@remnic/core 9.3.663 → 9.3.664

package/dist/{chunk-Q4CAQGKQ.js → chunk-AER6MT24.js}

@@ -1,3 +1,10 @@
+import {
+  assertPathInsideRoot
+} from "./chunk-5GPPACXK.js";
+import {
+  RECALL_FALLBACK_DIRS
+} from "./chunk-VS2IYZRU.js";
+
 // src/search/document-scanner.ts
 import path from "path";
 import { lstat, readdir, readFile, realpath } from "fs/promises";
@@ -66,15 +73,6 @@ async function scanDir(dir, memoryRootReal) {
 function isNodeError(err) {
   return typeof err === "object" && err !== null && "code" in err;
 }
-function pathIsInside(parent, child) {
-  const relative = path.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
-}
-function assertPathInsideRoot(rootReal, candidateReal, originalPath) {
-  if (!pathIsInside(rootReal, candidateReal)) {
-    throw new Error(`Refusing to scan memory path outside memoryDir: ${originalPath}`);
-  }
-}
 async function scanMemoryDir(memoryDir) {
   let memoryRootReal;
   try {
@@ -85,20 +83,13 @@ async function scanMemoryDir(memoryDir) {
     }
     throw err;
   }
-  const factsDir = path.join(memoryDir, "facts");
-  const correctionsDir = path.join(memoryDir, "corrections");
-  const proceduresDir = path.join(memoryDir, "procedures");
-  const reasoningTracesDir = path.join(memoryDir, "reasoning-traces");
-  const [facts, corrections, procedures, reasoningTraces] = await Promise.all([
-    scanDir(factsDir, memoryRootReal),
-    scanDir(correctionsDir, memoryRootReal),
-    scanDir(proceduresDir, memoryRootReal),
-    scanDir(reasoningTracesDir, memoryRootReal)
-  ]);
-  return [...facts, ...corrections, ...procedures, ...reasoningTraces];
+  const perDir = await Promise.all(
+    RECALL_FALLBACK_DIRS.map((dir) => scanDir(path.join(memoryDir, dir), memoryRootReal))
+  );
+  return perDir.flat();
 }
 
 export {
   scanMemoryDir
 };
-//# sourceMappingURL=chunk-Q4CAQGKQ.js.map
+//# sourceMappingURL=chunk-AER6MT24.js.map

package/dist/chunk-AER6MT24.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/search/document-scanner.ts"],"sourcesContent":["import path from \"node:path\";\nimport { lstat, readdir, readFile, realpath } from \"node:fs/promises\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\nimport { assertPathInsideRoot } from \"../utils/path-containment.js\";\n\nexport interface IndexableDocument {\n  /** Memory ID from frontmatter or filename stem */\n  docid: string;\n  /** Absolute file path */\n  path: string;\n  /** Markdown body (no YAML frontmatter) */\n  content: string;\n  /** First ~200 chars for display */\n  snippet: string;\n}\n\n/**\n * Parse YAML frontmatter from a markdown string.\n * Returns the frontmatter key-value pairs and body, or null if no frontmatter block.\n */\nfunction parseFrontmatter(raw: string): { data: Record<string, string>; body: string } | null {\n  // Support both LF and CRLF line endings\n  const normalized = raw.replace(/\\r\\n/g, \"\\n\");\n  const match = normalized.match(/^---\\n([\\s\\S]*?)\\n---\\n?([\\s\\S]*)$/);\n  if (!match) return null;\n\n  const fmBlock = match[1];\n  const body = (match[2] ?? \"\").trim();\n  const data: Record<string, string> = {};\n\n  for (const line of fmBlock.split(\"\\n\")) {\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx === -1) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n    data[key] = value;\n  }\n\n  return { data, body };\n}\n\n/**\n * Recursively scan a directory for `.md` files and return IndexableDocuments.\n */\nasync function scanDir(dir: string, memoryRootReal: string): Promise<IndexableDocument[]> {\n  const docs: IndexableDocument[] = [];\n  try {\n    const dirStat = await lstat(dir);\n    if (dirStat.isSymbolicLink()) {\n      throw new Error(`Refusing to scan symlinked memory category directory: ${dir}`);\n    }\n    if (!dirStat.isDirectory()) {\n      const error = new Error(`Memory category path is not a directory: ${dir}`) as NodeJS.ErrnoException;\n      error.code = \"ENOTDIR\";\n      throw error;\n    }\n    assertPathInsideRoot(memoryRootReal, await realpath(dir), dir);\n\n    const entries = await readdir(dir, { withFileTypes: true });\n    for (const entry of entries) {\n      if (entry.isSymbolicLink()) continue;\n      const fullPath = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);\n        const sub = await scanDir(fullPath, memoryRootReal);\n        docs.push(...sub);\n      } else if (entry.name.endsWith(\".md\")) {\n        try {\n          assertPathInsideRoot(memoryRootReal, await realpath(fullPath), fullPath);\n          const raw = await readFile(fullPath, \"utf-8\");\n          const parsed = parseFrontmatter(raw);\n          const body = parsed ? parsed.body : raw.trim();\n          const docid = parsed?.data.id || path.basename(entry.name, \".md\");\n          docs.push({\n            docid,\n            path: fullPath,\n            content: body,\n            snippet: body.slice(0, 200),\n          });\n        } catch {\n          // Skip unreadable files\n        }\n      }\n    }\n  } catch (err) {\n    if (isNodeError(err) && err.code === \"ENOENT\") {\n      // Optional category directories may not exist yet.\n      return docs;\n    }\n    throw err;\n  }\n  return docs;\n}\n\nfunction isNodeError(err: unknown): err is NodeJS.ErrnoException {\n  return typeof err === \"object\" && err !== null && \"code\" in err;\n}\n\n/**\n * Scan every recall category subdir of memoryDir for indexable markdown\n * documents. The directory set is derived from `RECALL_FALLBACK_DIRS`\n * (utils/category-dir.ts → ALL_CATEGORY_DIRS minus non-recall queue dirs) —\n * the single source of truth — so adding a new category never requires\n * touching this scanner. Non-QMD backends (Orama / Meilisearch / LanceDB)\n * build their index through this helper; deriving from RECALL_FALLBACK_DIRS\n * keeps them in parity with writeMemory's category-dir routing (issue #1546)\n * and the QMD filesystem-fallback corpus. reasoning-traces/ and the other\n * category dirs are covered automatically (issue #564 PR 3 no longer needs a\n * hand-maintained list). scanDir tolerates missing dirs (ENOENT), so category\n * dirs that do not exist yet are skipped.\n */\nexport async function scanMemoryDir(memoryDir: string): Promise<IndexableDocument[]> {\n  let memoryRootReal: string;\n  try {\n    memoryRootReal = await realpath(memoryDir);\n  } catch (err) {\n    if (isNodeError(err) && err.code === \"ENOENT\") {\n      return [];\n    }\n    throw err;\n  }\n  const perDir = await Promise.all(\n    RECALL_FALLBACK_DIRS.map((dir) => scanDir(path.join(memoryDir, dir), memoryRootReal)),\n  );\n  return perDir.flat();\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,SAAS,UAAU,gBAAgB;AAmBnD,SAAS,iBAAiB,KAAoE;AAE5F,QAAM,aAAa,IAAI,QAAQ,SAAS,IAAI;AAC5C,QAAM,QAAQ,WAAW,MAAM,oCAAoC;AACnE,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,UAAU,MAAM,CAAC;AACvB,QAAM,QAAQ,MAAM,CAAC,KAAK,IAAI,KAAK;AACnC,QAAM,OAA+B,CAAC;AAEtC,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,aAAa,GAAI;AACrB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAC5C,SAAK,GAAG,IAAI;AAAA,EACd;AAEA,SAAO,EAAE,MAAM,KAAK;AACtB;AAKA,eAAe,QAAQ,KAAa,gBAAsD;AACxF,QAAM,OAA4B,CAAC;AACnC,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG;AAC/B,QAAI,QAAQ,eAAe,GAAG;AAC5B,YAAM,IAAI,MAAM,yDAAyD,GAAG,EAAE;AAAA,IAChF;AACA,QAAI,CAAC,QAAQ,YAAY,GAAG;AAC1B,YAAM,QAAQ,IAAI,MAAM,4CAA4C,GAAG,EAAE;AACzE,YAAM,OAAO;AACb,YAAM;AAAA,IACR;AACA,yBAAqB,gBAAgB,MAAM,SAAS,GAAG,GAAG,GAAG;AAE7D,UAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,eAAe,EAAG;AAC5B,YAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;AAC1C,UAAI,MAAM,YAAY,GAAG;AACvB,6BAAqB,gBAAgB,MAAM,SAAS,QAAQ,GAAG,QAAQ;AACvE,cAAM,MAAM,MAAM,QAAQ,UAAU,cAAc;AAClD,aAAK,KAAK,GAAG,GAAG;AAAA,MAClB,WAAW,MAAM,KAAK,SAAS,KAAK,GAAG;AACrC,YAAI;AACF,+BAAqB,gBAAgB,MAAM,SAAS,QAAQ,GAAG,QAAQ;AACvE,gBAAM,MAAM,MAAM,SAAS,UAAU,OAAO;AAC5C,gBAAM,SAAS,iBAAiB,GAAG;AACnC,gBAAM,OAAO,SAAS,OAAO,OAAO,IAAI,KAAK;AAC7C,gBAAM,QAAQ,QAAQ,KAAK,MAAM,KAAK,SAAS,MAAM,MAAM,KAAK;AAChE,eAAK,KAAK;AAAA,YACR;AAAA,YACA,MAAM;AAAA,YACN,SAAS;AAAA,YACT,SAAS,KAAK,MAAM,GAAG,GAAG;AAAA,UAC5B,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,YAAY,GAAG,KAAK,IAAI,SAAS,UAAU;AAE7C,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,SAAS,YAAY,KAA4C;AAC/D,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU;AAC9D;AAeA,eAAsB,cAAc,WAAiD;AACnF,MAAI;AACJ,MAAI;AACF,qBAAiB,MAAM,SAAS,SAAS;AAAA,EAC3C,SAAS,KAAK;AACZ,QAAI,YAAY,GAAG,KAAK,IAAI,SAAS,UAAU;AAC7C,aAAO,CAAC;AAAA,IACV;AACA,UAAM;AAAA,EACR;AACA,QAAM,SAAS,MAAM,QAAQ;AAAA,IAC3B,qBAAqB,IAAI,CAAC,QAAQ,QAAQ,KAAK,KAAK,WAAW,GAAG,GAAG,cAAc,CAAC;AAAA,EACtF;AACA,SAAO,OAAO,KAAK;AACrB;","names":[]}

package/dist/{chunk-DHGSZ3UD.js → chunk-ARV3AUOM.js}

@@ -1,6 +1,6 @@
 import {
   createVersion
-} from "./chunk-ALEPI75L.js";
+} from "./chunk-VF4XKTX3.js";
 import {
   parseExportBundle
 } from "./chunk-WEHSQBFR.js";
@@ -227,4 +227,4 @@ function mintForkId(capsuleId, originalId, now) {
 export {
   importCapsule
 };
-//# sourceMappingURL=chunk-DHGSZ3UD.js.map
+//# sourceMappingURL=chunk-ARV3AUOM.js.map

package/dist/{chunk-PXVFMQLD.js → chunk-BZG2CWOQ.js}

@@ -10,10 +10,10 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-A7EF2XRO.js";
+} from "./chunk-EXXBA5OM.js";
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   MEMORY_LIFECYCLE_EVENT_SORT_ORDER,
   buildLifecycleEventsForMemory,
@@ -929,4 +929,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-PXVFMQLD.js.map
+//# sourceMappingURL=chunk-BZG2CWOQ.js.map

package/dist/{chunk-ANJOULTP.js → chunk-C7AF236A.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -118,4 +118,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-ANJOULTP.js.map
+//# sourceMappingURL=chunk-C7AF236A.js.map

package/dist/{chunk-FZC2WSDB.js → chunk-DOCTITOP.js}

@@ -1,6 +1,6 @@
 import {
   scanMemoryDir
-} from "./chunk-Q4CAQGKQ.js";
+} from "./chunk-AER6MT24.js";
 import {
   isSearchAborted,
   throwIfSearchAborted
@@ -245,4 +245,4 @@ function isMeilisearchIndexNotFoundError(err) {
 export {
   MeilisearchBackend
 };
-//# sourceMappingURL=chunk-FZC2WSDB.js.map
+//# sourceMappingURL=chunk-DOCTITOP.js.map

package/dist/{chunk-WOQIHC67.js → chunk-DQY7NJ5L.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-35HP3TGR.js";
+} from "./chunk-ROHLEUTH.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
@@ -401,4 +401,4 @@ export {
   namespaceCollectionName,
   NamespaceSearchRouter
 };
-//# sourceMappingURL=chunk-WOQIHC67.js.map
+//# sourceMappingURL=chunk-DQY7NJ5L.js.map

package/dist/{chunk-NMPEJV5M.js → chunk-DSLUOQDY.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -117,4 +117,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-NMPEJV5M.js.map
+//# sourceMappingURL=chunk-DSLUOQDY.js.map

package/dist/{chunk-A7EF2XRO.js → chunk-EXXBA5OM.js}

@@ -1,13 +1,19 @@
+import {
+  assertPathInsideRoot
+} from "./chunk-5GPPACXK.js";
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   decideLifecycleTransition
 } from "./chunk-TBBDFYXW.js";
+import {
+  RECALL_FALLBACK_DIRS
+} from "./chunk-VS2IYZRU.js";
 
