@remnic/core 10.0.85 → 10.0.86

package/dist/access-cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/access-cli.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseConfig } from \"./config.js\";\nimport type { PluginConfig } from \"./types.js\";\nimport { Orchestrator } from \"./orchestrator.js\";\nimport { EngramAccessService } from \"./access-service.js\";\nimport { readEnvVar, resolveHomeDir } from \"./runtime/env.js\";\nimport { resolvePluginEntry } from \"./plugin-entry-resolver.js\";\nimport { expandTildePath } from \"./utils/path.js\";\nimport { getOperation } from \"./access-boundary.js\";\n// Importing access-operations registers the pilot boundary operations as a\n// side effect; the store command dispatches through the registry (issue #1525).\nimport \"./access-operations.js\";\nimport { projectTagProjectId } from \"./coding/coding-namespace.js\";\n\nconst OPENCLAW_REMNIC_PLUGIN_IDS = [\"openclaw-remnic\", \"openclaw-engram\"] as const;\n\ntype CommandName =\n  | \"browse\"\n  | \"store\"\n  | \"extraction-flush\"\n  | \"decision\"\n  | \"architecture\"\n  | \"delta\"\n  | \"correct\";\n\ntype ParsedArgs = {\n  command: CommandName;\n  options: Record<string, string[]>;\n  flags: Set<string>;\n};\n\ntype CommandSpec = {\n  valueOptions: ReadonlySet<string>;\n  flagOptions: ReadonlySet<string>;\n};\n\ntype Runtime = {\n  config: PluginConfig;\n  service: EngramAccessService;\n};\n\nexport type AccessCliOptions = {\n  /**\n   * The calling plugin's own id (e.g. `\"openclaw-engram\"` when invoked by the\n   * shim binary).  Forwarded to the plugin-entry resolver so shim CLI\n   * users target their own `plugins.entries[\"openclaw-engram\"]` block instead\n   * of accidentally resolving to the canonical `\"openclaw-remnic\"` entry when\n   * `plugins.slots.memory` is unset (#403).\n   */\n  preferredId?: string;\n};\n\nfunction getOpenClawPluginEntries(raw: Record<string, unknown>): Record<string, unknown> | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const entries =\n    plugins && plugins[\"entries\"] && typeof plugins[\"entries\"] === \"object\" && !Array.isArray(plugins[\"entries\"])\n      ? (plugins[\"entries\"] as Record<string, unknown>)\n      : undefined;\n  return entries;\n}\n\nfunction getOpenClawMemorySlotId(raw: Record<string, unknown>): string | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const slots =\n    plugins && plugins[\"slots\"] && typeof plugins[\"slots\"] === \"object\" && !Array.isArray(plugins[\"slots\"])\n      ? (plugins[\"slots\"] as Record<string, unknown>)\n      : undefined;\n  const slotId = slots?.[\"memory\"];\n  return typeof slotId === \"string\" ? slotId : undefined;\n}\n\nfunction resolveOpenClawRemnicPluginEntry(raw: unknown, preferredId?: string): Record<string, unknown> | undefined {\n  return resolvePluginEntry(raw, {\n    candidateIds: OPENCLAW_REMNIC_PLUGIN_IDS,\n    preferredId,\n    getEntries: getOpenClawPluginEntries,\n    getSlotId: getOpenClawMemorySlotId,\n  });\n}\n\nfunction hasAllowedOpenClawRemnicPluginId(value: string): boolean {\n  return (OPENCLAW_REMNIC_PLUGIN_IDS as readonly string[]).includes(value);\n}\n\ntype UsageErrorKind =\n  | \"unsupported-command\"\n  | \"unexpected-positional\"\n  | \"unknown-option\"\n  | \"invalid-option\"\n  | \"option-does-not-take-value\"\n  | \"missing-option\"\n  | \"missing-content\"\n  | \"invalid-integer\"\n  | \"invalid-number\";\n\nclass UsageError extends Error {\n  constructor(\n    readonly kind: UsageErrorKind,\n    readonly optionName?: string,\n    readonly acceptedValues?: readonly string[],\n  ) {\n    super(\"invalid access-cli arguments\");\n  }\n}\n\nfunction formatUsageError(error: UsageError): string {\n  switch (error.kind) {\n    case \"unsupported-command\":\n      return \"unsupported command\";\n    case \"unexpected-positional\":\n      return \"unexpected positional argument\";\n    case \"unknown-option\":\n      return `unknown option: --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-option\": {\n      const accepted = error.acceptedValues?.length ? `. Accepted: ${error.acceptedValues.join(\", \")}.` : \"\";\n      return `invalid value for --${error.optionName ?? \"unknown\"}${accepted}`;\n    }\n    case \"option-does-not-take-value\":\n      return `option does not accept a value: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-option\":\n      return `missing required option: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-content\":\n      return \"missing required option: --content or --content-file\";\n    case \"invalid-integer\":\n      return `invalid integer for --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-number\":\n      return `invalid number for --${error.optionName ?? \"unknown\"}`;\n  }\n}\n\nfunction writeCliOutput(text: string = \"\"): void {\n  process.stdout.write(`${text}\\n`);\n}\n\nfunction usage(): string {\n  return [\n    \"  engram-access browse [options]\",\n    \"  engram-access store [options]\",\n    \"  engram-access extraction-flush [options]\",\n    \"  engram-access decision [options]\",\n    \"  engram-access architecture [options]\",\n    \"  engram-access delta [options]\",\n    \"  engram-access correct [options]\",\n    \"\",\n    \"Browse options:\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --query <text>\",\n    \"  --category <name>\",\n    \"  --status <name>\",\n    \"  --sort <updated_desc|updated_asc|created_desc|created_asc>\",\n    \"  --limit <n>\",\n    \"  --offset <n>\",\n    \"\",\n    \"Store options:\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --content <text> | --content-file <path>\",\n    \"  --category <name>\",\n    \"  --confidence <0-1>\",\n    \"  --tag <tag> (repeatable)\",\n    \"  --entity-ref <ref>\",\n    \"  --ttl <duration>\",\n    \"  --source-reason <text>\",\n    \"  --idempotency-key <key>\",\n    \"  --dry-run\",\n    \"\",\n    \"Extraction flush options:\",\n    \"  --session-key <key>\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --cwd <path>\",\n    \"  --project-tag <tag>\",\n    \"  --deadline-ms <timestamp>\",\n    \"\",\n    \"Decision options:\",\n    \"  --subcommand <list|get|record|supersede>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --id <id> (get/supersede)\",\n    \"  --title <title> (record/supersede)\",\n    \"  --status <proposed|accepted|superseded|rejected> (record)\",\n    \"  --context <text> (record/supersede)\",\n    \"  --decision <text> (record/supersede)\",\n    \"  --consequences <text> (record/supersede)\",\n    \"  --entity-ref <ref> (repeatable)\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --supersedes-id <id> (alias for --id on supersede)\",\n    \"\",\n    \"Architecture options:\",\n    \"  --subcommand <get|refresh>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --repo-root <path> (repo to scan for refresh; defaults to the current directory)\",\n    \"\",\n    \"Correct options (issue #1580 — one plan/apply pipeline for all corrections):\",\n    \"  --text \\\"<correction>\\\"          plan a correction from natural language\",\n    \"  --id <memoryId> (repeatable)   explicit target memory ids\",\n    \"  --duplicate-of <memoryId>      winner id; requires exactly one --id (skips the classifier)\",\n    \"  --apply                        apply a pending plan (requires --plan-id + --confirm)\",\n    \"  --plan-id <id>                 the plan to apply or discard\",\n    \"  --confirm                      confirm the apply (safety guard, rule 48)\",\n    \"  --list                         list pending plans\",\n    \"  --discard                      discard a pending plan (requires --plan-id)\",\n    \"  --namespace <name>             namespace (validated by policy)\",\n    \"  --session-key <key>            session identifier for namespace resolution\",\n    \"  --principal <principal>\",\n  ].join(\"\\n\");\n}\n\nconst COMMAND_SPECS: Record<CommandName, CommandSpec> = {\n  browse: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"principal\",\n      \"query\",\n      \"category\",\n      \"status\",\n      \"sort\",\n      \"limit\",\n      \"offset\",\n    ]),\n    flagOptions: new Set(),\n  },\n  store: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"content\",\n      \"content-file\",\n      \"category\",\n      \"confidence\",\n      \"tag\",\n      \"entity-ref\",\n      \"ttl\",\n      \"source-reason\",\n      \"idempotency-key\",\n    ]),\n    flagOptions: new Set([\"dry-run\"]),\n  },\n  \"extraction-flush\": {\n    valueOptions: new Set([\"session-key\", \"namespace\", \"principal\", \"cwd\", \"project-tag\", \"deadline-ms\"]),\n    flagOptions: new Set(),\n  },\n  decision: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"id\",\n      \"title\",\n      \"status\",\n      \"context\",\n      \"decision\",\n      \"consequences\",\n      \"entity-ref\",\n      \"project-tag\",\n      \"supersedes-id\",\n    ]),\n    flagOptions: new Set(),\n  },\n  architecture: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n  delta: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n  correct: {\n    valueOptions: new Set([\n      \"text\",\n      \"id\",\n      \"duplicate-of\",\n      \"plan-id\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n    ]),\n    flagOptions: new Set([\"apply\", \"list\", \"discard\", \"confirm\", \"yes\"]),\n  },\n};\nconst BROWSE_SORT_VALUES = Object.freeze([\n  \"updated_desc\",\n  \"updated_asc\",\n  \"created_desc\",\n  \"created_asc\",\n] as const);\n\ntype BrowseSort = (typeof BROWSE_SORT_VALUES)[number];\n\n/**\n * Type guard for {@link CommandName}. Enumerating the union (rather than a\n * bare `value in COMMAND_SPECS`) is what lets TypeScript NARROW the string\n * to `CommandName` — the `in` operator alone yields TS2322 on the\n * `command: commandRaw` assignment below (codex review P2).\n */\nfunction isCommandName(value: string): value is CommandName {\n  return (\n    value === \"browse\" ||\n    value === \"store\" ||\n    value === \"extraction-flush\" ||\n    value === \"decision\" ||\n    value === \"architecture\" ||\n    value === \"delta\" ||\n    value === \"correct\"\n  );\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const [commandRaw, ...rest] = argv;\n  if (!isCommandName(commandRaw)) {\n    throw new UsageError(\"unsupported-command\");\n  }\n  const spec = COMMAND_SPECS[commandRaw];\n\n  const options: Record<string, string[]> = {};\n  const flags = new Set<string>();\n\n  for (let i = 0; i < rest.length; i += 1) {\n    const token = rest[i];\n    if (!token.startsWith(\"--\")) {\n      throw new UsageError(\"unexpected-positional\");\n    }\n    const rawKey = token.slice(2);\n    if (!rawKey) {\n      throw new UsageError(\"unknown-option\", rawKey);\n    }\n    const equalsIndex = rawKey.indexOf(\"=\");\n    const key = equalsIndex === -1 ? rawKey : rawKey.slice(0, equalsIndex);\n    const inlineValue = equalsIndex === -1 ? undefined : rawKey.slice(equalsIndex + 1);\n\n    if (!spec.valueOptions.has(key) && !spec.flagOptions.has(key)) {\n      throw new UsageError(\"unknown-option\", key);\n    }\n\n    if (spec.flagOptions.has(key)) {\n      if (inlineValue !