@remnic/core 1.1.2 → 1.1.3

package/dist/secure-store-4R2GSO7S.js

@@ -0,0 +1,156 @@
+import {
+  MIN_PASSPHRASE_LENGTH,
+  createPassphraseReader,
+  renderDisableReport,
+  renderInitReport,
+  renderLockReport,
+  renderMigrateReport,
+  renderStatusReport,
+  renderUnlockReport,
+  runSecureStoreDisable,
+  runSecureStoreInit,
+  runSecureStoreLock,
+  runSecureStoreMigrate,
+  runSecureStoreStatus,
+  runSecureStoreUnlock
+} from "./chunk-CK5NTM2S.js";
+import {
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  SecureStoreDecryptError,
+  SecureStoreLockedError,
+  decryptFileBody,
+  decryptMemoryDirToPlaintext,
+  encryptFileBody,
+  filePathAad,
+  isEncryptedFile,
+  migrateMemoryDirToEncrypted,
+  readMaybeEncryptedFile,
+  writeMaybeEncryptedFile
+} from "./chunk-YNJHCGDT.js";
+import {
+  HEADER_FILENAME,
+  HEADER_FORMAT,
+  HEADER_FORMAT_VERSION,
+  SECURE_STORE_DIR_NAME,
+  buildHeader,
+  buildHeaderFromPassphrase,
+  deriveKeyFromHeader,
+  headerPath,
+  keyring_exports,
+  parseHeader,
+  readHeader,
+  secureStoreDir,
+  serializeHeader,
+  validateHeader,
+  verifyKey,
+  writeHeader
+} from "./chunk-BJMBJZ2Y.js";
+import {
+  METADATA_FORMAT,
+  METADATA_FORMAT_VERSION,
+  buildMetadata,
+  decodeMetadataSalt,
+  parseMetadata,
+  serializeMetadata,
+  validateMetadata
+} from "./chunk-UKJAGEXH.js";
+import {
+  DEFAULT_ARGON2ID_PARAMS,
+  DEFAULT_SCRYPT_PARAMS,
+  KDF_KEY_LENGTH,
+  KDF_SALT_LENGTH,
+  constantTimeEqual,
+  deriveKey,
+  deriveKeyScrypt,
+  validateScryptParams
+} from "./chunk-FP2373TW.js";
+import {
+  AES_KEY_LENGTH,
+  AUTH_TAG_LENGTH,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  IV_LENGTH,
+  generateSalt,
+  open,
+  parseEnvelope,
+  seal
+} from "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  AES_KEY_LENGTH,
+  AUTH_TAG_LENGTH,
+  DEFAULT_ARGON2ID_PARAMS,
+  DEFAULT_SCRYPT_PARAMS,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  HEADER_FILENAME,
+  HEADER_FORMAT,
+  HEADER_FORMAT_VERSION,
+  IV_LENGTH,
+  KDF_KEY_LENGTH,
+  KDF_SALT_LENGTH,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  METADATA_FORMAT,
+  METADATA_FORMAT_VERSION,
+  MIN_PASSPHRASE_LENGTH,
+  SECURE_STORE_DIR_NAME,
+  SecureStoreDecryptError,
+  SecureStoreLockedError,
+  buildHeader,
+  buildHeaderFromPassphrase,
+  buildMetadata,
+  constantTimeEqual,
+  createPassphraseReader,
+  decodeMetadataSalt,
+  decryptFileBody,
+  decryptMemoryDirToPlaintext,
+  deriveKey,
+  deriveKeyFromHeader,
+  deriveKeyScrypt,
+  encryptFileBody,
+  filePathAad,
+  generateSalt,
+  headerPath,
+  isEncryptedFile,
+  keyring_exports as keyring,
+  migrateMemoryDirToEncrypted,
+  open,
+  parseEnvelope,
+  parseHeader,
+  parseMetadata,
+  readHeader,
+  readMaybeEncryptedFile,
+  renderDisableReport,
+  renderInitReport,
+  renderLockReport,
+  renderMigrateReport,
+  renderStatusReport,
+  renderUnlockReport,
+  runSecureStoreDisable,
+  runSecureStoreInit,
+  runSecureStoreLock,
+  runSecureStoreMigrate,
+  runSecureStoreStatus,
+  runSecureStoreUnlock,
+  seal,
+  secureStoreDir,
+  serializeHeader,
+  serializeMetadata,
+  validateHeader,
+  validateMetadata,
+  validateScryptParams,
+  verifyKey,
+  writeHeader,
+  writeMaybeEncryptedFile
+};
+//# sourceMappingURL=secure-store-4R2GSO7S.js.map

package/dist/secure-store-4R2GSO7S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/semantic-chunking.js

@@ -8,6 +8,7 @@ import {
   stddev
 } from "./chunk-KVE7R4CG.js";
 import "./chunk-4WMCPJWX.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_SEMANTIC_CHUNKING_CONFIG,
   cosineSimilarity,

package/dist/{semantic-consolidation-CxJU6MJk.d.ts → semantic-consolidation-ByBXb-sf.d.ts}

@@ -1,7 +1,7 @@
 import { PluginConfig, MemoryFile } from './types.js';
 import { R as RolloutSummaryInput, M as MaterializeResult } from './codex-materialize-CQlLTzke.js';
 import { LoggerBackend } from './logger.js';
-import { ConsolidationOperator } from './consolidation-operator.js';
+import { SemanticConsolidationLlmOperator } from './consolidation-operator.js';
 
