@remnic/core 9.3.550 → 9.3.552

package/dist/{chunk-HWVTS5NO.js → chunk-UZYLX7M6.js}

@@ -14,10 +14,10 @@ function compileSafePrincipalRegex(pattern) {
 }
 function resolvePrincipal(sessionKey, config) {
   if (!config.namespacesEnabled) return "default";
-  const sk = sessionKey ?? "";
+  const sk = typeof sessionKey === "string" && sessionKey.trim().length > 0 ? sessionKey : "";
   const mode = config.principalFromSessionKeyMode;
   const rules = config.principalFromSessionKeyRules ?? [];
-  if (!sk) return "default";
+  if (!sk) return void 0;
   if (mode === "prefix") {
     for (const r of rules) {
       if (sk.startsWith(r.match)) return r.principal;
@@ -45,24 +45,28 @@ function resolvePrincipal(sessionKey, config) {
 }
 function canReadNamespace(principal, namespace, config) {
   if (!config.namespacesEnabled) return true;
+  if (!principal) return false;
   const policy = config.namespacePolicies.find((p) => p.name === namespace);
   if (!policy) return namespace === config.defaultNamespace || namespace === config.sharedNamespace;
   return policy.readPrincipals.includes(principal) || policy.readPrincipals.includes("*");
 }
 function canWriteNamespace(principal, namespace, config) {
   if (!config.namespacesEnabled) return true;
+  if (!principal) return false;
   const policy = config.namespacePolicies.find((p) => p.name === namespace);
   if (!policy) return namespace === config.defaultNamespace;
   return policy.writePrincipals.includes(principal) || policy.writePrincipals.includes("*");
 }
 function defaultNamespaceForPrincipal(principal, config) {
   if (!config.namespacesEnabled) return config.defaultNamespace;
+  if (!principal) return config.defaultNamespace;
   const exists = config.namespacePolicies.some((p) => p.name === principal);
   return exists ? principal : config.defaultNamespace;
 }
 function recallNamespacesForPrincipal(principal, config) {
   const out = [];
   if (!config.namespacesEnabled) return [config.defaultNamespace];
+  if (!principal) return out;
   const selfNs = defaultNamespaceForPrincipal(principal, config);
   if (config.defaultRecallNamespaces.includes("self") && canReadNamespace(principal, selfNs, config)) {
     out.push(selfNs);
@@ -85,4 +89,4 @@ export {
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal
 };
-//# sourceMappingURL=chunk-HWVTS5NO.js.map
+//# sourceMappingURL=chunk-UZYLX7M6.js.map

