@remnic/core 1.1.30 → 9.3.515

package/dist/chunk-TERNBNJB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utility-telemetry.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport {\n  assertIsoRecordedAt,\n  assertSafePathSegment,\n  assertString,\n  isRecord,\n  optionalStringArray,\n  recordStoreDay,\n  validateStringRecord,\n} from \"./store-contract.js\";\n\nexport type UtilityTelemetrySource = \"cli\" | \"system\" | \"benchmark\" | \"tool_result\";\nexport type UtilityTelemetryTarget = \"promotion\" | \"ranking\";\nexport type UtilityTelemetryDecision = \"promote\" | \"demote\" | \"hold\" | \"boost\" | \"suppress\";\nexport type UtilityTelemetryOutcome = \"helpful\" | \"neutral\" | \"harmful\";\n\nexport interface UtilityTelemetryEvent {\n  schemaVersion: 1;\n  eventId: string;\n  recordedAt: string;\n  sessionKey: string;\n  source: UtilityTelemetrySource;\n  target: UtilityTelemetryTarget;\n  decision: UtilityTelemetryDecision;\n  outcome: UtilityTelemetryOutcome;\n  utilityScore: number;\n  summary: string;\n  memoryIds?: string[];\n  entityRefs?: string[];\n  tags?: string[];\n  metadata?: Record<string, string>;\n}\n\nexport interface UtilityTelemetryStatus {\n  enabled: boolean;\n  promotionByOutcomeEnabled: boolean;\n  rootDir: string;\n  eventsDir: string;\n  events: {\n    total: number;\n    valid: number;\n    invalid: number;\n    byTarget: Partial<Record<UtilityTelemetryTarget, number>>;\n    byDecision: Partial<Record<UtilityTelemetryDecision, number>>;\n    byOutcome: Partial<Record<UtilityTelemetryOutcome, number>>;\n    latestEventId?: string;\n    latestRecordedAt?: string;\n    latestSessionKey?: string;\n  };\n  latestEvent?: UtilityTelemetryEvent;\n  invalidEvents: Array<{\n    path: string;\n    error: string;\n  }>;\n}\n\nexport function resolveUtilityTelemetryDir(memoryDir: string, overrideDir?: string): string {\n  if (typeof overrideDir === \"string\" && overrideDir.trim().length > 0) {\n    return overrideDir.trim();\n  }\n  return path.join(memoryDir, \"state\", \"utility-telemetry\");\n}\n\nfunction assertUtilityScore(value: unknown): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) {\n    throw new Error(\"utilityScore must be a finite number\");\n  }\n  if (value < -1 || value > 1) {\n    throw new Error(\"utilityScore must be between -1 and 1\");\n  }\n  return value;\n}\n\nexport function validateUtilityTelemetryEvent(raw: unknown): UtilityTelemetryEvent {\n  if (!isRecord(raw)) throw new Error(\"utility telemetry event must be an object\");\n  if (raw.schemaVersion !== 1) throw new Error(\"schemaVersion must be 1\");\n\n  const source = assertString(raw.source, \"source\");\n  if (![\"cli\", \"system\", \"benchmark\", \"tool_result\"].includes(source)) {\n    throw new Error(\"source must be one of cli|system|benchmark|tool_result\");\n  }\n\n  const target = assertString(raw.target, \"target\");\n  if (![\"promotion\", \"ranking\"].includes(target)) {\n    throw new Error(\"target must be one of promotion|ranking\");\n  }\n\n  const decision = assertString(raw.decision, \"decision\");\n  if (![\"promote\", \"demote\", \"hold\", \"boost\", \"suppress\"].includes(decision)) {\n    throw new Error(\"decision must be one of promote|demote|hold|boost|suppress\");\n  }\n\n  const outcome = assertString(raw.outcome, \"outcome\");\n  if (![\"helpful\", \"neutral\", \"harmful\"].includes(outcome)) {\n    throw new Error(\"outcome must be one of helpful|neutral|harmful\");\n  }\n\n  return {\n    schemaVersion: 1,\n    eventId: assertSafePathSegment(assertString(raw.eventId, \"eventId\"), \"eventId\"),\n    recordedAt: assertIsoRecordedAt(assertString(raw.recordedAt, \"recordedAt\")),\n    sessionKey: assertString(raw.sessionKey, \"sessionKey\"),\n    source: source as