 /**
  * memory-extension-host/types.ts — Types for third-party memory extension discovery.
@@ -104,7 +104,7 @@ declare function parseConsolidationResponse(response: string): string;
  *   returns).  Callers persist this as the body of the new memory.
  */
 interface OperatorAwareConsolidationResult {
-    operator: ConsolidationOperator;
+    operator: SemanticConsolidationLlmOperator;
     output: string;
 }
 /**
@@ -126,7 +126,7 @@ interface OperatorAwareConsolidationResult {
  *     logical source actually encodes several distinct facts — at which
  *     point the orchestrator would need to write multiple outputs.
  */
-declare function chooseConsolidationOperator(cluster: ConsolidationCluster): ConsolidationOperator;
+declare function chooseConsolidationOperator(cluster: ConsolidationCluster): SemanticConsolidationLlmOperator;
 /**
  * Build the operator-aware LLM prompt.  The LLM is asked to return a
  * JSON object `{ "operator": <split|merge|update>, "output": <content> }`.

package/dist/semantic-consolidation.d.ts

@@ -1,5 +1,5 @@
 import './types.js';
 import './codex-materialize-CQlLTzke.js';
-export { C as ConsolidationCluster, O as OperatorAwareConsolidationResult, S as SemanticConsolidationResult, a as buildConsolidationPrompt, b as buildExtensionsBlockForConsolidation, c as buildOperatorAwareConsolidationPrompt, e as chooseConsolidationOperator, f as findSimilarClusters, m as materializeAfterSemanticConsolidation, p as parseConsolidationResponse, g as parseOperatorAwareConsolidationResponse, r as resolveExtensionsRoot } from './semantic-consolidation-CxJU6MJk.js';
-export { CONSOLIDATION_OPERATORS, ConsolidationOperator, isConsolidationOperator, isValidDerivedFromEntry } from './consolidation-operator.js';
+export { C as ConsolidationCluster, O as OperatorAwareConsolidationResult, S as SemanticConsolidationResult, a as buildConsolidationPrompt, b as buildExtensionsBlockForConsolidation, c as buildOperatorAwareConsolidationPrompt, e as chooseConsolidationOperator, f as findSimilarClusters, m as materializeAfterSemanticConsolidation, p as parseConsolidationResponse, g as parseOperatorAwareConsolidationResponse, r as resolveExtensionsRoot } from './semantic-consolidation-ByBXb-sf.js';
+export { CONSOLIDATION_OPERATORS, ConsolidationOperator, SemanticConsolidationLlmOperator, isConsolidationOperator, isSemanticConsolidationLlmOperator, isValidDerivedFromEntry } from './consolidation-operator.js';
 import './logger.js';

package/dist/semantic-consolidation.js

@@ -7,16 +7,17 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-PVICZTKG.js";
+} from "./chunk-55FXRRSJ.js";
 import {
   resolveExtensionsRoot
 } from "./chunk-EJI5XIBB.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+import "./chunk-DCE6SQLA.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-BOUYNNYD.js";
 import "./chunk-DM2T26WE.js";
@@ -26,11 +27,14 @@ import "./chunk-4DJQYKMN.js";
 import {
   CONSOLIDATION_OPERATORS,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry
-} from "./chunk-X6GF3FX2.js";
+} from "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   CONSOLIDATION_OPERATORS,
   buildConsolidationPrompt,
@@ -39,6 +43,7 @@ export {
   chooseConsolidationOperator,
   findSimilarClusters,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry,
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,

package/dist/semantic-rule-promotion.d.ts

@@ -9,7 +9,7 @@ interface SemanticRulePromotionCandidate {
 }
 interface SemanticRulePromotionSkip {
     sourceMemoryId: string;
-    reason: "disabled" | "source-memory-missing" | "source-memory-not-episode" | "no-explicit-rule" | "duplicate-rule";
+    reason: "disabled" | "source-memory-missing" | "source-memory-forgotten" | "source-memory-not-episode" | "no-explicit-rule" | "duplicate-rule";
     existingRuleId?: string;
 }
 interface SemanticRulePromotionReport {

package/dist/semantic-rule-promotion.js

@@ -1,20 +1,23 @@
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-VDX363PS.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+} from "./chunk-34F3PLWZ.js";
+import "./chunk-DCE6SQLA.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-BOUYNNYD.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
-import "./chunk-X6GF3FX2.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   promoteSemanticRuleFromMemory
 };

package/dist/semantic-rule-verifier.d.ts

@@ -1,6 +1,6 @@
 import { MemoryFile } from './types.js';
 
-type SemanticRuleVerificationStatus = "verified" | "source-memory-missing" | "source-memory-archived" | "source-memory-not-episode";
+type SemanticRuleVerificationStatus = "verified" | "source-memory-missing" | "source-memory-archived" | "source-memory-forgotten" | "source-memory-not-episode";
 interface VerifiedSemanticRuleResult {
     rule: MemoryFile;
     score: number;

package/dist/semantic-rule-verifier.js

@@ -1,21 +1,24 @@
 import {
   searchVerifiedSemanticRules
-} from "./chunk-SPI27QT6.js";
+} from "./chunk-L5IIGA5V.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+import "./chunk-DCE6SQLA.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-BOUYNNYD.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
-import "./chunk-X6GF3FX2.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   searchVerifiedSemanticRules
 };

package/dist/session-integrity.js

@@ -3,6 +3,7 @@ import {
   applySessionRepair,
   planSessionRepair
 } from "./chunk-YRMVARQP.js";
+import "./chunk-PZ5AY32C.js";
 export {
   analyzeSessionIntegrity,
   applySessionRepair,

package/dist/session-observer-bands.js

@@ -2,6 +2,7 @@ import {
   DEFAULT_SESSION_OBSERVER_BANDS,
   cloneDefaultSessionObserverBands
 } from "./chunk-Z5LAYHGJ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_SESSION_OBSERVER_BANDS,
   cloneDefaultSessionObserverBands

package/dist/session-observer-state.js

@@ -4,6 +4,7 @@ import {
 } from "./chunk-JR4ZC3G4.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   SessionObserverState,
   normalizeObserverBands

package/dist/session-toggles.js

@@ -1,3 +1,5 @@
+import "./chunk-PZ5AY32C.js";
+
 // src/session-toggles.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import path from "path";

