@remnic/core 1.1.31 → 9.3.515

package/dist/{chunk-TPU5L5EY.js → chunk-D6WE5MTW.js}

@@ -1,81 +1,87 @@
+import {
+  openclawReplayNormalizer
+} from "./chunk-7F7Z6MOS.js";
 import {
   chatgptReplayNormalizer
-} from "./chunk-ICRIXAP2.js";
+} from "./chunk-MC4FJXPA.js";
 import {
   claudeReplayNormalizer
-} from "./chunk-EHRTFRWW.js";
+} from "./chunk-LQHDIS7L.js";
 import {
-  openclawReplayNormalizer
-} from "./chunk-S7KDBTWT.js";
+  exportJsonBundle
+} from "./chunk-UP6MOYCB.js";
+import {
+  exportSqlite
+} from "./chunk-XSWKORGM.js";
 import {
   importMarkdownBundle
-} from "./chunk-TK4UEOSK.js";
+} from "./chunk-HDDRVXX4.js";
 import {
   importSqlite
-} from "./chunk-XKLD5OK4.js";
+} from "./chunk-4RR6ROTB.js";
 import {
   detectImportFormat
-} from "./chunk-DOM4GKSW.js";
+} from "./chunk-OZKVVUJB.js";
 import {
   importJsonBundle
-} from "./chunk-W4L6CZKA.js";
+} from "./chunk-2DL3OFLD.js";
 import {
   backupMemoryDir
-} from "./chunk-7OZ53EXP.js";
-import {
-  exportJsonBundle
-} from "./chunk-GIF42EW3.js";
+} from "./chunk-2NLLXCJG.js";
 import {
   exportMarkdownBundle
-} from "./chunk-6H2TESSP.js";
-import {
-  exportSqlite
-} from "./chunk-66DHUKLO.js";
+} from "./chunk-765K3SAT.js";
 import {
   TailscaleHelper
 } from "./chunk-TKWGAOLV.js";
 import {
   WebDavServer
-} from "./chunk-FIT6DMX6.js";
+} from "./chunk-UWY7GIVS.js";
 import {
   buildReplayNormalizerRegistry,
   clampBatchSize,
   runReplay
-} from "./chunk-TPMQ3G6Z.js";
+} from "./chunk-HOJZMQ4J.js";
+import {
+  migrateObservations
+} from "./chunk-2NM43EWN.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-BVF3AGJP.js";
+} from "./chunk-LJBOVCQG.js";
 import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-2IWUMAES.js";
+} from "./chunk-E62SBGQ3.js";
 import {
   rebuildObservations
-} from "./chunk-PZIAX57I.js";
+} from "./chunk-XR6DNK4U.js";
 import {
   archiveObservations
-} from "./chunk-65PG43EQ.js";
+} from "./chunk-S7WU3Y3D.js";
 import {
-  migrateObservations
-} from "./chunk-PK7H5L6Y.js";
+  getBulkImportSource,
+  listBulkImportSources,
+  registerBulkImportSource,
+  runBulkImportPipeline
+} from "./chunk-H2NCNXMS.js";
 import {
   runCompatChecks
-} from "./chunk-TMM4S4IJ.js";
+} from "./chunk-YR6GIWWY.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-MRILGULB.js";
-import {
-  resolveAgentAccessAuthToken
-} from "./chunk-MXC3AP5I.js";
+} from "./chunk-V2RCP53Q.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-ZK7I7JYV.js";
+} from "./chunk-R3PS27B4.js";
+import {
+  resolveAgentAccessAuthToken
+} from "./chunk-TGQ2NTWH.js";
 import {
   parseXrayCliOptions
-} from "./chunk-MT4HVDUZ.js";
+} from "./chunk-PM3QHTFT.js";
 import {
   collectPatternMemories,
   explainPatternMemory,
@@ -92,70 +98,76 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-W6AQJ2PY.js";
+} from "./chunk-L7S47WZT.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-77H5NU3M.js";
+} from "./chunk-EDBEWFJO.js";
 import {
   GraphDashboardServer
-} from "./chunk-ZPKBYX2F.js";
+} from "./chunk-YNDLCWXS.js";
+import {
+  RoutingRulesStore
+} from "./chunk-HPWVAEET.js";
 import {
   isReplaySource,
   normalizeReplaySessionKey
 } from "./chunk-2PRQG7PV.js";
-import {
-  RoutingRulesStore
-} from "./chunk-LUDTDZLK.js";
 import {
   searchVerifiedEpisodes
-} from "./chunk-JA3AK3PT.js";
+} from "./chunk-XNLXAWHX.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
-} from "./chunk-PYXS46O7.js";
+} from "./chunk-3BP57I6J.js";
 import {
   getUtilityTelemetryStatus,
   recordUtilityTelemetryEvent
-} from "./chunk-3QKK7QOS.js";
+} from "./chunk-TERNBNJB.js";
 import {
   ThreadingManager
 } from "./chunk-W4RVMTHR.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-SAZS2QZB.js";
+} from "./chunk-23UORJ4S.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
   searchWorkProductLedgerEntries
-} from "./chunk-CULXMQJH.js";
+} from "./chunk-XPXEJRUB.js";
 import {
   readRuntimePolicySnapshot,
   sanitizeRuntimePolicyValues
-} from "./chunk-EABGC2TL.js";
+} from "./chunk-A2Z6UCWT.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
   planSessionRepair
-} from "./chunk-YRMVARQP.js";
+} from "./chunk-KFY3SGN7.js";
 import {
+  GITHUB_CONNECTOR_ID,
+  GMAIL_CONNECTOR_ID,
   GOOGLE_DRIVE_CONNECTOR_ID,
   NOTION_CONNECTOR_ID,
+  createGitHubConnector,
+  createGmailConnector,
   createGoogleDriveConnector,
   createNotionConnector,
+  validateGitHubConfig,
+  validateGmailConfig,
   validateGoogleDriveConfig,
   validateNotionConfig
-} from "./chunk-HXXBL2KD.js";
+} from "./chunk-BECQDWBA.js";
 import {
   listConnectorStates
-} from "./chunk-LPMVBPA3.js";
+} from "./chunk-CWWMTTQE.js";
 import {
   rescoreMemoryImportance
 } from "./chunk-JXS5PDQ7.js";
 import {
   searchHarmonicRetrieval
-} from "./chunk-HMDCOMYU.js";
+} from "./chunk-SKGV326D.js";
 import {
   createEvalBaselineSnapshot,
   getEvalHarnessStatus,
@@ -164,24 +176,25 @@ import {
   runEvalBenchmarkCiGate,
   runEvalStoredBaselineCiGate,
   validateEvalBenchmarkPack
-} from "./chunk-D46YSIYX.js";
+} from "./chunk-G3Z3QEF5.js";
 import {
   getCueAnchorStoreStatus
-} from "./chunk-C6QPK5GG.js";
+} from "./chunk-FZZ2QTJI.js";
 import {
   applyCommitmentLedgerLifecycle,
   getCommitmentLedgerStatus,
   recordCommitmentLedgerEntry,
   transitionCommitmentLedgerEntryState
-} from "./chunk-2KI4QFHU.js";
+} from "./chunk-LMDRGRJ2.js";
 import {
+  buildConnectorRowsFromDefinitions,
   parseConnectorsListOptions,
   parseConnectorsRunName,
   parseConnectorsStatusOptions,
   renderConnectorsList,
   renderConnectorsRunResult,
   runConnectorPollOnce
-} from "./chunk-OZHRDTDX.js";
+} from "./chunk-OKTXM5H4.js";
 import {
   resolveNamespaceChildRoot
 } from "./chunk-3UXOZBHV.js";
@@ -190,64 +203,61 @@ import {