UtilityTelemetrySource,\n    target: target as UtilityTelemetryTarget,\n    decision: decision as UtilityTelemetryDecision,\n    outcome: outcome as UtilityTelemetryOutcome,\n    utilityScore: assertUtilityScore(raw.utilityScore),\n    summary: assertString(raw.summary, \"summary\"),\n    memoryIds: optionalStringArray(raw.memoryIds, \"memoryIds\"),\n    entityRefs: optionalStringArray(raw.entityRefs, \"entityRefs\"),\n    tags: optionalStringArray(raw.tags, \"tags\"),\n    metadata: validateStringRecord(raw.metadata, \"metadata\"),\n  };\n}\n\nexport async function recordUtilityTelemetryEvent(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n  event: UtilityTelemetryEvent;\n}): Promise<string> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const validated = validateUtilityTelemetryEvent(options.event);\n  const day = recordStoreDay(validated.recordedAt);\n  const eventsDir = path.join(rootDir, \"events\", day);\n  const filePath = path.join(eventsDir, `${validated.eventId}.json`);\n  await mkdir(eventsDir, { recursive: true });\n  await writeFile(filePath, JSON.stringify(validated, null, 2), { encoding: \"utf8\", flag: \"wx\" });\n  return filePath;\n}\n\nexport async function readUtilityTelemetryEvents(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n}): Promise<{\n  files: string[];\n  events: UtilityTelemetryEvent[];\n  invalidEvents: Array<{ path: string; error: string }>;\n}> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const files = await listJsonFiles(path.join(rootDir, \"events\"));\n  const events: UtilityTelemetryEvent[] = [];\n  const invalidEvents: Array<{ path: string; error: string }> = [];\n  for (const filePath of files) {\n    try {\n      events.push(validateUtilityTelemetryEvent(await readJsonFile(filePath)));\n    } catch (error) {\n      invalidEvents.push({\n        path: filePath,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { files, events, invalidEvents };\n}\n\nexport async function getUtilityTelemetryStatus(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n  enabled: boolean;\n  promotionByOutcomeEnabled?: boolean;\n}): Promise<UtilityTelemetryStatus> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const eventsDir = path.join(rootDir, \"events\");\n  if (!options.enabled) {\n    return {\n      enabled: false,\n      promotionByOutcomeEnabled: options.promotionByOutcomeEnabled === true,\n      rootDir,\n      eventsDir,\n      events: {\n        total: 0,\n        valid: 0,\n        invalid: 0,\n        byTarget: {},\n        byDecision: {},\n        byOutcome: {},\n      },\n      invalidEvents: [],\n    };\n  }\n\n  const { files, events, invalidEvents } = await readUtilityTelemetryEvents(options);\n  events.sort((a, b) => b.recordedAt.localeCompare(a.recordedAt));\n\n  const byTarget: Partial<Record<UtilityTelemetryTarget, number>> = {};\n  const byDecision: Partial<Record<UtilityTelemetryDecision, number>> = {};\n  const byOutcome: Partial<Record<UtilityTelemetryOutcome, number>> = {};\n  for (const event of events) {\n    byTarget[event.target] = (byTarget[event.target] ?? 0) + 1;\n    byDecision[event.decision] = (byDecision[event.decision] ?? 0) + 1;\n    byOutcome[event.outcome] = (byOutcome[event.outcome] ?? 0) + 1;\n  }\n\n  return {\n    enabled: true,\n    promotionByOutcomeEnabled: options.promotionByOutcomeEnabled === true,\n    rootDir,\n    eventsDir,\n    events: {\n      total: files.length,\n      valid: events.length,\n      invalid: invalidEvents.length,\n      byTarget,\n      byDecision,\n      byOutcome,\n      latestEventId: events[0]?.eventId,\n      latestRecordedAt: events[0]?.recordedAt,\n      latestSessionKey: events[0]?.sessionKey,\n    },\n    latestEvent: events[0],\n    invalidEvents,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,iBAAiB;AAyD1B,SAAS,2BAA2B,WAAmB,aAA8B;AAC1F,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,SAAO,KAAK,KAAK,WAAW,SAAS,mBAAmB;AAC1D;AAEA,SAAS,mBAAmB,OAAwB;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC3B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,KAAqC;AACjF,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC/E,MAAI,IAAI,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAEtE,QAAM,SAAS,aAAa,IAAI,QAAQ,QAAQ;AAChD,MAAI,CAAC,CAAC,OAAO,UAAU,aAAa,aAAa,EAAE,SAAS,MAAM,GAAG;AACnE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,SAAS,aAAa,IAAI,QAAQ,QAAQ;AAChD,MAAI,CAAC,CAAC,aAAa,SAAS,EAAE,SAAS,MAAM,GAAG;AAC9C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,WAAW,aAAa,IAAI,UAAU,UAAU;AACtD,MAAI,CAAC,CAAC,WAAW,UAAU,QAAQ,SAAS,UAAU,EAAE,SAAS,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,UAAU,aAAa,IAAI,SAAS,SAAS;AACnD,MAAI,CAAC,CAAC,WAAW,WAAW,SAAS,EAAE,SAAS,OAAO,GAAG;AACxD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,SAAS,sBAAsB,aAAa,IAAI,SAAS,SAAS,GAAG,SAAS;AAAA,IAC9E,YAAY,oBAAoB,aAAa,IAAI,YAAY,YAAY,CAAC;AAAA,IAC1E,YAAY,aAAa,IAAI,YAAY,YAAY;AAAA,IACrD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,mBAAmB,IAAI,YAAY;AAAA,IACjD,SAAS,aAAa,IAAI,SAAS,SAAS;AAAA,IAC5C,WAAW,oBAAoB,IAAI,WAAW,WAAW;AAAA,IACzD,YAAY,oBAAoB,IAAI,YAAY,YAAY;AAAA,IAC5D,MAAM,oBAAoB,IAAI,MAAM,MAAM;AAAA,IAC1C,UAAU,qBAAqB,IAAI,UAAU,UAAU;AAAA,EACzD;AACF;AAEA,eAAsB,4BAA4B,SAI9B;AAClB,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,YAAY,8BAA8B,QAAQ,KAAK;AAC7D,QAAM,MAAM,eAAe,UAAU,UAAU;AAC/C,QAAM,YAAY,KAAK,KAAK,SAAS,UAAU,GAAG;AAClD,QAAM,WAAW,KAAK,KAAK,WAAW,GAAG,UAAU,OAAO,OAAO;AACjE,QAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAC1C,QAAM,UAAU,UAAU,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC;AAC9F,SAAO;AACT;AAEA,eAAsB,2BAA2B,SAO9C;AACD,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,QAAQ,MAAM,cAAc,KAAK,KAAK,SAAS,QAAQ,CAAC;AAC9D,QAAM,SAAkC,CAAC;AACzC,QAAM,gBAAwD,CAAC;AAC/D,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,aAAO,KAAK,8BAA8B,MAAM,aAAa,QAAQ,CAAC,CAAC;AAAA,IACzE,SAAS,OAAO;AACd,oBAAc,KAAK;AAAA,QACjB,MAAM;AAAA,QACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,OAAO,QAAQ,cAAc;AACxC;AAEA,eAAsB,0BAA0B,SAKZ;AAClC,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,YAAY,KAAK,KAAK,SAAS,QAAQ;AAC7C,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,2BAA2B,QAAQ,8BAA8B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO;AAAA,QACP,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU,CAAC;AAAA,QACX,YAAY,CAAC;AAAA,QACb,WAAW,CAAC;AAAA,MACd;AAAA,MACA,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,QAAQ,cAAc,IAAI,MAAM,2BAA2B,OAAO;AACjF,SAAO,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AAE9D,QAAM,WAA4D,CAAC;AACnE,QAAM,aAAgE,CAAC;AACvE,QAAM,YAA8D,CAAC;AACrE,aAAW,SAAS,QAAQ;AAC1B,aAAS,MAAM,MAAM,KAAK,SAAS,MAAM,MAAM,KAAK,KAAK;AACzD,eAAW,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ,KAAK,KAAK;AACjE,cAAU,MAAM,OAAO,KAAK,UAAU,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,2BAA2B,QAAQ,8BAA8B;AAAA,IACjE;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,MACN,OAAO,MAAM;AAAA,MACb,OAAO,OAAO;AAAA,MACd,SAAS,cAAc;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,OAAO,CAAC,GAAG;AAAA,MAC1B,kBAAkB,OAAO,CAAC,GAAG;AAAA,MAC7B,kBAAkB,OAAO,CAAC,GAAG;AAAA,IAC/B;AAAA,IACA,aAAa,OAAO,CAAC;AAAA,IACrB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-MXC3AP5I.js → chunk-TGQ2NTWH.js}

@@ -1,5 +1,5 @@
 // src/resolve-auth-token.ts
-var resolvedCache = /* @__PURE__ */ new Map();
+var resolvedCache = /* @__PURE__ */ new WeakMap();
 function cacheKeyForSecretRef(ref) {
   const sortedKeys = Object.keys(ref).sort();
   const stable = {};
@@ -28,15 +28,20 @@ async function resolveAgentAccessAuthToken(value, options = {}) {
       "unsupported SecretRef shape for agentAccessHttp.authToken \u2014 missing required `source` field (see https://github.com/joshuaswarren/remnic/issues/757)"
     );
   }
-  const cacheKey = cacheKeyForSecretRef(ref);
-  const cached = resolvedCache.get(cacheKey);
-  if (cached !== void 0) return cached;
   const resolver = options.resolveSecretRef ?? null;
   if (!resolver) {
     throw new Error(
       `cannot resolve agentAccessHttp.authToken SecretRef (source="${ref.source}") \u2014 a SecretRef resolver was not provided. Use a literal string or \${ENV_VAR} expansion in standalone Remnic, or have the host adapter resolve SecretRef objects through its native secret resolver (see https://github.com/joshuaswarren/remnic/issues/757).`
     );
   }
+  const cacheKey = cacheKeyForSecretRef(ref);
+  let resolverCache = resolvedCache.get(resolver);
+  if (!resolverCache) {
+    resolverCache = /* @__PURE__ */ new Map();
+    resolvedCache.set(resolver, resolverCache);
+  }
+  const cached = resolverCache.get(cacheKey);
+  if (cached !== void 0) return cached;
   let resolved;
   try {
     const out = await resolver(ref);
@@ -54,7 +59,7 @@ async function resolveAgentAccessAuthToken(value, options = {}) {
       `agentAccessHttp.authToken SecretRef resolved to empty value (source="${ref.source}", provider="${ref.provider ?? ""}") \u2014 refusing to start the HTTP bridge with an empty bearer token.`
     );
   }
-  resolvedCache.set(cacheKey, resolved);
+  resolverCache.set(cacheKey, resolved);
   return resolved;
 }
 function isAgentAccessSecretRef(value) {
@@ -63,7 +68,7 @@ function isAgentAccessSecretRef(value) {
   return typeof ref.source === "string" && ref.source.trim().length > 0;
 }
 function clearAuthTokenSecretCache() {
-  resolvedCache.clear();
+  resolvedCache = /* @__PURE__ */ new WeakMap();
 }
 
 export {
@@ -71,4 +76,4 @@ export {
   isAgentAccessSecretRef,
   clearAuthTokenSecretCache
 };
-//# sourceMappingURL=chunk-MXC3AP5I.js.map
+//# sourceMappingURL=chunk-TGQ2NTWH.js.map

package/dist/chunk-TGQ2NTWH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve-auth-token.ts"],"sourcesContent":["import type { AgentAccessAuthToken, SecretRef } from \"./types.js\";\n\n/**\n * Resolve `agentAccessHttp.authToken` (issue #757).\n *\n * Two shapes are accepted:\n *\n *   1. Plain string — returned unchanged. This is the only shape supported\n *      in standalone Remnic; it preserves backward compatibility with every\n *      pre-#757 config.\n *\n *   2. SecretRef-like object (`{source, provider?, id?, command?, ...}`) —\n *      resolved only through a resolver supplied by the host adapter. Core\n *      stays host-agnostic and never scans OpenClaw, Hermes, or any other\n *      runtime directly.\n *\n * Resolution flow for SecretRef objects:\n *\n *   - Plain strings short-circuit before any host work.\n *   - Host adapters pass their native SecretRef resolver in `options`.\n *   - If no resolver is provided, throw a clear, actionable error rather\n *     than silently leaving the bridge open or starting with no auth.\n *\n * Lessons baked in from PRs #316–#319:\n *\n *   - Successful resolutions are cached for the process lifetime; failures\n *     are not cached so transient issues (Keychain unlocked late, agent\n *     restarts) recover automatically.\n */\n\nexport type ResolveSecretRefFn = (\n  ref: SecretRef,\n  context?: unknown,\n) => Promise<string | undefined> | string | undefined;\n\ntype ResolveAgentAccessAuthTokenOptions = {\n  resolveSecretRef?: ResolveSecretRefFn | null;\n};\n\nlet resolvedCache = new WeakMap<ResolveSecretRefFn, Map<string, string>>();\n\n/**\n * SecretRef objects are stable per (source, provider, id, command) tuple.\n * Sort keys before serializing so semantically-identical refs hit the same\n * cache slot regardless of authoring order (Lesson 38 in CLAUDE.md).\n */\nfunction cacheKeyForSecretRef(ref: SecretRef): string {\n  const sortedKeys = Object.keys(ref).sort();\n  const stable: Record<string, unknown> = {};\n  for (const key of sortedKeys) {\n    stable[key] = ref[key];\n  }\n  return JSON.stringify(stable);\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Resolve an `agentAccessHttp.authToken` value to a literal bearer string.\n *\n * @returns the resolved string, or `undefined` if input was undefined/empty.\n * @throws if the input is a SecretRef and no resolver is provided, if the\n *         resolver returns no value, or if the input shape is malformed.\n */\nexport async function resolveAgentAccessAuthToken(\n  value: AgentAccessAuthToken | undefined,\n  options: ResolveAgentAccessAuthTokenOptions = {},\n): Promise<string | undefined> {\n  if (value === undefined || value === null) return undefined;\n\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (!isPlainObject(value)) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"expected a string or an object with a `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const ref = value as SecretRef;\n  if (typeof ref.source !== \"string\" || ref.source.trim().length === 0) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"missing required `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const resolver = options.resolveSecretRef ?? null;\n  if (!resolver) {\n    throw new Error(\n      `cannot resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\") — ` +\n        \"a SecretRef resolver was not provided. Use a literal string or \" +\n        \"${ENV_VAR} expansion in standalone Remnic, or have the host adapter \" +\n        \"resolve SecretRef objects through its native secret resolver \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757).\",\n    );\n  }\n\n  const cacheKey = cacheKeyForSecretRef(ref);\n  let resolverCache = resolvedCache.get(resolver);\n  if (!resolverCache) {\n    resolverCache = new Map<string, string>();\n    resolvedCache.set(resolver, resolverCache);\n  }\n  const cached = resolverCache.get(cacheKey);\n  if (cached !== undefined) return cached;\n\n  let resolved: string | undefined;\n  try {\n    const out = await resolver(ref);\n    if (typeof out === \"string\") {\n      const trimmed = out.trim();\n      if (trimmed.length > 0) resolved = trimmed;\n    }\n  } catch (err) {\n    throw new Error(\n      `failed to resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\"): ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    );\n  }\n\n  if (!resolved) {\n    throw new Error(\n      `agentAccessHttp.authToken SecretRef resolved to empty value (source=\"${ref.source}\", provider=\"${\n        ref.provider ?? \"\"\n      }\") — refusing to start the HTTP bridge with an empty bearer token.`,\n    );\n  }\n\n  resolverCache.set(cacheKey, resolved);\n  return resolved;\n}\n\n/**\n * Returns true if the value is a SecretRef object (issue #757). Useful for\n * surfaces (CLI flags, doctor checks) that want to render a redacted\n * placeholder instead of leaking the unresolved object shape.\n */\nexport function isAgentAccessSecretRef(value: unknown): value is SecretRef {\n  if (!isPlainObject(value)) return false;\n  const ref = value as Record<string, unknown>;\n  return typeof ref.source === \"string\" && ref.source.trim().length > 0;\n}\n\n/** Test/operations hook: drop the cache and force resolver rediscovery. */\nexport function clearAuthTokenSecretCache(): void {\n  resolvedCache = new WeakMap<ResolveSecretRefFn, Map<string, string>>();\n}\n"],"mappings":";AAuCA,IAAI,gBAAgB,oBAAI,QAAiD;AAOzE,SAAS,qBAAqB,KAAwB;AACpD,QAAM,aAAa,OAAO,KAAK,GAAG,EAAE,KAAK;AACzC,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,YAAY;AAC5B,WAAO,GAAG,IAAI,IAAI,GAAG;AAAA,EACvB;AACA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AASA,eAAsB,4BACpB,OACA,UAA8C,CAAC,GAClB;AAC7B,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAElD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,oBAAoB;AAC7C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,+DAA+D,IAAI,MAAM;AAAA,IAK3E;AAAA,EACF;AAEA,QAAM,WAAW,qBAAqB,GAAG;AACzC,MAAI,gBAAgB,cAAc,IAAI,QAAQ;AAC9C,MAAI,CAAC,eAAe;AAClB,oBAAgB,oBAAI,IAAoB;AACxC,kBAAc,IAAI,UAAU,aAAa;AAAA,EAC3C;AACA,QAAM,SAAS,cAAc,IAAI,QAAQ;AACzC,MAAI,WAAW,OAAW,QAAO;AAEjC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,GAAG;AAC9B,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,QAAQ,SAAS,EAAG,YAAW;AAAA,IACrC;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kEAAkE,IAAI,MAAM,OAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,wEAAwE,IAAI,MAAM,gBAChF,IAAI,YAAY,EAClB;AAAA,IACF;AAAA,EACF;AAEA,gBAAc,IAAI,UAAU,QAAQ;AACpC,SAAO;AACT;AAOO,SAAS,uBAAuB,OAAoC;AACzE,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,QAAM,MAAM;AACZ,SAAO,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,SAAS;AACtE;AAGO,SAAS,4BAAkC;AAChD,kBAAgB,oBAAI,QAAiD;AACvE;","names":[]}

package/dist/{chunk-3Y4P7RXM.js → chunk-TMSXWOBZ.js}

@@ -1,6 +1,6 @@
 import {
   headerValue
-} from "./chunk-FAJ7FZYM.js";
+} from "./chunk-7RXCMVFQ.js";
 
 // src/adapters/replit.ts
 var ReplitAdapter = class {
@@ -14,11 +14,10 @@ var ReplitAdapter = class {
   }
   resolveIdentity(context) {
     const mcpSessionId = headerValue(context.headers, "mcp-session-id");
-    const principal = headerValue(context.headers, "x-engram-principal") || "replit-agent";
     const namespace = headerValue(context.headers, "x-engram-namespace") || "replit";
     return {
       namespace,
-      principal,
+      principal: "replit-agent",
       sessionKey: mcpSessionId ?? context.sessionKey,
       adapterId: this.id
     };
@@ -28,4 +27,4 @@ var ReplitAdapter = class {
 export {
   ReplitAdapter
 };
-//# sourceMappingURL=chunk-3Y4P7RXM.js.map
+//# sourceMappingURL=chunk-TMSXWOBZ.js.map

package/dist/chunk-TMSXWOBZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/replit.ts"],"sourcesContent":["import { headerValue, type AdapterContext, type EngramAdapter, type ResolvedIdentity } from \"./types.js\";\n\n/**\n * Replit Agent adapter.\n *\n * Detection: Replit Agent supports MCP natively (HTTP-only, configured\n * via the Integrations pane). It does NOT send identifying headers\n * automatically — detection relies on user-configured custom headers\n * in Replit's MCP Integrations UI.\n *\n * Replit provides env vars to running code (REPL_ID, REPL_OWNER,\n * REPL_SLUG) but these are NOT sent as HTTP headers to MCP servers.\n *\n * To identify Replit connections, users should configure a custom header\n * in the Replit Integrations pane when adding the Engram MCP server:\n *   Header Name: X-Engram-Client-Id\n *   Header Value: replit\n *\n * Optionally also set X-Engram-Namespace for project scoping. Principal\n * overrides are intentionally handled only by the HTTP server's\n * trustPrincipalHeader gate. Adapters must not independently trust\n * X-Engram-Principal.\n */\nexport class ReplitAdapter implements EngramAdapter {\n  readonly id = \"replit\";\n\n  matches(context: AdapterContext): boolean {\n    // Primary: user-configured client identifier header\n    const clientId = headerValue(context.headers, \"x-engram-client-id\");\n    if (clientId?.toLowerCase() === \"replit\") return true;\n\n    // MCP clientInfo (Replit's MCP client name is not publicly documented,\n    // but check for it in case it becomes available)\n    const clientName = context.clientInfo?.name?.toLowerCase() ?? \"\";\n    if (clientName.includes(\"replit\")) return true;\n\n    return false;\n  }\n\n  resolveIdentity(context: AdapterContext): ResolvedIdentity {\n    const mcpSessionId = headerValue(context.headers, \"mcp-session-id\");\n\n    const namespace = headerValue(context.headers, \"x-engram-namespace\")\n      || \"replit\";\n\n    return {\n      namespace,\n      principal: \"replit-agent\",\n      sessionKey: mcpSessionId ?? context.sessionKey,\n      adapterId: this.id,\n    };\n  }\n}\n"],"mappings":";;;;;AAuBO,IAAM,gBAAN,MAA6C;AAAA,EACzC,KAAK;AAAA,EAEd,QAAQ,SAAkC;AAExC,UAAM,WAAW,YAAY,QAAQ,SAAS,oBAAoB;AAClE,QAAI,UAAU,YAAY,MAAM,SAAU,QAAO;AAIjD,UAAM,aAAa,QAAQ,YAAY,MAAM,YAAY,KAAK;AAC9D,QAAI,WAAW,SAAS,QAAQ,EAAG,QAAO;AAE1C,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,SAA2C;AACzD,UAAM,eAAe,YAAY,QAAQ,SAAS,gBAAgB;AAElE,UAAM,YAAY,YAAY,QAAQ,SAAS,oBAAoB,KAC9D;AAEL,WAAO;AAAA,MACL;AAAA,MACA,WAAW;AAAA,MACX,YAAY,gBAAgB,QAAQ;AAAA,MACpC,WAAW,KAAK;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-3TNBOMQT.js → chunk-TVRN5QKH.js}

@@ -9,10 +9,10 @@ import {
 import {
   getCachedQmdSearch,
   setCachedQmdSearch
-} from "./chunk-PFV5C235.js";
+} from "./chunk-CPPS65WS.js";
 import {
   mergeEnv
-} from "./chunk-XIG5PDM7.js";
+} from "./chunk-JUC24CTX.js";
 import {
   log
 } from "./chunk-2ODBA7MQ.js";
@@ -1351,9 +1351,10 @@ var QmdClient = class _QmdClient {
     return args;
   }
   async search(query, collection, maxResults, options, execution) {
-    if (!this.isAvailable()) return [];
     const trimmed = query.trim();
     if (!trimmed) return [];
+    await this.maybeProbeDaemon();
+    if (!this.isAvailable()) return [];
     const col = collection ?? this.collection;
     const n = maxResults ?? this.maxResults;
     const searchOptions = this.resolveSearchOptions(options);
@@ -1364,7 +1365,6 @@ var QmdClient = class _QmdClient {
       log.debug(`QMD search cache hit (${cached.length} results)`);
       return cached;
     }
-    await this.maybeProbeDaemon();
     if (this.daemonAvailable) {
       let results;
       try {
@@ -1394,12 +1394,12 @@ var QmdClient = class _QmdClient {
     return subprocessResults;
   }
   async searchGlobal(query, maxResults, execution) {
-    if (!this.isAvailable()) return [];
     const trimmed = query.trim();
     if (!trimmed) return [];
+    await this.maybeProbeDaemon();
+    if (!this.isAvailable()) return [];
     const n = maxResults ?? 6;
     const searchOptions = this.resolveSearchOptions();
-    await this.maybeProbeDaemon();
     if (this.daemonAvailable) {
       let results;
       try {
@@ -1429,12 +1429,12 @@ var QmdClient = class _QmdClient {
    * BM25 keyword search (fast, ~0.3s). Uses `qmd search`.
    */
   async bm25Search(query, collection, maxResults, execution) {
-    if (!this.isAvailable()) return [];
     const trimmed = query.trim();
     if (!trimmed) return [];
+    await this.maybeProbeDaemon();
+    if (!this.isAvailable()) return [];
     const col = collection ?? this.collection;
     const n = maxResults ?? this.maxResults;
-    await this.maybeProbeDaemon();
     if (this.daemonAvailable && this.daemonSession) {
       let results;
       try {
@@ -1464,12 +1464,12 @@ var QmdClient = class _QmdClient {
    * Vector similarity search (~3-4s). Uses `qmd vsearch`.
    */
   async vectorSearch(query, collection, maxResults, execution) {
-    if (!this.isAvailable()) return [];
     const trimmed = query.trim();
     if (!trimmed) return [];
+    await this.maybeProbeDaemon();
+    if (!this.isAvailable()) return [];
     const col = collection ?? this.collection;
     const n = maxResults ?? this.maxResults;
-    await this.maybeProbeDaemon();
     if (this.daemonAvailable && this.daemonSession) {
       let results;
       try {
@@ -1982,4 +1982,4 @@ export {
   getQmdCommandName,
   QmdClient
 };
-//# sourceMappingURL=chunk-3TNBOMQT.js.map
+//# sourceMappingURL=chunk-TVRN5QKH.js.map