== undefined) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      const next = rest[i + 1];\n      if (next && !next.startsWith(\"--\")) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      flags.add(key);\n      continue;\n    }\n\n    if (inlineValue !== undefined) {\n      if (inlineValue.length === 0) {\n        throw new UsageError(\"missing-option\", key);\n      }\n      if (!options[key]) {\n        options[key] = [];\n      }\n      options[key].push(inlineValue);\n      continue;\n    }\n\n    const next = rest[i + 1];\n    if (next === undefined || next.length === 0 || next.startsWith(\"--\")) {\n      throw new UsageError(\"missing-option\", key);\n    }\n    if (!options[key]) {\n      options[key] = [];\n    }\n    options[key].push(next);\n    i += 1;\n  }\n\n  return {\n    command: commandRaw,\n    options,\n    flags,\n  };\n}\n\nfunction getLastOption(args: ParsedArgs, name: string): string | undefined {\n  const values = args.options[name];\n  if (!values || values.length === 0) return undefined;\n  return values[values.length - 1];\n}\n\nfunction getAllOptions(args: ParsedArgs, name: string): string[] {\n  return args.options[name] ?? [];\n}\n\nfunction requireOption(args: ParsedArgs, name: string): string {\n  const value = getLastOption(args, name);\n  if (!value || value.trim().length === 0) {\n    throw new UsageError(\"missing-option\", name);\n  }\n  return value;\n}\n\nfunction parseIntegerOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?\\d+$/.test(trimmed)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isSafeInteger(value)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-option\", name, [`integer >= ${options.min}`]);\n  }\n  return value;\n}\n\nfunction parseBrowseSortOption(args: ParsedArgs, name: string): BrowseSort | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  if ((BROWSE_SORT_VALUES as readonly string[]).includes(raw)) {\n    return raw as BrowseSort;\n  }\n  throw new UsageError(\"invalid-option\", name, BROWSE_SORT_VALUES);\n}\n\nfunction parseFloatOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number; max?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?(?:(?:\\d+\\.?\\d*)|(?:\\.\\d+))(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isFinite(value)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.max !== undefined && value > options.max) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  return value;\n}\n\nfunction loadPluginConfig(preferredId?: string): Record<string, unknown> {\n  const configPath =\n    expandOptionalPath(readEnvVar(\"OPENCLAW_CONFIG_PATH\")) ||\n    expandOptionalPath(readEnvVar(\"OPENCLAW_ENGRAM_CONFIG_PATH\")) ||\n    path.join(resolveHomeDir(), \".openclaw\", \"openclaw.json\");\n  const raw = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n  const slotId =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? getOpenClawMemorySlotId(raw as Record<string, unknown>)\n      : undefined;\n  if (typeof slotId === \"string\" && !hasAllowedOpenClawRemnicPluginId(slotId)) {\n    throw new Error(\n      `OpenClaw memory slot points to non-Remnic plugin \"${slotId}\"; refusing to use default Remnic access config.`,\n    );\n  }\n  // Delegate slot → preferredId → canonical → legacy resolution to the\n  // generic helper so all config loaders stay in sync (#403).  Shim CLI\n  // callers pass `preferredId: \"openclaw-engram\"` so legacy shim installs\n  // target their own config block instead of falling through to the canonical\n  // \"openclaw-remnic\" entry.\n  const entry = resolveOpenClawRemnicPluginEntry(raw, preferredId);\n  if (!entry) {\n    throw new Error(\n      \"OpenClaw config does not contain an allowed Remnic plugin entry; refusing to use default Remnic access config.\",\n    );\n  }\n  return (entry?.[\"config\"] as Record<string, unknown> | undefined) ?? {};\n}\n\nfunction buildRuntime(preferredId?: string): Runtime {\n  const config = parseConfig(loadPluginConfig(preferredId));\n  return {\n    config,\n    service: new EngramAccessService(new Orchestrator(config)),\n  };\n}\n\nasync function runBrowse(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const browseArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    principal: getLastOption(args, \"principal\"),\n    query: getLastOption(args, \"query\"),\n    category: getLastOption(args, \"category\"),\n    status: getLastOption(args, \"status\"),\n    sort: parseBrowseSortOption(args, \"sort\"),\n    limit: parseIntegerOption(args, \"limit\", { min: 1 }),\n    offset: parseIntegerOption(args, \"offset\", { min: 0 }),\n  };\n  const { config, service } = buildRuntime(preferredId);\n  const request = {\n    namespace: browseArgs.namespace,\n    authenticatedPrincipal: browseArgs.principal ?? config.agentAccessHttp.principal,\n    query: browseArgs.query,\n    category: browseArgs.category,\n    status: browseArgs.status,\n    sort: browseArgs.sort,\n    limit: browseArgs.limit,\n    offset: browseArgs.offset,\n  };\n  const result = await service.memoryBrowse(request);\n  console.log(JSON.stringify(result, null, 2));\n}\n\nasync function runStore(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const contentFile = getLastOption(args, \"content-file\");\n  const inlineContent = getLastOption(args, \"content\");\n  const content = contentFile\n    ? fs.readFileSync(expandTildePath(contentFile), \"utf8\")\n    : inlineContent;\n  if (!content || content.trim().length === 0) {\n    throw new UsageError(\"missing-content\");\n  }\n  const storeArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    sessionKey: getLastOption(args, \"session-key\"),\n    content,\n    category: requireOption(args, \"category\"),\n    confidence: parseFloatOption(args, \"confidence\", { min: 0, max: 1 }),\n    tags: getAllOptions(args, \"tag\"),\n    entityRef: getLastOption(args, \"entity-ref\"),\n    ttl: getLastOption(args, \"ttl\"),\n    sourceReason: getLastOption(args, \"source-reason\"),\n    idempotencyKey: getLastOption(args, \"idempotency-key\"),\n    dryRun: args.flags.has(\"dry-run\"),\n  };\n\n  const { config, service } = buildRuntime(preferredId);\n  // Migrated through the access boundary (issue #1525): the store command\n  // dispatches through the same registry entry as the MCP tool and HTTP\n  // route, so validation/normalization is owned in ONE place. The CLI has no\n  // write-quota hook (it is a one-shot process), so no hooks are forwarded.\n  const op = getOperation(\"memory_store\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: memory_store\");\n  }\n  const output = (await op.run(\n    {\n      namespace: storeArgs.namespace,\n      sessionKey: storeArgs.sessionKey,\n      content: storeArgs.content,\n      category: storeArgs.category,\n      confidence: storeArgs.confidence,\n      tags: storeArgs.tags,\n      entityRef: storeArgs.entityRef,\n      ttl: storeArgs.ttl,\n      sourceReason: storeArgs.sourceReason,\n      idempotencyKey: storeArgs.idempotencyKey,\n      dryRun: storeArgs.dryRun,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nasync function runExtractionFlush(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const { config, service } = buildRuntime(preferredId);\n  const op = getOperation(\"extraction_force_flush\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: extraction_force_flush\");\n  }\n  const output = (await op.run(\n    {\n      sessionKey: requireOption(args, \"session-key\"),\n      namespace: getLastOption(args, \"namespace\"),\n      cwd: expandOptionalPath(getLastOption(args, \"cwd\")),\n      projectTag: getLastOption(args, \"project-tag\"),\n      deadlineMs: parseIntegerOption(args, \"deadline-ms\", { min: 0 }),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nfunction expandOptionalPath(value: string | undefined): string | undefined {\n  return value === undefined ? undefined : expandTildePath(value);\n}\n\n/**\n * Decision-record surface (issue #1548 Track A PR 2). Dispatches through the\n * same `coding_decision` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDecision(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // The CLI creates a fresh Orchestrator per invocation, so the session\n  // coding-context map is empty. If --project-tag + --session-key are\n  // provided, attach a coding context BEFORE dispatching so the gate\n  // passes and project-scoped writes resolve to the right namespace\n  // (review P2).\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (projectTag && projectTag.trim().length > 0 && sessionKey && sessionKey.trim().length > 0) {\n    const projectId = projectTagProjectId(projectTag.trim());\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: projectId,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_decision\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_decision\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n      id: getLastOption(args, \"id\"),\n      supersedesId: getLastOption(args, \"supersedes-id\"),\n      title: getLastOption(args, \"title\"),\n      status: getLastOption(args, \"status\"),\n      context: getLastOption(args, \"context\"),\n      decision: getLastOption(args, \"decision\"),\n      consequences: getLastOption(args, \"consequences\"),\n      entityRefs: getAllOptions(args, \"entity-ref\"),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Architecture-card surface (issue #1548 Track A PR 3). Dispatches through\n * the same `coding_architecture` operation as the MCP tool and HTTP route —\n * one validation boundary, three transports.\n */\nasync function runArchitecture(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runDecision (review P2): the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach\n  // a context BEFORE dispatching when --project-tag + --session-key are\n  // given, so the gate passes and writes resolve to the right namespace.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    // refresh scans codingContext.rootPath, so it must be a REAL checkout\n    // path. Default to the CWD (or an explicit --repo-root) so a one-shot\n    // CLI refresh scans the caller's repo, not a non-existent tag path.\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    // --project-tag supplies the context id (namespace); when absent, derive\n    // a default from the repo-root basename so refresh works with just\n    // --session-key + --repo-root (codex review).