    if ((await snapshot(keychain)).token !== base.token) throw new Stop("credential_changed");
-    check();
-    const fingerprint = credentialFingerprint(endpoint, redeemed.apiKey);
-    try {
-      await keychain.write({
-        schemaVersion: 1,
-        endpoint,
-        apiKey: redeemed.apiKey,
-        connection: redeemed.connection,
-        provenance: "browser-login"
-      });
-    } catch (err) {
-      if ((await snapshot(keychain)).token !== fingerprint) throw err;
-    }
-    connected = { connection: redeemed.connection, fingerprint };
-  } catch (err) {
-    if (err instanceof Stop) outcome = err.outcome;
-    else if (err instanceof JournalInvalidError) outcome = "journal_invalid";
-    else if (err instanceof KeychainError) {
-      storeError = err;
-      outcome = "credential_store_unavailable";
-    } else outcome = "login_failed";
-  }
-  listener?.close();
-  lines?.close();
-  process.off("SIGINT", cancel);
-  process.off("SIGTERM", cancel);
-  let cleanupPending = outcome !== "busy";
-  if (journal !== null && !lockLost) {
-    try {
-      cleanupPending = !isEmpty(await settle(keychain, api, journal, () => lockLost));
-    } catch {
-      cleanupPending = true;
-    }
-  }
-  if (release !== null) await releaseLifecycleLock(release);
-  if (connected !== null) {
-    emit4({
-      event: "connected",
-      connection: connected.connection,
-      credentialFingerprint: connected.fingerprint,
-      cleanupPending
-    });
-    return EXIT.OK;
-  }
-  if (outcome === "requested" || outcome === "denied") {
-    emit4({ event: "cancelled", reason: outcome, cleanupPending });
-    return EXIT.CANCELLED;
-  }
-  const code = outcome ?? "login_failed";
-  emit4({
-    event: "error",
-    code,
-    message: storeError ? `${storeError.message} ${storeError.guidance}` : ERROR_MESSAGES[code].message,
-    retryable: ERROR_MESSAGES[code].retryable,
-    cleanupPending
-  });
-  return storeError?.exit ?? exitFor(code);
-}
-
-// src/cli/commands/logout.ts
-function lifecycleFailure(code, cleanupPending, err) {
-  return {
-    ok: false,
-    code,
-    // Keychain guidance is static text; any other error's text is never shown.
-    message: err instanceof KeychainError ? `${err.message} ${err.guidance}` : ERROR_MESSAGES[code].message,
-    retryable: ERROR_MESSAGES[code].retryable,
-    cleanupPending
-  };
-}
-async function cleanupPendingAfterFailure(keychain) {
-  try {
-    return !isEmpty(await loadJournal(keychain));
-  } catch {
-    return true;
-  }
-}
-async function logoutCommand(opts = {}) {
-  const keychain = opts.keychain ?? getLifecycleKeychain();
-  const api = createCliLoginApi(opts.fetchImpl);
-  const fail2 = (failure2, exit) => {
-    if (opts.json) process.stdout.write(`${JSON.stringify(failure2)}
-`);
-    else process.stderr.write(`Error: ${failure2.message}
-`);
-    return exit;
-  };
-  try {
-    const result = await withLifecycleLock(keychain, (lockLost) => logout(lockLost));
-    return result === BUSY ? fail2(lifecycleFailure("busy", false), EXIT.BUSY) : result;
-  } catch (err) {
-    const pending = await cleanupPendingAfterFailure(keychain);
-    if (err instanceof KeychainError) {
-      return fail2(lifecycleFailure("credential_store_unavailable", pending, err), err.exit);
-    }
-    if (err instanceof LockLostError) {
-      return fail2(lifecycleFailure("lock_lost", pending), EXIT.DOCTOR_FAIL);
-    }
-    if (err instanceof JournalInvalidError) {
-      return fail2(lifecycleFailure("journal_invalid", true), EXIT.DOCTOR_FAIL);
-    }
-    return fail2(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
-  }
-  async function logout(lockLost) {
-    const journal = await loadJournal(keychain);
-    const selected = await keychain.read().catch((err) => {
-      if (err instanceof KeychainError && err.code === "credential-record-invalid") {
-        return "unreadable";
-      }
-      throw err;
-    });
-    const managed = selected !== null && selected !== "unreadable" && selected.provenance === "browser-login" && isKeyRef({ endpoint: selected.endpoint, apiKey: selected.apiKey }) ? { endpoint: selected.endpoint, apiKey: selected.apiKey } : null;
-    if (selected === null || selected === "unreadable") {
-      await keychain.delete();
-    } else {
-      journal.logout = {
-        fingerprint: credentialFingerprint(selected.endpoint, selected.apiKey),
-        revoke: managed
-      };
-      await saveJournal(keychain, journal);
-    }
-    const cleanupPending = !isEmpty(await settle(keychain, api, journal, lockLost));
-    if (await keychain.read() !== null) {
-      return fail2(lifecycleFailure("credential_changed", cleanupPending), EXIT.DOCTOR_FAIL);
-    }
-    if (lockLost()) throw new LockLostError();
-    const convergence = convergenceSeconds(journal);
-    const revocationPending = journal.revoke.length > 0;
-    const serverRevocation = revocationPending ? "pending" : convergence !== null ? "revoked" : "not_attempted";
-    const legacy = selected !== null && managed === null;
-    const report4 = {
-      ok: true,
-      credentialKind: selected === null ? null : managed !== null ? "browser" : "legacy",
-      localDeleted: selected !== null,
-      serverRevocation,
-      cleanupPending,
-      reconnectRequired: selected !== null || serverRevocation !== "not_attempted",
-      // Proxies older than the per-request credential check hold the key in
-      // memory. A key that is still valid on the server keeps them working.
-      pendingLegacySessions: legacy || revocationPending,
-      serverConvergenceSeconds: convergence
-    };
-    if (opts.json) {
-      process.stdout.write(`${JSON.stringify(report4)}
-`);
-    } else {
-      process.stdout.write(
-        selected === null ? "No pyx-memory credentials were stored.\n" : "pyx-memory credentials deleted from OS credential store.\n"
-      );
-      if (cleanupPending) {
-        process.stderr.write(
-          "The server-side key could not be revoked yet. Run: pyx-mem login-recovery\n"
-        );
-      } else if (report4.pendingLegacySessions) {
-        process.stdout.write(
-          "The API key itself was not revoked (other computers may use it). Restart running agents; revoke the key in the dashboard to end it everywhere.\n"
-        );
-      }
-    }
-    return cleanupPending ? EXIT.CLEANUP_PENDING : EXIT.OK;
-  }
-}
-
-// src/cli/commands/login-recovery.ts
-async function signOutJournal(keychain) {
-  const journal = emptyJournal();
-  const shared = await keychain.read().catch((err) => {
-    if (err instanceof KeychainError && err.code === "credential-record-invalid") return null;
-    throw err;
-  });
-  if (shared !== null) {
-    const key = { endpoint: shared.endpoint, apiKey: shared.apiKey };
-    journal.logout = {
-      fingerprint: credentialFingerprint(shared.endpoint, shared.apiKey),
-      revoke: shared.provenance === "browser-login" && isKeyRef(key) ? key : null
-    };
-  }
-  await saveJournal(keychain, journal);
-  return journal;
-}
-async function loginRecoveryCommand(opts = {}) {
-  const keychain = opts.keychain ?? getLifecycleKeychain();
-  const fail2 = (failure2, exit) => {
-    if (opts.json) process.stdout.write(`${JSON.stringify(failure2)}
-`);
-    else process.stderr.write(`Error: ${failure2.message}
-`);
-    return exit;
-  };
-  try {
-    const journal = await withLifecycleLock(keychain, async (lockLost) => {
-      const loaded = await loadJournal(keychain).catch((err) => {
-        if (err instanceof JournalInvalidError && opts.discardUnreadableJournal) {
-          return signOutJournal(keychain);
-        }
-        throw err;
-      });
-      const settled = await settle(keychain, createCliLoginApi(opts.fetchImpl), loaded, lockLost);
-      if (lockLost()) throw new LockLostError();
-      return settled;
-    });
-    if (journal === BUSY) return fail2(lifecycleFailure("busy", true), EXIT.BUSY);
-    if (!isEmpty(journal)) {
-      return fail2(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
-    }
-    const convergence = convergenceSeconds(journal);
-    const report4 = {
-      ok: true,
-      cleanupPending: false,
-      serverRevocation: convergence !== null ? "revoked" : "not_attempted",
-      serverConvergenceSeconds: convergence
-    };
-    if (opts.json) process.stdout.write(`${JSON.stringify(report4)}
-`);
-    else process.stdout.write("Nothing is pending.\n");
-    return EXIT.OK;
-  } catch (err) {
-    if (err instanceof JournalInvalidError) {
-      return fail2(lifecycleFailure("journal_invalid", true), EXIT.DOCTOR_FAIL);
-    }
-    const pending = await cleanupPendingAfterFailure(keychain);
-    if (err instanceof KeychainError) {
-      return fail2(lifecycleFailure("credential_store_unavailable", pending, err), err.exit);
-    }
-    if (err instanceof LockLostError) {
-      return fail2(lifecycleFailure("lock_lost", pending), EXIT.DOCTOR_FAIL);
-    }
-    return fail2(lifecycleFailure("cleanup_pending", true), EXIT.CLEANUP_PENDING);
-  }
-}
-
-// src/mcp/credentials.ts
-function createReadCredentials(providerFactory) {
-  return async () => {
-    const provider = providerFactory();
-    try {
-      const creds = await provider.read();
-      if (!creds) return { ok: false, result: mcpMissingCredentials() };
-      return { ok: true, credentials: creds };
-    } catch (err) {
-      if (err instanceof KeychainError) {
-        return { ok: false, result: mcpKeychainError(err.message, err.guidance) };
-      }
-      const msg = err instanceof Error ? err.message : String(err);
-      return { ok: false, result: mcpKeychainError(msg, "") };
-    }
-  };
-}
-
-// src/mcp/proxy-server.ts
-import { createHash as createHash5, randomUUID as randomUUID5 } from "crypto";
-import { readFile as readFile2, stat as stat2 } from "fs/promises";
-import { basename as basename2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
-import { setTimeout as delay2 } from "timers/promises";
-import { Client as McpClient } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import {
-  CallToolRequestSchema,
-  GetPromptRequestSchema,
-  ListPromptsRequestSchema,
-  ListToolsRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
-
-// src/mcp/file-ingest-intents.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir2, readdir, readFile, rename, rm, writeFile } from "fs/promises";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-var DELIVERED_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
-var DEFAULT_FILE_INGEST_INTENT_DIR = join2(homedir2(), ".pyx-memory", "file-ingests");
-function parseIntent(raw, file) {
-  const value = JSON.parse(raw);
-  const fp = value?.fingerprint;
-  if (value?.version !== 1 || typeof value.jobId !== "string" || typeof value.endpoint !== "string" || typeof value.delivered !== "boolean" || typeof value.createdAt !== "string" || typeof value.updatedAt !== "string" || typeof fp?.path !== "string" || typeof fp.byteLength !== "number" || typeof fp.sha256 !== "string") {
-    throw new Error(`file ingest intent ${file} is not a version 1 record; remove it to continue`);
-  }
-  return value;
-}
-async function readIntents(dir) {
-  let names;
-  try {
-    names = await readdir(dir);
-  } catch (err) {
-    if (err.code === "ENOENT") return [];
-    throw err;
-  }
-  return Promise.all(
-    names.filter((name) => name.endsWith(".json")).map(async (name) => {
-      const file = join2(dir, name);
-      return { file, intent: parseIntent(await readFile(file, "utf8"), file) };
-    })
-  );
-}
-function createFileIngestIntentStore(dir = DEFAULT_FILE_INGEST_INTENT_DIR) {
-  return {
-    async findUndelivered(endpoint, path, namespaceId) {
-      const records = await readIntents(dir);
-      const prunedBefore = Date.now() - DELIVERED_RETENTION_MS;
-      await Promise.all(
-        records.filter(({ intent }) => intent.delivered && Date.parse(intent.updatedAt) < prunedBefore).map(({ file }) => rm(file, { force: true }))
-      );
-      return records.map(({ intent }) => intent).filter(
-        (intent) => !intent.delivered && intent.endpoint === endpoint && intent.fingerprint.path === path && intent.fingerprint.namespaceId === namespaceId
-      ).sort((a, b) => a.createdAt.localeCompare(b.createdAt))[0];
-    },
-    async save(intent) {
-      await mkdir2(dir, { recursive: true, mode: 448 });
-      const file = join2(dir, `${intent.jobId}.json`);
-      const temp = join2(dir, `.${intent.jobId}.${randomUUID3()}.tmp`);
-      await writeFile(temp, `${JSON.stringify(intent)}
-`, { mode: 384, flag: "wx" });
-      await rename(temp, file);
-    }
-  };
-}
-
-// src/mcp/hosted-file-ingest.ts
-import { createHash as createHash4, randomUUID as randomUUID4 } from "crypto";
-import { createReadStream, openAsBlob } from "fs";
-import { stat } from "fs/promises";
-import { basename, isAbsolute, resolve } from "path";
-import { setTimeout as delay } from "timers/promises";
-function parseHostedFileIngestDescriptor(meta) {
-  if (meta === null || typeof meta !== "object") return void 0;
-  const value = meta[HOSTED_FILE_INGEST_PROTOCOL.metaKey];
-  if (value === null || typeof value !== "object") return void 0;
-  const { protocolVersion, endpoint, maxBytes } = value;
-  if (protocolVersion !== HOSTED_FILE_INGEST_PROTOCOL.version || typeof endpoint !== "string" || // Same-origin absolute path only: the keychain bearer goes with every request.
