@remnic/core 1.1.31 → 9.3.516

package/dist/chunk-T2PO5MUF.js

@@ -0,0 +1,62 @@
+import {
+  log
+} from "./chunk-2ODBA7MQ.js";
+
+// src/conversation-index/cleanup.ts
+import { lstat, readdir, realpath, rm } from "fs/promises";
+import path from "path";
+async function cleanupConversationChunks(rootDir, retentionDays) {
+  if (!Number.isFinite(retentionDays) || retentionDays <= 0) return;
+  const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1e3;
+  try {
+    const root = await assertCleanupRoot(rootDir);
+    const sessions = await readdir(rootDir, { withFileTypes: true });
+    for (const s of sessions) {
+      if (!s.isDirectory()) continue;
+      const sessionDir = await assertCleanupChild(root, path.join(rootDir, s.name));
+      const dayDirs = await readdir(sessionDir, { withFileTypes: true });
+      for (const d of dayDirs) {
+        if (!d.isDirectory()) continue;
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(d.name)) continue;
+        const dayMs = (/* @__PURE__ */ new Date(d.name + "T00:00:00.000Z")).getTime();
+        if (!Number.isFinite(dayMs)) continue;
+        if (dayMs < cutoffMs) {
+          await rm(await assertCleanupChild(root, path.join(sessionDir, d.name)), { recursive: true, force: true });
+        }
+      }
+      try {
+        const remaining = await readdir(sessionDir);
+        if (remaining.length === 0) {
+          await rm(await assertCleanupChild(root, sessionDir), { recursive: true, force: true });
+        }
+      } catch {
+      }
+    }
+  } catch (err) {
+    log.debug(`conversation chunk cleanup failed: ${err}`);
+  }
+}
+async function assertCleanupRoot(rootDir) {
+  const stat = await lstat(rootDir);
+  if (stat.isSymbolicLink()) {
+    throw new Error("conversation chunk cleanup root must not be a symlink");
+  }
+  return realpath(rootDir);
+}
+async function assertCleanupChild(rootReal, candidate) {
+  const stat = await lstat(candidate);
+  if (stat.isSymbolicLink()) {
+    throw new Error("conversation chunk cleanup path must not contain symlinks");
+  }
+  const real = await realpath(candidate);
+  const relative = path.relative(rootReal, real);
+  if (relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative)) {
+    return real;
+  }
+  throw new Error("conversation chunk cleanup path escapes index root");
+}
+
+export {
+  cleanupConversationChunks
+};
+//# sourceMappingURL=chunk-T2PO5MUF.js.map

package/dist/chunk-T2PO5MUF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/conversation-index/cleanup.ts"],"sourcesContent":["import { lstat, readdir, realpath, rm } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { log } from \"../logger.js\";\n\n/**\n * Best-effort retention cleanup for conversation chunk docs.\n *\n * Layout (written by indexer.ts):\n *   <root>/<safeSessionKey>/<YYYY-MM-DD>/<chunkId>.md\n *\n * We prune day directories older than retentionDays, and remove empty session dirs.\n */\nexport async function cleanupConversationChunks(\n  rootDir: string,\n  retentionDays: number,\n): Promise<void> {\n  if (!Number.isFinite(retentionDays) || retentionDays <= 0) return;\n\n  const cutoffMs = Date.now() - retentionDays * 24 * 60 * 60 * 1000;\n\n  try {\n    const root = await assertCleanupRoot(rootDir);\n    const sessions = await readdir(rootDir, { withFileTypes: true });\n    for (const s of sessions) {\n      if (!s.isDirectory()) continue;\n      const sessionDir = await assertCleanupChild(root, path.join(rootDir, s.name));\n      const dayDirs = await readdir(sessionDir, { withFileTypes: true });\n\n      for (const d of dayDirs) {\n        if (!d.isDirectory()) continue;\n        // Expect YYYY-MM-DD\n        if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(d.name)) continue;\n        const dayMs = new Date(d.name + \"T00:00:00.000Z\").getTime();\n        if (!Number.isFinite(dayMs)) continue;\n        if (dayMs < cutoffMs) {\n          await rm(await assertCleanupChild(root, path.join(sessionDir, d.name)), { recursive: true, force: true });\n        }\n      }\n\n      // Remove empty session dirs after pruning.\n      try {\n        const remaining = await readdir(sessionDir);\n        if (remaining.length === 0) {\n          await rm(await assertCleanupChild(root, sessionDir), { recursive: true, force: true });\n        }\n      } catch {\n        // ignore\n      }\n    }\n  } catch (err) {\n    log.debug(`conversation chunk cleanup failed: ${err}`);\n  }\n}\n\nasync function assertCleanupRoot(rootDir: string): Promise<string> {\n  const stat = await lstat(rootDir);\n  if (stat.isSymbolicLink()) {\n    throw new Error(\"conversation chunk cleanup root must not be a symlink\");\n  }\n  return realpath(rootDir);\n}\n\nasync function assertCleanupChild(rootReal: string, candidate: string): Promise<string> {\n  const stat = await lstat(candidate);\n  if (stat.isSymbolicLink()) {\n    throw new Error(\"conversation chunk cleanup path must not contain symlinks\");\n  }\n  const real = await realpath(candidate);\n  const relative = path.relative(rootReal, real);\n  if (relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative))) {\n    return real;\n  }\n  throw new Error(\"conversation chunk cleanup path escapes index root\");\n}\n"],"mappings":";;;;;AAAA,SAAS,OAAO,SAAS,UAAU,UAAU;AAC7C,OAAO,UAAU;AAWjB,eAAsB,0BACpB,SACA,eACe;AACf,MAAI,CAAC,OAAO,SAAS,aAAa,KAAK,iBAAiB,EAAG;AAE3D,QAAM,WAAW,KAAK,IAAI,IAAI,gBAAgB,KAAK,KAAK,KAAK;AAE7D,MAAI;AACF,UAAM,OAAO,MAAM,kBAAkB,OAAO;AAC5C,UAAM,WAAW,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC;AAC/D,eAAW,KAAK,UAAU;AACxB,UAAI,CAAC,EAAE,YAAY,EAAG;AACtB,YAAM,aAAa,MAAM,mBAAmB,MAAM,KAAK,KAAK,SAAS,EAAE,IAAI,CAAC;AAC5E,YAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,eAAe,KAAK,CAAC;AAEjE,iBAAW,KAAK,SAAS;AACvB,YAAI,CAAC,EAAE,YAAY,EAAG;AAEtB,YAAI,CAAC,sBAAsB,KAAK,EAAE,IAAI,EAAG;AACzC,cAAM,SAAQ,oBAAI,KAAK,EAAE,OAAO,gBAAgB,GAAE,QAAQ;AAC1D,YAAI,CAAC,OAAO,SAAS,KAAK,EAAG;AAC7B,YAAI,QAAQ,UAAU;AACpB,gBAAM,GAAG,MAAM,mBAAmB,MAAM,KAAK,KAAK,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,QAC1G;AAAA,MACF;AAGA,UAAI;AACF,cAAM,YAAY,MAAM,QAAQ,UAAU;AAC1C,YAAI,UAAU,WAAW,GAAG;AAC1B,gBAAM,GAAG,MAAM,mBAAmB,MAAM,UAAU,GAAG,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,QACvF;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,MAAM,sCAAsC,GAAG,EAAE;AAAA,EACvD;AACF;AAEA,eAAe,kBAAkB,SAAkC;AACjE,QAAM,OAAO,MAAM,MAAM,OAAO;AAChC,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AACA,SAAO,SAAS,OAAO;AACzB;AAEA,eAAe,mBAAmB,UAAkB,WAAoC;AACtF,QAAM,OAAO,MAAM,MAAM,SAAS;AAClC,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,QAAM,OAAO,MAAM,SAAS,SAAS;AACrC,QAAM,WAAW,KAAK,SAAS,UAAU,IAAI;AAC7C,MAAI,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ,GAAI;AACjF,WAAO;AAAA,EACT;AACA,QAAM,IAAI,MAAM,oDAAoD;AACtE;","names":[]}