\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_architecture\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_architecture\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Session-delta surface (issue #1548 Track A PR 4). Dispatches through the\n * same `coding_delta` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDelta(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runArchitecture/runDecision: the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach a\n  // context BEFORE dispatching so the gate passes.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_delta\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_delta\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Correction Contract surface (issue #1580). Dispatches through the same\n * `memory_correct_plan` / `memory_correct_apply` operations as the MCP tool\n * and HTTP route — one validation boundary, three transports.\n *\n * Modes:\n *   remnic correct \"<text>\" [--id <id>...]   → plan + print diff\n *   remnic correct --apply <planId> [--confirm] → apply a pending plan\n *   remnic correct --list                      → list pending plans\n *   remnic correct --discard <planId>          → discard a pending plan\n */\nasync function runCorrect(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const { config, service } = buildRuntime(preferredId);\n  const principal = getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal;\n  const namespace = getLastOption(args, \"namespace\");\n  const sessionKey = getLastOption(args, \"session-key\");\n\n  if (args.flags.has(\"list\")) {\n    const plans = await service.correctionListPending({\n      ...(namespace ? { namespace } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      principal,\n    });\n    console.log(JSON.stringify(plans, null, 2));\n    return;\n  }\n\n  if (args.flags.has(\"discard\")) {\n    const planId = requireOption(args, \"plan-id\");\n    await service.correctionDiscard(planId, {\n      ...(namespace ? { namespace } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      principal,\n    });\n    console.log(JSON.stringify({ discarded: planId }));\n    return;\n  }\n\n  if (args.flags.has(\"apply\")) {\n    const planId = requireOption(args, \"plan-id\");\n    const op = getOperation(\"memory_correct_apply\");\n    if (!op) {\n      throw new Error(\"access-boundary: operation not registered: memory_correct_apply\");\n    }\n    const output = (await op.run(\n      {\n        planId,\n        confirm: args.flags.has(\"confirm\") || args.flags.has(\"yes\"),\n        ...(sessionKey ? { sessionKey } : {}),\n        ...(namespace ? { namespace } : {}),\n      },\n      { service, authenticatedPrincipal: principal },\n    )) as { result: unknown };\n    console.log(JSON.stringify(output.result, null, 2));\n    return;\n  }\n\n  // Default mode: plan from text — dispatch through the boundary operation\n  // so schema validation + namespace policy reach this path (same as MCP/HTTP).\n  const text = requireOption(args, \"text\");\n  const targetIds = getAllOptions(args, \"id\");\n  const duplicateOf = getLastOption(args, \"duplicate-of\");\n  const planOp = getOperation(\"memory_correct_plan\");\n  if (!planOp) {\n    throw new Error(\"access-boundary: operation not registered: memory_correct_plan\");\n  }\n  const planOutput = (await planOp.run(\n    {\n      text,\n      ...(targetIds.length > 0 ? { targetIds } : {}),\n      ...(duplicateOf ? { duplicateOf } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      ...(namespace ? { namespace } : {}),\n    },\n    { service, authenticatedPrincipal: principal },\n  )) as { result: unknown };\n  console.log(JSON.stringify(planOutput.result, null, 2));\n}\n\nexport async function main(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  const args = parseArgs(argv);\n  if (args.command === \"browse\") {\n    await runBrowse(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"extraction-flush\") {\n    await runExtractionFlush(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"decision\") {\n    await runDecision(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"architecture\") {\n    await runArchitecture(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"delta\") {\n    await runDelta(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"correct\") {\n    await runCorrect(args, options.preferredId);\n    return;\n  }\n  await runStore(args, options.preferredId);\n}\n\nexport function sanitizeAccessCliErrorMessage(message: string): string {\n  return message.replace(\n    /\\b(openaiApiKey|localLlmApiKey)\\b(\\s*[:=]\\s*)(?:\"[^\"]*\"|'[^']*'|[^\\s,}\\]]+)/gi,\n    (_match, name: string, separator: string) => `${name}${separator}[redacted]`,\n  );\n}\n\nexport function printUsage(): void {\n  writeCliOutput(usage());\n}\n\nexport async function runCli(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  try {\n    await main(argv, options);\n  } catch (error) {\n    if (error instanceof UsageError) {\n      writeCliOutput(formatUsageError(error));\n      writeCliOutput();\n      printUsage();\n      process.exit(1);\n    }\n\n    console.error(\"access-cli failed: runtime error\");\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcjB,IAAM,6BAA6B,CAAC,mBAAmB,iBAAiB;AAsCxE,SAAS,yBAAyB,KAAmE;AACnG,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,UACJ,WAAW,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,SAAS,CAAC,IACvG,QAAQ,SAAS,IAClB;AACN,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAkD;AACjF,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,QACJ,WAAW,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,IACjG,QAAQ,OAAO,IAChB;AACN,QAAM,SAAS,QAAQ,QAAQ;AAC/B,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAEA,SAAS,iCAAiC,KAAc,aAA2D;AACjH,SAAO,mBAAmB,KAAK;AAAA,IAC7B,cAAc;AAAA,IACd;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,iCAAiC,OAAwB;AAChE,SAAQ,2BAAiD,SAAS,KAAK;AACzE;AAaA,IAAM,aAAN,cAAyB,MAAM;AAAA,EAC7B,YACW,MACA,YACA,gBACT;AACA,UAAM,8BAA8B;AAJ3B;AACA;AACA;AAAA,EAGX;AAAA,EALW;AAAA,EACA;AAAA,EACA;AAIb;AAEA,SAAS,iBAAiB,OAA2B;AACnD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,qBAAqB,MAAM,cAAc,SAAS;AAAA,IAC3D,KAAK,kBAAkB;AACrB,YAAM,WAAW,MAAM,gBAAgB,SAAS,eAAe,MAAM,eAAe,KAAK,IAAI,CAAC,MAAM;AACpG,aAAO,uBAAuB,MAAM,cAAc,SAAS,GAAG,QAAQ;AAAA,IACxE;AAAA,IACA,KAAK;AACH,aAAO,qCAAqC,MAAM,cAAc,SAAS;AAAA,IAC3E,KAAK;AACH,aAAO,8BAA8B,MAAM,cAAc,SAAS;AAAA,IACpE,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,yBAAyB,MAAM,cAAc,SAAS;AAAA,IAC/D,KAAK;AACH,aAAO,wBAAwB,MAAM,cAAc,SAAS;AAAA,EAChE;AACF;AAEA,SAAS,eAAe,OAAe,IAAU;AAC/C,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAClC;AAEA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,gBAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,CAAC;AAAA,EAClC;AAAA,EACA,oBAAoB;AAAA,IAClB,cAAc,oBAAI,IAAI,CAAC,eAAe,aAAa,aAAa,OAAO,eAAe,aAAa,CAAC;AAAA,IACpG,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,UAAU;AAAA,IACR,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,cAAc;AAAA,IACZ,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,SAAS;AAAA,IACP,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,QAAQ,WAAW,WAAW,KAAK,CAAC;AAAA,EACrE;AACF;AACA,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAUV,SAAS,cAAc,OAAqC;AAC1D,SACE,UAAU,YACV,UAAU,WACV,UAAU,sBACV,UAAU,cACV,UAAU,kBACV,UAAU,WACV,UAAU;AAEd;AAEA,SAAS,UAAU,MAA4B;AAC7C,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAC9B,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AACA,QAAM,OAAO,cAAc,UAAU;AAErC,QAAM,UAAoC,CAAC;AAC3C,QAAM,QAAQ,oBAAI,IAAY;AAE9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC3B,YAAM,IAAI,WAAW,uBAAuB;AAAA,IAC9C;AACA,UAAM,SAAS,MAAM,MAAM,CAAC;AAC5B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,WAAW,kBAAkB,MAAM;AAAA,IAC/C;AACA,UAAM,cAAc,OAAO,QAAQ,GAAG;AACtC,UAAM,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,GAAG,WAAW;AACrE,UAAM,cAAc,gBAAgB,KAAK,SAAY,OAAO,MAAM,cAAc,CAAC;AAEjF,QAAI,CAAC,KAAK,aAAa,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7D,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AAEA,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,UAAI,gBAAgB,QAAW;AAC7B,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAMA,QAAO,KAAK,IAAI,CAAC;AACvB,UAAIA,SAAQ,CAACA,MAAK,WAAW,IAAI,GAAG;AAClC,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAM,IAAI,GAAG;AACb;AAAA,IACF;AAEA,QAAI,gBAAgB,QAAW;AAC7B,UAAI,YAAY,WAAW,GAAG;AAC5B,cAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,MAC5C;AACA,UAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,gBAAQ,GAAG,IAAI,CAAC;AAAA,MAClB;AACA,cAAQ,GAAG,EAAE,KAAK,WAAW;AAC7B;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,SAAS,UAAa,KAAK,WAAW,KAAK,KAAK,WAAW,IAAI,GAAG;AACpE,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AACA,QAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,cAAQ,GAAG,IAAI,CAAC;AAAA,IAClB;AACA,YAAQ,GAAG,EAAE,KAAK,IAAI;AACtB,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAkB,MAAkC;AACzE,QAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO;AAC3C,SAAO,OAAO,OAAO,SAAS,CAAC;AACjC;AAEA,SAAS,cAAc,MAAkB,MAAwB;AAC/D,SAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;AAChC;AAEA,SAAS,cAAc,MAAkB,MAAsB;AAC7D,QAAM,QAAQ,cAAc,MAAM,IAAI;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACA,MACA,UAA4B,CAAC,GACT;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAChC,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,MAAM,CAAC,cAAc,QAAQ,GAAG,EAAE,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAkB,MAAsC;AACrF,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAK,mBAAyC,SAAS,GAAG,GAAG;AAC3D,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,kBAAkB,MAAM,kBAAkB;AACjE;AAEA,SAAS,iBACP,MACA,MACA,UAA0C,CAAC,GACvB;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,oDAAoD,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,aAA+C;AACvE,QAAM,aACJ,mBAAmB,WAAW,sBAAsB,CAAC,KACrD,mBAAmB,WAAW,6BAA6B,CAAC,KAC5D,KAAK,KAAK,eAAe,GAAG,aAAa,eAAe;AAC1D,QAAM,MAAM,KAAK,MAAM,GAAG,aAAa,YAAY,MAAM,CAAC;AAC1D,QAAM,SACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAChD,wBAAwB,GAA8B,IACtD;AACN,MAAI,OAAO,WAAW,YAAY,CAAC,iCAAiC,MAAM,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,qDAAqD,MAAM;AAAA,IAC7D;AAAA,EACF;AAMA,QAAM,QAAQ,iCAAiC,KAAK,WAAW;AAC/D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAQ,QAAQ,QAAQ,KAA6C,CAAC;AACxE;AAEA,SAAS,aAAa,aAA+B;AACnD,QAAM,SAAS,YAAY,iBAAiB,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,oBAAoB,IAAI,aAAa,MAAM,CAAC;AAAA,EAC3D;AACF;AAEA,eAAe,UAAU,MAAkB,aAAqC;AAC9E,QAAM,aAAa;AAAA,IACjB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,OAAO,cAAc,MAAM,OAAO;AAAA,IAClC,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,QAAQ,cAAc,MAAM,QAAQ;AAAA,IACpC,MAAM,sBAAsB,MAAM,MAAM;AAAA,IACxC,OAAO,mBAAmB,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,IACnD,QAAQ,mBAAmB,MAAM,UAAU,EAAE,KAAK,EAAE,CAAC;AAAA,EACvD;AACA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,UAAU;AAAA,IACd,WAAW,WAAW;AAAA,IACtB,wBAAwB,WAAW,aAAa,OAAO,gBAAgB;AAAA,IACvE,OAAO,WAAW;AAAA,IAClB,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW;AAAA,IAClB,QAAQ,WAAW;AAAA,EACrB;AACA,QAAM,SAAS,MAAM,QAAQ,aAAa,OAAO;AACjD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,gBAAgB,cAAc,MAAM,SAAS;