@remnic/core 9.3.619 → 9.3.621

package/dist/{chunk-UEY3VB6W.js → chunk-6HMYUWXR.js}

@@ -30,6 +30,15 @@ function validateValueRef(raw, field) {
 function validateMetadata(raw) {
   return validateStringRecord(raw, "metadata");
 }
+function assertWithinDir(baseDir, candidate) {
+  const resolvedBase = path.resolve(baseDir);
+  const resolved = path.resolve(candidate);
+  const rel = path.relative(resolvedBase, resolved);
+  if (rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+    throw new Error("objective-state path escapes the snapshots directory");
+  }
+  return resolved;
+}
 function resolveObjectiveStateStoreDir(memoryDir, overrideDir) {
   if (typeof overrideDir === "string" && overrideDir.trim().length > 0) {
     return overrideDir.trim();
@@ -89,8 +98,9 @@ async function recordObjectiveStateSnapshot(options) {
   const rootDir = resolveObjectiveStateStoreDir(options.memoryDir, options.objectiveStateStoreDir);
   const validated = validateObjectiveStateSnapshot(options.snapshot);
   const day = recordStoreDay(validated.recordedAt);
-  const snapshotsDir = path.join(rootDir, "snapshots", day);
-  const filePath = path.join(snapshotsDir, `${validated.snapshotId}.json`);
+  const snapshotsRoot = path.join(rootDir, "snapshots");
+  const snapshotsDir = assertWithinDir(snapshotsRoot, path.join(snapshotsRoot, day));
+  const filePath = assertWithinDir(snapshotsDir, path.join(snapshotsDir, `${validated.snapshotId}.json`));
   await mkdir(snapshotsDir, { recursive: true });
   await writeFile(filePath, JSON.stringify(validated, null, 2), "utf8");
   return filePath;
@@ -208,4 +218,4 @@ export {
   getObjectiveStateStoreStatus,
   searchObjectiveStateSnapshots
 };
-//# sourceMappingURL=chunk-UEY3VB6W.js.map
+//# sourceMappingURL=chunk-6HMYUWXR.js.map