package/dist/{chunk-C7VW7C3F.js → chunk-TDKQGLJW.js}

@@ -8,10 +8,10 @@ var RerankCache = class {
       this.entries.delete(key);
       return null;
     }
-    return e.rankedIds;
+    return e.rankedIds.slice();
   }
   set(key, rankedIds, ttlMs) {
-    this.entries.set(key, { rankedIds, expiresAtMs: Date.now() + ttlMs });
+    this.entries.set(key, { rankedIds: rankedIds.slice(), expiresAtMs: Date.now() + ttlMs });
   }
 };
 function parseRerankResponse(raw, candidates) {
@@ -114,4 +114,4 @@ export {
   parseRerankResponse,
   rerankLocalOrNoop
 };
-//# sourceMappingURL=chunk-C7VW7C3F.js.map
+//# sourceMappingURL=chunk-TDKQGLJW.js.map

package/dist/chunk-TDKQGLJW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rerank.ts"],"sourcesContent":["export interface RerankCandidate {\n  id: string;\n  originalIndex: number;\n}\n\nexport interface RerankScore {\n  id: string;\n  score: number;\n}\n\nexport interface RerankCacheEntry {\n  expiresAtMs: number;\n  rankedIds: string[];\n}\n\nexport class RerankCache {\n  private entries = new Map<string, RerankCacheEntry>();\n\n  get(key: string): string[] | null {\n    const e = this.entries.get(key);\n    if (!e) return null;\n    if (Date.now() > e.expiresAtMs) {\n      this.entries.delete(key);\n      return null;\n    }\n    return e.rankedIds.slice();\n  }\n\n  set(key: string, rankedIds: string[], ttlMs: number): void {\n    this.entries.set(key, { rankedIds: rankedIds.slice(), expiresAtMs: Date.now() + ttlMs });\n  }\n}\n\n/**\n * Parse a rerank response (JSON) and return candidates sorted by score.\n *\n * Rules:\n * - Unknown IDs in the response are ignored.\n * - Candidates missing from the response keep relative order after scored ones.\n * - Stable tie-breaker: originalIndex ascending.\n */\nexport function parseRerankResponse(\n  raw: string,\n  candidates: RerankCandidate[],\n): Array<RerankCandidate & { score?: number }> {\n  const byId = new Map<string, RerankCandidate>();\n  for (const c of candidates) byId.set(c.id, c);\n\n  const scores = new Map<string, number>();\n  try {\n    const parsed = JSON.parse(raw) as { scores?: Array<Partial<RerankScore>> };\n    if (Array.isArray(parsed.scores)) {\n      for (const s of parsed.scores) {\n        if (!s || typeof s.id !== \"string\") continue;\n        if (!byId.has(s.id)) continue;\n        if (typeof s.score !== \"number\" || !Number.isFinite(s.score)) continue;\n        scores.set(s.id, s.score);\n      }\n    }\n  } catch {\n    // Ignore parse errors and fall back to original order.\n  }\n\n  const withScore = candidates.map((c) => ({\n    ...c,\n    score: scores.get(c.id),\n  }));\n\n  return withScore.sort((a, b) => {\n    const as = a.score;\n    const bs = b.score;\n    if (typeof as === \"number\" && typeof bs === \"number\") {\n      if (bs !== as) return bs - as;\n      return a.originalIndex - b.originalIndex;\n    }\n    if (typeof as === \"number\") return -1;\n    if (typeof bs === \"number\") return 1;\n    return a.originalIndex - b.originalIndex;\n  });\n}\n\nfunction stableKey(query: string, ids: string[]): string {\n  // Keep it simple and deterministic; this is not a security boundary.\n  return `${query.trim().toLowerCase()}|${ids.join(\",\")}`;\n}\n\nfunction clampSnippet(snippet: string, maxChars: number): string {\n  const s = snippet.replace(/\\s+/g, \" \").trim();\n  return s.length > maxChars ? s.slice(0, maxChars) : s;\n}\n\nexport async function rerankLocalOrNoop(opts: {\n  query: string;\n  candidates: Array<{ id: string; snippet: string }>;\n  local: {\n    chatCompletion: (\n      messages: Array<{ role: string; content: string }>,\n      options?: {\n        maxTokens?: number;\n        temperature?: number;\n        timeoutMs?: number;\n        operation?: string;\n        priority?: \"recall-critical\" | \"background\";\n      },\n    ) => Promise<{ content: string } | null>;\n  };\n  enabled: boolean;\n  timeoutMs: number;\n  maxCandidates: number;\n  cache?: RerankCache;\n  cacheEnabled: boolean;\n  cacheTtlMs: number;\n}): Promise<string[] | null> {\n  if (!opts.enabled) return null;\n\n  const ids = opts.candidates.slice(0, opts.maxCandidates).map((c) => c.id);\n  if (ids.length <= 1) return ids;\n\n  const key = stableKey(opts.query, ids);\n  if (opts.cache && opts.cacheEnabled) {\n    const cached = opts.cache.get(key);\n    if (cached) return cached;\n  }\n\n  const payload = opts.candidates.slice(0, opts.maxCandidates).map((c) => ({\n    id: c.id,\n    snippet: clampSnippet(c.snippet, 400),\n  }));\n\n  const system =\n    \"You are a ranking system. Return JSON only. No markdown, no commentary.\";\n  const user = JSON.stringify(\n    {\n      task: \"rerank\",\n      query: opts.query,\n      candidates: payload,\n      output: {\n        scores: [{ id: \"string\", score: \"number 0-100\" }],\n      },\n      rules: [\n        \"Assign higher score to more relevant candidates.\",\n        \"Prefer durability and direct relevance to the query.\",\n        \"If unsure, keep scores close together.\",\n      ],\n    },\n    null,\n    0,\n  );\n\n  const res = await opts.local.chatCompletion(\n    [\n      { role: \"system\", content: system },\n      { role: \"user\", content: user },\n    ],\n    {\n      maxTokens: 800,\n      temperature: 0.0,\n      timeoutMs: opts.timeoutMs,\n      operation: \"rerank\",\n      priority: \"recall-critical\",\n    },\n  );\n  if (!res?.content) return null;\n\n  const parsed = parseRerankResponse(\n    res.content,\n    ids.map((id, i) => ({ id, originalIndex: i })),\n  );\n  const rankedIds = parsed.map((p) => p.id);\n\n  if (opts.cache && opts.cacheEnabled) {\n    opts.cache.set(key, rankedIds, opts.cacheTtlMs);\n  }\n\n  return rankedIds;\n}\n"],"mappings":";AAeO,IAAM,cAAN,MAAkB;AAAA,EACf,UAAU,oBAAI,IAA8B;AAAA,EAEpD,IAAI,KAA8B;AAChC,UAAM,IAAI,KAAK,QAAQ,IAAI,GAAG;AAC9B,QAAI,CAAC,EAAG,QAAO;AACf,QAAI,KAAK,IAAI,IAAI,EAAE,aAAa;AAC9B,WAAK,QAAQ,OAAO,GAAG;AACvB,aAAO;AAAA,IACT;AACA,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AAAA,EAEA,IAAI,KAAa,WAAqB,OAAqB;AACzD,SAAK,QAAQ,IAAI,KAAK,EAAE,WAAW,UAAU,MAAM,GAAG,aAAa,KAAK,IAAI,IAAI,MAAM,CAAC;AAAA,EACzF;AACF;AAUO,SAAS,oBACd,KACA,YAC6C;AAC7C,QAAM,OAAO,oBAAI,IAA6B;AAC9C,aAAW,KAAK,WAAY,MAAK,IAAI,EAAE,IAAI,CAAC;AAE5C,QAAM,SAAS,oBAAI,IAAoB;AACvC,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChC,iBAAW,KAAK,OAAO,QAAQ;AAC7B,YAAI,CAAC,KAAK,OAAO,EAAE,OAAO,SAAU;AACpC,YAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAAG;AACrB,YAAI,OAAO,EAAE,UAAU,YAAY,CAAC,OAAO,SAAS,EAAE,KAAK,EAAG;AAC9D,eAAO,IAAI,EAAE,IAAI,EAAE,KAAK;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,YAAY,WAAW,IAAI,CAAC,OAAO;AAAA,IACvC,GAAG;AAAA,IACH,OAAO,OAAO,IAAI,EAAE,EAAE;AAAA,EACxB,EAAE;AAEF,SAAO,UAAU,KAAK,CAAC,GAAG,MAAM;AAC9B,UAAM,KAAK,EAAE;AACb,UAAM,KAAK,EAAE;AACb,QAAI,OAAO,OAAO,YAAY,OAAO,OAAO,UAAU;AACpD,UAAI,OAAO,GAAI,QAAO,KAAK;AAC3B,aAAO,EAAE,gBAAgB,EAAE;AAAA,IAC7B;AACA,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,QAAI,OAAO,OAAO,SAAU,QAAO;AACnC,WAAO,EAAE,gBAAgB,EAAE;AAAA,EAC7B,CAAC;AACH;AAEA,SAAS,UAAU,OAAe,KAAuB;AAEvD,SAAO,GAAG,MAAM,KAAK,EAAE,YAAY,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;AACvD;AAEA,SAAS,aAAa,SAAiB,UAA0B;AAC/D,QAAM,IAAI,QAAQ,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC5C,SAAO,EAAE,SAAS,WAAW,EAAE,MAAM,GAAG,QAAQ,IAAI;AACtD;AAEA,eAAsB,kBAAkB,MAqBX;AAC3B,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,MAAM,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AACxE,MAAI,IAAI,UAAU,EAAG,QAAO;AAE5B,QAAM,MAAM,UAAU,KAAK,OAAO,GAAG;AACrC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,UAAM,SAAS,KAAK,MAAM,IAAI,GAAG;AACjC,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,UAAU,KAAK,WAAW,MAAM,GAAG,KAAK,aAAa,EAAE,IAAI,CAAC,OAAO;AAAA,IACvE,IAAI,EAAE;AAAA,IACN,SAAS,aAAa,EAAE,SAAS,GAAG;AAAA,EACtC,EAAE;AAEF,QAAM,SACJ;AACF,QAAM,OAAO,KAAK;AAAA,IAChB;AAAA,MACE,MAAM;AAAA,MACN,OAAO,KAAK;AAAA,MACZ,YAAY;AAAA,MACZ,QAAQ;AAAA,QACN,QAAQ,CAAC,EAAE,IAAI,UAAU,OAAO,eAAe,CAAC;AAAA,MAClD;AAAA,MACA,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,KAAK,MAAM;AAAA,IAC3B;AAAA,MACE,EAAE,MAAM,UAAU,SAAS,OAAO;AAAA,MAClC,EAAE,MAAM,QAAQ,SAAS,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,MACE,WAAW;AAAA,MACX,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,CAAC,KAAK,QAAS,QAAO;AAE1B,QAAM,SAAS;AAAA,IACb,IAAI;AAAA,IACJ,IAAI,IAAI,CAAC,IAAI,OAAO,EAAE,IAAI,eAAe,EAAE,EAAE;AAAA,EAC/C;AACA,QAAM,YAAY,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE;AAExC,MAAI,KAAK,SAAS,KAAK,cAAc;AACnC,SAAK,MAAM,IAAI,KAAK,WAAW,KAAK,UAAU;AAAA,EAChD;AAEA,SAAO;AACT;","names":[]}