package/dist/chunk-UZYLX7M6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/principal.ts"],"sourcesContent":["import type { PluginConfig } from \"../types.js\";\nimport { isLikelyUnsafeRegex } from \"../routing/engine.js\";\n\nconst MAX_REGEX_SESSION_KEY_LENGTH = 512;\n\nfunction compileSafePrincipalRegex(pattern: string): RegExp | null {\n  if (isLikelyUnsafeRegex(pattern)) return null;\n  try {\n    return new RegExp(pattern);\n  } catch {\n    return null;\n  }\n}\n\nexport function resolvePrincipal(sessionKey: string | undefined, config: PluginConfig): string | undefined {\n  if (!config.namespacesEnabled) return \"default\";\n  const sk = typeof sessionKey === \"string\" && sessionKey.trim().length > 0\n    ? sessionKey\n    : \"\";\n  const mode = config.principalFromSessionKeyMode;\n  const rules = config.principalFromSessionKeyRules ?? [];\n\n  if (!sk) return undefined;\n\n  if (mode === \"prefix\") {\n    for (const r of rules) {\n      if (sk.startsWith(r.match)) return r.principal;\n    }\n  } else if (mode === \"map\") {\n    for (const r of rules) {\n      if (sk === r.match) return r.principal;\n    }\n  } else if (mode === \"regex\") {\n    if (sk.length <= MAX_REGEX_SESSION_KEY_LENGTH) {\n      for (const r of rules) {\n        const re = compileSafePrincipalRegex(r.match);\n        if (re?.test(sk)) {\n          return r.principal;\n        }\n      }\n    }\n  }\n\n  // Fallback heuristic: \"agent:<agentId>:<channelType>:...\"\n  const parts = sk.split(\":\");\n  if (parts.length >= 2 && parts[0] === \"agent\") {\n    const agentId = parts[1];\n    if (agentId && agentId.length > 0) return agentId;\n  }\n  return \"default\";\n}\n\nexport function canReadNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {\n  if (!config.namespacesEnabled) return true;\n  if (!principal) return false;\n  const policy = config.namespacePolicies.find((p) => p.name === namespace);\n  if (!policy) return namespace === config.defaultNamespace || namespace === config.sharedNamespace;\n  return policy.readPrincipals.includes(principal) || policy.readPrincipals.includes(\"*\");\n}\n\nexport function canWriteNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {\n  if (!config.namespacesEnabled) return true;\n  if (!principal) return false;\n  const policy = config.namespacePolicies.find((p) => p.name === namespace);\n  if (!policy) return namespace === config.defaultNamespace;\n  return policy.writePrincipals.includes(principal) || policy.writePrincipals.includes(\"*\");\n}\n\n/**\n * Default \"self\" namespace for a principal.\n *\n * Heuristic:\n * - If there's a namespace policy with the same name as the principal, use it.\n * - Otherwise use config.defaultNamespace.\n */\nexport function defaultNamespaceForPrincipal(principal: string | undefined, config: PluginConfig): string {\n  if (!config.namespacesEnabled) return config.defaultNamespace;\n  if (!principal) return config.defaultNamespace;\n  const exists = config.namespacePolicies.some((p) => p.name === principal);\n  return exists ? principal : config.defaultNamespace;\n}\n\nexport function recallNamespacesForPrincipal(principal: string | undefined, config: PluginConfig): string[] {\n  const out: string[] = [];\n  if (!config.namespacesEnabled) return [config.defaultNamespace];\n  if (!principal) return out;\n\n  const selfNs = defaultNamespaceForPrincipal(principal, config);\n  if (config.defaultRecallNamespaces.includes(\"self\") && canReadNamespace(principal, selfNs, config)) {\n    out.push(selfNs);\n  }\n  if (config.defaultRecallNamespaces.includes(\"shared\") && canReadNamespace(principal, config.sharedNamespace, config)) {\n    out.push(config.sharedNamespace);\n  }\n\n  for (const p of config.namespacePolicies) {\n    if (p.includeInRecallByDefault && canReadNamespace(principal, p.name, config)) {\n      if (!out.includes(p.name)) out.push(p.name);\n    }\n  }\n\n  return out;\n}\n"],"mappings":";;;;;AAGA,IAAM,+BAA+B;AAErC,SAAS,0BAA0B,SAAgC;AACjE,MAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,MAAI;AACF,WAAO,IAAI,OAAO,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,YAAgC,QAA0C;AACzG,MAAI,CAAC,OAAO,kBAAmB,QAAO;AACtC,QAAM,KAAK,OAAO,eAAe,YAAY,WAAW,KAAK,EAAE,SAAS,IACpE,aACA;AACJ,QAAM,OAAO,OAAO;AACpB,QAAM,QAAQ,OAAO,gCAAgC,CAAC;AAEtD,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI,SAAS,UAAU;AACrB,eAAW,KAAK,OAAO;AACrB,UAAI,GAAG,WAAW,EAAE,KAAK,EAAG,QAAO,EAAE;AAAA,IACvC;AAAA,EACF,WAAW,SAAS,OAAO;AACzB,eAAW,KAAK,OAAO;AACrB,UAAI,OAAO,EAAE,MAAO,QAAO,EAAE;AAAA,IAC/B;AAAA,EACF,WAAW,SAAS,SAAS;AAC3B,QAAI,GAAG,UAAU,8BAA8B;AAC7C,iBAAW,KAAK,OAAO;AACrB,cAAM,KAAK,0BAA0B,EAAE,KAAK;AAC5C,YAAI,IAAI,KAAK,EAAE,GAAG;AAChB,iBAAO,EAAE;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MAAI,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,SAAS;AAC7C,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,WAAW,QAAQ,SAAS,EAAG,QAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,WAA+B,WAAmB,QAA+B;AAChH,MAAI,CAAC,OAAO,kBAAmB,QAAO;AACtC,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO,cAAc,OAAO,oBAAoB,cAAc,OAAO;AAClF,SAAO,OAAO,eAAe,SAAS,SAAS,KAAK,OAAO,eAAe,SAAS,GAAG;AACxF;AAEO,SAAS,kBAAkB,WAA+B,WAAmB,QAA+B;AACjH,MAAI,CAAC,OAAO,kBAAmB,QAAO;AACtC,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO,cAAc,OAAO;AACzC,SAAO,OAAO,gBAAgB,SAAS,SAAS,KAAK,OAAO,gBAAgB,SAAS,GAAG;AAC1F;AASO,SAAS,6BAA6B,WAA+B,QAA8B;AACxG,MAAI,CAAC,OAAO,kBAAmB,QAAO,OAAO;AAC7C,MAAI,CAAC,UAAW,QAAO,OAAO;AAC9B,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,SAAO,SAAS,YAAY,OAAO;AACrC;AAEO,SAAS,6BAA6B,WAA+B,QAAgC;AAC1G,QAAM,MAAgB,CAAC;AACvB,MAAI,CAAC,OAAO,kBAAmB,QAAO,CAAC,OAAO,gBAAgB;AAC9D,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,SAAS,6BAA6B,WAAW,MAAM;AAC7D,MAAI,OAAO,wBAAwB,SAAS,MAAM,KAAK,iBAAiB,WAAW,QAAQ,MAAM,GAAG;AAClG,QAAI,KAAK,MAAM;AAAA,EACjB;AACA,MAAI,OAAO,wBAAwB,SAAS,QAAQ,KAAK,iBAAiB,WAAW,OAAO,iBAAiB,MAAM,GAAG;AACpH,QAAI,KAAK,OAAO,eAAe;AAAA,EACjC;AAEA,aAAW,KAAK,OAAO,mBAAmB;AACxC,QAAI,EAAE,4BAA4B,iBAAiB,WAAW,EAAE,MAAM,MAAM,GAAG;AAC7E,UAAI,CAAC,IAAI,SAAS,EAAE,IAAI,EAAG,KAAI,KAAK,EAAE,IAAI;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/{cli-9pwA_PXm.d.ts → cli-OrfKXNU4.d.ts}