package/dist/chunk-6HMYUWXR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/objective-state.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport {\n  assertIsoRecordedAt,\n  assertSafePathSegment,\n  assertString,\n  isRecord,\n  optionalString,\n  optionalStringArray,\n  recordStoreDay,\n  validateStringRecord,\n} from \"./store-contract.js\";\n\nexport type ObjectiveStateSnapshotSource = \"tool_result\" | \"cli\" | \"system\" | \"manual\";\nexport type ObjectiveStateSnapshotKind = \"tool\" | \"file\" | \"process\" | \"record\" | \"workspace\";\nexport type ObjectiveStateChangeKind = \"created\" | \"updated\" | \"deleted\" | \"observed\" | \"executed\" | \"failed\";\nexport type ObjectiveStateOutcome = \"success\" | \"failure\" | \"partial\" | \"unknown\";\n\nexport interface ObjectiveStateValueRef {\n  exists?: boolean;\n  ref?: string;\n  valueHash?: string;\n}\n\nexport interface ObjectiveStateSnapshot {\n  schemaVersion: 1;\n  snapshotId: string;\n  recordedAt: string;\n  sessionKey: string;\n  source: ObjectiveStateSnapshotSource;\n  kind: ObjectiveStateSnapshotKind;\n  changeKind: ObjectiveStateChangeKind;\n  scope: string;\n  summary: string;\n  toolName?: string;\n  command?: string;\n  outcome?: ObjectiveStateOutcome;\n  before?: ObjectiveStateValueRef;\n  after?: ObjectiveStateValueRef;\n  entityRefs?: string[];\n  tags?: string[];\n  metadata?: Record<string, string>;\n}\n\nexport interface ObjectiveStateStoreStatus {\n  enabled: boolean;\n  writesEnabled: boolean;\n  rootDir: string;\n  snapshotsDir: string;\n  snapshots: {\n    total: number;\n    valid: number;\n    invalid: number;\n    byKind: Partial<Record<ObjectiveStateSnapshotKind, number>>;\n    byOutcome: Partial<Record<ObjectiveStateOutcome, number>>;\n    latestSnapshotId?: string;\n    latestRecordedAt?: string;\n    latestSessionKey?: string;\n  };\n  latestSnapshot?: ObjectiveStateSnapshot;\n  invalidSnapshots: Array<{\n    path: string;\n    error: string;\n  }>;\n}\n\nexport interface ObjectiveStateSearchResult {\n  snapshot: ObjectiveStateSnapshot;\n  score: number;\n}\n\nfunction validateValueRef(raw: unknown, field: string): ObjectiveStateValueRef | undefined {\n  if (raw === undefined) return undefined;\n  if (!isRecord(raw)) throw new Error(`${field} must be an object`);\n  const exists = typeof raw.exists === \"boolean\" ? raw.exists : undefined;\n  const ref = optionalString(raw.ref);\n  const valueHash = optionalString(raw.valueHash);\n  if (exists === undefined && ref === undefined && valueHash === undefined) {\n    throw new Error(`${field} must include exists, ref, or valueHash`);\n  }\n  return { exists, ref, valueHash };\n}\n\nfunction validateMetadata(raw: unknown): Record<string, string> | undefined {\n  return validateStringRecord(raw, \"metadata\");\n}\n\n// Assert that a built path stays inside the expected base directory before it is\n// used in a filesystem write. snapshotId/recordedAt are already validated by\n// validateObjectiveStateSnapshot, so for valid data this is a defense-in-depth\n// barrier (and makes the containment provable to CodeQL js/path-injection).\nfunction assertWithinDir(baseDir: string, candidate: string): string {\n  const resolvedBase = path.resolve(baseDir);\n  const resolved = path.resolve(candidate);\n  const rel = path.relative(resolvedBase, resolved);\n  if (rel === \"..\" || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {\n    throw new Error(\"objective-state path escapes the snapshots directory\");\n  }\n  return resolved;\n}\n\nexport function resolveObjectiveStateStoreDir(memoryDir: string, overrideDir?: string): string {\n  if (typeof overrideDir === \"string\" && overrideDir.trim().length > 0) {\n    return overrideDir.trim();\n  }\n  return path.join(memoryDir, \"state\", \"objective-state\");\n}\n\nexport function objectiveStateStoreOverrideForNamespace(options: {\n  memoryDir: string;\n  configuredStoreDir?: string;\n  namespacesEnabled: boolean;\n  namespace: string;\n}): string | undefined {\n  const configured = options.configuredStoreDir?.trim();\n  if (!configured) return undefined;\n  if (!options.namespacesEnabled) return configured;\n\n  const defaultStoreDir = path.join(options.memoryDir, \"state\", \"objective-state\");\n  if (path.resolve(configured) === path.resolve(defaultStoreDir)) {\n    return undefined;\n  }\n  return path.join(configured, \"namespaces\", options.namespace);\n}\n\nexport function validateObjectiveStateSnapshot(raw: unknown): ObjectiveStateSnapshot {\n  if (!isRecord(raw)) throw new Error(\"objective-state snapshot must be an object\");\n  if (raw.schemaVersion !== 1) throw new Error(\"schemaVersion must be 1\");\n\n  const source = assertString(raw.source, \"source\");\n  if (![\"tool_result\", \"cli\", \"system\", \"manual\"].includes(source)) {\n    throw new Error(\"source must be one of tool_result|cli|system|manual\");\n  }\n\n  const kind = assertString(raw.kind, \"kind\");\n  if (![\"tool\", \"file\", \"process\", \"record\", \"workspace\"].includes(kind)) {\n    throw new Error(\"kind must be one of tool|file|process|record|workspace\");\n  }\n\n  const changeKind = assertString(raw.changeKind, \"changeKind\");\n  if (![\"created\", \"updated\", \"deleted\", \"observed\", \"executed\", \"failed\"].includes(changeKind)) {\n    throw new Error(\"changeKind must be one of created|updated|deleted|observed|executed|failed\");\n  }\n\n  const outcomeRaw = optionalString(raw.outcome);\n  if (outcomeRaw !