AACnD,QAAM,UAAU,cACZ,GAAG,aAAa,gBAAgB,WAAW,GAAG,MAAM,IACpD;AACJ,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,WAAW,iBAAiB;AAAA,EACxC;AACA,QAAM,YAAY;AAAA,IAChB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,YAAY,cAAc,MAAM,aAAa;AAAA,IAC7C;AAAA,IACA,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,YAAY,iBAAiB,MAAM,cAAc,EAAE,KAAK,GAAG,KAAK,EAAE,CAAC;AAAA,IACnE,MAAM,cAAc,MAAM,KAAK;AAAA,IAC/B,WAAW,cAAc,MAAM,YAAY;AAAA,IAC3C,KAAK,cAAc,MAAM,KAAK;AAAA,IAC9B,cAAc,cAAc,MAAM,eAAe;AAAA,IACjD,gBAAgB,cAAc,MAAM,iBAAiB;AAAA,IACrD,QAAQ,KAAK,MAAM,IAAI,SAAS;AAAA,EAClC;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,YAAY,UAAU;AAAA,MACtB,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,WAAW,UAAU;AAAA,MACrB,KAAK,UAAU;AAAA,MACf,cAAc,UAAU;AAAA,MACxB,gBAAgB,UAAU;AAAA,MAC1B,QAAQ,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,eAAe,mBAAmB,MAAkB,aAAqC;AACvF,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,KAAK,aAAa,wBAAwB;AAChD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,YAAY,cAAc,MAAM,aAAa;AAAA,MAC7C,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C,KAAK,mBAAmB,cAAc,MAAM,KAAK,CAAC;AAAA,MAClD,YAAY,cAAc,MAAM,aAAa;AAAA,MAC7C,YAAY,mBAAmB,MAAM,eAAe,EAAE,KAAK,EAAE,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,SAAS,mBAAmB,OAA+C;AACzE,SAAO,UAAU,SAAY,SAAY,gBAAgB,KAAK;AAChE;AAOA,eAAe,YAAY,MAAkB,aAAqC;AAChF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAMpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5F,UAAM,YAAY,oBAAoB,WAAW,KAAK,CAAC;AACvD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,iBAAiB;AACzC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,MACA,IAAI,cAAc,MAAM,IAAI;AAAA,MAC5B,cAAc,cAAc,MAAM,eAAe;AAAA,MACjD,OAAO,cAAc,MAAM,OAAO;AAAA,MAClC,QAAQ,cAAc,MAAM,QAAQ;AAAA,MACpC,SAAS,cAAc,MAAM,SAAS;AAAA,MACtC,UAAU,cAAc,MAAM,UAAU;AAAA,MACxC,cAAc,cAAc,MAAM,cAAc;AAAA,MAChD,YAAY,cAAc,MAAM,YAAY;AAAA,IAC9C;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,gBAAgB,MAAkB,aAAqC;AACpF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAI9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AAIrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,qBAAqB;AAC7C,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAIpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AACrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAaA,eAAe,WAAW,MAAkB,aAAqC;AAC/E,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,YAAY,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAC7E,QAAM,YAAY,cAAc,MAAM,WAAW;AACjD,QAAM,aAAa,cAAc,MAAM,aAAa;AAEpD,MAAI,KAAK,MAAM,IAAI,MAAM,GAAG;AAC1B,UAAM,QAAQ,MAAM,QAAQ,sBAAsB;AAAA,MAChD,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC1C;AAAA,EACF;AAEA,MAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,QAAQ,kBAAkB,QAAQ;AAAA,MACtC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,KAAK,UAAU,EAAE,WAAW,OAAO,CAAC,CAAC;AACjD;AAAA,EACF;AAEA,MAAI,KAAK,MAAM,IAAI,OAAO,GAAG;AAC3B,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,KAAK,aAAa,sBAAsB;AAC9C,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,SAAU,MAAM,GAAG;AAAA,MACvB;AAAA,QACE;AAAA,QACA,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AAAA,QAC1D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC;AAAA,MACA,EAAE,SAAS,wBAAwB,UAAU;AAAA,IAC/C;AACA,YAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AAClD;AAAA,EACF;AAIA,QAAM,OAAO,cAAc,MAAM,MAAM;AACvC,QAAM,YAAY,cAAc,MAAM,IAAI;AAC1C,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,SAAS,aAAa,qBAAqB;AACjD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,aAAc,MAAM,OAAO;AAAA,IAC/B;AAAA,MACE;AAAA,MACA,GAAI,UAAU,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;AAAA,MAC5C,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACrC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACnC;AAAA,IACA,EAAE,SAAS,wBAAwB,UAAU;AAAA,EAC/C;AACA,UAAQ,IAAI,KAAK,UAAU,WAAW,QAAQ,MAAM,CAAC,CAAC;AACxD;AAEA,eAAsB,KACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,QAAM,OAAO,UAAU,IAAI;AAC3B,MAAI,KAAK,YAAY,UAAU;AAC7B,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,oBAAoB;AACvC,UAAM,mBAAmB,MAAM,QAAQ,WAAW;AAClD;AAAA,EACF;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,UAAM,YAAY,MAAM,QAAQ,WAAW;AAC3C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,UAAM,gBAAgB,MAAM,QAAQ,WAAW;AAC/C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,UAAM,SAAS,MAAM,QAAQ,WAAW;AACxC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,WAAW;AAC9B,UAAM,WAAW,MAAM,QAAQ,WAAW;AAC1C;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAC1C;AAEO,SAAS,8BAA8B,SAAyB;AACrE,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,CAAC,QAAQ,MAAc,cAAsB,GAAG,IAAI,GAAG,SAAS;AAAA,EAClE;AACF;AAEO,SAAS,aAAmB;AACjC,iBAAe,MAAM,CAAC;AACxB;AAEA,eAAsB,OACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,QAAI,iBAAiB,YAAY;AAC/B,qBAAe,iBAAiB,KAAK,CAAC;AACtC,qBAAe;AACf,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":["next"]}
+{"version":3,"sources":["../src/access-cli.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseConfig } from \"./config.js\";\nimport type { PluginConfig } from \"./types.js\";\nimport { Orchestrator } from \"./orchestrator.js\";\nimport { EngramAccessService } from \"./access-service.js\";\nimport { readEnvVar, resolveHomeDir } from \"./runtime/env.js\";\nimport { resolvePluginEntry } from \"./plugin-entry-resolver.js\";\nimport { expandTildePath } from \"./utils/path.js\";\nimport { getOperation } from \"./access-boundary.js\";\n// Importing access-operations registers the pilot boundary operations as a\n// side effect; the store command dispatches through the registry (issue #1525).\nimport \"./access-operations.js\";\nimport { projectTagProjectId } from \"./coding/coding-namespace.js\";\n\nconst OPENCLAW_REMNIC_PLUGIN_IDS = [\"openclaw-remnic\", \"openclaw-engram\"] as const;\n\ntype CommandName =\n  | \"browse\"\n  | \"store\"\n  | \"extraction-flush\"\n  | \"decision\"\n  | \"architecture\"\n  | \"delta\"\n  | \"correct\";\n\ntype ParsedArgs = {\n  command: CommandName;\n  options: Record<string, string[]>;\n  flags: Set<string>;\n};\n\ntype CommandSpec = {\n  valueOptions: ReadonlySet<string>;\n  flagOptions: ReadonlySet<string>;\n};\n\ntype Runtime = {\n  config: PluginConfig;\n  service: EngramAccessService;\n};\n\nexport type AccessCliOptions = {\n  /**\n   * The calling plugin's own id (e.g. `\"openclaw-engram\"` when invoked by the\n   * shim binary).  Forwarded to the plugin-entry resolver so shim CLI\n   * users target their own `plugins.entries[\"openclaw-engram\"]` block instead\n   * of accidentally resolving to the canonical `\"openclaw-remnic\"` entry when\n   * `plugins.slots.memory` is unset (#403).\n   */\n  preferredId?: string;\n};\n\nfunction getOpenClawPluginEntries(raw: Record<string, unknown>): Record<string, unknown> | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const entries =\n    plugins && plugins[\"entries\"] && typeof plugins[\"entries\"] === \"object\" && !Array.isArray(plugins[\"entries\"])\n      ? (plugins[\"entries\"] as Record<string, unknown>)\n      : undefined;\n  return entries;\n}\n\nfunction getOpenClawMemorySlotId(raw: Record<string, unknown>): string | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const slots =\n    plugins && plugins[\"slots\"] && typeof plugins[\"slots\"] === \"object\" && !Array.isArray(plugins[\"slots\"])\n      ? (plugins[\"slots\"] as Record<string, unknown>)\n      : undefined;\n  const slotId = slots?.[\"memory\"];\n  return typeof slotId === \"string\" ? slotId : undefined;\n}\n\nfunction resolveOpenClawRemnicPluginEntry(raw: unknown, preferredId?: string): Record<string, unknown> | undefined {\n  return resolvePluginEntry(raw, {\n    candidateIds: OPENCLAW_REMNIC_PLUGIN_IDS,\n    preferredId,\n    getEntries: getOpenClawPluginEntries,\n    getSlotId: getOpenClawMemorySlotId,\n  });\n}\n\nfunction hasAllowedOpenClawRemnicPluginId(value: string): boolean {\n  return (OPENCLAW_REMNIC_PLUGIN_IDS as readonly string[]).includes(value);\n}\n\ntype UsageErrorKind =\n  | \"unsupported-command\"\n  | \"unexpected-positional\"\n  | \"unknown-option\"\n  | \"invalid-option\"\n  | \"option-does-not-take-value\"\n  | \"missing-option\"\n  | \"missing-content\"\n  | \"invalid-integer\"\n  | \"invalid-number\";\n\nclass UsageError extends Error {\n  constructor(\n    readonly kind: UsageErrorKind,\n    readonly optionName?: string,\n    readonly acceptedValues?: readonly string[],\n  ) {\n    super(\"invalid access-cli arguments\");\n  }\n}\n\nfunction formatUsageError(error: UsageError): string {\n  switch (error.kind) {\n    case \"unsupported-command\":\n      return \"unsupported command\";\n    case \"unexpected-positional\":\n      return \"unexpected positional argument\";\n    case \"unknown-option\":\n      return `unknown option: --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-option\": {\n      const accepted = error.acceptedValues?.length ? `. Accepted: ${error.acceptedValues.join(\", \")}.` : \"\";\n      return `invalid value for --${error.optionName ?? \"unknown\"}${accepted}`;\n    }\n    case \"option-does-not-take-value\":\n      return `option does not accept a value: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-option\":\n      return `missing required option: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-content\":\n      return \"missing required option: --content or --content-file\";\n    case \"invalid-integer\":\n      return `invalid integer for --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-number\":\n      return `invalid number for --${error.optionName ?? \"unknown\"}`;\n  }\n}\n\nfunction writeCliOutput(text: string = \"\"): void {\n  process.stdout.write(`${text}\\n`);\n}\n\nfunction usage(): string {\n  return [\n    \"  engram-access browse [options]\",\n    \"  engram-access store [options]\",\n    \"  engram-access extraction-flush [options]\",\n    \"  engram-access decision [options]\",\n    \"  engram-access architecture [options]\",\n    \"  engram-access delta [options]\",\n    \"  engram-access correct [options]\",\n    \"\",\n    \"Browse options:\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --query <text>\",\n    \"  --category <name>\",\n    \"  --status <name>\",\n    \"  --sort <updated_desc|updated_asc|created_desc|created_asc>\",\n    \"  --limit <n>\",\n    \"  --offset <n>\",\n    \"\",\n    \"Store options:\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --content <text> | --content-file <path>\",\n    \"  --category <name>\",\n    \"  --confidence <0-1>\",\n    \"  --tag <tag> (repeatable)\",\n    \"  --entity-ref <ref>\",\n    \"  --ttl <duration>\",\n    \"  --source-reason <text>\",\n    \"  --idempotency-key <key>\",\n    \"  --dry-run\",\n    \"\",\n    \"Extraction flush options:\",\n    \"  --session-key <key>\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --cwd <path>\",\n    \"  --project-tag <tag>\",\n    \"  --deadline-ms <timestamp>\",\n    \"\",\n    \"Decision options:\",\n    \"  --subcommand <list|get|record|supersede>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --id <id> (get/supersede)\",\n    \"  --title <title> (record/supersede)\",\n    \"  --status <proposed|accepted|superseded|rejected> (record)\",\n    \"  --context <text> (record/supersede)\",\n    \"  --decision <text> (record/supersede)\",\n    \"  --consequences <text> (record/supersede)\",\n    \"  --entity-ref <ref> (repeatable)\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --supersedes-id <id> (alias for --id on supersede)\",\n    \"\",\n    \"Architecture options:\",\n    \"  --subcommand <get|refresh>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --repo-root <path> (repo to scan for refresh; defaults to the current directory)\",\n    \"\",\n    \"Correct options (issue #1580 — one plan/apply pipeline for all corrections):\",\n    \"  --text \\\"<correction>\\\"          plan a correction from natural language\",\n    \"  --id <memoryId> (repeatable)   explicit target memory ids\",\n    \"  --duplicate-of <memoryId>      winner id; requires exactly one --id (skips the classifier)\",\n    \"  --apply                        apply a pending plan (requires --plan-id + --confirm)\",\n    \"  --plan-id <id>                 the plan to apply or discard\",\n    \"  --confirm                      confirm the apply (safety guard, rule 48)\",\n    \"  --list                         list pending plans\",\n    \"  --discard                      discard a pending plan (requires --plan-id)\",\n    \"  --namespace <name>             namespace (validated by policy)\",\n    \"  --session-key <key>            session identifier for namespace resolution\",\n    \"  --principal <principal>\",\n  ].join(\"\\n\");\n}\n\nconst COMMAND_SPECS: Record<CommandName, CommandSpec> = {\n  browse: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"principal\",\n      \"query\",\n      \"category\",\n      \"status\",\n      \"sort\",\n      \"limit\",\n      \"offset\",\n    ]),\n    flagOptions: new Set(),\n  },\n  store: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"content\",\n      \"content-file\",\n      \"category\",\n      \"confidence\",\n      \"tag\",\n      \"entity-ref\",\n      \"ttl\",\n      \"source-reason\",\n      \"idempotency-key\",\n    ]),\n    flagOptions: new Set([\"dry-run\"]),\n  },\n  \"extraction-flush\": {\n    valueOptions: new Set([\"session-key\", \"namespace\", \"principal\", \"cwd\", \"project-tag\", \"deadline-ms\"]),\n    flagOptions: new Set(),\n  },\n  decision: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"id\",\n      \"title\",\n      \"status\",\n      \"context\",\n      \"decision\",\n      \"consequences\",\n      \"entity-ref\",\n      \"project-tag\",\n      \"supersedes-id\",\n    ]),\n    flagOptions: new Set(),\n  },\n  architecture: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n  delta: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n  correct: {\n    valueOptions: new Set([\n      \"text\",\n      \"id\",\n      \"duplicate-of\",\n      \"plan-id\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n    ]),\n    flagOptions: new Set([\"apply\", \"list\", \"discard\", \"confirm\", \"yes\"]),\n  },\n};\nconst BROWSE_SORT_VALUES = Object.freeze([\n  \"updated_desc\",\n  \"updated_asc\",\n  \"created_desc\",\n  \"created_asc\",\n] as const);\n\ntype BrowseSort = (typeof BROWSE_SORT_VALUES)[number];\n\n/**\n * Type guard for {@link CommandName}. Enumerating the union (rather than a\n * bare `value in COMMAND_SPECS`) is what lets TypeScript NARROW the string\n * to `CommandName` — the `in` operator alone yields TS2322 on the\n * `command: commandRaw` assignment below (codex review P2).\n */\nfunction isCommandName(value: string): value is CommandName {\n  return (\n    value === \"browse\" ||\n    value === \"store\" ||\n    value === \"extraction-flush\" ||\n    value === \"decision\" ||\n    value === \"architecture\" ||\n    value === \"delta\" ||\n    value === \"correct\"\n  );\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const [commandRaw, ...rest] = argv;\n  if (!isCommandName(commandRaw)) {\n    throw new UsageError(\"unsupported-command\");\n  }\n  const spec = COMMAND_SPECS[commandRaw];\n\n  const options: Record<string, string[]> = {};\n  const flags = new Set<string>();\n\n  for (let i = 0; i < rest.length; i += 1) {\n    const token = rest[i];\n    if (!token.startsWith(\"--\")) {\n      throw new UsageError(\"unexpected-positional\");\n    }\n    const rawKey = token.slice(2);\n    if (!rawKey) {\n      throw new UsageError(\"unknown-option\", rawKey);\n    }\n    const equalsIndex = rawKey.indexOf(\"=\");\n    const key = equalsIndex === -1 ? rawKey : rawKey.slice(0, equalsIndex);\n    const inlineValue = equalsIndex === -1 ? undefined : rawKey.slice(equalsIndex + 1);\n\n    if (!spec.valueOptions.has(key) && !spec.flagOptions.has(key)) {\n      throw new UsageError(\"unknown-option\", key);\n    }\n\n    if (spec.flagOptions.has(key)) {\n      if (inlineValue !== undefined) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      const next = rest[i + 1];\n      if (next && !next.startsWith(\"--\")) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      flags.add(key);\n      continue;\n    }\n\n    if (inlineValue !== undefined) {\n      if (inlineValue.length === 0) {\n        throw new UsageError(\"missing-option\", key);\n      }\n      if (!options[key]) {\n        options[key] = [];\n      }\n      options[key].push(inlineValue);\n      continue;\n    }\n\n    const next = rest[i + 1];\n    if (next === undefined || next.length === 0 || next.startsWith(\"--\")) {\n      throw new UsageError(\"missing-option\", key);\n    }\n    if (!options[key]) {\n      options[key] = [];\n    }\n    options[key].push(next);\n    i += 1;\n  }\n\n  return {\n    command: commandRaw,\n    options,\n    flags,\n  };\n}\n\nfunction getLastOption(args: ParsedArgs, name: string): string | undefined {\n  const values = args.options[name];\n  if (!values || values.length === 0) return undefined;\n  return values[values.length - 1];\n}\n\nfunction getAllOptions(args: ParsedArgs, name: string): string[] {\n  return args.options[name] ?? [];\n}\n\nfunction requireOption(args: ParsedArgs, name: string): string {\n  const value = getLastOption(args, name);\n  if (!value || value.trim().length === 0) {\n    throw new UsageError(\"missing-option\", name);\n  }\n  return value;\n}\n\nfunction parseIntegerOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?\\d+$/.test(trimmed)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isSafeInteger(value)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-option\", name, [`integer >= ${options.min}`]);\n  }\n  return value;\n}\n\nfunction parseBrowseSortOption(args: ParsedArgs, name: string): BrowseSort | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  if ((BROWSE_SORT_VALUES as readonly string[]).includes(raw)) {\n    return raw as BrowseSort;\n  }\n  throw new UsageError(\"invalid-option\", name, BROWSE_SORT_VALUES);\n}\n\nfunction parseFloatOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number; max?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?(?:(?:\\d+\\.?\\d*)|(?:\\.\\d+))(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isFinite(value)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.max !== undefined && value > options.max) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  return value;\n}\n\nfunction loadPluginConfig(preferredId?: string): Record<string, unknown> {\n  const configPath =\n    expandOptionalPath(readEnvVar(\"OPENCLAW_CONFIG_PATH\")) ||\n    expandOptionalPath(readEnvVar(\"OPENCLAW_ENGRAM_CONFIG_PATH\")) ||\n    path.join(resolveHomeDir(), \".openclaw\", \"openclaw.json\");\n  const raw = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n  const slotId =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? getOpenClawMemorySlotId(raw as Record<string, unknown>)\n      : undefined;\n  if (typeof slotId === \"string\" && !hasAllowedOpenClawRemnicPluginId(slotId)) {\n    throw new Error(\n      `OpenClaw memory slot points to non-Remnic plugin \"${slotId}\"; refusing to use default Remnic access config.`,\n    );\n  }\n  // Delegate slot → preferredId → canonical → legacy resolution to the\n  // generic helper so all config loaders stay in sync (#403).  Shim CLI\n  // callers pass `preferredId: \"openclaw-engram\"` so legacy shim installs\n  // target their own config block instead of falling through to the canonical\n  // \"openclaw-remnic\" entry.\n  const entry = resolveOpenClawRemnicPluginEntry(raw, preferredId);\n  if (!entry) {\n    throw new Error(\n      \"OpenClaw config does not contain an allowed Remnic plugin entry; refusing to use default Remnic access config.\",\n    );\n  }\n  return (entry?.[\"config\"] as Record<string, unknown> | undefined) ?? {};\n}\n\nfunction buildRuntime(preferredId?: string): Runtime {\n  const config = parseConfig(loadPluginConfig(preferredId));\n  return {\n    config,\n    service: new EngramAccessService(new Orchestrator(config)),\n  };\n}\n\nasync function runBrowse(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const browseArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    principal: getLastOption(args, \"principal\"),\n    query: getLastOption(args, \"query\"),\n    category: getLastOption(args, \"category\"),\n    status: getLastOption(args, \"status\"),\n    sort: parseBrowseSortOption(args, \"sort\"),\n    limit: parseIntegerOption(args, \"limit\", { min: 1 }),\n    offset: parseIntegerOption(args, \"offset\", { min: 0 }),\n  };\n  const { config, service } = buildRuntime(preferredId);\n  const request = {\n    namespace: browseArgs.namespace,\n    authenticatedPrincipal: browseArgs.principal ?? config.agentAccessHttp.principal,\n    query: browseArgs.query,\n    category: browseArgs.category,\n    status: browseArgs.status,\n    sort: browseArgs.sort,\n    limit: browseArgs.limit,\n    offset: browseArgs.offset,\n  };\n  const result = await service.memoryBrowse(request);\n  console.log(JSON.stringify(result, null, 2));\n}\n\nasync function runStore(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const contentFile = getLastOption(args, \"content-file\");\n  const inlineContent = getLastOption(args, \"content\");\n  const content = contentFile\n    ? fs.readFileSync(expandTildePath(contentFile), \"utf8\")\n    : inlineContent;\n  if (!content || content.trim().length === 0) {\n    throw new UsageError(\"missing-content\");\n  }\n  const storeArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    sessionKey: getLastOption(args, \"session-key\"),\n    content,\n    category: requireOption(args, \"category\"),\n    confidence: parseFloatOption(args, \"confidence\", { min: 0, max: 1 }),\n    tags: getAllOptions(args, \"tag\"),\n    entityRef: getLastOption(args, \"entity-ref\"),\n    ttl: getLastOption(args, \"ttl\"),\n    sourceReason: getLastOption(args, \"source-reason\"),\n    idempotencyKey: getLastOption(args, \"idempotency-key\"),\n    dryRun: args.flags.has(\"dry-run\"),\n  };\n\n  const { config, service } = buildRuntime(preferredId);\n  // Migrated through the access boundary (issue #1525): the store command\n  // dispatches through the same registry entry as the MCP tool and HTTP\n  // route, so validation/normalization is owned in ONE place. The CLI has no\n  // write-quota hook (it is a one-shot process), so no hooks are forwarded.