package/dist/session-toggles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/session-toggles.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nexport interface SessionToggleStore {\n  isDisabled(sessionKey: string, agentId: string): Promise<boolean>;\n  resolve(sessionKey: string, agentId: string): Promise<{\n    disabled: boolean;\n    source: \"primary\" | \"secondary\" | \"none\";\n    updatedAt?: string;\n  }>;\n  setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void>;\n  clear(sessionKey: string, agentId: string): Promise<void>;\n  list(): Promise<Array<{ sessionKey: string; agentId: string; disabled: boolean; updatedAt: string }>>;\n}\n\ninterface ToggleEntry {\n  disabled: boolean;\n  updatedAt: string;\n}\n\ninterface ToggleFile {\n  version: 1;\n  entries: Record<string, ToggleEntry>;\n}\n\ninterface FileToggleStoreOptions {\n  secondaryReadOnlyPath?: string;\n}\n\nfunction encodeToggleKey(sessionKey: string, agentId: string): string {\n  return `${encodeURIComponent(sessionKey)}::${encodeURIComponent(agentId)}`;\n}\n\nfunction decodeToggleKey(key: string): { sessionKey: string; agentId: string } | null {\n  const [encodedSessionKey, encodedAgentId] = key.split(\"::\");\n  if (!encodedSessionKey || !encodedAgentId) return null;\n  return {\n    sessionKey: decodeURIComponent(encodedSessionKey),\n    agentId: decodeURIComponent(encodedAgentId),\n  };\n}\n\nasync function safeReadToggleFile(filePath: string): Promise<ToggleFile> {\n  try {\n    const raw = await readFile(filePath, \"utf8\");\n    const parsed = JSON.parse(raw) as Partial<ToggleFile>;\n    if (!parsed || typeof parsed !== \"object\" || typeof parsed.entries !== \"object\") {\n      return { version: 1, entries: {} };\n    }\n    return {\n      version: 1,\n      entries: Object.fromEntries(\n        Object.entries(parsed.entries).filter(\n          ([, value]) =>\n            value &&\n            typeof value === \"object\" &&\n            typeof value.disabled === \"boolean\" &&\n            typeof value.updatedAt === \"string\",\n        ),\n      ) as Record<string, ToggleEntry>,\n    };\n  } catch {\n    return { version: 1, entries: {} };\n  }\n}\n\nexport function createFileToggleStore(\n  filePath: string,\n  options: FileToggleStoreOptions = {},\n): SessionToggleStore {\n  let writeChain = Promise.resolve();\n\n  async function queueWrite(operation: () => Promise<void>): Promise<void> {\n    const run = writeChain.catch(() => undefined).then(operation);\n    writeChain = run.catch(() => undefined);\n    await run;\n  }\n\n  async function writeToggleFile(next: ToggleFile): Promise<void> {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    await writeFile(filePath, JSON.stringify(next, null, 2), \"utf8\");\n  }\n\n  async function readPrimary(): Promise<ToggleFile> {\n    return safeReadToggleFile(filePath);\n  }\n\n  async function readSecondary(): Promise<ToggleFile> {\n    if (!options.secondaryReadOnlyPath) return { version: 1, entries: {} };\n    return safeReadToggleFile(options.secondaryReadOnlyPath);\n  }\n\n  return {\n    async isDisabled(sessionKey: string, agentId: string): Promise<boolean> {\n      const resolved = await this.resolve(sessionKey, agentId);\n      return resolved.disabled;\n    },\n\n    async resolve(sessionKey: string, agentId: string) {\n      const key = encodeToggleKey(sessionKey, agentId);\n      const primary = await readPrimary();\n      if (primary.entries[key]) {\n        return {\n          disabled: primary.entries[key].disabled,\n          source: \"primary\" as const,\n          updatedAt: primary.entries[key].updatedAt,\n        };\n      }\n      const secondary = await readSecondary();\n      if (secondary.entries[key]) {\n        return {\n          disabled: secondary.entries[key].disabled,\n          source: \"secondary\" as const,\n          updatedAt: secondary.entries[key].updatedAt,\n        };\n      }\n      return { disabled: false, source: \"none\" as const };\n    },\n\n    async setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        current.entries[key] = {\n          disabled,\n          updatedAt: new Date().toISOString(),\n        };\n        await writeToggleFile(current);\n      });\n    },\n\n    async clear(sessionKey: string, agentId: string): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        delete current.entries[key];\n        await writeToggleFile(current);\n      });\n    },\n\n    async list() {\n      const current = await readPrimary();\n      return Object.entries(current.entries)\n        .map(([key, value]) => {\n          const decoded = decodeToggleKey(key);\n          if (!decoded) return null;\n          return {\n            sessionKey: decoded.sessionKey,\n            agentId: decoded.agentId,\n            disabled: value.disabled,\n            updatedAt: value.updatedAt,\n          };\n        })\n        .filter((value): value is { sessionKey: string; agentId: string; disabled: boolean; updatedAt: string } =>\n          value !