 // src/maintenance/memory-governance.ts
 import path from "path";
-import { mkdir, readFile, readdir, rm, writeFile } from "fs/promises";
+import { lstat, mkdir, readFile, readdir, realpath, rm, writeFile } from "fs/promises";
 var RULE_VERSION = "memory-governance.v2";
 var SEMANTIC_DUPLICATE_MIN_TOKENS = 6;
 var SEMANTIC_DUPLICATE_MIN_JACCARD = 0.66;
@@ -168,18 +174,27 @@ function buildExplicitCaptureReviewEntries(memories, lifecycleEvents) {
     relatedMemoryIds: []
   }));
 }
-async function listMarkdownFiles(root) {
+async function listMarkdownFiles(root, containmentRoot) {
   const files = [];
   const walk = async (dir) => {
     try {
+      const dirStat = await lstat(dir);
+      if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return;
+      assertPathInsideRoot(containmentRoot, await realpath(dir), dir);
       const entries = await readdir(dir, { withFileTypes: true });
       for (const entry of entries) {
+        if (entry.isSymbolicLink()) continue;
         const fullPath = path.join(dir, entry.name);
         if (entry.isDirectory()) {
           await walk(fullPath);
           continue;
         }
         if (entry.isFile() && entry.name.endsWith(".md")) {
+          try {
+            assertPathInsideRoot(containmentRoot, await realpath(fullPath), fullPath);
+          } catch {
+            continue;
+          }
           files.push(fullPath);
         }
       }
@@ -194,10 +209,17 @@ function malformedMemoryId(memoryDir, filePath) {
 }
 async function buildMalformedImportEntries(memoryDir, storage, parsedMemories, candidateFiles) {
   const parsedPaths = new Set(parsedMemories.map((memory) => memory.path));
-  const filesToInspect = candidateFiles ?? [
-    ...await listMarkdownFiles(path.join(memoryDir, "facts")),
-    ...await listMarkdownFiles(path.join(memoryDir, "corrections"))
-  ];
+  let containmentRoot = null;
+  try {
+    containmentRoot = await realpath(memoryDir);
+  } catch {
+    containmentRoot = null;
+  }
+  const filesToInspect = candidateFiles ?? (containmentRoot === null ? [] : (await Promise.all(
+    RECALL_FALLBACK_DIRS.map(
+      (dir) => listMarkdownFiles(path.join(memoryDir, dir), containmentRoot)
+    )
+  )).flat());
   const entries = [];
   for (const filePath of filesToInspect) {
     if (parsedPaths.has(filePath)) continue;
@@ -729,4 +751,4 @@ export {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
 };
-//# sourceMappingURL=chunk-A7EF2XRO.js.map
+//# sourceMappingURL=chunk-EXXBA5OM.js.map

