@remnic/core 9.3.623 → 9.3.625

package/dist/types.js

@@ -4,7 +4,7 @@ import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier,
   isRecallDisclosure
-} from "./chunk-4R4KTDIE.js";
+} from "./chunk-FPNQF475.js";
 import "./chunk-PZ5AY32C.js";
 export {
   DEFAULT_RECALL_DISCLOSURE,

package/dist/utility-runtime.d.ts

@@ -1,5 +1,5 @@
 import { TierRoutingPolicy } from './tier-routing.js';
-import './types.js';
+import './types-D5VRAI04.js';
 import './types-BliCnURB.js';
 import './index-DJ9QWMw-.js';
 import './lifecycle.js';

package/dist/verified-recall.js

@@ -1,11 +1,11 @@
 import {
   searchVerifiedEpisodes
-} from "./chunk-R3OQGYOU.js";
+} from "./chunk-P2D2MM47.js";
 import "./chunk-HQ6NIBL6.js";
-import "./chunk-PJGB7XRR.js";
+import "./chunk-UGHUNQ74.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-J6A3CX5N.js";
-import "./chunk-4R4KTDIE.js";
+import "./chunk-FPNQF475.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-MB5RSUW6.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.3.623",
+  "version": "9.3.625",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",

package/src/access-http.ts

@@ -8,6 +8,7 @@ import { fileURLToPath, URL } from "node:url";
 import { gunzipSync } from "node:zlib";
 import { log } from "./logger.js";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
+import { WearablesInputError } from "./wearables/errors.js";
 import { EngramMcpServer } from "./access-mcp.js";
 import { validateRequest, type SchemaName, type SchemaTypeFor } from "./access-schema.js";
 import {
@@ -984,23 +985,149 @@ export class EngramAccessHttpServer {
           ...(disclosure !== undefined ? { disclosure } : {}),
         });
       } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.startsWith("recallXray:")) {
+        // Only surface the message for the deliberately-prefixed recallXray
+        // input-validation errors, and only when it is a real Error.message —
+        // never String(err) of an arbitrary throw, which CodeQL flags as
+        // stack-trace exposure (js/stack-trace-exposure). Validation errors are
+        // always thrown as Error instances (see access-service.ts), so this is
+        // behavior-preserving; anything else is a server-side fault and is
+        // rethrown so the outer `handle()` catch returns 500 + logs it.
+        if (err instanceof Error && err.message.startsWith("recallXray:")) {
           this.respondJson(res, 400, {
             error: "invalid_request",
             code: "invalid_request",
-            message,
+            message: err.message,
           });
           return;
         }
-        // Anything else is a server-side fault; rethrow so the
-        // outer `handle()` catch returns 500 + logs the error.
         throw err;
       }
       this.respondJson(res, 200, payload);
       return;
     }
 
