@remnic/core 10.0.58 → 10.0.59

package/dist/{chunk-QS5DUSBM.js → chunk-R4BR62UO.js}

@@ -1,6 +1,6 @@
 import {
   resolveCorpusNamespaceRoots
-} from "./chunk-UQYBPPVC.js";
+} from "./chunk-5U2BBF7E.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-YO2JEX2Z.js";
@@ -200,4 +200,4 @@ async function readAggregateExtractionWatermark(options) {
 export {
   readAggregateExtractionWatermark
 };
-//# sourceMappingURL=chunk-QS5DUSBM.js.map
+//# sourceMappingURL=chunk-R4BR62UO.js.map

package/dist/{chunk-W7NKMRAF.js → chunk-RFT4OPYI.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportCreateGrantRequestSchema,
   defineOperation
-} from "./chunk-QF5EJ5VP.js";
+} from "./chunk-Y5KESB7T.js";
 import {
   SupportPassportCardCategorySchema,
   SupportPassportMemoryIdSchema,
@@ -220,4 +220,4 @@ var supportPassportGrantAskOperation = defineOperation({
     result: await ctx.service.supportPassportAskGrant(grantId, secret, question, ctx.abortSignal)
   })
 });
-//# sourceMappingURL=chunk-W7NKMRAF.js.map
+//# sourceMappingURL=chunk-RFT4OPYI.js.map

package/dist/{chunk-AO5ZOD32.js → chunk-RHJ5VGB3.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-EKUI7I2X.js";
 import {
   StorageManager
-} from "./chunk-OCXDZJL4.js";
+} from "./chunk-WXBVGKS6.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -974,4 +974,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-AO5ZOD32.js.map
+//# sourceMappingURL=chunk-RHJ5VGB3.js.map

package/dist/{chunk-FFQNNFHX.js → chunk-RYB553SS.js}

@@ -1,6 +1,6 @@
 import {
   rebuildMemoryProjection
-} from "./chunk-QAHP5SBG.js";
+} from "./chunk-JD5F5MYN.js";
 
 // src/convergence-refresh.ts
 async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, getStorage, searchEnabled) {
@@ -32,4 +32,4 @@ async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, get
 export {
   refreshConvergedNamespaces
 };
-//# sourceMappingURL=chunk-FFQNNFHX.js.map
+//# sourceMappingURL=chunk-RYB553SS.js.map

package/dist/{chunk-3632XJMR.js → chunk-TYSD7UQO.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-OCXDZJL4.js";
+} from "./chunk-WXBVGKS6.js";
 import {
   OKF_PROFILE_TYPE,
   okfTypeForMemory
@@ -272,4 +272,4 @@ export {
   exportOkfBundle,
   firstHeading
 };
-//# sourceMappingURL=chunk-3632XJMR.js.map
+//# sourceMappingURL=chunk-TYSD7UQO.js.map

package/dist/{chunk-V4VCBFAL.js → chunk-UGTYADB4.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-34UVJNSG.js";
+} from "./chunk-AMKIIRLL.js";
 import {
   StorageManager
-} from "./chunk-OCXDZJL4.js";
+} from "./chunk-WXBVGKS6.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-V4VCBFAL.js.map
+//# sourceMappingURL=chunk-UGTYADB4.js.map

package/dist/{chunk-7XGNGLAN.js → chunk-UHH67NLU.js}

@@ -1,6 +1,6 @@
 import {
   defineOperation
-} from "./chunk-QF5EJ5VP.js";
+} from "./chunk-Y5KESB7T.js";
 import {
   EngramAccessInputError
 } from "./chunk-LGEH473S.js";
@@ -92,4 +92,4 @@ defineOperation({
     };
   }
 });
-//# sourceMappingURL=chunk-7XGNGLAN.js.map
+//# sourceMappingURL=chunk-UHH67NLU.js.map