package/dist/chunk-EXXBA5OM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/maintenance/memory-governance.ts"],"sourcesContent":["import path from \"node:path\";\nimport { lstat, mkdir, readFile, readdir, realpath, rm, writeFile } from \"node:fs/promises\";\nimport { StorageManager } from \"../storage.js\";\nimport { decideLifecycleTransition } from \"../lifecycle.js\";\nimport type { MemoryFile, MemoryStatus } from \"../types.js\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\nimport { assertPathInsideRoot } from \"../utils/path-containment.js\";\n\nexport type MemoryGovernanceMode = \"shadow\" | \"apply\";\nexport type MemoryGovernanceReasonCode =\n  | \"exact_duplicate\"\n  | \"semantic_duplicate_candidate\"\n  | \"disputed_memory\"\n  | \"speculative_low_confidence\"\n  | \"archive_candidate\"\n  | \"explicit_capture_review\"\n  | \"malformed_import\";\n\nexport interface MemoryGovernanceReviewQueueEntry {\n  entryId: string;\n  memoryId: string;\n  path: string;\n  reasonCode: MemoryGovernanceReasonCode;\n  severity: \"low\" | \"medium\" | \"high\";\n  suggestedAction: \"set_status\" | \"archive\";\n  suggestedStatus?: Extract<MemoryStatus, \"pending_review\" | \"quarantined\" | \"rejected\">;\n  relatedMemoryIds: string[];\n}\n\nexport interface MemoryGovernanceAppliedAction {\n  action: \"set_status\" | \"archive\";\n  memoryId: string;\n  reasonCode: MemoryGovernanceReviewQueueEntry[\"reasonCode\"];\n  beforeStatus: MemoryStatus;\n  afterStatus?: MemoryStatus;\n  originalPath: string;\n  currentPath: string;\n}\n\ninterface MemoryGovernanceRestoreEntry {\n  action: MemoryGovernanceAppliedAction[\"action\"];\n  memoryId: string;\n  reasonCode: MemoryGovernanceReviewQueueEntry[\"reasonCode\"];\n  originalPath: string;\n  currentPath: string;\n  beforeRaw: string;\n  expectedCurrentRaw?: string;\n  applied: boolean;\n}\n\nexport interface MemoryGovernanceRestoreManifest {\n  runId: string;\n  createdAt: string;\n  entries: MemoryGovernanceRestoreEntry[];\n}\n\nexport interface MemoryGovernanceSummary {\n  schemaVersion: 1;\n  runId: string;\n  traceId: string;\n  mode: MemoryGovernanceMode;\n  createdAt: string;\n  scannedMemories: number;\n  reviewQueueCount: number;\n  proposedActionCount: number;\n  appliedActionCount: number;\n  ruleVersion: string;\n}\n\nexport interface MemoryGovernanceMetrics {\n  reviewReasons: Record<MemoryGovernanceReasonCode, number>;\n  proposedStatuses: Record<string, number>;\n  keptMemoryCount: number;\n  qualityScore: MemoryGovernanceQualityScore;\n}\n\nexport interface MemoryGovernanceQualityScore {\n  score: number;\n  maxScore: 100;\n  grade: \"excellent\" | \"good\" | \"fair\" | \"poor\";\n  deductions: Array<{\n    reasonCode: MemoryGovernanceReasonCode;\n    count: number;\n    pointsLost: number;\n  }>;\n}\n\nexport interface MemoryGovernanceTransitionReport {\n  proposed: Record<string, MemoryGovernanceAppliedAction[]>;\n  applied: Record<string, MemoryGovernanceAppliedAction[]>;\n}\n\nexport interface MemoryGovernanceManifest {\n  schemaVersion: 1;\n  runId: string;\n  traceId: string;\n  mode: MemoryGovernanceMode;\n  createdAt: string;\n  ruleVersion: string;\n  artifacts: Record<string, string>;\n}\n\nexport interface MemoryGovernanceRunResult {\n  runId: string;\n  traceId: string;\n  mode: MemoryGovernanceMode;\n  summary: MemoryGovernanceSummary;\n  summaryPath: string;\n  reviewQueuePath: string;\n  qualityScorePath: string;\n  transitionReportPath: string;\n  reportPath: string;\n  keptMemoriesPath: string;\n  appliedActionsPath: string;\n  metricsPath: string;\n  manifestPath: string;\n  restorePath?: string;\n  reviewQueue: MemoryGovernanceReviewQueueEntry[];\n  proposedActions: MemoryGovernanceAppliedAction[];\n  appliedActions: MemoryGovernanceAppliedAction[];\n}\n\nexport interface RestoreMemoryGovernanceRunResult {\n  runId: string;\n  restoredActions: number;\n  restorePath: string;\n}\n\nexport interface RunMemoryGovernanceOptions {\n  memoryDir: string;\n  mode: MemoryGovernanceMode;\n  now?: Date;\n  maxMemories?: number;\n  batchSize?: number;\n  recentDays?: number;\n}\n\nexport interface RestoreMemoryGovernanceRunOptions {\n  memoryDir: string;\n  runId: string;\n  now?: Date;\n}\n\nexport const RULE_VERSION = \"memory-governance.v2\";\nconst SEMANTIC_DUPLICATE_MIN_TOKENS = 6;\nconst SEMANTIC_DUPLICATE_MIN_JACCARD = 0.66;\nconst QUALITY_SCORE_WEIGHTS: Record<MemoryGovernanceReasonCode, number> = {\n  exact_duplicate: 6,\n  semantic_duplicate_candidate: 4,\n  disputed_memory: 15,\n  speculative_low_confidence: 8,\n  archive_candidate: 2,\n  explicit_capture_review: 5,\n  malformed_import: 12,\n};\n\nfunction governanceRunsDir(memoryDir: string): string {\n  return path.join(memoryDir, \"state\", \"memory-governance\", \"runs\");\n}\n\nfunction governanceRunDir(memoryDir: string, runId: string): string {\n  return path.join(governanceRunsDir(memoryDir), runId);\n}\n\nfunction governanceRestorePath(memoryDir: string, runId: string): string {\n  return path.join(governanceRunDir(memoryDir, runId), \"restore.json\");\n}\n\nfunction buildRunId(now: Date): string {\n  return `gov-${now.toISOString().replace(/[:.]/g, \"-\")}`;\n}\n\nfunction plannedArchivePath(memoryDir: string, originalPath: string, now: Date): string {\n  return path.join(\n    memoryDir,\n    \"archive\",\n    now.toISOString().slice(0, 10),\n    path.basename(originalPath),\n  );\n}\n\nfunction normalizeContent(content: string): string {\n  return content.trim().replace(/\\s+/g, \" \").toLowerCase();\n}\n\nfunction statusOf(memory: MemoryFile): MemoryStatus {\n  return memory.frontmatter.status ?? \"active\";\n}\n\nfunction parseIsoMs(value?: string): number | null {\n  if (!value) return null;\n  const ms = Date.parse(value);\n  return Number.isFinite(ms) ? ms : null;\n}\n\nfunction daysSince(value: string | undefined, now: Date): number {\n  const ts = parseIsoMs(value);\n  if (ts === null) return 365;\n  return Math.max(0, (now.getTime() - ts) / 86_400_000);\n}\n\nfunction compareCanonicalPreference(left: MemoryFile, right: MemoryFile): number {\n  if (left.frontmatter.confidence !== right.frontmatter.confidence) {\n    return (right.frontmatter.confidence ?? 0) - (left.frontmatter.confidence ?? 0);\n  }\n  return left.frontmatter.created.localeCompare(right.frontmatter.created);\n}\n\nfunction proposedStatusPriority(status: MemoryStatus): number {\n  switch (status) {\n    case \"quarantined\":\n      return 4;\n    case \"rejected\":\n      return 3;\n    case \"archived\":\n      return 2;\n    case \"pending_review\":\n      return 1;\n    default:\n      return 0;\n  }\n}\n\nfunction proposedActionPriority(action: MemoryGovernanceAppliedAction): number {\n  if (action.action === \"archive\") {\n    return proposedStatusPriority(\"archived\");\n  }\n  return proposedStatusPriority(action.afterStatus ?? \"active\");\n}\n\nfunction tokenizeSemanticContent(content: string): string[] {\n  return Array.from(\n    new Set(\n      normalizeContent(content)\n        .replaceAll(/[^\\p{L}\\p{N}]+/gu, \" \")\n        .split(\" \")\n        .filter((token) => token.length >= 4),\n    ),\n  );\n}\n\nfunction jaccardSimilarity(left: string[], right: string[]): number {\n  if (left.length === 0 || right.length === 0) return 0;\n  const leftSet = new Set(left);\n  const rightSet = new Set(right);\n  let intersection = 0;\n  for (const token of leftSet) {\n    if (rightSet.has(token)) intersection += 1;\n  }\n  const union = new Set([...leftSet, ...rightSet]).size;\n  return union > 0 ? intersection / union : 0;\n}\n\nfunction sameSemanticDuplicateScope(left: MemoryFile, right: MemoryFile): boolean {\n  if (left.frontmatter.category !== right.frontmatter.category) return false;\n  const leftEntityRef = left.frontmatter.entityRef?.trim();\n  const rightEntityRef = right.frontmatter.entityRef?.trim();\n  if (leftEntityRef && rightEntityRef && leftEntityRef !== rightEntityRef) return false;\n  return true;\n}\n\nfunction buildSemanticDuplicateEntries(activeMemories: MemoryFile[]): MemoryGovernanceReviewQueueEntry[] {\n  const reviewQueue: MemoryGovernanceReviewQueueEntry[] = [];\n  const ordered = [...activeMemories].sort(compareCanonicalPreference);\n  const tokensByMemoryId = new Map(\n    ordered.map((memory) => [memory.frontmatter.id, tokenizeSemanticContent(memory.content)] as const),\n  );\n  const claimed = new Set<string>();\n\n  for (let candidateIndex = 1; candidateIndex < ordered.length; candidateIndex += 1) {\n    const candidate = ordered[candidateIndex];\n    if (claimed.has(candidate.frontmatter.id)) continue;\n    const candidateTokens = tokensByMemoryId.get(candidate.frontmatter.id) ?? [];\n    if (candidateTokens.length < SEMANTIC_DUPLICATE_MIN_TOKENS) continue;\n    const candidateNormalized = normalizeContent(candidate.content);\n\n    for (let canonicalIndex = 0; canonicalIndex < candidateIndex; canonicalIndex += 1) {\n      const canonical = ordered[canonicalIndex];\n      if (!sameSemanticDuplicateScope(canonical, candidate)) continue;\n      const canonicalNormalized = normalizeContent(canonical.content);\n      if (canonicalNormalized === candidateNormalized) continue;\n      const canonicalTokens = tokensByMemoryId.get(canonical.frontmatter.id) ?? [];\n      if (canonicalTokens.length < SEMANTIC_DUPLICATE_MIN_TOKENS) continue;\n\n      const shorter = Math.min(candidateTokens.length, canonicalTokens.length);\n      const longer = Math.max(candidateTokens.length, canonicalTokens.length);\n      if (shorter / longer < 0.6) continue;\n      if (jaccardSimilarity(candidateTokens, canonicalTokens) < SEMANTIC_DUPLICATE_MIN_JACCARD) continue;\n\n      reviewQueue.push({\n        entryId: `review:${candidate.frontmatter.id}:semantic_duplicate_candidate`,\n        memoryId: candidate.frontmatter.id,\n        path: candidate.path,\n        reasonCode: \"semantic_duplicate_candidate\",\n        severity: \"medium\",\n        suggestedAction: \"set_status\",\n        suggestedStatus: \"pending_review\",\n        relatedMemoryIds: [canonical.frontmatter.id],\n      });\n      claimed.add(candidate.frontmatter.id);\n      break;\n    }\n  }\n\n  return reviewQueue;\n}\n\nfunction buildExplicitCaptureReviewEntries(\n  memories: MemoryFile[],\n  lifecycleEvents: Array<{\n    memoryId: string;\n    eventType: string;\n    reasonCode?: string;\n  }>,\n): MemoryGovernanceReviewQueueEntry[] {\n  const explicitQueuedIds = new Set(\n    lifecycleEvents\n      .filter((event) => event.eventType === \"explicit_capture_queued\")\n      .map((event) => event.memoryId),\n  );\n\n  return memories\n    .filter((memory) => {\n      if (statusOf(memory) !