package/dist/{chunk-3QKK7QOS.js → chunk-TERNBNJB.js}

@@ -6,7 +6,7 @@ import {
   optionalStringArray,
   recordStoreDay,
   validateStringRecord
-} from "./chunk-DGXUHMOV.js";
+} from "./chunk-A2IYSXDQ.js";
 import {
   listJsonFiles,
   readJsonFile
@@ -73,7 +73,7 @@ async function recordUtilityTelemetryEvent(options) {
   const eventsDir = path.join(rootDir, "events", day);
   const filePath = path.join(eventsDir, `${validated.eventId}.json`);
   await mkdir(eventsDir, { recursive: true });
-  await writeFile(filePath, JSON.stringify(validated, null, 2), "utf8");
+  await writeFile(filePath, JSON.stringify(validated, null, 2), { encoding: "utf8", flag: "wx" });
   return filePath;
 }
 async function readUtilityTelemetryEvents(options) {
@@ -151,4 +151,4 @@ export {
   readUtilityTelemetryEvents,
   getUtilityTelemetryStatus
 };
-//# sourceMappingURL=chunk-3QKK7QOS.js.map
+//# sourceMappingURL=chunk-TERNBNJB.js.map

package/dist/chunk-TERNBNJB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utility-telemetry.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport {\n  assertIsoRecordedAt,\n  assertSafePathSegment,\n  assertString,\n  isRecord,\n  optionalStringArray,\n  recordStoreDay,\n  validateStringRecord,\n} from \"./store-contract.js\";\n\nexport type UtilityTelemetrySource = \"cli\" | \"system\" | \"benchmark\" | \"tool_result\";\nexport type UtilityTelemetryTarget = \"promotion\" | \"ranking\";\nexport type UtilityTelemetryDecision = \"promote\" | \"demote\" | \"hold\" | \"boost\" | \"suppress\";\nexport type UtilityTelemetryOutcome = \"helpful\" | \"neutral\" | \"harmful\";\n\nexport interface UtilityTelemetryEvent {\n  schemaVersion: 1;\n  eventId: string;\n  recordedAt: string;\n  sessionKey: string;\n  source: UtilityTelemetrySource;\n  target: UtilityTelemetryTarget;\n  decision: UtilityTelemetryDecision;\n  outcome: UtilityTelemetryOutcome;\n  utilityScore: number;\n  summary: string;\n  memoryIds?: string[];\n  entityRefs?: string[];\n  tags?: string[];\n  metadata?: Record<string, string>;\n}\n\nexport interface UtilityTelemetryStatus {\n  enabled: boolean;\n  promotionByOutcomeEnabled: boolean;\n  rootDir: string;\n  eventsDir: string;\n  events: {\n    total: number;\n    valid: number;\n    invalid: number;\n    byTarget: Partial<Record<UtilityTelemetryTarget, number>>;\n    byDecision: Partial<Record<UtilityTelemetryDecision, number>>;\n    byOutcome: Partial<Record<UtilityTelemetryOutcome, number>>;\n    latestEventId?: string;\n    latestRecordedAt?: string;\n    latestSessionKey?: string;\n  };\n  latestEvent?: UtilityTelemetryEvent;\n  invalidEvents: Array<{\n    path: string;\n    error: string;\n  }>;\n}\n\nexport function resolveUtilityTelemetryDir(memoryDir: string, overrideDir?: string): string {\n  if (typeof overrideDir === \"string\" && overrideDir.trim().length > 0) {\n    return overrideDir.trim();\n  }\n  return path.join(memoryDir, \"state\", \"utility-telemetry\");\n}\n\nfunction assertUtilityScore(value: unknown): number {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) {\n    throw new Error(\"utilityScore must be a finite number\");\n  }\n  if (value < -1 || value > 1) {\n    throw new Error(\"utilityScore must be between -1 and 1\");\n  }\n  return value;\n}\n\nexport function validateUtilityTelemetryEvent(raw: unknown): UtilityTelemetryEvent {\n  if (!isRecord(raw)) throw new Error(\"utility telemetry event must be an object\");\n  if (raw.schemaVersion !== 1) throw new Error(\"schemaVersion must be 1\");\n\n  const source = assertString(raw.source, \"source\");\n  if (![\"cli\", \"system\", \"benchmark\", \"tool_result\"].includes(source)) {\n    throw new Error(\"source must be one of cli|system|benchmark|tool_result\");\n  }\n\n  const target = assertString(raw.target, \"target\");\n  if (![\"promotion\", \"ranking\"].includes(target)) {\n    throw new Error(\"target must be one of promotion|ranking\");\n  }\n\n  const decision = assertString(raw.decision, \"decision\");\n  if (![\"promote\", \"demote\", \"hold\", \"boost\", \"suppress\"].includes(decision)) {\n    throw new Error(\"decision must be one of promote|demote|hold|boost|suppress\");\n  }\n\n  const outcome = assertString(raw.outcome, \"outcome\");\n  if (![\"helpful\", \"neutral\", \"harmful\"].includes(outcome)) {\n    throw new Error(\"outcome must be one of helpful|neutral|harmful\");\n  }\n\n  return {\n    schemaVersion: 1,\n    eventId: assertSafePathSegment(assertString(raw.eventId, \"eventId\"), \"eventId\"),\n    recordedAt: assertIsoRecordedAt(assertString(raw.recordedAt, \"recordedAt\")),\n    sessionKey: assertString(raw.sessionKey, \"sessionKey\"),\n    source: source as UtilityTelemetrySource,\n    target: target as UtilityTelemetryTarget,\n    decision: decision as UtilityTelemetryDecision,\n    outcome: outcome as UtilityTelemetryOutcome,\n    utilityScore: assertUtilityScore(raw.utilityScore),\n    summary: assertString(raw.summary, \"summary\"),\n    memoryIds: optionalStringArray(raw.memoryIds, \"memoryIds\"),\n    entityRefs: optionalStringArray(raw.entityRefs, \"entityRefs\"),\n    tags: optionalStringArray(raw.tags, \"tags\"),\n    metadata: validateStringRecord(raw.metadata, \"metadata\"),\n  };\n}\n\nexport async function recordUtilityTelemetryEvent(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n  event: UtilityTelemetryEvent;\n}): Promise<string> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const validated = validateUtilityTelemetryEvent(options.event);\n  const day = recordStoreDay(validated.recordedAt);\n  const eventsDir = path.join(rootDir, \"events\", day);\n  const filePath = path.join(eventsDir, `${validated.eventId}.json`);\n  await mkdir(eventsDir, { recursive: true });\n  await writeFile(filePath, JSON.stringify(validated, null, 2), { encoding: \"utf8\", flag: \"wx\" });\n  return filePath;\n}\n\nexport async function readUtilityTelemetryEvents(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n}): Promise<{\n  files: string[];\n  events: UtilityTelemetryEvent[];\n  invalidEvents: Array<{ path: string; error: string }>;\n}> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const files = await listJsonFiles(path.join(rootDir, \"events\"));\n  const events: UtilityTelemetryEvent[] = [];\n  const invalidEvents: Array<{ path: string; error: string }> = [];\n  for (const filePath of files) {\n    try {\n      events.push(validateUtilityTelemetryEvent(await readJsonFile(filePath)));\n    } catch (error) {\n      invalidEvents.push({\n        path: filePath,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { files, events, invalidEvents };\n}\n\nexport async function getUtilityTelemetryStatus(options: {\n  memoryDir: string;\n  utilityTelemetryDir?: string;\n  enabled: boolean;\n  promotionByOutcomeEnabled?: boolean;\n}): Promise<UtilityTelemetryStatus> {\n  const rootDir = resolveUtilityTelemetryDir(options.memoryDir, options.utilityTelemetryDir);\n  const eventsDir = path.join(rootDir, \"events\");\n  if (!options.enabled) {\n    return {\n      enabled: false,\n      promotionByOutcomeEnabled: options.promotionByOutcomeEnabled === true,\n      rootDir,\n      eventsDir,\n      events: {\n        total: 0,\n        valid: 0,\n        invalid: 0,\n        byTarget: {},\n        byDecision: {},\n        byOutcome: {},\n      },\n      invalidEvents: [],\n    };\n  }\n\n  const { files, events, invalidEvents } = await readUtilityTelemetryEvents(options);\n  events.sort((a, b) => b.recordedAt.localeCompare(a.recordedAt));\n\n  const byTarget: Partial<Record<UtilityTelemetryTarget, number>> = {};\n  const byDecision: Partial<Record<UtilityTelemetryDecision, number>> = {};\n  const byOutcome: Partial<Record<UtilityTelemetryOutcome, number>> = {};\n  for (const event of events) {\n    byTarget[event.target] = (byTarget[event.target] ?? 0) + 1;\n    byDecision[event.decision] = (byDecision[event.decision] ?? 0) + 1;\n    byOutcome[event.outcome] = (byOutcome[event.outcome] ?? 0) + 1;\n  }\n\n  return {\n    enabled: true,\n    promotionByOutcomeEnabled: options.promotionByOutcomeEnabled === true,\n    rootDir,\n    eventsDir,\n    events: {\n      total: files.length,\n      valid: events.length,\n      invalid: invalidEvents.length,\n      byTarget,\n      byDecision,\n      byOutcome,\n      latestEventId: events[0]?.eventId,\n      latestRecordedAt: events[0]?.recordedAt,\n      latestSessionKey: events[0]?.sessionKey,\n    },\n    latestEvent: events[0],\n    invalidEvents,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,iBAAiB;AAyD1B,SAAS,2BAA2B,WAAmB,aAA8B;AAC1F,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,SAAO,KAAK,KAAK,WAAW,SAAS,mBAAmB;AAC1D;AAEA,SAAS,mBAAmB,OAAwB;AAClD,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC3B,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,KAAqC;AACjF,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,2CAA2C;AAC/E,MAAI,IAAI,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAEtE,QAAM,SAAS,aAAa,IAAI,QAAQ,QAAQ;AAChD,MAAI,CAAC,CAAC,OAAO,UAAU,aAAa,aAAa,EAAE,SAAS,MAAM,GAAG;AACnE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,SAAS,aAAa,IAAI,QAAQ,QAAQ;AAChD,MAAI,CAAC,CAAC,aAAa,SAAS,EAAE,SAAS,MAAM,GAAG;AAC9C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,WAAW,aAAa,IAAI,UAAU,UAAU;AACtD,MAAI,CAAC,CAAC,WAAW,UAAU,QAAQ,SAAS,UAAU,EAAE,SAAS,QAAQ,GAAG;AAC1E,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,QAAM,UAAU,aAAa,IAAI,SAAS,SAAS;AACnD,MAAI,CAAC,CAAC,WAAW,WAAW,SAAS,EAAE,SAAS,OAAO,GAAG;AACxD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,SAAS,sBAAsB,aAAa,IAAI,SAAS,SAAS,GAAG,SAAS;AAAA,IAC9E,YAAY,oBAAoB,aAAa,IAAI,YAAY,YAAY,CAAC;AAAA,IAC1E,YAAY,aAAa,IAAI,YAAY,YAAY;AAAA,IACrD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,mBAAmB,IAAI,YAAY;AAAA,IACjD,SAAS,aAAa,IAAI,SAAS,SAAS;AAAA,IAC5C,WAAW,oBAAoB,IAAI,WAAW,WAAW;AAAA,IACzD,YAAY,oBAAoB,IAAI,YAAY,YAAY;AAAA,IAC5D,MAAM,oBAAoB,IAAI,MAAM,MAAM;AAAA,IAC1C,UAAU,qBAAqB,IAAI,UAAU,UAAU;AAAA,EACzD;AACF;AAEA,eAAsB,4BAA4B,SAI9B;AAClB,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,YAAY,8BAA8B,QAAQ,KAAK;AAC7D,QAAM,MAAM,eAAe,UAAU,UAAU;AAC/C,QAAM,YAAY,KAAK,KAAK,SAAS,UAAU,GAAG;AAClD,QAAM,WAAW,KAAK,KAAK,WAAW,GAAG,UAAU,OAAO,OAAO;AACjE,QAAM,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAC1C,QAAM,UAAU,UAAU,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC;AAC9F,SAAO;AACT;AAEA,eAAsB,2BAA2B,SAO9C;AACD,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,QAAQ,MAAM,cAAc,KAAK,KAAK,SAAS,QAAQ,CAAC;AAC9D,QAAM,SAAkC,CAAC;AACzC,QAAM,gBAAwD,CAAC;AAC/D,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,aAAO,KAAK,8BAA8B,MAAM,aAAa,QAAQ,CAAC,CAAC;AAAA,IACzE,SAAS,OAAO;AACd,oBAAc,KAAK;AAAA,QACjB,MAAM;AAAA,QACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,OAAO,QAAQ,cAAc;AACxC;AAEA,eAAsB,0BAA0B,SAKZ;AAClC,QAAM,UAAU,2BAA2B,QAAQ,WAAW,QAAQ,mBAAmB;AACzF,QAAM,YAAY,KAAK,KAAK,SAAS,QAAQ;AAC7C,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,2BAA2B,QAAQ,8BAA8B;AAAA,MACjE;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,QACN,OAAO;AAAA,QACP,OAAO;AAAA,QACP,SAAS;AAAA,QACT,UAAU,CAAC;AAAA,QACX,YAAY,CAAC;AAAA,QACb,WAAW,CAAC;AAAA,MACd;AAAA,MACA,eAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,EAAE,OAAO,QAAQ,cAAc,IAAI,MAAM,2BAA2B,OAAO;AACjF,SAAO,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AAE9D,QAAM,WAA4D,CAAC;AACnE,QAAM,aAAgE,CAAC;AACvE,QAAM,YAA8D,CAAC;AACrE,aAAW,SAAS,QAAQ;AAC1B,aAAS,MAAM,MAAM,KAAK,SAAS,MAAM,MAAM,KAAK,KAAK;AACzD,eAAW,MAAM,QAAQ,KAAK,WAAW,MAAM,QAAQ,KAAK,KAAK;AACjE,cAAU,MAAM,OAAO,KAAK,UAAU,MAAM,OAAO,KAAK,KAAK;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,2BAA2B,QAAQ,8BAA8B;AAAA,IACjE;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,MACN,OAAO,MAAM;AAAA,MACb,OAAO,OAAO;AAAA,MACd,SAAS,cAAc;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,MACA,eAAe,OAAO,CAAC,GAAG;AAAA,MAC1B,kBAAkB,OAAO,CAAC,GAAG;AAAA,MAC7B,kBAAkB,OAAO,CAAC,GAAG;AAAA,IAC/B;AAAA,IACA,aAAa,OAAO,CAAC;AAAA,IACrB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-MXC3AP5I.js → chunk-TGQ2NTWH.js}