== undefined && ![\"success\", \"failure\", \"partial\", \"unknown\"].includes(outcomeRaw)) {\n    throw new Error(\"outcome must be one of success|failure|partial|unknown\");\n  }\n\n  return {\n    schemaVersion: 1,\n    snapshotId: assertSafePathSegment(assertString(raw.snapshotId, \"snapshotId\"), \"snapshotId\"),\n    recordedAt: assertIsoRecordedAt(assertString(raw.recordedAt, \"recordedAt\")),\n    sessionKey: assertString(raw.sessionKey, \"sessionKey\"),\n    source: source as ObjectiveStateSnapshotSource,\n    kind: kind as ObjectiveStateSnapshotKind,\n    changeKind: changeKind as ObjectiveStateChangeKind,\n    scope: assertString(raw.scope, \"scope\"),\n    summary: assertString(raw.summary, \"summary\"),\n    toolName: optionalString(raw.toolName),\n    command: optionalString(raw.command),\n    outcome: outcomeRaw as ObjectiveStateOutcome | undefined,\n    before: validateValueRef(raw.before, \"before\"),\n    after: validateValueRef(raw.after, \"after\"),\n    entityRefs: optionalStringArray(raw.entityRefs, \"entityRefs\"),\n    tags: optionalStringArray(raw.tags, \"tags\"),\n    metadata: validateMetadata(raw.metadata),\n  };\n}\n\nexport async function recordObjectiveStateSnapshot(options: {\n  memoryDir: string;\n  objectiveStateStoreDir?: string;\n  snapshot: ObjectiveStateSnapshot;\n}): Promise<string> {\n  const rootDir = resolveObjectiveStateStoreDir(options.memoryDir, options.objectiveStateStoreDir);\n  const validated = validateObjectiveStateSnapshot(options.snapshot);\n  const day = recordStoreDay(validated.recordedAt);\n  const snapshotsRoot = path.join(rootDir, \"snapshots\");\n  const snapshotsDir = assertWithinDir(snapshotsRoot, path.join(snapshotsRoot, day));\n  const filePath = assertWithinDir(snapshotsDir, path.join(snapshotsDir, `${validated.snapshotId}.json`));\n  await mkdir(snapshotsDir, { recursive: true });\n  await writeFile(filePath, JSON.stringify(validated, null, 2), \"utf8\");\n  return filePath;\n}\n\nexport async function getObjectiveStateStoreStatus(options: {\n  memoryDir: string;\n  objectiveStateStoreDir?: string;\n  enabled: boolean;\n  writesEnabled: boolean;\n}): Promise<ObjectiveStateStoreStatus> {\n  const rootDir = resolveObjectiveStateStoreDir(options.memoryDir, options.objectiveStateStoreDir);\n  const snapshotsDir = path.join(rootDir, \"snapshots\");\n  const { files, snapshots, invalidSnapshots } = await readObjectiveStateSnapshots(options);\n\n  snapshots.sort((a, b) => b.recordedAt.localeCompare(a.recordedAt));\n  const byKind: Partial<Record<ObjectiveStateSnapshotKind, number>> = {};\n  const byOutcome: Partial<Record<ObjectiveStateOutcome, number>> = {};\n  for (const snapshot of snapshots) {\n    byKind[snapshot.kind] = (byKind[snapshot.kind] ?? 0) + 1;\n    const outcome = snapshot.outcome ?? \"unknown\";\n    byOutcome[outcome] = (byOutcome[outcome] ?? 0) + 1;\n  }\n\n  return {\n    enabled: options.enabled,\n    writesEnabled: options.writesEnabled,\n    rootDir,\n    snapshotsDir,\n    snapshots: {\n      total: files.length,\n      valid: snapshots.length,\n      invalid: invalidSnapshots.length,\n      byKind,\n      byOutcome,\n      latestSnapshotId: snapshots[0]?.snapshotId,\n      latestRecordedAt: snapshots[0]?.recordedAt,\n      latestSessionKey: snapshots[0]?.sessionKey,\n    },\n    latestSnapshot: snapshots[0],\n    invalidSnapshots,\n  };\n}\n\nasync function readObjectiveStateSnapshots(options: {\n  memoryDir: string;\n  objectiveStateStoreDir?: string;\n}): Promise<{\n  files: string[];\n  snapshots: ObjectiveStateSnapshot[];\n  invalidSnapshots: Array<{ path: string; error: string }>;\n}> {\n  const rootDir = resolveObjectiveStateStoreDir(options.memoryDir, options.objectiveStateStoreDir);\n  const files = await listJsonFiles(path.join(rootDir, \"snapshots\"));\n  const snapshots: ObjectiveStateSnapshot[] = [];\n  const invalidSnapshots: Array<{ path: string; error: string }> = [];\n  for (const filePath of files) {\n    try {\n      snapshots.push(validateObjectiveStateSnapshot(await readJsonFile(filePath)));\n    } catch (error) {\n      invalidSnapshots.push({\n        path: filePath,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { files, snapshots, invalidSnapshots };\n}\n\nfunction normalizeTokens(value: string): string[] {\n  return value\n    .toLowerCase()\n    .split(/[^a-z0-9]+/)\n    .map((token) => token.trim())\n    .filter((token) => token.length >= 2);\n}\n\nfunction overlapScore(queryTokens: Set<string>, value: string | undefined, weight: number): number {\n  if (!value) return 0;\n  const tokens = new Set(normalizeTokens(value));\n  let matches = 0;\n  for (const token of queryTokens) {\n    if (tokens.has(token)) matches += 1;\n  }\n  return matches * weight;\n}\n\nfunction lexicalScoreObjectiveStateSnapshot(\n  snapshot: ObjectiveStateSnapshot,\n  queryTokens: Set<string>,\n): number {\n  let score = 0;\n  score += overlapScore(queryTokens, snapshot.scope, 4);\n  score += overlapScore(queryTokens, snapshot.summary, 3);\n  score += overlapScore(queryTokens, snapshot.command, 3);\n  score += overlapScore(queryTokens, snapshot.toolName, 2);\n  score += overlapScore(queryTokens, snapshot.tags?.join(\" \"), 2);\n  score += overlapScore(queryTokens, snapshot.entityRefs?.join(\" \"), 2);\n  score += overlapScore(queryTokens, snapshot.kind, 1);\n  score += overlapScore(queryTokens, snapshot.changeKind, 1);\n  score += overlapScore(queryTokens, snapshot.outcome, 1);\n  return score;\n}\n\nfunction scoreObjectiveStateSnapshot(\n  snapshot: ObjectiveStateSnapshot,\n  lexicalScore: number,\n  sessionKey?: string,\n): number {\n  let score = lexicalScore;\n  if (sessionKey && snapshot.sessionKey === sessionKey) score += 1.5;\n\n  const recordedAtMs = Date.parse(snapshot.recordedAt);\n  if (Number.isFinite(recordedAtMs)) {\n    const ageHours = Math.max(0, (Date.now() - recordedAtMs) / 3_600_000);\n    score += 1 / (1 + ageHours);\n  }\n  return score;\n}\n\nexport async function searchObjectiveStateSnapshots(options: {\n  memoryDir: string;\n  objectiveStateStoreDir?: string;\n  query: string;\n  maxResults: number;\n  sessionKey?: string;\n}): Promise<ObjectiveStateSearchResult[]> {\n  const maxResults = Math.max(0, Math.floor(options.maxResults));\n  if (maxResults === 0) return [];\n\n  const { snapshots } = await readObjectiveStateSnapshots(options);\n  if (snapshots.length === 0) return [];\n\n  const queryTokens = new Set(normalizeTokens(options.query));\n  const scored = snapshots.map((snapshot) => {\n    const lexicalScore = lexicalScoreObjectiveStateSnapshot(snapshot, queryTokens);\n    return {\n      snapshot,\n      lexicalScore,\n      score: scoreObjectiveStateSnapshot(snapshot, lexicalScore, options.sessionKey),\n    };\n  });\n\n  const filtered = queryTokens.size === 0\n    ? scored\n    : scored.filter((result) => result.lexicalScore > 0);\n\n  filtered.sort((left, right) => {\n    if (right.score !