== \"pending_review\") return false;\n      const tags = memory.frontmatter.tags ?? [];\n      if (tags.includes(\"queued-review\")) return true;\n      if (explicitQueuedIds.has(memory.frontmatter.id)) return true;\n      return memory.frontmatter.source === \"explicit-review\" || memory.frontmatter.source === \"explicit-inline-review\";\n    })\n    .map((memory) => ({\n      entryId: `review:${memory.frontmatter.id}:explicit_capture_review`,\n      memoryId: memory.frontmatter.id,\n      path: memory.path,\n      reasonCode: \"explicit_capture_review\" as const,\n      severity: \"medium\" as const,\n      suggestedAction: \"set_status\" as const,\n      suggestedStatus: \"pending_review\" as const,\n      relatedMemoryIds: [],\n    }));\n}\n\n/**\n * List every `*.md` under `root`, refusing to follow symlinked directories or\n * entries that resolve outside `containmentRoot` (a realpath-resolved memory\n * store root). Mirrors the containment guard in consolidation-provenance's\n * walkMarkdownFiles / the CLI walker, reusing the shared assertPathInsideRoot\n * (rule 22). Without this, a symlinked category dir (e.g. decisions/ → outside\n * memoryDir) would be walked and its files surfaced by the malformed-import\n * governance sweep — an out-of-store info leak.\n */\nasync function listMarkdownFiles(root: string, containmentRoot: string): Promise<string[]> {\n  const files: string[] = [];\n  const walk = async (dir: string) => {\n    try {\n      const dirStat = await lstat(dir);\n      if (dirStat.isSymbolicLink() || !dirStat.isDirectory()) return;\n      assertPathInsideRoot(containmentRoot, await realpath(dir), dir);\n      const entries = await readdir(dir, { withFileTypes: true });\n      for (const entry of entries) {\n        if (entry.isSymbolicLink()) continue; // never follow symlinked entries\n        const fullPath = path.join(dir, entry.name);\n        if (entry.isDirectory()) {\n          await walk(fullPath);\n          continue;\n        }\n        if (entry.isFile() && entry.name.endsWith(\".md\")) {\n          try {\n            assertPathInsideRoot(containmentRoot, await realpath(fullPath), fullPath);\n          } catch {\n            continue; // poisoned entry escaping the root — skip it.\n          }\n          files.push(fullPath);\n        }\n      }\n    } catch {\n      // Absent dir (ENOENT), symlinked/out-of-root dir, or containment\n      // violation — skip this subtree without aborting the sweep.\n    }\n  };\n\n  await walk(root);\n  return files;\n}\n\nfunction malformedMemoryId(memoryDir: string, filePath: string): string {\n  return `malformed:${path.relative(memoryDir, filePath).replaceAll(path.sep, \"/\")}`;\n}\n\nasync function buildMalformedImportEntries(\n  memoryDir: string,\n  storage: StorageManager,\n  parsedMemories: MemoryFile[],\n  candidateFiles?: string[],\n): Promise<MemoryGovernanceReviewQueueEntry[]> {\n  const parsedPaths = new Set(parsedMemories.map((memory) => memory.path));\n  // Inspect every recall category directory (RECALL_FALLBACK_DIRS — the single\n  // source of truth) so malformed files under newly-routed categories\n  // (decisions/, preferences/, ...) are surfaced too, not just facts/ (#1546).\n  // Resolve the containment root (realpath) once and thread it into the walker\n  // so a symlinked category dir can't escape memoryDir. If memoryDir itself\n  // can't be resolved, there is nothing valid to inspect.\n  let containmentRoot: string | null = null;\n  try {\n    containmentRoot = await realpath(memoryDir);\n  } catch {\n    containmentRoot = null;\n  }\n  const filesToInspect =\n    candidateFiles ??\n    (containmentRoot === null\n      ? []\n      : (\n          await Promise.all(\n            RECALL_FALLBACK_DIRS.map((dir) =>\n              listMarkdownFiles(path.join(memoryDir, dir), containmentRoot as string),\n            ),\n          )\n        ).flat());\n  const entries: MemoryGovernanceReviewQueueEntry[] = [];\n\n  for (const filePath of filesToInspect) {\n    if (parsedPaths.has(filePath)) continue;\n    const parsed = await storage.readMemoryByPath(filePath);\n    if (parsed) continue;\n    entries.push({\n      entryId: `review:${malformedMemoryId(memoryDir, filePath)}:malformed_import`,\n      memoryId: malformedMemoryId(memoryDir, filePath),\n      path: filePath,\n      reasonCode: \"malformed_import\",\n      severity: \"high\",\n      suggestedAction: \"set_status\",\n      suggestedStatus: \"quarantined\",\n      relatedMemoryIds: [],\n    });\n  }\n\n  return entries;\n}\n\nasync function buildReviewQueue(\n  memoryDir: string,\n  storage: StorageManager,\n  memories: MemoryFile[],\n  now: Date,\n  options: {\n    malformedCandidateFiles?: string[];\n  } = {},\n): Promise<MemoryGovernanceReviewQueueEntry[]> {\n  const reviewQueue: MemoryGovernanceReviewQueueEntry[] = [];\n  const activeMemories = memories.filter((memory) => statusOf(memory) === \"active\");\n  const duplicateBuckets = new Map<string, MemoryFile[]>();\n\n  for (const memory of activeMemories) {\n    const key = `${memory.frontmatter.category}:${normalizeContent(memory.content)}`;\n    const bucket = duplicateBuckets.get(key) ?? [];\n    bucket.push(memory);\n    duplicateBuckets.set(key, bucket);\n  }\n\n  for (const bucket of duplicateBuckets.values()) {\n    if (bucket.length < 2) continue;\n    const ordered = [...bucket].sort(compareCanonicalPreference);\n    const canonical = ordered[0];\n    for (const duplicate of ordered.slice(1)) {\n      reviewQueue.push({\n        entryId: `review:${duplicate.frontmatter.id}:exact_duplicate`,\n        memoryId: duplicate.frontmatter.id,\n        path: duplicate.path,\n        reasonCode: \"exact_duplicate\",\n        severity: \"medium\",\n        suggestedAction: \"set_status\",\n        suggestedStatus: \"pending_review\",\n        relatedMemoryIds: canonical ? [canonical.frontmatter.id] : [],\n      });\n    }\n  }\n\n  reviewQueue.push(...buildSemanticDuplicateEntries(activeMemories));\n\n  for (const memory of activeMemories) {\n    if (memory.frontmatter.verificationState === \"disputed\") {\n      reviewQueue.push({\n        entryId: `review:${memory.frontmatter.id}:disputed_memory`,\n        memoryId: memory.frontmatter.id,\n        path: memory.path,\n        reasonCode: \"disputed_memory\",\n        severity: \"high\",\n        suggestedAction: \"set_status\",\n        suggestedStatus: \"quarantined\",\n        relatedMemoryIds: [],\n      });\n    }\n\n    if (\n      memory.frontmatter.confidenceTier === \"speculative\"\n      && (memory.frontmatter.confidence ?? 0) <= 0.25\n    ) {\n      reviewQueue.push({\n        entryId: `review:${memory.frontmatter.id}:speculative_low_confidence`,\n        memoryId: memory.frontmatter.id,\n        path: memory.path,\n        reasonCode: \"speculative_low_confidence\",\n        severity: \"medium\",\n        suggestedAction: \"set_status\",\n        suggestedStatus: \"pending_review\",\n        relatedMemoryIds: [],\n      });\n    }\n\n    const lifecycle = decideLifecycleTransition(memory, {}, now);\n    const staleForArchive = memory.frontmatter.lifecycleState === \"stale\"\n      && daysSince(memory.frontmatter.updated ?? memory.frontmatter.created, now) >= 180;\n    if ((lifecycle.nextState === \"archived\" && lifecycle.changed) || staleForArchive) {\n      reviewQueue.push({\n        entryId: `review:${memory.frontmatter.id}:archive_candidate`,\n        memoryId: memory.frontmatter.id,\n        path: memory.path,\n        reasonCode: \"archive_candidate\",\n        severity: \"low\",\n        suggestedAction: \"archive\",\n        relatedMemoryIds: [],\n      });\n    }\n  }\n\n  const lifecycleEvents = await storage.readMemoryLifecycleEvents(Number.MAX_SAFE_INTEGER);\n  reviewQueue.push(...buildExplicitCaptureReviewEntries(memories, lifecycleEvents));\n  reviewQueue.push(...await buildMalformedImportEntries(\n    memoryDir,\n    storage,\n    memories,\n    options.malformedCandidateFiles,\n  ));\n\n  return reviewQueue;\n}\n\nexport function buildProposedActions(\n  reviewQueue: MemoryGovernanceReviewQueueEntry[],\n  memories: MemoryFile[],\n): MemoryGovernanceAppliedAction[] {\n  const byMemory = new Map(memories.map((memory) => [memory.frontmatter.id, memory]));\n  const