== null\n        );\n    },\n  };\n}\n"],"mappings":";AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AA4BjB,SAAS,gBAAgB,YAAoB,SAAyB;AACpE,SAAO,GAAG,mBAAmB,UAAU,CAAC,KAAK,mBAAmB,OAAO,CAAC;AAC1E;AAEA,SAAS,gBAAgB,KAA6D;AACpF,QAAM,CAAC,mBAAmB,cAAc,IAAI,IAAI,MAAM,IAAI;AAC1D,MAAI,CAAC,qBAAqB,CAAC,eAAgB,QAAO;AAClD,SAAO;AAAA,IACL,YAAY,mBAAmB,iBAAiB;AAAA,IAChD,SAAS,mBAAmB,cAAc;AAAA,EAC5C;AACF;AAEA,eAAe,mBAAmB,UAAuC;AACvE,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,YAAY,UAAU;AAC/E,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,OAAO;AAAA,QACd,OAAO,QAAQ,OAAO,OAAO,EAAE;AAAA,UAC7B,CAAC,CAAC,EAAE,KAAK,MACP,SACA,OAAO,UAAU,YACjB,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,cAAc;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEO,SAAS,sBACd,UACA,UAAkC,CAAC,GACf;AACpB,MAAI,aAAa,QAAQ,QAAQ;AAEjC,iBAAe,WAAW,WAA+C;AACvE,UAAM,MAAM,WAAW,MAAM,MAAM,MAAS,EAAE,KAAK,SAAS;AAC5D,iBAAa,IAAI,MAAM,MAAM,MAAS;AACtC,UAAM;AAAA,EACR;AAEA,iBAAe,gBAAgB,MAAiC;AAC9D,UAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,UAAM,UAAU,UAAU,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAM;AAAA,EACjE;AAEA,iBAAe,cAAmC;AAChD,WAAO,mBAAmB,QAAQ;AAAA,EACpC;AAEA,iBAAe,gBAAqC;AAClD,QAAI,CAAC,QAAQ,sBAAuB,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AACrE,WAAO,mBAAmB,QAAQ,qBAAqB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,YAAoB,SAAmC;AACtE,YAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO;AACvD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,QAAQ,YAAoB,SAAiB;AACjD,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,QAAQ,QAAQ,GAAG,GAAG;AACxB,eAAO;AAAA,UACL,UAAU,QAAQ,QAAQ,GAAG,EAAE;AAAA,UAC/B,QAAQ;AAAA,UACR,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,QAClC;AAAA,MACF;AACA,YAAM,YAAY,MAAM,cAAc;AACtC,UAAI,UAAU,QAAQ,GAAG,GAAG;AAC1B,eAAO;AAAA,UACL,UAAU,UAAU,QAAQ,GAAG,EAAE;AAAA,UACjC,QAAQ;AAAA,UACR,WAAW,UAAU,QAAQ,GAAG,EAAE;AAAA,QACpC;AAAA,MACF;AACA,aAAO,EAAE,UAAU,OAAO,QAAQ,OAAgB;AAAA,IACpD;AAAA,IAEA,MAAM,YAAY,YAAoB,SAAiB,UAAkC;AACvF,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,gBAAQ,QAAQ,GAAG,IAAI;AAAA,UACrB;AAAA,UACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AACA,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,MAAM,YAAoB,SAAgC;AAC9D,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,eAAO,QAAQ,QAAQ,GAAG;AAC1B,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,UAAU,MAAM,YAAY;AAClC,aAAO,OAAO,QAAQ,QAAQ,OAAO,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,cAAM,UAAU,gBAAgB,GAAG;AACnC,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO;AAAA,UACL,YAAY,QAAQ;AAAA,UACpB,SAAS,QAAQ;AAAA,UACjB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF,CAAC,EACA;AAAA,QAAO,CAAC,UACP,UAAU;AAAA,MACZ;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/session-toggles.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nexport interface SessionToggleStore {\n  isDisabled(sessionKey: string, agentId: string): Promise<boolean>;\n  resolve(sessionKey: string, agentId: string): Promise<{\n    disabled: boolean;\n    source: \"primary\" | \"secondary\" | \"none\";\n    updatedAt?: string;\n  }>;\n  setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void>;\n  clear(sessionKey: string, agentId: string): Promise<void>;\n  list(): Promise<Array<{ sessionKey: string; agentId: string; disabled: boolean; updatedAt: string }>>;\n}\n\ninterface ToggleEntry {\n  disabled: boolean;\n  updatedAt: string;\n}\n\ninterface ToggleFile {\n  version: 1;\n  entries: Record<string, ToggleEntry>;\n}\n\ninterface FileToggleStoreOptions {\n  secondaryReadOnlyPath?: string;\n}\n\nfunction encodeToggleKey(sessionKey: string, agentId: string): string {\n  return `${encodeURIComponent(sessionKey)}::${encodeURIComponent(agentId)}`;\n}\n\nfunction decodeToggleKey(key: string): { sessionKey: string; agentId: string } | null {\n  const [encodedSessionKey, encodedAgentId] = key.split(\"::\");\n  if (!encodedSessionKey || !encodedAgentId) return null;\n  return {\n    sessionKey: decodeURIComponent(encodedSessionKey),\n    agentId: decodeURIComponent(encodedAgentId),\n  };\n}\n\nasync function safeReadToggleFile(filePath: string): Promise<ToggleFile> {\n  try {\n    const raw = await readFile(filePath, \"utf8\");\n    const parsed = JSON.parse(raw) as Partial<ToggleFile>;\n    if (!parsed || typeof parsed !== \"object\" || typeof parsed.entries !== \"object\") {\n      return { version: 1, entries: {} };\n    }\n    return {\n      version: 1,\n      entries: Object.fromEntries(\n        Object.entries(parsed.entries).filter(\n          ([, value]) =>\n            value &&\n            typeof value === \"object\" &&\n            typeof value.disabled === \"boolean\" &&\n            typeof value.updatedAt === \"string\",\n        ),\n      ) as Record<string, ToggleEntry>,\n    };\n  } catch {\n    return { version: 1, entries: {} };\n  }\n}\n\nexport function createFileToggleStore(\n  filePath: string,\n  options: FileToggleStoreOptions = {},\n): SessionToggleStore {\n  let writeChain = Promise.resolve();\n\n  async function queueWrite(operation: () => Promise<void>): Promise<void> {\n    const run = writeChain.catch(() => undefined).then(operation);\n    writeChain = run.catch(() => undefined);\n    await run;\n  }\n\n  async function writeToggleFile(next: ToggleFile): Promise<void> {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    await writeFile(filePath, JSON.stringify(next, null, 2), \"utf8\");\n  }\n\n  async function readPrimary(): Promise<ToggleFile> {\n    return safeReadToggleFile(filePath);\n  }\n\n  async function readSecondary(): Promise<ToggleFile> {\n    if (!options.secondaryReadOnlyPath) return { version: 1, entries: {} };\n    return safeReadToggleFile(options.secondaryReadOnlyPath);\n  }\n\n  return {\n    async isDisabled(sessionKey: string, agentId: string): Promise<boolean> {\n      const resolved = await this.resolve(sessionKey, agentId);\n      return resolved.disabled;\n    },\n\n    async resolve(sessionKey: string, agentId: string) {\n      const key = encodeToggleKey(sessionKey, agentId);\n      const primary = await readPrimary();\n      if (primary.entries[key]) {\n        return {\n          disabled: primary.entries[key].disabled,\n          source: \"primary\" as const,\n          updatedAt: primary.entries[key].updatedAt,\n        };\n      }\n      const secondary = await readSecondary();\n      if (secondary.entries[key]) {\n        return {\n          disabled: secondary.entries[key].disabled,\n          source: \"secondary\" as const,\n          updatedAt: secondary.entries[key].updatedAt,\n        };\n      }\n      return { disabled: false, source: \"none\" as const };\n    },\n\n    async setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        current.entries[key] = {\n          disabled,\n          updatedAt: new Date().toISOString(),\n        };\n        await writeToggleFile(current);\n      });\n    },\n\n    async clear(sessionKey: string, agentId: string): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        delete current.entries[key];\n        await writeToggleFile(current);\n      });\n    },\n\n    async list() {\n      const current = await readPrimary();\n      return Object.entries(current.entries)\n        .map(([key, value]) => {\n          const decoded = decodeToggleKey(key);\n          if (!decoded) return null;\n          return {\n            sessionKey: decoded.sessionKey,\n            agentId: decoded.agentId,\n            disabled: value.disabled,\n            updatedAt: value.updatedAt,\n          };\n        })\n        .filter((value): value is { sessionKey: string; agentId: string; disabled: boolean; updatedAt: string } =>\n          value !== null\n        );\n    },\n  };\n}\n"],"mappings":";;;AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AA4BjB,SAAS,gBAAgB,YAAoB,SAAyB;AACpE,SAAO,GAAG,mBAAmB,UAAU,CAAC,KAAK,mBAAmB,OAAO,CAAC;AAC1E;AAEA,SAAS,gBAAgB,KAA6D;AACpF,QAAM,CAAC,mBAAmB,cAAc,IAAI,IAAI,MAAM,IAAI;AAC1D,MAAI,CAAC,qBAAqB,CAAC,eAAgB,QAAO;AAClD,SAAO;AAAA,IACL,YAAY,mBAAmB,iBAAiB;AAAA,IAChD,SAAS,mBAAmB,cAAc;AAAA,EAC5C;AACF;AAEA,eAAe,mBAAmB,UAAuC;AACvE,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,YAAY,UAAU;AAC/E,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,OAAO;AAAA,QACd,OAAO,QAAQ,OAAO,OAAO,EAAE;AAAA,UAC7B,CAAC,CAAC,EAAE,KAAK,MACP,SACA,OAAO,UAAU,YACjB,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,cAAc;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEO,SAAS,sBACd,UACA,UAAkC,CAAC,GACf;AACpB,MAAI,aAAa,QAAQ,QAAQ;AAEjC,iBAAe,WAAW,WAA+C;AACvE,UAAM,MAAM,WAAW,MAAM,MAAM,MAAS,EAAE,KAAK,SAAS;AAC5D,iBAAa,IAAI,MAAM,MAAM,MAAS;AACtC,UAAM;AAAA,EACR;AAEA,iBAAe,gBAAgB,MAAiC;AAC9D,UAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,UAAM,UAAU,UAAU,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAM;AAAA,EACjE;AAEA,iBAAe,cAAmC;AAChD,WAAO,mBAAmB,QAAQ;AAAA,EACpC;AAEA,iBAAe,gBAAqC;AAClD,QAAI,CAAC,QAAQ,sBAAuB,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AACrE,WAAO,mBAAmB,QAAQ,qBAAqB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,YAAoB,SAAmC;AACtE,YAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO;AACvD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,QAAQ,YAAoB,SAAiB;AACjD,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,QAAQ,QAAQ,GAAG,GAAG;AACxB,eAAO;AAAA,UACL,UAAU,QAAQ,QAAQ,GAAG,EAAE;AAAA,UAC/B,QAAQ;AAAA,UACR,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,QAClC;AAAA,MACF;AACA,YAAM,YAAY,MAAM,cAAc;AACtC,UAAI,UAAU,QAAQ,GAAG,GAAG;AAC1B,eAAO;AAAA,UACL,UAAU,UAAU,QAAQ,GAAG,EAAE;AAAA,UACjC,QAAQ;AAAA,UACR,WAAW,UAAU,QAAQ,GAAG,EAAE;AAAA,QACpC;AAAA,MACF;AACA,aAAO,EAAE,UAAU,OAAO,QAAQ,OAAgB;AAAA,IACpD;AAAA,IAEA,MAAM,YAAY,YAAoB,SAAiB,UAAkC;AACvF,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,gBAAQ,QAAQ,GAAG,IAAI;AAAA,UACrB;AAAA,UACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AACA,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,MAAM,YAAoB,SAAgC;AAC9D,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,eAAO,QAAQ,QAAQ,GAAG;AAC1B,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,UAAU,MAAM,YAAY;AAClC,aAAO,OAAO,QAAQ,QAAQ,OAAO,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,cAAM,UAAU,gBAAgB,GAAG;AACnC,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO;AAAA,UACL,YAAY,QAAQ;AAAA,UACpB,SAAS,QAAQ;AAAA,UACjB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF,CAAC,EACA;AAAA,QAAO,CAAC,UACP,UAAU;AAAA,MACZ;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}