\n  const op = getOperation(\"memory_store\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: memory_store\");\n  }\n  const output = (await op.run(\n    {\n      namespace: storeArgs.namespace,\n      sessionKey: storeArgs.sessionKey,\n      content: storeArgs.content,\n      category: storeArgs.category,\n      confidence: storeArgs.confidence,\n      tags: storeArgs.tags,\n      entityRef: storeArgs.entityRef,\n      ttl: storeArgs.ttl,\n      sourceReason: storeArgs.sourceReason,\n      idempotencyKey: storeArgs.idempotencyKey,\n      dryRun: storeArgs.dryRun,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nasync function runExtractionFlush(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const { config, service } = buildRuntime(preferredId);\n  const op = getOperation(\"extraction_force_flush\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: extraction_force_flush\");\n  }\n  const output = (await op.run(\n    {\n      sessionKey: requireOption(args, \"session-key\"),\n      namespace: getLastOption(args, \"namespace\"),\n      cwd: expandOptionalPath(getLastOption(args, \"cwd\")),\n      projectTag: getLastOption(args, \"project-tag\"),\n      deadlineMs: parseIntegerOption(args, \"deadline-ms\", { min: 0 }),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nfunction expandOptionalPath(value: string | undefined): string | undefined {\n  return value === undefined ? undefined : expandTildePath(value);\n}\n\n/**\n * Decision-record surface (issue #1548 Track A PR 2). Dispatches through the\n * same `coding_decision` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDecision(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // The CLI creates a fresh Orchestrator per invocation, so the session\n  // coding-context map is empty. If --project-tag + --session-key are\n  // provided, attach a coding context BEFORE dispatching so the gate\n  // passes and project-scoped writes resolve to the right namespace\n  // (review P2).\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (projectTag && projectTag.trim().length > 0 && sessionKey && sessionKey.trim().length > 0) {\n    const projectId = projectTagProjectId(projectTag.trim());\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: projectId,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_decision\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_decision\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n      id: getLastOption(args, \"id\"),\n      supersedesId: getLastOption(args, \"supersedes-id\"),\n      title: getLastOption(args, \"title\"),\n      status: getLastOption(args, \"status\"),\n      context: getLastOption(args, \"context\"),\n      decision: getLastOption(args, \"decision\"),\n      consequences: getLastOption(args, \"consequences\"),\n      entityRefs: getAllOptions(args, \"entity-ref\"),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Architecture-card surface (issue #1548 Track A PR 3). Dispatches through\n * the same `coding_architecture` operation as the MCP tool and HTTP route —\n * one validation boundary, three transports.\n */\nasync function runArchitecture(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runDecision (review P2): the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach\n  // a context BEFORE dispatching when --project-tag + --session-key are\n  // given, so the gate passes and writes resolve to the right namespace.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    // refresh scans codingContext.rootPath, so it must be a REAL checkout\n    // path. Default to the CWD (or an explicit --repo-root) so a one-shot\n    // CLI refresh scans the caller's repo, not a non-existent tag path.\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    // --project-tag supplies the context id (namespace); when absent, derive\n    // a default from the repo-root basename so refresh works with just\n    // --session-key + --repo-root (codex review).\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_architecture\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_architecture\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Session-delta surface (issue #1548 Track A PR 4). Dispatches through the\n * same `coding_delta` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDelta(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runArchitecture/runDecision: the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach a\n  // context BEFORE dispatching so the gate passes.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_delta\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_delta\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Correction Contract surface (issue #1580). Dispatches through the same\n * `memory_correct_plan` / `memory_correct_apply` operations as the MCP tool\n * and HTTP route — one validation boundary, three transports.\n *\n * Modes:\n *   remnic correct \"<text>\" [--id <id>...]   → plan + print diff\n *   remnic correct --apply <planId> [--confirm] → apply a pending plan\n *   remnic correct --list                      → list pending plans\n *   remnic correct --discard <planId>          → discard a pending plan\n */\nasync function runCorrect(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const { config, service } = buildRuntime(preferredId);\n  const principal = getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal;\n  const namespace = getLastOption(args, \"namespace\");\n  const sessionKey = getLastOption(args, \"session-key\");\n\n  if (args.flags.has(\"list\")) {\n    const plans = await service.correctionListPending({\n      ...(namespace ? { namespace } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      principal,\n    });\n    console.log(JSON.stringify(plans, null, 2));\n    return;\n  }\n\n  if (args.flags.has(\"discard\")) {\n    const planId = requireOption(args, \"plan-id\");\n    await service.correctionDiscard(planId, {\n      ...(namespace ? { namespace } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      principal,\n    });\n    console.log(JSON.stringify({ discarded: planId }));\n    return;\n  }\n\n  if (args.flags.has(\"apply\")) {\n    const planId = requireOption(args, \"plan-id\");\n    const op = getOperation(\"memory_correct_apply\");\n    if (!op) {\n      throw new Error(\"access-boundary: operation not registered: memory_correct_apply\");\n    }\n    const output = (await op.run(\n      {\n        planId,\n        confirm: args.flags.has(\"confirm\") || args.flags.has(\"yes\"),\n        ...(sessionKey ? { sessionKey } : {}),\n        ...(namespace ? { namespace } : {}),\n      },\n      { service, authenticatedPrincipal: principal },\n    )) as { result: unknown };\n    console.log(JSON.stringify(output.result, null, 2));\n    return;\n  }\n\n  // Default mode: plan from text — dispatch through the boundary operation\n  // so schema validation + namespace policy reach this path (same as MCP/HTTP).\n  const text = requireOption(args, \"text\");\n  const targetIds = getAllOptions(args, \"id\");\n  const duplicateOf = getLastOption(args, \"duplicate-of\");\n  const planOp = getOperation(\"memory_correct_plan\");\n  if (!planOp) {\n    throw new Error(\"access-boundary: operation not registered: memory_correct_plan\");\n  }\n  const planOutput = (await planOp.run(\n    {\n      text,\n      ...(targetIds.length > 0 ? { targetIds } : {}),\n      ...(duplicateOf ? { duplicateOf } : {}),\n      ...(sessionKey ? { sessionKey } : {}),\n      ...(namespace ? { namespace } : {}),\n    },\n    { service, authenticatedPrincipal: principal },\n  )) as { result: unknown };\n  console.log(JSON.stringify(planOutput.result, null, 2));\n}\n\nexport async function main(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  const args = parseArgs(argv);\n  if (args.command === \"browse\") {\n    await runBrowse(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"extraction-flush\") {\n    await runExtractionFlush(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"decision\") {\n    await runDecision(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"architecture\") {\n    await runArchitecture(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"delta\") {\n    await runDelta(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"correct\") {\n    await runCorrect(args, options.preferredId);\n    return;\n  }\n  await runStore(args, options.preferredId);\n}\n\nexport function sanitizeAccessCliErrorMessage(message: string): string {\n  return message.replace(\n    /\\b(openaiApiKey|localLlmApiKey)\\b(\\s*[:=]\\s*)(?:\"[^\"]*\"|'[^']*'|[^\\s,}\\]]+)/gi,\n    (_match, name: string, separator: string) => `${name}${separator}[redacted]`,\n  );\n}\n\nexport function printUsage(): void {\n  writeCliOutput(usage());\n}\n\nexport async function runCli(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  try {\n    await main(argv, options);\n  } catch (error) {\n    if (error instanceof UsageError) {\n      writeCliOutput(formatUsageError(error));\n      writeCliOutput();\n      printUsage();\n      process.exit(1);\n    }\n\n    console.error(\"access-cli failed: runtime