-  !endpoint.startsWith("/") || endpoint.startsWith("//") || typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1) {
-    return void 0;
-  }
-  return { endpoint, maxBytes };
-}
-function toMicrocents(cents) {
-  const microcents = typeof cents === "number" && cents >= 0 ? Math.round(cents * 1e6) : Number.NaN;
-  return Number.isSafeInteger(microcents) ? String(microcents) : void 0;
-}
-function parseArgs(args) {
-  const { path, description, namespaceId, maxCostCents, cancel } = args;
-  const maxCostMicrocents = maxCostCents === void 0 ? void 0 : toMicrocents(maxCostCents);
-  if (typeof path !== "string" || path.length === 0) {
-    return "`path` must be a non-empty local file path.";
-  }
-  if (description !== void 0 && typeof description !== "string") {
-    return "`description` must be a string.";
-  }
-  if (namespaceId !== void 0 && (typeof namespaceId !== "string" || namespaceId.length === 0)) {
-    return "`namespaceId` must be a non-empty string.";
-  }
-  if (cancel !== void 0 && typeof cancel !== "boolean") return "`cancel` must be a boolean.";
-  if (maxCostCents !== void 0 && maxCostMicrocents === void 0) {
-    return "`maxCostCents` must be a non-negative number of cents.";
-  }
-  return {
-    path: isAbsolute(path) ? path : resolve(path),
-    description: description || null,
-    namespaceId: namespaceId ?? null,
-    maxCostMicrocents,
-    cancel: cancel === true
-  };
-}
-var CATALOG_STEPS = /* @__PURE__ */ new Set(["begin", "prepare", "commit", "publish"]);
-var DEADLINE_MS = {
-  begin: 15e3,
-  authorize: 15e3,
-  cancel: 15e3,
-  upload: 12e4,
-  prepare: 9e4,
-  commit: 16e4,
-  publish: 6e4
-};
-var RETRY_BUDGET_MS = 5 * 6e4;
-var DEFAULT_RETRY_AFTER_S = 2;
-var MAX_RETRY_AFTER_S = 30;
-var RESUME = "Call this tool again with the same arguments to resume the job.";
-var NEW_IMPORT = "Call this tool again to start a new import.";
-var NEXT_BY_CODE = /* @__PURE__ */ new Map([
-  [
-    "runtime_upgrade_required",
-    "The pyx-memory instance needs a runtime upgrade before file ingest can continue; call this tool again with the same arguments once it is upgraded."
-  ],
-  [
-    "file_ingest_job_limit",
-    "This instance already has as many unfinished imports as it allows: finish or cancel another one (cancel: true with its path), then call this tool again with the same arguments."
-  ],
-  [
-    "file_ingest_disabled",
-    "Hosted file ingest is switched off on the server; call this tool again with the same arguments later to resume."
-  ],
-  [
-    "file_too_large",
-    "The file is larger than hosted file ingest accepts: call with cancel: true to drop this import, then import a smaller file."
-  ],
-  [
-    "file_ingest_cancel_requested",
-    "The job is being cancelled: call this tool with cancel: true to confirm."
-  ]
-]);
-var ENDED_CODES = /* @__PURE__ */ new Set(["file_ingest_cancelled", "file_ingest_expired"]);
-var COST_CODES = /* @__PURE__ */ new Set([
-  "file_ingest_authorization_required",
-  "file_ingest_ceiling_exceeded",
-  "file_ingest_quota_paused",
-  "file_ingest_limit_exceeded"
-]);
-function nextAfter(res) {
-  if (res.status === 402) {
-    return "The wallet balance is too low: top up, then call this tool again with the same arguments to resume.";
-  }
-  return NEXT_BY_CODE.get(res.code ?? "") ?? RESUME;
-}
-var errorText = (err) => err instanceof Error ? err.message : String(err);
-var text = (result) => result.content.map((part) => part.text).join("\n");
-var fail = (result) => ({ ok: false, result });
-var refuse = (message) => fail(mcpText(message, true));
-var label = (intent) => `${basename(intent.fingerprint.path)} (job ${intent.jobId})`;
-async function hashFile(path) {
-  const hash = createHash4("sha256");
-  let byteLength = 0;
-  for await (const chunk of createReadStream(path)) {
-    hash.update(chunk);
-    byteLength += chunk.length;
-  }
-  return { byteLength, sha256: hash.digest("hex") };
-}
-async function matchIntent(intent, args, size) {
-  const fp = intent.fingerprint;
-  const changed = args.description !== fp.description || typeof size === "number" && (size !== fp.byteLength || (await hashFile(args.path)).sha256 !== fp.sha256);
-  if (!changed) return { ok: true, value: intent };
-  return refuse(
-    `${args.path} no longer matches ${label(intent)}: its content or description changed since that import started.
-Call this tool with cancel: true to abandon job ${intent.jobId}, then call again to import the file as it is now.`
-  );
-}
-function isRetryable(res) {
-  return res.status === 429 || res.status === 503 || HOSTED_FILE_INGEST_RETRYABLE_CODES.includes(res.code ?? "");
-}
-async function pause(ms, signal) {
-  await delay(ms, void 0, { signal }).catch((err) => {
-    if (!signal?.aborted) throw err;
-  });
-}
-function retryAfterMs(header) {
-  const seconds = parseRetryAfterSeconds(header) ?? DEFAULT_RETRY_AFTER_S;
-  return Math.min(seconds, MAX_RETRY_AFTER_S) * 1e3;
-}
-function formatCents(microcents, decimals) {
-  const step = 10n ** BigInt(6 - decimals);
-  const units = (BigInt(microcents) + step - 1n) / step;
-  const scale = 10n ** BigInt(decimals);
-  return `${units / scale}.${String(units % scale).padStart(decimals, "0")}`;
-}
-function unwrapEnvelope(body) {
-  if (body === null || typeof body !== "object" || body.success !== true) {
-    throw new Error("the response is not a {success: true, data} envelope");
-  }
-  return body.data;
-}
-function createHostedFileIngestDriver(credentials, guard, intents, fetchImpl = fetch) {
-  const http = createHttpClient(credentials, fetchImpl);
-  const origin = new URL(credentials.endpoint).origin;
-  const stopped = (call, step, detail, next = RESUME) => mcpText(`Import of ${label(call.intent)} stopped at ${step}: ${detail}
-${next}`, true);
-  const interrupted = (call) => refuse(`The call was cancelled; ${label(call.intent)} keeps its progress.
-${RESUME}`);
-  const published = (call, publication) => mcpText(
-    `Ingested ${call.filename}: ${publication.entryCount} chunks stored (replaced ${publication.retiredCount}). job ${call.intent.jobId}`
-  );
-  async function record(call, state) {
-    if (call.intent.lastState === state) return;
-    call.intent.lastState = state;
-    call.intent.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await intents.save(call.intent);
-  }
-  async function deliver(call, result) {
-    call.intent.delivered = true;
-    call.intent.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await intents.save(call.intent);
-    return result;
-  }
-  function accept(call, step, body, parse) {
-    try {
-      return { ok: true, value: parse(unwrapEnvelope(body)) };
-    } catch (err) {
-      return fail(stopped(call, step, `invalid server response: ${errorText(err)}`));
-    }
-  }
-  async function exchange(call, step, attempt, parse) {
-    for (; ; ) {
-      await guard();
-      const res = await attempt(randomUUID4());
-      if (call.signal?.aborted) return interrupted(call);
-      if (res.ok) return accept(call, step, res.data, parse);
-      const waitMs = retryAfterMs(res.retryAfter);
-      if (!isRetryable(res) || Date.now() + waitMs > call.retryUntil)
-        return refused(call, step, res);
-      await pause(waitMs, call.signal);
-    }
-  }
-  function post(call, step, route, body, parse) {
-    const { namespaceId } = call.intent.fingerprint;
-    const scoped = CATALOG_STEPS.has(step) && namespaceId !== null;
-    return exchange(
-      call,
-      step,
-      (idempotencyKey) => http.requestJson({
-        method: "POST",
-        path: `${call.descriptor.endpoint}${route}`,
-        body: scoped ? { ...body, namespaceId } : body,
-        idempotencyKey,
-        timeoutMs: DEADLINE_MS[step],
-        signal: call.signal
-      }),
-      parse
-    );
-  }
-  async function upload(call, job) {
-    const token = job.upload?.token;
-    if (token === void 0) {
-      return fail(stopped(call, "upload", "the server issued no upload token"));
-    }
-    const { path, byteLength, sha256 } = call.intent.fingerprint;
-    let body;
-    try {
-      const current = await hashFile(path);
-      body = await openAsBlob(path);
-      if (current.sha256 !== sha256 || current.byteLength !== byteLength || body.size !== byteLength) {
-        throw new Error("it changed since the import started");
-      }
-    } catch (err) {
-      return fail(
-        stopped(
-          call,
-          "upload",
-          `cannot send ${path}: ${errorText(err)}`,
-          `Restore the file and call again to resume, or call with cancel: true to abandon job ${call.intent.jobId}.`
-        )
-      );
-    }
-    return exchange(
-      call,
-      "upload",
-      (idempotencyKey) => http.requestBytes({
-        method: "PUT",
-        path: `${call.descriptor.endpoint}/${call.intent.jobId}/content`,
-        body,
-        headers: { [HOSTED_FILE_INGEST_PROTOCOL.uploadTokenHeader]: token },
-        idempotencyKey,
-        timeoutMs: DEADLINE_MS.upload,
-        signal: call.signal
-      }),
-      parseHostedFileIngestJobView
-    );
-  }
-  async function refused(call, step, res) {
-    const detail = res.code === void 0 ? text(res.result) : `${text(res.result)} (${res.code})`;
-    if (CATALOG_STEPS.has(step) && COST_CODES.has(res.code ?? "")) {
-      return fail(await costRefusal(call, step, detail));
-    }
-    if (step === "prepare" && res.status === 422 || ENDED_CODES.has(res.code ?? "")) {
-      return fail(await deliver(call, stopped(call, step, detail, NEW_IMPORT)));
-    }
-    return { ok: false, status: res.status, result: stopped(call, step, detail, nextAfter(res)) };
-  }
-  async function costRefusal(call, step, detail) {
-    const auth = await post(
-      call,
-      "authorize",
-      `/${call.intent.jobId}/authorize`,
-      {},
-      parseHostedFileIngestAuthorization
-    );
-    if (!auth.ok) return stopped(call, step, detail);
-    await record(call, auth.value.state);
-    const { ceilingMicrocents, estimateMicrocents, settledMicrocents } = auth.value;
-    const cents = (microcents) => microcents === null ? "unknown" : `${formatCents(microcents, 2)} cents`;
-    return await authorizationStop(call, step, auth.value) ?? stopped(
-      call,
-      step,
-      `${detail}. The spending ceiling is ${cents(ceilingMicrocents)}, the estimated total ${cents(estimateMicrocents)}; charged so far ${formatCents(settledMicrocents, 4)} cents.`,
-      `Call this tool again with the same arguments and a maxCostCents above ${cents(ceilingMicrocents)} to continue.`
-    );
-  }
-  async function authorizationStop(call, step, auth, entryCount) {
-    const charged = `Charged so far: ${formatCents(auth.settledMicrocents, 4)} cents.`;
-    const chunks = entryCount === void 0 ? "its chunks" : `its ${entryCount} chunks`;
-    const stop = (detail, next) => stopped(call, step, `${detail} ${charged}`, next);
-    const resume = `call this tool again with the same arguments and maxCostCents of at least ${auth.estimateMicrocents === null ? "the estimate" : formatCents(auth.estimateMicrocents, 2)} to resume`;
-    switch (auth.state) {
-      case "quota_paused":
-        return stop(
-          `the import was paused before storing ${chunks}.`,
-          `${resume[0]?.toUpperCase()}${resume.slice(1)}.`
-        );
-      case "limit_exceeded":
-        return stop(
-          "the document exceeds the hosted limits for extracted text or chunks.",
-          `Call with cancel: true to abandon job ${call.intent.jobId}, then import the document in smaller parts.`
-        );
-      case "cancel_requested":
-        return stop(
-          "the job is being cancelled.",
-          "Call this tool with cancel: true to confirm the cancellation."