@@ -7,7 +7,7 @@ import { RebuildMemoryLifecycleLedgerResult } from './maintenance/rebuild-memory
 import { RebuildObservationsResult } from './maintenance/rebuild-observations.js';
 import { ArchiveObservationsResult } from './maintenance/archive-observations.js';
 import { Writable, Readable } from 'node:stream';
-import { O as Orchestrator } from './orchestrator-Co9nxRLF.js';
+import { O as Orchestrator } from './orchestrator-DTRQG75J.js';
 import { ReplayRunSummary } from './replay/runner.js';
 import { ReplaySource, ReplayTurn } from './replay/types.js';
 import { b as BulkImportResult } from './types-BliCnURB.js';
@@ -16,7 +16,7 @@ import { WorkProjectStatus, WorkTaskStatus, WorkTaskPriority } from './work/type
 import { RoutePatternType } from './routing/engine.js';
 import { TailscaleSyncOptions } from './network/tailscale.js';
 import { DashboardStatus } from './dashboard-runtime.js';
-import { E as EngramAccessService } from './access-service-CZfksQuS.js';
+import { E as EngramAccessService } from './access-service-D2J9dh_9.js';
 import { ResolveSecretRefFn } from './resolve-auth-token.js';
 import { CompatRunner, CompatReport } from './compat/types.js';
 import { EvalBaselineDeltaReport, EvalBaselineSnapshot, EvalCiGateReport, EvalBenchmarkPackSummary, EvalHarnessStatus, EvalStoredBaselineCiGateReport } from './evals.js';