selected = new Map<string, MemoryGovernanceAppliedAction>();\n\n  for (const entry of reviewQueue) {\n    const memory = byMemory.get(entry.memoryId);\n    if (!memory) continue;\n    const currentStatus = statusOf(memory);\n    if (\n      entry.suggestedAction === \"set_status\"\n      && entry.suggestedStatus\n      && entry.suggestedStatus === currentStatus\n    ) {\n      continue;\n    }\n    const candidate: MemoryGovernanceAppliedAction = {\n      action: entry.suggestedAction,\n      memoryId: entry.memoryId,\n      reasonCode: entry.reasonCode,\n      beforeStatus: currentStatus,\n      afterStatus: entry.suggestedStatus,\n      originalPath: memory.path,\n      currentPath: memory.path,\n    };\n\n    const existing = selected.get(entry.memoryId);\n    if (!existing) {\n      selected.set(entry.memoryId, candidate);\n      continue;\n    }\n\n    const existingPriority = proposedActionPriority(existing);\n    const candidatePriority = proposedActionPriority(candidate);\n    if (candidatePriority > existingPriority) {\n      selected.set(entry.memoryId, candidate);\n    }\n  }\n\n  return [...selected.values()];\n}\n\nfunction buildMetrics(\n  reviewQueue: MemoryGovernanceReviewQueueEntry[],\n  proposedActions: MemoryGovernanceAppliedAction[],\n  scannedMemories: number,\n): MemoryGovernanceMetrics {\n  const reviewReasons: MemoryGovernanceMetrics[\"reviewReasons\"] = {\n    exact_duplicate: 0,\n    semantic_duplicate_candidate: 0,\n    disputed_memory: 0,\n    speculative_low_confidence: 0,\n    archive_candidate: 0,\n    explicit_capture_review: 0,\n    malformed_import: 0,\n  };\n  const proposedStatuses: Record<string, number> = {};\n\n  for (const entry of reviewQueue) {\n    reviewReasons[entry.reasonCode] += 1;\n  }\n\n  for (const action of proposedActions) {\n    const effectiveStatus = action.afterStatus ?? (action.action === \"archive\" ? \"archived\" : undefined);\n    if (!effectiveStatus) continue;\n    proposedStatuses[effectiveStatus] = (proposedStatuses[effectiveStatus] ?? 0) + 1;\n  }\n\n  return {\n    reviewReasons,\n    proposedStatuses,\n    keptMemoryCount: Math.max(0, scannedMemories - proposedActions.length),\n    qualityScore: buildQualityScore(reviewReasons),\n  };\n}\n\nexport function buildQualityScore(\n  reviewReasons: Record<MemoryGovernanceReasonCode, number>,\n): MemoryGovernanceQualityScore {\n  const deductions = Object.entries(reviewReasons)\n    .map(([reasonCode, count]) => ({\n      reasonCode: reasonCode as MemoryGovernanceReasonCode,\n      count,\n      pointsLost: count * QUALITY_SCORE_WEIGHTS[reasonCode as MemoryGovernanceReasonCode],\n    }))\n    .filter((entry) => entry.count > 0)\n    .sort((left, right) => right.pointsLost - left.pointsLost);\n  const totalPointsLost = deductions.reduce((sum, entry) => sum + entry.pointsLost, 0);\n  const score = Math.max(0, 100 - totalPointsLost);\n  const grade = score >= 90 ? \"excellent\"\n    : score >= 75 ? \"good\"\n      : score >= 50 ? \"fair\"\n        : \"poor\";\n  return {\n    score,\n    maxScore: 100,\n    grade,\n    deductions,\n  };\n}\n\nexport function groupActionsByStatus(\n  actions: MemoryGovernanceAppliedAction[],\n): Record<string, MemoryGovernanceAppliedAction[]> {\n  const grouped: Record<string, MemoryGovernanceAppliedAction[]> = {};\n  for (const action of actions) {\n    const status = action.afterStatus ?? (action.action === \"archive\" ? \"archived\" : \"unchanged\");\n    const bucket = grouped[status] ?? [];\n    bucket.push(action);\n    grouped[status] = bucket;\n  }\n  return grouped;\n}\n\nasync function safeRead(filePath: string): Promise<string | null> {\n  try {\n    return await readFile(filePath, \"utf-8\");\n  } catch {\n    return null;\n  }\n}\n\nasync function persistRestoreManifest(\n  memoryDir: string,\n  manifest: MemoryGovernanceRestoreManifest,\n): Promise<string> {\n  const restorePath = governanceRestorePath(memoryDir, manifest.runId);\n  await mkdir(path.dirname(restorePath), { recursive: true });\n  await writeFile(restorePath, JSON.stringify(manifest, null, 2), \"utf-8\");\n  return restorePath;\n}\n\nasync function writeGovernanceArtifacts(options: {\n  memoryDir: string;\n  runId: string;\n  traceId: string;\n  summary: MemoryGovernanceSummary;\n  metrics: MemoryGovernanceMetrics;\n  qualityScore: MemoryGovernanceQualityScore;\n  transitionReport: MemoryGovernanceTransitionReport;\n  keptMemoryIds: string[];\n  reviewQueue: MemoryGovernanceReviewQueueEntry[];\n  proposedActions: MemoryGovernanceAppliedAction[];\n  appliedActions: MemoryGovernanceAppliedAction[];\n  restoreManifest?: MemoryGovernanceRestoreManifest;\n}): Promise<\n  Pick<\n    MemoryGovernanceRunResult,\n    | \"summaryPath\"\n    | \"reviewQueuePath\"\n    | \"qualityScorePath\"\n    | \"transitionReportPath\"\n    | \"reportPath\"\n    | \"keptMemoriesPath\"\n    | \"appliedActionsPath\"\n    | \"metricsPath\"\n    | \"manifestPath\"\n    | \"restorePath\"\n  >\n> {\n  const runDir = governanceRunDir(options.memoryDir, options.runId);\n  await mkdir(runDir, { recursive: true });\n\n  const summaryPath = path.join(runDir, \"summary.json\");\n  const reviewQueuePath = path.join(runDir, \"review-queue.json\");\n  const qualityScorePath = path.join(runDir, \"quality-score.json\");\n  const transitionReportPath = path.join(runDir, \"status-transitions.json\");\n  const reportPath = path.join(runDir, \"report.md\");\n  const keptMemoriesPath = path.join(runDir, \"kept-memories.json\");\n  const appliedActionsPath = path.join(runDir, \"applied-actions.json\");\n  const metricsPath = path.join(runDir, \"metrics.json\");\n  const manifestPath = path.join(runDir, \"manifest.json\");\n  const restorePath = options.restoreManifest ? governanceRestorePath(options.memoryDir, options.runId) : undefined;\n\n  await writeFile(summaryPath, JSON.stringify(options.summary, null, 2), \"utf-8\");\n  await writeFile(reviewQueuePath, JSON.stringify(options.reviewQueue, null, 2), \"utf-8\");\n  await writeFile(qualityScorePath, JSON.stringify(options.qualityScore, null, 2), \"utf-8\");\n  await writeFile(transitionReportPath, JSON.stringify(options.transitionReport, null, 2), \"utf-8\");\n  await writeFile(keptMemoriesPath, JSON.stringify(options.keptMemoryIds, null, 2), \"utf-8\");\n  await writeFile(appliedActionsPath, JSON.stringify(options.appliedActions, null, 2), \"utf-8\");\n  await writeFile(metricsPath, JSON.stringify(options.metrics, null, 2), \"utf-8\");\n  await writeFile(\n    reportPath,\n    [\n      `# Memory Governance Run ${options.runId}`,\n      \"\",\n      `- Trace ID: ${options.traceId}`,\n      `- Mode: ${options.summary.mode}`,\n      `- Scanned memories: ${options.summary.scannedMemories}`,\n      `- Kept memories: ${options.metrics.keptMemoryCount}`,\n      `- Review queue entries: ${options.summary.reviewQueueCount}`,\n      `- Proposed actions: ${options.summary.proposedActionCount}`,\n      `- Applied actions: ${options.summary.appliedActionCount}`,\n      `- Quality score: ${options.qualityScore.score}/${options.qualityScore.maxScore} (${options.qualityScore.grade})`,\n      \"\",\n      \"## Metrics\",\n      ...Object.entries(options.metrics.reviewReasons).map(([reason, count]) => `- ${reason}: ${count}`),\n      ...(Object.entries(options.metrics.proposedStatuses).length > 0\n        ? Object.entries(options.metrics.proposedStatuses).map(([status, count]) => `- proposed ${status}: ${count}`)\n        : [\"- proposed statuses: (none)\"]),\n      \"\",\n      \"## Quality Score\",\n      ...(options.qualityScore.deductions.length > 0\n        ? options.qualityScore.deductions.map((entry) => `- ${entry.reasonCode}: ${entry.count} -> -${entry.pointsLost}`)\n        : [\"- no deductions\"]),\n      \"\",\n      \"## Proposed Actions\",\n      ...(options.proposedActions.length > 0\n        ? options.proposedActions.map((action) =>\n            `- ${action.memoryId}: ${action.action}${action.afterStatus ? ` -> ${action.afterStatus}` : \"\"} [${action.reasonCode}]`,\n          )\n        : [\"- (empty)\"]),\n      \"\",\n      \"## Applied Actions\",\n      ...(options.appliedActions.length > 0\n        ? options.appliedActions.map((action) =>\n            `- ${action.memoryId}: ${action.action}${action.afterStatus ? ` -> ${action.afterStatus}` : \"\"} [${action.reasonCode}]`,\n          )\n        : [\"- (empty)\"]),\n      \"\",\n      \"## Review Queue\",\n      ...(options.reviewQueue.length > 0\n        ? options.reviewQueue.map((entry) =>\n            `- ${entry.memoryId}: ${entry.reasonCode} -> ${entry.suggestedAction}${entry.suggestedStatus ? ` (${entry.suggestedStatus})` : \"\"}`,\n          )\n        : [\"- (empty)\"]),\n    ].join(\"\\n\"),\n    \"utf-8\",\n  );\n  const manifest: MemoryGovernanceManifest = {\n    schemaVersion: 1,\n    runId: options.runId,\n    traceId: options.traceId,\n    mode: options.summary.mode,\n    createdAt: options.summary.createdAt,\n    ruleVersion: options.summary.ruleVersion,\n    artifacts: {\n      summary: summaryPath,\n      reviewQueue: reviewQueuePath,\n      qualityScore: qualityScorePath,\n      transitionReport: transitionReportPath,\n      report: reportPath,\n      keptMemories: keptMemoriesPath,\n      appliedActions: appliedActionsPath,\n      metrics: metricsPath,\n      ...