-        );
-      case "cancelled":
-      case "expired":
-      case "failed":
-        return deliver(call, stop(`the job is ${auth.state}.`, NEW_IMPORT));
-    }
-    if (auth.authorized) return void 0;
-    if (auth.estimateMicrocents === null) {
-      return stop("the server has no cost estimate for the job yet.", RESUME);
-    }
-    const estimate = formatCents(auth.estimateMicrocents, 2);
-    const ceiling = auth.ceilingMicrocents === null ? "" : ` The current ceiling is ${formatCents(auth.ceilingMicrocents, 2)} cents.`;
-    return stop(
-      `storing ${chunks} needs your approval: the estimated cost is ${estimate} cents.${ceiling}`,
-      `Call this tool again with the same arguments and maxCostCents of at least ${estimate} to continue.`
-    );
-  }
-  async function commitPages(call, job, manifest) {
-    const committed = new Set(job.committedPages);
-    for (const page2 of manifest.pages) {
-      if (committed.has(page2.pageIndex)) continue;
-      const commit = await post(
-        call,
-        "commit",
-        `/${call.intent.jobId}/commit`,
-        { manifestSha256: manifest.manifestSha256, page: page2 },
-        parseHostedFileIngestCommitResult
-      );
-      if (!commit.ok) return commit.result;
-    }
-    return void 0;
-  }
-  async function finish(call, job, maxCostMicrocents) {
-    const manifest = job.manifest;
-    if (!manifest) return stopped(call, "prepare", "the prepared job has no manifest");
-    const auth = await post(
-      call,
-      "authorize",
-      `/${call.intent.jobId}/authorize`,
-      maxCostMicrocents === void 0 ? {} : { maxCostMicrocents },
-      parseHostedFileIngestAuthorization
-    );
-    if (!auth.ok) return auth.result;
-    await record(call, auth.value.state);
-    const halted = await authorizationStop(call, "authorize", auth.value, manifest.entryCount) ?? await commitPages(call, job, manifest);
-    if (halted) return halted;
-    const publish = await post(
-      call,
-      "publish",
-      `/${call.intent.jobId}/publish`,
-      { manifestSha256: manifest.manifestSha256, entryCount: manifest.entryCount },
-      parseHostedFileIngestPublishResult
-    );
-    if (!publish.ok) return publish.result;
-    await record(call, "published");
-    return deliver(call, published(call, publish.value));
-  }
-  async function ended(call, job) {
-    if (job.state === "published") {
-      return job.publication ? deliver(call, published(call, job.publication)) : stopped(call, "begin", "the published job has no publication result");
-    }
-    const what = job.state === "failed" ? `failed: ${job.error ? `${job.error.message} (${job.error.code})` : "no reason given"}` : `is ${job.state}.`;
-    return deliver(call, mcpText(`Import of ${label(call.intent)} ${what}
-${NEW_IMPORT}`, true));
-  }
-  async function ingest(call, maxCostMicrocents) {
-    const { fingerprint, jobId } = call.intent;
-    let next = await post(
-      call,
-      "begin",
-      "",
-      {
-        jobId,
-        filename: call.filename,
-        byteLength: fingerprint.byteLength,
-        sha256: fingerprint.sha256,
-        ...fingerprint.description === null ? {} : { description: fingerprint.description }
-      },
-      parseHostedFileIngestJobView
-    );
-    while (next.ok) {
-      const job = next.value;
-      await record(call, job.state);
-      switch (job.state) {
-        case "awaiting_upload":
-          next = await upload(call, job);
-          break;
-        case "uploaded":
-          next = await post(call, "prepare", `/${jobId}/prepare`, {}, parseHostedFileIngestJobView);
-          break;
-        case "prepared":
-          return finish(call, job, maxCostMicrocents);
-        default:
-          return ended(call, job);
-      }
-    }
-    return next.result;
-  }
-  async function cancel(call) {
-    const res = await post(
-      call,
-      "cancel",
-      `/${call.intent.jobId}/cancel`,
-      {},
-      parseHostedFileIngestAuthorization
-    );
-    if (!res.ok) {
-      if (res.status !== 404) return res.result;
-      return deliver(
-        call,
-        mcpText(`The server has no ${label(call.intent)}; nothing to cancel.
-${NEW_IMPORT}`, true)
-      );
-    }
-    const { state, settledMicrocents } = res.value;
-    await record(call, state);
-    const charged = `Charged: ${formatCents(settledMicrocents, 4)} cents.`;
-    switch (state) {
-      case "cancelled":
-        return deliver(
-          call,
-          mcpText(`Cancelled ${label(call.intent)}. ${charged}
-${NEW_IMPORT}`, true)
-        );
-      case "published":
-      case "expired":
-      case "failed":
-        return deliver(
-          call,
-          mcpText(
-            `${label(call.intent)} was already ${state}; nothing to cancel. ${charged}
-${NEW_IMPORT}`,
-            true
-          )
-        );
-      default:
-        return mcpText(
-          `Cancel of ${label(call.intent)} is ${state}: it stops once outstanding work settles. ${charged}
-Call this tool with cancel: true again to confirm.`,
-          true
-        );
-    }
-  }
-  async function openIntent(descriptor, args, existing) {
-    const size = await stat(args.path).then(
-      (info) => info.size,
-      (err) => err
-    );
-    if (existing) return matchIntent(existing, args, size);
-    if (typeof size !== "number") return refuse(`Failed to read ${args.path}: ${size.message}.`);
-    if (size === 0) return refuse(`${args.path} is empty.`);
-    if (size > descriptor.maxBytes) {
-      return refuse(`File too large: ${size} bytes > ${descriptor.maxBytes} cap.`);
-    }
-    try {
-      requireHostedFileIngestFilename(basename(args.path), "the file name");
-    } catch (err) {
-      return refuse(`Cannot import ${args.path}: ${errorText(err)}.`);
-    }
-    const { byteLength, sha256 } = await hashFile(args.path);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const intent = {
-      version: 1,
-      jobId: randomUUID4(),
-      endpoint: origin,
-      fingerprint: {
-        path: args.path,
-        byteLength,
-        sha256,
-        description: args.description,
-        namespaceId: args.namespaceId
-      },
-      lastState: null,
-      delivered: false,
-      createdAt: now,
-      updatedAt: now
-    };
-    await intents.save(intent);
-    return { ok: true, value: intent };
-  }
-  return async (descriptor, rawArgs, signal) => {
-    const args = parseArgs(rawArgs);
-    if (typeof args === "string") return mcpText(args, true);
-    let intent;
-    const callOn = (value) => ({
-      descriptor,
-      intent: value,
-      filename: basename(value.fingerprint.path),
-      signal,
-      retryUntil: Date.now() + RETRY_BUDGET_MS
-    });
-    try {
-      await guard();
-      const existing = await intents.findUndelivered(origin, args.path, args.namespaceId);
-      if (args.cancel) {
-        if (!existing) return mcpText(`No hosted import of ${args.path} to cancel.`, true);
-        intent = existing;
-        return await cancel(callOn(intent));
-      }
-      const opened = await openIntent(descriptor, args, existing);
-      if (!opened.ok) return opened.result;
-      intent = opened.value;
-      return await ingest(callOn(intent), args.maxCostMicrocents);
-    } catch (err) {
-      return mcpText(intent ? `${errorText(err)}
-job ${intent.jobId}` : errorText(err), true);
-    }
-  };
-}
-
-// src/mcp/tools/shared.ts
-var LOCAL_UPLOAD_META_KEY = "pyx.dev/local-upload";
-
-// src/mcp/proxy-server.ts
-var REMOTE_MCP_PATH = "/mcp";
-function createMcpIdempotentFetch(fetchImpl = fetch, sessionNonce = randomUUID5()) {
-  const wrapped = async (input, init) => {
-    const upstream = input instanceof Request ? input : new Request(String(input), init);
-    const method = init?.method ?? upstream.method;
-    const body = init?.body ?? (input instanceof Request ? await input.clone().text() : void 0);
-    const headers = new Headers(init?.headers ?? upstream.headers);
-    if (method.toUpperCase() === "POST" && !headers.has("Idempotency-Key")) {
-      if (typeof body !== "string") {
-        throw new Error("remote MCP POST body must be text for stable request idempotency");
-      }
-      const key = createHash5("sha256").update("pyx-mcp-idempotency-v1\0").update(sessionNonce).update("\0").update(body).digest("hex");
-      headers.set("Idempotency-Key", `mcp-${key}`);
-    }
-    return fetchImpl(input, { ...init, method, headers, body });
-  };
-  return Object.assign(wrapped, { preconnect: fetch.preconnect });
-}
-function resultText(result) {
-  return result.content.map((c) => c.type === "text" ? c.text : "").join(" ").trim();
-}
-function createCredentialGuard(readCredentials, snapshot2) {
-  return async () => {
-    const read = await readCredentials();
-    if (!read.ok) {
-      throw new Error(
-        `${resultText(read.result) || "pyx-memory credentials are unavailable. Run: pyx-mem login"}
-This attempt was not sent. Then reconnect the pyx-memory MCP server.`
-      );
-    }
-    if (read.credentials.endpoint !== snapshot2.endpoint || read.credentials.apiKey !== snapshot2.apiKey) {
-      throw new Error(
-        "pyx-memory credentials changed since this MCP session started (different endpoint or account). This attempt was not sent. Reconnect the pyx-memory MCP server to use the current sign-in."
-      );
-    }
-  };
-}
-function createGuardedFetch(guard, fetchImpl = fetch) {
-  const wrapped = async (input, init) => {
-    await guard();
-    return fetchImpl(input, init);
-  };
-  return Object.assign(wrapped, { preconnect: fetch.preconnect });
-}
-var RETRYABLE_MCP_METHODS = /* @__PURE__ */ new Set([
-  "initialize",
-  "notifications/initialized",
-  "tools/list",
-  "prompts/list"
-]);
-var MCP_RETRY_BUDGET_MS = 2e4;
-var MIN_RESEND_SPACING_MS = 1e3;
-function isRetryableMcpMessage(input, init) {
-  const method = init?.method ?? (input instanceof Request ? input.method : "GET");
-  if (method.toUpperCase() !== "POST" || typeof init?.body !== "string") return false;
-  let message;
-  try {
-    message = JSON.parse(init.body);
-  } catch {
-    return false;
-  }
-  if (typeof message !== "object" || message === null) return false;
-  const { method: rpc } = message;
-  return typeof rpc === "string" && RETRYABLE_MCP_METHODS.has(rpc);
-}
-function resendDelayMs(res, deadline) {
-  if (res.status !== 429 && res.status !== 503) return void 0;
-  const retryAfterMs2 = parseRetryAfterMs(res.headers.get("retry-after"));
-  if (retryAfterMs2 === void 0) return void 0;
-  const waitMs = Math.max(retryAfterMs2, MIN_RESEND_SPACING_MS);
-  return Date.now() + waitMs > deadline ? void 0 : waitMs;
-}
-function createMcpRetryAfterFetch(fetchImpl = fetch, retryUntil = () => Date.now() + MCP_RETRY_BUDGET_MS) {
-  const wrapped = async (input, init) => {
-    if (!isRetryableMcpMessage(input, init)) return fetchImpl(input, init);
-    const deadline = retryUntil();
-    const signal = init?.signal ?? (input instanceof Request ? input.signal : void 0);
-    for (; ; ) {
-      const res = await fetchImpl(input, init);
-      const waitMs = resendDelayMs(res, deadline);
-      if (waitMs === void 0) return res;
-      await res.body?.cancel();
-      await delay2(waitMs, void 0, { signal });
-    }
-  };
-  return Object.assign(wrapped, { preconnect: fetch.preconnect });
-}
-async function connectRemoteMcp(client, url, apiKey, fetchImpl, budgetMs = MCP_RETRY_BUDGET_MS) {
-  const connectUntil = Date.now() + budgetMs;
-  let connecting = true;
-  const transport = new StreamableHTTPClientTransport(url, {
-    requestInit: { headers: { Authorization: `Bearer ${apiKey}` } },
-    fetch: createMcpIdempotentFetch(
-      createMcpRetryAfterFetch(
-        fetchImpl,
-        () => connecting ? connectUntil : Date.now() + budgetMs
-      )
-    )
-  });
-  try {
-    await client.connect(transport);
-  } finally {
-    connecting = false;
-  }
-}
-function extractLocalUpload(meta) {
-  if (meta === null || typeof meta !== "object") return void 0;
-  const descriptor = meta[LOCAL_UPLOAD_META_KEY];
-  if (descriptor === null || typeof descriptor !== "object") return void 0;
-  const obj = descriptor;
-  if (typeof obj.pathArg !== "string" || typeof obj.endpoint !== "string" || typeof obj.fileField !== "string") {
-    return void 0;
-  }
-  if (!obj.endpoint.startsWith("/") || obj.endpoint.startsWith("//")) {
-    return void 0;
-  }
-  return obj;
-}
-async function readCappedLocalFile(rawPath, descriptor) {
-  if (typeof rawPath !== "string" || rawPath.length === 0) {
-    return {
-      ok: false,
-      result: mcpText(`\`${descriptor.pathArg}\` must be a non-empty local file path.`, true)
-    };
-  }
-  const abs = isAbsolute2(rawPath) ? rawPath : resolve2(rawPath);
-  try {
-    if (typeof descriptor.maxBytes === "number") {
-      const info = await stat2(abs);
-      if (info.size > descriptor.maxBytes) {
-        return {
-          ok: false,
-          result: mcpText(`File too large: ${info.size} bytes > ${descriptor.maxBytes} cap.`, true)
-        };
-      }
-    }
-    return { ok: true, bytes: await readFile2(abs), name: basename2(abs) };
-  } catch (err) {
-    return {
-      ok: false,
-      result: mcpText(
-        `Failed to read ${abs}: ${err instanceof Error ? err.message : String(err)}.`,
-        true
-      )
-    };
-  }
-}
-function createLocalFileUploader(credentials, readCredentials, fetchImpl = fetch) {
-  const guard = createCredentialGuard(readCredentials, credentials);
-  return async (descriptor, args) => {
-    try {
-      await guard();
-      const file = await readCappedLocalFile(args[descriptor.pathArg], descriptor);
-      if (!file.ok) return file.result;
-      const http = createHttpClient(credentials, fetchImpl);
-      const res = await http.requestMultipart({
-        path: descriptor.endpoint,
-        formData: async () => {
-          await guard();
-          const form = new FormData();
-          form.set(descriptor.fileField, new File([new Uint8Array(file.bytes)], file.name));
-          for (const key of descriptor.optionalArgs ?? []) {
-            const value = args[key];
-            if (typeof value === "string" && value.length > 0) form.set(key, value);
-          }
-          return form;
-        }
-      });
-      return res.ok ? mcpJson(res.data) : res.result;
-    } catch (err) {
-      return mcpText(err instanceof Error ? err.message : String(err), true);
-    }
-  };
-}
-function createProxyServer(client, version, uploadLocalFile, hostedFileIngest) {
-  const caps = client.getServerCapabilities();
-  const server = new Server(client.getServerVersion() ?? { name: "pyx-memory", version }, {
-    capabilities: {
-      // Advertise the PRESENCE of tools/prompts, but NOT their `listChanged`
-      // sub-capability: this proxy does not relay the remote's list_changed
-      // notifications, so claiming listChanged would be a capability the host
-      // could rely on but we never honor (Codex: keep the proxy transparent).