== left.score) return right.score - left.score;\n    return right.snapshot.recordedAt.localeCompare(left.snapshot.recordedAt);\n  });\n  return filtered.slice(0, maxResults);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,iBAAiB;AAuEjC,SAAS,iBAAiB,KAAc,OAAmD;AACzF,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,oBAAoB;AAChE,QAAM,SAAS,OAAO,IAAI,WAAW,YAAY,IAAI,SAAS;AAC9D,QAAM,MAAM,eAAe,IAAI,GAAG;AAClC,QAAM,YAAY,eAAe,IAAI,SAAS;AAC9C,MAAI,WAAW,UAAa,QAAQ,UAAa,cAAc,QAAW;AACxE,UAAM,IAAI,MAAM,GAAG,KAAK,yCAAyC;AAAA,EACnE;AACA,SAAO,EAAE,QAAQ,KAAK,UAAU;AAClC;AAEA,SAAS,iBAAiB,KAAkD;AAC1E,SAAO,qBAAqB,KAAK,UAAU;AAC7C;AAMA,SAAS,gBAAgB,SAAiB,WAA2B;AACnE,QAAM,eAAe,KAAK,QAAQ,OAAO;AACzC,QAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,QAAM,MAAM,KAAK,SAAS,cAAc,QAAQ;AAChD,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,KAAK,KAAK,WAAW,GAAG,GAAG;AAC3E,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO;AACT;AAEO,SAAS,8BAA8B,WAAmB,aAA8B;AAC7F,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,SAAO,KAAK,KAAK,WAAW,SAAS,iBAAiB;AACxD;AAEO,SAAS,wCAAwC,SAKjC;AACrB,QAAM,aAAa,QAAQ,oBAAoB,KAAK;AACpD,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,CAAC,QAAQ,kBAAmB,QAAO;AAEvC,QAAM,kBAAkB,KAAK,KAAK,QAAQ,WAAW,SAAS,iBAAiB;AAC/E,MAAI,KAAK,QAAQ,UAAU,MAAM,KAAK,QAAQ,eAAe,GAAG;AAC9D,WAAO;AAAA,EACT;AACA,SAAO,KAAK,KAAK,YAAY,cAAc,QAAQ,SAAS;AAC9D;AAEO,SAAS,+BAA+B,KAAsC;AACnF,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,4CAA4C;AAChF,MAAI,IAAI,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAEtE,QAAM,SAAS,aAAa,IAAI,QAAQ,QAAQ;AAChD,MAAI,CAAC,CAAC,eAAe,OAAO,UAAU,QAAQ,EAAE,SAAS,MAAM,GAAG;AAChE,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAEA,QAAM,OAAO,aAAa,IAAI,MAAM,MAAM;AAC1C,MAAI,CAAC,CAAC,QAAQ,QAAQ,WAAW,UAAU,WAAW,EAAE,SAAS,IAAI,GAAG;AACtE,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,aAAa,aAAa,IAAI,YAAY,YAAY;AAC5D,MAAI,CAAC,CAAC,WAAW,WAAW,WAAW,YAAY,YAAY,QAAQ,EAAE,SAAS,UAAU,GAAG;AAC7F,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AAEA,QAAM,aAAa,eAAe,IAAI,OAAO;AAC7C,MAAI,eAAe,UAAa,CAAC,CAAC,WAAW,WAAW,WAAW,SAAS,EAAE,SAAS,UAAU,GAAG;AAClG,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,YAAY,sBAAsB,aAAa,IAAI,YAAY,YAAY,GAAG,YAAY;AAAA,IAC1F,YAAY,oBAAoB,aAAa,IAAI,YAAY,YAAY,CAAC;AAAA,IAC1E,YAAY,aAAa,IAAI,YAAY,YAAY;AAAA,IACrD;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,aAAa,IAAI,OAAO,OAAO;AAAA,IACtC,SAAS,aAAa,IAAI,SAAS,SAAS;AAAA,IAC5C,UAAU,eAAe,IAAI,QAAQ;AAAA,IACrC,SAAS,eAAe,IAAI,OAAO;AAAA,IACnC,SAAS;AAAA,IACT,QAAQ,iBAAiB,IAAI,QAAQ,QAAQ;AAAA,IAC7C,OAAO,iBAAiB,IAAI,OAAO,OAAO;AAAA,IAC1C,YAAY,oBAAoB,IAAI,YAAY,YAAY;AAAA,IAC5D,MAAM,oBAAoB,IAAI,MAAM,MAAM;AAAA,IAC1C,UAAU,iBAAiB,IAAI,QAAQ;AAAA,EACzC;AACF;AAEA,eAAsB,6BAA6B,SAI/B;AAClB,QAAM,UAAU,8BAA8B,QAAQ,WAAW,QAAQ,sBAAsB;AAC/F,QAAM,YAAY,+BAA+B,QAAQ,QAAQ;AACjE,QAAM,MAAM,eAAe,UAAU,UAAU;AAC/C,QAAM,gBAAgB,KAAK,KAAK,SAAS,WAAW;AACpD,QAAM,eAAe,gBAAgB,eAAe,KAAK,KAAK,eAAe,GAAG,CAAC;AACjF,QAAM,WAAW,gBAAgB,cAAc,KAAK,KAAK,cAAc,GAAG,UAAU,UAAU,OAAO,CAAC;AACtG,QAAM,MAAM,cAAc,EAAE,WAAW,KAAK,CAAC;AAC7C,QAAM,UAAU,UAAU,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,MAAM;AACpE,SAAO;AACT;AAEA,eAAsB,6BAA6B,SAKZ;AACrC,QAAM,UAAU,8BAA8B,QAAQ,WAAW,QAAQ,sBAAsB;AAC/F,QAAM,eAAe,KAAK,KAAK,SAAS,WAAW;AACnD,QAAM,EAAE,OAAO,WAAW,iBAAiB,IAAI,MAAM,4BAA4B,OAAO;AAExF,YAAU,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AACjE,QAAM,SAA8D,CAAC;AACrE,QAAM,YAA4D,CAAC;AACnE,aAAW,YAAY,WAAW;AAChC,WAAO,SAAS,IAAI,KAAK,OAAO,SAAS,IAAI,KAAK,KAAK;AACvD,UAAM,UAAU,SAAS,WAAW;AACpC,cAAU,OAAO,KAAK,UAAU,OAAO,KAAK,KAAK;AAAA,EACnD;AAEA,SAAO;AAAA,IACL,SAAS,QAAQ;AAAA,IACjB,eAAe,QAAQ;AAAA,IACvB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,MACT,OAAO,MAAM;AAAA,MACb,OAAO,UAAU;AAAA,MACjB,SAAS,iBAAiB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,kBAAkB,UAAU,CAAC,GAAG;AAAA,MAChC,kBAAkB,UAAU,CAAC,GAAG;AAAA,MAChC,kBAAkB,UAAU,CAAC,GAAG;AAAA,IAClC;AAAA,IACA,gBAAgB,UAAU,CAAC;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,eAAe,4BAA4B,SAOxC;AACD,QAAM,UAAU,8BAA8B,QAAQ,WAAW,QAAQ,sBAAsB;AAC/F,QAAM,QAAQ,MAAM,cAAc,KAAK,KAAK,SAAS,WAAW,CAAC;AACjE,QAAM,YAAsC,CAAC;AAC7C,QAAM,mBAA2D,CAAC;AAClE,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,gBAAU,KAAK,+BAA+B,MAAM,aAAa,QAAQ,CAAC,CAAC;AAAA,IAC7E,SAAS,OAAO;AACd,uBAAiB,KAAK;AAAA,QACpB,MAAM;AAAA,QACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,OAAO,WAAW,iBAAiB;AAC9C;AAEA,SAAS,gBAAgB,OAAyB;AAChD,SAAO,MACJ,YAAY,EACZ,MAAM,YAAY,EAClB,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,CAAC,UAAU,MAAM,UAAU,CAAC;AACxC;AAEA,SAAS,aAAa,aAA0B,OAA2B,QAAwB;AACjG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,IAAI,IAAI,gBAAgB,KAAK,CAAC;AAC7C,MAAI,UAAU;AACd,aAAW,SAAS,aAAa;AAC/B,QAAI,OAAO,IAAI,KAAK,EAAG,YAAW;AAAA,EACpC;AACA,SAAO,UAAU;AACnB;AAEA,SAAS,mCACP,UACA,aACQ;AACR,MAAI,QAAQ;AACZ,WAAS,aAAa,aAAa,SAAS,OAAO,CAAC;AACpD,WAAS,aAAa,aAAa,SAAS,SAAS,CAAC;AACtD,WAAS,aAAa,aAAa,SAAS,SAAS,CAAC;AACtD,WAAS,aAAa,aAAa,SAAS,UAAU,CAAC;AACvD,WAAS,aAAa,aAAa,SAAS,MAAM,KAAK,GAAG,GAAG,CAAC;AAC9D,WAAS,aAAa,aAAa,SAAS,YAAY,KAAK,GAAG,GAAG,CAAC;AACpE,WAAS,aAAa,aAAa,SAAS,MAAM,CAAC;AACnD,WAAS,aAAa,aAAa,SAAS,YAAY,CAAC;AACzD,WAAS,aAAa,aAAa,SAAS,SAAS,CAAC;AACtD,SAAO;AACT;AAEA,SAAS,4BACP,UACA,cACA,YACQ;AACR,MAAI,QAAQ;AACZ,MAAI,cAAc,SAAS,eAAe,WAAY,UAAS;AAE/D,QAAM,eAAe,KAAK,MAAM,SAAS,UAAU;AACnD,MAAI,OAAO,SAAS,YAAY,GAAG;AACjC,UAAM,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,IAAS;AACpE,aAAS,KAAK,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,eAAsB,8BAA8B,SAMV;AACxC,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,UAAU,CAAC;AAC7D,MAAI,eAAe,EAAG,QAAO,CAAC;AAE9B,QAAM,EAAE,UAAU,IAAI,MAAM,4BAA4B,OAAO;AAC/D,MAAI,UAAU,WAAW,EAAG,QAAO,CAAC;AAEpC,QAAM,cAAc,IAAI,IAAI,gBAAgB,QAAQ,KAAK,CAAC;AAC1D,QAAM,SAAS,UAAU,IAAI,CAAC,aAAa;AACzC,UAAM,eAAe,mCAAmC,UAAU,WAAW;AAC7E,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,OAAO,4BAA4B,UAAU,cAAc,QAAQ,UAAU;AAAA,IAC/E;AAAA,EACF,CAAC;AAED,QAAM,WAAW,YAAY,SAAS,IAClC,SACA,OAAO,OAAO,CAAC,WAAW,OAAO,eAAe,CAAC;AAErD,WAAS,KAAK,CAAC,MAAM,UAAU;AAC7B,QAAI,MAAM,UAAU,KAAK,MAAO,QAAO,MAAM,QAAQ,KAAK;AAC1D,WAAO,MAAM,SAAS,WAAW,cAAc,KAAK,SAAS,UAAU;AAAA,EACzE,CAAC;AACD,SAAO,SAAS,MAAM,GAAG,UAAU;AACrC;","names":[]}