@@ -1,5 +1,5 @@
 // src/resolve-auth-token.ts
-var resolvedCache = /* @__PURE__ */ new Map();
+var resolvedCache = /* @__PURE__ */ new WeakMap();
 function cacheKeyForSecretRef(ref) {
   const sortedKeys = Object.keys(ref).sort();
   const stable = {};
@@ -28,15 +28,20 @@ async function resolveAgentAccessAuthToken(value, options = {}) {
       "unsupported SecretRef shape for agentAccessHttp.authToken \u2014 missing required `source` field (see https://github.com/joshuaswarren/remnic/issues/757)"
     );
   }
-  const cacheKey = cacheKeyForSecretRef(ref);
-  const cached = resolvedCache.get(cacheKey);
-  if (cached !== void 0) return cached;
   const resolver = options.resolveSecretRef ?? null;
   if (!resolver) {
     throw new Error(
       `cannot resolve agentAccessHttp.authToken SecretRef (source="${ref.source}") \u2014 a SecretRef resolver was not provided. Use a literal string or \${ENV_VAR} expansion in standalone Remnic, or have the host adapter resolve SecretRef objects through its native secret resolver (see https://github.com/joshuaswarren/remnic/issues/757).`
     );
   }
+  const cacheKey = cacheKeyForSecretRef(ref);
+  let resolverCache = resolvedCache.get(resolver);
+  if (!resolverCache) {
+    resolverCache = /* @__PURE__ */ new Map();
+    resolvedCache.set(resolver, resolverCache);
+  }
+  const cached = resolverCache.get(cacheKey);
+  if (cached !== void 0) return cached;
   let resolved;
   try {
     const out = await resolver(ref);
@@ -54,7 +59,7 @@ async function resolveAgentAccessAuthToken(value, options = {}) {
       `agentAccessHttp.authToken SecretRef resolved to empty value (source="${ref.source}", provider="${ref.provider ?? ""}") \u2014 refusing to start the HTTP bridge with an empty bearer token.`
     );
   }
-  resolvedCache.set(cacheKey, resolved);
+  resolverCache.set(cacheKey, resolved);
   return resolved;
 }
 function isAgentAccessSecretRef(value) {
@@ -63,7 +68,7 @@ function isAgentAccessSecretRef(value) {
   return typeof ref.source === "string" && ref.source.trim().length > 0;
 }
 function clearAuthTokenSecretCache() {
-  resolvedCache.clear();
+  resolvedCache = /* @__PURE__ */ new WeakMap();
 }
 
 export {
@@ -71,4 +76,4 @@ export {
   isAgentAccessSecretRef,
   clearAuthTokenSecretCache
 };
-//# sourceMappingURL=chunk-MXC3AP5I.js.map
+//# sourceMappingURL=chunk-TGQ2NTWH.js.map