-      ...caps?.tools ? { tools: {} } : {},
-      ...caps?.prompts ? { prompts: {} } : {}
-    },
-    instructions: client.getInstructions()
-  });
-  const bridges = /* @__PURE__ */ new Map();
-  const bridging = uploadLocalFile !== void 0 || hostedFileIngest !== void 0;
-  const bridgeOf = (meta) => {
-    const hosted = hostedFileIngest ? parseHostedFileIngestDescriptor(meta) : void 0;
-    if (hosted) return { kind: "hosted", descriptor: hosted };
-    const local = uploadLocalFile ? extractLocalUpload(meta) : void 0;
-    return local ? { kind: "local", descriptor: local } : void 0;
-  };
-  let listedOnce = false;
-  let listingsStarted = 0;
-  let listingApplied = 0;
-  const listAndRefresh = async (params) => {
-    const listing = ++listingsStarted;
-    const result = await client.listTools(params);
-    const { tools, nextCursor } = result;
-    if (!Array.isArray(tools) || listing < listingApplied) return result;
-    listingApplied = listing;
-    listedOnce = true;
-    if (params?.cursor === void 0 && nextCursor === void 0) bridges.clear();
-    for (const tool of tools) {
-      const bridge = bridgeOf(tool._meta);
-      if (bridge) bridges.set(tool.name, bridge);
-      else bridges.delete(tool.name);
-    }
-    return result;
-  };
-  if (caps?.tools) {
-    server.setRequestHandler(ListToolsRequestSchema, (req) => listAndRefresh(req.params));
-    server.setRequestHandler(CallToolRequestSchema, async (req, extra) => {
-      if (bridging && !listedOnce) {
-        try {
-          await listAndRefresh();
-        } catch {
-        }
-      }
-      const bridge = bridges.get(req.params.name);
-      const args = req.params.arguments ?? {};
-      if (bridge?.kind === "hosted" && hostedFileIngest) {
-        return await hostedFileIngest(bridge.descriptor, args, extra.signal);
-      }
-      if (bridge?.kind === "local" && uploadLocalFile) {
-        return await uploadLocalFile(bridge.descriptor, args);
-      }
-      return client.callTool(req.params);
-    });
-  }
-  if (caps?.prompts) {
-    server.setRequestHandler(
-      ListPromptsRequestSchema,
-      (req) => client.listPrompts(req.params)
-    );
-    server.setRequestHandler(
-      GetPromptRequestSchema,
-      (req) => client.getPrompt(req.params)
-    );
-  }
-  return server;
-}
-async function runMcpProxyServer(opts) {
-  const version = opts.version ?? (true ? "1.26.6" : "0.0.0-dev");
-  const read = await opts.readCredentials();
-  if (!read.ok) {
-    throw new Error(
-      resultText(read.result) || "pyx-memory credentials are unavailable. Run: pyx-mem login"
-    );
-  }
-  const { endpoint, apiKey } = read.credentials;
-  const url = new URL(`${endpoint.replace(/\/+$/, "")}${REMOTE_MCP_PATH}`);
-  const guard = createCredentialGuard(opts.readCredentials, read.credentials);
-  const client = new McpClient({ name: "pyx-mem-proxy", version }, { capabilities: {} });
-  try {
-    await connectRemoteMcp(client, url, apiKey, createGuardedFetch(guard));
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(
-      `Could not reach the pyx-memory remote MCP at ${url.href}: ${msg}. Verify the endpoint and key with \`pyx-mem doctor\`.`
-    );
-  }
-  try {
-    const server = createProxyServer(
-      client,
-      version,
-      createLocalFileUploader(read.credentials, opts.readCredentials),
-      createHostedFileIngestDriver(read.credentials, guard, createFileIngestIntentStore())
-    );
-    const transport = new StdioServerTransport();
-    const closed = new Promise((resolve4) => {
-      transport.onclose = () => resolve4();
-    });
-    process.stdin.once("end", () => void transport.close());
-    await server.connect(transport);
-    void opts.onConnected?.(client);
-    await closed;
-  } finally {
-    await client.close().catch(() => {
-    });
-  }
-}
-
-// src/cli/commands/mcp-install.ts
-import { spawnSync as nodeSpawnSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
-
-// src/cli/commands/mcp-install-merge.ts
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-function mergeWriteJsonMcpEntry(opts) {
-  const { filePath, serverName, entry } = opts;
-  let existingDoc = {};
-  if (existsSync(filePath)) {
-    const raw = readFileSync(filePath, "utf8").trim();
-    if (raw.length > 0) {
-      try {
-        const parsed = JSON.parse(raw);
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-          return {
-            exitCode: EXIT.USAGE,
-            status: "parse-error",
-            message: `Refusing to write: ${filePath} is not a JSON object at its root.
-Fix the file manually, then re-run.
-`
-          };
-        }
-        existingDoc = parsed;
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        return {
-          exitCode: EXIT.USAGE,
-          status: "parse-error",
-          message: `Refusing to write: ${filePath} contains invalid JSON (${reason}).
-Fix the file manually, then re-run.
-`
-        };
-      }
-    }
-  }
-  const rawServers = existingDoc.mcpServers;
-  const servers = rawServers !== null && typeof rawServers === "object" && !Array.isArray(rawServers) ? { ...rawServers } : {};
-  const existingEntry = servers[serverName];
-  if (existingEntry !== void 0) {
-    if (entriesEqual(existingEntry, entry)) {
-      return {
-        exitCode: EXIT.OK,
-        status: "already-installed",
-        message: `pyx-memory is already installed in ${filePath} (no changes written).
-`
-      };
-    }
-    return {
-      exitCode: EXIT.USAGE,
-      status: "conflict",
-      message: `Refusing to overwrite existing \`${serverName}\` entry in ${filePath}.
-
-Found:
-${indent(JSON.stringify(existingEntry, null, 2))}
-
-Proposed:
-${indent(JSON.stringify(entry, null, 2))}
-
-Remove or rename the existing entry, then re-run.
-`
-    };
-  }
-  servers[serverName] = entry;
-  const nextDoc = { ...existingDoc, mcpServers: servers };
-  const payload = `${JSON.stringify(nextDoc, null, 2)}
-`;
-  const parent = dirname2(filePath);
-  if (!existsSync(parent)) {
-    mkdirSync(parent, { recursive: true });
-  }
-  const tmpPath = `${filePath}.tmp`;
-  writeFileSync(tmpPath, payload, { mode: 384 });
-  renameSync(tmpPath, filePath);
-  return {
-    exitCode: EXIT.OK,
-    status: "installed",
-    message: `Installed \`${serverName}\` MCP server entry in ${filePath}.
