@remnic/core 1.1.14 → 1.1.15

package/dist/{chunk-XVZ7B3HG.js → chunk-JFEH2LZM.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 
 // src/semantic-rule-promotion.ts
 function normalizeRuleWhitespace(value) {
@@ -132,4 +132,4 @@ async function promoteSemanticRuleFromMemory(options) {
 export {
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-XVZ7B3HG.js.map
+//# sourceMappingURL=chunk-JFEH2LZM.js.map

package/dist/{chunk-JLFA7DQG.js → chunk-M3AA636B.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   buildLifecycleEventsForMemory,
   sortMemoryLifecycleEvents
@@ -59,4 +59,4 @@ async function rebuildMemoryLifecycleLedger(options) {
 export {
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-JLFA7DQG.js.map
+//# sourceMappingURL=chunk-M3AA636B.js.map

package/dist/{chunk-P4NEIHUT.js → chunk-MS3ULOZF.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-NZL6GGQE.js";
 import {
   StorageManager
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -105,4 +105,4 @@ async function searchVerifiedEpisodes(options) {
 export {
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-P4NEIHUT.js.map
+//# sourceMappingURL=chunk-MS3ULOZF.js.map

package/dist/{chunk-7IASACLB.js → chunk-NOHC2L57.js}

@@ -4,7 +4,7 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-FVQJYWH7.js";
@@ -593,4 +593,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-7IASACLB.js.map
+//# sourceMappingURL=chunk-NOHC2L57.js.map

package/dist/{chunk-6RVI47ZR.js → chunk-NTUNYIF7.js}

@@ -1,3 +1,6 @@
+import {
+  NoopSearchBackend
+} from "./chunk-NJ3MJQZX.js";
 import {
   OramaBackend
 } from "./chunk-XVVIG67A.js";
@@ -13,12 +16,9 @@ import {
 import {
   MeilisearchBackend
 } from "./chunk-TMQLARTH.js";
-import {
-  NoopSearchBackend
-} from "./chunk-NJ3MJQZX.js";
 import {
   createConversationIndexBackend
-} from "./chunk-PR5FBTFU.js";
+} from "./chunk-CYFQJMUV.js";
 import {
   FaissConversationIndexAdapter
 } from "./chunk-FJ43PRLT.js";
@@ -156,4 +156,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-6RVI47ZR.js.map
+//# sourceMappingURL=chunk-NTUNYIF7.js.map

package/dist/{chunk-CK5NTM2S.js → chunk-OGROP7ZN.js}

@@ -1,7 +1,7 @@
 import {
   decryptMemoryDirToPlaintext,
   migrateMemoryDirToEncrypted
-} from "./chunk-YNJHCGDT.js";
+} from "./chunk-SH5S7XYD.js";
 import {
   buildHeaderFromPassphrase,
   deriveKeyFromHeader,
@@ -451,4 +451,4 @@ export {
   renderStatusReport,
   createPassphraseReader
 };
-//# sourceMappingURL=chunk-CK5NTM2S.js.map
+//# sourceMappingURL=chunk-OGROP7ZN.js.map

package/dist/{chunk-MT25YHYH.js → chunk-OJRKZLZ4.js}

@@ -1,9 +1,9 @@
-import {
-  namespaceCollectionName
-} from "./chunk-PU63GXWS.js";
 import {
   NamespaceStorageRouter
-} from "./chunk-QQUAB63I.js";
+} from "./chunk-BEB4GUU5.js";
+import {
+  namespaceCollectionName
+} from "./chunk-W7DK3CYM.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -138,4 +138,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-MT25YHYH.js.map
+//# sourceMappingURL=chunk-OJRKZLZ4.js.map

package/dist/{chunk-2F2W355T.js → chunk-QA2ZAPBU.js}

@@ -1,12 +1,12 @@
-import {
-  encryptCapsuleFile
-} from "./chunk-KNKUID7G.js";
 import {
   CAPSULE_ID_PATTERN,
   CapsuleBlockSchema,
   ExportBundleV2Schema,
   ExportManifestV2Schema
 } from "./chunk-WEHSQBFR.js";
+import {
+  encryptCapsuleFile
+} from "./chunk-KNKUID7G.js";
 import {
   CAPSULE_SCHEMA_VERSION,
   EXPORT_FORMAT
@@ -253,4 +253,4 @@ export {
   exportCapsule,
   isValidCapsuleSince
 };
-//# sourceMappingURL=chunk-2F2W355T.js.map
+//# sourceMappingURL=chunk-QA2ZAPBU.js.map

package/dist/{chunk-MC26UJIM.js → chunk-QLKBF3TI.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -115,4 +115,4 @@ async function searchVerifiedSemanticRules(options) {
 export {
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-MC26UJIM.js.map
+//# sourceMappingURL=chunk-QLKBF3TI.js.map

package/dist/{chunk-YNJHCGDT.js → chunk-SH5S7XYD.js}

@@ -69,10 +69,10 @@ function filePathAad(filePath, memoryDir) {
   }
   return Buffer.from(rel, "utf8");
 }
-async function readMaybeEncryptedFile(filePath, key, memoryDir) {
+async function readMaybeEncryptedFileBuffer(filePath, key, memoryDir) {
   const buf = await readFile(filePath);
   if (!isEncryptedFile(buf)) {
-    return buf.toString("utf8");
+    return buf;
   }
   if (key === null) {
     throw new SecureStoreLockedError(
@@ -80,8 +80,10 @@ async function readMaybeEncryptedFile(filePath, key, memoryDir) {
     );
   }
   const aad = filePathAad(filePath, memoryDir);
-  const plain = decryptFileBody(buf, key, aad);
-  return plain.toString("utf8");
+  return decryptFileBody(buf, key, aad);
+}
+async function readMaybeEncryptedFile(filePath, key, memoryDir) {
+  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString("utf8");
 }
 async function writeMaybeEncryptedFile(filePath, content, key, options = {}, memoryDir) {
   const { mode = 384, atomic = true } = options;
@@ -301,9 +303,10 @@ export {
   encryptFileBody,
   decryptFileBody,
   filePathAad,
+  readMaybeEncryptedFileBuffer,
   readMaybeEncryptedFile,
   writeMaybeEncryptedFile,
   migrateMemoryDirToEncrypted,
   decryptMemoryDirToPlaintext
 };
-//# sourceMappingURL=chunk-YNJHCGDT.js.map
+//# sourceMappingURL=chunk-SH5S7XYD.js.map