 } from "./chunk-4WMCPJWX.js";
 import {
   parseConfig
-} from "./chunk-MZH6EHNR.js";
+} from "./chunk-7H6CFEBJ.js";
 import {
   getAbstractionNodeStoreStatus
-} from "./chunk-NGAVDO7E.js";
+} from "./chunk-OADWQ5CR.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-YU5KIWYQ.js";
+} from "./chunk-FER4WARO.js";
 import {
   EngramMcpServer
-} from "./chunk-3ZLVGM76.js";
+} from "./chunk-JYIKKAK3.js";
 import {
   EngramAccessService
-} from "./chunk-ZAVUCJ4H.js";
+} from "./chunk-3Q4H3OBR.js";
 import {
   WorkStorage
-} from "./chunk-WELDCG6C.js";
+} from "./chunk-L227SKTB.js";
 import {
   parseRecallExplainFormat,
   renderRecallExplain,
   renderXray
-} from "./chunk-FBYESMQ2.js";
+} from "./chunk-3C5RPJAX.js";
 import {
   getTrustZoneStoreStatus,
   promoteTrustZoneRecord,
   seedTrustZoneDemoDataset
-} from "./chunk-QDZ2RLEC.js";
+} from "./chunk-472U7RDF.js";
 import {
   getObjectiveStateStoreStatus
-} from "./chunk-5UM2VJ6D.js";
+} from "./chunk-UEY3VB6W.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-76FLAAUC.js";
-import {
-  selectRouteRule,
-  validateRouteTarget
-} from "./chunk-U3PN77QT.js";
+} from "./chunk-2AN2L4NL.js";
 import {
   analyzeGraphHealth
-} from "./chunk-RK2Y4XOM.js";
+} from "./chunk-4JRRISLU.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-Q7P4WJDP.js";
-import {
-  expandTildePath
-} from "./chunk-QRNI5JBH.js";
+} from "./chunk-M5T4Q2ZU.js";
 import {
   getCausalTrajectoryStoreStatus
-} from "./chunk-MY6TPVXW.js";
+} from "./chunk-LMPHTYJC.js";
 import {
-  resolveHomeDir
-} from "./chunk-XIG5PDM7.js";
+  selectRouteRule,
+  validateRouteTarget
+} from "./chunk-U3PN77QT.js";
 import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
+  expandTildePath
+} from "./chunk-EYIEWJNI.js";
+import {
+  resolveHomeDir
+} from "./chunk-JUC24CTX.js";
 import {
   buildActionConfidenceInputFromOptions,
   evaluateActionConfidence,
@@ -256,197 +266,12 @@ import {
 
 // src/cli.ts
 import path2 from "path";
-import { access, readFile as readFile2, readdir as readdir2, unlink } from "fs/promises";
+import { access, readFile, readdir as readdir2, unlink } from "fs/promises";
 import { createHash } from "crypto";
 
-// src/bulk-import/types.ts
-var VALID_ROLES = /* @__PURE__ */ new Set(["user", "assistant", "other"]);
-function isImportRole(value) {
-  return typeof value === "string" && VALID_ROLES.has(value);
-}
-function parseIsoTimestamp(value) {
-  return parseIsoOffsetTimestamp(value);
-}
-function validateImportTurn(turn, index) {
-  const issues = [];
-  if (!turn || typeof turn !== "object") {
-    issues.push({
-      code: "turn.invalid",
-      message: "Import turn must be an object.",
-      index
-    });
-    return issues;
-  }
-  if (!isImportRole(turn.role)) {
-    issues.push({
-      code: "turn.role.invalid",
-      message: `Import turn role must be 'user', 'assistant', or 'other', received '${String(turn.role)}'.`,
-      index
-    });
-  }
-  if (!turn.content || typeof turn.content !== "string" || turn.content.trim().length === 0) {
-    issues.push({
-      code: "turn.content.invalid",
-      message: "Import turn content must be a non-empty string.",
-      index
-    });
-  }
-  if (!turn.timestamp || typeof turn.timestamp !== "string" || parseIsoTimestamp(turn.timestamp) === null) {
-    issues.push({
-      code: "turn.timestamp.invalid",
-      message: `Import turn timestamp must be a valid ISO timestamp, received '${String(turn.timestamp)}'.`,
-      index
-    });
-  }
-  return issues;
-}
-
-// src/bulk-import/registry.ts
-var adapters = /* @__PURE__ */ new Map();
-function registerBulkImportSource(adapter) {
-  if (!adapter || typeof adapter !== "object") {
-    throw new Error("bulk-import adapter must be an object");
-  }
-  if (!adapter.name || typeof adapter.name !== "string" || adapter.name.trim().length === 0) {
-    throw new Error("bulk-import adapter name must be a non-empty string");
-  }
-  if (typeof adapter.parse !== "function") {
-    throw new Error(
-      `bulk-import adapter '${adapter.name}' must have a parse function`
-    );
-  }
-  const key = adapter.name.trim();
-  if (adapters.has(key)) {
-    throw new Error(
-      `bulk-import source adapter '${key}' is already registered`
-    );
-  }
-  const normalized = adapter.name === key ? adapter : { ...adapter, name: key };
-  adapters.set(key, normalized);
-}
-function getBulkImportSource(name) {
-  if (typeof name !== "string") return void 0;
-  const key = name.trim();
-  if (key.length === 0) return void 0;
-  return adapters.get(key);
-}
-function listBulkImportSources() {
-  return [...adapters.keys()];
-}
-function clearBulkImportSources() {
-  adapters.clear();
-}
-
-// src/bulk-import/pipeline.ts
-var DEFAULT_BATCH_SIZE = 20;
-var MIN_BATCH_SIZE = 1;
-var MAX_BATCH_SIZE = 1e3;
-function validateBatchSize(value) {
-  if (value === void 0) return DEFAULT_BATCH_SIZE;
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new Error(
-      `batchSize must be a finite number, received ${String(value)}`
-    );
-  }
-  if (!Number.isInteger(value)) {
-    throw new Error(
-      `batchSize must be an integer, received ${value}`
-    );
-  }
-  if (value < MIN_BATCH_SIZE || value > MAX_BATCH_SIZE) {
-    throw new Error(
-      `batchSize must be between ${MIN_BATCH_SIZE} and ${MAX_BATCH_SIZE}, received ${value}`
-    );
-  }
-  return value;
-}
-function resolveBulkImportContext(options) {
-  if (options.dedup !== void 0 && typeof options.dedup !== "boolean") {
-    throw new Error(
-      `dedup must be a boolean when provided, received ${String(options.dedup)}`
-    );
-  }
-  if (options.trustLevel !== void 0 && options.trustLevel !== "import") {
-    throw new Error(