(restorePath ? { restore: restorePath } : {}),\n    },\n  };\n  await writeFile(manifestPath, JSON.stringify(manifest, null, 2), \"utf-8\");\n  if (restorePath && options.restoreManifest && await safeRead(restorePath) === null) {\n    await writeFile(restorePath, JSON.stringify(options.restoreManifest, null, 2), \"utf-8\");\n  }\n\n  return {\n    summaryPath,\n    reviewQueuePath,\n    qualityScorePath,\n    transitionReportPath,\n    reportPath,\n    keptMemoriesPath,\n    appliedActionsPath,\n    metricsPath,\n    manifestPath,\n    restorePath,\n  };\n}\n\nexport async function runMemoryGovernance(\n  options: RunMemoryGovernanceOptions,\n): Promise<MemoryGovernanceRunResult> {\n  const now = options.now ?? new Date();\n  const runId = buildRunId(now);\n  const traceId = runId;\n  const storage = new StorageManager(options.memoryDir);\n  const boundedScan =\n    options.maxMemories !== undefined ||\n    options.recentDays !== undefined ||\n    options.batchSize !== undefined;\n  const normalizedRecentDays = typeof options.recentDays === \"number\" && Number.isFinite(options.recentDays)\n    ? Math.max(1, Math.floor(options.recentDays))\n    : undefined;\n  const updatedAfter = normalizedRecentDays !== undefined\n    ? new Date(now.getTime() - normalizedRecentDays * 86_400_000)\n    : undefined;\n  const memoryWindow = boundedScan\n    ? await storage.readMemoriesWindow({\n        maxMemories: options.maxMemories,\n        batchSize: options.batchSize,\n        updatedAfter,\n      })\n    : undefined;\n  const memories = memoryWindow?.memories ?? await storage.readAllMemories();\n  const reviewQueue = await buildReviewQueue(options.memoryDir, storage, memories, now, {\n    malformedCandidateFiles: memoryWindow?.filePaths,\n  });\n  const proposedActions = buildProposedActions(reviewQueue, memories);\n  const reviewEntryByActionKey = new Map(\n    reviewQueue.map((entry) => [`${entry.memoryId}:${entry.reasonCode}`, entry] as const),\n  );\n  const metrics = buildMetrics(reviewQueue, proposedActions, memories.length);\n  const transitionReport: MemoryGovernanceTransitionReport = {\n    proposed: groupActionsByStatus(proposedActions),\n    applied: {},\n  };\n  const memoryPathById = new Map(memories.map((memory) => [memory.frontmatter.id, memory.path] as const));\n  const targetedMemoryIds = new Set(proposedActions.map((action) => action.memoryId));\n  const keptMemoryIds = memories\n    .map((memory) => memory.frontmatter.id)\n    .filter((memoryId) => !targetedMemoryIds.has(memoryId));\n  const appliedActions: MemoryGovernanceAppliedAction[] = [];\n  const restoreEntries: MemoryGovernanceRestoreEntry[] = [];\n  const restoreEntryByMemoryId = new Map<string, MemoryGovernanceRestoreEntry>();\n\n  if (options.mode === \"apply\") {\n    for (const action of proposedActions) {\n      const memoryPath = memoryPathById.get(action.memoryId) ?? null;\n      if (!memoryPath) continue;\n      const memory = await storage.readMemoryByPath(memoryPath);\n      if (!memory) continue;\n      if (memory.frontmatter.id !== action.memoryId) continue;\n      const beforeRaw = await safeRead(memory.path);\n      if (!beforeRaw) continue;\n      const entry: MemoryGovernanceRestoreEntry = {\n        action: action.action,\n        memoryId: action.memoryId,\n        reasonCode: action.reasonCode,\n        originalPath: memory.path,\n        currentPath: action.action === \"archive\"\n          ? plannedArchivePath(options.memoryDir, memory.path, now)\n          : memory.path,\n        beforeRaw,\n        applied: false,\n      };\n      restoreEntries.push(entry);\n      restoreEntryByMemoryId.set(action.memoryId, entry);\n    }\n\n    const restoreManifest: MemoryGovernanceRestoreManifest = {\n      runId,\n      createdAt: now.toISOString(),\n      entries: restoreEntries,\n    };\n    await persistRestoreManifest(options.memoryDir, restoreManifest);\n\n    for (const action of proposedActions) {\n      const memoryPath = memoryPathById.get(action.memoryId) ?? null;\n      if (!memoryPath) continue;\n      const memory = await storage.readMemoryByPath(memoryPath);\n      if (!memory) continue;\n      if (memory.frontmatter.id !== action.memoryId) continue;\n      const restoreEntry = restoreEntryByMemoryId.get(action.memoryId);\n      if (!restoreEntry) continue;\n\n      if (action.action === \"archive\") {\n        const reviewEntry = reviewEntryByActionKey.get(`${action.memoryId}:${action.reasonCode}`);\n        restoreEntry.applied = true;\n        await persistRestoreManifest(options.memoryDir, restoreManifest);\n        const archivedPath = await storage.archiveMemory(memory, {\n          at: now,\n          actor: \"memory-governance.apply\",\n          reasonCode: action.reasonCode,\n          ruleVersion: RULE_VERSION,\n          relatedMemoryIds: reviewEntry?.relatedMemoryIds ?? [],\n          correlationId: traceId,\n        });\n        if (!archivedPath) {\n          restoreEntry.applied = false;\n          await persistRestoreManifest(options.memoryDir, restoreManifest);\n          continue;\n        }\n        restoreEntry.currentPath = archivedPath;\n        restoreEntry.expectedCurrentRaw = await safeRead(archivedPath) ?? undefined;\n        await persistRestoreManifest(options.memoryDir, restoreManifest);\n        appliedActions.push({\n          ...action,\n          currentPath: archivedPath,\n          afterStatus: \"archived\",\n        });\n        continue;\n      }\n\n      if (!action.afterStatus || action.beforeStatus === action.afterStatus) continue;\n      const reviewEntry = reviewEntryByActionKey.get(`${action.memoryId}:${action.reasonCode}`);\n      restoreEntry.applied = true;\n      await persistRestoreManifest(options.memoryDir, restoreManifest);\n      const updated = await storage.writeMemoryFrontmatter(memory, {\n        status: action.afterStatus,\n        updated: now.toISOString(),\n      }, {\n        actor: \"memory-governance.apply\",\n        reasonCode: action.reasonCode,\n        ruleVersion: RULE_VERSION,\n        relatedMemoryIds: reviewEntry?.relatedMemoryIds ?? [],\n        correlationId: traceId,\n      });\n      if (!updated) {\n        restoreEntry.applied = false;\n        await persistRestoreManifest(options.memoryDir, restoreManifest);\n        continue;\n      }\n      restoreEntry.expectedCurrentRaw = await safeRead(memory.path) ?? undefined;\n      await persistRestoreManifest(options.memoryDir, restoreManifest);\n      appliedActions.push({\n        ...action,\n        currentPath: memory.path,\n      });\n    }\n  }\n\n  const summary: MemoryGovernanceSummary = {\n    schemaVersion: 1,\n    runId,\n    traceId,\n    mode: options.mode,\n    createdAt: now.toISOString(),\n    scannedMemories: memories.length,\n    reviewQueueCount: reviewQueue.length,\n    proposedActionCount: proposedActions.length,\n    appliedActionCount: appliedActions.length,\n    ruleVersion: RULE_VERSION,\n  };\n  const restoreManifest = options.mode === \"apply\"\n    ? {\n        runId,\n        createdAt: now.toISOString(),\n        entries: restoreEntries,\n      }\n    : undefined;\n  transitionReport.applied = groupActionsByStatus(appliedActions);\n  const paths = await writeGovernanceArtifacts({\n    memoryDir: options.memoryDir,\n    runId,\n    traceId,\n    summary,\n    metrics,\n    qualityScore: metrics.qualityScore,\n    transitionReport,\n    keptMemoryIds,\n    reviewQueue,\n    proposedActions,\n    appliedActions,\n    restoreManifest,\n  });\n\n  return {\n    runId,\n    traceId,\n    mode: options.mode,\n    summary,\n    ...paths,\n    reviewQueue,\n    proposedActions,\n    appliedActions,\n  };\n}\n\nexport async function restoreMemoryGovernanceRun(\n  options: RestoreMemoryGovernanceRunOptions,\n): Promise<RestoreMemoryGovernanceRunResult> {\n  void options.now;\n  const restorePath = governanceRestorePath(options.memoryDir, options.runId);\n  const raw = JSON.parse(await readFile(restorePath, \"utf-8\")) as MemoryGovernanceRestoreManifest;\n  let restoredActions = 0;\n\n  for (const entry of [...raw.entries].reverse()) {\n    if (!entry.applied) {\n      continue;\n    }\n    const currentRaw = await safeRead(entry.currentPath);\n    if (entry.expectedCurrentRaw && currentRaw !== entry.expectedCurrentRaw) {\n      throw new Error(`restore conflict for ${entry.memoryId}: current contents diverged from governance run`);\n    }\n    if (entry.action === \"archive\") {\n      await rm(entry.currentPath, { force: true });\n    }\n    await mkdir(path.dirname(entry.originalPath), { recursive: true });\n    await writeFile(entry.originalPath, entry.beforeRaw, \"utf-8\");\n    restoredActions += 1;\n  }\n\n  return {\n    runId: raw.runId,\n    restoredActions,\n    restorePath,\n  };\n}\n\nexport async function listMemoryGovernanceRuns(memoryDir: string): Promise<string[]> {\n  try {\n    return (await readdir(governanceRunsDir(memoryDir))).sort().reverse();\n  } catch {\n    return [];\n  }\n}\n\nexport async function readMemoryGovernanceRunArtifact(\n  memoryDir: string,\n  runId: string,\n): Promise<{\n  summary: MemoryGovernanceSummary;\n  metrics: MemoryGovernanceMetrics;\n  qualityScore: MemoryGovernanceQualityScore;\n  keptMemoryIds: string[];\n  reviewQueue: MemoryGovernanceReviewQueueEntry[];\n  appliedActions: MemoryGovernanceAppliedAction[];\n  transitionReport: MemoryGovernanceTransitionReport;\n  report: string;\n  manifest: MemoryGovernanceManifest;\n  restore?: MemoryGovernanceRestoreManifest;\n}> {\n  const runDir = governanceRunDir(memoryDir, runId);\n  const summary = JSON.parse(await readFile(path.join(runDir, \"summary.json\"), \"utf-8\")) as MemoryGovernanceSummary;\n  const metrics = JSON.parse(await readFile(path.join(runDir, \"metrics.json\"), \"utf-8\")) as MemoryGovernanceMetrics;\n  metrics.qualityScore ??