package/dist/chunk-SH5S7XYD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { lstat, mkdir, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { generateSalt, open, seal } from \"./cipher.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`,\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  try {\n    return open(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(\n      `secure-store decryption failed: ${msg}`,\n    );\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFileBuffer(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<Buffer> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain file — legacy or unencrypted store.\n    return buf;\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. ` +\n        \"Run `remnic secure-store unlock` to decrypt.\",\n    );\n  }\n  const aad = filePathAad(filePath, memoryDir);\n  return decryptFileBody(buf, key, aad);\n}\n\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string,\n): Promise<string> {\n  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a `.tmp-<pid>-<ts>` file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string | Buffer,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string,\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>,\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = `${filePath}.enc-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(\n  dir: string,\n  key: Buffer,\n): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const aad = filePathAad(filePath, storageAadRootForFile(filePath, dir));\n      const plaintext = decryptFileBody(buf, key, aad);\n      const tempPath = `${filePath}.dec-tmp-${process.pid}-${Date.now()}`;\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir,\n): Promise<string[]> {\n  const results: string[] = [];\n  let names: string[];\n  try {\n    names = await readdir(dir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(dir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, rootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, rootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\nfunction storageAadRootForFile(filePath: string, rootDir: string): string {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return rootDir;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(rootDir, \"namespaces\", parts[1]);\n  }\n  return rootDir;\n}\n\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set([\n  \"facts\",\n  \"corrections\",\n  \"procedures\",\n  \"reasoning-traces\",\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\n  \"state\",\n  \"indexes\",\n  \"index\",\n  \"provenance\",\n]);\n"],"mappings":";;;;;;;AA6CA,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC3E,OAAO,UAAU;AAaV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAU/C,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,MAAI;AACF,WAAO,KAAK,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI;AAAA,MACR,mCAAmC,GAAG;AAAA,IACxC;AAAA,EACF;AACF;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,6BACpB,UACA,KACA,WACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IAEpE;AAAA,EACF;AACA,QAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,SAAO,gBAAgB,KAAK,KAAK,GAAG;AACtC;AAEA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,UAAQ,MAAM,6BAA6B,UAAU,KAAK,SAAS,GAAG,SAAS,MAAM;AACvF;AAyBA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC7D,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAA,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BACpB,KACA,KACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,MAAM,YAAY,UAAU,sBAAsB,UAAU,GAAG,CAAC;AACtE,YAAM,YAAY,gBAAgB,KAAK,KAAK,GAAG;AAC/C,YAAM,WAAW,GAAG,QAAQ,YAAY,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACjE,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAWA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,KAAK,EAAE,UAAU,OAAO,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,KAAK,IAAI;AAChC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,OAAO;AACvE,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,OAAO,GAAG;AAC/C,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAAkB,SAAyB;AACxE,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,SAAS,cAAc,MAAM,CAAC,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AAEA,IAAM,qCAAqC,oBAAI,IAAI;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":["unlink"]}

package/dist/{chunk-VW676BEI.js → chunk-V7WH7DEM.js}

@@ -1,7 +1,7 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   readEnvVar,
   resolveHomeDir
@@ -824,4 +824,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-VW676BEI.js.map
+//# sourceMappingURL=chunk-V7WH7DEM.js.map

package/dist/{chunk-A2XUIMJ3.js → chunk-VWFIQOTJ.js}

@@ -1,6 +1,6 @@
 import {
   isValidCapsuleSince
-} from "./chunk-2F2W355T.js";
+} from "./chunk-QA2ZAPBU.js";
 import {
   CAPSULE_ID_PATTERN
 } from "./chunk-WEHSQBFR.js";
@@ -246,6 +246,13 @@ var capsuleImportRequestSchema = z.object({
 var capsuleListRequestSchema = z.object({
   namespace: namespaceSchema
 });
+var offlineSyncApplyRequestSchema = z.object({
+  namespace: namespaceSchema,
+  changeset: z.unknown()
+}).refine((value) => value.changeset !== void 0 && value.changeset !== null, {
+  message: "changeset is required",
+  path: ["changeset"]
+});
 var nullableOptional = (schema) => schema.optional().nullable().transform((value) => value ?? void 0);
 var actionConfidenceRuleSchema = z.object({
   kind: z.enum(ACTION_CONFIDENCE_RULE_KINDS),
@@ -293,6 +300,7 @@ var schemas = {
   capsuleExport: capsuleExportRequestSchema,
   capsuleImport: capsuleImportRequestSchema,
   capsuleList: capsuleListRequestSchema,
+  offlineSyncApply: offlineSyncApplyRequestSchema,
   actionConfidence: actionConfidenceRequestSchema
 };
 function validateRequest(schemaName, body) {
@@ -335,7 +343,8 @@ export {
   capsuleExportRequestSchema,
   capsuleImportRequestSchema,
   capsuleListRequestSchema,
+  offlineSyncApplyRequestSchema,
   actionConfidenceRequestSchema,
   validateRequest
 };
-//# sourceMappingURL=chunk-A2XUIMJ3.js.map
+//# sourceMappingURL=chunk-VWFIQOTJ.js.map