package/dist/chunk-TGQ2NTWH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve-auth-token.ts"],"sourcesContent":["import type { AgentAccessAuthToken, SecretRef } from \"./types.js\";\n\n/**\n * Resolve `agentAccessHttp.authToken` (issue #757).\n *\n * Two shapes are accepted:\n *\n *   1. Plain string — returned unchanged. This is the only shape supported\n *      in standalone Remnic; it preserves backward compatibility with every\n *      pre-#757 config.\n *\n *   2. SecretRef-like object (`{source, provider?, id?, command?, ...}`) —\n *      resolved only through a resolver supplied by the host adapter. Core\n *      stays host-agnostic and never scans OpenClaw, Hermes, or any other\n *      runtime directly.\n *\n * Resolution flow for SecretRef objects:\n *\n *   - Plain strings short-circuit before any host work.\n *   - Host adapters pass their native SecretRef resolver in `options`.\n *   - If no resolver is provided, throw a clear, actionable error rather\n *     than silently leaving the bridge open or starting with no auth.\n *\n * Lessons baked in from PRs #316–#319:\n *\n *   - Successful resolutions are cached for the process lifetime; failures\n *     are not cached so transient issues (Keychain unlocked late, agent\n *     restarts) recover automatically.\n */\n\nexport type ResolveSecretRefFn = (\n  ref: SecretRef,\n  context?: unknown,\n) => Promise<string | undefined> | string | undefined;\n\ntype ResolveAgentAccessAuthTokenOptions = {\n  resolveSecretRef?: ResolveSecretRefFn | null;\n};\n\nlet resolvedCache = new WeakMap<ResolveSecretRefFn, Map<string, string>>();\n\n/**\n * SecretRef objects are stable per (source, provider, id, command) tuple.\n * Sort keys before serializing so semantically-identical refs hit the same\n * cache slot regardless of authoring order (Lesson 38 in CLAUDE.md).\n */\nfunction cacheKeyForSecretRef(ref: SecretRef): string {\n  const sortedKeys = Object.keys(ref).sort();\n  const stable: Record<string, unknown> = {};\n  for (const key of sortedKeys) {\n    stable[key] = ref[key];\n  }\n  return JSON.stringify(stable);\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * Resolve an `agentAccessHttp.authToken` value to a literal bearer string.\n *\n * @returns the resolved string, or `undefined` if input was undefined/empty.\n * @throws if the input is a SecretRef and no resolver is provided, if the\n *         resolver returns no value, or if the input shape is malformed.\n */\nexport async function resolveAgentAccessAuthToken(\n  value: AgentAccessAuthToken | undefined,\n  options: ResolveAgentAccessAuthTokenOptions = {},\n): Promise<string | undefined> {\n  if (value === undefined || value === null) return undefined;\n\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    return trimmed.length > 0 ? trimmed : undefined;\n  }\n\n  if (!isPlainObject(value)) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"expected a string or an object with a `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const ref = value as SecretRef;\n  if (typeof ref.source !== \"string\" || ref.source.trim().length === 0) {\n    throw new Error(\n      \"unsupported SecretRef shape for agentAccessHttp.authToken — \" +\n        \"missing required `source` field \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757)\",\n    );\n  }\n\n  const resolver = options.resolveSecretRef ?? null;\n  if (!resolver) {\n    throw new Error(\n      `cannot resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\") — ` +\n        \"a SecretRef resolver was not provided. Use a literal string or \" +\n        \"${ENV_VAR} expansion in standalone Remnic, or have the host adapter \" +\n        \"resolve SecretRef objects through its native secret resolver \" +\n        \"(see https://github.com/joshuaswarren/remnic/issues/757).\",\n    );\n  }\n\n  const cacheKey = cacheKeyForSecretRef(ref);\n  let resolverCache = resolvedCache.get(resolver);\n  if (!resolverCache) {\n    resolverCache = new Map<string, string>();\n    resolvedCache.set(resolver, resolverCache);\n  }\n  const cached = resolverCache.get(cacheKey);\n  if (cached !== undefined) return cached;\n\n  let resolved: string | undefined;\n  try {\n    const out = await resolver(ref);\n    if (typeof out === \"string\") {\n      const trimmed = out.trim();\n      if (trimmed.length > 0) resolved = trimmed;\n    }\n  } catch (err) {\n    throw new Error(\n      `failed to resolve agentAccessHttp.authToken SecretRef (source=\"${ref.source}\"): ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    );\n  }\n\n  if (!resolved) {\n    throw new Error(\n      `agentAccessHttp.authToken SecretRef resolved to empty value (source=\"${ref.source}\", provider=\"${\n        ref.provider ?? \"\"\n      }\") — refusing to start the HTTP bridge with an empty bearer token.`,\n    );\n  }\n\n  resolverCache.set(cacheKey, resolved);\n  return resolved;\n}\n\n/**\n * Returns true if the value is a SecretRef object (issue #757). Useful for\n * surfaces (CLI flags, doctor checks) that want to render a redacted\n * placeholder instead of leaking the unresolved object shape.\n */\nexport function isAgentAccessSecretRef(value: unknown): value is SecretRef {\n  if (!isPlainObject(value)) return false;\n  const ref = value as Record<string, unknown>;\n  return typeof ref.source === \"string\" && ref.source.trim().length > 0;\n}\n\n/** Test/operations hook: drop the cache and force resolver rediscovery. */\nexport function clearAuthTokenSecretCache(): void {\n  resolvedCache = new WeakMap<ResolveSecretRefFn, Map<string, string>>();\n}\n"],"mappings":";AAuCA,IAAI,gBAAgB,oBAAI,QAAiD;AAOzE,SAAS,qBAAqB,KAAwB;AACpD,QAAM,aAAa,OAAO,KAAK,GAAG,EAAE,KAAK;AACzC,QAAM,SAAkC,CAAC;AACzC,aAAW,OAAO,YAAY;AAC5B,WAAO,GAAG,IAAI,IAAI,GAAG;AAAA,EACvB;AACA,SAAO,KAAK,UAAU,MAAM;AAC9B;AAEA,SAAS,cAAc,OAAkD;AACvE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AASA,eAAsB,4BACpB,OACA,UAA8C,CAAC,GAClB;AAC7B,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAElD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,WAAO,QAAQ,SAAS,IAAI,UAAU;AAAA,EACxC;AAEA,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AACpE,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,oBAAoB;AAC7C,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,+DAA+D,IAAI,MAAM;AAAA,IAK3E;AAAA,EACF;AAEA,QAAM,WAAW,qBAAqB,GAAG;AACzC,MAAI,gBAAgB,cAAc,IAAI,QAAQ;AAC9C,MAAI,CAAC,eAAe;AAClB,oBAAgB,oBAAI,IAAoB;AACxC,kBAAc,IAAI,UAAU,aAAa;AAAA,EAC3C;AACA,QAAM,SAAS,cAAc,IAAI,QAAQ;AACzC,MAAI,WAAW,OAAW,QAAO;AAEjC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,GAAG;AAC9B,QAAI,OAAO,QAAQ,UAAU;AAC3B,YAAM,UAAU,IAAI,KAAK;AACzB,UAAI,QAAQ,SAAS,EAAG,YAAW;AAAA,IACrC;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,kEAAkE,IAAI,MAAM,OAC1E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,wEAAwE,IAAI,MAAM,gBAChF,IAAI,YAAY,EAClB;AAAA,IACF;AAAA,EACF;AAEA,gBAAc,IAAI,UAAU,QAAQ;AACpC,SAAO;AACT;AAOO,SAAS,uBAAuB,OAAoC;AACzE,MAAI,CAAC,cAAc,KAAK,EAAG,QAAO;AAClC,QAAM,MAAM;AACZ,SAAO,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,KAAK,EAAE,SAAS;AACtE;AAGO,SAAS,4BAAkC;AAChD,kBAAgB,oBAAI,QAAiD;AACvE;","names":[]}

package/dist/{chunk-3Y4P7RXM.js → chunk-TMSXWOBZ.js}

@@ -1,6 +1,6 @@
 import {
   headerValue
-} from "./chunk-FAJ7FZYM.js";
+} from "./chunk-7RXCMVFQ.js";
 
 // src/adapters/replit.ts
 var ReplitAdapter = class {
@@ -14,11 +14,10 @@ var ReplitAdapter = class {
   }
   resolveIdentity(context) {
     const mcpSessionId = headerValue(context.headers, "mcp-session-id");
-    const principal = headerValue(context.headers, "x-engram-principal") || "replit-agent";
     const namespace = headerValue(context.headers, "x-engram-namespace") || "replit";
     return {
       namespace,
-      principal,
+      principal: "replit-agent",
       sessionKey: mcpSessionId ?? context.sessionKey,
       adapterId: this.id
     };
@@ -28,4 +27,4 @@ var ReplitAdapter = class {
 export {
   ReplitAdapter
 };
-//# sourceMappingURL=chunk-3Y4P7RXM.js.map
+//# sourceMappingURL=chunk-TMSXWOBZ.js.map