error\");\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcjB,IAAM,6BAA6B,CAAC,mBAAmB,iBAAiB;AAsCxE,SAAS,yBAAyB,KAAmE;AACnG,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,UACJ,WAAW,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,SAAS,CAAC,IACvG,QAAQ,SAAS,IAClB;AACN,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAkD;AACjF,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,QACJ,WAAW,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,IACjG,QAAQ,OAAO,IAChB;AACN,QAAM,SAAS,QAAQ,QAAQ;AAC/B,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAEA,SAAS,iCAAiC,KAAc,aAA2D;AACjH,SAAO,mBAAmB,KAAK;AAAA,IAC7B,cAAc;AAAA,IACd;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,iCAAiC,OAAwB;AAChE,SAAQ,2BAAiD,SAAS,KAAK;AACzE;AAaA,IAAM,aAAN,cAAyB,MAAM;AAAA,EAC7B,YACW,MACA,YACA,gBACT;AACA,UAAM,8BAA8B;AAJ3B;AACA;AACA;AAAA,EAGX;AAAA,EALW;AAAA,EACA;AAAA,EACA;AAIb;AAEA,SAAS,iBAAiB,OAA2B;AACnD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,qBAAqB,MAAM,cAAc,SAAS;AAAA,IAC3D,KAAK,kBAAkB;AACrB,YAAM,WAAW,MAAM,gBAAgB,SAAS,eAAe,MAAM,eAAe,KAAK,IAAI,CAAC,MAAM;AACpG,aAAO,uBAAuB,MAAM,cAAc,SAAS,GAAG,QAAQ;AAAA,IACxE;AAAA,IACA,KAAK;AACH,aAAO,qCAAqC,MAAM,cAAc,SAAS;AAAA,IAC3E,KAAK;AACH,aAAO,8BAA8B,MAAM,cAAc,SAAS;AAAA,IACpE,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,yBAAyB,MAAM,cAAc,SAAS;AAAA,IAC/D,KAAK;AACH,aAAO,wBAAwB,MAAM,cAAc,SAAS;AAAA,EAChE;AACF;AAEA,SAAS,eAAe,OAAe,IAAU;AAC/C,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAClC;AAEA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,gBAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,CAAC;AAAA,EAClC;AAAA,EACA,oBAAoB;AAAA,IAClB,cAAc,oBAAI,IAAI,CAAC,eAAe,aAAa,aAAa,OAAO,eAAe,aAAa,CAAC;AAAA,IACpG,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,UAAU;AAAA,IACR,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,cAAc;AAAA,IACZ,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,SAAS;AAAA,IACP,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,QAAQ,WAAW,WAAW,KAAK,CAAC;AAAA,EACrE;AACF;AACA,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAUV,SAAS,cAAc,OAAqC;AAC1D,SACE,UAAU,YACV,UAAU,WACV,UAAU,sBACV,UAAU,cACV,UAAU,kBACV,UAAU,WACV,UAAU;AAEd;AAEA,SAAS,UAAU,MAA4B;AAC7C,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAC9B,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AACA,QAAM,OAAO,cAAc,UAAU;AAErC,QAAM,UAAoC,CAAC;AAC3C,QAAM,QAAQ,oBAAI,IAAY;AAE9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC3B,YAAM,IAAI,WAAW,uBAAuB;AAAA,IAC9C;AACA,UAAM,SAAS,MAAM,MAAM,CAAC;AAC5B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,WAAW,kBAAkB,MAAM;AAAA,IAC/C;AACA,UAAM,cAAc,OAAO,QAAQ,GAAG;AACtC,UAAM,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,GAAG,WAAW;AACrE,UAAM,cAAc,gBAAgB,KAAK,SAAY,OAAO,MAAM,cAAc,CAAC;AAEjF,QAAI,CAAC,KAAK,aAAa,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7D,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AAEA,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,UAAI,gBAAgB,QAAW;AAC7B,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAMA,QAAO,KAAK,IAAI,CAAC;AACvB,UAAIA,SAAQ,CAACA,MAAK,WAAW,IAAI,GAAG;AAClC,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAM,IAAI,GAAG;AACb;AAAA,IACF;AAEA,QAAI,gBAAgB,QAAW;AAC7B,UAAI,YAAY,WAAW,GAAG;AAC5B,cAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,MAC5C;AACA,UAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,gBAAQ,GAAG,IAAI,CAAC;AAAA,MAClB;AACA,cAAQ,GAAG,EAAE,KAAK,WAAW;AAC7B;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,SAAS,UAAa,KAAK,WAAW,KAAK,KAAK,WAAW,IAAI,GAAG;AACpE,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AACA,QAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,cAAQ,GAAG,IAAI,CAAC;AAAA,IAClB;AACA,YAAQ,GAAG,EAAE,KAAK,IAAI;AACtB,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAkB,MAAkC;AACzE,QAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO;AAC3C,SAAO,OAAO,OAAO,SAAS,CAAC;AACjC;AAEA,SAAS,cAAc,MAAkB,MAAwB;AAC/D,SAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;AAChC;AAEA,SAAS,cAAc,MAAkB,MAAsB;AAC7D,QAAM,QAAQ,cAAc,MAAM,IAAI;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACA,MACA,UAA4B,CAAC,GACT;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAChC,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,MAAM,CAAC,cAAc,QAAQ,GAAG,EAAE,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAkB,MAAsC;AACrF,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAK,mBAAyC,SAAS,GAAG,GAAG;AAC3D,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,kBAAkB,MAAM,kBAAkB;AACjE;AAEA,SAAS,iBACP,MACA,MACA,UAA0C,CAAC,GACvB;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,oDAAoD,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,aAA+C;AACvE,QAAM,aACJ,mBAAmB,WAAW,sBAAsB,CAAC,KACrD,mBAAmB,WAAW,6BAA6B,CAAC,KAC5D,KAAK,KAAK,eAAe,GAAG,aAAa,eAAe;AAC1D,QAAM,MAAM,KAAK,MAAM,GAAG,aAAa,YAAY,MAAM,CAAC;AAC1D,QAAM,SACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAChD,wBAAwB,GAA8B,IACtD;AACN,MAAI,OAAO,WAAW,YAAY,CAAC,iCAAiC,MAAM,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,qDAAqD,MAAM;AAAA,IAC7D;AAAA,EACF;AAMA,QAAM,QAAQ,iCAAiC,KAAK,WAAW;AAC/D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAQ,QAAQ,QAAQ,KAA6C,CAAC;AACxE;AAEA,SAAS,aAAa,aAA+B;AACnD,QAAM,SAAS,YAAY,iBAAiB,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,oBAAoB,IAAI,aAAa,MAAM,CAAC;AAAA,EAC3D;AACF;AAEA,eAAe,UAAU,MAAkB,aAAqC;AAC9E,QAAM,aAAa;AAAA,IACjB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,OAAO,cAAc,MAAM,OAAO;AAAA,IAClC,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,QAAQ,cAAc,MAAM,QAAQ;AAAA,IACpC,MAAM,sBAAsB,MAAM,MAAM;AAAA,IACxC,OAAO,mBAAmB,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,IACnD,QAAQ,mBAAmB,MAAM,UAAU,EAAE,KAAK,EAAE,CAAC;AAAA,EACvD;AACA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,UAAU;AAAA,IACd,WAAW,WAAW;AAAA,IACtB,wBAAwB,WAAW,aAAa,OAAO,gBAAgB;AAAA,IACvE,OAAO,WAAW;AAAA,IAClB,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW;AAAA,IAClB,QAAQ,WAAW;AAAA,EACrB;AACA,QAAM,SAAS,MAAM,QAAQ,aAAa,OAAO;AACjD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,gBAAgB,cAAc,MAAM,SAAS;AACnD,QAAM,UAAU,cACZ,GAAG,aAAa,gBAAgB,WAAW,GAAG,MAAM,IACpD;AACJ,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,WAAW,iBAAiB;AAAA,EACxC;AACA,QAAM,YAAY;AAAA,IAChB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,YAAY,cAAc,MAAM,aAAa;AAAA,IAC7C;AAAA,IACA,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,YAAY,iBAAiB,MAAM,cAAc,EAAE,KAAK,GAAG,KAAK,EAAE,CAAC;AAAA,IACnE,MAAM,cAAc,MAAM,KAAK;AAAA,IAC/B,WAAW,cAAc,MAAM,YAAY;AAAA,IAC3C,KAAK,cAAc,MAAM,KAAK;AAAA,IAC9B,cAAc,cAAc,MAAM,eAAe;AAAA,IACjD,gBAAgB,cAAc,MAAM,iBAAiB;AAAA,IACrD,QAAQ,KAAK,MAAM,IAAI,SAAS;AAAA,EAClC;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,YAAY,UAAU;AAAA,MACtB,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,WAAW,UAAU;AAAA,MACrB,KAAK,UAAU;AAAA,MACf,cAAc,UAAU;AAAA,MACxB,gBAAgB,UAAU;AAAA,MAC1B,QAAQ,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,eAAe,mBAAmB,MAAkB,aAAqC;AACvF,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,KAAK,aAAa,wBAAwB;AAChD,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,YAAY,cAAc,MAAM,aAAa;AAAA,MAC7C,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C,KAAK,mBAAmB,cAAc,MAAM,KAAK,CAAC;AAAA,MAClD,YAAY,cAAc,MAAM,aAAa;AAAA,MAC7C,YAAY,mBAAmB,MAAM,eAAe,EAAE,KAAK,EAAE,CAAC;AAAA,IAChE;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,SAAS,mBAAmB,OAA+C;AACzE,SAAO,UAAU,SAAY,SAAY,gBAAgB,KAAK;AAChE;AAOA,eAAe,YAAY,MAAkB,aAAqC;AAChF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAMpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5F,UAAM,YAAY,oBAAoB,WAAW,KAAK,CAAC;AACvD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,iBAAiB;AACzC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,MACA,IAAI,cAAc,MAAM,IAAI;AAAA,MAC5B,cAAc,cAAc,MAAM,eAAe;AAAA,MACjD,OAAO,cAAc,MAAM,OAAO;AAAA,MAClC,QAAQ,cAAc,MAAM,QAAQ;AAAA,MACpC,SAAS,cAAc,MAAM,SAAS;AAAA,MACtC,UAAU,cAAc,MAAM,UAAU;AAAA,MACxC,cAAc,cAAc,MAAM,cAAc;AAAA,MAChD,YAAY,cAAc,MAAM,YAAY;AAAA,IAC9C;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,gBAAgB,MAAkB,aAAqC;AACpF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAI9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AAIrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,qBAAqB;AAC7C,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAIpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AACrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAaA,eAAe,WAAW,MAAkB,aAAqC;AAC/E,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,YAAY,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAC7E,QAAM,YAAY,cAAc,MAAM,WAAW;AACjD,QAAM,aAAa,cAAc,MAAM,aAAa;AAEpD,MAAI,KAAK,MAAM,IAAI,MAAM,GAAG;AAC1B,UAAM,QAAQ,MAAM,QAAQ,sBAAsB;AAAA,MAChD,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC1C;AAAA,EACF;AAEA,MAAI,KAAK,MAAM,IAAI,SAAS,GAAG;AAC7B,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,QAAQ,kBAAkB,QAAQ;AAAA,MACtC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACjC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,KAAK,UAAU,EAAE,WAAW,OAAO,CAAC,CAAC;AACjD;AAAA,EACF;AAEA,MAAI,KAAK,MAAM,IAAI,OAAO,GAAG;AAC3B,UAAM,SAAS,cAAc,MAAM,SAAS;AAC5C,UAAM,KAAK,aAAa,sBAAsB;AAC9C,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,SAAU,MAAM,GAAG;AAAA,MACvB;AAAA,QACE;AAAA,QACA,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,MAAM,IAAI,KAAK;AAAA,QAC1D,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,MACnC;AAAA,MACA,EAAE,SAAS,wBAAwB,UAAU;AAAA,IAC/C;AACA,YAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AAClD;AAAA,EACF;AAIA,QAAM,OAAO,cAAc,MAAM,MAAM;AACvC,QAAM,YAAY,cAAc,MAAM,IAAI;AAC1C,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,SAAS,aAAa,qBAAqB;AACjD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,aAAc,MAAM,OAAO;AAAA,IAC/B;AAAA,MACE;AAAA,MACA,GAAI,UAAU,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;AAAA,MAC5C,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;AAAA,MACrC,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,MACnC,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,IACnC;AAAA,IACA,EAAE,SAAS,wBAAwB,UAAU;AAAA,EAC/C;AACA,UAAQ,IAAI,KAAK,UAAU,WAAW,QAAQ,MAAM,CAAC,CAAC;AACxD;AAEA,eAAsB,KACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,QAAM,OAAO,UAAU,IAAI;AAC3B,MAAI,KAAK,YAAY,UAAU;AAC7B,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,oBAAoB;AACvC,UAAM,mBAAmB,MAAM,QAAQ,WAAW;AAClD;AAAA,EACF;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,UAAM,YAAY,MAAM,QAAQ,WAAW;AAC3C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,UAAM,gBAAgB,MAAM,QAAQ,WAAW;AAC/C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,UAAM,SAAS,MAAM,QAAQ,WAAW;AACxC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,WAAW;AAC9B,UAAM,WAAW,MAAM,QAAQ,WAAW;AAC1C;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAC1C;AAEO,SAAS,8BAA8B,SAAyB;AACrE,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,CAAC,QAAQ,MAAc,cAAsB,GAAG,IAAI,GAAG,SAAS;AAAA,EAClE;AACF;AAEO,SAAS,aAAmB;AACjC,iBAAe,MAAM,CAAC;AACxB;AAEA,eAAsB,OACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,QAAI,iBAAiB,YAAY;AAC/B,qBAAe,iBAAiB,KAAK,CAAC;AACtC,qBAAe;AACf,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":["next"]}

package/dist/access-errors.d.ts

@@ -25,6 +25,20 @@ export declare class NamespaceNotWritableError extends EngramAccessInputError {
     readonly principal: string | undefined;
     constructor(attemptedNamespace: string, principal: string | undefined, message?: string);
 }
+/**
+ * Dictionary keys that change object shape or prototype resolution. A JSON
+ * body can carry them as own members; the request preprocessors reject them
+ * before copying, so a decoded `__proto__` member cannot become an inherited
+ * schema field. Lives in this lowest module so the boundary and wire schema
+ * layers share one implementation without an import cycle.
+ */
+export declare const RESERVED_PROTO_KEYS: readonly string[];
+/**
+ * Reject the reserved keys with the input-error type, so a client that
+ * submits a magic dictionary key gets a validation error instead of a
+ * silently reshaped request object.
+ */
+export declare function rejectReservedArgumentKey(key: string): void;
 /**
  * Standard Levenshtein edit distance. O(n*m) over bounded inputs.
  * Exported so the test can verify it without importing private helpers.