-`
-  };
-}
-function entriesEqual(a, b) {
-  if (a === null || typeof a !== "object") return false;
-  const left = a;
-  if (left.command !== b.command) return false;
-  if (!arraysEqual(left.args, b.args)) return false;
-  if (!recordsEqual(left.env, b.env)) return false;
-  return true;
-}
-function arraysEqual(a, b) {
-  const left = Array.isArray(a) ? a : void 0;
-  const right = b;
-  if (left === void 0 && right === void 0) return true;
-  if (left === void 0 || right === void 0)
-    return (left ?? []).length === 0 && (right ?? []).length === 0;
-  if (left.length !== right.length) return false;
-  for (let i = 0; i < left.length; i++) {
-    if (left[i] !== right[i]) return false;
-  }
-  return true;
-}
-function recordsEqual(a, b) {
-  const left = a !== null && typeof a === "object" && !Array.isArray(a) ? a : void 0;
-  const right = b;
-  if (left === void 0 && right === void 0) return true;
-  const leftKeys = left ? Object.keys(left) : [];
-  const rightKeys = right ? Object.keys(right) : [];
-  if (leftKeys.length === 0 && rightKeys.length === 0) return true;
-  if (leftKeys.length !== rightKeys.length) return false;
-  for (const k of leftKeys) {
-    if (left?.[k] !== right?.[k]) return false;
-  }
-  return true;
-}
-function indent(text2) {
-  return text2.split("\n").map((line) => `  ${line}`).join("\n");
-}
-
-// src/cli/commands/memory-rules-merge.ts
-import { randomUUID as randomUUID6 } from "crypto";
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  linkSync,
-  lstatSync,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  realpathSync,
-  renameSync as renameSync2,
-  rmSync,
-  statSync,
-  writeFileSync as writeFileSync2
-} from "fs";
-import { dirname as dirname3 } from "path";
-var RULES_BEGIN_MARKER = "<!-- pyx-memory:begin (managed by `pyx-mem mcp install`; edit outside these markers) -->";
-var RULES_END_MARKER = "<!-- pyx-memory:end -->";
-var BEGIN_MARKER_PREFIX = "<!-- pyx-memory:begin";
-var PM_HEADING_RE = /^ {0,3}##[ \t]+Persistent Memory[ \t]*$/;
-var H1_OR_H2_RE = /^ {0,3}#{1,2}[ \t]+\S/;
-var FENCE_RE = /^ {0,3}(`{3,}|~{3,})/;
-var CLOSING_FENCE_RE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
-var BEGIN_MARKER_RE = /^ {0,3}<!-- pyx-memory:begin(?:[ \t][^>]*)?-->[ \t]*$/;
-var END_MARKER_RE = /^ {0,3}<!-- pyx-memory:end -->[ \t]*$/;
-function isBeginMarker(line) {
-  return BEGIN_MARKER_RE.test(line);
-}
-function isEndMarker(line) {
-  return END_MARKER_RE.test(line);
-}
-function fenceMask(lines) {
-  const mask = new Array(lines.length).fill(false);
-  let openIdx = -1;
-  let delim = "";
-  let openLen = 0;
-  for (let i = 0; i < lines.length; i++) {
-    const fence = FENCE_RE.exec(lines[i] ?? "")?.[1];
-    if (!fence) continue;
-    if (openIdx === -1) {
-      openIdx = i;
-      delim = fence.charAt(0);
-      openLen = fence.length;
-      continue;
-    }
-    if (CLOSING_FENCE_RE.test(lines[i] ?? "") && fence.charAt(0) === delim && fence.length >= openLen) {
-      for (let j = openIdx; j <= i; j++) mask[j] = true;
-      openIdx = -1;
-      delim = "";
-      openLen = 0;
-    }
-  }
-  return mask;
-}
-function nextH1OrH2(lines, mask, from) {
-  for (let i = from; i < lines.length; i++) {
-    const line = lines[i];
-    if (line !== void 0 && !mask[i] && H1_OR_H2_RE.test(line)) return i;
-  }
-  return lines.length;
-}
-function findCompleteManagedRange(lines, mask) {
-  let begin = -1;
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line === void 0 || mask[i]) continue;
-    if (isBeginMarker(line)) begin = i;
-    else if (begin !== -1 && isEndMarker(line)) return [begin, i + 1];
-  }
-  return null;
-}
-function findBeginLines(lines, mask) {
-  const found = [];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line !== void 0 && !mask[i] && isBeginMarker(line)) found.push(i);
-  }
-  return found;
-}
-function findLegacyPyxRange(lines, mask) {
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    if (line === void 0 || mask[i] || !PM_HEADING_RE.test(line)) continue;
-    const end = nextH1OrH2(lines, mask, i + 1);
-    const own = lines.slice(i, end).filter((l, k) => !mask[i + k] && !isBeginMarker(l) && !isEndMarker(l));
-    if (own.join("\n").toLowerCase().includes("pyx-memory")) return [i, end];
-  }
-  return null;
-}
-function spliceBlock(lines, from, toExclusive, blockLines) {
-  const before = lines.slice(0, from);
-  const after = lines.slice(toExclusive);
-  while (before.length && (before[before.length - 1] ?? "").trim() === "") before.pop();
-  while (after.length && (after[0] ?? "").trim() === "") after.shift();
-  const out = [...before];
-  if (out.length) out.push("");
-  out.push(...blockLines);
-  if (after.length) out.push("");
-  out.push(...after);
-  return out;
-}
-function joinWithTrailingNewline(lines, eol) {
-  const body = lines.join(eol);
-  return body.endsWith(eol) ? body : `${body}${eol}`;
-}
-var BOM = "\uFEFF";
-function mergeMemoryRules(existing, section) {
-  const bom = existing.startsWith(BOM) ? BOM : "";
-  const merged = mergeBody(existing.slice(bom.length), section);
-  return { ...merged, content: bom + merged.content };
-}
-function mergeBody(existing, section) {
-  if (section.includes(BEGIN_MARKER_PREFIX) || section.includes(RULES_END_MARKER)) {
-    throw new Error("pyx-memory rules section must not contain the managed markers.");
-  }
-  const eol = existing.includes("\r\n") ? "\r\n" : "\n";
-  const blockLines = [RULES_BEGIN_MARKER, ...section.split(/\r?\n/), RULES_END_MARKER];
-  const normalized = existing.replace(/\r\n/g, "\n");
-  if (normalized.trim().length === 0) {
-    return { content: joinWithTrailingNewline(blockLines, eol), action: "created" };
-  }
-  let lines = normalized.split("\n");
-  let mask = fenceMask(lines);
-  const complete = findCompleteManagedRange(lines, mask);
-  if (complete) {
-    const next2 = spliceBlock(lines, complete[0], complete[1], blockLines);
-    return { content: joinWithTrailingNewline(next2, eol), action: "updated" };
-  }
-  const orphans = new Set(findBeginLines(lines, mask));
-  if (orphans.size > 0) {
-    lines = lines.filter((_, i) => !orphans.has(i));
-    mask = fenceMask(lines);
-  }
-  const legacy = findLegacyPyxRange(lines, mask);
-  if (legacy) {
-    const next2 = spliceBlock(lines, legacy[0], legacy[1], blockLines);
-    return { content: joinWithTrailingNewline(next2, eol), action: "updated" };
-  }
-  const next = spliceBlock(lines, lines.length, lines.length, blockLines);
-  return { content: joinWithTrailingNewline(next, eol), action: "appended" };
-}
-function refreshMemoryRules(file, section) {
-  const bom = file.startsWith(BOM) ? BOM : "";
-  const refreshed = refreshBody(file.slice(bom.length), section);
-  return refreshed === null ? null : bom + refreshed;
-}
-function refreshBody(existing, section) {
-  const lines = existing.replace(/\r\n/g, "\n").split("\n");
-  const complete = findCompleteManagedRange(lines, fenceMask(lines));
-  if (!complete) return null;
-  const [first, last] = [complete[0], complete[1] - 1];
-  const starts = [0];
-  for (let i = 0; i < existing.length; i++) if (existing[i] === "\n") starts.push(i + 1);
-  const from = starts[first] ?? 0;
-  const lastStart = starts[last] ?? 0;
-  const to = lastStart + (lines[last] ?? "").length;
-  const eol = existing.slice(from).match(/\r?\n/)?.[0] ?? "\n";
-  const block = [RULES_BEGIN_MARKER, ...section.split(/\r?\n/), RULES_END_MARKER].join(eol);
-  return existing.slice(0, from) + block + existing.slice(to);
-}
-function changedDuringWrite(filePath) {
-  return new Error(`${filePath} changed while updating the pyx-memory rules; retry.`);
-}
-function readUtf8Strict(path) {
-  try {
-    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readFileSync2(path));
-  } catch (err) {
-    if (err instanceof TypeError) {
-      throw new Error(`${path} is not valid UTF-8; the pyx-memory rules were not changed.`);
-    }
-    throw err;
-  }
-}
-function writeMemoryRulesFile(opts) {
-  const { filePath, section } = opts;
-  const fileExists = existsSync2(filePath);
-  if (!fileExists && lstatSync(filePath, { throwIfNoEntry: false })?.isSymbolicLink()) {
-    throw new Error(`${filePath} is a broken link; fix or remove it, then retry.`);
-  }
-  const target = fileExists ? realpathSync(filePath) : filePath;
-  const existing = fileExists ? readUtf8Strict(target) : "";
-  let merged = null;
-  if (!opts.refreshOnly) merged = mergeMemoryRules(existing, section);
-  else {
-    const content = refreshMemoryRules(existing, section);
-    if (content !== null) merged = { content, action: "updated" };
-  }
-  if (merged === null || merged.content === existing) {
-    return {
-      action: "unchanged",
-      filePath,
-      message: `pyx-memory rules already current in ${filePath} (no changes written).
-`
-    };
-  }
-  const parent = dirname3(target);
-  if (!existsSync2(parent)) mkdirSync2(parent, { recursive: true });
-  const mode = fileExists ? statSync(target).mode & 511 : 420;
-  const tmpPath = `${target}.${process.pid}.${randomUUID6()}.tmp`;
-  try {
-    writeFileSync2(tmpPath, merged.content, { mode });
-    chmodSync(tmpPath, mode);
-    if (fileExists) {
-      if (readUtf8Strict(target) !== existing) throw changedDuringWrite(filePath);
-      renameSync2(tmpPath, target);
-    } else {
-      try {
-        linkSync(tmpPath, target);
-      } catch (err) {
-        if (err.code === "EEXIST") throw changedDuringWrite(filePath);
-        throw err;
-      }
-      rmSync(tmpPath);
-    }
-  } catch (err) {
-    rmSync(tmpPath, { force: true });
-    throw err;
-  }
-  const verb = merged.action === "created" ? "Wrote" : merged.action === "appended" ? "Added" : "Updated";
-  return {
-    action: merged.action,
-    filePath,
-    message: `${verb} the pyx-memory rules in ${filePath}.
-`
-  };
-}
-
-// src/cli/commands/mcp-install.ts
-var VALID_SCOPES = /* @__PURE__ */ new Set(["local", "user", "project"]);
-var SERVER_NAME = "pyx-memory";
-function pyxMemArgs(remote) {
-  return remote ? ["mcp", "--remote"] : ["mcp"];
-}
-function mcpEntry(remote) {
-  return { command: "pyx-mem", args: pyxMemArgs(remote) };
-}
-function mcpInstallClaudeCodeCommand(opts = {}) {
-  const scope = opts.scope ?? "local";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const spawnSync = opts._spawnSync ?? nodeSpawnSync;
-  const probe = spawnSync("claude", ["--version"], { stdio: "pipe" });
-  if (probe.error || probe.status !== 0) {
-    printClaudeCodeManualInstructions(scope, remote);
-    return EXIT.OK;
-  }
-  const cmd = ["mcp", "add", SERVER_NAME, "-s", scope, "--", "pyx-mem", ...pyxMemArgs(remote)];
-  const res = spawnSync("claude", cmd, { stdio: "inherit" });
-  if (res.status !== 0) {
-    process.stderr.write(`\`claude ${cmd.join(" ")}\` exited with code ${res.status ?? "null"}.
-`);
-    printClaudeCodeManualInstructions(scope, remote);
-    return EXIT.USAGE;
-  }
-  process.stdout.write(
-    `Installed pyx-memory MCP server in Claude Code (scope: ${scope}).
-Restart Claude Code to make the tools available. No API key was written to .mcp.json \u2014 credentials live in the OS credential store.
-To populate the knowledge graph, YOU pass entities and relationships (or triples) \u2014 a multi-entity store needs at least one connecting edge or it is refused. The server does not extract for you unless a self-host operator configured a BYO extraction endpoint (then store_memory can forward extractEntities:true). Images require caller-provided descriptions/hooks.
-`
-  );
-  return EXIT.OK;
-}
-function printClaudeCodeManualInstructions(scope, remote) {
-  process.stdout.write(
-    [
-      "The `claude` CLI is not on PATH, or the install command failed.",
-      "",
-      "Run this once Claude Code is installed:",
-      `  claude mcp add ${SERVER_NAME} -s ${scope} -- pyx-mem ${pyxMemArgs(remote).join(" ")}`,
-      "",
-      "Or add this entry manually to your Claude Code MCP config (.mcp.json):",
-      JSON.stringify({ mcpServers: { [SERVER_NAME]: mcpEntry(remote) } }, null, 2),
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-}
-function mcpInstallCodexCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const spawnSync = opts._spawnSync ?? nodeSpawnSync;
-  const home = opts._homeDir ?? homedir3();
-  const codexHome = (opts._env ?? process.env).CODEX_HOME;
-  const probe = spawnSync("codex", ["--version"], { stdio: "pipe" });
-  if (probe.error || probe.status !== 0) {
-    printCodexManualInstructions(home, remote, codexHome);
-    return EXIT.OK;
-  }
-  const cmd = [
-    "mcp",
-    "add",
-    SERVER_NAME,
-    ...codexHome ? ["--env", `CODEX_HOME=${codexHome}`] : [],
-    "--",
-    "pyx-mem",
-    ...pyxMemArgs(remote)
-  ];
-  const res = spawnSync("codex", cmd, { stdio: "inherit" });
-  if (res.status !== 0) {
-    process.stderr.write(`\`codex ${cmd.join(" ")}\` exited with code ${res.status ?? "null"}.
-`);
-    printCodexManualInstructions(home, remote, codexHome);
-    return EXIT.USAGE;
-  }
-  process.stdout.write(
-    `Installed pyx-memory MCP server in Codex CLI.
-Restart Codex CLI to make the tools available. No API key was written to config.toml \u2014 credentials live in the OS credential store.