package/dist/chunk-VWFIQOTJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-schema.ts"],"sourcesContent":["// Request/response schema validation for the Remnic HTTP API.\n// Uses zod for runtime validation — returns structured 400 errors with\n// field-level detail so consumers get clear feedback on malformed requests.\n\nimport { z } from \"zod\";\nimport {\n  ACTION_CONFIDENCE_CONTEXT_READINESS,\n  ACTION_CONFIDENCE_RISK_CATEGORIES,\n  ACTION_CONFIDENCE_RULE_KINDS,\n} from \"./action-confidence.js\";\nimport { isValidCapsuleSince } from \"./transfer/capsule-export.js\";\nimport { CAPSULE_ID_PATTERN } from \"./transfer/types.js\";\n\n// ---------------------------------------------------------------------------\n// Error formatting\n// ---------------------------------------------------------------------------\n\nexport interface SchemaValidationError {\n  error: string;\n  code: \"validation_error\";\n  details: Array<{ field: string; message: string }>;\n}\n\nexport function formatZodError(error: z.ZodError): SchemaValidationError {\n  return {\n    error: \"request validation failed\",\n    code: \"validation_error\",\n    details: error.issues.map((issue) => ({\n      field: issue.path.join(\".\") || \"(root)\",\n      message: issue.message,\n    })),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Shared fields\n// ---------------------------------------------------------------------------\n\nconst namespaceSchema = z.string().trim().max(256).optional();\nconst sessionKeySchema = z.string().trim().min(1).max(512).optional();\nconst idempotencyKeySchema = z.string().trim().min(1).max(256).optional();\nconst dryRunSchema = z.boolean().optional();\nconst schemaVersionSchema = z.number().int().optional();\n\n// ---------------------------------------------------------------------------\n// Recall\n// ---------------------------------------------------------------------------\n\n/**\n * Coding-agent context (issue #569). Optional payload that connectors may\n * ship with a recall request so the project/branch namespace overlay\n * applies to that recall. All fields are validated per CLAUDE.md #51 —\n * empty-string projectId / rootPath is rejected, not silently accepted.\n */\nexport const codingContextSchema = z\n  .object({\n    projectId: z.string().trim().min(1, \"codingContext.projectId is required\").max(128),\n    branch: z.string().trim().max(256).nullable(),\n    rootPath: z.string().trim().min(1, \"codingContext.rootPath is required\").max(1024),\n    defaultBranch: z.string().trim().max(256).nullable(),\n  })\n  .nullable();\n\n/**\n * Recall disclosure depth (issue #677).  Mirrors the `RecallDisclosure`\n * type in `types.ts` — keep these in sync.  Default-application happens\n * inside `EngramAccessService.recall()`; the schema only accepts/rejects.\n * Invalid values throw a structured 400 instead of silently defaulting,\n * per CLAUDE.md rule 51.\n */\nexport const recallDisclosureSchema = z.enum([\"chunk\", \"section\", \"raw\"]);\n\n/**\n * Tag-match semantics (issue #689). `any` (default when `tags` is provided\n * and `tagMatch` is omitted) admits a result when it carries at least one\n * of the filter tags. `all` requires every filter tag to be present.\n * Schema rejects unknown values up front — never silently defaults\n * (CLAUDE.md rule 51).\n */\nexport const tagMatchSchema = z.enum([\"any\", \"all\"]);\n\nexport const recallRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  topK: z.number().int().min(0).max(200).optional(),\n  mode: z.enum([\"auto\", \"no_recall\", \"minimal\", \"full\", \"graph_mode\"]).optional(),\n  includeDebug: z.boolean().optional(),\n  idempotencyKey: idempotencyKeySchema,\n  disclosure: recallDisclosureSchema.optional(),\n  codingContext: codingContextSchema.optional(),\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: z.string().trim().min(1, \"cwd must be non-empty when provided\").max(2048).optional(),\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: z.string().trim().min(1, \"projectTag must be non-empty when provided\").max(256).optional(),\n  /**\n   * Historical recall pin (issue #680).  ISO 8601 timestamp.  The\n   * schema only enforces the basic shape; the access service runs\n   * `Date.parse` and emits a structured 400 on malformed input\n   * (CLAUDE.md rule 51).\n   */\n  asOf: z.string().trim().min(1, \"asOf must be a non-empty ISO 8601 timestamp\").max(64).optional(),\n  /**\n   * Free-form recall tag filter (issue #689). When provided, recall results\n   * whose frontmatter `tags` do not match the filter are removed before the\n   * response is returned. Comparison is case-sensitive exact match.\n   */\n  tags: z.array(z.string().trim().min(1).max(256)).max(50).optional(),\n  /**\n   * Match mode for `tags` (issue #689). Defaults to `\"any\"` when `tags` is\n   * provided and `tagMatch` is omitted. Ignored when `tags` is absent.\n   */\n  tagMatch: tagMatchSchema.optional(),\n  /**\n   * Include graph edges below `graphTraversalConfidenceFloor` for diagnostic\n   * recall traversal (issue #681). Defaults to false.\n   */\n  includeLowConfidence: z.boolean().optional(),\n});\n\nexport const recallExplainRequestSchema = z.object({\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n});\n\n/**\n * Standalone \"set coding context\" request. Used by the HTTP endpoint\n * `POST /engram/v1/coding-context` and the MCP `remnic.set_coding_context`\n * tool (PR 7). `codingContext: null` clears the attached context.\n */\nexport const setCodingContextRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  codingContext: codingContextSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Observe\n// ---------------------------------------------------------------------------\n\nconst messageSchema = z.object({\n  role: z.enum([\"user\", \"assistant\"]),\n  content: z.string().min(1, \"message content must be non-empty\"),\n  sourceFormat: z\n    .enum([\"openai\", \"anthropic\", \"openclaw\", \"pi\", \"lossless-claw\", \"remnic\"])\n    .nullable()\n    .optional(),\n  rawContent: z.unknown().nullable().optional(),\n  parts: z\n    .array(\n      z.object({\n        ordinal: z.number().int().min(0).nullable().optional(),\n        kind: z.enum([\n          \"text\",\n          \"tool_call\",\n          \"tool_result\",\n          \"patch\",\n          \"file_read\",\n          \"file_write\",\n          \"step_start\",\n          \"step_finish\",\n          \"snapshot\",\n          \"retry\",\n        ]),\n        payload: z.record(z.string(), z.unknown()),\n        toolName: z.string().nullable().optional(),\n        tool_name: z.string().nullable().optional(),\n        filePath: z.string().nullable().optional(),\n        file_path: z.string().nullable().optional(),\n        createdAt: z.string().nullable().optional(),\n        created_at: z.string().nullable().optional(),\n      }),\n    )\n    .nullable()\n    .optional(),\n});\n\nexport const observeRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  messages: z.array(messageSchema).min(1, \"messages must be a non-empty array\"),\n  namespace: namespaceSchema,\n  skipExtraction: z.boolean().optional(),\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: z.string().trim().min(1, \"cwd must be non-empty when provided\").max(2048).optional(),\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: z.string().trim().min(1, \"projectTag must be non-empty when provided\").max(256).