package/dist/cli.d.ts

@@ -7,7 +7,7 @@ import './maintenance/rebuild-memory-lifecycle-ledger.js';
 import './maintenance/rebuild-observations.js';
 import './maintenance/archive-observations.js';
 import 'node:stream';
-import './orchestrator-Co9nxRLF.js';
+import './orchestrator-DTRQG75J.js';
 import './replay/runner.js';
 import './replay/types.js';
 import './types-BliCnURB.js';
@@ -16,7 +16,7 @@ import './work/types.js';
 import './routing/engine.js';
 import './network/tailscale.js';
 import './dashboard-runtime.js';
-import './access-service-CZfksQuS.js';
+import './access-service-D2J9dh_9.js';
 import './resolve-auth-token.js';
 import './compat/types.js';
 import './evals.js';
@@ -38,7 +38,7 @@ import './trust-zones.js';
 import './session-integrity.js';
 import './recall-state.js';
 import './policy-runtime.js';
-export { A as AccessHttpServeCliCommandOptions, a as ArchiveObservationsCliCommandOptions, B as BulkImportCliCommandOptions, C as CompatCliCommandOptions, b as ConnectorsRunCliOutputOptions, c as ConversationIndexHealthCliOrchestrator, D as DashboardStartCliCommandOptions, d as DedupeCandidate, E as ExactDedupePlan, G as GraphHealthCliCommandOptions, M as MemoryActionAuditCliCommandOptions, e as MemoryActionAuditCliNamespaceSummary, f as MemoryActionAuditCliReport, g as MemoryGovernanceCliCommandOptions, h as MemoryGovernanceReportCliCommandOptions, i as MemoryGovernanceRestoreCliCommandOptions, j as MemoryReviewDispositionCliCommandOptions, k as MemoryTimelineCliCommandOptions, l as MigrateCliOrchestrator, m as MigrateCliReport, n as MigrateObservationsCliCommandOptions, P as PolicyDiffCliReport, o as PolicyDiffEntry, q as PolicyRollbackCliReport, s as PolicyStatusCliReport, t as PolicyTuningCliOrchestrator, R as RebuildMemoryLifecycleLedgerCliCommandOptions, u as RebuildMemoryProjectionCliCommandOptions, v as RebuildObservationsCliCommandOptions, w as RepairMemoryProjectionCliCommandOptions, x as ReplayCliCommandOptions, y as ReplayCliOrchestrator, z as RouteCliCommandOptions, S as SessionIntegrityCliCommandOptions, F as SessionRepairCliCommandOptions, T as TailscaleStatusCliCommandOptions, H as TailscaleSyncCliCommandOptions, I as TierMigrationCliOrchestrator, J as TrainingExportCliCommandOptions, V as VerifyMemoryProjectionCliCommandOptions, W as WebDavServeCliCommandOptions, K as WorkProjectCliCommandOptions, L as WorkTaskCliCommandOptions, N as emitConnectorsRunCliResult, O as filterNormalMemorySearchResults, Q as hasDestructivePurgeFailures, U as isNormalRetrievalVisibleMemory, X as parseDurationToMs, Y as parseStrictCliDate, Z as planAggressiveDuplicateDeletions, _ as planExactDuplicateDeletions, $ as registerCli, a0 as resolveAccessPrincipalOverride, a1 as resolveMemoryDirForNamespace, a2 as runAbstractionNodeStatusCliCommand, a3 as runAccessHttpServeCliCommand, a4 as runAccessHttpStatusCliCommand, a5 as runAccessHttpStopCliCommand, a6 as runAccessMcpServeCliCommand, a7 as runArchiveObservationsCliCommand, a8 as runBenchmarkBaselineReportCliCommand, a9 as runBenchmarkBaselineSnapshotCliCommand, aa as runBenchmarkCiGateCliCommand, ab as runBenchmarkImportCliCommand, ac as runBenchmarkStatusCliCommand, ad as runBenchmarkStoredBaselineCiGateCliCommand, ae as runBenchmarkValidateCliCommand, r as runBulkImportCliCommand, af as runCausalTrajectoryStatusCliCommand, ag as runCommitmentLifecycleCliCommand, ah as runCommitmentRecordCliCommand, ai as runCommitmentSetStateCliCommand, aj as runCommitmentStatusCliCommand, ak as runCompatCliCommand, al as runCompoundingPromoteCliCommand, am as runConversationIndexHealthCliCommand, an as runConversationIndexInspectCliCommand, ao as runConversationIndexRebuildCliCommand, ap as runCueAnchorStatusCliCommand, aq as runDashboardStartCliCommand, ar as runDashboardStatusCliCommand, as as runDashboardStopCliCommand, at as runGraphHealthCliCommand, au as runHarmonicSearchCliCommand, av as runMemoryActionAuditCliCommand, aw as runMemoryGovernanceCliCommand, ax as runMemoryGovernanceReportCliCommand, ay as runMemoryGovernanceRestoreCliCommand, az as runMemoryReviewDispositionCliCommand, aA as runMemoryTimelineCliCommand, aB as runMigrateNormalizeFrontmatterCliCommand, aC as runMigrateObservationsCliCommand, aD as runMigrateRechunkCliCommand, aE as runMigrateReextractCliCommand, aF as runMigrateRescoreImportanceCliCommand, aG as runObjectiveStateStatusCliCommand, aH as runPolicyDiffCliCommand, aI as runPolicyRollbackCliCommand, aJ as runPolicyStatusCliCommand, aK as runRebuildMemoryLifecycleLedgerCliCommand, aL as runRebuildMemoryProjectionCliCommand, aM as runRebuildObservationsCliCommand, aN as runRepairMemoryProjectionCliCommand, aO as runReplayCliCommand, aP as runResumeBundleBuildCliCommand, aQ as runResumeBundleRecordCliCommand, aR as runResumeBundleStatusCliCommand, aS as runRouteCliCommand, aT as runSemanticRulePromoteCliCommand, aU as runSemanticRuleVerifyCliCommand, aV as runSessionCheckCliCommand, aW as runSessionRepairCliCommand, aX as runTailscaleStatusCliCommand, aY as runTailscaleSyncCliCommand, aZ as runTierMigrateCliCommand, a_ as runTierStatusCliCommand, a$ as runTrainingExportCliCommand, b0 as runTrustZoneDemoSeedCliCommand, b1 as runTrustZonePromoteCliCommand, b2 as runTrustZoneStatusCliCommand, b3 as runUtilityLearningCliCommand, b4 as runUtilityLearningStatusCliCommand, b5 as runUtilityTelemetryRecordCliCommand, b6 as runUtilityTelemetryStatusCliCommand, b7 as runVerifiedRecallSearchCliCommand, b8 as runVerifyMemoryProjectionCliCommand, b9 as runWebDavServeCliCommand, ba as runWebDavStopCliCommand, bb as runWorkProductRecallSearchCliCommand, bc as runWorkProductRecordCliCommand, bd as runWorkProductStatusCliCommand, be as runWorkProjectCliCommand, bf as runWorkTaskCliCommand } from './cli-9pwA_PXm.js';
+export { A as AccessHttpServeCliCommandOptions, a as ArchiveObservationsCliCommandOptions, B as BulkImportCliCommandOptions, C as CompatCliCommandOptions, b as ConnectorsRunCliOutputOptions, c as ConversationIndexHealthCliOrchestrator, D as DashboardStartCliCommandOptions, d as DedupeCandidate, E as ExactDedupePlan, G as GraphHealthCliCommandOptions, M as MemoryActionAuditCliCommandOptions, e as MemoryActionAuditCliNamespaceSummary, f as MemoryActionAuditCliReport, g as MemoryGovernanceCliCommandOptions, h as MemoryGovernanceReportCliCommandOptions, i as MemoryGovernanceRestoreCliCommandOptions, j as MemoryReviewDispositionCliCommandOptions, k as MemoryTimelineCliCommandOptions, l as MigrateCliOrchestrator, m as MigrateCliReport, n as MigrateObservationsCliCommandOptions, P as PolicyDiffCliReport, o as PolicyDiffEntry, q as PolicyRollbackCliReport, s as PolicyStatusCliReport, t as PolicyTuningCliOrchestrator, R as RebuildMemoryLifecycleLedgerCliCommandOptions, u as RebuildMemoryProjectionCliCommandOptions, v as RebuildObservationsCliCommandOptions, w as RepairMemoryProjectionCliCommandOptions, x as ReplayCliCommandOptions, y as ReplayCliOrchestrator, z as RouteCliCommandOptions, S as SessionIntegrityCliCommandOptions, F as SessionRepairCliCommandOptions, T as TailscaleStatusCliCommandOptions, H as TailscaleSyncCliCommandOptions, I as TierMigrationCliOrchestrator, J as TrainingExportCliCommandOptions, V as VerifyMemoryProjectionCliCommandOptions, W as WebDavServeCliCommandOptions, K as WorkProjectCliCommandOptions, L as WorkTaskCliCommandOptions, N as emitConnectorsRunCliResult, O as filterNormalMemorySearchResults, Q as hasDestructivePurgeFailures, U as isNormalRetrievalVisibleMemory, X as parseDurationToMs, Y as parseStrictCliDate, Z as planAggressiveDuplicateDeletions, _ as planExactDuplicateDeletions, $ as registerCli, a0 as resolveAccessPrincipalOverride, a1 as resolveMemoryDirForNamespace, a2 as runAbstractionNodeStatusCliCommand, a3 as runAccessHttpServeCliCommand, a4 as runAccessHttpStatusCliCommand, a5 as runAccessHttpStopCliCommand, a6 as runAccessMcpServeCliCommand, a7 as runArchiveObservationsCliCommand, a8 as runBenchmarkBaselineReportCliCommand, a9 as runBenchmarkBaselineSnapshotCliCommand, aa as runBenchmarkCiGateCliCommand, ab as runBenchmarkImportCliCommand, ac as runBenchmarkStatusCliCommand, ad as runBenchmarkStoredBaselineCiGateCliCommand, ae as runBenchmarkValidateCliCommand, r as runBulkImportCliCommand, af as runCausalTrajectoryStatusCliCommand, ag as runCommitmentLifecycleCliCommand, ah as runCommitmentRecordCliCommand, ai as runCommitmentSetStateCliCommand, aj as runCommitmentStatusCliCommand, ak as runCompatCliCommand, al as runCompoundingPromoteCliCommand, am as runConversationIndexHealthCliCommand, an as runConversationIndexInspectCliCommand, ao as runConversationIndexRebuildCliCommand, ap as runCueAnchorStatusCliCommand, aq as runDashboardStartCliCommand, ar as runDashboardStatusCliCommand, as as runDashboardStopCliCommand, at as runGraphHealthCliCommand, au as runHarmonicSearchCliCommand, av as runMemoryActionAuditCliCommand, aw as runMemoryGovernanceCliCommand, ax as runMemoryGovernanceReportCliCommand, ay as runMemoryGovernanceRestoreCliCommand, az as runMemoryReviewDispositionCliCommand, aA as runMemoryTimelineCliCommand, aB as runMigrateNormalizeFrontmatterCliCommand, aC as runMigrateObservationsCliCommand, aD as runMigrateRechunkCliCommand, aE as runMigrateReextractCliCommand, aF as runMigrateRescoreImportanceCliCommand, aG as runObjectiveStateStatusCliCommand, aH as runPolicyDiffCliCommand, aI as runPolicyRollbackCliCommand, aJ as runPolicyStatusCliCommand, aK as runRebuildMemoryLifecycleLedgerCliCommand, aL as runRebuildMemoryProjectionCliCommand, aM as runRebuildObservationsCliCommand, aN as runRepairMemoryProjectionCliCommand, aO as runReplayCliCommand, aP as runResumeBundleBuildCliCommand, aQ as runResumeBundleRecordCliCommand, aR as runResumeBundleStatusCliCommand, aS as runRouteCliCommand, aT as runSemanticRulePromoteCliCommand, aU as runSemanticRuleVerifyCliCommand, aV as runSessionCheckCliCommand, aW as runSessionRepairCliCommand, aX as runTailscaleStatusCliCommand, aY as runTailscaleSyncCliCommand, aZ as runTierMigrateCliCommand, a_ as runTierStatusCliCommand, a$ as runTrainingExportCliCommand, b0 as runTrustZoneDemoSeedCliCommand, b1 as runTrustZonePromoteCliCommand, b2 as runTrustZoneStatusCliCommand, b3 as runUtilityLearningCliCommand, b4 as runUtilityLearningStatusCliCommand, b5 as runUtilityTelemetryRecordCliCommand, b6 as runUtilityTelemetryStatusCliCommand, b7 as runVerifiedRecallSearchCliCommand, b8 as runVerifyMemoryProjectionCliCommand, b9 as runWebDavServeCliCommand, ba as runWebDavStopCliCommand, bb as runWorkProductRecallSearchCliCommand, bc as runWorkProductRecordCliCommand, bd as runWorkProductStatusCliCommand, be as runWorkProjectCliCommand, bf as runWorkTaskCliCommand } from './cli-OrfKXNU4.js';
 import './connectors-cli-2iaQ5tX2.js';
 import './storage.js';
 import './page-versioning.js';