package/dist/{chunk-JQDZQ4TB.js → chunk-BMFZLLNI.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-CI7RKSRE.js";
 import {
   recordObjectiveStateSnapshot
-} from "./chunk-UEY3VB6W.js";
+} from "./chunk-6HMYUWXR.js";
 
 // src/objective-state-writers.ts
 import crypto from "crypto";
@@ -644,4 +644,4 @@ export {
   recordObjectiveStateSnapshotsFromAgentMessages,
   recordObjectiveStateSnapshotsFromObservedMessages
 };
-//# sourceMappingURL=chunk-JQDZQ4TB.js.map
+//# sourceMappingURL=chunk-BMFZLLNI.js.map

package/dist/{chunk-ZK32E74R.js → chunk-F4QTFIB4.js}

@@ -49,10 +49,10 @@ import {
 } from "./chunk-BPSGLMQ4.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
-} from "./chunk-JQDZQ4TB.js";
+} from "./chunk-BMFZLLNI.js";
 import {
   objectiveStateStoreOverrideForNamespace
-} from "./chunk-UEY3VB6W.js";
+} from "./chunk-6HMYUWXR.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
@@ -4349,4 +4349,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-ZK32E74R.js.map
+//# sourceMappingURL=chunk-F4QTFIB4.js.map

package/dist/{chunk-X4QQB7O6.js → chunk-FH3PPO42.js}

@@ -11,11 +11,11 @@ import {
 } from "./chunk-LMDRGRJ2.js";
 import {
   parseConfig
-} from "./chunk-T7N6KQGS.js";
+} from "./chunk-5GOMXHLC.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
-} from "./chunk-UEY3VB6W.js";
+} from "./chunk-6HMYUWXR.js";
 import {
   assertIsoRecordedAt,
   assertSafePathSegment,
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-X4QQB7O6.js.map
+//# sourceMappingURL=chunk-FH3PPO42.js.map

package/dist/{chunk-TNOWU6RP.js → chunk-HA5SI4GK.js}

@@ -1,6 +1,6 @@
 import {
   listNamespaces
-} from "./chunk-OBIRVF36.js";
+} from "./chunk-YEEAADCI.js";
 import {
   runConsolidationProvenanceCheck
 } from "./chunk-AL4RAJL5.js";
@@ -32,7 +32,7 @@ import {
 } from "./chunk-AJU4PJGY.js";
 import {
   parseConfig
-} from "./chunk-T7N6KQGS.js";
+} from "./chunk-5GOMXHLC.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
@@ -1336,4 +1336,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-TNOWU6RP.js.map
+//# sourceMappingURL=chunk-HA5SI4GK.js.map

package/dist/{chunk-EXUAP5LH.js → chunk-O3U5BPUP.js}

@@ -237,7 +237,7 @@ import {
 } from "./chunk-CYEPCZN5.js";
 import {
   NamespaceStorageRouter
-} from "./chunk-VMGLYN42.js";
+} from "./chunk-XQNPGNKK.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
@@ -321,7 +321,7 @@ import {
 import {
   objectiveStateStoreOverrideForNamespace,
   searchObjectiveStateSnapshots
-} from "./chunk-UEY3VB6W.js";
+} from "./chunk-6HMYUWXR.js";
 import {
   ProfilingCollector
 } from "./chunk-QY7YA7OL.js";
@@ -12498,4 +12498,4 @@ export {
   resolvePersistedMemoryRelativePath,
   Orchestrator
 };
-//# sourceMappingURL=chunk-EXUAP5LH.js.map
+//# sourceMappingURL=chunk-O3U5BPUP.js.map

package/dist/{chunk-NM5NQYJE.js → chunk-THTIZJZA.js}

@@ -3,10 +3,10 @@ import {
 } from "./chunk-2QSZNTDO.js";
 import {
   EngramMcpServer
-} from "./chunk-5OHHEORR.js";
+} from "./chunk-TIPYPLLQ.js";
 import {
   EngramAccessInputError
-} from "./chunk-ZK32E74R.js";
+} from "./chunk-F4QTFIB4.js";
 import {
   projectTagProjectId
 } from "./chunk-EDQVAMQI.js";
@@ -1847,4 +1847,4 @@ var EngramAccessHttpServer = class {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-NM5NQYJE.js.map
+//# sourceMappingURL=chunk-THTIZJZA.js.map

package/dist/{chunk-5OHHEORR.js → chunk-TIPYPLLQ.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-D24OXEPB.js";
 import {
   EngramAccessInputError
-} from "./chunk-ZK32E74R.js";
+} from "./chunk-F4QTFIB4.js";
 import {
   projectTagProjectId
 } from "./chunk-EDQVAMQI.js";
@@ -2903,4 +2903,4 @@ ${body}`;
 export {
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-5OHHEORR.js.map
+//# sourceMappingURL=chunk-TIPYPLLQ.js.map