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Memory store / suggestion submit\n// ---------------------------------------------------------------------------\n\nconst writeContentSchema = z.string().min(1, \"content is required\").max(50000);\nconst categorySchema = z\n  .enum([\n    \"fact\", \"preference\", \"correction\", \"entity\", \"decision\",\n    \"relationship\", \"principle\", \"commitment\", \"moment\", \"skill\", \"rule\", \"procedure\",\n    \"reasoning_trace\",\n  ])\n  .optional();\nconst confidenceSchema = z.number().min(0).max(1).optional();\nconst tagsSchema = z.array(z.string().max(256)).max(50).optional();\nconst entityRefSchema = z.string().trim().max(512).optional();\nconst ttlSchema = z.string().trim().max(128).optional();\nconst sourceReasonSchema = z.string().trim().max(2000).optional();\n\nexport const memoryStoreRequestSchema = z.object({\n  schemaVersion: schemaVersionSchema,\n  idempotencyKey: idempotencyKeySchema,\n  dryRun: dryRunSchema,\n  sessionKey: sessionKeySchema,\n  content: writeContentSchema,\n  category: categorySchema,\n  confidence: confidenceSchema,\n  namespace: namespaceSchema,\n  tags: tagsSchema,\n  entityRef: entityRefSchema,\n  ttl: ttlSchema,\n  sourceReason: sourceReasonSchema,\n});\n\nexport const suggestionSubmitRequestSchema = memoryStoreRequestSchema;\n\n// ---------------------------------------------------------------------------\n// Review disposition\n// ---------------------------------------------------------------------------\n\nexport const reviewDispositionRequestSchema = z.object({\n  memoryId: z.string().trim().min(1, \"memoryId is required\"),\n  status: z.enum([\n    \"active\", \"pending_review\", \"quarantined\", \"rejected\", \"superseded\", \"archived\",\n  ]),\n  reasonCode: z.string().trim().min(1, \"reasonCode is required\"),\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone promote\n// ---------------------------------------------------------------------------\n\nexport const trustZonePromoteRequestSchema = z.object({\n  recordId: z.string().trim().min(1, \"recordId is required\"),\n  targetZone: z.enum([\"working\", \"trusted\"], {\n    errorMap: () => ({ message: \"targetZone must be 'working' or 'trusted'\" }),\n  }),\n  promotionReason: z.string().trim().min(1, \"promotionReason is required\"),\n  recordedAt: z.string().trim().optional(),\n  summary: z.string().trim().max(5000).optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone demo-seed\n// ---------------------------------------------------------------------------\n\nexport const trustZoneDemoSeedRequestSchema = z.object({\n  scenario: z.string().trim().max(256).optional(),\n  recordedAt: z.string().trim().optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// LCM search\n// ---------------------------------------------------------------------------\n\nexport const lcmSearchRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  limit: z.number().int().min(1).max(100).optional(),\n});\n\nexport const lcmCompactionFlushRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n});\n\nexport const lcmCompactionRecordRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n  tokensBefore: z.number().int().min(0, \"tokensBefore must be a non-negative integer\"),\n  tokensAfter: z.number().int().min(0, \"tokensAfter must be a non-negative integer\"),\n});\n\n// ---------------------------------------------------------------------------\n// Day summary\n// ---------------------------------------------------------------------------\n\nexport const daySummaryRequestSchema = z.object({\n  memories: z.string().max(100000).optional(),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Capsule export\n// ---------------------------------------------------------------------------\n\nconst capsuleTopLevelSegmentSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine(\n    (value) => !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a top-level directory name without path separators\",\n  );\n\nconst capsulePeerIdSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(256)\n  .refine(\n    (value) => value !== \".\" && value !== \"..\" && !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a plain peer id without path separators\",\n  );\n\nconst capsuleIsoSinceSchema = z\n  .string()\n  .trim()\n  .min(1, \"since must be a non-empty ISO 8601 timestamp\")\n  .max(128)\n  .refine(\n    isValidCapsuleSince,\n    \"since must be a valid ISO 8601 timestamp with no calendar overflow\",\n  );\n\nexport const capsuleExportRequestSchema = z\n  .object({\n    name: z\n      .string()\n      .trim()\n      .min(1, \"name is required\")\n      .max(64, \"name must be 64 characters or fewer\")\n      .regex(\n        CAPSULE_ID_PATTERN,\n        \"name must be alphanumeric with single dashes (no spaces, no leading/trailing dashes)\",\n      ),\n    namespace: namespaceSchema,\n    since: capsuleIsoSinceSchema.optional(),\n    includeKinds: z.array(capsuleTopLevelSegmentSchema).max(50).optional(),\n    peerIds: z.array(capsulePeerIdSchema).max(100).optional(),\n    includeTranscripts: z.boolean().optional(),\n    encrypt: z.boolean().optional(),\n  });\n\nexport const capsuleImportRequestSchema = z\n  .object({\n    archivePath: z.string().trim().min(1, \"archivePath is required\").max(4096),\n    namespace: namespaceSchema,\n    mode: z.enum([\"skip\", \"overwrite\", \"fork\"]).optional(),\n  });\n\nexport const capsuleListRequestSchema = z\n  .object({\n    namespace: namespaceSchema,\n  });\n\n// ---------------------------------------------------------------------------\n// Offline sync\n// ---------------------------------------------------------------------------\n\nexport const offlineSyncApplyRequestSchema = z\n  .object({\n    namespace: namespaceSchema,\n    changeset: z.unknown(),\n  })\n  .refine((value) => value.changeset !== undefined && value.changeset !