@remnic/core 9.3.532 → 9.3.534

package/dist/cli.js

@@ -89,7 +89,7 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-KCLX6LOV.js";
+} from "./chunk-SRAF4TIS.js";
 import "./chunk-7F7Z6MOS.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
@@ -162,8 +162,8 @@ import "./chunk-7DTASS5T.js";
 import "./chunk-KFY3SGN7.js";
 import "./chunk-PCI747N2.js";
 import "./chunk-CMTINOFS.js";
-import "./chunk-BECQDWBA.js";
-import "./chunk-CWWMTTQE.js";
+import "./chunk-TQNRI55H.js";
+import "./chunk-6GUG4YNM.js";
 import "./chunk-JXS5PDQ7.js";
 import "./chunk-SKGV326D.js";
 import "./chunk-BEUDU7Y4.js";

package/dist/{connectors-cli-DbTPNj2H.d.ts → connectors-cli-2iaQ5tX2.d.ts}

@@ -1,4 +1,4 @@
-import { b as ConnectorCursor, a as ConnectorDocument } from './framework-CyHYDcri.js';
+import { b as ConnectorCursor, a as ConnectorDocument } from './framework-CNDn2164.js';
 
 /**
  * @remnic/core — Live Connectors State Store (issue #683 PR 1/N)

package/dist/connectors-cli.d.ts

@@ -1,2 +1,2 @@
-import './framework-CyHYDcri.js';
-export { b as CONNECTORS_OUTPUT_FORMATS, c as ConnectorRow, n as ConnectorRowDefinition, C as ConnectorRunResult, a as ConnectorsOutputFormat, P as ParsedConnectorsListOptions, f as ParsedConnectorsStatusOptions, R as RunConnectorPollOnceArgs, o as buildConnectorRowsFromDefinitions, p as parseConnectorsFormat, g as parseConnectorsListOptions, h as parseConnectorsRunName, i as parseConnectorsStatusOptions, j as renderConnectorsList, k as renderConnectorsRunResult, m as runConnectorPollOnce } from './connectors-cli-DbTPNj2H.js';
+import './framework-CNDn2164.js';
+export { b as CONNECTORS_OUTPUT_FORMATS, c as ConnectorRow, n as ConnectorRowDefinition, C as ConnectorRunResult, a as ConnectorsOutputFormat, P as ParsedConnectorsListOptions, f as ParsedConnectorsStatusOptions, R as RunConnectorPollOnceArgs, o as buildConnectorRowsFromDefinitions, p as parseConnectorsFormat, g as parseConnectorsListOptions, h as parseConnectorsRunName, i as parseConnectorsStatusOptions, j as renderConnectorsList, k as renderConnectorsRunResult, m as runConnectorPollOnce } from './connectors-cli-2iaQ5tX2.js';

package/dist/explicit-capture.d.ts

@@ -19,7 +19,7 @@ import './local-llm.js';
 import './fallback-llm.js';
 import './resolve-provider-secret.js';
 import './live-connectors-runner.js';
-import './framework-CyHYDcri.js';
+import './framework-CNDn2164.js';
 import './relevance.js';
 import './negative.js';
 import './recall-state.js';

