@remnic/core 1.1.2 → 1.1.4

package/dist/semantic-rule-verifier.js

@@ -1,21 +1,24 @@
 import {
   searchVerifiedSemanticRules
-} from "./chunk-SPI27QT6.js";
+} from "./chunk-W7WWT4FJ.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+import "./chunk-Y4A6M3B6.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-BOUYNNYD.js";
+import "./chunk-67YLUWLG.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
-import "./chunk-X6GF3FX2.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   searchVerifiedSemanticRules
 };

package/dist/session-integrity.js

@@ -3,6 +3,7 @@ import {
   applySessionRepair,
   planSessionRepair
 } from "./chunk-YRMVARQP.js";
+import "./chunk-PZ5AY32C.js";
 export {
   analyzeSessionIntegrity,
   applySessionRepair,

package/dist/session-observer-bands.js

@@ -2,6 +2,7 @@ import {
   DEFAULT_SESSION_OBSERVER_BANDS,
   cloneDefaultSessionObserverBands
 } from "./chunk-Z5LAYHGJ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_SESSION_OBSERVER_BANDS,
   cloneDefaultSessionObserverBands

package/dist/session-observer-state.js

@@ -4,6 +4,7 @@ import {
 } from "./chunk-JR4ZC3G4.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   SessionObserverState,
   normalizeObserverBands

package/dist/session-toggles.js

@@ -1,3 +1,5 @@
+import "./chunk-PZ5AY32C.js";
+
 // src/session-toggles.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import path from "path";