== null, {\n    message: \"changeset is required\",\n    path: [\"changeset\"],\n  });\n\n// ---------------------------------------------------------------------------\n// Action confidence\n// ---------------------------------------------------------------------------\n\nconst nullableOptional = <T extends z.ZodTypeAny>(schema: T) =>\n  schema.optional().nullable().transform((value) => value ?? undefined);\n\nconst actionConfidenceRuleSchema = z\n  .object({\n    kind: z.enum(ACTION_CONFIDENCE_RULE_KINDS),\n    description: nullableOptional(z.string().trim().min(1).max(2000)),\n    matched: nullableOptional(z.boolean()),\n  })\n  .strict();\n\nconst actionConfidenceMemorySchema = z\n  .object({\n    source: nullableOptional(z.string().trim().min(1).max(256)),\n    created: nullableOptional(z.string().trim().min(1).max(128)),\n    updated: nullableOptional(z.string().trim().min(1).max(128)),\n    scope: nullableOptional(z.string().trim().min(1).max(512)),\n    userContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    retrievalReason: nullableOptional(z.string().trim().min(1).max(2000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    stale: nullableOptional(z.boolean()),\n    corrected: nullableOptional(z.boolean()),\n    correctionState: nullableOptional(z.enum([\"none\", \"correction\", \"superseded\", \"disputed\", \"forgotten\"])),\n    safeToUse: nullableOptional(z.boolean()),\n    safety: nullableOptional(z.enum([\"safe\", \"requires-review\", \"blocked\"])),\n    safetyReasons: nullableOptional(z.array(z.string().trim().min(1).max(1000)).max(50)),\n  })\n  .strict();\n\nexport const actionConfidenceRequestSchema = z\n  .object({\n    intendedAction: nullableOptional(z.string().trim().min(1).max(1000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    risk: nullableOptional(z.enum(ACTION_CONFIDENCE_RISK_CATEGORIES)),\n    contextReadiness: nullableOptional(z.enum(ACTION_CONFIDENCE_CONTEXT_READINESS)),\n    currentContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    userRules: nullableOptional(z.array(actionConfidenceRuleSchema).max(100)),\n    retrievedMemories: nullableOptional(z.array(actionConfidenceMemorySchema).max(200)),\n  })\n  .strict();\n\n// ---------------------------------------------------------------------------\n// Inferred types\n// ---------------------------------------------------------------------------\n\nexport type RecallRequest = z.infer<typeof recallRequestSchema>;\nexport type RecallExplainRequest = z.infer<typeof recallExplainRequestSchema>;\nexport type SetCodingContextRequest = z.infer<typeof setCodingContextRequestSchema>;\nexport type ObserveRequest = z.infer<typeof observeRequestSchema>;\nexport type MemoryStoreRequest = z.infer<typeof memoryStoreRequestSchema>;\nexport type SuggestionSubmitRequest = z.infer<typeof suggestionSubmitRequestSchema>;\nexport type ReviewDispositionRequest = z.infer<typeof reviewDispositionRequestSchema>;\nexport type TrustZonePromoteRequest = z.infer<typeof trustZonePromoteRequestSchema>;\nexport type TrustZoneDemoSeedRequest = z.infer<typeof trustZoneDemoSeedRequestSchema>;\nexport type LcmSearchRequest = z.infer<typeof lcmSearchRequestSchema>;\nexport type LcmCompactionFlushRequest = z.infer<typeof lcmCompactionFlushRequestSchema>;\nexport type LcmCompactionRecordRequest = z.infer<typeof lcmCompactionRecordRequestSchema>;\nexport type DaySummaryRequest = z.infer<typeof daySummaryRequestSchema>;\nexport type CapsuleExportRequest = z.infer<typeof capsuleExportRequestSchema>;\nexport type CapsuleImportRequest = z.infer<typeof capsuleImportRequestSchema>;\nexport type CapsuleListRequest = z.infer<typeof capsuleListRequestSchema>;\nexport type OfflineSyncApplyRequest = z.infer<typeof offlineSyncApplyRequestSchema>;\nexport type ActionConfidenceRequest = z.infer<typeof actionConfidenceRequestSchema>;\n\n// ---------------------------------------------------------------------------\n// Validation helper\n// ---------------------------------------------------------------------------\n\nexport type SchemaName =\n  | \"recall\"\n  | \"recallExplain\"\n  | \"setCodingContext\"\n  | \"observe\"\n  | \"memoryStore\"\n  | \"suggestionSubmit\"\n  | \"reviewDisposition\"\n  | \"trustZonePromote\"\n  | \"trustZoneDemoSeed\"\n  | \"lcmSearch\"\n  | \"lcmCompactionFlush\"\n  | \"lcmCompactionRecord\"\n  | \"daySummary\"\n  | \"capsuleExport\"\n  | \"capsuleImport\"\n  | \"capsuleList\"\n  | \"offlineSyncApply\"\n  | \"actionConfidence\";\n\nexport type SchemaTypeFor<N extends SchemaName> =\n  N extends \"recall\" ? RecallRequest\n  : N extends \"recallExplain\" ? RecallExplainRequest\n  : N extends \"setCodingContext\" ? SetCodingContextRequest\n  : N extends \"observe\" ? ObserveRequest\n  : N extends \"memoryStore\" ? MemoryStoreRequest\n  : N extends \"suggestionSubmit\" ? SuggestionSubmitRequest\n  : N extends \"reviewDisposition\" ? ReviewDispositionRequest\n  : N extends \"trustZonePromote\" ? TrustZonePromoteRequest\n  : N extends \"trustZoneDemoSeed\" ? TrustZoneDemoSeedRequest\n  : N extends \"lcmSearch\" ? LcmSearchRequest\n  : N extends \"lcmCompactionFlush\" ? LcmCompactionFlushRequest\n  : N extends \"lcmCompactionRecord\" ? LcmCompactionRecordRequest\n  : N extends \"daySummary\" ? DaySummaryRequest\n  : N extends \"capsuleExport\" ? CapsuleExportRequest\n  : N extends \"capsuleImport\" ? CapsuleImportRequest\n  : N extends \"capsuleList\" ? CapsuleListRequest\n  : N extends \"offlineSyncApply\" ? OfflineSyncApplyRequest\n  : N extends \"actionConfidence\" ? ActionConfidenceRequest\n  : never;\n\nconst schemas: Record<SchemaName, z.ZodTypeAny> = {\n  recall: recallRequestSchema,\n  recallExplain: recallExplainRequestSchema,\n  setCodingContext: setCodingContextRequestSchema,\n  observe: observeRequestSchema,\n  memoryStore: memoryStoreRequestSchema,\n  suggestionSubmit: suggestionSubmitRequestSchema,\n  reviewDisposition: reviewDispositionRequestSchema,\n  trustZonePromote: trustZonePromoteRequestSchema,\n  trustZoneDemoSeed: trustZoneDemoSeedRequestSchema,\n  lcmSearch: lcmSearchRequestSchema,\n  lcmCompactionFlush: lcmCompactionFlushRequestSchema,\n  lcmCompactionRecord: lcmCompactionRecordRequestSchema,\n  daySummary: daySummaryRequestSchema,\n  capsuleExport: capsuleExportRequestSchema,\n  capsuleImport: capsuleImportRequestSchema,\n  capsuleList: capsuleListRequestSchema,\n  offlineSyncApply: offlineSyncApplyRequestSchema,\n  actionConfidence: actionConfidenceRequestSchema,\n};\n\n/**\n * Validate a request body against the named schema.\n * Returns `{ success: true, data }` on pass or\n * `{ success: false, error }` on failure with field-level detail.