package/dist/cli.js

@@ -89,7 +89,7 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-2R6MP5C6.js";
+} from "./chunk-GEL3F3RV.js";
 import "./chunk-7F7Z6MOS.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
@@ -181,7 +181,7 @@ import "./chunk-6HZ6AO2P.js";
 import "./chunk-HQ6NIBL6.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-OADWQ5CR.js";
-import "./chunk-GSFFWOWU.js";
+import "./chunk-65OLPXBU.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-JBPKEARU.js";
 import "./chunk-TMSXWOBZ.js";
@@ -189,10 +189,10 @@ import "./chunk-J64TK33U.js";
 import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-DEGH5BUP.js";
+import "./chunk-BUUYY2H2.js";
 import "./chunk-EAZGEEG2.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-YN3WHXBG.js";
+import "./chunk-KS7WO6EQ.js";
 import "./chunk-ETUPBUHB.js";
 import "./chunk-L227SKTB.js";
 import "./chunk-DHGSZ3UD.js";
@@ -236,7 +236,7 @@ import "./chunk-ALEPI75L.js";
 import "./chunk-ZY2MNJR6.js";
 import "./chunk-LMPHTYJC.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-HWVTS5NO.js";
+import "./chunk-UZYLX7M6.js";
 import "./chunk-U3PN77QT.js";
 import "./chunk-4DJQYKMN.js";
 import "./chunk-EYIEWJNI.js";

package/dist/explicit-capture.d.ts

@@ -1,4 +1,4 @@
-import { O as Orchestrator } from './orchestrator-Co9nxRLF.js';
+import { O as Orchestrator } from './orchestrator-DTRQG75J.js';
 import { MemoryCategory, PluginConfig } from './types.js';
 import './buffer.js';
 import './storage.js';