-`
-  );
-  return EXIT.OK;
-}
-function printCodexManualInstructions(home, remote, codexHome) {
-  const configPath = join3(codexHome ?? join3(home, ".codex"), "config.toml");
-  process.stdout.write(
-    [
-      "The `codex` CLI is not on PATH, or the install command failed.",
-      "",
-      "Run this once Codex CLI is installed:",
-      `  codex mcp add ${SERVER_NAME}${codexHome ? ` --env ${JSON.stringify(`CODEX_HOME=${codexHome}`)}` : ""} -- pyx-mem ${pyxMemArgs(remote).join(" ")}`,
-      "",
-      `Or add this section manually to ${configPath}:`,
-      "",
-      `[mcp_servers.${SERVER_NAME}]`,
-      `command = "pyx-mem"`,
-      `args = ${JSON.stringify(pyxMemArgs(remote))}`,
-      ...codexHome ? [`env = { CODEX_HOME = ${JSON.stringify(codexHome)} }`] : [],
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-}
-function mcpInstallCursorCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const home = opts._homeDir ?? homedir3();
-  const filePath = scope === "project" ? join3(process.cwd(), ".cursor", "mcp.json") : join3(home, ".cursor", "mcp.json");
-  return writeJsonAndReport(filePath, "Cursor", mcpEntry(opts.remote ?? false));
-}
-function mcpInstallClineCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  process.stdout.write(
-    [
-      "Cline MCP config is managed through the Cline UI in VS Code (the file",
-      "path differs by OS, VS Code variant, and Cline version).",
-      "",
-      "1. Open VS Code (or Cursor / Windsurf running the Cline extension).",
-      "2. Click the Cline icon in the sidebar.",
-      '3. Click "MCP Servers" \u2192 "Configure MCP Servers".',
-      `4. Add this entry under "mcpServers":`,
-      "",
-      JSON.stringify({ mcpServers: { [SERVER_NAME]: mcpEntry(remote) } }, null, 2),
-      "",
-      "5. Save the file. Cline will reload the MCP servers automatically.",
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-  return EXIT.OK;
-}
-function mcpInstallContinueCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const home = opts._homeDir ?? homedir3();
-  const yamlPath = join3(home, ".continue", "mcpServers", `${SERVER_NAME}.yaml`);
-  process.stdout.write(
-    [
-      "Continue uses YAML config. The recommended way to add an MCP server is a",
-      "standalone block file:",
-      "",
-      `  ${yamlPath}`,
-      "",
-      "Create that file with these contents:",
-      "",
-      `name: ${SERVER_NAME}`,
-      "version: 0.0.1",
-      "schema: v1",
-      "mcpServers:",
-      `  - name: ${SERVER_NAME}`,
-      `    command: pyx-mem`,
-      `    args:`,
-      ...pyxMemArgs(remote).map((arg) => `      - ${arg}`),
-      "",
-      "Continue auto-loads new YAML blocks on next chat session \u2014 no restart",
-      "needed in most setups.",
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-  return EXIT.OK;
-}
-function mcpInstallWindsurfCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const home = opts._homeDir ?? homedir3();
-  const filePath = join3(home, ".codeium", "windsurf", "mcp_config.json");
-  return writeJsonAndReport(filePath, "Windsurf", mcpEntry(opts.remote ?? false));
-}
-function mcpInstallGeminiCliCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const spawnSync = opts._spawnSync ?? nodeSpawnSync;
-  const home = opts._homeDir ?? homedir3();
-  const probe = spawnSync("gemini", ["--version"], { stdio: "pipe" });
-  if (probe.error || probe.status !== 0) {
-    return writeJsonAndReport(geminiConfigPath(home, scope), "Gemini CLI", mcpEntry(remote));
-  }
-  const geminiScope = scope === "local" ? "project" : scope;
-  const cmd = ["mcp", "add", "-s", geminiScope, SERVER_NAME, "pyx-mem", ...pyxMemArgs(remote)];
-  const res = spawnSync("gemini", cmd, { stdio: "inherit" });
-  if (res.status !== 0) {
-    process.stderr.write(`\`gemini ${cmd.join(" ")}\` exited with code ${res.status ?? "null"}.
-`);
-    return writeJsonAndReport(geminiConfigPath(home, scope), "Gemini CLI", mcpEntry(remote));
-  }
-  process.stdout.write(
-    `Installed pyx-memory MCP server in Gemini CLI (scope: ${geminiScope}).
-Restart Gemini CLI to make the tools available. No API key was written to settings.json \u2014 credentials live in the OS credential store.
-`
-  );
-  return EXIT.OK;
-}
-function geminiConfigPath(home, scope) {
-  return scope === "project" ? join3(process.cwd(), ".gemini", "settings.json") : join3(home, ".gemini", "settings.json");
-}
-function mcpInstallPiCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const home = opts._homeDir ?? homedir3();
-  const filePath = scope === "user" ? join3(home, ".pi", "agent", "mcp.json") : join3(process.cwd(), ".pi", "mcp.json");
-  return writeJsonAndReport(filePath, "Pi", mcpEntry(opts.remote ?? false), {
-    prereq: "pi has no native MCP support \u2014 install the third-party adapter once:\n  pi install npm:pi-mcp-adapter"
-  });
-}
-function mcpInstallOhMyPiCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const home = opts._homeDir ?? homedir3();
-  const filePath = scope === "user" ? join3(home, ".omp", "agent", "mcp.json") : join3(process.cwd(), ".omp", "mcp.json");
-  return writeJsonAndReport(filePath, "oh-my-pi", mcpEntry(opts.remote ?? false));
-}
-function mcpInstallOpenClawCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const spawnSync = opts._spawnSync ?? nodeSpawnSync;
-  const probe = spawnSync("openclaw", ["--version"], { stdio: "pipe" });
-  if (probe.error || probe.status !== 0) {
-    printOpenClawManualInstructions(remote);
-    return EXIT.OK;
-  }
-  const entryJson = JSON.stringify(mcpEntry(remote));
-  const cmd = ["mcp", "set", SERVER_NAME, entryJson];
-  const res = spawnSync("openclaw", cmd, { stdio: "inherit" });
-  if (res.status !== 0) {
-    process.stderr.write(
-      `\`openclaw ${cmd.join(" ")}\` exited with code ${res.status ?? "null"}.
-`
-    );
-    printOpenClawManualInstructions(remote);
-    return EXIT.USAGE;
-  }
-  process.stdout.write(
-    `Installed pyx-memory MCP server in OpenClaw.
-Restart OpenClaw to make the tools available. No API key was written to openclaw.json \u2014 credentials live in the OS credential store.
-`
-  );
-  return EXIT.OK;
-}
-function printOpenClawManualInstructions(remote) {
-  const entry = mcpEntry(remote);
-  const entryJson = JSON.stringify(entry);
-  process.stdout.write(
-    [
-      "The `openclaw` CLI is not on PATH, or the install command failed.",
-      "",
-      "Run this once OpenClaw is installed:",
-      `  openclaw mcp set ${SERVER_NAME} '${entryJson}'`,
-      "",
-      "Or add this entry manually under `mcp.servers` in your OpenClaw config",
-      "(run `openclaw config file` to print the active config path):",
-      "",
-      JSON.stringify({ mcp: { servers: { [SERVER_NAME]: entry } } }, null, 2),
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-}
-function mcpInstallHermesCommand(opts = {}) {
-  const scope = opts.scope ?? "user";
-  if (!validateScope(scope)) return EXIT.USAGE;
-  const remote = opts.remote ?? false;
-  const spawnSync = opts._spawnSync ?? nodeSpawnSync;
-  const probe = spawnSync("hermes", ["--version"], { stdio: "pipe" });
-  if (probe.error || probe.status !== 0) {
-    printHermesManualInstructions(remote);
-    return EXIT.OK;
-  }
-  const cmd = ["mcp", "add", SERVER_NAME, "--command", "pyx-mem", "--args", ...pyxMemArgs(remote)];
-  const res = spawnSync("hermes", cmd, { stdio: "inherit" });
-  if (res.status !== 0) {
-    process.stderr.write(`\`hermes ${cmd.join(" ")}\` exited with code ${res.status ?? "null"}.
-`);
-    printHermesManualInstructions(remote);
-    return EXIT.USAGE;
-  }
-  process.stdout.write(
-    `Installed pyx-memory MCP server in Hermes.
-Restart Hermes to make the tools available. No API key was written to config.yaml \u2014 credentials live in the OS credential store.
-`
-  );
-  return EXIT.OK;
-}
-function printHermesManualInstructions(remote) {
-  process.stdout.write(
-    [
-      "The `hermes` CLI is not on PATH, or the install command failed.",
-      "",
-      "Run this once Hermes is installed:",
-      `  hermes mcp add ${SERVER_NAME} --command pyx-mem --args ${pyxMemArgs(remote).join(" ")}`,
-      "",
-      "Or add this block under `mcp_servers:` in your Hermes config",
-      "(typically ~/.hermes/config.yaml):",
-      "",
-      `${SERVER_NAME}:`,
-      "  command: pyx-mem",
-      "  args:",
-      ...pyxMemArgs(remote).map((arg) => `    - ${arg}`),
-      "",
-      "Do NOT add your pyx-memory API key here. Run `pyx-mem login` to store it in the OS credential store.",
-      ""
-    ].join("\n")
-  );
-}
-var RULES_FILE_TARGETS = {
-  "claude-code": { envDir: "CLAUDE_CONFIG_DIR", dir: [".claude"], file: "CLAUDE.md" },
-  codex: { envDir: "CODEX_HOME", dir: [".codex"], file: "AGENTS.md" },
-  "gemini-cli": { dir: [".gemini"], file: "GEMINI.md" },
-  "oh-my-pi": { dir: [".omp", "agent"], file: "RULES.md" }
-};
-function rulesFilePath(target, opts) {
-  if (!Object.hasOwn(RULES_FILE_TARGETS, target)) return void 0;
-  const spec = RULES_FILE_TARGETS[target];
-  const env = opts._env ?? (opts._homeDir === void 0 ? process.env : {});
-  const configDir = spec.envDir ? env[spec.envDir] : void 0;
-  return configDir ? join3(configDir, spec.file) : join3(opts._homeDir ?? homedir3(), ...spec.dir, spec.file);
-}
-function installMemoryRules(opts) {
-  const filePath = rulesFilePath(opts.target, opts);
-  if (!filePath) return;
-  if (opts.noRules) {
-    process.stdout.write(
-      'Skipped writing the memory rules (--no-rules). The tools are installed, but the agent will reach for memory only when you ask; add the "## Persistent Memory" rules yourself to change that.\n'
-    );
-    return;
-  }
-  const result = writeMemoryRulesFile({ filePath, section: PERSISTENT_MEMORY_SECTION });
-  process.stdout.write(result.message);
-}
-function installMemoryRulesOnly(target, opts = {}) {
-  if (target === void 0 || !rulesFilePath(target, opts)) {
-    process.stderr.write(
-      `Error: \`pyx-mem mcp rules\` needs a host with a known rules file: ${Object.keys(RULES_FILE_TARGETS).join(", ")}.
-`
-    );
-    return EXIT.USAGE;
-  }
-  installMemoryRules({ ...opts, target, noRules: false });
-  return EXIT.OK;
-}
-function reconcileMemoryRules(opts = {}) {
-  const section = opts.section ?? PERSISTENT_MEMORY_SECTION;
-  for (const target of Object.keys(RULES_FILE_TARGETS)) {
-    const filePath = rulesFilePath(target, opts);
-    try {
-      if (!existsSync3(filePath)) continue;
-      const result = writeMemoryRulesFile({ filePath, section, refreshOnly: true });
-      if (result.action !== "unchanged") {
-        process.stderr.write(
-          `pyx-memory: refreshed the "## Persistent Memory" rules in ${filePath}
-`
-        );
-      }
-    } catch {
-    }
-  }
-}
-var MAX_SERVER_RULES_BYTES = 16 * 1024;
-async function syncMemoryRulesFromServer(client, opts = {}) {
-  try {
-    const { tools } = await client.listTools();
-    if (!tools.some((tool) => tool.name === "get_memory_rules")) {
-      reconcileMemoryRules(opts);
-      return;
-    }
-    const result = await client.callTool({ name: "get_memory_rules", arguments: {} });
-    const [first] = result.content ?? [];
-    const section = first?.type === "text" ? first.text : void 0;
-    if (result.isError || !section || !isRulesSection(section)) {
-      throw new Error('the server returned no valid "## Persistent Memory" section');
-    }
-    reconcileMemoryRules({ ...opts, section });
-  } catch (err) {
-    process.stderr.write(
-      `pyx-memory: left the installed memory rules unchanged \u2014 could not fetch current rules (${err instanceof Error ? err.message : String(err)}).
-`
-    );
-  }
-}
-function isRulesSection(text2) {
-  return text2.startsWith("## Persistent Memory\n") && Buffer.byteLength(text2, "utf8") <= MAX_SERVER_RULES_BYTES && !text2.includes("<!-- pyx-memory:") && !/^\s*(```|~~~)/m.test(text2);
-}
-function validateScope(scope) {
-  if (VALID_SCOPES.has(scope)) return true;
-  process.stderr.write(`Error: invalid --scope \`${scope}\`. Expected: local | user | project.
-`);
-  return false;
-}
-function writeJsonAndReport(filePath, agentLabel, entry, opts = {}) {
-  const result = mergeWriteJsonMcpEntry({
-    filePath,
-    serverName: SERVER_NAME,
-    entry
-  });
-  const stream = result.exitCode === EXIT.OK ? process.stdout : process.stderr;
-  stream.write(result.message);
-  if (result.status === "installed") {
-    process.stdout.write(
-      `Restart ${agentLabel} to make the tools available. No API key was written \u2014 credentials live in the OS credential store.
-`
-    );
-  }
-  if ((result.status === "installed" || result.status === "already-installed") && opts.prereq) {
-    process.stdout.write(`Prerequisite: ${opts.prereq}
-`);
-  }
-  return result.exitCode;
-}
-
-// src/cli/commands/mcp.ts
-async function mcpCommand() {
-  const readCredentials = createReadCredentials(() => getDefaultKeychain());
-  try {
-    await runMcpProxyServer({
-      readCredentials,
-      onConnected: (client) => syncMemoryRulesFromServer(client)
-    });
-    return EXIT.OK;
-  } catch (err) {
-    process.stderr.write(`Internal error: ${err instanceof Error ? err.message : String(err)}
-`);
-    return EXIT.USAGE;
-  }
-}
-function resolveMcpMode(flags) {
-  if (flags.bundled === true) {
-    return {
-      ok: false,
-      error: "The bundled stdio MCP server was removed in v1.3.0. `pyx-mem mcp` now uses the hosted zero-touch path (server-owned tools + instructions; your key stays in the OS keychain). Drop `--bundled`. For a self-hosted server, point at it with `pyx-mem login --endpoint <url>` first."