\n */\nexport function validateRequest<T = unknown>(\n  schemaName: SchemaName,\n  body: unknown,\n): { success: true; data: T } | { success: false; error: SchemaValidationError } {\n  const schema = schemas[schemaName];\n  if (!schema) {\n    return {\n      success: false,\n      error: {\n        error: `unknown schema: ${schemaName}`,\n        code: \"validation_error\",\n        details: [],\n      },\n    };\n  }\n  const result = schema.safeParse(body);\n  if (result.success) {\n    return { success: true, data: result.data as T };\n  }\n  return { success: false, error: formatZodError(result.error) };\n}\n"],"mappings":";;;;;;;;;;;;;AAIA,SAAS,SAAS;AAmBX,SAAS,eAAe,OAA0C;AACvE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpC,OAAO,MAAM,KAAK,KAAK,GAAG,KAAK;AAAA,MAC/B,SAAS,MAAM;AAAA,IACjB,EAAE;AAAA,EACJ;AACF;AAMA,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpE,IAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACxE,IAAM,eAAe,EAAE,QAAQ,EAAE,SAAS;AAC1C,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAY/C,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,GAAG;AAAA,EAClF,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oCAAoC,EAAE,IAAI,IAAI;AAAA,EACjF,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACrD,CAAC,EACA,SAAS;AASL,IAAM,yBAAyB,EAAE,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC;AASjE,IAAM,iBAAiB,EAAE,KAAK,CAAC,OAAO,KAAK,CAAC;AAE5C,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,WAAW,QAAQ,YAAY,CAAC,EAAE,SAAS;AAAA,EAC9E,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,gBAAgB;AAAA,EAChB,YAAY,uBAAuB,SAAS;AAAA,EAC5C,eAAe,oBAAoB,SAAS;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,4CAA4C,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6CAA6C,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlE,UAAU,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAC7C,CAAC;AAEM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAOM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,eAAe;AACjB,CAAC;AAMD,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,mCAAmC;AAAA,EAC9D,cAAc,EACX,KAAK,CAAC,UAAU,aAAa,YAAY,MAAM,iBAAiB,QAAQ,CAAC,EACzE,SAAS,EACT,SAAS;AAAA,EACZ,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAO,EACJ;AAAA,IACC,EAAE,OAAO;AAAA,MACP,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,MACrD,MAAM,EAAE,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,MACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,EACC,SAAS,EACT,SAAS;AACd,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,UAAU,EAAE,MAAM,aAAa,EAAE,IAAI,GAAG,oCAAoC;AAAA,EAC5E,WAAW;AAAA,EACX,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,4CAA4C,EAAE,IAAI,GAAG,EAAE,SAAS;AACvG,CAAC;AAMD,IAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,GAAK;AAC7E,IAAM,iBAAiB,EACpB,KAAK;AAAA,EACJ;AAAA,EAAQ;AAAA,EAAc;AAAA,EAAc;AAAA,EAAU;AAAA,EAC9C;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAc;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EACtE;AACF,CAAC,EACA,SAAS;AACZ,IAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3D,IAAM,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACjE,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,IAAM,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAEzD,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AAAA,EACX,KAAK;AAAA,EACL,cAAc;AAChB,CAAC;AAEM,IAAM,gCAAgC;AAMtC,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,QAAQ,EAAE,KAAK;AAAA,IACb;AAAA,IAAU;AAAA,IAAkB;AAAA,IAAe;AAAA,IAAY;AAAA,IAAc;AAAA,EACvE,CAAC;AAAA,EACD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB;AAAA,EAC7D,WAAW;AACb,CAAC;AAMM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,YAAY,EAAE,KAAK,CAAC,WAAW,SAAS,GAAG;AAAA,IACzC,UAAU,OAAO,EAAE,SAAS,4CAA4C;AAAA,EAC1E,CAAC;AAAA,EACD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6BAA6B;AAAA,EACvE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC9C,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AACb,CAAC;AAEM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AAAA,EACX,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,6CAA6C;AAAA,EACnF,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,4CAA4C;AACnF,CAAC;AAMM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EAC1C,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAMD,IAAM,+BAA+B,EAClC,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EACvD;AACF;AAEF,IAAM,sBAAsB,EACzB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,UAAU,OAAO,UAAU,QAAQ,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EAC1F;AACF;AAEF,IAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL,IAAI,GAAG,8CAA8C,EACrD,IAAI,GAAG,EACP;AAAA,EACC;AAAA,EACA;AACF;AAEK,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,MAAM,EACH,OAAO,EACP,KAAK,EACL,IAAI,GAAG,kBAAkB,EACzB,IAAI,IAAI,qCAAqC,EAC7C;AAAA,IACC;AAAA,IACA;AAAA,EACF;AAAA,EACF,WAAW;AAAA,EACX,OAAO,sBAAsB,SAAS;AAAA,EACtC,cAAc,EAAE,MAAM,4BAA4B,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACrE,SAAS,EAAE,MAAM,mBAAmB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAEI,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,yBAAyB,EAAE,IAAI,IAAI;AAAA,EACzE,WAAW;AAAA,EACX,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,MAAM,CAAC,EAAE,SAAS;AACvD,CAAC;AAEI,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,WAAW;AACb,CAAC;AAMI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,WAAW;AAAA,EACX,WAAW,EAAE,QAAQ;AACvB,CAAC,EACA,OAAO,CAAC,UAAU,MAAM,cAAc,UAAa,MAAM,cAAc,MAAM;AAAA,EAC5E,SAAS;AAAA,EACT,MAAM,CAAC,WAAW;AACpB,CAAC;AAMH,IAAM,mBAAmB,CAAyB,WAChD,OAAO,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,SAAS,MAAS;AAEtE,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,MAAM,EAAE,KAAK,4BAA4B;AAAA,EACzC,aAAa,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EAChE,SAAS,iBAAiB,EAAE,QAAQ,CAAC;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,+BAA+B,EAClC,OAAO;AAAA,EACN,QAAQ,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC1D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,OAAO,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EACzD,mBAAmB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACtF,iBAAiB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACpE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,OAAO,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACnC,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,iBAAiB,iBAAiB,EAAE,KAAK,CAAC,QAAQ,cAAc,cAAc,YAAY,WAAW,CAAC,CAAC;AAAA,EACvG,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,QAAQ,iBAAiB,EAAE,KAAK,CAAC,QAAQ,mBAAmB,SAAS,CAAC,CAAC;AAAA,EACvE,eAAe,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACrF,CAAC,EACA,OAAO;AAEH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACnE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,MAAM,iBAAiB,EAAE,KAAK,iCAAiC,CAAC;AAAA,EAChE,kBAAkB,iBAAiB,EAAE,KAAK,mCAAmC,CAAC;AAAA,EAC9E,sBAAsB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACzF,WAAW,iBAAiB,EAAE,MAAM,0BAA0B,EAAE,IAAI,GAAG,CAAC;AAAA,EACxE,mBAAmB,iBAAiB,EAAE,MAAM,4BAA4B,EAAE,IAAI,GAAG,CAAC;AACpF,CAAC,EACA,OAAO;AAsEV,IAAM,UAA4C;AAAA,EAChD,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,SAAS;AAAA,EACT,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,eAAe;AAAA,EACf,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,kBAAkB;AACpB;AAOO,SAAS,gBACd,YACA,MAC+E;AAC/E,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,OAAO,mBAAmB,UAAU;AAAA,QACpC,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,IAAI;AACpC,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,SAAS,MAAM,MAAM,OAAO,KAAU;AAAA,EACjD;AACA,SAAO,EAAE,SAAS,OAAO,OAAO,eAAe,OAAO,KAAK,EAAE;AAC/D;","names":[]}