package/dist/signal.js

@@ -2,6 +2,7 @@ import {
   isDisagreementPrompt,
   scanSignals
 } from "./chunk-XYIK4LF6.js";
+import "./chunk-PZ5AY32C.js";
 export {
   isDisagreementPrompt,
   scanSignals

package/dist/skills-registry.js

@@ -1,3 +1,5 @@
+import "./chunk-PZ5AY32C.js";
+
 // src/skills-registry.ts
 import { fileURLToPath } from "url";
 import { dirname, resolve } from "path";

package/dist/skills-registry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/skills-registry.ts"],"sourcesContent":["/**\n * skills-registry.ts\n *\n * Built-in Remnic procedural memory skills — the canonical SKILL.md sources\n * shipped with the monorepo. Consumers (e.g. the Codex materializer in #378)\n * read this registry to discover which skills to materialize into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n *\n * This module is intentionally free of Codex/Claude Code host coupling —\n * it only exposes the static metadata each host needs.\n */\n\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\n\n/**\n * A single procedural-memory skill source that Remnic ships.\n *\n * - `slug` is the canonical folder name under `skills/` and the file on disk\n *   must live at `<pluginRoot>/skills/<slug>/SKILL.md`.\n * - `staticPath`, when set, points at a pre-authored SKILL.md on disk.\n * - `generator`, when set, produces a SKILL.md body at materialization time.\n *   Exactly one of `staticPath` or `generator` should be provided.\n * - `disableModelInvocation` mirrors the `disable-model-invocation` frontmatter\n *   key and indicates a skill that writes or mutates state and therefore\n *   should not be auto-invoked by a model without explicit opt-in.\n */\nexport interface RemnicSkillSource {\n  slug: string;\n  staticPath?: string;\n  generator?: () => Promise<string>;\n  disableModelInvocation: boolean;\n}\n\n/**\n * Validate a Remnic skill slug. Rules:\n *\n * - lowercase letters, digits, and `-` only\n * - must start with a letter or digit\n * - 1–64 characters\n *\n * This is the same shape the Codex skills directory expects.\n */\nexport function isValidSkillSlug(slug: string): boolean {\n  // Must start with alphanumeric; each dash must be followed by alphanumeric\n  // (no trailing dashes, no consecutive dashes); 1–64 characters total.\n  return /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63}$/.test(slug);\n}\n\n// ---------------------------------------------------------------------------\n// Built-in skill paths — resolved relative to this source file.\n// ---------------------------------------------------------------------------\n//\n// This file lives at `packages/remnic-core/src/skills-registry.ts`.\n// After tsup build it lives at `packages/remnic-core/dist/skills-registry.js`.\n// In both cases, the shipped skill sources live four levels up at\n// `packages/plugin-codex/skills/<slug>/SKILL.md`.\n//\n// We compute the absolute path from the current module so that callers in any\n// cwd can resolve the files.\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst PLUGIN_CODEX_SKILLS_DIR = resolve(HERE, \"..\", \"..\", \"plugin-codex\", \"skills\");\n\nfunction codexSkillPath(slug: string): string {\n  return resolve(PLUGIN_CODEX_SKILLS_DIR, slug, \"SKILL.md\");\n}\n\n/**\n * The canonical list of Remnic procedural memory skills shipped with the\n * monorepo. The Codex materializer (#378) copies these into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n */\nexport const BUILTIN_SKILLS: RemnicSkillSource[] = [\n  {\n    slug: \"remnic-memory-workflow\",\n    staticPath: codexSkillPath(\"remnic-memory-workflow\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-recall\",\n    staticPath: codexSkillPath(\"remnic-recall\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-remember\",\n    staticPath: codexSkillPath(\"remnic-remember\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-search\",\n    staticPath: codexSkillPath(\"remnic-search\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-entities\",\n    staticPath: codexSkillPath(\"remnic-entities\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-status\",\n    staticPath: codexSkillPath(\"remnic-status\"),\n    disableModelInvocation: false,\n  },\n];\n"],"mappings":";AAYA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AA8B1B,SAAS,iBAAiB,MAAuB;AAGtD,SAAO,6CAA6C,KAAK,IAAI;AAC/D;AAcA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,0BAA0B,QAAQ,MAAM,MAAM,MAAM,gBAAgB,QAAQ;AAElF,SAAS,eAAe,MAAsB;AAC5C,SAAO,QAAQ,yBAAyB,MAAM,UAAU;AAC1D;AAOO,IAAM,iBAAsC;AAAA,EACjD;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,wBAAwB;AAAA,IACnD,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../src/skills-registry.ts"],"sourcesContent":["/**\n * skills-registry.ts\n *\n * Built-in Remnic procedural memory skills — the canonical SKILL.md sources\n * shipped with the monorepo. Consumers (e.g. the Codex materializer in #378)\n * read this registry to discover which skills to materialize into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n *\n * This module is intentionally free of Codex/Claude Code host coupling —\n * it only exposes the static metadata each host needs.\n */\n\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\n\n/**\n * A single procedural-memory skill source that Remnic ships.\n *\n * - `slug` is the canonical folder name under `skills/` and the file on disk\n *   must live at `<pluginRoot>/skills/<slug>/SKILL.md`.\n * - `staticPath`, when set, points at a pre-authored SKILL.md on disk.\n * - `generator`, when set, produces a SKILL.md body at materialization time.\n *   Exactly one of `staticPath` or `generator` should be provided.\n * - `disableModelInvocation` mirrors the `disable-model-invocation` frontmatter\n *   key and indicates a skill that writes or mutates state and therefore\n *   should not be auto-invoked by a model without explicit opt-in.\n */\nexport interface RemnicSkillSource {\n  slug: string;\n  staticPath?: string;\n  generator?: () => Promise<string>;\n  disableModelInvocation: boolean;\n}\n\n/**\n * Validate a Remnic skill slug. Rules:\n *\n * - lowercase letters, digits, and `-` only\n * - must start with a letter or digit\n * - 1–64 characters\n *\n * This is the same shape the Codex skills directory expects.\n */\nexport function isValidSkillSlug(slug: string): boolean {\n  // Must start with alphanumeric; each dash must be followed by alphanumeric\n  // (no trailing dashes, no consecutive dashes); 1–64 characters total.\n  return /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63}$/.test(slug);\n}\n\n// ---------------------------------------------------------------------------\n// Built-in skill paths — resolved relative to this source file.\n// ---------------------------------------------------------------------------\n//\n// This file lives at `packages/remnic-core/src/skills-registry.ts`.\n// After tsup build it lives at `packages/remnic-core/dist/skills-registry.js`.\n// In both cases, the shipped skill sources live four levels up at\n// `packages/plugin-codex/skills/<slug>/SKILL.md`.\n//\n// We compute the absolute path from the current module so that callers in any\n// cwd can resolve the files.\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst PLUGIN_CODEX_SKILLS_DIR = resolve(HERE, \"..\", \"..\", \"plugin-codex\", \"skills\");\n\nfunction codexSkillPath(slug: string): string {\n  return resolve(PLUGIN_CODEX_SKILLS_DIR, slug, \"SKILL.md\");\n}\n\n/**\n * The canonical list of Remnic procedural memory skills shipped with the\n * monorepo. The Codex materializer (#378) copies these into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n */\nexport const BUILTIN_SKILLS: RemnicSkillSource[] = [\n  {\n    slug: \"remnic-memory-workflow\",\n    staticPath: codexSkillPath(\"remnic-memory-workflow\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-recall\",\n    staticPath: codexSkillPath(\"remnic-recall\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-remember\",\n    staticPath: codexSkillPath(\"remnic-remember\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-search\",\n    staticPath: codexSkillPath(\"remnic-search\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-entities\",\n    staticPath: codexSkillPath(\"remnic-entities\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-status\",\n    staticPath: codexSkillPath(\"remnic-status\"),\n    disableModelInvocation: false,\n  },\n];\n"],"mappings":";;;AAYA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AA8B1B,SAAS,iBAAiB,MAAuB;AAGtD,SAAO,6CAA6C,KAAK,IAAI;AAC/D;AAcA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,0BAA0B,QAAQ,MAAM,MAAM,MAAM,gBAAgB,QAAQ;AAElF,SAAS,eAAe,MAAsB;AAC5C,SAAO,QAAQ,yBAAyB,MAAM,UAAU;AAC1D;AAOO,IAAM,iBAAsC;AAAA,EACjD;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,wBAAwB;AAAA,IACnD,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AACF;","names":[]}