-    };
-  }
-  return { ok: true };
-}
-
-// src/cli/commands/overview.ts
-import { z as z2 } from "zod";
-var OVERVIEW_SCHEMA_VERSION = 1;
-var RECENT_ENTRY_LIMIT = 3;
-var MAX_TOPIC_CHARS = 160;
-var MAX_PROJECT_CHARS = 80;
-var entrySchema = z2.object({
-  id: z2.string().min(1),
-  metadata: z2.record(z2.string(), z2.unknown())
-}).passthrough();
-var hostedEntriesResponseSchema = z2.object({
-  memories: z2.array(entrySchema),
-  total: z2.number().int().nonnegative()
-}).passthrough();
-var selfHostedEntriesResponseSchema = z2.object({
-  success: z2.literal(true),
-  data: z2.object({
-    entries: z2.array(entrySchema),
-    totalCount: z2.number().int().nonnegative()
-  }).passthrough()
-}).passthrough();
-var entriesResponseSchema = z2.union([
-  hostedEntriesResponseSchema.transform(({ memories, total }) => ({
-    entries: memories,
-    totalCount: total
-  })),
-  selfHostedEntriesResponseSchema.transform(({ data }) => data)
-]);
-async function overviewCommand(opts = {}) {
-  const result = await readSurface({
-    surface: "overview",
-    request: {
-      method: "GET",
-      path: "/api/memory/entries",
-      query: { status: "active", limit: RECENT_ENTRY_LIMIT }
-    },
-    schema: entriesResponseSchema,
-    keychain: opts.keychain,
-    fetchImpl: opts.fetchImpl
-  });
-  if (!result.ok) {
-    emit2(report2(result.state, result.endpoint, result.keySource, result.problem));
-    return result.exit;
-  }
-  emit2({
-    ...report2("ready", result.endpoint, "keychain", null),
-    totalCount: result.data.totalCount,
-    entries: result.data.entries.slice(0, RECENT_ENTRY_LIMIT).map((entry) => ({
-      id: entry.id,
-      topic: boundedLabel(entry.metadata.topic, "Untitled", MAX_TOPIC_CHARS),
-      project: boundedLabel(entry.metadata.project, "Unscoped", MAX_PROJECT_CHARS)
-    }))
-  });
-  return EXIT.OK;
-}
-function report2(state, endpoint, keySource, problem) {
-  return {
-    schemaVersion: OVERVIEW_SCHEMA_VERSION,
-    state,
-    endpoint,
-    keySource,
-    totalCount: 0,
-    entries: [],
-    problem
-  };
-}
-function emit2(value) {
-  process.stdout.write(`${JSON.stringify(value)}
-`);
-}
-function boundedLabel(value, fallback, maxChars) {
-  if (typeof value !== "string" || value.trim().length === 0) return fallback;
-  const normalized = value.trim();
-  const chars = [...normalized];
-  return chars.length > maxChars ? `${chars.slice(0, maxChars).join("")}\u2026` : normalized;
-}
-
-// src/cli/commands/scaffold.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, statSync as statSync2, writeFileSync as writeFileSync3 } from "fs";
-import { basename as basename3, join as join4, resolve as resolve3 } from "path";
-var SERVER_IMAGE = "ghcr.io/pyx-corp/pyx-memory-v1:latest";
-var DOCKER_COMPOSE = `services:
-  pyx-memory:
-    image: ${SERVER_IMAGE}
-    ports:
-      - "7822:7822"
-    volumes:
-      - pyx-memory-data:/data
-    environment:
-      DATA_DIR: "\${DATA_DIR:-/data}"
-      API_KEY: "\${API_KEY:-}"
-      ADMIN_API_KEY: "\${ADMIN_API_KEY:-}"
-      TENANT_MODE: "\${TENANT_MODE:-single}"
-      NEO4J_URL: "\${NEO4J_URL:-bolt://neo4j:7687}"
-      NEO4J_USERNAME: "\${NEO4J_USERNAME:-neo4j}"
-      NEO4J_PASSWORD: "\${NEO4J_PASSWORD:?Set NEO4J_PASSWORD in .env or the shell.}"
-      EMBEDDING_PROVIDER: "\${EMBEDDING_PROVIDER:-local}"
-      EMBEDDING_ENDPOINT: "\${EMBEDDING_ENDPOINT:-}"
-      EMBEDDING_DIMENSIONS: "\${EMBEDDING_DIMENSIONS:-}"
-      # Graph is built by the CALLING AGENT by default (it passes entities +
-      # relationships / triples) \u2014 the server runs no LLM. To opt into
-      # server-side BYO extraction, set EXTRACTION_PROVIDER=http and supply
-      # EXTRACTION_ENDPOINT in .env.
-      EXTRACTION_PROVIDER: "\${EXTRACTION_PROVIDER:-none}"
-      EXTRACTION_ENDPOINT: "\${EXTRACTION_ENDPOINT:-}"
-      EXTRACTION_API_KEY: "\${EXTRACTION_API_KEY:-}"
-      EXTRACTION_MODEL: "\${EXTRACTION_MODEL:-}"
-      ENCRYPTION_KEY: "\${ENCRYPTION_KEY:-}"
-    depends_on:
-      neo4j:
-        condition: service_healthy
-
-  neo4j:
-    image: neo4j:5-community
-    ports:
-      - "7474:7474"
-      - "7687:7687"
-    volumes:
-      - pyx-memory-neo4j-data:/data
-      - pyx-memory-neo4j-logs:/logs
-    environment:
-      NEO4J_AUTH: "neo4j/\${NEO4J_PASSWORD:?Set NEO4J_PASSWORD in .env or the shell.}"
-      NEO4J_PLUGINS: '["apoc"]'
-    healthcheck:
-      test: ["CMD", "neo4j", "status"]
-      interval: 10s
-      timeout: 10s
-      retries: 10
-
-volumes:
-  pyx-memory-data:
-  pyx-memory-neo4j-data:
-  pyx-memory-neo4j-logs:
-`;
-var ENV_EXAMPLE = `# pyx-memory operator config
-# Copy this file to .env, then fill the required values before running Docker Compose.
-
-# OPTIONAL. Graph is built by the calling agent by default (the server runs no LLM).
-# Set to http ONLY to opt into server-side BYO entity/relationship extraction.
-EXTRACTION_PROVIDER=none
-
-# REQUIRED only when EXTRACTION_PROVIDER=http. HTTP chat/completions-compatible base URL.
-# Leave empty for the default agent-owns-the-graph setup.
-EXTRACTION_ENDPOINT=
-
-# OPTIONAL. Bearer token sent to EXTRACTION_ENDPOINT when your extraction service requires auth.
-EXTRACTION_API_KEY=
-
-# OPTIONAL. Model identifier sent to the extraction service.
-EXTRACTION_MODEL=
-
-# OPTIONAL for local embeddings. Set to http only when using a remote embedding service.
-EMBEDDING_PROVIDER=local
-
-# REQUIRED only when EMBEDDING_PROVIDER=http. Base URL for the HTTP embedding service.
-EMBEDDING_ENDPOINT=
-
-# REQUIRED only when EMBEDDING_PROVIDER=http. Must match the remote embedding vector width.
-# Example for embeddinggemma: 768.
-EMBEDDING_DIMENSIONS=
-
-# RECOMMENDED for any protected or production deployment. Empty means unauthenticated local access.
-API_KEY=
-
-# OPTIONAL. Destructive/admin operations use this; when empty, the server falls back to API_KEY.
-ADMIN_API_KEY=
-
-# REQUIRED only when SENSITIVITY_POLICY=encrypt is configured on the server.
-# 32 bytes as 64 hex chars or 44 base64 chars.
-ENCRYPTION_KEY=
-
-# REQUIRED by the scaffolded container.
-DATA_DIR=/data
-
-# REQUIRED. Use single for one app/tenant; use multi only behind authenticated tenant routing.
-TENANT_MODE=single
-
-# REQUIRED for graph storage in this compose stack.
-NEO4J_URL=bolt://neo4j:7687
-
-# OPTIONAL. Defaults to neo4j when unset.
-NEO4J_USERNAME=neo4j
-
-# REQUIRED by docker-compose.yml for the Neo4j service and pyx-memory graph connection.
-NEO4J_PASSWORD=
-`;
-var MEMORY_TS = `import { createPyxMemory } from '@pyxmate/memory';
-
-// Reads PYX_MEMORY_URL and PYX_MEMORY_API_KEY by default.
-export const memory = createPyxMemory();
-`;
-function resolveTarget(args) {
-  const cwd = args.cwd ?? process.cwd();
-  if (args.name === true) {
-    process.stderr.write("Error: --name requires a directory name.\n");
-    return null;
-  }
-  const trimmedName = typeof args.name === "string" ? args.name.trim() : "";
-  if (typeof args.name === "string" && trimmedName.length === 0) {
-    process.stderr.write("Error: --name requires a non-empty directory name.\n");
-    return null;
-  }
-  const targetDir = trimmedName ? resolve3(cwd, trimmedName) : cwd;
-  const appName = trimmedName || basename3(resolve3(cwd));
-  return { targetDir, appName };
-}
-function buildFiles(targetDir, appName) {
-  return [
-    { path: join4(targetDir, "docker-compose.yml"), contents: DOCKER_COMPOSE },
-    { path: join4(targetDir, ".env.example"), contents: ENV_EXAMPLE },
-    { path: join4(targetDir, "memory.ts"), contents: MEMORY_TS },
-    {
-      path: join4(targetDir, "PYX_MEMORY_DESIGN_GUIDE.md"),
-      contents: buildDesignGuide({ appName })
-    }
-  ];
-}
-function scaffoldCommand(args = {}) {
-  const target = resolveTarget(args);
-  if (target === null) return EXIT.USAGE;
-  if (existsSync4(target.targetDir) && !statSync2(target.targetDir).isDirectory()) {
-    process.stderr.write(`Error: target exists and is not a directory: ${target.targetDir}
-`);
-    return EXIT.USAGE;
-  }
-  mkdirSync3(target.targetDir, { recursive: true });
-  const created = [];
-  const skipped = [];
-  for (const file of buildFiles(target.targetDir, target.appName)) {
-    const relativePath = basename3(file.path);
-    if (existsSync4(file.path)) {
-      skipped.push(relativePath);
-      continue;
-    }
-    writeFileSync3(file.path, file.contents, "utf8");
-    created.push(relativePath);
-  }
-  process.stdout.write(
-    [
-      `pyx-memory scaffold: ${target.targetDir}`,
-      `created: ${created.length > 0 ? created.join(", ") : "(none)"}`,
-      `skipped: ${skipped.length > 0 ? skipped.join(", ") : "(none)"}`,
-      "",
-      "Next steps:",
-      "1. Copy .env.example to .env and set NEO4J_PASSWORD (graph is built by the calling agent by default \u2014 set EXTRACTION_* only to opt into server-side BYO extraction).",
-      "2. Set API_KEY before using this beyond local development.",
-      "3. Run: docker compose up -d",
-      "4. Set PYX_MEMORY_URL=http://localhost:7822 and PYX_MEMORY_API_KEY to match API_KEY.",
-      ""
-    ].join("\n")
-  );
-  return EXIT.OK;
-}
-
-// src/cli/commands/status.ts
-async function readLifecycle(provider) {
-  let serverConvergenceSeconds = null;
-  try {
-    const journal = await loadJournal(provider);
-    serverConvergenceSeconds = convergenceSeconds(journal);
-    if (isEmpty(journal)) return { cleanupPending: false, serverConvergenceSeconds };
-  } catch (err) {
-    if (!(err instanceof JournalInvalidError)) throw err;
-  }
-  return { cleanupPending: !await provider.isLocked(), serverConvergenceSeconds };
-}
-async function statusCommand(opts = {}) {
-  const provider = opts.keychain ? guardKeychain(opts.keychain) : getDefaultKeychain();
-  let report4;
-  try {
-    const creds = await provider.read();
-    report4 = {
-      endpoint: creds?.endpoint ?? null,
-      keyPresent: creds !== null,
-      keySource: creds !== null ? "keychain" : null,
-      loggedIn: creds !== null,
-      credentialFingerprint: creds === null ? null : credentialFingerprint(creds.endpoint, creds.apiKey),
-      lifecycleVersion: 1,
-      connection: creds?.provenance === "browser-login" ? creds.connection ?? null : null,
-      ...await readLifecycle(provider)
-    };
-  } catch (err) {
-    if (err instanceof KeychainError) return emitError(err, opts.json);
-    throw err;
-  }
-  if (opts.json) {
-    process.stdout.write(`${JSON.stringify(report4)}
-`);
-  } else {
-    const lines = [
-      `endpoint:    ${report4.endpoint ?? "(not set)"}`,
-      `credentials: ${report4.loggedIn ? "present (keychain)" : "not logged in \u2014 run: pyx-mem login"}`
-    ];
-    process.stdout.write(`${lines.join("\n")}
-`);
-  }
-  return report4.loggedIn ? EXIT.OK : EXIT.NOT_LOGGED_IN;
-}
-function emitError(err, json) {
-  if (json) {
-    process.stdout.write(
-      `${JSON.stringify({ ok: false, code: err.code, message: err.message, guidance: err.guidance })}
-`
-    );
-  } else {
-    process.stderr.write(`Error: ${err.message}
-${err.guidance}
-`);
-  }
-  return err.exit;
-}
-
-// src/cli/commands/taxonomy.ts
-import { z as z3 } from "zod";
-var TAXONOMY_SCHEMA_VERSION = 1;
-var TAXONOMY_MAX_RETURNED_CATEGORIES = TAXONOMY_MAX_CATEGORIES + 1;
-var taxonomyStateSchema = z3.object({
-  clusters: z3.array(
-    z3.object({
-      size: z3.number().int().nonnegative(),
-      currentName: z3.string().nullable(),
-      categoryNodeId: z3.string().nullable(),
-      projects: z3.array(
-        z3.object({
-          name: z3.string().min(1).max(MEMORY_PROJECT_LABEL_MAX_CHARS),
-          memories: z3.number().int().positive()
-        })
-      ).max(TAXONOMY_MAX_PROJECTS),
-      sampleTopics: z3.array(z3.string()).max(TAXONOMY_MAX_SAMPLE_TOPICS),
-      topEntities: z3.array(
-        z3.object({
-          name: z3.string(),
-          type: z3.string(),
-          degree: z3.number().int().nonnegative()
-        })
-      ).max(TAXONOMY_MAX_TOP_ENTITIES)
-    })
-  ).max(TAXONOMY_MAX_RETURNED_CATEGORIES),
-  totals: z3.object({
-    clusters: z3.number().int().nonnegative(),
-    unnamed: z3.number().int().nonnegative(),
-    nodesConsidered: z3.number().int().nonnegative()
-  })
-});
-var taxonomyResponseSchema = z3.union([
-  taxonomyStateSchema,
-  z3.object({ success: z3.literal(true), data: taxonomyStateSchema }).transform(({ data }) => data)
-]);
-async function taxonomyCommand(opts = {}) {
-  const result = await readSurface({
-    surface: "taxonomy",
-    request: { method: "GET", path: "/api/memory/graph/taxonomy" },
-    schema: taxonomyResponseSchema,
-    minimumServiceVersion: "1.18.1",
-    keychain: opts.keychain,
-    fetchImpl: opts.fetchImpl
-  });
-  const withIdentity = opts.withIdentity === true;
-  if (!result.ok) {
-    emit3(
-      report3(result.state, result.endpoint, result.keySource, result.problem, {
-        withIdentity,
-        credentialFingerprint: result.credentialFingerprint
-      })
-    );
-    return result.exit;
-  }
-  emit3({
-    ...report3("ready", result.endpoint, "keychain", null, {
-      withIdentity,
-      credentialFingerprint: result.credentialFingerprint
-    }),
-    clusters: result.data.clusters,
-    totals: result.data.totals
-  });
-  return EXIT.OK;
-}
-function report3(state, endpoint, keySource, problem, identity) {
-  return {
-    schemaVersion: TAXONOMY_SCHEMA_VERSION,
-    state,
-    endpoint,
-    keySource,
-    // Spread, not `undefined`: JSON.stringify would drop an undefined value,
-    // but the key must be absent from the object too so exact-shape checks hold.