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { PluginEntryResolverOptions, resolvePluginEntry } from './plugin-entry-resolver.js';
 export { isOpenaiApiKeyDisabled, parseConfig, resolveEnvVars } from './config.js';
 export { MigrationOptions, MigrationResult, RollbackResult, migrateFromEngram, rollbackFromEngramMigration } from './migrate/from-engram.js';
-export { O as Orchestrator, d as defaultWorkspaceDir, s as sanitizeSessionKeyForFilename } from './orchestrator-Co9nxRLF.js';
+export { O as Orchestrator, d as defaultWorkspaceDir, s as sanitizeSessionKeyForFilename } from './orchestrator-DTRQG75J.js';
 export { normalizeProjectionPreview, normalizeProjectionTags } from './memory-projection-format.js';
 export { ModelCapabilities, ModelRegistry } from './model-registry.js';
 export { ACTIVE_STATUSES, ContradictionFilter, ContradictionJudgeBatchResult, ContradictionJudgeInput, ContradictionJudgeResult, ContradictionListResult, ContradictionVerdict, ResolutionResult, ResolutionVerb, ScanDependencies, ScanResult, computePairId, executeResolution, isCoolingDown, isValidResolutionVerb, judgeContradictionPairs, listPairs, readPair, resolvePair, runContradictionScan, writePair, writePairs } from './contradiction/index.js';
@@ -22,7 +22,7 @@ import { PluginConfig, CodingContext, CodingModeConfig, MemoryCategory } from '.
 export { AgentAccessAuthToken, BriefingActiveThread, BriefingConfig, BriefingFocus, BriefingFollowup, BriefingOpenCommitment, BriefingRecentEntity, BriefingResult, BriefingSections, BriefingWindow, BufferSurpriseEvent, CalendarEvent, CalendarSource, CodexCompatConfig, ConsolidationObservation, ContinuityImprovementLoop, DEFAULT_RECALL_DISCLOSURE, EntityFile, EntityStructuredSection, ExtractedFact, GatewayConfig, MemoryActionEligibilityContext, MemoryActionEligibilitySource, MemoryActionType, MemoryFile, MemoryFrontmatter, MemoryObservation, MemoryScope, RECALL_DISCLOSURE_LEVELS, RecallDisclosure, SecretRef, isRecallDisclosure } from './types.js';
 export { JudgeBatchResult, JudgeCandidate, JudgeVerdict, JudgeVerdictKind, clearVerdictCache, createVerdictCache, getVerdictKind, isDurableVerdict, isValidCachedVerdict, judgeFactDurability, normalizeCachedVerdict, verdictCacheSize } from './extraction-judge.js';
 export { hasBroadGraphIntent, inferIntentFromText, intentCompatibilityScore, isTaskInitiationIntent, planRecallMode } from './intent.js';
-export { b as EngramAccessInputError, E as EngramAccessService, P as ProcedureStatsConfigSnapshot, c as ProcedureStatsRecent, d as ProcedureStatsReport, e as ProcedureStatusCounts, f as computeProcedureStats, g as formatProcedureStatsText } from './access-service-CZfksQuS.js';
+export { b as EngramAccessInputError, E as EngramAccessService, P as ProcedureStatsConfigSnapshot, c as ProcedureStatsRecent, d as ProcedureStatsReport, e as ProcedureStatusCounts, f as computeProcedureStats, g as formatProcedureStatsText } from './access-service-D2J9dh_9.js';
 export { FILTER_LABELS as DIRECT_ANSWER_FILTER_LABELS, DirectAnswerCandidate, DirectAnswerConfig, DirectAnswerInput, DirectAnswerReason, DirectAnswerResult, isDirectAnswerEligible } from './direct-answer.js';
 export { MemoryTier, TierRoutingPolicy, TierTransitionDecision, computeTierValueScore, decideTierTransition } from './tier-routing.js';
 export { ApplyReasoningTraceBoostOptions, BoostableResult, DEFAULT_REASONING_TRACE_BOOST, applyReasoningTraceBoost, isReasoningTracePath, looksLikeProblemSolvingQuery } from './reasoning-trace-recall.js';
@@ -74,7 +74,7 @@ export { EnrichmentAuditEntry, EnrichmentCandidate, EnrichmentCostTier, Enrichme
 export { d as BulkImportError, B as BulkImportOptions, b as BulkImportResult, a as BulkImportSource, e as BulkImportSourceAdapter, f as ImportSourceRole, I as ImportTurn, g as ImportTurnValidationIssue, i as isImportRole, p as parseIsoTimestamp, v as validateImportTurn } from './types-BliCnURB.js';
 export { clearBulkImportSources, getBulkImportSource, listBulkImportSources, registerBulkImportSource } from './bulk-import/index.js';
 export { a as ProcessBatchContext, P as ProcessBatchFn, b as ProcessBatchResult, f as formatBatchTranscript, r as resolveBulkImportContext, c as runBulkImportPipeline, v as validateBatchSize } from './pipeline-D18UAKlN.js';
-export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-9pwA_PXm.js';
+export { B as BulkImportCliCommandOptions, p as parseStrictCliDate, r as runBulkImportCliCommand } from './cli-OrfKXNU4.js';
 export { DEFAULT_IMPORT_BATCH_SIZE, ImportProgress, ImportedMemory, ImporterAdapter, ImporterParseOptions, ImporterTransformOptions, ImporterWriteResult, ImporterWriteTarget, RunImportOptions, RunImporterResult, defaultWriteMemoriesToOrchestrator, importedMemoryToTurn, runImporter, validateImportBatchSize, validateImportRateLimit } from './importers/index.js';
 export { FallbackLlmClient, FallbackLlmOptions, FallbackLlmResponse, FallbackLlmRuntimeContext } from './fallback-llm.js';
 export { ComputeMemoryWorthInput, MemoryWorthResult, computeMemoryWorth } from './memory-worth.js';