package/dist/session-toggles.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/session-toggles.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nexport interface SessionToggleStore {\n  isDisabled(sessionKey: string, agentId: string): Promise<boolean>;\n  resolve(sessionKey: string, agentId: string): Promise<{\n    disabled: boolean;\n    source: \"primary\" | \"secondary\" | \"none\";\n    updatedAt?: string;\n  }>;\n  setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void>;\n  clear(sessionKey: string, agentId: string): Promise<void>;\n  list(): Promise<Array<{ sessionKey: string; agentId: string; disabled: boolean; updatedAt: string }>>;\n}\n\ninterface ToggleEntry {\n  disabled: boolean;\n  updatedAt: string;\n}\n\ninterface ToggleFile {\n  version: 1;\n  entries: Record<string, ToggleEntry>;\n}\n\ninterface FileToggleStoreOptions {\n  secondaryReadOnlyPath?: string;\n}\n\nfunction encodeToggleKey(sessionKey: string, agentId: string): string {\n  return `${encodeURIComponent(sessionKey)}::${encodeURIComponent(agentId)}`;\n}\n\nfunction decodeToggleKey(key: string): { sessionKey: string; agentId: string } | null {\n  const [encodedSessionKey, encodedAgentId] = key.split(\"::\");\n  if (!encodedSessionKey || !encodedAgentId) return null;\n  return {\n    sessionKey: decodeURIComponent(encodedSessionKey),\n    agentId: decodeURIComponent(encodedAgentId),\n  };\n}\n\nasync function safeReadToggleFile(filePath: string): Promise<ToggleFile> {\n  try {\n    const raw = await readFile(filePath, \"utf8\");\n    const parsed = JSON.parse(raw) as Partial<ToggleFile>;\n    if (!parsed || typeof parsed !== \"object\" || typeof parsed.entries !== \"object\") {\n      return { version: 1, entries: {} };\n    }\n    return {\n      version: 1,\n      entries: Object.fromEntries(\n        Object.entries(parsed.entries).filter(\n          ([, value]) =>\n            value &&\n            typeof value === \"object\" &&\n            typeof value.disabled === \"boolean\" &&\n            typeof value.updatedAt === \"string\",\n        ),\n      ) as Record<string, ToggleEntry>,\n    };\n  } catch {\n    return { version: 1, entries: {} };\n  }\n}\n\nexport function createFileToggleStore(\n  filePath: string,\n  options: FileToggleStoreOptions = {},\n): SessionToggleStore {\n  let writeChain = Promise.resolve();\n\n  async function queueWrite(operation: () => Promise<void>): Promise<void> {\n    const run = writeChain.catch(() => undefined).then(operation);\n    writeChain = run.catch(() => undefined);\n    await run;\n  }\n\n  async function writeToggleFile(next: ToggleFile): Promise<void> {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    await writeFile(filePath, JSON.stringify(next, null, 2), \"utf8\");\n  }\n\n  async function readPrimary(): Promise<ToggleFile> {\n    return safeReadToggleFile(filePath);\n  }\n\n  async function readSecondary(): Promise<ToggleFile> {\n    if (!options.secondaryReadOnlyPath) return { version: 1, entries: {} };\n    return safeReadToggleFile(options.secondaryReadOnlyPath);\n  }\n\n  return {\n    async isDisabled(sessionKey: string, agentId: string): Promise<boolean> {\n      const resolved = await this.resolve(sessionKey, agentId);\n      return resolved.disabled;\n    },\n\n    async resolve(sessionKey: string, agentId: string) {\n      const key = encodeToggleKey(sessionKey, agentId);\n      const primary = await readPrimary();\n      if (primary.entries[key]) {\n        return {\n          disabled: primary.entries[key].disabled,\n          source: \"primary\" as const,\n          updatedAt: primary.entries[key].updatedAt,\n        };\n      }\n      const secondary = await readSecondary();\n      if (secondary.entries[key]) {\n        return {\n          disabled: secondary.entries[key].disabled,\n          source: \"secondary\" as const,\n          updatedAt: secondary.entries[key].updatedAt,\n        };\n      }\n      return { disabled: false, source: \"none\" as const };\n    },\n\n    async setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        current.entries[key] = {\n          disabled,\n          updatedAt: new Date().toISOString(),\n        };\n        await writeToggleFile(current);\n      });\n    },\n\n    async clear(sessionKey: string, agentId: string): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        delete current.entries[key];\n        await writeToggleFile(current);\n      });\n    },\n\n    async list() {\n      const current = await readPrimary();\n      return Object.entries(current.entries)\n        .map(([key, value]) => {\n          const decoded = decodeToggleKey(key);\n          if (!decoded) return null;\n          return {\n            sessionKey: decoded.sessionKey,\n            agentId: decoded.agentId,\n            disabled: value.disabled,\n            updatedAt: value.updatedAt,\n          };\n        })\n        .filter((value): value is { sessionKey: string; agentId: string; disabled: boolean; updatedAt: string } =>\n          value !