package/dist/{framework-CyHYDcri.d.ts → framework-CNDn2164.d.ts}

@@ -19,14 +19,22 @@
  */
 /**
  * Free-form connector configuration. Validated by each connector's
- * `validateConfig` implementation. Stored alongside the cursor in the state
- * store. MUST be JSON-serializable: no functions, no class instances, no
+ * `validateConfig` implementation and passed to `syncIncremental` for runtime
+ * use. MUST be JSON-serializable: no functions, no class instances, no
  * circular references.
  *
- * Connectors MUST NOT persist secrets here — credentials belong in OS keychain
- * / OAuth token storage (PR 2 design).
+ * Runtime configs may contain hydrated credentials. Do not persist a runtime
+ * config directly. Any code that needs to store connector settings must call
+ * `persistableConnectorConfig()` so credentials are stripped or replaced by
+ * connector-owned references.
  */
 type ConnectorConfig = Record<string, unknown>;
+/**
+ * Redact secret-looking keys from a JSON-serializable connector config.
+ * Built-in connectors provide explicit projections, but this default keeps
+ * third-party connectors from accidentally persisting obvious credentials.
+ */
+declare function redactConnectorConfigSecrets(config: ConnectorConfig): ConnectorConfig;
 /**
  * Opaque cursor describing "where the last sync left off". Each connector
  * defines what `kind` and `value` mean (e.g. Drive: `{kind: "pageToken",
@@ -127,16 +135,25 @@ interface LiveConnector {
     readonly description?: string;
     /**
      * Validate raw user-supplied config. MUST throw on malformed input — never
-     * silently default. The returned object is what gets persisted and passed
-     * back to `syncIncremental`. Connectors SHOULD strip unknown fields.
+     * silently default. The returned object is the runtime config passed back to
+     * `syncIncremental`; it may contain hydrated credentials and MUST NOT be
+     * persisted directly. Connectors SHOULD strip unknown fields.
      */
     validateConfig(raw: unknown): ConnectorConfig;
+    /**
+     * Return the subset of validated config that may be written to disk. Use this
+     * for state/config persistence instead of `validateConfig()`. Connectors that
+     * need credentials should omit the raw values here and store only non-secret
+     * scope/schedule fields plus any connector-owned secret references.
+     */
+    persistConfig?(validated: ConnectorConfig): ConnectorConfig;
     /**
      * Run one incremental sync pass. See `SyncIncrementalArgs` /
      * `SyncIncrementalResult` for the contract.
      */
     syncIncremental(args: SyncIncrementalArgs): Promise<SyncIncrementalResult>;
 }
+declare function persistableConnectorConfig(connector: Pick<LiveConnector, "persistConfig">, validated: ConnectorConfig): ConnectorConfig;
 /**
  * Regex enforcing the connector-id naming rule. Exported so connectors and
  * tests can validate ids consistently with the registry.
@@ -150,4 +167,4 @@ declare const CONNECTOR_ID_PATTERN: RegExp;
  */
 declare function isValidConnectorId(id: unknown): id is string;
 
-export { type ConnectorConfig as C, type LiveConnector as L, type SyncIncrementalResult as S, type ConnectorDocument as a, type ConnectorCursor as b, CONNECTOR_ID_PATTERN as c, type ConnectorDocumentSource as d, type SyncIncrementalArgs as e, isValidConnectorId as i };
+export { type ConnectorConfig as C, type LiveConnector as L, type SyncIncrementalResult as S, type ConnectorDocument as a, type ConnectorCursor as b, CONNECTOR_ID_PATTERN as c, type ConnectorDocumentSource as d, type SyncIncrementalArgs as e, isValidConnectorId as i, persistableConnectorConfig as p, redactConnectorConfigSecrets as r };