-      `trustLevel must be 'import' when provided, received ${String(options.trustLevel)}`
-    );
-  }
-  if (options.namespace !== void 0) {
-    if (typeof options.namespace !== "string" || options.namespace.trim().length === 0) {
-      throw new Error(
-        `namespace must be a non-empty string when provided, received ${String(options.namespace)}`
-      );
-    }
-  }
-  return {
-    dedup: options.dedup !== false,
-    trustLevel: options.trustLevel ?? "import",
-    ...options.namespace !== void 0 ? { namespace: options.namespace } : {}
-  };
-}
-function formatBatchTranscript(turns) {
-  return turns.map((t) => {
-    const prefix = t.participantName ?? t.participantId ?? t.role;
-    return `[${t.timestamp}] ${prefix}: ${t.content}`;
-  }).join("\n");
-}
-async function runBulkImportPipeline(source, options = {}, processBatch) {
-  const batchSize = validateBatchSize(options.batchSize);
-  const dryRun = options.dryRun === true;
-  const batchContext = resolveBulkImportContext(options);
-  const result = {
-    memoriesCreated: 0,
-    duplicatesSkipped: 0,
-    entitiesCreated: 0,
-    turnsProcessed: 0,
-    batchesProcessed: 0,
-    errors: []
-  };
-  const turns = source.turns;
-  if (!turns || turns.length === 0) {
-    return result;
-  }
-  const validTurns = [];
-  for (let i = 0; i < turns.length; i += 1) {
-    const issues = validateImportTurn(turns[i], i);
-    if (issues.length > 0) {
-      const error = {
-        batchIndex: -1,
-        message: issues.map((iss) => iss.message).join("; ")
-      };
-      result.errors.push(error);
-    } else {
-      validTurns.push(turns[i]);
-    }
-  }
-  if (dryRun) {
-    result.turnsProcessed = validTurns.length;
-    result.batchesProcessed = validTurns.length > 0 ? Math.ceil(validTurns.length / batchSize) : 0;
-    return result;
-  }
-  let batchIndex = 0;
-  for (let i = 0; i < validTurns.length; i += batchSize) {
-    const batch = validTurns.slice(i, i + batchSize);
-    try {
-      const batchResult = await processBatch(batch, batchContext);
-      result.memoriesCreated += batchResult.memoriesCreated;
-      result.duplicatesSkipped += batchResult.duplicatesSkipped;
-      if (typeof batchResult.entitiesCreated === "number") {
-        result.entitiesCreated += batchResult.entitiesCreated;
-      }
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      result.errors.push({ batchIndex, message });
-    }
-    result.turnsProcessed += batch.length;
-    result.batchesProcessed += 1;
-    batchIndex += 1;
-  }
-  return result;
-}
-
 // src/training-export/converter.ts
-import { lstat, readdir, readFile, realpath } from "fs/promises";
+import { constants } from "fs";
+import { lstat, open, readdir, realpath } from "fs/promises";
 import path from "path";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
@@ -486,6 +311,9 @@ async function safeRealpath(p) {
     return null;
   }
 }
+function isContainedPath(real, containmentRoot) {
+  return real === containmentRoot || real.startsWith(containmentRoot + path.sep);
+}
 async function collectMarkdownFiles(dir, containmentRoot) {
   const files = [];
   const walk = async (d) => {
@@ -518,7 +346,7 @@ async function collectMarkdownFiles(dir, containmentRoot) {
         if (st.nlink > 1) continue;
         const real = await safeRealpath(full);
         if (!real) continue;
-        if (real !== containmentRoot && !real.startsWith(containmentRoot + path.sep)) {
+        if (!isContainedPath(real, containmentRoot)) {
           continue;
         }
         files.push(full);
@@ -528,6 +356,21 @@ async function collectMarkdownFiles(dir, containmentRoot) {
   await walk(dir);
   return files.sort((a, b) => a.localeCompare(b));
 }
+async function readContainedMarkdownFile(filePath, containmentRoot) {
+  let handle = null;
+  try {
+    handle = await open(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const st = await handle.stat();
+    if (!st.isFile() || st.nlink > 1) return null;
+    const real = await safeRealpath(filePath);
+    if (!real || !isContainedPath(real, containmentRoot)) return null;
+    return await handle.readFile("utf-8");
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
 function buildInstruction(category, tags) {
   const tagSuffix = tags.length > 0 ? ` (${tags.join(", ")})` : "";
   switch (category) {
@@ -561,8 +404,11 @@ function buildInstruction(category, tags) {
 }
 function parseIsoDate(isoStr) {
   if (!isoStr) return null;
-  const d = new Date(isoStr);
-  return Number.isFinite(d.getTime()) ? d : null;
+  try {
+    return parseStrictCliDate(isoStr, "memory created timestamp");
+  } catch {
+    return null;
+  }
 }
 async function convertMemoriesToRecords(options) {
   const { memoryDir } = options;
@@ -581,12 +427,8 @@ async function convertMemoriesToRecords(options) {
   }
   const records = [];
   for (const filePath of allFiles) {
-    let raw;
-    try {
-      raw = await readFile(filePath, "utf-8");
-    } catch {
-      continue;
-    }
+    const raw = await readContainedMarkdownFile(filePath, containmentRoot);
+    if (raw === null) continue;
     const parsed = parseFrontmatter(raw);
     if (!parsed) continue;
     if (!parsed.content) continue;
@@ -622,29 +464,44 @@ async function convertMemoriesToRecords(options) {
 }
 
 // src/training-export/registry.ts
-var adapters2 = /* @__PURE__ */ new Map();
+var adapters = /* @__PURE__ */ new Map();
 function registerTrainingExportAdapter(adapter) {
-  if (!adapter || typeof adapter.name !== "string" || adapter.name.trim().length === 0) {
+  if (!adapter || typeof adapter !== "object" || Array.isArray(adapter)) {
+    throw new Error(
+      "registerTrainingExportAdapter: adapter must be an object with name, fileExtension, and formatRecords."
+    );
+  }
+  if (typeof adapter.name !== "string" || adapter.name.trim().length === 0) {
     throw new Error(
       "registerTrainingExportAdapter: adapter.name must be a non-empty string. Provide a unique adapter name (e.g. 'weclone', 'axolotl', 'mlx')."
     );
   }
+  if (typeof adapter.formatRecords !== "function") {
+    throw new Error(
+      "registerTrainingExportAdapter: adapter.formatRecords must be a function."
+    );
+  }
+  if (typeof adapter.fileExtension !== "string" || !/^\.[A-Za-z0-9][A-Za-z0-9._-]*$/.test(adapter.fileExtension.trim())) {
+    throw new Error(
+      "registerTrainingExportAdapter: adapter.fileExtension must be a non-empty extension like '.jsonl'."
+    );
+  }
   const key = adapter.name.trim();
-  if (adapters2.has(key)) {
+  if (adapters.has(key)) {
     throw new Error(
       `registerTrainingExportAdapter: adapter "${key}" is already registered. Currently registered adapters: [${listTrainingExportAdapters().join(", ")}].`
     );
   }
-  adapters2.set(key, adapter);
+  adapters.set(key, adapter);
 }
 function getTrainingExportAdapter(name) {
-  return adapters2.get(name.trim());
+  return adapters.get(name.trim());
 }
 function listTrainingExportAdapters() {
-  return [...adapters2.keys()];
+  return [...adapters.keys()];
 }
 function clearTrainingExportAdapters() {
-  adapters2.clear();
+  adapters.clear();
 }
 
 // src/cli.ts
@@ -724,6 +581,16 @@ var activeDashboardServer = null;
 var dashboardOperationChain = Promise.resolve();
 var activeAccessHttpServer = null;
 var accessHttpOperationChain = Promise.resolve();
+function parseDashboardPort(value, fallback = 4319) {
+  if (value === void 0 || value === null || String(value).trim().length === 0) {
+    return fallback;
+  }
+  const port = Number(String(value).trim());
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error("dashboard port must be an integer from 0 to 65535");
+  }
+  return port;
+}
 async function withWebDavLock(operation) {
   const run = webDavOperationChain.then(operation, operation);
   webDavOperationChain = run.then(
@@ -1865,6 +1732,7 @@ async function runWebDavStopCliCommand() {
 }
 async function runDashboardStartCliCommand(options) {
   return withDashboardLock(async () => {
+    const port = parseDashboardPort(options.port, 4319);
     if (activeDashboardServer) {
       const status = activeDashboardServer.status();
       if (status.running) return status;
@@ -1872,10 +1740,11 @@ async function runDashboardStartCliCommand(options) {
     const createServer = options.createServer ?? ((opts) => new GraphDashboardServer({
       memoryDir: opts.memoryDir,
       host: opts.host,
-      port: opts.port,
-      publicDir: opts.publicDir
+      port,
+      publicDir: opts.publicDir,
+      authToken: opts.authToken
     }));
-    const server = createServer(options);
+    const server = createServer({ ...options, port });
     activeDashboardServer = server;
     try {
       return await server.start();
@@ -2150,7 +2019,7 @@ async function withTimeout(promise, timeoutMs, timeoutMessage) {
 }
 async function runReplayCliCommand(orchestrator, options) {
   const extractionIdleTimeoutMs = Number.isFinite(options.extractionIdleTimeoutMs) ? Math.max(1e3, Math.floor(options.extractionIdleTimeoutMs)) : 15 * 6e4;
-  const inputRaw = await readFile2(options.inputPath, "utf-8");
+  const inputRaw = await readFile(options.inputPath, "utf-8");
   const registry = buildReplayNormalizerRegistry([
     openclawReplayNormalizer,
     claudeReplayNormalizer,
@@ -2242,7 +2111,7 @@ async function runBulkImportCliCommand(opts) {
       "Bulk import persistence is not wired: no ingestBatch callback was provided by the host CLI. Use --dry-run to validate without persisting, or invoke via `openclaw engram bulk-import` which supplies the orchestrator-backed ingestion path."
     );
   }
-  const inputRaw = await readFile2(opts.file, "utf-8");
+  const inputRaw = await readFile(opts.file, "utf-8");
   let inputParsed;
   try {
     inputParsed = JSON.parse(inputRaw);
@@ -2306,7 +2175,7 @@ async function runBulkImportCliCommand(opts) {
 async function getPluginVersion() {
   try {
     const pkgPath = new URL("../package.json", import.meta.url);
-    const raw = await readFile2(pkgPath, "utf-8");
+    const raw = await readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     return parsed.version ?? "unknown";
   } catch {
@@ -2377,7 +2246,7 @@ async function readAllMemoryFiles(memoryDir) {
   const out = [];
   await walkMemoryMarkdownFiles(memoryDir, async (fullPath) => {
     try {
-      const raw = await readFile2(fullPath, "utf-8");
+      const raw = await readFile(fullPath, "utf-8");
       const parsed = raw.match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);
       if (!parsed) return;
       const fmRaw = parsed[1];
@@ -2692,7 +2561,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       );
       tierCmd.command("list").description("Summarize tier distribution across all memories").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-62ZVDFKS.js");
+        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-SKML2OSF.js");
         const summary = await summarizeTiers(orchestrator.storage);
         if (reportHasMachineReadableOutput(options)) {
           console.log(JSON.stringify(summary, null, 2));
@@ -2703,7 +2572,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       tierCmd.command("explain").description("Explain the tier-transition decision for a single memory").argument("<id>", "Memory id to explain").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const idArg = typeof args[0] === "string" ? args[0] : "";
         const options = args[1] ?? {};
-        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-62ZVDFKS.js");
+        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-SKML2OSF.js");
         try {
           const explain = await explainTierForMemory(
             orchestrator.storage,
@@ -3149,8 +3018,8 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         console.log("OK");
       });
       capsuleCmd.command("import").description(
-        "Import a capsule archive into the memory directory. Auto-detects encrypted archives (REMNIC-ENC header); requires --encrypt-key-dir or the memory dir to have an unlocked secure-store."
-      ).argument("<archive>", "Path to the .capsule.json.gz (or .enc) archive").option("--mode <mode>", "Conflict mode: skip (default), overwrite, fork", "skip").option("--namespace <ns>", "Target namespace (v3.0+, default: config defaultNamespace)", "").action(async (...args) => {
+        "Import a capsule archive into the memory directory. Auto-detects encrypted archives (REMNIC-ENC header); requires the original passphrase or an unlocked secure-store."
+      ).argument("<archive>", "Path to the .capsule.json.gz (or .enc) archive").option("--mode <mode>", "Conflict mode: skip (default), overwrite, fork", "skip").option("--namespace <ns>", "Target namespace (v3.0+, default: config defaultNamespace)", "").option("--passphrase <passphrase>", "Original secure-store passphrase for encrypted format-v2 archive restore").action(async (...args) => {
         const archivePath = args[0] ? String(args[0]) : "";
         const options = args[1] ?? {};
         if (!archivePath) {
@@ -3165,6 +3034,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           return;
         }
         const namespace = options.namespace ? String(options.namespace) : "";
+        const passphrase = typeof options.passphrase === "string" ? options.passphrase : void 0;
         const memoryDir = await resolveMemoryDirForNamespace(orchestrator, namespace, {
           rejectUnsupportedOverride: true
         });
@@ -3173,7 +3043,8 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           archivePath: expandTildePath(archivePath),
           root: memoryDir,
           mode,
-          memoryDir
+          memoryDir,
+          passphrase
         });
         console.log(`Imported: ${result.imported.length} record(s)`);
         if (result.skipped.length > 0) {
@@ -3219,7 +3090,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           }
         }
         if (sourceArchive.endsWith(".enc")) {
-          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-5CYAGVC5.js");
+          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-7FJQINUR.js");
           const encDetected = await isEncryptedCapsuleFile(sourceArchive).catch(() => true);
           if (encDetected) {
             throw new Error(
@@ -3227,7 +3098,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
             );
           }
         }
-        const { mergeCapsule } = await import("./capsule-merge-4MGKE7C5.js");
+        const { mergeCapsule } = await import("./capsule-merge-T2JRE46P.js");
         const result = await mergeCapsule({
           sourceArchive,
           targetRoot: memoryDir,
@@ -3264,7 +3135,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const dirWasExplicit = typeof opts.dir === "string" && opts.dir.trim() !== "";
         const parsed = parseCapsuleListOptions(opts, defaultDir);
         const capsulesDir = expandTildePath(parsed.capsulesDir);
-        const { readdir: readdir3, readFile: readFile3, stat } = await import("fs/promises");
+        const { readdir: readdir3, readFile: readFile2, stat } = await import("fs/promises");
         let dirEntries;
         try {
           dirEntries = await readdir3(capsulesDir);
@@ -3303,7 +3174,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           }
           if (hasManifest) {
             try {
-              const raw = await readFile3(manifestPath, "utf-8");
+              const raw = await readFile2(manifestPath, "utf-8");
               const sidecar = JSON.parse(raw);
               createdAt = typeof sidecar.createdAt === "string" ? sidecar.createdAt : null;
               pluginVersion = typeof sidecar.pluginVersion === "string" ? sidecar.pluginVersion : null;
@@ -3369,8 +3240,8 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const sidecarPath = archivePath.replace(/\.enc$/, "").replace(/\.capsule\.json\.gz$/, ".manifest.json");
         let sidecar = null;
         try {
-          const { readFile: readFile3 } = await import("fs/promises");
-          const raw = await readFile3(sidecarPath, "utf-8");
+          const { readFile: readFile2 } = await import("fs/promises");
+          const raw = await readFile2(sidecarPath, "utf-8");
           sidecar = JSON.parse(raw);
         } catch {
         }
@@ -3382,7 +3253,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           const { parseExportBundle } = await import("./transfer/types.js");
           let decryptedBuf;
           try {
-            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-5CYAGVC5.js");
+            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-7FJQINUR.js");
             decryptedBuf = await decryptCapsuleFileInMemory(archivePath, memoryDir);
           } catch (decErr) {
             const msg = decErr instanceof Error ? decErr.message : String(decErr);
@@ -3407,10 +3278,10 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           }
           manifest = parsed2.bundle.manifest;
         } else {
-          const { readFile: readFile3 } = await import("fs/promises");
+          const { readFile: readFile2 } = await import("fs/promises");
           const { gunzipSync } = await import("zlib");
           const { parseExportBundle } = await import("./transfer/types.js");
-          const buf = await readFile3(archivePath);
+          const buf = await readFile2(archivePath);
           const json = gunzipSync(buf).toString("utf-8");
           const parsed2 = parseExportBundle(JSON.parse(json));
           if (parsed2.capsuleVersion !== 2) {
@@ -3898,29 +3769,56 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         console.log(renderPatternExplain(detail, parsed.format));
       });
       {
-        async function buildConnectorRows() {
-          const states = await listConnectorStates(
-            orchestrator.config.memoryDir
-          );
-          const stateMap = new Map(states.map((s) => [s.id, s]));
-          const builtIn = [
+        let builtInConnectorDefinitions2 = function() {
+          const cfg = orchestrator.config.connectors;
+          return [
             {
               id: GOOGLE_DRIVE_CONNECTOR_ID,
               displayName: "Google Drive",
-              enabled: orchestrator.config.connectors.googleDrive.enabled
+              enabled: cfg.googleDrive.enabled,
+              rawConfig: cfg.googleDrive,
+              enabledConfigPath: "connectors.googleDrive.enabled",
+              createConnector: () => createGoogleDriveConnector(),
+              validateConfig: (raw) => validateGoogleDriveConfig(raw)
             },
             {
               id: NOTION_CONNECTOR_ID,
               displayName: "Notion",
-              enabled: orchestrator.config.connectors.notion.enabled
+              enabled: cfg.notion.enabled,
+              rawConfig: cfg.notion,
+              enabledConfigPath: "connectors.notion.enabled",
+              createConnector: () => createNotionConnector(),
+              validateConfig: (raw) => validateNotionConfig(raw)
+            },
+            {
+              id: GMAIL_CONNECTOR_ID,
+              displayName: "Gmail",
+              enabled: cfg.gmail.enabled,
+              rawConfig: cfg.gmail,
+              enabledConfigPath: "connectors.gmail.enabled",
+              createConnector: () => createGmailConnector(),
+              validateConfig: (raw) => validateGmailConfig(raw)
+            },
+            {
+              id: GITHUB_CONNECTOR_ID,
+              displayName: "GitHub",
+              enabled: cfg.github.enabled,
+              rawConfig: cfg.github,
+              enabledConfigPath: "connectors.github.enabled",
+              createConnector: () => createGitHubConnector(),
+              validateConfig: (raw) => validateGitHubConfig(raw)
             }
           ];
-          return builtIn.map((c) => ({
-            id: c.id,
-            displayName: c.displayName,
-            enabled: c.enabled,
-            state: stateMap.get(c.id) ?? null
-          }));
+        };
+        var builtInConnectorDefinitions = builtInConnectorDefinitions2;
+        async function buildConnectorRows() {
+          const states = await listConnectorStates(
+            orchestrator.config.memoryDir
+          );
+          return buildConnectorRowsFromDefinitions(
+            builtInConnectorDefinitions2(),
+            states
+          );
         }
         const connectorsCmd = cmd.command("connectors").description(
           "Manage live connectors (Google Drive, Notion, \u2026). Subcommands: list, status, run. See docs/live-connectors.md."
@@ -3997,8 +3895,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
             process.exitCode = 2;
             return;
           }
-          const cfg = orchestrator.config.connectors;
-          const { readConnectorState, writeConnectorState } = await import("./state-store-VZU2IA53.js");
+          const { readConnectorState, withConnectorStateLock, writeConnectorState } = await import("./state-store-4QZISH3J.js");
           const sharedIngestFn = async (docs) => {
             const fetchedAt = (/* @__PURE__ */ new Date()).toISOString();
             const turns = docs.map((doc) => ({
@@ -4030,10 +3927,13 @@ ${doc.content}` : doc.content,
             );
           };
           let runResult;
-          if (name === GOOGLE_DRIVE_CONNECTOR_ID) {
-            if (!cfg.googleDrive.enabled) {
+          const connectorDefinition = builtInConnectorDefinitions2().find(
+            (definition) => definition.id === name
+          );
+          if (connectorDefinition) {
+            if (!connectorDefinition.enabled) {
               process.stderr.write(
-                `connectors run: connector "${name}" is disabled. Set connectors.googleDrive.enabled=true in config.
+                `connectors run: connector "${name}" is disabled. Set ${connectorDefinition.enabledConfigPath}=true in config.
 `
               );
               process.exitCode = 1;
@@ -4041,45 +3941,9 @@ ${doc.content}` : doc.content,
             }
             let validatedCfg;
             try {
-              validatedCfg = validateGoogleDriveConfig(cfg.googleDrive);
-            } catch (err) {
-              process.stderr.write(
-                `connectors run: invalid config for "${name}": ${err instanceof Error ? err.message : String(err)}
-`
-              );
-              process.exitCode = 1;
-              return;
-            }
-            const connector = createGoogleDriveConnector();
-            const state = await readConnectorState(
-              orchestrator.config.memoryDir,
-              name
-            );
-            runResult = await runConnectorPollOnce({
-              connectorId: name,
-              priorState: state,
-              syncFn: (cursor) => connector.syncIncremental({
-                cursor,
-                // GoogleDriveConnectorConfig is narrower than ConnectorConfig
-                // (no index signature) but is structurally compatible at
-                // runtime. Double-cast via unknown to satisfy the interface.
-                config: validatedCfg
-              }),
-              ingestFn: sharedIngestFn,
-              writeCursorFn: makeWriteCursorFn(name)
-            });
-          } else if (name === NOTION_CONNECTOR_ID) {
-            if (!cfg.notion.enabled) {
-              process.stderr.write(
-                `connectors run: connector "${name}" is disabled. Set connectors.notion.enabled=true in config.
-`
+              validatedCfg = connectorDefinition.validateConfig(
+                connectorDefinition.rawConfig
               );
-              process.exitCode = 1;
-              return;
-            }
-            let validatedCfg;
-            try {
-              validatedCfg = validateNotionConfig(cfg.notion);
             } catch (err) {
               process.stderr.write(
                 `connectors run: invalid config for "${name}": ${err instanceof Error ? err.message : String(err)}
@@ -4088,27 +3952,27 @@ ${doc.content}` : doc.content,
               process.exitCode = 1;
               return;
             }
-            const connector = createNotionConnector();
-            const state = await readConnectorState(
-              orchestrator.config.memoryDir,
-              name
-            );
-            runResult = await runConnectorPollOnce({
-              connectorId: name,
-              priorState: state,
-              syncFn: (cursor) => connector.syncIncremental({
-                cursor,
-                // NotionConnectorConfig is narrower than ConnectorConfig (no
-                // index signature) but is structurally compatible at runtime.
-                // Double-cast via unknown to satisfy the interface boundary.
-                config: validatedCfg
-              }),
-              ingestFn: sharedIngestFn,
-              writeCursorFn: makeWriteCursorFn(name)
+            const connector = connectorDefinition.createConnector();
+            runResult = await withConnectorStateLock(orchestrator.config.memoryDir, name, async () => {
+              const state = await readConnectorState(
+                orchestrator.config.memoryDir,
+                name
+              );
+              return runConnectorPollOnce({
+                connectorId: name,
+                priorState: state,
+                syncFn: (cursor) => connector.syncIncremental({
+                  cursor,
+                  config: validatedCfg
+                }),
+                ingestFn: sharedIngestFn,
+                writeCursorFn: makeWriteCursorFn(name)
+              });
             });
           } else {
+            const known = builtInConnectorDefinitions2().map((definition) => definition.id).join(", ");
             process.stderr.write(
-              `connectors run: unknown connector "${name}". Known connectors: ${GOOGLE_DRIVE_CONNECTOR_ID}, ${NOTION_CONNECTOR_ID}.
+              `connectors run: unknown connector "${name}". Known connectors: ${known}.
 `
             );
             process.exitCode = 1;
@@ -4810,14 +4674,14 @@ ${doc.content}` : doc.content,
         console.log("OK");
       });
       const dashboardCmd = cmd.command("dashboard").description("Manage live graph dashboard service");
-      dashboardCmd.command("start").description("Start dashboard server (localhost by default)").option("--host <host>", "Bind host", "127.0.0.1").option("--port <n>", "Bind port", "4319").option("--public-dir <path>", "Override static dashboard assets path").action(async (...args) => {
+      dashboardCmd.command("start").description("Start dashboard server (localhost by default)").option("--host <host>", "Bind host", "127.0.0.1").option("--port <n>", "Bind port", "4319").option("--public-dir <path>", "Override static dashboard assets path").option("--token <token>", "Bearer token required for non-loopback dashboard API access").action(async (...args) => {
         const options = args[0] ?? {};
-        const portRaw = parseInt(String(options.port ?? "4319"), 10);
         const status = await runDashboardStartCliCommand({
           memoryDir: orchestrator.config.memoryDir,
           host: typeof options.host === "string" ? options.host : "127.0.0.1",
-          port: Number.isFinite(portRaw) ? portRaw : 4319,
-          publicDir: typeof options.publicDir === "string" ? options.publicDir : void 0
+          port: parseDashboardPort(options.port, 4319),
+          publicDir: typeof options.publicDir === "string" ? options.publicDir : void 0,
+          authToken: typeof options.token === "string" ? options.token : void 0
         });
         console.log(JSON.stringify(status, null, 2));
         console.log("OK");
@@ -5972,7 +5836,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           process.exit(1);
         }
         const limit = parseInt(options.limit ?? "50", 10);
-        const { listPairs } = await import("./contradiction-review-ATP4S6IC.js");
+        const { listPairs } = await import("./contradiction-review-6V2LXXK6.js");
         const result = listPairs(orchestrator.config.memoryDir, {
           filter,
           namespace: options.namespace,
@@ -5999,7 +5863,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("pairId is required");
           process.exit(1);
         }
-        const { readPair } = await import("./contradiction-review-ATP4S6IC.js");
+        const { readPair } = await import("./contradiction-review-6V2LXXK6.js");
         const pair = readPair(orchestrator.config.memoryDir, pairId);
         if (!pair) {
           console.error(`Pair ${pairId} not found.`);
@@ -6019,7 +5883,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("--verb is required. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context");
           process.exit(1);
         }
-        const { isValidResolutionVerb, executeResolution } = await import("./resolution-B7FNQSSP.js");
+        const { isValidResolutionVerb, executeResolution } = await import("./resolution-ZY7VM6WS.js");
         if (!isValidResolutionVerb(verb)) {
           console.error(`Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context`);
           process.exit(1);
@@ -6045,7 +5909,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
       });
       reviewCmd.command("scan").description("Run an on-demand contradiction scan").option("--namespace <ns>", "Namespace to scan").action(async (...args) => {
         const options = args[0] ?? {};
-        const { runContradictionScan } = await import("./contradiction-scan-5A4IDZV5.js");
+        const { runContradictionScan } = await import("./contradiction-scan-GIRVC4C7.js");
         console.log("Running contradiction scan...");
         const result = await runContradictionScan({
           storage: orchestrator.storage,
@@ -6085,7 +5949,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error(`Invalid --format '${fmt}'. Must be one of: text, json, markdown`);
           process.exit(1);
         }
-        const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-LR2NBAZE.js");
+        const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-3WSCI5V4.js");
         let windowHours;
         const rawWindowHours = options.windowHours;
         try {
@@ -6198,7 +6062,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       const secureStoreCmd = cmd.command("secure-store").description(
-        "At-rest encryption keyring (issue #690). Manage the secure-store header and the in-memory master key used by the running daemon."
+        "At-rest encryption keyring (issue #690). Manage the secure-store header and the process-local in-memory master key."
       );
       secureStoreCmd.command("init").description(
         "Initialize a new secure-store header. Prompts for a passphrase, derives a master key via Argon2id by default, and writes the verifier to <memoryDir>/.secure-store/header.json. Refuses to overwrite an existing header."
@@ -6229,7 +6093,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         console.log(renderInitReport(report));
       });
       secureStoreCmd.command("unlock").description(
-        "Unlock the secure-store. Prompts for the passphrase, validates it against the header verifier, and registers the master key in the daemon's in-memory keyring. The key is cleared on `lock`, daemon restart, or process exit."
+        "Unlock the secure-store for this Remnic process. Prompts for the passphrase, validates it against the header verifier, and registers the master key in this process-local keyring. The key is cleared on `lock`, process restart, or process exit."
       ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
         const {
@@ -6252,7 +6116,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       secureStoreCmd.command("lock").description(
-        "Lock the secure-store. Clears the master key from the daemon's in-memory keyring. Idempotent \u2014 succeeds even if the store is already locked."
+        "Lock the secure-store in this Remnic process. Clears the master key from the process-local in-memory keyring. Idempotent \u2014 succeeds even if this process is already locked."
       ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
         const { runSecureStoreLock, renderLockReport } = await import("./secure-store/index.js");
@@ -6268,9 +6132,12 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         "Encrypt existing plaintext storage-managed memory files in an initialized, unlocked secure-store. Idempotent; already-encrypted files are skipped."
       ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const { runSecureStoreMigrate, renderMigrateReport } = await import("./secure-store/index.js");
+        const { runSecureStoreMigrate, renderMigrateReport, createPassphraseReader } = await import("./secure-store/index.js");
         const memoryDir = expandTildePath(orchestrator.config.memoryDir);
-        const report = await runSecureStoreMigrate({ memoryDir });
+        const report = await runSecureStoreMigrate({
+          memoryDir,
+          readPassphrase: createPassphraseReader()
+        });
         if (options.json === true) {
           console.log(JSON.stringify(report, null, 2));
         } else {
@@ -6281,9 +6148,12 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       async function runSecureStoreDisableCommand(options) {
-        const { runSecureStoreDisable, renderDisableReport } = await import("./secure-store/index.js");
+        const { runSecureStoreDisable, renderDisableReport, createPassphraseReader } = await import("./secure-store/index.js");
         const memoryDir = expandTildePath(orchestrator.config.memoryDir);
-        const report = await runSecureStoreDisable({ memoryDir });
+        const report = await runSecureStoreDisable({
+          memoryDir,
+          readPassphrase: createPassphraseReader()
+        });
         if (options.json === true) {
           console.log(JSON.stringify(report, null, 2));
         } else {
@@ -6304,7 +6174,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         await runSecureStoreDisableCommand(options);
       });
       secureStoreCmd.command("status").description(
-        "Report secure-store status: whether a header exists, whether the daemon currently holds the key, KDF parameters, and last-unlock timestamp."
+        "Report secure-store status: whether a header exists, whether this Remnic process currently holds the key, KDF parameters, and last-unlock timestamp."
       ).option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
         const { runSecureStoreStatus, renderStatusReport } = await import("./secure-store/index.js");
@@ -6319,7 +6189,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
       const peerCmd = cmd.command("peer").description("Manage the peer registry (issue #679).");
       peerCmd.command("list").description("List all registered peers").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const { listPeers } = await import("./peers-HCVGHMAE.js");
+        const { listPeers } = await import("./peers/index.js");
         const peers = await listPeers(orchestrator.config.memoryDir);
         if (options.json === true) {
           console.log(JSON.stringify({ peers }, null, 2));
@@ -6343,7 +6213,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("peer id is required");
           process.exit(1);
         }
-        const peersShow = await import("./peers-HCVGHMAE.js");
+        const peersShow = await import("./peers/index.js");
         const validateIdShow = peersShow.assertValidPeerId;
         try {
           validateIdShow(id);
@@ -6456,7 +6326,7 @@ ${peer.notes.split("\n").map((l) => `    ${l}`).join("\n")}`);
           console.error("peer id is required");
           process.exit(1);
         }
-        const peersProfile = await import("./peers-HCVGHMAE.js");
+        const peersProfile = await import("./peers/index.js");
         const validateIdProfile = peersProfile.assertValidPeerId;
         try {
           validateIdProfile(id);
@@ -6491,7 +6361,7 @@ ${peer.notes.split("\n").map((l) => `    ${l}`).join("\n")}`);
         const options = args[0] ?? {};
         const isDryRun = options.dryRun === true;
         const displayName = typeof options.displayName === "string" && options.displayName.length > 0 ? options.displayName : void 0;
-        const { migrateFromIdentityAnchor } = await import("./migrate-from-identity-anchor-G27MCD6A.js");
+        const { migrateFromIdentityAnchor } = await import("./migrate-from-identity-anchor-EB4XI4Q2.js");
         let result;
         try {
           result = await migrateFromIdentityAnchor({
@@ -6565,8 +6435,8 @@ Legacy identity-anchor files are untouched. Verify the migration result`);
           return;
         }
         if (typeof options.trace === "string" && options.trace.length > 0) {
-          const { replayTrace, parseSpeedFlag } = await import("./trace-C5ETWBEF.js");
-          const { expandTildePath: expandTildePath2 } = await import("./path-MR5JPYOP.js");
+          const { replayTrace, parseSpeedFlag } = await import("./trace-WM7V4CKI.js");
+          const { expandTildePath: expandTildePath2 } = await import("./path-X2K5XCHL.js");
           const tracePath = expandTildePath2(options.trace);
           let speed;
           try {
@@ -6596,8 +6466,8 @@ Legacy identity-anchor files are untouched. Verify the migration result`);
         const { runConsoleTui } = await import("./tui-RI7P6PBS.js");
         let recorder = null;
         if (typeof options.recordTrace === "string" && options.recordTrace.length > 0) {
-          const { openTraceRecorder } = await import("./trace-C5ETWBEF.js");
-          const { expandTildePath: expandTildePath2 } = await import("./path-MR5JPYOP.js");
+          const { openTraceRecorder } = await import("./trace-WM7V4CKI.js");
+          const { expandTildePath: expandTildePath2 } = await import("./path-X2K5XCHL.js");
           recorder = await openTraceRecorder(
             expandTildePath2(options.recordTrace)
           );
@@ -6610,7 +6480,7 @@ Legacy identity-anchor files are untouched. Verify the migration result`);
         } finally {
           if (recorder) {
             const CLOSE_TIMEOUT_MS = 2e3;
-            const { flushWithTimeout } = await import("./trace-C5ETWBEF.js");
+            const { flushWithTimeout } = await import("./trace-WM7V4CKI.js");
             const flushResult = await flushWithTimeout(
               (signal) => recorder.close(signal),
               CLOSE_TIMEOUT_MS
@@ -6650,15 +6520,6 @@ function parseDuration(duration) {
 }
 
 export {
-  isImportRole,
-  parseIsoTimestamp,
-  validateImportTurn,
-  registerBulkImportSource,
-  getBulkImportSource,
-  listBulkImportSources,
-  clearBulkImportSources,
-  formatBatchTranscript,
-  runBulkImportPipeline,
   convertMemoriesToRecords,
   registerTrainingExportAdapter,
   getTrainingExportAdapter,
@@ -6755,4 +6616,4 @@ export {
   resolveMemoryDirForNamespace,
   registerCli
 };
-//# sourceMappingURL=chunk-TPU5L5EY.js.map
+//# sourceMappingURL=chunk-D6WE5MTW.js.map