package/dist/{chunk-VMGLYN42.js → chunk-XQNPGNKK.js}

@@ -67,6 +67,12 @@ async function hasStoredEntries(p) {
     return false;
   }
 }
+function resolveNamespaceDir(memoryDir, segment) {
+  if (segment.length === 0 || segment.includes("/") || segment.includes("\\") || segment.includes("..") || path2.isAbsolute(segment)) {
+    throw new Error(`unsafe namespace path segment: ${segment}`);
+  }
+  return path2.join(memoryDir, "namespaces", segment);
+}
 var LEGACY_NAMESPACE_CONTENT_CHILDREN = [
   ...ALL_CATEGORY_DIRS,
   "entities",
@@ -103,10 +109,9 @@ var NamespaceStorageRouter = class {
       this.defaultNsRootResolved = this.config.memoryDir;
       return this.defaultNsRootResolved;
     }
-    const legacyNsDir = path2.join(this.config.memoryDir, "namespaces", this.config.defaultNamespace);
-    const tokenizedNsDir = path2.join(
+    const legacyNsDir = resolveNamespaceDir(this.config.memoryDir, this.config.defaultNamespace);
+    const tokenizedNsDir = resolveNamespaceDir(
       this.config.memoryDir,
-      "namespaces",
       namespaceIdentityToken(this.config.defaultNamespace)
     );
     const tokenizedHasData = await exists(tokenizedNsDir) && await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true });
@@ -119,8 +124,8 @@ var NamespaceStorageRouter = class {
     if (namespace === this.config.defaultNamespace) {
       return this.defaultNsRootResolved ?? this.config.memoryDir;
     }
-    const legacyRoot = path2.join(this.config.memoryDir, "namespaces", namespace);
-    const tokenizedRoot = path2.join(this.config.memoryDir, "namespaces", namespaceIdentityToken(namespace));
+    const legacyRoot = resolveNamespaceDir(this.config.memoryDir, namespace);
+    const tokenizedRoot = resolveNamespaceDir(this.config.memoryDir, namespaceIdentityToken(namespace));
     if (await exists(tokenizedRoot) && await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true })) {
       return tokenizedRoot;
     }
@@ -156,4 +161,4 @@ export {
   getCategoryDir,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-VMGLYN42.js.map
+//# sourceMappingURL=chunk-XQNPGNKK.js.map

package/dist/chunk-XQNPGNKK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/storage.ts","../src/utils/category-dir.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n\n  constructor(private readonly config: PluginConfig) {}\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    if (!this.config.namespacesEnabled) {\n      this.defaultNsRootResolved = this.config.memoryDir;\n      return this.defaultNsRootResolved;\n    }\n\n    const legacyNsDir = resolveNamespaceDir(this.config.memoryDir, this.config.defaultNamespace);\n    const tokenizedNsDir = resolveNamespaceDir(\n      this.config.memoryDir,\n      namespaceIdentityToken(this.config.defaultNamespace),\n    );\n    const tokenizedHasData =\n      (await exists(tokenizedNsDir)) && (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n    const nsDir = tokenizedHasData\n      ? tokenizedNsDir\n      : (await exists(legacyNsDir)) ? legacyNsDir : tokenizedNsDir;\n    this.defaultNsRootResolved =\n      (await exists(nsDir)) && !(await hasAnyLegacyData(this.config.memoryDir))\n        ? nsDir\n        : this.config.memoryDir;\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (namespace === this.config.defaultNamespace) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    const legacyRoot = resolveNamespaceDir(this.config.memoryDir, namespace);\n    const tokenizedRoot = resolveNamespaceDir(this.config.memoryDir, namespaceIdentityToken(namespace));\n    if ((await exists(tokenizedRoot)) && (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))) {\n      return tokenizedRoot;\n    }\n    return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.config.defaultNamespace && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.config.defaultNamespace) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) return cached;\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    this.cache.set(ns, sm);\n    return sm;\n  }\n}\n","/**\n * @remnic/core — Category Directory Map\n *\n * Shared mapping of memory category names to directory names.\n * Single source of truth — import from here instead of copy-pasting.\n */\n\nimport path from \"node:path\";\n\nexport const CATEGORY_DIR_MAP: Record<string, string> = {\n  correction: \"corrections\",\n  question: \"questions\",\n  preference: \"preferences\",\n  decision: \"decisions\",\n  moment: \"moments\",\n  commitment: \"commitments\",\n  principle: \"principles\",\n  rule: \"rules\",\n  skill: \"skills\",\n  relationship: \"relationships\",\n  procedure: \"procedures\",\n  reasoning_trace: \"reasoning-traces\",\n};\n\n/** All directory names derived from CATEGORY_DIR_MAP, plus \"facts\" (the default). */\nexport const ALL_CATEGORY_DIRS: string[] = [\n  \"facts\",\n  ...Object.values(CATEGORY_DIR_MAP),\n];\n\n/** All category keys (singular form) — used when iterating categories and calling getCategoryDir. */\nexport const ALL_CATEGORY_KEYS: string[] = [\n  \"fact\",\n  ...Object.keys(CATEGORY_DIR_MAP),\n];\n\n/**\n * Resolve a category name to its directory path under memoryDir.\n * Falls back to `facts/` for unknown categories.\n */\nexport function getCategoryDir(memoryDir: string, category: string): string {\n  const dir = Object.hasOwn(CATEGORY_DIR_MAP, category)\n    ? CATEGORY_DIR_MAP[category]\n    : undefined;\n  return dir ? path.join(memoryDir, dir) : path.join(memoryDir, \"facts\");\n}\n"],"mappings":";;;;;;;;;;;;AAAA,OAAOA,WAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;;;ACMvC,OAAO,UAAU;AAEV,IAAM,mBAA2C;AAAA,EACtD,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,cAAc;AAAA,EACd,WAAW;AAAA,EACX,iBAAiB;AACnB;AAGO,IAAM,oBAA8B;AAAA,EACzC;AAAA,EACA,GAAG,OAAO,OAAO,gBAAgB;AACnC;AAGO,IAAM,oBAA8B;AAAA,EACzC;AAAA,EACA,GAAG,OAAO,KAAK,gBAAgB;AACjC;AAMO,SAAS,eAAe,WAAmB,UAA0B;AAC1E,QAAM,MAAM,OAAO,OAAO,kBAAkB,QAAQ,IAChD,iBAAiB,QAAQ,IACzB;AACJ,SAAO,MAAM,KAAK,KAAK,WAAW,GAAG,IAAI,KAAK,KAAK,WAAW,OAAO;AACvE;;;ADrCA,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAYC,MAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrBA,MAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAOA,MAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiBA,MAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAOA,MAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AAcO,IAAM,yBAAN,MAA6B;AAAA,EAIlC,YAA6B,QAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAHZ,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA,EAI/C,MAAc,uBAAwC;AACpD,QAAI,CAAC,KAAK,OAAO,mBAAmB;AAClC,WAAK,wBAAwB,KAAK,OAAO;AACzC,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,cAAc,oBAAoB,KAAK,OAAO,WAAW,KAAK,OAAO,gBAAgB;AAC3F,UAAM,iBAAiB;AAAA,MACrB,KAAK,OAAO;AAAA,MACZ,uBAAuB,KAAK,OAAO,gBAAgB;AAAA,IACrD;AACA,UAAM,mBACH,MAAM,OAAO,cAAc,KAAO,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACrH,UAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IAAK,cAAc;AAChD,SAAK,wBACF,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,KAAK,OAAO,SAAS,IACnE,QACA,KAAK,OAAO;AAClB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,cAAc,KAAK,OAAO,kBAAkB;AAC9C,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,UAAM,aAAa,oBAAoB,KAAK,OAAO,WAAW,SAAS;AACvE,UAAM,gBAAgB,oBAAoB,KAAK,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAClG,QAAK,MAAM,OAAO,aAAa,KAAO,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAAI;AACvH,aAAO;AAAA,IACT;AACA,WAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AAAA,EACnD;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,OAAO,oBAAoB,CAAC,qBAAqB,EAAE,GAAG;AACpE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,OAAO,kBAAkB;AACvC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,KAAM,QAAO;AAAA,IAC5C;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAClC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,WAAO;AAAA,EACT;AACF;","names":["path","path"]}