package/dist/{chunk-PU63GXWS.js → chunk-W7DK3CYM.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-6RVI47ZR.js";
+} from "./chunk-NTUNYIF7.js";
 
 // src/namespaces/search.ts
 function namespaceCollectionName(baseCollection, namespace, options) {
@@ -171,4 +171,4 @@ export {
   namespaceCollectionName,
   NamespaceSearchRouter
 };
-//# sourceMappingURL=chunk-PU63GXWS.js.map
+//# sourceMappingURL=chunk-W7DK3CYM.js.map

package/dist/{chunk-TFO23QT4.js → chunk-XKLD5OK4.js}

@@ -1,10 +1,10 @@
-import {
-  SQLITE_SCHEMA_VERSION
-} from "./chunk-Z734BLO3.js";
 import {
   parseConflictPolicy,
   validateManifestRecords
 } from "./chunk-3JXBXXM2.js";
+import {
+  SQLITE_SCHEMA_VERSION
+} from "./chunk-Z734BLO3.js";
 import {
   openBetterSqlite3
 } from "./chunk-3HPAPHUK.js";
@@ -85,4 +85,4 @@ async function importSqlite(opts) {
 export {
   importSqlite
 };
-//# sourceMappingURL=chunk-TFO23QT4.js.map
+//# sourceMappingURL=chunk-XKLD5OK4.js.map

package/dist/{chunk-I5V2VDIW.js → chunk-YCVWX2NF.js}

@@ -1,6 +1,6 @@
 import {
   runPostConsolidationMaterialize
-} from "./chunk-ME6ESPZU.js";
+} from "./chunk-IG5VGHYB.js";
 import {
   discoverMemoryExtensions,
   renderExtensionsBlock,
@@ -216,4 +216,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-I5V2VDIW.js.map
+//# sourceMappingURL=chunk-YCVWX2NF.js.map