+    // -- Wearables (Limitless / Bee / Omi transcript ingestion). All
+    //    behavior + validation lives in WearablesService; these routes
+    //    translate transport shape only. Service validation errors map
+    //    to 400 via respondWearablesError; backend faults bubble to the
+    //    global 500 handler.
+    if (
+      req.method === "GET" &&
+      (pathname === "/engram/v1/wearables/status" || pathname === "/remnic/v1/wearables/status")
+    ) {
+      this.respondJson(res, 200, await this.service.wearablesStatus());
+      return;
+    }
+
+    if (
+      req.method === "POST" &&
+      (pathname === "/engram/v1/wearables/sync" || pathname === "/remnic/v1/wearables/sync")
+    ) {
+      const body = (await this.readJsonBody(req)) as Record<string, unknown>;
+      const source = optionalQueryString(body.source, "source");
+      const date = optionalQueryString(body.date, "date");
+      let days: number | undefined;
+      if (body.days !== undefined && body.days !== null) {
+        if (
+          typeof body.days !== "number" ||
+          !Number.isInteger(body.days) ||
+          body.days < 1
+        ) {
+          throw new EngramAccessInputError(
+            `days must be a positive integer (got ${JSON.stringify(body.days)})`,
+          );
+        }
+        days = body.days;
+      }
+      if (body.forceMemories !== undefined && typeof body.forceMemories !== "boolean") {
+        throw new EngramAccessInputError(
+          `forceMemories must be a boolean (got ${JSON.stringify(body.forceMemories)})`,
+        );
+      }
+      try {
+        const summaries = await this.service.wearablesSync({
+          source,
+          date,
+          days,
+          forceMemories: body.forceMemories === true,
+        });
+        this.respondJson(res, 200, { summaries });
+      } catch (err) {
+        if (this.respondWearablesError(res, err)) return;
+        throw err;
+      }
+      return;
+    }
+
+    if (
+      req.method === "GET" &&
+      (pathname === "/engram/v1/wearables/transcript" || pathname === "/remnic/v1/wearables/transcript")
+    ) {
+      const date = parsed.searchParams.get("date");
+      if (!date || date.trim().length === 0) {
+        throw new EngramAccessInputError(
+          "date query parameter is required (YYYY-MM-DD)",
+        );
+      }
+      const sourceParam = parsed.searchParams.get("source");
+      try {
+        const transcripts = await this.service.wearablesTranscriptDay({
+          date,
+          source: sourceParam && sourceParam.length > 0 ? sourceParam : undefined,
+        });
+        this.respondJson(res, 200, { transcripts });
+      } catch (err) {
+        if (this.respondWearablesError(res, err)) return;
+        throw err;
+      }
+      return;
+    }
+
+    if (
+      req.method === "GET" &&
+      (pathname === "/engram/v1/wearables/transcripts/search" ||
+        pathname === "/remnic/v1/wearables/transcripts/search")
+    ) {
+      const queryParam = parsed.searchParams.get("q");
+      if (!queryParam || queryParam.trim().length === 0) {
+        throw new EngramAccessInputError(
+          "q query parameter is required and must be non-empty",
+        );
+      }
+      try {
+        const results = await this.service.wearablesTranscriptSearch({
+          query: queryParam,
+          source: nonEmptyQueryParam(parsed.searchParams.get("source")),
+          from: nonEmptyQueryParam(parsed.searchParams.get("from")),
+          to: nonEmptyQueryParam(parsed.searchParams.get("to")),
+          limit: positiveIntQueryParam(parsed.searchParams.get("limit"), "limit"),
+        });
+        this.respondJson(res, 200, { results });
+      } catch (err) {
+        if (this.respondWearablesError(res, err)) return;
+        throw err;
+      }
+      return;
+    }
+
+    if (
+      req.method === "GET" &&
+      (pathname === "/engram/v1/wearables/memories" || pathname === "/remnic/v1/wearables/memories")
+    ) {
+      try {
+        const memories = await this.service.wearablesTranscriptMemories({
+          source: nonEmptyQueryParam(parsed.searchParams.get("source")),
+          date: nonEmptyQueryParam(parsed.searchParams.get("date")),
+          limit: positiveIntQueryParam(parsed.searchParams.get("limit"), "limit"),
+        });
+        this.respondJson(res, 200, { memories });
+      } catch (err) {
+        if (this.respondWearablesError(res, err)) return;
+        throw err;
+      }
+      return;
+    }
+
     if (req.method === "POST" && pathname === "/engram/v1/observe") {
       const body = await this.readValidatedBody(req, "observe");
       this.ensureWriteRateLimitAvailable();
@@ -1558,12 +1685,15 @@ export class EngramAccessHttpServer {
         );
         this.respondJson(res, 200, snapshot);
       } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        if (message.startsWith("graphSnapshot:")) {
+        // As with recallXray above: surface only the deliberately-prefixed
+        // graphSnapshot validation Error.message, never String(err) of an
+        // arbitrary throw (CodeQL js/stack-trace-exposure). Validation errors are
+        // always Error instances; anything else is rethrown as a 500.
+        if (err instanceof Error && err.message.startsWith("graphSnapshot:")) {
           this.respondJson(res, 400, {
             error: "invalid_request",
             code: "invalid_request",
-            message,
+            message: err.message,
           });
           return;
         }
@@ -2365,4 +2495,48 @@ export class EngramAccessHttpServer {
   private shouldCountWriteRateLimit(response: { dryRun?: boolean; idempotencyReplay?: boolean }): boolean {
     return response.dryRun !== true && response.idempotencyReplay !== true;
   }
+
+  /**
+   * Map wearables validation errors (WearablesInputError — invalid
+   * params, unknown/disabled sources, missing connector packages) to a
+   * 400 response. Returns false for everything else so backend faults
+   * keep flowing to the global 500 handler.
+   */
+  private respondWearablesError(res: ServerResponse, err: unknown): boolean {
+    if (err instanceof WearablesInputError) {
+      this.respondJson(res, 400, {
+        error: "invalid_request",
+        code: "invalid_request",
+        message: err.message,
+      });
+      return true;
+    }
+    return false;
+  }
+}
+
+/** Optional string field from a JSON body: absent/null/"" → undefined. */
+function optionalQueryString(value: unknown, label: string): string | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value !== "string") {
+    throw new EngramAccessInputError(
+      `${label} must be a string (got ${JSON.stringify(value)})`,
+    );
+  }
+  return value;
+}
+
+/** Optional non-empty query param: null/"" → undefined. */
+function nonEmptyQueryParam(value: string | null): string | undefined {
+  return value !== null && value.length > 0 ? value : undefined;
+}
+
+/** Optional positive-integer query param; rejects invalid values. */
+function positiveIntQueryParam(value: string | null, label: string): number | undefined {
+  if (value === null || value.length === 0) return undefined;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {
+    throw new EngramAccessInputError(`${label} expects a positive integer`);
+  }
+  return parsed;
 }