package/dist/{chunk-OBIRVF36.js → chunk-YEEAADCI.js}

@@ -4,7 +4,7 @@ import {
 import {
   ALL_CATEGORY_DIRS,
   NamespaceStorageRouter
-} from "./chunk-VMGLYN42.js";
+} from "./chunk-XQNPGNKK.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -202,4 +202,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-OBIRVF36.js.map
+//# sourceMappingURL=chunk-YEEAADCI.js.map

package/dist/cli.js

@@ -89,7 +89,7 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-KGLPJROV.js";
+} from "./chunk-4EWRLK3C.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
 import "./chunk-7F7Z6MOS.js";
@@ -118,11 +118,11 @@ import "./chunk-H2NCNXMS.js";
 import "./chunk-PU44GBL4.js";
 import "./chunk-YR6GIWWY.js";
 import "./chunk-CIOMS6DI.js";
-import "./chunk-X4QQB7O6.js";
+import "./chunk-FH3PPO42.js";
 import "./chunk-3QSU4NFF.js";
 import "./chunk-TGQ2NTWH.js";
-import "./chunk-TNOWU6RP.js";
-import "./chunk-OBIRVF36.js";
+import "./chunk-HA5SI4GK.js";
+import "./chunk-YEEAADCI.js";
 import "./chunk-3T74IZB3.js";
 import "./chunk-HL4DB7TO.js";
 import "./chunk-YNDLCWXS.js";
@@ -152,7 +152,7 @@ import "./chunk-CYEPCZN5.js";
 import "./chunk-DCGT4FPP.js";
 import "./chunk-Q4CAQGKQ.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-VMGLYN42.js";
+import "./chunk-XQNPGNKK.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -176,14 +176,14 @@ import "./chunk-LMDRGRJ2.js";
 import "./chunk-OKTXM5H4.js";
 import "./chunk-3UXOZBHV.js";
 import "./chunk-4WMCPJWX.js";
-import "./chunk-T7N6KQGS.js";
+import "./chunk-5GOMXHLC.js";
 import "./chunk-PHK3HARR.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-LBJBNWS2.js";
 import "./chunk-HQ6NIBL6.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-OADWQ5CR.js";
-import "./chunk-NM5NQYJE.js";
+import "./chunk-THTIZJZA.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-2QSZNTDO.js";
 import "./chunk-RSUYKGGZ.js";
@@ -191,10 +191,10 @@ import "./chunk-42NQ7AVG.js";
 import "./chunk-TMSXWOBZ.js";
 import "./chunk-J64TK33U.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-5OHHEORR.js";
+import "./chunk-TIPYPLLQ.js";
 import "./chunk-6L46YAEZ.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-ZK32E74R.js";
+import "./chunk-F4QTFIB4.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-DGNQRNLL.js";
@@ -206,9 +206,9 @@ import "./chunk-5BTCT236.js";
 import "./chunk-EDQVAMQI.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-BPSGLMQ4.js";
-import "./chunk-JQDZQ4TB.js";
+import "./chunk-BMFZLLNI.js";
 import "./chunk-CI7RKSRE.js";
-import "./chunk-UEY3VB6W.js";
+import "./chunk-6HMYUWXR.js";
 import "./chunk-EIR5VLIH.js";
 import "./chunk-7V2SGZ3H.js";
 import "./chunk-EI6V5UXY.js";

package/dist/config.js

@@ -4,7 +4,7 @@ import {
   isOpenaiApiKeyDisabled,
   parseConfig,
   resolveEnvVars
-} from "./chunk-T7N6KQGS.js";
+} from "./chunk-5GOMXHLC.js";
 import "./chunk-PHK3HARR.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-4DJQYKMN.js";

package/dist/index.js

@@ -93,7 +93,7 @@ import {
   listTrainingExportAdapters,
   registerTrainingExportAdapter,
   runBulkImportCliCommand
-} from "./chunk-KGLPJROV.js";
+} from "./chunk-4EWRLK3C.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
 import "./chunk-7F7Z6MOS.js";
@@ -135,7 +135,7 @@ import {
 } from "./chunk-PU44GBL4.js";
 import "./chunk-YR6GIWWY.js";
 import "./chunk-CIOMS6DI.js";
-import "./chunk-X4QQB7O6.js";
+import "./chunk-FH3PPO42.js";
 import {
   parseXrayBudgetFlag,
   parseXrayCliOptions
@@ -145,8 +145,8 @@ import {
   isAgentAccessSecretRef,
   resolveAgentAccessAuthToken
 } from "./chunk-TGQ2NTWH.js";
-import "./chunk-TNOWU6RP.js";
-import "./chunk-OBIRVF36.js";
+import "./chunk-HA5SI4GK.js";
+import "./chunk-YEEAADCI.js";
 import {
   parseStrictCliDate
 } from "./chunk-3T74IZB3.js";
@@ -182,7 +182,7 @@ import {
   saveTaxonomy,
   validateSlug,
   validateTaxonomy
-} from "./chunk-EXUAP5LH.js";
+} from "./chunk-O3U5BPUP.js";
 import "./chunk-5RIRL3XL.js";
 import {
   migrateFromEngram,
@@ -381,7 +381,7 @@ import {
   ALL_CATEGORY_DIRS,
   ALL_CATEGORY_KEYS,
   getCategoryDir
-} from "./chunk-VMGLYN42.js";
+} from "./chunk-XQNPGNKK.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -462,7 +462,7 @@ import {
   isOpenaiApiKeyDisabled,
   parseConfig,
   resolveEnvVars
-} from "./chunk-T7N6KQGS.js";
+} from "./chunk-5GOMXHLC.js";
 import {
   coerceInstallExtension
 } from "./chunk-PHK3HARR.js";
@@ -478,7 +478,7 @@ import "./chunk-PVGDJXVK.js";
 import "./chunk-OADWQ5CR.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-NM5NQYJE.js";
+} from "./chunk-THTIZJZA.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-2QSZNTDO.js";
 import "./chunk-RSUYKGGZ.js";
@@ -488,7 +488,7 @@ import "./chunk-J64TK33U.js";
 import "./chunk-7RXCMVFQ.js";
 import {
   EngramMcpServer
-} from "./chunk-5OHHEORR.js";
+} from "./chunk-TIPYPLLQ.js";
 import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_CANONICAL_TOOL,
   REMNIC_CHATGPT_MEMORY_INSPECTOR_MIME_TYPE,
@@ -509,7 +509,7 @@ import {
   EngramAccessService,
   computeProcedureStats,
   formatProcedureStatsText
-} from "./chunk-ZK32E74R.js";
+} from "./chunk-F4QTFIB4.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import {
@@ -540,7 +540,7 @@ import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
 import "./chunk-BPSGLMQ4.js";
-import "./chunk-JQDZQ4TB.js";
+import "./chunk-BMFZLLNI.js";
 import {
   isLcmMessagePartKind,
   normalizeExplicitParts,
@@ -551,7 +551,7 @@ import {
   parsePiMessageParts,
   partsFromRenderedText
 } from "./chunk-CI7RKSRE.js";
-import "./chunk-UEY3VB6W.js";
+import "./chunk-6HMYUWXR.js";
 import {
   memoryWorthOutcomeEligibleCategories,
   recordMemoryOutcome

package/dist/namespaces/migrate.js

@@ -2,7 +2,7 @@ import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "../chunk-OBIRVF36.js";
+} from "../chunk-YEEAADCI.js";
 import "../chunk-ZJR7VG5L.js";
 import "../chunk-YRMKDTKF.js";
 import "../chunk-JOASJWQR.js";
@@ -13,7 +13,7 @@ import "../chunk-CYEPCZN5.js";
 import "../chunk-DCGT4FPP.js";
 import "../chunk-Q4CAQGKQ.js";
 import "../chunk-CINZGPSJ.js";
-import "../chunk-VMGLYN42.js";
+import "../chunk-XQNPGNKK.js";
 import "../chunk-ZFXCQPNO.js";
 import "../chunk-Q6YIJGXJ.js";
 import "../chunk-ORFGK3XI.js";

package/dist/namespaces/storage.js

@@ -1,6 +1,6 @@
 import {
   NamespaceStorageRouter
-} from "../chunk-VMGLYN42.js";
+} from "../chunk-XQNPGNKK.js";
 import "../chunk-ZFXCQPNO.js";
 import "../chunk-7MLB4NCL.js";
 import "../chunk-5UZXUTVO.js";

package/dist/objective-state-writers.js

@@ -3,9 +3,9 @@ import {
   deriveObjectiveStateSnapshotsFromObservedMessages,
   recordObjectiveStateSnapshotsFromAgentMessages,
   recordObjectiveStateSnapshotsFromObservedMessages
-} from "./chunk-JQDZQ4TB.js";
+} from "./chunk-BMFZLLNI.js";
 import "./chunk-CI7RKSRE.js";
-import "./chunk-UEY3VB6W.js";
+import "./chunk-6HMYUWXR.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-LPSF4OQH.js";
 import "./chunk-PZ5AY32C.js";

package/dist/objective-state.js

@@ -5,7 +5,7 @@ import {
   resolveObjectiveStateStoreDir,
   searchObjectiveStateSnapshots,
   validateObjectiveStateSnapshot
-} from "./chunk-UEY3VB6W.js";
+} from "./chunk-6HMYUWXR.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-LPSF4OQH.js";
 import "./chunk-PZ5AY32C.js";

package/dist/operator-toolkit.js

@@ -11,8 +11,8 @@ import {
   summarizeMemoryWorthLegacyCounters,
   summarizeObservationThroughput,
   summarizeTierDistribution
-} from "./chunk-TNOWU6RP.js";
-import "./chunk-OBIRVF36.js";
+} from "./chunk-HA5SI4GK.js";
+import "./chunk-YEEAADCI.js";
 import "./chunk-AL4RAJL5.js";
 import "./chunk-YBPYIAA5.js";
 import "./chunk-ZJR7VG5L.js";
@@ -25,7 +25,7 @@ import "./chunk-CYEPCZN5.js";
 import "./chunk-DCGT4FPP.js";
 import "./chunk-Q4CAQGKQ.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-VMGLYN42.js";
+import "./chunk-XQNPGNKK.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -39,7 +39,7 @@ import "./chunk-BEUDU7Y4.js";
 import "./chunk-3PY7VHV7.js";
 import "./chunk-AJU4PJGY.js";
 import "./chunk-3ONXXHQO.js";
-import "./chunk-T7N6KQGS.js";
+import "./chunk-5GOMXHLC.js";
 import "./chunk-PHK3HARR.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-PVGDJXVK.js";

package/dist/orchestrator.js

@@ -27,7 +27,7 @@ import {
   sanitizeSessionKeyForFilename,
   shouldFilterLifecycleRecallCandidate,
   summarizeGraphShadowComparison
-} from "./chunk-EXUAP5LH.js";
+} from "./chunk-O3U5BPUP.js";
 import "./chunk-5RIRL3XL.js";
 import "./chunk-4HFJQCJZ.js";
 import "./chunk-6BDVBBBY.js";
@@ -119,7 +119,7 @@ import "./chunk-CYEPCZN5.js";
 import "./chunk-DCGT4FPP.js";
 import "./chunk-Q4CAQGKQ.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-VMGLYN42.js";
+import "./chunk-XQNPGNKK.js";
 import "./chunk-ZFXCQPNO.js";
 import "./chunk-Q6YIJGXJ.js";
 import "./chunk-ORFGK3XI.js";
@@ -162,7 +162,7 @@ import "./chunk-EDQVAMQI.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-BPSGLMQ4.js";
 import "./chunk-CI7RKSRE.js";
-import "./chunk-UEY3VB6W.js";
+import "./chunk-6HMYUWXR.js";
 import "./chunk-EI6V5UXY.js";
 import "./chunk-QY7YA7OL.js";
 import "./chunk-NNVTUXEB.js";

package/dist/resume-bundles.js

@@ -4,16 +4,16 @@ import {
   recordResumeBundle,
   resolveResumeBundleDir,
   validateResumeBundle
-} from "./chunk-X4QQB7O6.js";
+} from "./chunk-FH3PPO42.js";
 import "./chunk-ZRWB5D4H.js";
 import "./chunk-A6D7A2FW.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-KFY3SGN7.js";
 import "./chunk-LMDRGRJ2.js";
-import "./chunk-T7N6KQGS.js";
+import "./chunk-5GOMXHLC.js";
 import "./chunk-PHK3HARR.js";
 import "./chunk-Z5LAYHGJ.js";
-import "./chunk-UEY3VB6W.js";
+import "./chunk-6HMYUWXR.js";
 import "./chunk-4DJQYKMN.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";