= buildQualityScore(metrics.reviewReasons);\n  const keptMemoryIds = JSON.parse(await readFile(path.join(runDir, \"kept-memories.json\"), \"utf-8\")) as string[];\n  const reviewQueue = JSON.parse(\n    await readFile(path.join(runDir, \"review-queue.json\"), \"utf-8\"),\n  ) as MemoryGovernanceReviewQueueEntry[];\n  const appliedActions = JSON.parse(\n    await readFile(path.join(runDir, \"applied-actions.json\"), \"utf-8\"),\n  ) as MemoryGovernanceAppliedAction[];\n  const qualityScoreRaw = await safeRead(path.join(runDir, \"quality-score.json\"));\n  const transitionReportRaw = await safeRead(path.join(runDir, \"status-transitions.json\"));\n  const manifest = JSON.parse(\n    await readFile(path.join(runDir, \"manifest.json\"), \"utf-8\"),\n  ) as MemoryGovernanceManifest;\n  const report = await readFile(path.join(runDir, \"report.md\"), \"utf-8\");\n  const restoreRaw = await safeRead(path.join(runDir, \"restore.json\"));\n  const qualityScore = qualityScoreRaw\n    ? JSON.parse(qualityScoreRaw) as MemoryGovernanceQualityScore\n    : metrics.qualityScore ?? buildQualityScore(metrics.reviewReasons);\n  const transitionReport = transitionReportRaw\n    ? JSON.parse(transitionReportRaw) as MemoryGovernanceTransitionReport\n    : {\n        proposed: {},\n        applied: groupActionsByStatus(appliedActions),\n      };\n  return {\n    summary,\n    metrics,\n    qualityScore,\n    keptMemoryIds,\n    reviewQueue,\n    appliedActions,\n    transitionReport,\n    report,\n    manifest,\n    restore: restoreRaw ? JSON.parse(restoreRaw) as MemoryGovernanceRestoreManifest : undefined,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,OAAO,UAAU,SAAS,UAAU,IAAI,iBAAiB;AA8IlE,IAAM,eAAe;AAC5B,IAAM,gCAAgC;AACtC,IAAM,iCAAiC;AACvC,IAAM,wBAAoE;AAAA,EACxE,iBAAiB;AAAA,EACjB,8BAA8B;AAAA,EAC9B,iBAAiB;AAAA,EACjB,4BAA4B;AAAA,EAC5B,mBAAmB;AAAA,EACnB,yBAAyB;AAAA,EACzB,kBAAkB;AACpB;AAEA,SAAS,kBAAkB,WAA2B;AACpD,SAAO,KAAK,KAAK,WAAW,SAAS,qBAAqB,MAAM;AAClE;AAEA,SAAS,iBAAiB,WAAmB,OAAuB;AAClE,SAAO,KAAK,KAAK,kBAAkB,SAAS,GAAG,KAAK;AACtD;AAEA,SAAS,sBAAsB,WAAmB,OAAuB;AACvE,SAAO,KAAK,KAAK,iBAAiB,WAAW,KAAK,GAAG,cAAc;AACrE;AAEA,SAAS,WAAW,KAAmB;AACrC,SAAO,OAAO,IAAI,YAAY,EAAE,QAAQ,SAAS,GAAG,CAAC;AACvD;AAEA,SAAS,mBAAmB,WAAmB,cAAsB,KAAmB;AACtF,SAAO,KAAK;AAAA,IACV;AAAA,IACA;AAAA,IACA,IAAI,YAAY,EAAE,MAAM,GAAG,EAAE;AAAA,IAC7B,KAAK,SAAS,YAAY;AAAA,EAC5B;AACF;AAEA,SAAS,iBAAiB,SAAyB;AACjD,SAAO,QAAQ,KAAK,EAAE,QAAQ,QAAQ,GAAG,EAAE,YAAY;AACzD;AAEA,SAAS,SAAS,QAAkC;AAClD,SAAO,OAAO,YAAY,UAAU;AACtC;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KAAK,KAAK,MAAM,KAAK;AAC3B,SAAO,OAAO,SAAS,EAAE,IAAI,KAAK;AACpC;AAEA,SAAS,UAAU,OAA2B,KAAmB;AAC/D,QAAM,KAAK,WAAW,KAAK;AAC3B,MAAI,OAAO,KAAM,QAAO;AACxB,SAAO,KAAK,IAAI,IAAI,IAAI,QAAQ,IAAI,MAAM,KAAU;AACtD;AAEA,SAAS,2BAA2B,MAAkB,OAA2B;AAC/E,MAAI,KAAK,YAAY,eAAe,MAAM,YAAY,YAAY;AAChE,YAAQ,MAAM,YAAY,cAAc,MAAM,KAAK,YAAY,cAAc;AAAA,EAC/E;AACA,SAAO,KAAK,YAAY,QAAQ,cAAc,MAAM,YAAY,OAAO;AACzE;AAEA,SAAS,uBAAuB,QAA8B;AAC5D,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,uBAAuB,QAA+C;AAC7E,MAAI,OAAO,WAAW,WAAW;AAC/B,WAAO,uBAAuB,UAAU;AAAA,EAC1C;AACA,SAAO,uBAAuB,OAAO,eAAe,QAAQ;AAC9D;AAEA,SAAS,wBAAwB,SAA2B;AAC1D,SAAO,MAAM;AAAA,IACX,IAAI;AAAA,MACF,iBAAiB,OAAO,EACrB,WAAW,oBAAoB,GAAG,EAClC,MAAM,GAAG,EACT,OAAO,CAAC,UAAU,MAAM,UAAU,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,MAAgB,OAAyB;AAClE,MAAI,KAAK,WAAW,KAAK,MAAM,WAAW,EAAG,QAAO;AACpD,QAAM,UAAU,IAAI,IAAI,IAAI;AAC5B,QAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,MAAI,eAAe;AACnB,aAAW,SAAS,SAAS;AAC3B,QAAI,SAAS,IAAI,KAAK,EAAG,iBAAgB;AAAA,EAC3C;AACA,QAAM,SAAQ,oBAAI,IAAI,CAAC,GAAG,SAAS,GAAG,QAAQ,CAAC,GAAE;AACjD,SAAO,QAAQ,IAAI,eAAe,QAAQ;AAC5C;AAEA,SAAS,2BAA2B,MAAkB,OAA4B;AAChF,MAAI,KAAK,YAAY,aAAa,MAAM,YAAY,SAAU,QAAO;AACrE,QAAM,gBAAgB,KAAK,YAAY,WAAW,KAAK;AACvD,QAAM,iBAAiB,MAAM,YAAY,WAAW,KAAK;AACzD,MAAI,iBAAiB,kBAAkB,kBAAkB,eAAgB,QAAO;AAChF,SAAO;AACT;AAEA,SAAS,8BAA8B,gBAAkE;AACvG,QAAM,cAAkD,CAAC;AACzD,QAAM,UAAU,CAAC,GAAG,cAAc,EAAE,KAAK,0BAA0B;AACnE,QAAM,mBAAmB,IAAI;AAAA,IAC3B,QAAQ,IAAI,CAAC,WAAW,CAAC,OAAO,YAAY,IAAI,wBAAwB,OAAO,OAAO,CAAC,CAAU;AAAA,EACnG;AACA,QAAM,UAAU,oBAAI,IAAY;AAEhC,WAAS,iBAAiB,GAAG,iBAAiB,QAAQ,QAAQ,kBAAkB,GAAG;AACjF,UAAM,YAAY,QAAQ,cAAc;AACxC,QAAI,QAAQ,IAAI,UAAU,YAAY,EAAE,EAAG;AAC3C,UAAM,kBAAkB,iBAAiB,IAAI,UAAU,YAAY,EAAE,KAAK,CAAC;AAC3E,QAAI,gBAAgB,SAAS,8BAA+B;AAC5D,UAAM,sBAAsB,iBAAiB,UAAU,OAAO;AAE9D,aAAS,iBAAiB,GAAG,iBAAiB,gBAAgB,kBAAkB,GAAG;AACjF,YAAM,YAAY,QAAQ,cAAc;AACxC,UAAI,CAAC,2BAA2B,WAAW,SAAS,EAAG;AACvD,YAAM,sBAAsB,iBAAiB,UAAU,OAAO;AAC9D,UAAI,wBAAwB,oBAAqB;AACjD,YAAM,kBAAkB,iBAAiB,IAAI,UAAU,YAAY,EAAE,KAAK,CAAC;AAC3E,UAAI,gBAAgB,SAAS,8BAA+B;AAE5D,YAAM,UAAU,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,MAAM;AACvE,YAAM,SAAS,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,MAAM;AACtE,UAAI,UAAU,SAAS,IAAK;AAC5B,UAAI,kBAAkB,iBAAiB,eAAe,IAAI,+BAAgC;AAE1F,kBAAY,KAAK;AAAA,QACf,SAAS,UAAU,UAAU,YAAY,EAAE;AAAA,QAC3C,UAAU,UAAU,YAAY;AAAA,QAChC,MAAM,UAAU;AAAA,QAChB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,kBAAkB,CAAC,UAAU,YAAY,EAAE;AAAA,MAC7C,CAAC;AACD,cAAQ,IAAI,UAAU,YAAY,EAAE;AACpC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kCACP,UACA,iBAKoC;AACpC,QAAM,oBAAoB,IAAI;AAAA,IAC5B,gBACG,OAAO,CAAC,UAAU,MAAM,cAAc,yBAAyB,EAC/D,IAAI,CAAC,UAAU,MAAM,QAAQ;AAAA,EAClC;AAEA,SAAO,SACJ,OAAO,CAAC,WAAW;AAClB,QAAI,SAAS,MAAM,MAAM,iBAAkB,QAAO;AAClD,UAAM,OAAO,OAAO,YAAY,QAAQ,CAAC;AACzC,QAAI,KAAK,SAAS,eAAe,EAAG,QAAO;AAC3C,QAAI,kBAAkB,IAAI,OAAO,YAAY,EAAE,EAAG,QAAO;AACzD,WAAO,OAAO,YAAY,WAAW,qBAAqB,OAAO,YAAY,WAAW;AAAA,EAC1F,CAAC,EACA,IAAI,CAAC,YAAY;AAAA,IAChB,SAAS,UAAU,OAAO,YAAY,EAAE;AAAA,IACxC,UAAU,OAAO,YAAY;AAAA,IAC7B,MAAM,OAAO;AAAA,IACb,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,IACjB,kBAAkB,CAAC;AAAA,EACrB,EAAE;AACN;AAWA,eAAe,kBAAkB,MAAc,iBAA4C;AACzF,QAAM,QAAkB,CAAC;AACzB,QAAM,OAAO,OAAO,QAAgB;AAClC,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,GAAG;AAC/B,UAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,EAAG;AACxD,2BAAqB,iBAAiB,MAAM,SAAS,GAAG,GAAG,GAAG;AAC9D,YAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,iBAAW,SAAS,SAAS;AAC3B,YAAI,MAAM,eAAe,EAAG;AAC5B,cAAM,WAAW,KAAK,KAAK,KAAK,MAAM,IAAI;AAC1C,YAAI,MAAM,YAAY,GAAG;AACvB,gBAAM,KAAK,QAAQ;AACnB;AAAA,QACF;AACA,YAAI,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG;AAChD,cAAI;AACF,iCAAqB,iBAAiB,MAAM,SAAS,QAAQ,GAAG,QAAQ;AAAA,UAC1E,QAAQ;AACN;AAAA,UACF;AACA,gBAAM,KAAK,QAAQ;AAAA,QACrB;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAGR;AAAA,EACF;AAEA,QAAM,KAAK,IAAI;AACf,SAAO;AACT;AAEA,SAAS,kBAAkB,WAAmB,UAA0B;AACtE,SAAO,aAAa,KAAK,SAAS,WAAW,QAAQ,EAAE,WAAW,KAAK,KAAK,GAAG,CAAC;AAClF;AAEA,eAAe,4BACb,WACA,SACA,gBACA,gBAC6C;AAC7C,QAAM,cAAc,IAAI,IAAI,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAOvE,MAAI,kBAAiC;AACrC,MAAI;AACF,sBAAkB,MAAM,SAAS,SAAS;AAAA,EAC5C,QAAQ;AACN,sBAAkB;AAAA,EACpB;AACA,QAAM,iBACJ,mBACC,oBAAoB,OACjB,CAAC,KAEC,MAAM,QAAQ;AAAA,IACZ,qBAAqB;AAAA,MAAI,CAAC,QACxB,kBAAkB,KAAK,KAAK,WAAW,GAAG,GAAG,eAAyB;AAAA,IACxE;AAAA,EACF,GACA,KAAK;AACb,QAAM,UAA8C,CAAC;AAErD,aAAW,YAAY,gBAAgB;AACrC,QAAI,YAAY,IAAI,QAAQ,EAAG;AAC/B,UAAM,SAAS,MAAM,QAAQ,iBAAiB,QAAQ;AACtD,QAAI,OAAQ;AACZ,YAAQ,KAAK;AAAA,MACX,SAAS,UAAU,kBAAkB,WAAW,QAAQ,CAAC;AAAA,MACzD,UAAU,kBAAkB,WAAW,QAAQ;AAAA,MAC/C,MAAM;AAAA,MACN,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,iBAAiB;AAAA,MACjB,kBAAkB,CAAC;AAAA,IACrB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,eAAe,iBACb,WACA,SACA,UACA,KACA,UAEI,CAAC,GACwC;AAC7C,QAAM,cAAkD,CAAC;AACzD,QAAM,iBAAiB,SAAS,OAAO,CAAC,WAAW,SAAS,MAAM,MAAM,QAAQ;AAChF,QAAM,mBAAmB,oBAAI,IAA0B;AAEvD,aAAW,UAAU,gBAAgB;AACnC,UAAM,MAAM,GAAG,OAAO,YAAY,QAAQ,IAAI,iBAAiB,OAAO,OAAO,CAAC;AAC9E,UAAM,SAAS,iBAAiB,IAAI,GAAG,KAAK,CAAC;AAC7C,WAAO,KAAK,MAAM;AAClB,qBAAiB,IAAI,KAAK,MAAM;AAAA,EAClC;AAEA,aAAW,UAAU,iBAAiB,OAAO,GAAG;AAC9C,QAAI,OAAO,SAAS,EAAG;AACvB,UAAM,UAAU,CAAC,GAAG,MAAM,EAAE,KAAK,0BAA0B;AAC3D,UAAM,YAAY,QAAQ,CAAC;AAC3B,eAAW,aAAa,QAAQ,MAAM,CAAC,GAAG;AACxC,kBAAY,KAAK;AAAA,QACf,SAAS,UAAU,UAAU,YAAY,EAAE;AAAA,QAC3C,UAAU,UAAU,YAAY;AAAA,QAChC,MAAM,UAAU;AAAA,QAChB,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,kBAAkB,YAAY,CAAC,UAAU,YAAY,EAAE,IAAI,CAAC;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,cAAY,KAAK,GAAG,8BAA8B,cAAc,CAAC;AAEjE,aAAW,UAAU,gBAAgB;AACnC,QAAI,OAAO,YAAY,sBAAsB,YAAY;AACvD,kBAAY,KAAK;AAAA,QACf,SAAS,UAAU,OAAO,YAAY,EAAE;AAAA,QACxC,UAAU,OAAO,YAAY;AAAA,QAC7B,MAAM,OAAO;AAAA,QACb,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,kBAAkB,CAAC;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,QACE,OAAO,YAAY,mBAAmB,kBAClC,OAAO,YAAY,cAAc,MAAM,MAC3C;AACA,kBAAY,KAAK;AAAA,QACf,SAAS,UAAU,OAAO,YAAY,EAAE;AAAA,QACxC,UAAU,OAAO,YAAY;AAAA,QAC7B,MAAM,OAAO;AAAA,QACb,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,iBAAiB;AAAA,QACjB,kBAAkB,CAAC;AAAA,MACrB,CAAC;AAAA,IACH;AAEA,UAAM,YAAY,0BAA0B,QAAQ,CAAC,GAAG,GAAG;AAC3D,UAAM,kBAAkB,OAAO,YAAY,mBAAmB,WACzD,UAAU,OAAO,YAAY,WAAW,OAAO,YAAY,SAAS,GAAG,KAAK;AACjF,QAAK,UAAU,cAAc,cAAc,UAAU,WAAY,iBAAiB;AAChF,kBAAY,KAAK;AAAA,QACf,SAAS,UAAU,OAAO,YAAY,EAAE;AAAA,QACxC,UAAU,OAAO,YAAY;AAAA,QAC7B,MAAM,OAAO;AAAA,QACb,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,iBAAiB;AAAA,QACjB,kBAAkB,CAAC;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,QAAQ,0BAA0B,OAAO,gBAAgB;AACvF,cAAY,KAAK,GAAG,kCAAkC,UAAU,eAAe,CAAC;AAChF,cAAY,KAAK,GAAG,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAED,SAAO;AACT;AAEO,SAAS,qBACd,aACA,UACiC;