package/dist/source-attribution.js

@@ -11,6 +11,7 @@ import {
   stripCitation,
   stripCitationForTemplate
 } from "./chunk-4KAN3GZ3.js";
+import "./chunk-PZ5AY32C.js";
 export {
   CITATION_UNKNOWN,
   DEFAULT_CITATION_FORMAT,

package/dist/state-NCHQ4TRG.js

@@ -0,0 +1,8 @@
+import {
+  gatherConsoleState
+} from "./chunk-TYEOAFH3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  gatherConsoleState
+};
+//# sourceMappingURL=state-NCHQ4TRG.js.map

package/dist/state-NCHQ4TRG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/state-store-3EH7HYIN.js

@@ -0,0 +1,16 @@
+import {
+  _connectorStatePathForTest,
+  listConnectorStates,
+  readConnectorState,
+  writeConnectorState
+} from "./chunk-6TBWYBJ3.js";
+import "./chunk-IXEJRKCZ.js";
+import "./chunk-MARWOCVP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  _connectorStatePathForTest,
+  listConnectorStates,
+  readConnectorState,
+  writeConnectorState
+};
+//# sourceMappingURL=state-store-3EH7HYIN.js.map

package/dist/state-store-3EH7HYIN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/storage.d.ts

@@ -1,7 +1,7 @@
 import { VersioningConfig } from './page-versioning.js';
 import { ConsolidationOperator } from './consolidation-operator.js';
 import { PluginConfig, MemoryCategory, ImportanceScore, MemoryLink, MemoryFrontmatter, MemoryStatus, MemoryFile, EntityStructuredSection, BufferState, MetaState, MemoryActionEvent, MemoryLifecycleEvent, BufferSurpriseEvent, BehaviorSignalEvent, CompressionGuidelineOptimizerState, ContinuityIncidentOpenInput, ContinuityIncidentRecord, ContinuityIncidentCloseInput, ContinuityImprovementLoop, ContinuityLoopUpsertInput, ContinuityLoopReviewInput, FileHygieneConfig, EntityRelationship, EntityActivityEntry, EntityFile, AccessTrackingEntry, MemoryProjectionCurrentState, MemorySummary, TopicScore } from './types.js';
-import { P as ProjectedMemoryBrowseOptions, a as ProjectedMemoryBrowsePage, b as readProjectedGovernanceRecord } from './memory-projection-store-DeSXPh1j.js';
+import { P as ProjectedMemoryBrowseOptions, a as ProjectedMemoryBrowsePage, b as readProjectedGovernanceRecord } from './memory-projection-store-D3vBHS4J.js';
 import 'better-sqlite3';
 
 interface ReextractJobRequest {
@@ -36,7 +36,10 @@ declare class ContentHashIndex {
     private hashes;
     private dirty;
     private readonly filePath;
-    constructor(stateDir: string);
+    private readonly secureStoreKeyProvider;
+    private readonly secureStoreWriteKeyProvider;
+    private readonly memoryDir;
+    constructor(stateDir: string, secureStoreKeyProvider?: () => Buffer | null, secureStoreWriteKeyProvider?: () => Buffer | null, memoryDir?: string);
     /** Load existing hashes from disk. Safe to call multiple times. */
     load(): Promise<void>;
     /** Check if content already exists in the index. */
@@ -112,6 +115,8 @@ declare class StorageManager {
     private static readonly ARTIFACT_INDEX_CACHE_TTL_MS;
     private static readonly artifactWriteVersionByDir;
     private static readonly memoryStatusVersionByDir;
+    private static readonly secureStoreEntityCacheKeyIds;
+    private static nextSecureStoreEntityCacheKeyId;
     private static readonly coldWriteVersionByDir;
     private static readonly allMemoriesInFlight;
     private static readonly COLD_SCAN_CACHE_TTL_MS;
@@ -122,12 +127,68 @@ declare class StorageManager {
     private factHashIndexLoadPromise;
     private factHashIndexAuthoritative;
     private factHashIndexAuthoritativePromise;
+    private readonly secureAppendChains;
     /** Optional: set by the orchestrator after construction to enable template-aware citation stripping during legacy hash rebuild. */
     citationTemplate: string;
     /** Page-versioning configuration.  Set by the orchestrator after construction. */
     private _versioningConfig;
     /** Set the page-versioning configuration.  When `enabled` is false (default), all versioning calls are no-ops. */
     setVersioningConfig(config: VersioningConfig): void;
+    /**
+     * At-rest encryption key (issue #690 PR 3/4).
+     *
+     * When non-null, every memory file read is decrypted and every write
+     * is encrypted using the secure-fs layer.  When null, the storage
+     * layer operates in plain-text mode (legacy/unencrypted store).
+     *
+     * Set by the orchestrator after init/unlock; cleared on lock.
+     * The key buffer is NEVER logged or serialized.
+     */
+    private _secureStoreKey;
+    /**
+     * When true (and `_secureStoreKey` is non-null), new writes are
+     * encrypted.  Set to false to pause encryption of new writes while
+     * still decrypting existing files.
+     */
+    private _secureStoreEncryptOnWrite;
+    /**
+     * When true, the secure-store is configured as required — writes
+     * MUST be encrypted and a locked store MUST reject writes rather
+     * than silently falling back to plaintext.  Set by the orchestrator
+     * from `config.secureStoreEnabled`.
+     */
+    private _secureStoreRequired;
+    /**
+     * Set or clear the at-rest encryption key.
+     *
+     * Pass a 32-byte Buffer to enable encryption; pass null to clear
+     * (lock) the store.  The caller is responsible for key lifecycle —
+     * this method does not zero the buffer on replacement; the keyring
+     * module (`keyring.ts`) owns zeroization.
+     */
+    setSecureStoreKey(key: Buffer | null, encryptOnWrite?: boolean): void;
+    private getEntityCacheSecureStoreKey;
+    /**
+     * Mark the secure-store as required for this storage instance.
+     * When required and locked, writes throw SecureStoreLockedError
+     * rather than silently writing plaintext.
+     */
+    setSecureStoreRequired(required: boolean): void;
+    /** Return true iff the secure-store key is currently set (store is unlocked). */
+    isSecureStoreUnlocked(): boolean;
+    /**
+     * Resolve the effective write key.
+     *
+     * - If `_secureStoreEncryptOnWrite` is false: returns null (plain write).
+     * - If `_secureStoreEncryptOnWrite` is true AND key is set: returns key.
+     * - If `_secureStoreEncryptOnWrite` is true AND key is null AND
+     *   `_secureStoreRequired` is true: throws SecureStoreLockedError so the
+     *   write fails loudly rather than silently writing plaintext (P1 finding
+     *   from Cursor review of PR #767).
+     * - If `_secureStoreEncryptOnWrite` is true AND key is null AND
+     *   `_secureStoreRequired` is false: returns null (unencrypted store).
+     */
+    private resolveWriteKey;
     /**
      * Snapshot the current content of a page before overwriting.
      * No-op when versioning is disabled or the file does not yet exist.
@@ -164,6 +225,11 @@ declare class StorageManager {
     private get proceduresDir();
     private get reasoningTracesDir();
     private get entitiesDir();
+    private readStorageSecureFile;
+    private writeStorageSecureFile;
+    createContentHashIndex(): ContentHashIndex;
+    private appendStorageSecureFile;
+    private appendStorageSecureFileUnlocked;
     private get stateDir();
     private get entitySynthesisQueuePath();
     private get factHashIndexReadyPath();
@@ -247,6 +313,8 @@ declare class StorageManager {
         derivedVia?: ConsolidationOperator;
     }): Promise<string>;
     hasFactContentHash(content: string): Promise<boolean>;
+    private factContentHashForRemoval;
+    removeFactContentHashesForMemories(memories: MemoryFile[]): Promise<void>;
     isFactContentHashAuthoritative(): Promise<boolean>;
     writeArtifact(quote: string, options?: {
         actor?: string;
@@ -287,6 +355,8 @@ declare class StorageManager {
     /** Public cache invalidation for callers that need authoritative disk reads
      *  (e.g. projection verify/rebuild). */
     invalidateAllMemoriesCacheForDir(): void;
+    /** Invalidate only the cache layers affected by direct tier file deletes. */
+    invalidateMemoryCachesForTiers(tiers: Iterable<"hot" | "cold" | "archive">): void;
     /** Clear ALL static caches. Use in tests that write files directly
      *  (bypassing StorageManager.writeMemory) to avoid stale reads. */
     static clearAllStaticCaches(): void;
@@ -477,6 +547,10 @@ declare class StorageManager {
     readReextractJobs(limit?: number): Promise<ReextractJobRequest[]>;
     readBehaviorSignals(limit?: number): Promise<BehaviorSignalEvent[]>;
     readMemoryActionEvents(limit?: number): Promise<MemoryActionEvent[]>;
+    readMemoryActionEventRows(limit?: number): Promise<Array<{
+        line: number;
+        event: MemoryActionEvent;
+    }>>;
     readAllMemoryLifecycleEvents(): Promise<MemoryLifecycleEvent[]>;
     readMemoryLifecycleEvents(limit?: number): Promise<MemoryLifecycleEvent[]>;
     writeCompressionGuidelines(content: string): Promise<void>;