package/dist/index.d.ts

@@ -60,9 +60,9 @@ export { OFFLINE_SYNC_APPLY_MAX_BODY_BYTES, OFFLINE_SYNC_CHANGESET_FORMAT, OFFLI
 import { D as DiscoveredExtension } from './semantic-consolidation-4HkHWgeI.js';
 export { E as ExtensionSchema, R as REMNIC_EXTENSIONS_TOTAL_TOKEN_LIMIT, b as buildExtensionsBlockForConsolidation, d as discoverMemoryExtensions, r as resolveExtensionsRoot } from './semantic-consolidation-4HkHWgeI.js';
 export { ConnectorCapability, ConnectorInstance, ConnectorManifest, ConnectorRegistry, DoctorCheck, DoctorResult, InstallOptions, InstallResult, MARKETPLACE_MANIFEST_FILENAME, MARKETPLACE_SCHEMA_VERSION, MarketplaceConfig, MarketplaceEntry, MarketplaceInstallResult, MarketplaceInstallType, MarketplaceLogger, MarketplaceManifest, MarketplaceValidation, RemoveResult, checkMarketplaceManifest, coerceInstallExtension, doctorConnector, generateMarketplaceManifest, getConnectorToken, installConnector, installFromMarketplace, listConnectors, loadRegistry, removeConnector, saveRegistry, validateMarketplaceManifest, writeMarketplaceManifest } from './connectors/index.js';
-import { L as LiveConnector, S as SyncIncrementalResult } from './framework-CyHYDcri.js';
-export { c as CONNECTOR_ID_PATTERN, C as ConnectorConfig, b as ConnectorCursor, a as ConnectorDocument, d as ConnectorDocumentSource, e as SyncIncrementalArgs, i as isValidConnectorId } from './framework-CyHYDcri.js';
-export { b as CONNECTORS_OUTPUT_FORMATS, c as ConnectorRow, C as ConnectorRunResult, d as ConnectorState, e as ConnectorSyncStatus, a as ConnectorsOutputFormat, P as ParsedConnectorsListOptions, f as ParsedConnectorsStatusOptions, R as RunConnectorPollOnceArgs, l as listConnectorStates, p as parseConnectorsFormat, g as parseConnectorsListOptions, h as parseConnectorsRunName, i as parseConnectorsStatusOptions, r as readConnectorState, j as renderConnectorsList, k as renderConnectorsRunResult, m as runConnectorPollOnce, w as writeConnectorState } from './connectors-cli-DbTPNj2H.js';
+import { L as LiveConnector, S as SyncIncrementalResult } from './framework-CNDn2164.js';
+export { c as CONNECTOR_ID_PATTERN, C as ConnectorConfig, b as ConnectorCursor, a as ConnectorDocument, d as ConnectorDocumentSource, e as SyncIncrementalArgs, i as isValidConnectorId, p as persistableConnectorConfig, r as redactConnectorConfigSecrets } from './framework-CNDn2164.js';
+export { b as CONNECTORS_OUTPUT_FORMATS, c as ConnectorRow, C as ConnectorRunResult, d as ConnectorState, e as ConnectorSyncStatus, a as ConnectorsOutputFormat, P as ParsedConnectorsListOptions, f as ParsedConnectorsStatusOptions, R as RunConnectorPollOnceArgs, l as listConnectorStates, p as parseConnectorsFormat, g as parseConnectorsListOptions, h as parseConnectorsRunName, i as parseConnectorsStatusOptions, r as readConnectorState, j as renderConnectorsList, k as renderConnectorsRunResult, m as runConnectorPollOnce, w as writeConnectorState } from './connectors-cli-2iaQ5tX2.js';
 export { LiveConnectorDefinition, LiveConnectorRunItem, LiveConnectorSkipReason, LiveConnectorsRunSummary, builtInLiveConnectorDefinitions, hasEnabledLiveConnector, runLiveConnectorsOnce } from './live-connectors-runner.js';
 import { TokenEntry } from './tokens.js';
 export { TokenStore, generateToken, getAllValidTokens, getAllValidTokensCached, listTokens, loadTokenStore, resolveConnectorFromToken, revokeToken, saveTokenStore } from './tokens.js';
@@ -74,7 +74,7 @@ export { EnrichmentAuditEntry, EnrichmentCandidate, EnrichmentCostTier, Enrichme
 export { d as BulkImportError, B as BulkImportOptions, b as BulkImportResult, a as BulkImportSource, e as BulkImportSourceAdapter, f as ImportSourceRole, I as ImportTurn, g as ImportTurnValidationIssue, i as isImportRole, p as parseIsoTimestamp, v as validateImportTurn } from './types-BliCnURB.js';
 export { clearBulkImportSources, getBulkImportSource, listBulkImportSources, registerBulkImportSource } from './bulk-import/index.js';
 export { a as ProcessBatchContext, P as ProcessBatchFn, b as ProcessBatchResult, f as formatBatchTranscript, r as resolveBulkImportContext, c as runBulkImportPipeline, v as validateBatchSize } from './pipeline-D18UAKlN.js';
-export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-CPe_2KB1.js';
+export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-9pwA_PXm.js';
 export { DEFAULT_IMPORT_BATCH_SIZE, ImportProgress, ImportedMemory, ImporterAdapter, ImporterParseOptions, ImporterTransformOptions, ImporterWriteResult, ImporterWriteTarget, RunImportOptions, RunImporterResult, defaultWriteMemoriesToOrchestrator, importedMemoryToTurn, runImporter, validateImportBatchSize, validateImportRateLimit } from './importers/index.js';
 export { FallbackLlmClient, FallbackLlmOptions, FallbackLlmResponse, FallbackLlmRuntimeContext } from './fallback-llm.js';
 export { ComputeMemoryWorthInput, MemoryWorthResult, computeMemoryWorth } from './memory-worth.js';