package/dist/index.js

@@ -93,7 +93,7 @@ import {
   listTrainingExportAdapters,
   registerTrainingExportAdapter,
   runBulkImportCliCommand
-} from "./chunk-2R6MP5C6.js";
+} from "./chunk-GEL3F3RV.js";
 import "./chunk-7F7Z6MOS.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
@@ -166,7 +166,7 @@ import {
 import {
   getMemoryForActiveMemory,
   recallForActiveMemory
-} from "./chunk-IC4GELZE.js";
+} from "./chunk-NINRTFSV.js";
 import "./chunk-6MKAMLQL.js";
 import {
   DEFAULT_TAXONOMY,
@@ -182,7 +182,7 @@ import {
   saveTaxonomy,
   validateSlug,
   validateTaxonomy
-} from "./chunk-XDMLTNIG.js";
+} from "./chunk-NYV435HC.js";
 import "./chunk-5RIRL3XL.js";
 import "./chunk-BFBF3XEF.js";
 import {
@@ -472,7 +472,7 @@ import "./chunk-PVGDJXVK.js";
 import "./chunk-OADWQ5CR.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-GSFFWOWU.js";
+} from "./chunk-65OLPXBU.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-JBPKEARU.js";
 import "./chunk-TMSXWOBZ.js";
@@ -482,7 +482,7 @@ import "./chunk-42NQ7AVG.js";
 import "./chunk-7RXCMVFQ.js";
 import {
   EngramMcpServer
-} from "./chunk-DEGH5BUP.js";
+} from "./chunk-BUUYY2H2.js";
 import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_CANONICAL_TOOL,
   REMNIC_CHATGPT_MEMORY_INSPECTOR_MIME_TYPE,
@@ -503,7 +503,7 @@ import {
   EngramAccessService,
   computeProcedureStats,
   formatProcedureStatsText
-} from "./chunk-YN3WHXBG.js";
+} from "./chunk-KS7WO6EQ.js";
 import "./chunk-ETUPBUHB.js";
 import "./chunk-L227SKTB.js";
 import {
@@ -625,7 +625,7 @@ import "./chunk-LMPHTYJC.js";
 import "./chunk-DT5TVLJE.js";
 import {
   resolvePrincipal
-} from "./chunk-HWVTS5NO.js";
+} from "./chunk-UZYLX7M6.js";
 import "./chunk-U3PN77QT.js";
 import "./chunk-4DJQYKMN.js";
 import {

package/dist/mcp-memory-inspector-app.d.ts

@@ -1,4 +1,4 @@
-import { a as EngramAccessRecallResponse } from './access-service-CZfksQuS.js';
+import { a as EngramAccessRecallResponse } from './access-service-D2J9dh_9.js';
 import { ActionConfidenceRequest } from './access-schema.js';
 import { RecallXraySnapshot } from './recall-xray.js';
 import { ActionConfidenceResult } from './action-confidence.js';
@@ -20,7 +20,7 @@ import './user-model.js';
 import './recall-audit-anomaly.js';
 import './recall-audit.js';
 import './explicit-capture.js';
-import './orchestrator-Co9nxRLF.js';
+import './orchestrator-DTRQG75J.js';
 import './buffer.js';
 import './search/port.js';
 import './transcript.js';

package/dist/namespaces/principal.d.ts

@@ -2,9 +2,9 @@ import { PluginConfig } from '../types.js';
 import '../types-BliCnURB.js';
 import '../index-DJ9QWMw-.js';
 
-declare function resolvePrincipal(sessionKey: string | undefined, config: PluginConfig): string;
-declare function canReadNamespace(principal: string, namespace: string, config: PluginConfig): boolean;
-declare function canWriteNamespace(principal: string, namespace: string, config: PluginConfig): boolean;
+declare function resolvePrincipal(sessionKey: string | undefined, config: PluginConfig): string | undefined;
+declare function canReadNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean;
+declare function canWriteNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean;
 /**
  * Default "self" namespace for a principal.
  *
@@ -12,7 +12,7 @@ declare function canWriteNamespace(principal: string, namespace: string, config:
  * - If there's a namespace policy with the same name as the principal, use it.
  * - Otherwise use config.defaultNamespace.
  */
-declare function defaultNamespaceForPrincipal(principal: string, config: PluginConfig): string;
-declare function recallNamespacesForPrincipal(principal: string, config: PluginConfig): string[];
+declare function defaultNamespaceForPrincipal(principal: string | undefined, config: PluginConfig): string;
+declare function recallNamespacesForPrincipal(principal: string | undefined, config: PluginConfig): string[];
 