package/src/access-mcp.ts

@@ -204,6 +204,36 @@ function parseMcpRequest<N extends SchemaName>(
   );
 }
 
+/**
+ * Strict optional-string MCP argument: absent/null/"" → undefined,
+ * non-string → loud error (CLAUDE.md rule 51 — no silent coercion).
+ */
+function optionalNonEmptyString(value: unknown, label: string): string | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value !== "string") {
+    throw new Error(`${label} expects a string; got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+
+/**
+ * Strict optional positive-integer MCP argument. Accepts JSON numbers
+ * and numeric strings (loosely-typed MCP clients send both); rejects
+ * everything else including booleans, which `Number()` would silently
+ * coerce.
+ */
+function optionalPositiveInteger(value: unknown, label: string): number | undefined {
+  if (value === undefined || value === null || value === "") return undefined;
+  if (typeof value !== "number" && typeof value !== "string") {
+    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+  }
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0 || !Number.isInteger(parsed)) {
+    throw new Error(`${label} expects a positive integer; got ${JSON.stringify(value)}`);
+  }
+  return parsed;
+}
+
 function getObjectProperties(value: unknown): Record<string, unknown> | undefined {
   return value && typeof value === "object" && !Array.isArray(value)
     ? (value as Record<string, unknown>)
@@ -452,6 +482,124 @@ export class EngramMcpServer {
           additionalProperties: false,
         },
       },
+      {
+        name: "engram.wearables_status",
+        description:
+          "Status of wearable transcript sources (Limitless / Bee / Omi): configured sources, connector availability, last sync, stored transcript days.",
+        inputSchema: {
+          type: "object",
+          properties: {},
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.wearables_sync",
+        description:
+          "Pull, clean, and store wearable transcripts for one source or all enabled sources; optionally creates trust-gated memories per the source's memoryMode.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            source: {
+              type: "string",
+              description: "Source id (e.g. limitless, bee, omi). Omit to sync every enabled source.",
+            },
+            date: {
+              type: "string",
+              description: "Sync exactly this day (YYYY-MM-DD). Overrides days.",
+            },
+            days: {
+              type: "integer",
+              minimum: 1,
+              maximum: 90,
+              description: "Lookback window in days ending today (default 2).",
+            },
+            forceMemories: {
+              type: "boolean",
+              description: "Re-run memory extraction even for unchanged days.",
+            },
+          },
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_day",
+        description:
+          "Return the full stored wearable transcript(s) for a day, across all sources or one source, with cross-source overlap hints.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            date: {
+              type: "string",
+              description: "Day to read (YYYY-MM-DD). Required.",
+            },
+            source: {
+              type: "string",
+              description: "Optional source id to scope to (e.g. limitless).",
+            },
+          },
+          required: ["date"],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_search",
+        description:
+          "Search stored wearable transcripts. Results carry source + date so callers can pull the full day via engram.transcript_day.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            query: {
+              type: "string",
+              description: "Search query. Required; non-empty.",
+            },
+            source: {
+              type: "string",
+              description: "Optional source id filter.",
+            },
+            from: {
+              type: "string",
+              description: "Optional inclusive start date (YYYY-MM-DD).",
+            },
+            to: {
+              type: "string",
+              description: "Optional inclusive end date (YYYY-MM-DD).",
+            },
+            limit: {
+              type: "integer",
+              minimum: 1,
+              maximum: 50,
+              description: "Maximum results (default 10).",
+            },
+          },
+          required: ["query"],
+          additionalProperties: false,
+        },
+      },
+      {
+        name: "engram.transcript_memories",
+        description:
+          "List memories created from wearable transcripts, filterable by source and/or day. Includes pending_review candidates awaiting approval.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            source: {
+              type: "string",
+              description: "Optional source id filter (e.g. limitless).",
+            },
+            date: {
+              type: "string",
+              description: "Optional transcript day filter (YYYY-MM-DD).",
+            },
+            limit: {
+              type: "integer",
+              minimum: 1,
+              maximum: 200,
+              description: "Maximum results (default 50).",
+            },
+          },
+          additionalProperties: false,
+        },
+      },
       {
         name: "engram.action_confidence",
         description:
@@ -2348,6 +2496,56 @@ export class EngramMcpServer {
             : {}),
         });
       }
+      case "engram.wearables_status":
+        return this.service.wearablesStatus();
+      case "engram.wearables_sync": {
+        const source = optionalNonEmptyString(args.source, "engram.wearables_sync: source");
+        const date = optionalNonEmptyString(args.date, "engram.wearables_sync: date");
+        const days = optionalPositiveInteger(args.days, "engram.wearables_sync: days");
+        let forceMemories: boolean | undefined;
+        if (args.forceMemories !== undefined && args.forceMemories !== null) {
+          if (typeof args.forceMemories !== "boolean") {
+            throw new Error(
+              `engram.wearables_sync: forceMemories expects a boolean; got ${JSON.stringify(args.forceMemories)}`,
+            );
+          }
+          forceMemories = args.forceMemories;
+        }
+        // Date/days/source validation beyond shape lives in the shared
+        // WearablesService so CLI/HTTP/MCP reject identically.
+        return this.service.wearablesSync({ source, date, days, forceMemories });
+      }
+      case "engram.transcript_day": {
+        const date = typeof args.date === "string" ? args.date : "";
+        if (date.trim().length === 0) {
+          throw new Error(
+            "engram.transcript_day: date is required and must be YYYY-MM-DD",
+          );
+        }
+        const source = optionalNonEmptyString(args.source, "engram.transcript_day: source");
+        return this.service.wearablesTranscriptDay({ date, source });
+      }
+      case "engram.transcript_search": {
+        const query = typeof args.query === "string" ? args.query : "";
+        if (query.trim().length === 0) {
+          throw new Error(
+            "engram.transcript_search: query is required and must be non-empty",
+          );
+        }
+        return this.service.wearablesTranscriptSearch({
+          query,
+          source: optionalNonEmptyString(args.source, "engram.transcript_search: source"),
+          from: optionalNonEmptyString(args.from, "engram.transcript_search: from"),
+          to: optionalNonEmptyString(args.to, "engram.transcript_search: to"),
+          limit: optionalPositiveInteger(args.limit, "engram.transcript_search: limit"),
+        });
+      }
+      case "engram.transcript_memories":
+        return this.service.wearablesTranscriptMemories({
+          source: optionalNonEmptyString(args.source, "engram.transcript_memories: source"),
+          date: optionalNonEmptyString(args.date, "engram.transcript_memories: date"),
+          limit: optionalPositiveInteger(args.limit, "engram.transcript_memories: limit"),
+        });
       case "engram.action_confidence": {
         const body: ActionConfidenceRequest = parseMcpRequest("actionConfidence", args);
         return this.service.actionConfidence(body);

package/src/access-service.ts

@@ -39,6 +39,7 @@ import {
 import { runProcedureMining } from "./procedural/procedure-miner.js";
 import type { PatternReinforcementResult } from "./maintenance/pattern-reinforcement.js";
 import type { LiveConnectorsRunSummary } from "./live-connectors-runner.js";
+import type { WearablesService } from "./wearables/service.js";
 import {
   computeProcedureStats,
   type ProcedureStatsReport,
@@ -6154,4 +6155,68 @@ export class EngramAccessService {
       notes: result.notes,
     };
   }
+
+  // ---------------------------------------------------------------------------
+  // Wearables (Limitless / Bee / Omi transcript ingestion)
+  //
+  // Thin delegations to the orchestrator-owned WearablesService — the
+  // same instance behind the CLI, so HTTP/MCP callers observe identical
+  // behavior and validation (renderer-sharing rule).
+  // ---------------------------------------------------------------------------
+
+  async wearablesStatus(): Promise<
+    Awaited<ReturnType<WearablesService["status"]>>
+  > {
+    return this.orchestrator.getWearablesService().status();
+  }
+
+  async wearablesSync(request: {
+    source?: string;
+    date?: string;
+    days?: number;
+    forceMemories?: boolean;
+  }): Promise<Awaited<ReturnType<WearablesService["sync"]>>> {
+    return this.orchestrator.getWearablesService().sync({
+      source: request.source,
+      date: request.date,
+      days: request.days,
+      forceMemories: request.forceMemories,
+    });
+  }
+
+  async wearablesTranscriptDay(request: {
+    date: string;
+    source?: string;
+  }): Promise<Awaited<ReturnType<WearablesService["dayTranscript"]>>> {
+    return this.orchestrator
+      .getWearablesService()
+      .dayTranscript(request.date, request.source);
+  }
+
+  async wearablesTranscriptSearch(request: {
+    query: string;
+    source?: string;
+    from?: string;
+    to?: string;
+    limit?: number;
+  }): Promise<Awaited<ReturnType<WearablesService["searchTranscripts"]>>> {
+    return this.orchestrator.getWearablesService().searchTranscripts(request.query, {
+      source: request.source,
+      from: request.from,
+      to: request.to,
+      limit: request.limit,
+    });
+  }
+
+  async wearablesTranscriptMemories(request: {
+    source?: string;
+    date?: string;
+    limit?: number;
+  }): Promise<Awaited<ReturnType<WearablesService["transcriptMemories"]>>> {
+    return this.orchestrator.getWearablesService().transcriptMemories({
+      source: request.source,
+      date: request.date,
+      limit: request.limit,
+    });
+  }
 }