== null\n        );\n    },\n  };\n}\n"],"mappings":";AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AA4BjB,SAAS,gBAAgB,YAAoB,SAAyB;AACpE,SAAO,GAAG,mBAAmB,UAAU,CAAC,KAAK,mBAAmB,OAAO,CAAC;AAC1E;AAEA,SAAS,gBAAgB,KAA6D;AACpF,QAAM,CAAC,mBAAmB,cAAc,IAAI,IAAI,MAAM,IAAI;AAC1D,MAAI,CAAC,qBAAqB,CAAC,eAAgB,QAAO;AAClD,SAAO;AAAA,IACL,YAAY,mBAAmB,iBAAiB;AAAA,IAChD,SAAS,mBAAmB,cAAc;AAAA,EAC5C;AACF;AAEA,eAAe,mBAAmB,UAAuC;AACvE,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,YAAY,UAAU;AAC/E,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,OAAO;AAAA,QACd,OAAO,QAAQ,OAAO,OAAO,EAAE;AAAA,UAC7B,CAAC,CAAC,EAAE,KAAK,MACP,SACA,OAAO,UAAU,YACjB,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,cAAc;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEO,SAAS,sBACd,UACA,UAAkC,CAAC,GACf;AACpB,MAAI,aAAa,QAAQ,QAAQ;AAEjC,iBAAe,WAAW,WAA+C;AACvE,UAAM,MAAM,WAAW,MAAM,MAAM,MAAS,EAAE,KAAK,SAAS;AAC5D,iBAAa,IAAI,MAAM,MAAM,MAAS;AACtC,UAAM;AAAA,EACR;AAEA,iBAAe,gBAAgB,MAAiC;AAC9D,UAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,UAAM,UAAU,UAAU,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAM;AAAA,EACjE;AAEA,iBAAe,cAAmC;AAChD,WAAO,mBAAmB,QAAQ;AAAA,EACpC;AAEA,iBAAe,gBAAqC;AAClD,QAAI,CAAC,QAAQ,sBAAuB,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AACrE,WAAO,mBAAmB,QAAQ,qBAAqB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,YAAoB,SAAmC;AACtE,YAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO;AACvD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,QAAQ,YAAoB,SAAiB;AACjD,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,QAAQ,QAAQ,GAAG,GAAG;AACxB,eAAO;AAAA,UACL,UAAU,QAAQ,QAAQ,GAAG,EAAE;AAAA,UAC/B,QAAQ;AAAA,UACR,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,QAClC;AAAA,MACF;AACA,YAAM,YAAY,MAAM,cAAc;AACtC,UAAI,UAAU,QAAQ,GAAG,GAAG;AAC1B,eAAO;AAAA,UACL,UAAU,UAAU,QAAQ,GAAG,EAAE;AAAA,UACjC,QAAQ;AAAA,UACR,WAAW,UAAU,QAAQ,GAAG,EAAE;AAAA,QACpC;AAAA,MACF;AACA,aAAO,EAAE,UAAU,OAAO,QAAQ,OAAgB;AAAA,IACpD;AAAA,IAEA,MAAM,YAAY,YAAoB,SAAiB,UAAkC;AACvF,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,gBAAQ,QAAQ,GAAG,IAAI;AAAA,UACrB;AAAA,UACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AACA,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,MAAM,YAAoB,SAAgC;AAC9D,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,eAAO,QAAQ,QAAQ,GAAG;AAC1B,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,UAAU,MAAM,YAAY;AAClC,aAAO,OAAO,QAAQ,QAAQ,OAAO,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,cAAM,UAAU,gBAAgB,GAAG;AACnC,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO;AAAA,UACL,YAAY,QAAQ;AAAA,UACpB,SAAS,QAAQ;AAAA,UACjB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF,CAAC,EACA;AAAA,QAAO,CAAC,UACP,UAAU;AAAA,MACZ;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/session-toggles.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nexport interface SessionToggleStore {\n  isDisabled(sessionKey: string, agentId: string): Promise<boolean>;\n  resolve(sessionKey: string, agentId: string): Promise<{\n    disabled: boolean;\n    source: \"primary\" | \"secondary\" | \"none\";\n    updatedAt?: string;\n  }>;\n  setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void>;\n  clear(sessionKey: string, agentId: string): Promise<void>;\n  list(): Promise<Array<{ sessionKey: string; agentId: string; disabled: boolean; updatedAt: string }>>;\n}\n\ninterface ToggleEntry {\n  disabled: boolean;\n  updatedAt: string;\n}\n\ninterface ToggleFile {\n  version: 1;\n  entries: Record<string, ToggleEntry>;\n}\n\ninterface FileToggleStoreOptions {\n  secondaryReadOnlyPath?: string;\n}\n\nfunction encodeToggleKey(sessionKey: string, agentId: string): string {\n  return `${encodeURIComponent(sessionKey)}::${encodeURIComponent(agentId)}`;\n}\n\nfunction decodeToggleKey(key: string): { sessionKey: string; agentId: string } | null {\n  const [encodedSessionKey, encodedAgentId] = key.split(\"::\");\n  if (!encodedSessionKey || !encodedAgentId) return null;\n  return {\n    sessionKey: decodeURIComponent(encodedSessionKey),\n    agentId: decodeURIComponent(encodedAgentId),\n  };\n}\n\nasync function safeReadToggleFile(filePath: string): Promise<ToggleFile> {\n  try {\n    const raw = await readFile(filePath, \"utf8\");\n    const parsed = JSON.parse(raw) as Partial<ToggleFile>;\n    if (!parsed || typeof parsed !== \"object\" || typeof parsed.entries !== \"object\") {\n      return { version: 1, entries: {} };\n    }\n    return {\n      version: 1,\n      entries: Object.fromEntries(\n        Object.entries(parsed.entries).filter(\n          ([, value]) =>\n            value &&\n            typeof value === \"object\" &&\n            typeof value.disabled === \"boolean\" &&\n            typeof value.updatedAt === \"string\",\n        ),\n      ) as Record<string, ToggleEntry>,\n    };\n  } catch {\n    return { version: 1, entries: {} };\n  }\n}\n\nexport function createFileToggleStore(\n  filePath: string,\n  options: FileToggleStoreOptions = {},\n): SessionToggleStore {\n  let writeChain = Promise.resolve();\n\n  async function queueWrite(operation: () => Promise<void>): Promise<void> {\n    const run = writeChain.catch(() => undefined).then(operation);\n    writeChain = run.catch(() => undefined);\n    await run;\n  }\n\n  async function writeToggleFile(next: ToggleFile): Promise<void> {\n    await mkdir(path.dirname(filePath), { recursive: true });\n    await writeFile(filePath, JSON.stringify(next, null, 2), \"utf8\");\n  }\n\n  async function readPrimary(): Promise<ToggleFile> {\n    return safeReadToggleFile(filePath);\n  }\n\n  async function readSecondary(): Promise<ToggleFile> {\n    if (!options.secondaryReadOnlyPath) return { version: 1, entries: {} };\n    return safeReadToggleFile(options.secondaryReadOnlyPath);\n  }\n\n  return {\n    async isDisabled(sessionKey: string, agentId: string): Promise<boolean> {\n      const resolved = await this.resolve(sessionKey, agentId);\n      return resolved.disabled;\n    },\n\n    async resolve(sessionKey: string, agentId: string) {\n      const key = encodeToggleKey(sessionKey, agentId);\n      const primary = await readPrimary();\n      if (primary.entries[key]) {\n        return {\n          disabled: primary.entries[key].disabled,\n          source: \"primary\" as const,\n          updatedAt: primary.entries[key].updatedAt,\n        };\n      }\n      const secondary = await readSecondary();\n      if (secondary.entries[key]) {\n        return {\n          disabled: secondary.entries[key].disabled,\n          source: \"secondary\" as const,\n          updatedAt: secondary.entries[key].updatedAt,\n        };\n      }\n      return { disabled: false, source: \"none\" as const };\n    },\n\n    async setDisabled(sessionKey: string, agentId: string, disabled: boolean): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        current.entries[key] = {\n          disabled,\n          updatedAt: new Date().toISOString(),\n        };\n        await writeToggleFile(current);\n      });\n    },\n\n    async clear(sessionKey: string, agentId: string): Promise<void> {\n      const key = encodeToggleKey(sessionKey, agentId);\n      await queueWrite(async () => {\n        const current = await readPrimary();\n        delete current.entries[key];\n        await writeToggleFile(current);\n      });\n    },\n\n    async list() {\n      const current = await readPrimary();\n      return Object.entries(current.entries)\n        .map(([key, value]) => {\n          const decoded = decodeToggleKey(key);\n          if (!decoded) return null;\n          return {\n            sessionKey: decoded.sessionKey,\n            agentId: decoded.agentId,\n            disabled: value.disabled,\n            updatedAt: value.updatedAt,\n          };\n        })\n        .filter((value): value is { sessionKey: string; agentId: string; disabled: boolean; updatedAt: string } =>\n          value !== null\n        );\n    },\n  };\n}\n"],"mappings":";;;AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AA4BjB,SAAS,gBAAgB,YAAoB,SAAyB;AACpE,SAAO,GAAG,mBAAmB,UAAU,CAAC,KAAK,mBAAmB,OAAO,CAAC;AAC1E;AAEA,SAAS,gBAAgB,KAA6D;AACpF,QAAM,CAAC,mBAAmB,cAAc,IAAI,IAAI,MAAM,IAAI;AAC1D,MAAI,CAAC,qBAAqB,CAAC,eAAgB,QAAO;AAClD,SAAO;AAAA,IACL,YAAY,mBAAmB,iBAAiB;AAAA,IAChD,SAAS,mBAAmB,cAAc;AAAA,EAC5C;AACF;AAEA,eAAe,mBAAmB,UAAuC;AACvE,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,UAAU,MAAM;AAC3C,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,YAAY,UAAU;AAC/E,aAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,IACnC;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,OAAO;AAAA,QACd,OAAO,QAAQ,OAAO,OAAO,EAAE;AAAA,UAC7B,CAAC,CAAC,EAAE,KAAK,MACP,SACA,OAAO,UAAU,YACjB,OAAO,MAAM,aAAa,aAC1B,OAAO,MAAM,cAAc;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEO,SAAS,sBACd,UACA,UAAkC,CAAC,GACf;AACpB,MAAI,aAAa,QAAQ,QAAQ;AAEjC,iBAAe,WAAW,WAA+C;AACvE,UAAM,MAAM,WAAW,MAAM,MAAM,MAAS,EAAE,KAAK,SAAS;AAC5D,iBAAa,IAAI,MAAM,MAAM,MAAS;AACtC,UAAM;AAAA,EACR;AAEA,iBAAe,gBAAgB,MAAiC;AAC9D,UAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,UAAM,UAAU,UAAU,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,MAAM;AAAA,EACjE;AAEA,iBAAe,cAAmC;AAChD,WAAO,mBAAmB,QAAQ;AAAA,EACpC;AAEA,iBAAe,gBAAqC;AAClD,QAAI,CAAC,QAAQ,sBAAuB,QAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AACrE,WAAO,mBAAmB,QAAQ,qBAAqB;AAAA,EACzD;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,YAAoB,SAAmC;AACtE,YAAM,WAAW,MAAM,KAAK,QAAQ,YAAY,OAAO;AACvD,aAAO,SAAS;AAAA,IAClB;AAAA,IAEA,MAAM,QAAQ,YAAoB,SAAiB;AACjD,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,UAAU,MAAM,YAAY;AAClC,UAAI,QAAQ,QAAQ,GAAG,GAAG;AACxB,eAAO;AAAA,UACL,UAAU,QAAQ,QAAQ,GAAG,EAAE;AAAA,UAC/B,QAAQ;AAAA,UACR,WAAW,QAAQ,QAAQ,GAAG,EAAE;AAAA,QAClC;AAAA,MACF;AACA,YAAM,YAAY,MAAM,cAAc;AACtC,UAAI,UAAU,QAAQ,GAAG,GAAG;AAC1B,eAAO;AAAA,UACL,UAAU,UAAU,QAAQ,GAAG,EAAE;AAAA,UACjC,QAAQ;AAAA,UACR,WAAW,UAAU,QAAQ,GAAG,EAAE;AAAA,QACpC;AAAA,MACF;AACA,aAAO,EAAE,UAAU,OAAO,QAAQ,OAAgB;AAAA,IACpD;AAAA,IAEA,MAAM,YAAY,YAAoB,SAAiB,UAAkC;AACvF,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,gBAAQ,QAAQ,GAAG,IAAI;AAAA,UACrB;AAAA,UACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC;AACA,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,MAAM,YAAoB,SAAgC;AAC9D,YAAM,MAAM,gBAAgB,YAAY,OAAO;AAC/C,YAAM,WAAW,YAAY;AAC3B,cAAM,UAAU,MAAM,YAAY;AAClC,eAAO,QAAQ,QAAQ,GAAG;AAC1B,cAAM,gBAAgB,OAAO;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,IAEA,MAAM,OAAO;AACX,YAAM,UAAU,MAAM,YAAY;AAClC,aAAO,OAAO,QAAQ,QAAQ,OAAO,EAClC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;AACrB,cAAM,UAAU,gBAAgB,GAAG;AACnC,YAAI,CAAC,QAAS,QAAO;AACrB,eAAO;AAAA,UACL,YAAY,QAAQ;AAAA,UACpB,SAAS,QAAQ;AAAA,UACjB,UAAU,MAAM;AAAA,UAChB,WAAW,MAAM;AAAA,QACnB;AAAA,MACF,CAAC,EACA;AAAA,QAAO,CAAC,UACP,UAAU;AAAA,MACZ;AAAA,IACJ;AAAA,EACF;AACF;","names":[]}

package/dist/signal.js

@@ -2,6 +2,7 @@ import {
   isDisagreementPrompt,
   scanSignals
 } from "./chunk-XYIK4LF6.js";
+import "./chunk-PZ5AY32C.js";
 export {
   isDisagreementPrompt,
   scanSignals

package/dist/skills-registry.js

@@ -1,3 +1,5 @@
+import "./chunk-PZ5AY32C.js";
+
 // src/skills-registry.ts
 import { fileURLToPath } from "url";
 import { dirname, resolve } from "path";

package/dist/skills-registry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/skills-registry.ts"],"sourcesContent":["/**\n * skills-registry.ts\n *\n * Built-in Remnic procedural memory skills — the canonical SKILL.md sources\n * shipped with the monorepo. Consumers (e.g. the Codex materializer in #378)\n * read this registry to discover which skills to materialize into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n *\n * This module is intentionally free of Codex/Claude Code host coupling —\n * it only exposes the static metadata each host needs.\n */\n\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\n\n/**\n * A single procedural-memory skill source that Remnic ships.\n *\n * - `slug` is the canonical folder name under `skills/` and the file on disk\n *   must live at `<pluginRoot>/skills/<slug>/SKILL.md`.\n * - `staticPath`, when set, points at a pre-authored SKILL.md on disk.\n * - `generator`, when set, produces a SKILL.md body at materialization time.\n *   Exactly one of `staticPath` or `generator` should be provided.\n * - `disableModelInvocation` mirrors the `disable-model-invocation` frontmatter\n *   key and indicates a skill that writes or mutates state and therefore\n *   should not be auto-invoked by a model without explicit opt-in.\n */\nexport interface RemnicSkillSource {\n  slug: string;\n  staticPath?: string;\n  generator?: () => Promise<string>;\n  disableModelInvocation: boolean;\n}\n\n/**\n * Validate a Remnic skill slug. Rules:\n *\n * - lowercase letters, digits, and `-` only\n * - must start with a letter or digit\n * - 1–64 characters\n *\n * This is the same shape the Codex skills directory expects.\n */\nexport function isValidSkillSlug(slug: string): boolean {\n  // Must start with alphanumeric; each dash must be followed by alphanumeric\n  // (no trailing dashes, no consecutive dashes); 1–64 characters total.\n  return /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63}$/.test(slug);\n}\n\n// ---------------------------------------------------------------------------\n// Built-in skill paths — resolved relative to this source file.\n// ---------------------------------------------------------------------------\n//\n// This file lives at `packages/remnic-core/src/skills-registry.ts`.\n// After tsup build it lives at `packages/remnic-core/dist/skills-registry.js`.\n// In both cases, the shipped skill sources live four levels up at\n// `packages/plugin-codex/skills/<slug>/SKILL.md`.\n//\n// We compute the absolute path from the current module so that callers in any\n// cwd can resolve the files.\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst PLUGIN_CODEX_SKILLS_DIR = resolve(HERE, \"..\", \"..\", \"plugin-codex\", \"skills\");\n\nfunction codexSkillPath(slug: string): string {\n  return resolve(PLUGIN_CODEX_SKILLS_DIR, slug, \"SKILL.md\");\n}\n\n/**\n * The canonical list of Remnic procedural memory skills shipped with the\n * monorepo. The Codex materializer (#378) copies these into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n */\nexport const BUILTIN_SKILLS: RemnicSkillSource[] = [\n  {\n    slug: \"remnic-memory-workflow\",\n    staticPath: codexSkillPath(\"remnic-memory-workflow\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-recall\",\n    staticPath: codexSkillPath(\"remnic-recall\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-remember\",\n    staticPath: codexSkillPath(\"remnic-remember\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-search\",\n    staticPath: codexSkillPath(\"remnic-search\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-entities\",\n    staticPath: codexSkillPath(\"remnic-entities\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-status\",\n    staticPath: codexSkillPath(\"remnic-status\"),\n    disableModelInvocation: false,\n  },\n];\n"],"mappings":";AAYA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AA8B1B,SAAS,iBAAiB,MAAuB;AAGtD,SAAO,6CAA6C,KAAK,IAAI;AAC/D;AAcA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,0BAA0B,QAAQ,MAAM,MAAM,MAAM,gBAAgB,QAAQ;AAElF,SAAS,eAAe,MAAsB;AAC5C,SAAO,QAAQ,yBAAyB,MAAM,UAAU;AAC1D;AAOO,IAAM,iBAAsC;AAAA,EACjD;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,wBAAwB;AAAA,IACnD,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AACF;","names":[]}
+{"version":3,"sources":["../src/skills-registry.ts"],"sourcesContent":["/**\n * skills-registry.ts\n *\n * Built-in Remnic procedural memory skills — the canonical SKILL.md sources\n * shipped with the monorepo. Consumers (e.g. the Codex materializer in #378)\n * read this registry to discover which skills to materialize into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n *\n * This module is intentionally free of Codex/Claude Code host coupling —\n * it only exposes the static metadata each host needs.\n */\n\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, resolve } from \"node:path\";\n\n/**\n * A single procedural-memory skill source that Remnic ships.\n *\n * - `slug` is the canonical folder name under `skills/` and the file on disk\n *   must live at `<pluginRoot>/skills/<slug>/SKILL.md`.\n * - `staticPath`, when set, points at a pre-authored SKILL.md on disk.\n * - `generator`, when set, produces a SKILL.md body at materialization time.\n *   Exactly one of `staticPath` or `generator` should be provided.\n * - `disableModelInvocation` mirrors the `disable-model-invocation` frontmatter\n *   key and indicates a skill that writes or mutates state and therefore\n *   should not be auto-invoked by a model without explicit opt-in.\n */\nexport interface RemnicSkillSource {\n  slug: string;\n  staticPath?: string;\n  generator?: () => Promise<string>;\n  disableModelInvocation: boolean;\n}\n\n/**\n * Validate a Remnic skill slug. Rules:\n *\n * - lowercase letters, digits, and `-` only\n * - must start with a letter or digit\n * - 1–64 characters\n *\n * This is the same shape the Codex skills directory expects.\n */\nexport function isValidSkillSlug(slug: string): boolean {\n  // Must start with alphanumeric; each dash must be followed by alphanumeric\n  // (no trailing dashes, no consecutive dashes); 1–64 characters total.\n  return /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,63}$/.test(slug);\n}\n\n// ---------------------------------------------------------------------------\n// Built-in skill paths — resolved relative to this source file.\n// ---------------------------------------------------------------------------\n//\n// This file lives at `packages/remnic-core/src/skills-registry.ts`.\n// After tsup build it lives at `packages/remnic-core/dist/skills-registry.js`.\n// In both cases, the shipped skill sources live four levels up at\n// `packages/plugin-codex/skills/<slug>/SKILL.md`.\n//\n// We compute the absolute path from the current module so that callers in any\n// cwd can resolve the files.\n\nconst HERE = dirname(fileURLToPath(import.meta.url));\nconst PLUGIN_CODEX_SKILLS_DIR = resolve(HERE, \"..\", \"..\", \"plugin-codex\", \"skills\");\n\nfunction codexSkillPath(slug: string): string {\n  return resolve(PLUGIN_CODEX_SKILLS_DIR, slug, \"SKILL.md\");\n}\n\n/**\n * The canonical list of Remnic procedural memory skills shipped with the\n * monorepo. The Codex materializer (#378) copies these into\n * `~/.codex/memories/skills/<slug>/SKILL.md`.\n */\nexport const BUILTIN_SKILLS: RemnicSkillSource[] = [\n  {\n    slug: \"remnic-memory-workflow\",\n    staticPath: codexSkillPath(\"remnic-memory-workflow\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-recall\",\n    staticPath: codexSkillPath(\"remnic-recall\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-remember\",\n    staticPath: codexSkillPath(\"remnic-remember\"),\n    disableModelInvocation: true,\n  },\n  {\n    slug: \"remnic-search\",\n    staticPath: codexSkillPath(\"remnic-search\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-entities\",\n    staticPath: codexSkillPath(\"remnic-entities\"),\n    disableModelInvocation: false,\n  },\n  {\n    slug: \"remnic-status\",\n    staticPath: codexSkillPath(\"remnic-status\"),\n    disableModelInvocation: false,\n  },\n];\n"],"mappings":";;;AAYA,SAAS,qBAAqB;AAC9B,SAAS,SAAS,eAAe;AA8B1B,SAAS,iBAAiB,MAAuB;AAGtD,SAAO,6CAA6C,KAAK,IAAI;AAC/D;AAcA,IAAM,OAAO,QAAQ,cAAc,YAAY,GAAG,CAAC;AACnD,IAAM,0BAA0B,QAAQ,MAAM,MAAM,MAAM,gBAAgB,QAAQ;AAElF,SAAS,eAAe,MAAsB;AAC5C,SAAO,QAAQ,yBAAyB,MAAM,UAAU;AAC1D;AAOO,IAAM,iBAAsC;AAAA,EACjD;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,wBAAwB;AAAA,IACnD,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,iBAAiB;AAAA,IAC5C,wBAAwB;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,YAAY,eAAe,eAAe;AAAA,IAC1C,wBAAwB;AAAA,EAC1B;AACF;","names":[]}

package/dist/source-attribution.js

@@ -11,6 +11,7 @@ import {
   stripCitation,
   stripCitationForTemplate
 } from "./chunk-4KAN3GZ3.js";
+import "./chunk-PZ5AY32C.js";
 export {
   CITATION_UNKNOWN,
   DEFAULT_CITATION_FORMAT,

package/dist/state-NCHQ4TRG.js

@@ -0,0 +1,8 @@
+import {
+  gatherConsoleState
+} from "./chunk-TYEOAFH3.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  gatherConsoleState
+};
+//# sourceMappingURL=state-NCHQ4TRG.js.map

package/dist/state-NCHQ4TRG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/state-store-3EH7HYIN.js

@@ -0,0 +1,16 @@
+import {
+  _connectorStatePathForTest,
+  listConnectorStates,
+  readConnectorState,
+  writeConnectorState
+} from "./chunk-6TBWYBJ3.js";
+import "./chunk-IXEJRKCZ.js";
+import "./chunk-MARWOCVP.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  _connectorStatePathForTest,
+  listConnectorStates,
+  readConnectorState,
+  writeConnectorState
+};
+//# sourceMappingURL=state-store-3EH7HYIN.js.map

package/dist/state-store-3EH7HYIN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/storage.d.ts

@@ -1,7 +1,7 @@
 import { VersioningConfig } from './page-versioning.js';
 import { ConsolidationOperator } from './consolidation-operator.js';
 import { PluginConfig, MemoryCategory, ImportanceScore, MemoryLink, MemoryFrontmatter, MemoryStatus, MemoryFile, EntityStructuredSection, BufferState, MetaState, MemoryActionEvent, MemoryLifecycleEvent, BufferSurpriseEvent, BehaviorSignalEvent, CompressionGuidelineOptimizerState, ContinuityIncidentOpenInput, ContinuityIncidentRecord, ContinuityIncidentCloseInput, ContinuityImprovementLoop, ContinuityLoopUpsertInput, ContinuityLoopReviewInput, FileHygieneConfig, EntityRelationship, EntityActivityEntry, EntityFile, AccessTrackingEntry, MemoryProjectionCurrentState, MemorySummary, TopicScore } from './types.js';
-import { P as ProjectedMemoryBrowseOptions, a as ProjectedMemoryBrowsePage, b as readProjectedGovernanceRecord } from './memory-projection-store-DeSXPh1j.js';
+import { P as ProjectedMemoryBrowseOptions, a as ProjectedMemoryBrowsePage, b as readProjectedGovernanceRecord } from './memory-projection-store-CY8TU40w.js';
 import 'better-sqlite3';
 
 interface ReextractJobRequest {
@@ -36,7 +36,10 @@ declare class ContentHashIndex {
     private hashes;
     private dirty;
     private readonly filePath;
-    constructor(stateDir: string);
+    private readonly secureStoreKeyProvider;
+    private readonly secureStoreWriteKeyProvider;
+    private readonly memoryDir;
+    constructor(stateDir: string, secureStoreKeyProvider?: () => Buffer | null, secureStoreWriteKeyProvider?: () => Buffer | null, memoryDir?: string);
     /** Load existing hashes from disk. Safe to call multiple times. */
     load(): Promise<void>;
     /** Check if content already exists in the index. */
@@ -112,6 +115,8 @@ declare class StorageManager {
     private static readonly ARTIFACT_INDEX_CACHE_TTL_MS;
     private static readonly artifactWriteVersionByDir;
     private static readonly memoryStatusVersionByDir;
+    private static readonly secureStoreEntityCacheKeyIds;
+    private static nextSecureStoreEntityCacheKeyId;
     private static readonly coldWriteVersionByDir;
     private static readonly allMemoriesInFlight;
     private static readonly COLD_SCAN_CACHE_TTL_MS;
@@ -122,12 +127,68 @@ declare class StorageManager {
     private factHashIndexLoadPromise;
     private factHashIndexAuthoritative;
     private factHashIndexAuthoritativePromise;
+    private readonly secureAppendChains;
     /** Optional: set by the orchestrator after construction to enable template-aware citation stripping during legacy hash rebuild. */
     citationTemplate: string;
     /** Page-versioning configuration.  Set by the orchestrator after construction. */
     private _versioningConfig;
     /** Set the page-versioning configuration.  When `enabled` is false (default), all versioning calls are no-ops. */
     setVersioningConfig(config: VersioningConfig): void;
+    /**
+     * At-rest encryption key (issue #690 PR 3/4).
+     *
+     * When non-null, every memory file read is decrypted and every write
+     * is encrypted using the secure-fs layer.  When null, the storage
+     * layer operates in plain-text mode (legacy/unencrypted store).
+     *
+     * Set by the orchestrator after init/unlock; cleared on lock.
+     * The key buffer is NEVER logged or serialized.
+     */
+    private _secureStoreKey;
+    /**
+     * When true (and `_secureStoreKey` is non-null), new writes are
+     * encrypted.  Set to false to pause encryption of new writes while
+     * still decrypting existing files.
+     */
+    private _secureStoreEncryptOnWrite;
+    /**
+     * When true, the secure-store is configured as required — writes
+     * MUST be encrypted and a locked store MUST reject writes rather
+     * than silently falling back to plaintext.  Set by the orchestrator
+     * from `config.secureStoreEnabled`.
+     */
+    private _secureStoreRequired;
+    /**
+     * Set or clear the at-rest encryption key.
+     *
+     * Pass a 32-byte Buffer to enable encryption; pass null to clear
+     * (lock) the store.  The caller is responsible for key lifecycle —
+     * this method does not zero the buffer on replacement; the keyring
+     * module (`keyring.ts`) owns zeroization.
+     */
+    setSecureStoreKey(key: Buffer | null, encryptOnWrite?: boolean): void;
+    private getEntityCacheSecureStoreKey;
+    /**
+     * Mark the secure-store as required for this storage instance.
+     * When required and locked, writes throw SecureStoreLockedError
+     * rather than silently writing plaintext.
+     */
+    setSecureStoreRequired(required: boolean): void;
+    /** Return true iff the secure-store key is currently set (store is unlocked). */
+    isSecureStoreUnlocked(): boolean;
+    /**
+     * Resolve the effective write key.
+     *
+     * - If `_secureStoreEncryptOnWrite` is false: returns null (plain write).
+     * - If `_secureStoreEncryptOnWrite` is true AND key is set: returns key.
+     * - If `_secureStoreEncryptOnWrite` is true AND key is null AND
+     *   `_secureStoreRequired` is true: throws SecureStoreLockedError so the
+     *   write fails loudly rather than silently writing plaintext (P1 finding
+     *   from Cursor review of PR #767).
+     * - If `_secureStoreEncryptOnWrite` is true AND key is null AND
+     *   `_secureStoreRequired` is false: returns null (unencrypted store).
+     */
+    private resolveWriteKey;
     /**
      * Snapshot the current content of a page before overwriting.
      * No-op when versioning is disabled or the file does not yet exist.
@@ -164,6 +225,11 @@ declare class StorageManager {
     private get proceduresDir();
     private get reasoningTracesDir();
     private get entitiesDir();
+    private readStorageSecureFile;
+    private writeStorageSecureFile;
+    createContentHashIndex(): ContentHashIndex;
+    private appendStorageSecureFile;
+    private appendStorageSecureFileUnlocked;
     private get stateDir();
     private get entitySynthesisQueuePath();
     private get factHashIndexReadyPath();
@@ -247,6 +313,8 @@ declare class StorageManager {
         derivedVia?: ConsolidationOperator;
     }): Promise<string>;
     hasFactContentHash(content: string): Promise<boolean>;
+    private factContentHashForRemoval;
+    removeFactContentHashesForMemories(memories: MemoryFile[]): Promise<void>;
     isFactContentHashAuthoritative(): Promise<boolean>;
     writeArtifact(quote: string, options?: {
         actor?: string;
@@ -287,6 +355,8 @@ declare class StorageManager {
     /** Public cache invalidation for callers that need authoritative disk reads
      *  (e.g. projection verify/rebuild). */
     invalidateAllMemoriesCacheForDir(): void;
+    /** Invalidate only the cache layers affected by direct tier file deletes. */
+    invalidateMemoryCachesForTiers(tiers: Iterable<"hot" | "cold" | "archive">): void;
     /** Clear ALL static caches. Use in tests that write files directly
      *  (bypassing StorageManager.writeMemory) to avoid stale reads. */
     static clearAllStaticCaches(): void;
@@ -477,6 +547,10 @@ declare class StorageManager {
     readReextractJobs(limit?: number): Promise<ReextractJobRequest[]>;
     readBehaviorSignals(limit?: number): Promise<BehaviorSignalEvent[]>;
     readMemoryActionEvents(limit?: number): Promise<MemoryActionEvent[]>;
+    readMemoryActionEventRows(limit?: number): Promise<Array<{
+        line: number;
+        event: MemoryActionEvent;
+    }>>;
     readAllMemoryLifecycleEvents(): Promise<MemoryLifecycleEvent[]>;
     readMemoryLifecycleEvents(limit?: number): Promise<MemoryLifecycleEvent[]>;
     writeCompressionGuidelines(content: string): Promise<void>;

package/dist/storage.js

@@ -8,20 +8,23 @@ import {
   normalizeEntityName,
   parseEntityFile,
   serializeEntityFile
-} from "./chunk-F5VP6YCB.js";
-import "./chunk-LTCGGW2D.js";
+} from "./chunk-Y4A6M3B6.js";
+import "./chunk-YNJHCGDT.js";
 import "./chunk-4KAN3GZ3.js";
-import "./chunk-6PFRXT4K.js";
-import "./chunk-TP4FZJIZ.js";
+import "./chunk-43EKP2UK.js";
+import "./chunk-PFV5C235.js";
+import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-BOUYNNYD.js";
+import "./chunk-67YLUWLG.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-QSVPYQPG.js";
 import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
-import "./chunk-X6GF3FX2.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-A6XUJE5D.js";
+import "./chunk-PZ5AY32C.js";
 export {
   ContentHashIndex,
   StorageManager,

package/dist/store-contract.js

@@ -8,6 +8,7 @@ import {
   recordStoreDay,
   validateStringRecord
 } from "./chunk-DGXUHMOV.js";
+import "./chunk-PZ5AY32C.js";
 export {
   assertIsoRecordedAt,
   assertSafePathSegment,

package/dist/summarizer.js

@@ -1,17 +1,18 @@
 import {
   HourlySummarizer
-} from "./chunk-DG6YMRDC.js";
+} from "./chunk-B2TL6GA2.js";
 import "./chunk-ETOW6ACV.js";
 import "./chunk-FEMOX5AD.js";
 import "./chunk-R2XRID2N.js";
-import "./chunk-OR64ZGRZ.js";
-import "./chunk-AYXIPSZO.js";
-import "./chunk-Y7R2XJ5Q.js";
+import "./chunk-CRU27Q4J.js";
+import "./chunk-Q7FJ5ZHM.js";
 import "./chunk-ODWDQNRE.js";
 import "./chunk-Y27UJK6V.js";
 import "./chunk-UZB5KHKX.js";
+import "./chunk-OR64ZGRZ.js";
 import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   HourlySummarizer
 };

package/dist/summary-snapshot.js

@@ -4,6 +4,7 @@ import {
   upsertSummarySnapshot,
   writeSummarySnapshot
 } from "./chunk-ETOW6ACV.js";
+import "./chunk-PZ5AY32C.js";
 export {
   readSummarySnapshot,
   summarySnapshotPath,

package/dist/temporal-index.js

@@ -12,6 +12,7 @@ import {
   recencyWindowFromPrompt,
   resolvePromptTagPrefilterAsync
 } from "./chunk-V3RXWQIE.js";
+import "./chunk-PZ5AY32C.js";
 export {
   clearIndexes,
   deindexMemory,

package/dist/temporal-supersession.d.ts

@@ -2,7 +2,7 @@ import { MemoryFrontmatter } from './types.js';
 import { StorageManager } from './storage.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
-import './memory-projection-store-DeSXPh1j.js';
+import './memory-projection-store-CY8TU40w.js';
 import 'better-sqlite3';
 
 /**

package/dist/temporal-supersession.js

@@ -6,8 +6,9 @@ import {
   shouldFilterSupersededFromRecall,
   shouldSupersedeExisting,
   supersessionKeysForFact
-} from "./chunk-W6SL7OFG.js";
+} from "./chunk-ZTSE2ZJ6.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   applyTemporalSupersession,
   computeSupersessionKey,

package/dist/temporal-validity.d.ts

@@ -0,0 +1,52 @@
+import { MemoryFrontmatter } from './types.js';
+
+/**
+ * Temporal validity helpers (issue #680).
+ *
+ * `valid_at` / `invalid_at` are explicit ISO 8601 timestamps that mark when a
+ * fact begins and ends being authoritative.  These helpers centralize the
+ * read-time defaulting rules so every call site (recall filter, supersession
+ * write, tests) agrees on the canonical semantics:
+ *
+ *   - `effectiveValidAt(fm)` — the moment this fact starts being true.
+ *     Falls back to `created` when `valid_at` is absent so legacy memories
+ *     written before #680 still participate in `as_of` filtering without
+ *     a backfill migration.
+ *   - `effectiveInvalidAt(fm)` — the moment this fact stops being true.
+ *     Returns `undefined` when no `invalid_at` is set; supersession logic
+ *     populates it on the older fact when a newer one replaces it.
+ *   - `isValidAsOf(fm, asOfMs)` — true when the fact was authoritative at
+ *     `asOfMs` (a numeric timestamp in ms).  Half-open interval semantics:
+ *     `valid_at <= asOf < invalid_at`.  Strings are parsed via
+ *     `Date.parse()` so timezone-suffixed ISO strings compare correctly
+ *     (CLAUDE.md gotcha — never compare ISO strings lexicographically).
+ *
+ * Boundary case: when `invalid_at === asOf`, the fact is treated as NOT
+ * valid (the upper bound is exclusive), which matches the supersession
+ * model — at the instant a successor's `valid_at` fires, the predecessor
+ * is no longer authoritative.
+ */
+
+declare function effectiveValidAt(fm: Pick<MemoryFrontmatter, "valid_at" | "created">): string;
+declare function effectiveInvalidAt(fm: Pick<MemoryFrontmatter, "invalid_at" | "supersededAt" | "status">): string | undefined;
+/**
+ * Returns true when the fact was authoritative at `asOfMs` (parsed
+ * milliseconds since epoch).  Half-open semantics: a fact is valid in
+ * `[valid_at, invalid_at)`.
+ *
+ * If `valid_at` cannot be parsed, the fact is conservatively treated as
+ * NOT valid at the requested point — we never silently default a corrupt
+ * timestamp to "always true" because that would let bad data leak past
+ * the historical filter (CLAUDE.md gotcha #34: distinguish empty from
+ * malformed).
+ */
+declare function isValidAsOf(fm: Pick<MemoryFrontmatter, "valid_at" | "invalid_at" | "created" | "supersededAt" | "status">, asOfMs: number): boolean;
+/**
+ * Parse and validate an `as_of` value supplied at an input boundary
+ * (CLI flag, HTTP query param, MCP field).  Returns parsed milliseconds
+ * on success; throws a `RangeError` with a helpful message on malformed
+ * input.  CLAUDE.md rule 51 — never silently default invalid input.
+ */
+declare function parseAsOfTimestamp(raw: unknown): number;
+
+export { effectiveInvalidAt, effectiveValidAt, isValidAsOf, parseAsOfTimestamp };

package/dist/temporal-validity.js

@@ -0,0 +1,14 @@
+import {
+  effectiveInvalidAt,
+  effectiveValidAt,
+  isValidAsOf,
+  parseAsOfTimestamp
+} from "./chunk-MDYG7VI7.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  effectiveInvalidAt,
+  effectiveValidAt,
+  isValidAsOf,
+  parseAsOfTimestamp
+};
+//# sourceMappingURL=temporal-validity.js.map

package/dist/temporal-validity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/threading.js

@@ -2,6 +2,7 @@ import {
   ThreadingManager
 } from "./chunk-JRNQ3RNA.js";
 import "./chunk-2ODBA7MQ.js";
+import "./chunk-PZ5AY32C.js";
 export {
   ThreadingManager
 };

package/dist/tier-migration.d.ts

@@ -1,10 +1,10 @@
 import { MemoryFile } from './types.js';
 import { StorageManager } from './storage.js';
 import { MemoryTier } from './tier-routing.js';
-import { S as SearchBackend } from './port-BADbLZU5.js';
+import { S as SearchBackend } from './port-hqGnoStS.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
-import './memory-projection-store-DeSXPh1j.js';
+import './memory-projection-store-CY8TU40w.js';
 import 'better-sqlite3';
 import './lifecycle.js';
 

package/dist/tier-migration.js

@@ -1,6 +1,7 @@
 import {
   TierMigrationExecutor
 } from "./chunk-Z5AAYHUC.js";
+import "./chunk-PZ5AY32C.js";
 export {
   TierMigrationExecutor
 };

package/dist/tier-routing.js

@@ -3,6 +3,7 @@ import {
   decideTierTransition
 } from "./chunk-S75M5ZRK.js";
 import "./chunk-TBBDFYXW.js";
+import "./chunk-PZ5AY32C.js";
 export {
   computeTierValueScore,
   decideTierTransition