package/dist/{chunk-5LBBXI2A.js → chunk-USNU3BEQ.js}

@@ -1,6 +1,6 @@
 import {
   parseEntityFile
-} from "./chunk-OCXDZJL4.js";
+} from "./chunk-WXBVGKS6.js";
 import {
   inferMemoryStatus
 } from "./chunk-7RJUVTVF.js";
@@ -253,4 +253,4 @@ export {
   WHO_KNOWS_MCP_TOOLS,
   handleWhoKnowsHttpQuery
 };
-//# sourceMappingURL=chunk-5LBBXI2A.js.map
+//# sourceMappingURL=chunk-USNU3BEQ.js.map

package/dist/{chunk-OWNAWY6D.js → chunk-VCLNU6MY.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-OCXDZJL4.js";
+} from "./chunk-WXBVGKS6.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-OWNAWY6D.js.map
+//# sourceMappingURL=chunk-VCLNU6MY.js.map

package/dist/{chunk-3LNAQLW4.js → chunk-WASVDS6G.js}

@@ -49,10 +49,10 @@ import {
 } from "./chunk-KIUVEMBI.js";
 import {
   getOperation
-} from "./chunk-QF5EJ5VP.js";
+} from "./chunk-Y5KESB7T.js";
 import {
   WHO_KNOWS_MCP_TOOLS
-} from "./chunk-5LBBXI2A.js";
+} from "./chunk-USNU3BEQ.js";
 import {
   PROMOTION_CANDIDATES_MCP_TOOLS
 } from "./chunk-SDXBR5QO.js";
@@ -3986,4 +3986,4 @@ export {
   MCP_MIGRATED_OPERATIONS,
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-3LNAQLW4.js.map
+//# sourceMappingURL=chunk-WASVDS6G.js.map

package/dist/{chunk-OCXDZJL4.js → chunk-WXBVGKS6.js}

@@ -560,16 +560,23 @@ var MemoryReadStore = class {
   /**
    * Recursively collect `*.md` paths under `startDirs`, hardened against symlink
    * escape: a category dir symlinked outside memoryDir (e.g. decisions/ -> an
-   * external dir) must NOT pull out-of-store files into a scan (info leak). Same
-   * walker-hardening pattern as document-scanner.ts / cli.ts /
-   * consolidation-provenance-check.ts; reuses the shared containment helper.
+   * external dir) must NOT pull out-of-store files into a scan (info leak).
+   *
+   * Containment is established once, not per file: the memory root is resolved
+   * with a single `realpath`, every directory the walk enters is `lstat`ed (a
+   * symlinked or non-directory entry is never followed), and the entry TYPE
+   * comes from `readdir(withFileTypes)` — so a symlinked entry, file or
+   * directory, is skipped without a per-entry `realpath`. The old per-entry
+   * `realpath` cost one syscall per markdown file (hundreds of thousands per
+   * corpus scan) to re-derive a fact the directory-level checks already
+   * establish; reads refuse symlinked files at open time with `O_NOFOLLOW`, so
+   * a path swapped to a symlink mid-scan is refused rather than followed.
    * Paths only — no frontmatter parse.
    */
   async collectContainedMarkdownPaths(startDirs, propagateReadErrors = false, options) {
     const filePaths = [];
-    let memoryRootReal;
     try {
-      memoryRootReal = await realpath(this.deps.baseDir);
+      await realpath(this.deps.baseDir);
     } catch (err) {
       if (propagateReadErrors && isPropagatableReadError(err)) throw err;
       return filePaths;
@@ -592,7 +599,6 @@ var MemoryReadStore = class {
       }
       let entries;
       try {
-        assertPathInsideRoot(memoryRootReal, await realpath(dir), dir);
         entries = await readdir(dir, { withFileTypes: true });
       } catch (err) {
         if (propagateReadErrors && isPropagatableReadError(err)) throw err;
@@ -607,12 +613,7 @@ var MemoryReadStore = class {
         if (entry.isDirectory()) {
           subdirs.push(fullPath);
         } else if (entry.name.endsWith(".md")) {
-          try {
-            assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);
-            filePaths.push(fullPath);
-          } catch (err) {
-            if (propagateReadErrors && isPropagatableReadError(err)) throw err;
-          }
+          filePaths.push(fullPath);
         }
       }
       for (const subdir of subdirs) {
@@ -11232,4 +11233,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-OCXDZJL4.js.map
+//# sourceMappingURL=chunk-WXBVGKS6.js.map