package/dist/{chunk-UXHQAFNA.js → chunk-ZPXYWTN5.js}

@@ -1,6 +1,6 @@
 import {
   listNamespaces
-} from "./chunk-MT25YHYH.js";
+} from "./chunk-OJRKZLZ4.js";
 import {
   runConsolidationProvenanceCheck
 } from "./chunk-5HRY2WRF.js";
@@ -36,13 +36,13 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-EFJ3MQ4V.js";
+} from "./chunk-65HQPW6O.js";
 import {
   analyzeGraphHealth
 } from "./chunk-RK2Y4XOM.js";
 import {
   StorageManager
-} from "./chunk-7AAT6G4Q.js";
+} from "./chunk-IOAY54RF.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -1314,4 +1314,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-UXHQAFNA.js.map
+//# sourceMappingURL=chunk-ZPXYWTN5.js.map

package/dist/{chunk-CHEL3SKB.js → chunk-ZYRMKWVW.js}

@@ -12,25 +12,25 @@ import {
 } from "./chunk-TK4UEOSK.js";
 import {
   importSqlite
-} from "./chunk-TFO23QT4.js";
-import {
-  backupMemoryDir
-} from "./chunk-7OZ53EXP.js";
-import {
-  exportJsonBundle
-} from "./chunk-GIF42EW3.js";
-import {
-  exportSqlite
-} from "./chunk-66DHUKLO.js";
+} from "./chunk-XKLD5OK4.js";
 import {
   detectImportFormat
 } from "./chunk-DOM4GKSW.js";
 import {
   importJsonBundle
 } from "./chunk-W4L6CZKA.js";
+import {
+  backupMemoryDir
+} from "./chunk-7OZ53EXP.js";
+import {
+  exportJsonBundle
+} from "./chunk-GIF42EW3.js";
 import {
   exportMarkdownBundle
 } from "./chunk-6H2TESSP.js";
+import {
+  exportSqlite
+} from "./chunk-66DHUKLO.js";
 import {
   TailscaleHelper
 } from "./chunk-TKWGAOLV.js";
@@ -44,12 +44,12 @@ import {
 } from "./chunk-TPMQ3G6Z.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-JLFA7DQG.js";
+} from "./chunk-M3AA636B.js";
 import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-KLAO5DGL.js";
+} from "./chunk-G7JBLD65.js";
 import {
   rebuildObservations
 } from "./chunk-PZIAX57I.js";
@@ -64,7 +64,7 @@ import {
 } from "./chunk-TMM4S4IJ.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-XVZ7B3HG.js";
+} from "./chunk-JFEH2LZM.js";
 import {
   resolveAgentAccessAuthToken
 } from "./chunk-MXC3AP5I.js";
@@ -92,12 +92,12 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-UXHQAFNA.js";
+} from "./chunk-ZPXYWTN5.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-MT25YHYH.js";
+} from "./chunk-OJRKZLZ4.js";
 import {
   GraphDashboardServer
 } from "./chunk-ZPKBYX2F.js";
@@ -108,6 +108,9 @@ import {
 import {
   RoutingRulesStore
 } from "./chunk-LUDTDZLK.js";
+import {
+  searchVerifiedEpisodes
+} from "./chunk-MS3ULOZF.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
@@ -116,15 +119,12 @@ import {
   getUtilityTelemetryStatus,
   recordUtilityTelemetryEvent
 } from "./chunk-3QKK7QOS.js";
-import {
-  searchVerifiedEpisodes
-} from "./chunk-P4NEIHUT.js";
 import {
   ThreadingManager
 } from "./chunk-W4RVMTHR.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-MC26UJIM.js";
+} from "./chunk-QLKBF3TI.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
@@ -196,13 +196,13 @@ import {
 } from "./chunk-NGAVDO7E.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-CQZRLNMV.js";
+} from "./chunk-HJ2WMBFB.js";
 import {
   EngramMcpServer
-} from "./chunk-WZYKANL3.js";
+} from "./chunk-BNATB54A.js";
 import {
   EngramAccessService
-} from "./chunk-M23FSH32.js";
+} from "./chunk-5D2G67ZQ.js";
 import {
   WorkStorage
 } from "./chunk-WELDCG6C.js";
@@ -224,7 +224,7 @@ import {
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-EFJ3MQ4V.js";
+} from "./chunk-65HQPW6O.js";
 import {
   selectRouteRule,
   validateRouteTarget
@@ -232,13 +232,13 @@ import {
 import {
   analyzeGraphHealth
 } from "./chunk-RK2Y4XOM.js";
-import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
 } from "./chunk-Q7P4WJDP.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   expandTildePath
 } from "./chunk-QRNI5JBH.js";
@@ -6755,4 +6755,4 @@ export {
   resolveMemoryDirForNamespace,
   registerCli
 };
-//# sourceMappingURL=chunk-CHEL3SKB.js.map
+//# sourceMappingURL=chunk-ZYRMKWVW.js.map

package/dist/{chunk-GGKRUQOO.js → chunk-ZYVPLJ4T.js}

@@ -1,13 +1,13 @@
 import {
   createVersion
 } from "./chunk-FAAFWE4G.js";
+import {
+  parseExportBundle
+} from "./chunk-WEHSQBFR.js";
 import {
   decryptCapsuleFileInMemory,
   isEncryptedCapsuleFile
 } from "./chunk-KNKUID7G.js";
-import {
-  parseExportBundle
-} from "./chunk-WEHSQBFR.js";
 import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot,
@@ -225,4 +225,4 @@ function mintForkId(capsuleId, originalId, now) {
 export {
   importCapsule
 };
-//# sourceMappingURL=chunk-GGKRUQOO.js.map
+//# sourceMappingURL=chunk-ZYVPLJ4T.js.map