package/dist/index.js

@@ -12,14 +12,6 @@ import {
   writePeer,
   writePeerProfile
 } from "./chunk-PRQJ5ESM.js";
-import {
-  DEFAULT_IMPORT_BATCH_SIZE,
-  defaultWriteMemoriesToOrchestrator,
-  importedMemoryToTurn,
-  runImporter,
-  validateImportBatchSize,
-  validateImportRateLimit
-} from "./chunk-LUDUFZTV.js";
 import {
   EnrichmentProviderRegistry,
   WebSearchProvider,
@@ -28,6 +20,14 @@ import {
   readAuditLog,
   runEnrichmentPipeline
 } from "./chunk-HINSGUA7.js";
+import {
+  DEFAULT_IMPORT_BATCH_SIZE,
+  defaultWriteMemoriesToOrchestrator,
+  importedMemoryToTurn,
+  runImporter,
+  validateImportBatchSize,
+  validateImportRateLimit
+} from "./chunk-LUDUFZTV.js";
 import {
   MARKETPLACE_MANIFEST_FILENAME,
   MARKETPLACE_SCHEMA_VERSION,
@@ -93,7 +93,7 @@ import {
   listTrainingExportAdapters,
   registerTrainingExportAdapter,
   runBulkImportCliCommand
-} from "./chunk-KCLX6LOV.js";
+} from "./chunk-SRAF4TIS.js";
 import "./chunk-7F7Z6MOS.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
@@ -182,13 +182,13 @@ import {
   saveTaxonomy,
   validateSlug,
   validateTaxonomy
-} from "./chunk-QRMZX3PR.js";
+} from "./chunk-KLZDGMDI.js";
 import "./chunk-Y2SXZ5KZ.js";
+import "./chunk-BFBF3XEF.js";
 import {
   migrateFromEngram,
   rollbackFromEngramMigration
 } from "./chunk-S53PKKWK.js";
-import "./chunk-BFBF3XEF.js";
 import "./chunk-HHLLAQGZ.js";
 import "./chunk-UWK5OXUJ.js";
 import "./chunk-RLV3PQGH.js";
@@ -255,7 +255,7 @@ import {
   builtInLiveConnectorDefinitions,
   hasEnabledLiveConnector,
   runLiveConnectorsOnce
-} from "./chunk-QMYXNM4P.js";
+} from "./chunk-VU3SVYMA.js";
 import "./chunk-H63EDPFJ.js";
 import {
   hasBroadGraphIntent,
@@ -409,14 +409,16 @@ import {
   defaultGoogleDriveClientFactory,
   validateGoogleDriveConfig,
   validateNotionConfig
-} from "./chunk-BECQDWBA.js";
+} from "./chunk-TQNRI55H.js";
 import {
   CONNECTOR_ID_PATTERN,
   isValidConnectorId,
   listConnectorStates,
+  persistableConnectorConfig,
   readConnectorState,
+  redactConnectorConfigSecrets,
   writeConnectorState
-} from "./chunk-CWWMTTQE.js";
+} from "./chunk-6GUG4YNM.js";
 import "./chunk-JXS5PDQ7.js";
 import "./chunk-SKGV326D.js";
 import "./chunk-BEUDU7Y4.js";
@@ -4735,6 +4737,7 @@ export {
   parseXrayFormat,
   partsFromRenderedText,
   performReview,
+  persistableConnectorConfig,
   planRecallMode,
   projectNamespaceName,
   promoteSpace,
@@ -4757,6 +4760,7 @@ export {
   recallForActiveMemory,
   recallRequestSchema,
   recordMemoryOutcome,
+  redactConnectorConfigSecrets,
   registerBulkImportSource,
   registerPublisher,
   registerTrainingExportAdapter,