package/dist/access-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-errors.d.ts","sourceRoot":"","sources":["../src/access-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAIpC,wEAAwE;AACxE,qBAAa,0BAA2B,SAAQ,KAAK;CAAG;AAExD,uCAAuC;AACvC,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD;;;;;;GAMG;AACH,qBAAa,yBAA0B,SAAQ,sBAAsB;IAEjE,QAAQ,CAAC,kBAAkB,EAAE,MAAM;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS;gBAD7B,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,CAAC,EAAE,MAAM;CAKnB;AAID;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,mBAAmB,EAAE,CAiBvB;AA6FD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CAUR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,OAAO,GACf,MAAM,CAuCR"}
+{"version":3,"file":"access-errors.d.ts","sourceRoot":"","sources":["../src/access-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAIpC,wEAAwE;AACxE,qBAAa,0BAA2B,SAAQ,KAAK;CAAG;AAExD,uCAAuC;AACvC,qBAAa,sBAAuB,SAAQ,KAAK;CAAG;AAEpD;;;;;;GAMG;AACH,qBAAa,yBAA0B,SAAQ,sBAAsB;IAEjE,QAAQ,CAAC,kBAAkB,EAAE,MAAM;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS;gBAD7B,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,EACtC,OAAO,CAAC,EAAE,MAAM;CAKnB;AAID;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAA8C,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI3D;AAID;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAKD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,mBAAmB,EAAE,CAiBvB;AA6FD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,MAAM,CAUR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,QAAQ,EAClB,MAAM,CAAC,EAAE,OAAO,GACf,MAAM,CAuCR"}

package/dist/access-errors.js

@@ -2,21 +2,25 @@ import {
   EngramAccessForbiddenError,
   EngramAccessInputError,
   NamespaceNotWritableError,
+  RESERVED_PROTO_KEYS,
   SUGGESTION_REQUEST_MAX_LEN,
   invalidArgsError,
   levenshtein,
   nearestSuggestions,
+  rejectReservedArgumentKey,
   unknownToolError
-} from "./chunk-LGEH473S.js";
+} from "./chunk-CJCTKL6Y.js";
 import "./chunk-PZ5AY32C.js";
 export {
   EngramAccessForbiddenError,
   EngramAccessInputError,
   NamespaceNotWritableError,
+  RESERVED_PROTO_KEYS,
   SUGGESTION_REQUEST_MAX_LEN,
   invalidArgsError,
   levenshtein,
   nearestSuggestions,
+  rejectReservedArgumentKey,
   unknownToolError
 };
 //# sourceMappingURL=access-errors.js.map

package/dist/access-extraction-force-flush.js

@@ -1,73 +1,73 @@
 import {
   extractionForceFlush
-} from "./chunk-HVFX2N2G.js";
+} from "./chunk-UAUV3BWS.js";
 import "./chunk-W4F3C7N7.js";
 import "./chunk-MPC7TYTZ.js";
-import "./chunk-JFH6JAGY.js";
+import "./chunk-G67EUQAB.js";
 import "./chunk-QV2VZKD5.js";
 import "./chunk-IFBSZGW3.js";
-import "./chunk-OGXXGHW6.js";
 import "./chunk-TFEHSPGQ.js";
 import "./chunk-VQ7B2Q6M.js";
+import "./chunk-OGXXGHW6.js";
+import "./chunk-IBDWYRDR.js";
 import "./chunk-BANSBRNX.js";
-import "./chunk-Y43X3E24.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JWX2Q6HS.js";
-import "./chunk-ZWTHVUT5.js";
+import "./chunk-3UZ2VMKD.js";
 import "./chunk-HNOSWPKG.js";
 import "./chunk-WWDO7ZWM.js";
-import "./chunk-5Y43VGYB.js";
 import "./chunk-45VUHDV2.js";
-import "./chunk-VZELUMKK.js";
-import "./chunk-5HFVWYHL.js";
+import "./chunk-5Y43VGYB.js";
 import "./chunk-MUHGYV2V.js";
+import "./chunk-NQP4ZYGG.js";
+import "./chunk-5HFVWYHL.js";
+import "./chunk-KIW3OOZE.js";
 import "./chunk-YE4JBZO5.js";
 import "./chunk-5KVT6G5U.js";
-import "./chunk-KIW3OOZE.js";
+import "./chunk-VYDGHJIN.js";
 import "./chunk-KZSGBWOJ.js";
 import "./chunk-7O5EW7KX.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-EWJZZDRG.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-7O2MC42R.js";
-import "./chunk-VYDGHJIN.js";
-import "./chunk-E5QEF3JO.js";
-import "./chunk-B6SPPYGJ.js";
-import "./chunk-FMFCQRDM.js";
-import "./chunk-UD7UNYRD.js";
+import "./chunk-YRZPBN46.js";
+import "./chunk-7IWRLYFJ.js";
+import "./chunk-ZANNIXXE.js";
 import "./chunk-IISBCCWR.js";
-import "./chunk-WBDIZWJQ.js";
-import "./chunk-WYPCJK6K.js";
+import "./chunk-UD7UNYRD.js";
+import "./chunk-TSS3D7ZY.js";
+import "./chunk-QKERFEJS.js";
 import "./chunk-2YA5N2BY.js";
 import "./chunk-YLTU2DC4.js";
-import "./chunk-GBOYOL5L.js";
+import "./chunk-3PJEDHLD.js";
 import "./chunk-HUDPXTXW.js";
 import "./chunk-AZEZSQ5R.js";
 import "./chunk-EI6V5UXY.js";
-import "./chunk-JX3E4XCW.js";
-import "./chunk-QA3Y2O6H.js";
-import "./chunk-V27FK6D6.js";
+import "./chunk-PDOOUXCS.js";
+import "./chunk-YAVIBVCU.js";
+import "./chunk-6XTUZKCZ.js";
 import "./chunk-DOWACHYO.js";
 import "./chunk-QNUNAXBE.js";
 import "./chunk-LTHVM4XN.js";
 import "./chunk-MTTYIXSU.js";
 import "./chunk-C37ZRXX7.js";
 import "./chunk-NVKO5YKP.js";
+import "./chunk-ZGFLIK5H.js";
 import "./chunk-RF2SMMPP.js";
 import "./chunk-3X5OPDPF.js";
 import "./chunk-HXFIILGF.js";
 import "./chunk-WTWQA7BB.js";
 import "./chunk-VZIAVM72.js";
 import "./chunk-HRATODNO.js";
+import "./chunk-D5EV6Y2L.js";
+import "./chunk-2U4LMSEX.js";
+import "./chunk-G54BOKZ6.js";
 import "./chunk-UFGFMWAD.js";
 import "./chunk-LXATZLSC.js";
-import "./chunk-ZGFLIK5H.js";
-import "./chunk-VCVEMQJK.js";
-import "./chunk-CCU7URRP.js";
-import "./chunk-FK4WC6VK.js";
-import "./chunk-MYCCO6AA.js";
-import "./chunk-MHSBOEH7.js";
+import "./chunk-JM2YZKCQ.js";
+import "./chunk-ROKDHO74.js";
 import "./chunk-3UXOZBHV.js";
 import "./chunk-J6GZ2254.js";
 import "./chunk-DC55RIEZ.js";
@@ -76,20 +76,21 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-LXY5VVGM.js";
 import "./chunk-GKCXTSFF.js";
-import "./chunk-73YVMZ7D.js";
+import "./chunk-BIVKPQ6Q.js";
+import "./chunk-2K3AUDH7.js";
+import "./chunk-CSAKJVXW.js";
+import "./chunk-K2XUWZBM.js";
+import "./chunk-OD4FM2U7.js";
+import "./chunk-2G4TV2ML.js";
+import "./chunk-T6OZW2WR.js";
 import "./chunk-MJFL75J6.js";
 import "./chunk-QEDLJDHP.js";
 import "./chunk-U4LUIE6Y.js";
-import "./chunk-T6OZW2WR.js";
 import "./chunk-5YQXWVCP.js";
+import "./chunk-FKBGK3NC.js";
 import "./chunk-ZY2MNJR6.js";
-import "./chunk-4IWEPQEV.js";
-import "./chunk-IR4C3DP2.js";
-import "./chunk-CSAKJVXW.js";
-import "./chunk-K2XUWZBM.js";
-import "./chunk-OD4FM2U7.js";
-import "./chunk-GJVGFKOU.js";
-import "./chunk-X2KO4FK5.js";
+import "./chunk-CYCEROPR.js";
+import "./chunk-FNFURZBZ.js";
 import "./chunk-GZFKCLRC.js";
 import "./chunk-EKUI7I2X.js";
 import "./chunk-ETSJD5IV.js";
@@ -102,32 +103,32 @@ import "./chunk-IJ6WHMFB.js";
 import "./chunk-AWD36R4D.js";
 import "./chunk-JV3C2MNQ.js";
 import "./chunk-ADXCCZL2.js";
-import "./chunk-AJG2TAMR.js";
+import "./chunk-IEEV27BC.js";
 import "./chunk-236PXYG7.js";
 import "./chunk-ZCUTSMR2.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-VEFGHRKV.js";
+import "./chunk-ZOJUWVAU.js";
 import "./chunk-ZJP66Q4I.js";
-import "./chunk-ELWI2R6H.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-3ODZLCHC.js";
-import "./chunk-H34INI3P.js";
-import "./chunk-DI5ET2IE.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
+import "./chunk-PFUXPTBT.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
 import "./chunk-OVZIYLBZ.js";
 import "./chunk-EXYT52NR.js";
 import "./chunk-DOJBV6WR.js";
-import "./chunk-PFUXPTBT.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-QCP75JGO.js";
-import "./chunk-A7Q43EUZ.js";
+import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
 import "./chunk-72A4L5JJ.js";
+import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
@@ -135,19 +136,19 @@ import "./chunk-S2HLHAZ4.js";
 import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-S45INSV3.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
+import "./chunk-S45INSV3.js";
 import "./chunk-FHGWKODN.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-3ONXXHQO.js";
-import "./chunk-YXZG5TVN.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -156,6 +157,15 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
+import "./chunk-NWA6IXR3.js";
+import "./chunk-VILPVT4S.js";
+import "./chunk-AF2XMJKD.js";
+import "./chunk-OR42ZI54.js";
+import "./chunk-23G5P7TA.js";
+import "./chunk-C64XATK7.js";
+import "./chunk-42JKGUFJ.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
@@ -164,16 +174,7 @@ import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
 import "./chunk-7VLBZKNB.js";
 import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
-import "./chunk-NWA6IXR3.js";
-import "./chunk-VILPVT4S.js";
-import "./chunk-AF2XMJKD.js";
-import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
-import "./chunk-C64XATK7.js";
-import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-WLNWFHX3.js";
+import "./chunk-UXXK523X.js";
 import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
@@ -200,16 +201,16 @@ import "./chunk-AQEJKOKI.js";
 import "./chunk-4RNBLLZR.js";
 import "./chunk-WZU5AGO6.js";
 import "./chunk-YLXETSAH.js";
-import "./chunk-YNBMBL4C.js";
+import "./chunk-4XYAWK5H.js";
 import "./chunk-ANZZLRUX.js";
 import "./chunk-353C5UNV.js";
 import "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-R6HMAIKM.js";
-import "./chunk-GYNRNKMW.js";
-import "./chunk-BUKK5SWA.js";
+import "./chunk-YMJRLT7S.js";
+import "./chunk-7LCGFUMB.js";
+import "./chunk-X7Y7WX73.js";
 import "./chunk-WEHSQBFR.js";
-import "./chunk-UVYI6VIX.js";
 import "./chunk-J4EB7DNW.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
@@ -217,7 +218,7 @@ import "./chunk-FP2373TW.js";
 import "./chunk-Z2YFLXHU.js";
 import "./chunk-I4WBNM3M.js";
 import "./chunk-SOAU2OE2.js";
-import "./chunk-KHZVAISH.js";
+import "./chunk-UWRHHRDK.js";
 import "./chunk-AJHNXIQU.js";
 import "./chunk-QUMKDRCF.js";
 import "./chunk-TIGYOZBU.js";
@@ -231,7 +232,7 @@ import "./chunk-7RJUVTVF.js";
 import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
-import "./chunk-YO2JEX2Z.js";
+import "./chunk-OGBQMY46.js";
 import "./chunk-PWPIERBM.js";
 import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
@@ -239,22 +240,22 @@ import "./chunk-BTNNL7ZW.js";
 import "./chunk-JDSVLVCG.js";
 import "./chunk-5GKPFL3S.js";
 import "./chunk-JAKIDQB2.js";
-import "./chunk-CLVILSBR.js";
+import "./chunk-OZNBZJ3S.js";
 import "./chunk-UI3NYK34.js";
 import "./chunk-XXR4A33N.js";
-import "./chunk-UWMZT2TY.js";
-import "./chunk-HLWXCDUQ.js";
-import "./chunk-5BE3FLKL.js";
+import "./chunk-3DAWHP5K.js";
+import "./chunk-TAUHAP5J.js";
 import "./chunk-63LFM77Z.js";
-import "./chunk-LDWE7OZS.js";
+import "./chunk-UWMZT2TY.js";
 import "./chunk-GCGJW34D.js";
+import "./chunk-LDWE7OZS.js";
 import "./chunk-XZ66U5M3.js";
 import "./chunk-SWRRZNHM.js";
 import "./chunk-JNA7LFMQ.js";
 import "./chunk-LQWOFU6L.js";
 import "./chunk-EBV6VXKF.js";
 import "./chunk-P7FMDTKL.js";
-import "./chunk-S5CQI2KF.js";
+import "./chunk-B3GKQ6DU.js";
 import "./chunk-ESG6ITGP.js";
 import "./chunk-PCXDUHQH.js";
 import "./chunk-VUFL7X3H.js";
@@ -266,7 +267,7 @@ import "./chunk-63E37JCN.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";
-import "./chunk-LGEH473S.js";
+import "./chunk-CJCTKL6Y.js";
 import "./chunk-R2MBW2S4.js";
 import "./chunk-F2XNSIPP.js";
 import "./chunk-G73MCJKL.js";