 export { canReadNamespace, canWriteNamespace, defaultNamespaceForPrincipal, recallNamespacesForPrincipal, resolvePrincipal };

package/dist/namespaces/principal.js

@@ -4,7 +4,7 @@ import {
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal,
   resolvePrincipal
-} from "../chunk-HWVTS5NO.js";
+} from "../chunk-UZYLX7M6.js";
 import "../chunk-U3PN77QT.js";
 import "../chunk-PZ5AY32C.js";
 export {

package/dist/{orchestrator-Co9nxRLF.d.ts → orchestrator-DTRQG75J.d.ts}

@@ -490,7 +490,7 @@ declare class Orchestrator {
     setRecallWorkspaceOverride(sessionKey: string, dir: string): void;
     /** Remove a per-session workspace selection (cleanup on error or early return). @internal */
     clearRecallWorkspaceOverride(sessionKey: string): void;
-    resolvePrincipal(sessionKey?: string): string;
+    resolvePrincipal(sessionKey?: string): string | undefined;
     resolveSelfNamespace(sessionKey?: string): string;
     /**
      * Attach a coding-agent context to a session (issue #569). Called by the

package/dist/orchestrator.d.ts

@@ -6,7 +6,7 @@ import './summarizer.js';
 import './local-llm.js';
 import './fallback-llm.js';
 import './live-connectors-runner.js';
-export { a as GraphRecallRankedResult, b as GraphRecallShadowComparison, G as GraphRecallSnapshot, I as IntentDebugSnapshot, O as Orchestrator, Q as QmdRecallSnapshot, R as RecallInvocationOptions, c as RecallModeDecision, e as appendMemoryToGraphContext, f as blendGraphExpandedRecallScore, g as buildCompressionGuidelinesMarkdown, h as buildMemoryPathById, i as computeArtifactCandidateFetchLimit, j as computeArtifactRecallLimit, k as computeQmdHybridFetchLimit, l as dedupeEntitySynthesisEvidenceEntries, d as defaultWorkspaceDir, m as deriveTopicsFromExtraction, n as filterRecallCandidates, o as formatCompressionGuidelinesForRecall, p as graphPathRelativeToStorage, q as hasIdentityRecoveryIntent, r as isArtifactMemoryPath, t as lifecycleRecallScoreAdjustment, u as mergeArtifactRecallCandidates, v as mergeGraphExpandedResults, w as resolveEffectiveIdentityInjectionMode, x as resolveEffectiveRecallMode, y as resolvePersistedMemoryRelativePath, z as resolveRecallModeDecision, A as resolveRecentThreadMemoryPaths, s as sanitizeSessionKeyForFilename, B as shouldFilterLifecycleRecallCandidate, C as summarizeGraphShadowComparison } from './orchestrator-Co9nxRLF.js';
+export { a as GraphRecallRankedResult, b as GraphRecallShadowComparison, G as GraphRecallSnapshot, I as IntentDebugSnapshot, O as Orchestrator, Q as QmdRecallSnapshot, R as RecallInvocationOptions, c as RecallModeDecision, e as appendMemoryToGraphContext, f as blendGraphExpandedRecallScore, g as buildCompressionGuidelinesMarkdown, h as buildMemoryPathById, i as computeArtifactCandidateFetchLimit, j as computeArtifactRecallLimit, k as computeQmdHybridFetchLimit, l as dedupeEntitySynthesisEvidenceEntries, d as defaultWorkspaceDir, m as deriveTopicsFromExtraction, n as filterRecallCandidates, o as formatCompressionGuidelinesForRecall, p as graphPathRelativeToStorage, q as hasIdentityRecoveryIntent, r as isArtifactMemoryPath, t as lifecycleRecallScoreAdjustment, u as mergeArtifactRecallCandidates, v as mergeGraphExpandedResults, w as resolveEffectiveIdentityInjectionMode, x as resolveEffectiveRecallMode, y as resolvePersistedMemoryRelativePath, z as resolveRecallModeDecision, A as resolveRecentThreadMemoryPaths, s as sanitizeSessionKeyForFilename, B as shouldFilterLifecycleRecallCandidate, C as summarizeGraphShadowComparison } from './orchestrator-DTRQG75J.js';
 import './model-registry.js';
 import './relevance.js';
 import './negative.js';

package/dist/orchestrator.js

@@ -26,7 +26,7 @@ import {
   sanitizeSessionKeyForFilename,
   shouldFilterLifecycleRecallCandidate,
   summarizeGraphShadowComparison
-} from "./chunk-XDMLTNIG.js";
+} from "./chunk-NYV435HC.js";
 import "./chunk-5RIRL3XL.js";
 import "./chunk-BFBF3XEF.js";
 import "./chunk-KVEVLBKC.js";
@@ -184,7 +184,7 @@ import "./chunk-G7D6GZ5J.js";
 import "./chunk-ALEPI75L.js";
 import "./chunk-LMPHTYJC.js";
 import "./chunk-DT5TVLJE.js";
-import "./chunk-HWVTS5NO.js";
+import "./chunk-UZYLX7M6.js";
 import "./chunk-U3PN77QT.js";
 import "./chunk-4DJQYKMN.js";
 import "./chunk-EYIEWJNI.js";