package/dist/chunk-TMSXWOBZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/replit.ts"],"sourcesContent":["import { headerValue, type AdapterContext, type EngramAdapter, type ResolvedIdentity } from \"./types.js\";\n\n/**\n * Replit Agent adapter.\n *\n * Detection: Replit Agent supports MCP natively (HTTP-only, configured\n * via the Integrations pane). It does NOT send identifying headers\n * automatically — detection relies on user-configured custom headers\n * in Replit's MCP Integrations UI.\n *\n * Replit provides env vars to running code (REPL_ID, REPL_OWNER,\n * REPL_SLUG) but these are NOT sent as HTTP headers to MCP servers.\n *\n * To identify Replit connections, users should configure a custom header\n * in the Replit Integrations pane when adding the Engram MCP server:\n *   Header Name: X-Engram-Client-Id\n *   Header Value: replit\n *\n * Optionally also set X-Engram-Namespace for project scoping. Principal\n * overrides are intentionally handled only by the HTTP server's\n * trustPrincipalHeader gate. Adapters must not independently trust\n * X-Engram-Principal.\n */\nexport class ReplitAdapter implements EngramAdapter {\n  readonly id = \"replit\";\n\n  matches(context: AdapterContext): boolean {\n    // Primary: user-configured client identifier header\n    const clientId = headerValue(context.headers, \"x-engram-client-id\");\n    if (clientId?.toLowerCase() === \"replit\") return true;\n\n    // MCP clientInfo (Replit's MCP client name is not publicly documented,\n    // but check for it in case it becomes available)\n    const clientName = context.clientInfo?.name?.toLowerCase() ?? \"\";\n    if (clientName.includes(\"replit\")) return true;\n\n    return false;\n  }\n\n  resolveIdentity(context: AdapterContext): ResolvedIdentity {\n    const mcpSessionId = headerValue(context.headers, \"mcp-session-id\");\n\n    const namespace = headerValue(context.headers, \"x-engram-namespace\")\n      || \"replit\";\n\n    return {\n      namespace,\n      principal: \"replit-agent\",\n      sessionKey: mcpSessionId ?? context.sessionKey,\n      adapterId: this.id,\n    };\n  }\n}\n"],"mappings":";;;;;AAuBO,IAAM,gBAAN,MAA6C;AAAA,EACzC,KAAK;AAAA,EAEd,QAAQ,SAAkC;AAExC,UAAM,WAAW,YAAY,QAAQ,SAAS,oBAAoB;AAClE,QAAI,UAAU,YAAY,MAAM,SAAU,QAAO;AAIjD,UAAM,aAAa,QAAQ,YAAY,MAAM,YAAY,KAAK;AAC9D,QAAI,WAAW,SAAS,QAAQ,EAAG,QAAO;AAE1C,WAAO;AAAA,EACT;AAAA,EAEA,gBAAgB,SAA2C;AACzD,UAAM,eAAe,YAAY,QAAQ,SAAS,gBAAgB;AAElE,UAAM,YAAY,YAAY,QAAQ,SAAS,oBAAoB,KAC9D;AAEL,WAAO;AAAA,MACL;AAAA,MACA,WAAW;AAAA,MACX,YAAY,gBAAgB,QAAQ;AAAA,MACpC,WAAW,KAAK;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-3ZLVGM76.js → chunk-TTGZV5R3.js}

@@ -5,25 +5,28 @@ import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_WIDGET_URI,
   buildChatGptMemoryInspectorActionRequest,
   buildChatGptMemoryInspectorResult
-} from "./chunk-C5BCH4ZS.js";
+} from "./chunk-EAZGEEG2.js";
 import {
   buildCitationGuidance
-} from "./chunk-IQT3XTKW.js";
+} from "./chunk-D24OXEPB.js";
 import {
   EngramAccessInputError
-} from "./chunk-ZAVUCJ4H.js";
+} from "./chunk-5V456VRV.js";
+import {
+  projectTagProjectId
+} from "./chunk-EDQVAMQI.js";
 import {
   validateBriefingFormat
-} from "./chunk-SIC6U3GZ.js";
+} from "./chunk-YHV3KRKS.js";
 import {
   expandTildePath
-} from "./chunk-QRNI5JBH.js";
+} from "./chunk-EYIEWJNI.js";
 import {
   readEnvVar
-} from "./chunk-XIG5PDM7.js";
+} from "./chunk-JUC24CTX.js";
 import {
   validateRequest
-} from "./chunk-YROHKYBY.js";
+} from "./chunk-5UHVGNZD.js";
 