-    ...identity.withIdentity ? { credentialFingerprint: identity.credentialFingerprint } : {},
-    clusters: [],
-    totals: { clusters: 0, unnamed: 0, nodesConsidered: 0 },
-    problem
-  };
-}
-function emit3(value) {
-  process.stdout.write(`${JSON.stringify(value)}
-`);
-}
+  EXIT
+} from "../chunk-4DXEQC6X.mjs";
 
 // src/cli/help.ts
 var HELP_TEXT = `pyx-mem \u2014 pyx-memory CLI
@@ -4195,6 +17,7 @@ Commands:
   status [--json]                              Show endpoint, key presence, MCP config status.
   overview --json                              Read memory count and three recent safe labels.
   insights --json [--with-identity]            Read body-free memory usage and coverage aggregates.
+      [--with-provenance]                      Add last writer, save time and applier to recent items.
   taxonomy --json [--with-identity]            Read knowledge-graph cluster composition (read-only).
                                                --with-identity adds credentialFingerprint (the same
                                                value as status --json) so a host can tell which
@@ -4235,7 +58,7 @@ Notes:
 
 // src/cli/parser.ts
 var COMMANDS_WITH_SUBCOMMAND = /* @__PURE__ */ new Set(["mcp"]);
-function parseArgs2(argv) {
+function parseArgs(argv) {
   const flags = /* @__PURE__ */ Object.create(null);
   const positional = [];
   let i = 0;
@@ -4278,21 +101,35 @@ function parseArgs2(argv) {
 }
 
 // src/cli/pyx-mem.ts
-var INSTALL_TARGETS = {
-  "claude-code": mcpInstallClaudeCodeCommand,
-  codex: mcpInstallCodexCommand,
-  cursor: mcpInstallCursorCommand,
-  cline: mcpInstallClineCommand,
-  continue: mcpInstallContinueCommand,
-  windsurf: mcpInstallWindsurfCommand,
-  "gemini-cli": mcpInstallGeminiCliCommand,
-  pi: mcpInstallPiCommand,
-  "oh-my-pi": mcpInstallOhMyPiCommand,
-  openclaw: mcpInstallOpenClawCommand,
-  hermes: mcpInstallHermesCommand
-};
-var VALID_TARGETS = Object.keys(INSTALL_TARGETS);
-function runMcpInstall(target, scope, remote, noRules) {
+async function runMcpInstall(target, scope, remote, noRules) {
+  const {
+    installMemoryRules,
+    mcpInstallClaudeCodeCommand,
+    mcpInstallClineCommand,
+    mcpInstallCodexCommand,
+    mcpInstallContinueCommand,
+    mcpInstallCursorCommand,
+    mcpInstallGeminiCliCommand,
+    mcpInstallHermesCommand,
+    mcpInstallOhMyPiCommand,
+    mcpInstallOpenClawCommand,
+    mcpInstallPiCommand,
+    mcpInstallWindsurfCommand
+  } = await import("../mcp-install-KBB45OB2.mjs");
+  const INSTALL_TARGETS = {
+    "claude-code": mcpInstallClaudeCodeCommand,
+    codex: mcpInstallCodexCommand,
+    cursor: mcpInstallCursorCommand,
+    cline: mcpInstallClineCommand,
+    continue: mcpInstallContinueCommand,
+    windsurf: mcpInstallWindsurfCommand,
+    "gemini-cli": mcpInstallGeminiCliCommand,
+    pi: mcpInstallPiCommand,
+    "oh-my-pi": mcpInstallOhMyPiCommand,
+    openclaw: mcpInstallOpenClawCommand,
+    hermes: mcpInstallHermesCommand
+  };
+  const VALID_TARGETS = Object.keys(INSTALL_TARGETS);
   if (target === void 0 || !Object.hasOwn(INSTALL_TARGETS, target)) {
     process.stderr.write(
       `Error: unknown install target \`${target ?? ""}\`. Expected: ${VALID_TARGETS.join(", ")}.
@@ -4305,8 +142,9 @@ function runMcpInstall(target, scope, remote, noRules) {
   if (code === EXIT.OK) installMemoryRules({ target, noRules });
   return code;
 }
-function runMcpCommand(parsed) {
+async function runMcpCommand(parsed) {
   if (parsed.subcommand === void 0) {
+    const { mcpCommand, resolveMcpMode } = await import("../mcp-64KVRH7F.mjs");
     const resolved = resolveMcpMode({
       remote: parsed.flags.remote === true,
       bundled: parsed.flags.bundled === true
@@ -4333,6 +171,7 @@ function runMcpCommand(parsed) {
       process.stderr.write("Error: `pyx-mem mcp rules <host>` takes no flags.\n");
       return EXIT.USAGE;
     }
+    const { installMemoryRulesOnly } = await import("../mcp-install-KBB45OB2.mjs");
     return installMemoryRulesOnly(parsed.positional[0]);
   }
   process.stderr.write(
@@ -4342,7 +181,7 @@ function runMcpCommand(parsed) {
   return EXIT.USAGE;
 }
 var LOGIN_FLAGS = /* @__PURE__ */ new Set(["endpoint", "api-key", "browser", "json", "no-open"]);
-function runLogin(parsed) {
+async function runLogin(parsed) {
   const { flags } = parsed;
   const browser = flags.browser === true;
   const invalid = Object.keys(flags).some((flag) => !LOGIN_FLAGS.has(flag)) || parsed.positional.length > 0 || flags.browser !== void 0 && !browser || (flags.json !== void 0 || flags["no-open"] !== void 0) && !browser || browser && flags["api-key"] !== void 0 || flags.json !== void 0 && flags.json !== true || flags["no-open"] !== void 0 && flags["no-open"] !== true;
@@ -4354,19 +193,21 @@ function runLogin(parsed) {
   }
   const endpoint = typeof flags.endpoint === "string" ? flags.endpoint : void 0;
   if (browser) {
+    const { browserLoginCommand } = await import("../login-browser-DO2O2Q2G.mjs");
     return browserLoginCommand({
       endpoint,
       json: flags.json === true,
       noOpen: flags["no-open"] === true
     });
   }
+  const { loginCommand } = await import("../login-4ALCAN4M.mjs");
   return loginCommand({
     endpoint,
     apiKey: typeof flags["api-key"] === "string" ? flags["api-key"] : void 0
   });
 }
 async function main() {
-  const parsed = parseArgs2(process.argv.slice(2));
+  const parsed = parseArgs(process.argv.slice(2));
   if (parsed.flags.help === true || parsed.flags.h === true) {
     process.stdout.write(HELP_TEXT);
     return EXIT.OK;
@@ -4378,43 +219,62 @@ async function main() {
       return EXIT.OK;
     case "login":
       return runLogin(parsed);
-    case "login-recovery":
+    case "login-recovery": {
+      const { loginRecoveryCommand } = await import("../login-recovery-AOO76PYX.mjs");
       return loginRecoveryCommand({
         json: parsed.flags.json === true,
         discardUnreadableJournal: parsed.flags["discard-unreadable-journal"] === true
       });
+    }
     case "lifecycle-capabilities":
       process.stdout.write(
         `${JSON.stringify({ schemaVersion: 1, browserLogin: true, sharedCredentialGuard: true })}
 `
       );
       return EXIT.OK;
-    case "status":
+    case "status": {
+      const { statusCommand } = await import("../status-UHJZLEPL.mjs");
       return statusCommand({ json: parsed.flags.json === true });
-    case "overview":
+    }
+    case "overview": {
       if (parsed.flags.json !== true) {
         process.stderr.write("Error: `pyx-mem overview` requires --json.\n");
         return EXIT.USAGE;
       }
+      const { overviewCommand } = await import("../overview-COBXHLP3.mjs");
       return overviewCommand();
-    case "insights":
+    }
+    case "insights": {
       if (parsed.flags.json !== true) {
         process.stderr.write("Error: `pyx-mem insights` requires --json.\n");
         return EXIT.USAGE;
       }
-      return insightsCommand({ withIdentity: parsed.flags["with-identity"] === true });
-    case "taxonomy":
+      const { insightsCommand } = await import("../insights-PD7Y6QDX.mjs");
+      return insightsCommand({
+        withIdentity: parsed.flags["with-identity"] === true,
+        withProvenance: parsed.flags["with-provenance"] === true
+      });
+    }
+    case "taxonomy": {
       if (parsed.flags.json !== true) {
         process.stderr.write("Error: `pyx-mem taxonomy` requires --json.\n");
         return EXIT.USAGE;
       }
+      const { taxonomyCommand } = await import("../taxonomy-EKDFDFXW.mjs");
       return taxonomyCommand({ withIdentity: parsed.flags["with-identity"] === true });
-    case "logout":
+    }
+    case "logout": {
+      const { logoutCommand } = await import("../logout-4CO53LNA.mjs");
       return logoutCommand({ json: parsed.flags.json === true });
-    case "doctor":
+    }
+    case "doctor": {
+      const { doctorCommand } = await import("../doctor-AERNUHEZ.mjs");
       return doctorCommand({ json: parsed.flags.json === true });
-    case "scaffold":
+    }
+    case "scaffold": {
+      const { scaffoldCommand } = await import("../scaffold-2FSCWF22.mjs");
       return scaffoldCommand({ name: parsed.flags.name });
+    }
     case "mcp":
       return runMcpCommand(parsed);
     default: