@remnic/core 1.1.2 → 1.1.4

package/dist/resolve-auth-token.d.ts

@@ -0,0 +1,51 @@
+import { SecretRef, AgentAccessAuthToken } from './types.js';
+
+/**
+ * Resolve `agentAccessHttp.authToken` (issue #757).
+ *
+ * Two shapes are accepted:
+ *
+ *   1. Plain string — returned unchanged. This is the only shape supported
+ *      in standalone Remnic; it preserves backward compatibility with every
+ *      pre-#757 config.
+ *
+ *   2. SecretRef-like object (`{source, provider?, id?, command?, ...}`) —
+ *      resolved only through a resolver supplied by the host adapter. Core
+ *      stays host-agnostic and never scans OpenClaw, Hermes, or any other
+ *      runtime directly.
+ *
+ * Resolution flow for SecretRef objects:
+ *
+ *   - Plain strings short-circuit before any host work.
+ *   - Host adapters pass their native SecretRef resolver in `options`.
+ *   - If no resolver is provided, throw a clear, actionable error rather
+ *     than silently leaving the bridge open or starting with no auth.
+ *
+ * Lessons baked in from PRs #316–#319:
+ *
+ *   - Successful resolutions are cached for the process lifetime; failures
+ *     are not cached so transient issues (Keychain unlocked late, agent
+ *     restarts) recover automatically.
+ */
+type ResolveSecretRefFn = (ref: SecretRef, context?: unknown) => Promise<string | undefined> | string | undefined;
+type ResolveAgentAccessAuthTokenOptions = {
+    resolveSecretRef?: ResolveSecretRefFn | null;
+};
+/**
+ * Resolve an `agentAccessHttp.authToken` value to a literal bearer string.
+ *
+ * @returns the resolved string, or `undefined` if input was undefined/empty.
+ * @throws if the input is a SecretRef and no resolver is provided, if the
+ *         resolver returns no value, or if the input shape is malformed.
+ */
+declare function resolveAgentAccessAuthToken(value: AgentAccessAuthToken | undefined, options?: ResolveAgentAccessAuthTokenOptions): Promise<string | undefined>;
+/**
+ * Returns true if the value is a SecretRef object (issue #757). Useful for
+ * surfaces (CLI flags, doctor checks) that want to render a redacted
+ * placeholder instead of leaking the unresolved object shape.
+ */
+declare function isAgentAccessSecretRef(value: unknown): value is SecretRef;
+/** Test/operations hook: drop the cache and force resolver rediscovery. */
+declare function clearAuthTokenSecretCache(): void;
+
+export { type ResolveSecretRefFn, clearAuthTokenSecretCache, isAgentAccessSecretRef, resolveAgentAccessAuthToken };

package/dist/resolve-auth-token.js

@@ -0,0 +1,12 @@
+import {
+  clearAuthTokenSecretCache,
+  isAgentAccessSecretRef,
+  resolveAgentAccessAuthToken
+} from "./chunk-MXC3AP5I.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  clearAuthTokenSecretCache,
+  isAgentAccessSecretRef,
+  resolveAgentAccessAuthToken
+};
+//# sourceMappingURL=resolve-auth-token.js.map

package/dist/resolve-auth-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/resolve-provider-secret.d.ts

@@ -40,6 +40,14 @@ type GetRuntimeAuthForModelFn = (params: {
     mode?: string;
     profileId?: string;
 } | null>;
+/**
+ * Discover gateway runtime module files matching the given filename prefix.
+ *
+ * Reused by adjacent SecretRef resolution code (`resolve-auth-token.ts`,
+ * issue #757). Walks the same dist-dir candidates as the model-auth path
+ * so callers don't reimplement install-method discovery.
+ */
+declare function findGatewayRuntimeModules(filePrefix: string): Promise<string[]>;
 declare function findExecutableOnPath(executableName: string, access: (path: string, mode?: number) => void, stat: (path: string) => {
     isFile(): boolean;
 }, executableMode: number): string | undefined;
@@ -68,4 +76,4 @@ declare function getGatewayRuntimeAuthForModel(): Promise<GetRuntimeAuthForModel
 declare function clearSecretCache(): void;
 declare function __setGatewayResolverForTest(resolver: ResolveApiKeyFn | null): void;
 
-export { type GetRuntimeAuthForModelFn, __findExecutableOnPathForTest, __setGatewayResolverForTest, clearSecretCache, getGatewayRuntimeAuthForModel, resolveProviderApiKey };
+export { type GetRuntimeAuthForModelFn, __findExecutableOnPathForTest, __setGatewayResolverForTest, clearSecretCache, findGatewayRuntimeModules, getGatewayRuntimeAuthForModel, resolveProviderApiKey };

package/dist/resolve-provider-secret.js

@@ -2,15 +2,18 @@ import {
   __findExecutableOnPathForTest,
   __setGatewayResolverForTest,
   clearSecretCache,
+  findGatewayRuntimeModules,
   getGatewayRuntimeAuthForModel,
   resolveProviderApiKey
-} from "./chunk-Y7R2XJ5Q.js";
+} from "./chunk-Q7FJ5ZHM.js";
 import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   __findExecutableOnPathForTest,
   __setGatewayResolverForTest,
   clearSecretCache,
+  findGatewayRuntimeModules,
   getGatewayRuntimeAuthForModel,
   resolveProviderApiKey
 };

package/dist/resume-bundles.js

@@ -4,12 +4,12 @@ import {
   recordResumeBundle,
   resolveResumeBundleDir,
   validateResumeBundle
-} from "./chunk-TMYO7B5P.js";
+} from "./chunk-47WOM4YW.js";
 import "./chunk-CULXMQJH.js";
 import "./chunk-E6K4NIEU.js";
-import "./chunk-YRMVARQP.js";
 import "./chunk-LOBRX7VD.js";
-import "./chunk-BECYBZLX.js";
+import "./chunk-YRMVARQP.js";
+import "./chunk-JWSENLQI.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-FYIYMQ5N.js";
 import "./chunk-DT5TVLJE.js";
@@ -18,6 +18,7 @@ import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
 import "./chunk-DGXUHMOV.js";
 import "./chunk-LPSF4OQH.js";
+import "./chunk-PZ5AY32C.js";
 export {
   buildResumeBundleFromState,
   getResumeBundleStatus,

package/dist/retrieval-agents.d.ts

@@ -1,6 +1,6 @@
 import { QmdSearchResult } from './types.js';
 import { QmdClient } from './qmd.js';
-import './port-BADbLZU5.js';
+import './port-hqGnoStS.js';
 
 /**
  * Parallel Specialized Retrieval (v9.1 — ASMR-inspired)

package/dist/retrieval-agents.js

@@ -10,6 +10,7 @@ import {
 } from "./chunk-K4FLSOR5.js";
 import "./chunk-V3RXWQIE.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   PARALLEL_AGENT_WEIGHTS,
   augmentWithDirectAndTemporal,

package/dist/retrieval-tiers.js

@@ -2,6 +2,7 @@ import {
   RETRIEVAL_TIERS,
   isRetrievalTier
 } from "./chunk-SOBJ6NEY.js";
+import "./chunk-PZ5AY32C.js";
 export {
   RETRIEVAL_TIERS,
   isRetrievalTier

package/dist/retrieval.js

@@ -3,6 +3,7 @@ import {
   expandQuery
 } from "./chunk-5IZL4DCV.js";
 import "./chunk-TBBDFYXW.js";
+import "./chunk-PZ5AY32C.js";
 export {
   applyRuntimeRetrievalPolicy,
   expandQuery

package/dist/sanitize.js

@@ -2,6 +2,7 @@ import {
   isSafeMemoryContent,
   sanitizeMemoryContent
 } from "./chunk-M62O4P4T.js";
+import "./chunk-PZ5AY32C.js";
 export {
   isSafeMemoryContent,
   sanitizeMemoryContent

package/dist/schemas.d.ts

@@ -7,12 +7,12 @@ declare const MemoryActionEligibilityContextSchema: z.ZodObject<{
     importance: z.ZodNumber;
     source: z.ZodEnum<["extraction", "consolidation", "replay", "manual", "unknown"]>;
 }, "strict", z.ZodTypeAny, {
-    source: "extraction" | "consolidation" | "replay" | "manual" | "unknown";
+    source: "manual" | "extraction" | "consolidation" | "replay" | "unknown";
     confidence: number;
     lifecycleState: "active" | "archived" | "candidate" | "validated" | "stale";
     importance: number;
 }, {
-    source: "extraction" | "consolidation" | "replay" | "manual" | "unknown";
+    source: "manual" | "extraction" | "consolidation" | "replay" | "unknown";
     confidence: number;
     lifecycleState: "active" | "archived" | "candidate" | "validated" | "stale";
     importance: number;
@@ -60,6 +60,7 @@ declare const ExtractedFactSchema: z.ZodObject<{
     tags: z.ZodArray<z.ZodString, "many">;
     entityRef: z.ZodNullable<z.ZodOptional<z.ZodString>>;
     promptedByQuestion: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+    scope: z.ZodNullable<z.ZodOptional<z.ZodEnum<["project", "global"]>>>;
     structuredAttributes: z.ZodNullable<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
     procedureSteps: z.ZodNullable<z.ZodOptional<z.ZodArray<z.ZodObject<{
         order: z.ZodNumber;
@@ -155,6 +156,7 @@ declare const ExtractedFactSchema: z.ZodObject<{
     entityRef?: string | null | undefined;
     structuredAttributes?: Record<string, string> | null | undefined;
     promptedByQuestion?: string | null | undefined;
+    scope?: "project" | "global" | null | undefined;
     procedureSteps?: {
         order: number;
         intent: string;
@@ -183,6 +185,7 @@ declare const ExtractedFactSchema: z.ZodObject<{
     entityRef?: string | null | undefined;
     structuredAttributes?: Record<string, string> | null | undefined;
     promptedByQuestion?: string | null | undefined;
+    scope?: "project" | "global" | null | undefined;
     procedureSteps?: {
         order: number;
         intent: string;
@@ -307,6 +310,7 @@ declare const ProactiveExtractionResultSchema: z.ZodObject<{
         tags: z.ZodArray<z.ZodString, "many">;
         entityRef: z.ZodNullable<z.ZodOptional<z.ZodString>>;
         promptedByQuestion: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+        scope: z.ZodNullable<z.ZodOptional<z.ZodEnum<["project", "global"]>>>;
         structuredAttributes: z.ZodNullable<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
         procedureSteps: z.ZodNullable<z.ZodOptional<z.ZodArray<z.ZodObject<{
             order: z.ZodNumber;
@@ -402,6 +406,7 @@ declare const ProactiveExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -430,6 +435,7 @@ declare const ProactiveExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -516,6 +522,7 @@ declare const ProactiveExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -564,6 +571,7 @@ declare const ProactiveExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -612,6 +620,7 @@ declare const ExtractionResultSchema: z.ZodObject<{
         tags: z.ZodArray<z.ZodString, "many">;
         entityRef: z.ZodNullable<z.ZodOptional<z.ZodString>>;
         promptedByQuestion: z.ZodNullable<z.ZodOptional<z.ZodString>>;
+        scope: z.ZodNullable<z.ZodOptional<z.ZodEnum<["project", "global"]>>>;
         structuredAttributes: z.ZodNullable<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
         procedureSteps: z.ZodNullable<z.ZodOptional<z.ZodArray<z.ZodObject<{
             order: z.ZodNumber;
@@ -707,6 +716,7 @@ declare const ExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -735,6 +745,7 @@ declare const ExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -835,6 +846,7 @@ declare const ExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;
@@ -889,6 +901,7 @@ declare const ExtractionResultSchema: z.ZodObject<{
         entityRef?: string | null | undefined;
         structuredAttributes?: Record<string, string> | null | undefined;
         promptedByQuestion?: string | null | undefined;
+        scope?: "project" | "global" | null | undefined;
         procedureSteps?: {
             order: number;
             intent: string;

package/dist/schemas.js

@@ -23,7 +23,8 @@ import {
   buildProfileConsolidationResultSchema,
   parseMemoryActionEligibilityContext,
   parseMemoryActionType
-} from "./chunk-NZLQTHS5.js";
+} from "./chunk-WW3QQF4H.js";
+import "./chunk-PZ5AY32C.js";
 export {
   BehaviorLoopAdjustmentSchema,
   BehaviorLoopPolicyStateSchema,

package/dist/sdk-compat.js

@@ -1,6 +1,7 @@
 import {
   readEnvVar
 } from "./chunk-MARWOCVP.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/sdk-compat.ts
 function detectSdkCapabilities(api) {

package/dist/sdk-compat.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/sdk-compat.ts"],"sourcesContent":["/**\n * Runtime SDK capability detection.\n *\n * Probes the injected api object at registration time to determine which\n * OpenClaw SDK features are available. All hook registrations and entry-point\n * patterns branch on these flags so engram works on both old (≤2026.3.13)\n * and new (≥2026.3.22) runtimes.\n */\nimport { readEnvVar } from \"./runtime/env.js\";\n\nexport interface SdkCapabilities {\n  /** api.on(\"before_prompt_build\", ...) is available */\n  hasBeforePromptBuild: boolean;\n  /** api.registerMemoryPromptSection() exists */\n  hasRegisterMemoryPromptSection: boolean;\n  /** api.registerMemoryCapability() exists (new SDK >=2026.4.5) */\n  hasRegisterMemoryCapability: boolean;\n  /** definePluginEntry from openclaw/plugin-sdk/plugin-entry is importable */\n  hasDefinePluginEntry: boolean;\n  /** api.runtime.* namespace exists */\n  hasRuntimeNamespace: boolean;\n  /** api.registrationMode is present */\n  hasRegistrationMode: boolean;\n  /** Hooks receive typed event/context objects */\n  hasTypedHooks: boolean;\n  /** Detected SDK version string, or \"legacy\" */\n  sdkVersion: string;\n  /** api.registrationMode value when present */\n  registrationMode: \"full\" | \"setup-only\" | \"setup-runtime\" | undefined;\n}\n\nexport function detectSdkCapabilities(api: Record<string, unknown>): SdkCapabilities {\n  const hasRegisterMemoryPromptSection =\n    typeof (api as any).registerMemoryPromptSection === \"function\";\n  const hasRegisterMemoryCapability =\n    typeof (api as any).registerMemoryCapability === \"function\";\n  const hasRuntimeNamespace =\n    typeof (api as any).runtime === \"object\" && (api as any).runtime !== null;\n  const hasRegistrationMode = typeof (api as any).registrationMode === \"string\";\n\n  const runtimeVersion =\n    hasRuntimeNamespace && typeof (api as any).runtime?.version === \"string\"\n      ? (api as any).runtime.version\n      : null;\n  const isNewSdk =\n    hasRegisterMemoryPromptSection || hasRegisterMemoryCapability || hasRuntimeNamespace || hasRegistrationMode;\n  const sdkVersion: string =\n    runtimeVersion ??\n    (isNewSdk ? readEnvVar(\"OPENCLAW_SERVICE_VERSION\") : null) ??\n    \"legacy\";\n\n  // New SDK is indicated by any of the new API surfaces being present.\n  // New hook system requires one of the authoritative new-SDK signals:\n  //   - registerMemoryPromptSection (pre-capability new SDKs, ≥2026.3.22)\n  //   - registerMemoryCapability   (capability-based SDKs, ≥2026.4.5; the\n  //     deprecated registerMemoryPromptSection may be absent)\n  //   - registrationMode           (explicit registration lifecycle signal)\n  // Just having runtime.version is NOT sufficient — some legacy builds\n  // expose it. Omitting registerMemoryCapability here would cause the\n  // legacy before_agent_start hook to be registered on new SDKs that only\n  // expose registerMemoryCapability, silently breaking memory injection.\n  const hasNewHookSystem =\n    hasRegisterMemoryPromptSection || hasRegisterMemoryCapability || hasRegistrationMode;\n\n  return {\n    hasBeforePromptBuild: hasNewHookSystem,\n    hasRegisterMemoryPromptSection,\n    hasRegisterMemoryCapability,\n    hasDefinePluginEntry: isNewSdk, // entry point is less risky, keep broad detection\n    hasRuntimeNamespace,\n    hasRegistrationMode,\n    hasTypedHooks: hasNewHookSystem,\n    sdkVersion,\n    registrationMode: hasRegistrationMode\n      ? ((api as any).registrationMode as SdkCapabilities[\"registrationMode\"])\n      : undefined,\n  };\n}\n"],"mappings":";;;;;AA+BO,SAAS,sBAAsB,KAA+C;AACnF,QAAM,iCACJ,OAAQ,IAAY,gCAAgC;AACtD,QAAM,8BACJ,OAAQ,IAAY,6BAA6B;AACnD,QAAM,sBACJ,OAAQ,IAAY,YAAY,YAAa,IAAY,YAAY;AACvE,QAAM,sBAAsB,OAAQ,IAAY,qBAAqB;AAErE,QAAM,iBACJ,uBAAuB,OAAQ,IAAY,SAAS,YAAY,WAC3D,IAAY,QAAQ,UACrB;AACN,QAAM,WACJ,kCAAkC,+BAA+B,uBAAuB;AAC1F,QAAM,aACJ,mBACC,WAAW,WAAW,0BAA0B,IAAI,SACrD;AAYF,QAAM,mBACJ,kCAAkC,+BAA+B;AAEnE,SAAO;AAAA,IACL,sBAAsB;AAAA,IACtB;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,sBACZ,IAAY,mBACd;AAAA,EACN;AACF;","names":[]}
+{"version":3,"sources":["../src/sdk-compat.ts"],"sourcesContent":["/**\n * Runtime SDK capability detection.\n *\n * Probes the injected api object at registration time to determine which\n * OpenClaw SDK features are available. All hook registrations and entry-point\n * patterns branch on these flags so engram works on both old (≤2026.3.13)\n * and new (≥2026.3.22) runtimes.\n */\nimport { readEnvVar } from \"./runtime/env.js\";\n\nexport interface SdkCapabilities {\n  /** api.on(\"before_prompt_build\", ...) is available */\n  hasBeforePromptBuild: boolean;\n  /** api.registerMemoryPromptSection() exists */\n  hasRegisterMemoryPromptSection: boolean;\n  /** api.registerMemoryCapability() exists (new SDK >=2026.4.5) */\n  hasRegisterMemoryCapability: boolean;\n  /** definePluginEntry from openclaw/plugin-sdk/plugin-entry is importable */\n  hasDefinePluginEntry: boolean;\n  /** api.runtime.* namespace exists */\n  hasRuntimeNamespace: boolean;\n  /** api.registrationMode is present */\n  hasRegistrationMode: boolean;\n  /** Hooks receive typed event/context objects */\n  hasTypedHooks: boolean;\n  /** Detected SDK version string, or \"legacy\" */\n  sdkVersion: string;\n  /** api.registrationMode value when present */\n  registrationMode: \"full\" | \"setup-only\" | \"setup-runtime\" | undefined;\n}\n\nexport function detectSdkCapabilities(api: Record<string, unknown>): SdkCapabilities {\n  const hasRegisterMemoryPromptSection =\n    typeof (api as any).registerMemoryPromptSection === \"function\";\n  const hasRegisterMemoryCapability =\n    typeof (api as any).registerMemoryCapability === \"function\";\n  const hasRuntimeNamespace =\n    typeof (api as any).runtime === \"object\" && (api as any).runtime !== null;\n  const hasRegistrationMode = typeof (api as any).registrationMode === \"string\";\n\n  const runtimeVersion =\n    hasRuntimeNamespace && typeof (api as any).runtime?.version === \"string\"\n      ? (api as any).runtime.version\n      : null;\n  const isNewSdk =\n    hasRegisterMemoryPromptSection || hasRegisterMemoryCapability || hasRuntimeNamespace || hasRegistrationMode;\n  const sdkVersion: string =\n    runtimeVersion ??\n    (isNewSdk ? readEnvVar(\"OPENCLAW_SERVICE_VERSION\") : null) ??\n    \"legacy\";\n\n  // New SDK is indicated by any of the new API surfaces being present.\n  // New hook system requires one of the authoritative new-SDK signals:\n  //   - registerMemoryPromptSection (pre-capability new SDKs, ≥2026.3.22)\n  //   - registerMemoryCapability   (capability-based SDKs, ≥2026.4.5; the\n  //     deprecated registerMemoryPromptSection may be absent)\n  //   - registrationMode           (explicit registration lifecycle signal)\n  // Just having runtime.version is NOT sufficient — some legacy builds\n  // expose it. Omitting registerMemoryCapability here would cause the\n  // legacy before_agent_start hook to be registered on new SDKs that only\n  // expose registerMemoryCapability, silently breaking memory injection.\n  const hasNewHookSystem =\n    hasRegisterMemoryPromptSection || hasRegisterMemoryCapability || hasRegistrationMode;\n\n  return {\n    hasBeforePromptBuild: hasNewHookSystem,\n    hasRegisterMemoryPromptSection,\n    hasRegisterMemoryCapability,\n    hasDefinePluginEntry: isNewSdk, // entry point is less risky, keep broad detection\n    hasRuntimeNamespace,\n    hasRegistrationMode,\n    hasTypedHooks: hasNewHookSystem,\n    sdkVersion,\n    registrationMode: hasRegistrationMode\n      ? ((api as any).registrationMode as SdkCapabilities[\"registrationMode\"])\n      : undefined,\n  };\n}\n"],"mappings":";;;;;;AA+BO,SAAS,sBAAsB,KAA+C;AACnF,QAAM,iCACJ,OAAQ,IAAY,gCAAgC;AACtD,QAAM,8BACJ,OAAQ,IAAY,6BAA6B;AACnD,QAAM,sBACJ,OAAQ,IAAY,YAAY,YAAa,IAAY,YAAY;AACvE,QAAM,sBAAsB,OAAQ,IAAY,qBAAqB;AAErE,QAAM,iBACJ,uBAAuB,OAAQ,IAAY,SAAS,YAAY,WAC3D,IAAY,QAAQ,UACrB;AACN,QAAM,WACJ,kCAAkC,+BAA+B,uBAAuB;AAC1F,QAAM,aACJ,mBACC,WAAW,WAAW,0BAA0B,IAAI,SACrD;AAYF,QAAM,mBACJ,kCAAkC,+BAA+B;AAEnE,SAAO;AAAA,IACL,sBAAsB;AAAA,IACtB;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA;AAAA,IACtB;AAAA,IACA;AAAA,IACA,eAAe;AAAA,IACf;AAAA,IACA,kBAAkB,sBACZ,IAAY,mBACd;AAAA,EACN;AACF;","names":[]}

package/dist/secure-store-4R2GSO7S.js

@@ -0,0 +1,156 @@
+import {
+  MIN_PASSPHRASE_LENGTH,
+  createPassphraseReader,
+  renderDisableReport,
+  renderInitReport,
+  renderLockReport,
+  renderMigrateReport,
+  renderStatusReport,
+  renderUnlockReport,
+  runSecureStoreDisable,
+  runSecureStoreInit,
+  runSecureStoreLock,
+  runSecureStoreMigrate,
+  runSecureStoreStatus,
+  runSecureStoreUnlock
+} from "./chunk-CK5NTM2S.js";
+import {
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  SecureStoreDecryptError,
+  SecureStoreLockedError,
+  decryptFileBody,
+  decryptMemoryDirToPlaintext,
+  encryptFileBody,
+  filePathAad,
+  isEncryptedFile,
+  migrateMemoryDirToEncrypted,
+  readMaybeEncryptedFile,
+  writeMaybeEncryptedFile
+} from "./chunk-YNJHCGDT.js";
+import {
+  HEADER_FILENAME,
+  HEADER_FORMAT,
+  HEADER_FORMAT_VERSION,
+  SECURE_STORE_DIR_NAME,
+  buildHeader,
+  buildHeaderFromPassphrase,
+  deriveKeyFromHeader,
+  headerPath,
+  keyring_exports,
+  parseHeader,
+  readHeader,
+  secureStoreDir,
+  serializeHeader,
+  validateHeader,
+  verifyKey,
+  writeHeader
+} from "./chunk-BJMBJZ2Y.js";
+import {
+  METADATA_FORMAT,
+  METADATA_FORMAT_VERSION,
+  buildMetadata,
+  decodeMetadataSalt,
+  parseMetadata,
+  serializeMetadata,
+  validateMetadata
+} from "./chunk-UKJAGEXH.js";
+import {
+  DEFAULT_ARGON2ID_PARAMS,
+  DEFAULT_SCRYPT_PARAMS,
+  KDF_KEY_LENGTH,
+  KDF_SALT_LENGTH,
+  constantTimeEqual,
+  deriveKey,
+  deriveKeyScrypt,
+  validateScryptParams
+} from "./chunk-FP2373TW.js";
+import {
+  AES_KEY_LENGTH,
+  AUTH_TAG_LENGTH,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  IV_LENGTH,
+  generateSalt,
+  open,
+  parseEnvelope,
+  seal
+} from "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  AES_KEY_LENGTH,
+  AUTH_TAG_LENGTH,
+  DEFAULT_ARGON2ID_PARAMS,
+  DEFAULT_SCRYPT_PARAMS,
+  ENVELOPE_HEADER_SIZE,
+  ENVELOPE_LAYOUT,
+  ENVELOPE_SALT_LENGTH,
+  ENVELOPE_VERSION,
+  FILE_FORMAT_FLAGS,
+  FILE_FORMAT_VERSION,
+  HEADER_FILENAME,
+  HEADER_FORMAT,
+  HEADER_FORMAT_VERSION,
+  IV_LENGTH,
+  KDF_KEY_LENGTH,
+  KDF_SALT_LENGTH,
+  MAGIC_BYTES,
+  MAGIC_HEADER_SIZE,
+  METADATA_FORMAT,
+  METADATA_FORMAT_VERSION,
+  MIN_PASSPHRASE_LENGTH,
+  SECURE_STORE_DIR_NAME,
+  SecureStoreDecryptError,
+  SecureStoreLockedError,
+  buildHeader,
+  buildHeaderFromPassphrase,
+  buildMetadata,
+  constantTimeEqual,
+  createPassphraseReader,
+  decodeMetadataSalt,
+  decryptFileBody,
+  decryptMemoryDirToPlaintext,
+  deriveKey,
+  deriveKeyFromHeader,
+  deriveKeyScrypt,
+  encryptFileBody,
+  filePathAad,
+  generateSalt,
+  headerPath,
+  isEncryptedFile,
+  keyring_exports as keyring,
+  migrateMemoryDirToEncrypted,
+  open,
+  parseEnvelope,
+  parseHeader,
+  parseMetadata,
+  readHeader,
+  readMaybeEncryptedFile,
+  renderDisableReport,
+  renderInitReport,
+  renderLockReport,
+  renderMigrateReport,
+  renderStatusReport,
+  renderUnlockReport,
+  runSecureStoreDisable,
+  runSecureStoreInit,
+  runSecureStoreLock,
+  runSecureStoreMigrate,
+  runSecureStoreStatus,
+  runSecureStoreUnlock,
+  seal,
+  secureStoreDir,
+  serializeHeader,
+  serializeMetadata,
+  validateHeader,
+  validateMetadata,
+  validateScryptParams,
+  verifyKey,
+  writeHeader,
+  writeMaybeEncryptedFile
+};
+//# sourceMappingURL=secure-store-4R2GSO7S.js.map

package/dist/secure-store-4R2GSO7S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/semantic-chunking.js

@@ -8,6 +8,7 @@ import {
   stddev
 } from "./chunk-KVE7R4CG.js";
 import "./chunk-4WMCPJWX.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_SEMANTIC_CHUNKING_CONFIG,
   cosineSimilarity,

package/dist/{semantic-consolidation-CxJU6MJk.d.ts → semantic-consolidation-ByBXb-sf.d.ts}

@@ -1,7 +1,7 @@
 import { PluginConfig, MemoryFile } from './types.js';
 import { R as RolloutSummaryInput, M as MaterializeResult } from './codex-materialize-CQlLTzke.js';
 import { LoggerBackend } from './logger.js';
-import { ConsolidationOperator } from './consolidation-operator.js';
+import { SemanticConsolidationLlmOperator } from './consolidation-operator.js';
 
 /**
  * memory-extension-host/types.ts — Types for third-party memory extension discovery.
@@ -104,7 +104,7 @@ declare function parseConsolidationResponse(response: string): string;
  *   returns).  Callers persist this as the body of the new memory.
  */
 interface OperatorAwareConsolidationResult {
-    operator: ConsolidationOperator;
+    operator: SemanticConsolidationLlmOperator;
     output: string;
 }
 /**
@@ -126,7 +126,7 @@ interface OperatorAwareConsolidationResult {
  *     logical source actually encodes several distinct facts — at which
  *     point the orchestrator would need to write multiple outputs.
  */
-declare function chooseConsolidationOperator(cluster: ConsolidationCluster): ConsolidationOperator;
+declare function chooseConsolidationOperator(cluster: ConsolidationCluster): SemanticConsolidationLlmOperator;
 /**
  * Build the operator-aware LLM prompt.  The LLM is asked to return a
  * JSON object `{ "operator": <split|merge|update>, "output": <content> }`.

package/dist/semantic-consolidation.d.ts

@@ -1,5 +1,5 @@
 import './types.js';
 import './codex-materialize-CQlLTzke.js';
-export { C as ConsolidationCluster, O as OperatorAwareConsolidationResult, S as SemanticConsolidationResult, a as buildConsolidationPrompt, b as buildExtensionsBlockForConsolidation, c as buildOperatorAwareConsolidationPrompt, e as chooseConsolidationOperator, f as findSimilarClusters, m as materializeAfterSemanticConsolidation, p as parseConsolidationResponse, g as parseOperatorAwareConsolidationResponse, r as resolveExtensionsRoot } from './semantic-consolidation-CxJU6MJk.js';
-export { CONSOLIDATION_OPERATORS, ConsolidationOperator, isConsolidationOperator, isValidDerivedFromEntry } from './consolidation-operator.js';
+export { C as ConsolidationCluster, O as OperatorAwareConsolidationResult, S as SemanticConsolidationResult, a as buildConsolidationPrompt, b as buildExtensionsBlockForConsolidation, c as buildOperatorAwareConsolidationPrompt, e as chooseConsolidationOperator, f as findSimilarClusters, m as materializeAfterSemanticConsolidation, p as parseConsolidationResponse, g as parseOperatorAwareConsolidationResponse, r as resolveExtensionsRoot } from './semantic-consolidation-ByBXb-sf.js';
+export { CONSOLIDATION_OPERATORS, ConsolidationOperator, SemanticConsolidationLlmOperator, isConsolidationOperator, isSemanticConsolidationLlmOperator, isValidDerivedFromEntry } from './consolidation-operator.js';
 import './logger.js';

package/dist/semantic-consolidation.js

@@ -7,18 +7,19 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-PVICZTKG.js";
+} from "./chunk-AGZHRWPT.js";
 import {
   resolveExtensionsRoot
 } from "./chunk-EJI5XIBB.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+import "./chunk-Y4A6M3B6.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-BOUYNNYD.js";
+import "./chunk-67YLUWLG.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
@@ -26,11 +27,14 @@ import "./chunk-4DJQYKMN.js";
 import {
   CONSOLIDATION_OPERATORS,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry
-} from "./chunk-X6GF3FX2.js";
+} from "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   CONSOLIDATION_OPERATORS,
   buildConsolidationPrompt,
@@ -39,6 +43,7 @@ export {
   chooseConsolidationOperator,
   findSimilarClusters,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry,
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,

package/dist/semantic-rule-promotion.d.ts

@@ -9,7 +9,7 @@ interface SemanticRulePromotionCandidate {
 }
 interface SemanticRulePromotionSkip {
     sourceMemoryId: string;
-    reason: "disabled" | "source-memory-missing" | "source-memory-not-episode" | "no-explicit-rule" | "duplicate-rule";
+    reason: "disabled" | "source-memory-missing" | "source-memory-forgotten" | "source-memory-not-episode" | "no-explicit-rule" | "duplicate-rule";
     existingRuleId?: string;
 }
 interface SemanticRulePromotionReport {

package/dist/semantic-rule-promotion.js

@@ -1,20 +1,23 @@
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-VDX363PS.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+} from "./chunk-MUELDH4F.js";
+import "./chunk-Y4A6M3B6.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-BOUYNNYD.js";
+import "./chunk-67YLUWLG.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
-import "./chunk-X6GF3FX2.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   promoteSemanticRuleFromMemory
 };

package/dist/semantic-rule-verifier.d.ts

@@ -1,6 +1,6 @@
 import { MemoryFile } from './types.js';
 
-type SemanticRuleVerificationStatus = "verified" | "source-memory-missing" | "source-memory-archived" | "source-memory-not-episode";
+type SemanticRuleVerificationStatus = "verified" | "source-memory-missing" | "source-memory-archived" | "source-memory-forgotten" | "source-memory-not-episode";
 interface VerifiedSemanticRuleResult {
     rule: MemoryFile;
     score: number;