 // src/access-mcp.ts
 import { readFile } from "fs/promises";
@@ -49,6 +52,34 @@ function resolveChatGptInspectorRecallSessionKey(explicitSessionKey, authenticat
   return `remnic:chatgpt-memory-inspector:${randomUUID()}`;
 }
 var STRICT_MCP_SCHEMA_KEYS = {
+  memoryStore: [
+    "schemaVersion",
+    "idempotencyKey",
+    "dryRun",
+    "sessionKey",
+    "content",
+    "category",
+    "confidence",
+    "namespace",
+    "tags",
+    "entityRef",
+    "ttl",
+    "sourceReason"
+  ],
+  suggestionSubmit: [
+    "schemaVersion",
+    "idempotencyKey",
+    "dryRun",
+    "sessionKey",
+    "content",
+    "category",
+    "confidence",
+    "namespace",
+    "tags",
+    "entityRef",
+    "ttl",
+    "sourceReason"
+  ],
   capsuleExport: [
     "name",
     "namespace",
@@ -58,7 +89,7 @@ var STRICT_MCP_SCHEMA_KEYS = {
     "includeTranscripts",
     "encrypt"
   ],
-  capsuleImport: ["archivePath", "namespace", "mode"],
+  capsuleImport: ["archivePath", "namespace", "mode", "passphrase"],
   capsuleList: ["namespace"]
 };
 function parseMcpRequest(schemaName, args) {
@@ -79,6 +110,9 @@ function parseMcpRequest(schemaName, args) {
     details.length > 0 ? `${validation.error.error}: ${details}` : validation.error.error
   );
 }
+function getObjectProperties(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
 async function getMcpServerVersion() {
   const envVersion = readEnvVar("OPENCLAW_ENGRAM_VERSION")?.trim() || readEnvVar("npm_package_version")?.trim();
   if (envVersion) return envVersion;
@@ -476,6 +510,10 @@ var EngramMcpServer = class {
               type: "string",
               enum: ["skip", "overwrite", "fork"],
               description: "Conflict handling mode. Defaults to skip."
+            },
+            passphrase: {
+              type: "string",
+              description: "Passphrase for encrypted capsule archives."
             }
           },
           required: ["archivePath"],
@@ -721,6 +759,7 @@ var EngramMcpServer = class {
           properties: {
             query: { type: "string", description: "Search query" },
             sessionKey: { type: "string", description: "Optional session filter" },
+            sessionPrefix: { type: "string", description: "Optional session prefix filter" },
             namespace: { type: "string" },
             limit: { type: "number", description: "Max results to return" }
           },
@@ -1692,6 +1731,13 @@ var EngramMcpServer = class {
           }
           argumentsObject = params.arguments;
         }
+        if (!("namespace" in argumentsObject) && options?.namespaceOverride && this.toolAcceptsArgument(name, "namespace")) {
+          argumentsObject = { ...argumentsObject, namespace: options.namespaceOverride };
+        }
+        const skipSessionKeyOverride = toLegacyToolName(name) === "engram.lcm_search" && typeof argumentsObject.sessionPrefix === "string" && argumentsObject.sessionPrefix.length > 0;
+        if (!("sessionKey" in argumentsObject) && !skipSessionKeyOverride && options?.sessionKeyOverride && this.toolAcceptsArgument(name, "sessionKey")) {
+          argumentsObject = { ...argumentsObject, sessionKey: options.sessionKeyOverride };
+        }
         const effectivePrincipal = options?.principalOverride ?? this.authenticatedPrincipal;
         const result = await this.callTool(name, argumentsObject, effectivePrincipal, options?.sessionId);
         return {
@@ -1806,6 +1852,15 @@ var EngramMcpServer = class {
 ${body}`;
     output.write(message);
   }
+  toolAcceptsArgument(name, key) {
+    const tool = this.tools.find((entry) => entry.name === name);
+    const inputSchema = getObjectProperties(tool?.inputSchema);
+    const properties = getObjectProperties(inputSchema?.properties);
+    if (properties && Object.prototype.hasOwnProperty.call(properties, key)) {
+      return true;
+    }
+    return inputSchema?.additionalProperties === true;
+  }
   /**
    * Determine whether oai-mem-citation guidance should be appended to recall.
    * Returns true when explicitly enabled via config OR when auto-detect is
@@ -1924,12 +1979,13 @@ ${body}`;
         const hasCodingContext = "codingContext" in args;
         if (!hasCodingContext && hasProjectTag) {
           const tag = args.projectTag.trim();
+          const projectId = projectTagProjectId(tag);
           this.service.setCodingContext({
             sessionKey,
             codingContext: {
-              projectId: `tag:${tag}`,
+              projectId,
               branch: null,
-              rootPath: `tag:${tag}`,
+              rootPath: projectId,
               defaultBranch: null
             }
           });
@@ -2106,7 +2162,8 @@ ${body}`;
           archivePath: expandTildePath(body.archivePath),
           namespace: body.namespace,
           principal: effectivePrincipal,
-          mode: body.mode
+          mode: body.mode,
+          passphrase: body.passphrase
         });
       }
       case "engram.capsule_list": {
@@ -2165,38 +2222,42 @@ ${body}`;
           effectivePrincipal
         );
       }
-      case "engram.memory_store":
+      case "engram.memory_store": {
+        const body = parseMcpRequest("memoryStore", args);
         return this.service.memoryStore({
-          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
-          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
-          dryRun: args.dryRun === true,
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          schemaVersion: body.schemaVersion,
+          idempotencyKey: body.idempotencyKey,
+          dryRun: body.dryRun,
+          sessionKey: body.sessionKey,
           authenticatedPrincipal: effectivePrincipal,
-          content: typeof args.content === "string" ? args.content : "",
-          category: typeof args.category === "string" ? args.category : void 0,
-          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
-          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
-          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
-          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
-          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
+          content: body.content,
+          category: body.category,
+          confidence: body.confidence,
+          namespace: body.namespace,
+          tags: body.tags,
+          entityRef: body.entityRef,
+          ttl: body.ttl,
+          sourceReason: body.sourceReason
         });
-      case "engram.suggestion_submit":
+      }
+      case "engram.suggestion_submit": {
+        const body = parseMcpRequest("suggestionSubmit", args);
         return this.service.suggestionSubmit({
-          schemaVersion: typeof args.schemaVersion === "number" ? args.schemaVersion : void 0,
-          idempotencyKey: typeof args.idempotencyKey === "string" ? args.idempotencyKey : void 0,
-          dryRun: args.dryRun === true,
-          sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          schemaVersion: body.schemaVersion,
+          idempotencyKey: body.idempotencyKey,
+          dryRun: body.dryRun,
+          sessionKey: body.sessionKey,
           authenticatedPrincipal: effectivePrincipal,
-          content: typeof args.content === "string" ? args.content : "",
-          category: typeof args.category === "string" ? args.category : void 0,
-          confidence: typeof args.confidence === "number" ? args.confidence : void 0,
-          namespace: typeof args.namespace === "string" ? args.namespace : void 0,
-          tags: Array.isArray(args.tags) ? args.tags.filter((tag) => typeof tag === "string") : void 0,
-          entityRef: typeof args.entityRef === "string" ? args.entityRef : void 0,
-          ttl: typeof args.ttl === "string" ? args.ttl : void 0,
-          sourceReason: typeof args.sourceReason === "string" ? args.sourceReason : void 0
+          content: body.content,
+          category: body.category,
+          confidence: body.confidence,
+          namespace: body.namespace,
+          tags: body.tags,
+          entityRef: body.entityRef,
+          ttl: body.ttl,
+          sourceReason: body.sourceReason
         });
+      }
       case "engram.entity_get":
         return this.service.entityGet(
           typeof args.name === "string" ? args.name : "",
@@ -2230,6 +2291,7 @@ ${body}`;
         return this.service.lcmSearch({
           query: typeof args.query === "string" ? args.query : "",
           sessionKey: typeof args.sessionKey === "string" ? args.sessionKey : void 0,
+          sessionPrefix: typeof args.sessionPrefix === "string" ? args.sessionPrefix : void 0,
           namespace: typeof args.namespace === "string" ? args.namespace : void 0,
           limit: typeof args.limit === "number" && Number.isFinite(args.limit) ? args.limit : void 0,
           authenticatedPrincipal: effectivePrincipal
@@ -2565,7 +2627,7 @@ ${body}`;
         const {
           isDefaultReviewNamespace,
           listPairs
-        } = await import("./contradiction-review-ATP4S6IC.js");
+        } = await import("./contradiction-review-6V2LXXK6.js");
         const VALID_REVIEW_FILTERS = /* @__PURE__ */ new Set(["all", "unresolved", "contradicts", "independent", "duplicates", "needs-user"]);
         const rawFilter = typeof args.filter === "string" ? args.filter : "unresolved";
         if (!VALID_REVIEW_FILTERS.has(rawFilter)) {
@@ -2592,9 +2654,9 @@ ${body}`;
         const verb = typeof args.verb === "string" ? args.verb : "";
         if (!pairId) throw new Error("pairId is required");
         if (!verb) throw new Error("verb is required");
-        const { isValidResolutionVerb } = await import("./resolution-B7FNQSSP.js");
+        const { isValidResolutionVerb } = await import("./resolution-ZY7VM6WS.js");
         if (!isValidResolutionVerb(verb)) throw new Error(`Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context`);
-        const { executeResolution } = await import("./resolution-B7FNQSSP.js");
+        const { executeResolution } = await import("./resolution-ZY7VM6WS.js");
         return executeResolution(this.service.memoryDir, this.service.storageRef, pairId, verb, {
           mergedMemoryId: typeof args.mergedMemoryId === "string" ? args.mergedMemoryId : void 0,
           mergedContent: typeof args.mergedContent === "string" ? args.mergedContent : void 0,
@@ -2606,7 +2668,7 @@ ${body}`;
       }
       case "engram.contradiction_scan_run":
       case "remnic.contradiction_scan_run": {
-        const { runContradictionScan } = await import("./contradiction-scan-5A4IDZV5.js");
+        const { runContradictionScan } = await import("./contradiction-scan-GIRVC4C7.js");
         return runContradictionScan({
           storage: this.service.storageRef,
           config: this.service.configRef,
@@ -2656,7 +2718,7 @@ ${body}`;
             reason: "graphEdgeDecayEnabled is false"
           };
         }
-        const { runGraphEdgeDecayMaintenanceAcrossNamespaces } = await import("./graph-edge-decay-5DI5GUNL.js");
+        const { runGraphEdgeDecayMaintenanceAcrossNamespaces } = await import("./graph-edge-decay-MUP5J7CC.js");
         const dryRun = args.dryRun === true;
         const results = await runGraphEdgeDecayMaintenanceAcrossNamespaces(
           this.service.memoryDir,
@@ -2745,7 +2807,7 @@ ${body}`;
       // ── Dreams telemetry (issue #678 PR 3+4) ──────────────────────────────
       case "engram.dreams_status":
       case "remnic.dreams_status": {
-        const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-LR2NBAZE.js");
+        const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-3WSCI5V4.js");
         let windowHours = 24;
         try {
           windowHours = normalizeDreamsStatusWindowHours(args.windowHours);
@@ -2797,4 +2859,4 @@ ${body}`;
 export {
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-3ZLVGM76.js.map
+//# sourceMappingURL=chunk-TTGZV5R3.js.map