AACjC,QAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,YAAY,IAAI,MAAM,CAAC,CAAC;AAClF,QAAM,WAAW,oBAAI,IAA2C;AAEhE,aAAW,SAAS,aAAa;AAC/B,UAAM,SAAS,SAAS,IAAI,MAAM,QAAQ;AAC1C,QAAI,CAAC,OAAQ;AACb,UAAM,gBAAgB,SAAS,MAAM;AACrC,QACE,MAAM,oBAAoB,gBACvB,MAAM,mBACN,MAAM,oBAAoB,eAC7B;AACA;AAAA,IACF;AACA,UAAM,YAA2C;AAAA,MAC/C,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,YAAY,MAAM;AAAA,MAClB,cAAc;AAAA,MACd,aAAa,MAAM;AAAA,MACnB,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,IACtB;AAEA,UAAM,WAAW,SAAS,IAAI,MAAM,QAAQ;AAC5C,QAAI,CAAC,UAAU;AACb,eAAS,IAAI,MAAM,UAAU,SAAS;AACtC;AAAA,IACF;AAEA,UAAM,mBAAmB,uBAAuB,QAAQ;AACxD,UAAM,oBAAoB,uBAAuB,SAAS;AAC1D,QAAI,oBAAoB,kBAAkB;AACxC,eAAS,IAAI,MAAM,UAAU,SAAS;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,CAAC,GAAG,SAAS,OAAO,CAAC;AAC9B;AAEA,SAAS,aACP,aACA,iBACA,iBACyB;AACzB,QAAM,gBAA0D;AAAA,IAC9D,iBAAiB;AAAA,IACjB,8BAA8B;AAAA,IAC9B,iBAAiB;AAAA,IACjB,4BAA4B;AAAA,IAC5B,mBAAmB;AAAA,IACnB,yBAAyB;AAAA,IACzB,kBAAkB;AAAA,EACpB;AACA,QAAM,mBAA2C,CAAC;AAElD,aAAW,SAAS,aAAa;AAC/B,kBAAc,MAAM,UAAU,KAAK;AAAA,EACrC;AAEA,aAAW,UAAU,iBAAiB;AACpC,UAAM,kBAAkB,OAAO,gBAAgB,OAAO,WAAW,YAAY,aAAa;AAC1F,QAAI,CAAC,gBAAiB;AACtB,qBAAiB,eAAe,KAAK,iBAAiB,eAAe,KAAK,KAAK;AAAA,EACjF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,iBAAiB,KAAK,IAAI,GAAG,kBAAkB,gBAAgB,MAAM;AAAA,IACrE,cAAc,kBAAkB,aAAa;AAAA,EAC/C;AACF;AAEO,SAAS,kBACd,eAC8B;AAC9B,QAAM,aAAa,OAAO,QAAQ,aAAa,EAC5C,IAAI,CAAC,CAAC,YAAY,KAAK,OAAO;AAAA,IAC7B;AAAA,IACA;AAAA,IACA,YAAY,QAAQ,sBAAsB,UAAwC;AAAA,EACpF,EAAE,EACD,OAAO,CAAC,UAAU,MAAM,QAAQ,CAAC,EACjC,KAAK,CAAC,MAAM,UAAU,MAAM,aAAa,KAAK,UAAU;AAC3D,QAAM,kBAAkB,WAAW,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,YAAY,CAAC;AACnF,QAAM,QAAQ,KAAK,IAAI,GAAG,MAAM,eAAe;AAC/C,QAAM,QAAQ,SAAS,KAAK,cACxB,SAAS,KAAK,SACZ,SAAS,KAAK,SACZ;AACR,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,qBACd,SACiD;AACjD,QAAM,UAA2D,CAAC;AAClE,aAAW,UAAU,SAAS;AAC5B,UAAM,SAAS,OAAO,gBAAgB,OAAO,WAAW,YAAY,aAAa;AACjF,UAAM,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnC,WAAO,KAAK,MAAM;AAClB,YAAQ,MAAM,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,eAAe,SAAS,UAA0C;AAChE,MAAI;AACF,WAAO,MAAM,SAAS,UAAU,OAAO;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,uBACb,WACA,UACiB;AACjB,QAAM,cAAc,sBAAsB,WAAW,SAAS,KAAK;AACnE,QAAM,MAAM,KAAK,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AAC1D,QAAM,UAAU,aAAa,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,OAAO;AACvE,SAAO;AACT;AAEA,eAAe,yBAAyB,SA2BtC;AACA,QAAM,SAAS,iBAAiB,QAAQ,WAAW,QAAQ,KAAK;AAChE,QAAM,MAAM,QAAQ,EAAE,WAAW,KAAK,CAAC;AAEvC,QAAM,cAAc,KAAK,KAAK,QAAQ,cAAc;AACpD,QAAM,kBAAkB,KAAK,KAAK,QAAQ,mBAAmB;AAC7D,QAAM,mBAAmB,KAAK,KAAK,QAAQ,oBAAoB;AAC/D,QAAM,uBAAuB,KAAK,KAAK,QAAQ,yBAAyB;AACxE,QAAM,aAAa,KAAK,KAAK,QAAQ,WAAW;AAChD,QAAM,mBAAmB,KAAK,KAAK,QAAQ,oBAAoB;AAC/D,QAAM,qBAAqB,KAAK,KAAK,QAAQ,sBAAsB;AACnE,QAAM,cAAc,KAAK,KAAK,QAAQ,cAAc;AACpD,QAAM,eAAe,KAAK,KAAK,QAAQ,eAAe;AACtD,QAAM,cAAc,QAAQ,kBAAkB,sBAAsB,QAAQ,WAAW,QAAQ,KAAK,IAAI;AAExG,QAAM,UAAU,aAAa,KAAK,UAAU,QAAQ,SAAS,MAAM,CAAC,GAAG,OAAO;AAC9E,QAAM,UAAU,iBAAiB,KAAK,UAAU,QAAQ,aAAa,MAAM,CAAC,GAAG,OAAO;AACtF,QAAM,UAAU,kBAAkB,KAAK,UAAU,QAAQ,cAAc,MAAM,CAAC,GAAG,OAAO;AACxF,QAAM,UAAU,sBAAsB,KAAK,UAAU,QAAQ,kBAAkB,MAAM,CAAC,GAAG,OAAO;AAChG,QAAM,UAAU,kBAAkB,KAAK,UAAU,QAAQ,eAAe,MAAM,CAAC,GAAG,OAAO;AACzF,QAAM,UAAU,oBAAoB,KAAK,UAAU,QAAQ,gBAAgB,MAAM,CAAC,GAAG,OAAO;AAC5F,QAAM,UAAU,aAAa,KAAK,UAAU,QAAQ,SAAS,MAAM,CAAC,GAAG,OAAO;AAC9E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,2BAA2B,QAAQ,KAAK;AAAA,MACxC;AAAA,MACA,eAAe,QAAQ,OAAO;AAAA,MAC9B,WAAW,QAAQ,QAAQ,IAAI;AAAA,MAC/B,uBAAuB,QAAQ,QAAQ,eAAe;AAAA,MACtD,oBAAoB,QAAQ,QAAQ,eAAe;AAAA,MACnD,2BAA2B,QAAQ,QAAQ,gBAAgB;AAAA,MAC3D,uBAAuB,QAAQ,QAAQ,mBAAmB;AAAA,MAC1D,sBAAsB,QAAQ,QAAQ,kBAAkB;AAAA,MACxD,oBAAoB,QAAQ,aAAa,KAAK,IAAI,QAAQ,aAAa,QAAQ,KAAK,QAAQ,aAAa,KAAK;AAAA,MAC9G;AAAA,MACA;AAAA,MACA,GAAG,OAAO,QAAQ,QAAQ,QAAQ,aAAa,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,KAAK,MAAM,KAAK,KAAK,EAAE;AAAA,MACjG,GAAI,OAAO,QAAQ,QAAQ,QAAQ,gBAAgB,EAAE,SAAS,IAC1D,OAAO,QAAQ,QAAQ,QAAQ,gBAAgB,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,cAAc,MAAM,KAAK,KAAK,EAAE,IAC1G,CAAC,6BAA6B;AAAA,MAClC;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,aAAa,WAAW,SAAS,IACzC,QAAQ,aAAa,WAAW,IAAI,CAAC,UAAU,KAAK,MAAM,UAAU,KAAK,MAAM,KAAK,QAAQ,MAAM,UAAU,EAAE,IAC9G,CAAC,iBAAiB;AAAA,MACtB;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,gBAAgB,SAAS,IACjC,QAAQ,gBAAgB;AAAA,QAAI,CAAC,WAC3B,KAAK,OAAO,QAAQ,KAAK,OAAO,MAAM,GAAG,OAAO,cAAc,OAAO,OAAO,WAAW,KAAK,EAAE,KAAK,OAAO,UAAU;AAAA,MACtH,IACA,CAAC,WAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,eAAe,SAAS,IAChC,QAAQ,eAAe;AAAA,QAAI,CAAC,WAC1B,KAAK,OAAO,QAAQ,KAAK,OAAO,MAAM,GAAG,OAAO,cAAc,OAAO,OAAO,WAAW,KAAK,EAAE,KAAK,OAAO,UAAU;AAAA,MACtH,IACA,CAAC,WAAW;AAAA,MAChB;AAAA,MACA;AAAA,MACA,GAAI,QAAQ,YAAY,SAAS,IAC7B,QAAQ,YAAY;AAAA,QAAI,CAAC,UACvB,KAAK,MAAM,QAAQ,KAAK,MAAM,UAAU,OAAO,MAAM,eAAe,GAAG,MAAM,kBAAkB,KAAK,MAAM,eAAe,MAAM,EAAE;AAAA,MACnI,IACA,CAAC,WAAW;AAAA,IAClB,EAAE,KAAK,IAAI;AAAA,IACX;AAAA,EACF;AACA,QAAM,WAAqC;AAAA,IACzC,eAAe;AAAA,IACf,OAAO,QAAQ;AAAA,IACf,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ,QAAQ;AAAA,IACtB,WAAW,QAAQ,QAAQ;AAAA,IAC3B,aAAa,QAAQ,QAAQ;AAAA,IAC7B,WAAW;AAAA,MACT,SAAS;AAAA,MACT,aAAa;AAAA,MACb,cAAc;AAAA,MACd,kBAAkB;AAAA,MAClB,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,SAAS;AAAA,MACT,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,IAChD;AAAA,EACF;AACA,QAAM,UAAU,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,OAAO;AACxE,MAAI,eAAe,QAAQ,mBAAmB,MAAM,SAAS,WAAW,MAAM,MAAM;AAClF,UAAM,UAAU,aAAa,KAAK,UAAU,QAAQ,iBAAiB,MAAM,CAAC,GAAG,OAAO;AAAA,EACxF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,oBACpB,SACoC;AACpC,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,QAAQ,WAAW,GAAG;AAC5B,QAAM,UAAU;AAChB,QAAM,UAAU,IAAI,eAAe,QAAQ,SAAS;AACpD,QAAM,cACJ,QAAQ,gBAAgB,UACxB,QAAQ,eAAe,UACvB,QAAQ,cAAc;AACxB,QAAM,uBAAuB,OAAO,QAAQ,eAAe,YAAY,OAAO,SAAS,QAAQ,UAAU,IACrG,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,UAAU,CAAC,IAC1C;AACJ,QAAM,eAAe,yBAAyB,SAC1C,IAAI,KAAK,IAAI,QAAQ,IAAI,uBAAuB,KAAU,IAC1D;AACJ,QAAM,eAAe,cACjB,MAAM,QAAQ,mBAAmB;AAAA,IAC/B,aAAa,QAAQ;AAAA,IACrB,WAAW,QAAQ;AAAA,IACnB;AAAA,EACF,CAAC,IACD;AACJ,QAAM,WAAW,cAAc,YAAY,MAAM,QAAQ,gBAAgB;AACzE,QAAM,cAAc,MAAM,iBAAiB,QAAQ,WAAW,SAAS,UAAU,KAAK;AAAA,IACpF,yBAAyB,cAAc;AAAA,EACzC,CAAC;AACD,QAAM,kBAAkB,qBAAqB,aAAa,QAAQ;AAClE,QAAM,yBAAyB,IAAI;AAAA,IACjC,YAAY,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,QAAQ,IAAI,MAAM,UAAU,IAAI,KAAK,CAAU;AAAA,EACtF;AACA,QAAM,UAAU,aAAa,aAAa,iBAAiB,SAAS,MAAM;AAC1E,QAAM,mBAAqD;AAAA,IACzD,UAAU,qBAAqB,eAAe;AAAA,IAC9C,SAAS,CAAC;AAAA,EACZ;AACA,QAAM,iBAAiB,IAAI,IAAI,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,YAAY,IAAI,OAAO,IAAI,CAAU,CAAC;AACtG,QAAM,oBAAoB,IAAI,IAAI,gBAAgB,IAAI,CAAC,WAAW,OAAO,QAAQ,CAAC;AAClF,QAAM,gBAAgB,SACnB,IAAI,CAAC,WAAW,OAAO,YAAY,EAAE,EACrC,OAAO,CAAC,aAAa,CAAC,kBAAkB,IAAI,QAAQ,CAAC;AACxD,QAAM,iBAAkD,CAAC;AACzD,QAAM,iBAAiD,CAAC;AACxD,QAAM,yBAAyB,oBAAI,IAA0C;AAE7E,MAAI,QAAQ,SAAS,SAAS;AAC5B,eAAW,UAAU,iBAAiB;AACpC,YAAM,aAAa,eAAe,IAAI,OAAO,QAAQ,KAAK;AAC1D,UAAI,CAAC,WAAY;AACjB,YAAM,SAAS,MAAM,QAAQ,iBAAiB,UAAU;AACxD,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,YAAY,OAAO,OAAO,SAAU;AAC/C,YAAM,YAAY,MAAM,SAAS,OAAO,IAAI;AAC5C,UAAI,CAAC,UAAW;AAChB,YAAM,QAAsC;AAAA,QAC1C,QAAQ,OAAO;AAAA,QACf,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,cAAc,OAAO;AAAA,QACrB,aAAa,OAAO,WAAW,YAC3B,mBAAmB,QAAQ,WAAW,OAAO,MAAM,GAAG,IACtD,OAAO;AAAA,QACX;AAAA,QACA,SAAS;AAAA,MACX;AACA,qBAAe,KAAK,KAAK;AACzB,6BAAuB,IAAI,OAAO,UAAU,KAAK;AAAA,IACnD;AAEA,UAAMA,mBAAmD;AAAA,MACvD;AAAA,MACA,WAAW,IAAI,YAAY;AAAA,MAC3B,SAAS;AAAA,IACX;AACA,UAAM,uBAAuB,QAAQ,WAAWA,gBAAe;AAE/D,eAAW,UAAU,iBAAiB;AACpC,YAAM,aAAa,eAAe,IAAI,OAAO,QAAQ,KAAK;AAC1D,UAAI,CAAC,WAAY;AACjB,YAAM,SAAS,MAAM,QAAQ,iBAAiB,UAAU;AACxD,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,YAAY,OAAO,OAAO,SAAU;AAC/C,YAAM,eAAe,uBAAuB,IAAI,OAAO,QAAQ;AAC/D,UAAI,CAAC,aAAc;AAEnB,UAAI,OAAO,WAAW,WAAW;AAC/B,cAAMC,eAAc,uBAAuB,IAAI,GAAG,OAAO,QAAQ,IAAI,OAAO,UAAU,EAAE;AACxF,qBAAa,UAAU;AACvB,cAAM,uBAAuB,QAAQ,WAAWD,gBAAe;AAC/D,cAAM,eAAe,MAAM,QAAQ,cAAc,QAAQ;AAAA,UACvD,IAAI;AAAA,UACJ,OAAO;AAAA,UACP,YAAY,OAAO;AAAA,UACnB,aAAa;AAAA,UACb,kBAAkBC,cAAa,oBAAoB,CAAC;AAAA,UACpD,eAAe;AAAA,QACjB,CAAC;AACD,YAAI,CAAC,cAAc;AACjB,uBAAa,UAAU;AACvB,gBAAM,uBAAuB,QAAQ,WAAWD,gBAAe;AAC/D;AAAA,QACF;AACA,qBAAa,cAAc;AAC3B,qBAAa,qBAAqB,MAAM,SAAS,YAAY,KAAK;AAClE,cAAM,uBAAuB,QAAQ,WAAWA,gBAAe;AAC/D,uBAAe,KAAK;AAAA,UAClB,GAAG;AAAA,UACH,aAAa;AAAA,UACb,aAAa;AAAA,QACf,CAAC;AACD;AAAA,MACF;AAEA,UAAI,CAAC,OAAO,eAAe,OAAO,iBAAiB,OAAO,YAAa;AACvE,YAAM,cAAc,uBAAuB,IAAI,GAAG,OAAO,QAAQ,IAAI,OAAO,UAAU,EAAE;AACxF,mBAAa,UAAU;AACvB,YAAM,uBAAuB,QAAQ,WAAWA,gBAAe;AAC/D,YAAM,UAAU,MAAM,QAAQ,uBAAuB,QAAQ;AAAA,QAC3D,QAAQ,OAAO;AAAA,QACf,SAAS,IAAI,YAAY;AAAA,MAC3B,GAAG;AAAA,QACD,OAAO;AAAA,QACP,YAAY,OAAO;AAAA,QACnB,aAAa;AAAA,QACb,kBAAkB,aAAa,oBAAoB,CAAC;AAAA,QACpD,eAAe;AAAA,MACjB,CAAC;AACD,UAAI,CAAC,SAAS;AACZ,qBAAa,UAAU;AACvB,cAAM,uBAAuB,QAAQ,WAAWA,gBAAe;AAC/D;AAAA,MACF;AACA,mBAAa,qBAAqB,MAAM,SAAS,OAAO,IAAI,KAAK;AACjE,YAAM,uBAAuB,QAAQ,WAAWA,gBAAe;AAC/D,qBAAe,KAAK;AAAA,QAClB,GAAG;AAAA,QACH,aAAa,OAAO;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,UAAmC;AAAA,IACvC,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,MAAM,QAAQ;AAAA,IACd,WAAW,IAAI,YAAY;AAAA,IAC3B,iBAAiB,SAAS;AAAA,IAC1B,kBAAkB,YAAY;AAAA,IAC9B,qBAAqB,gBAAgB;AAAA,IACrC,oBAAoB,eAAe;AAAA,IACnC,aAAa;AAAA,EACf;AACA,QAAM,kBAAkB,QAAQ,SAAS,UACrC;AAAA,IACE;AAAA,IACA,WAAW,IAAI,YAAY;AAAA,IAC3B,SAAS;AAAA,EACX,IACA;AACJ,mBAAiB,UAAU,qBAAqB,cAAc;AAC9D,QAAM,QAAQ,MAAM,yBAAyB;AAAA,IAC3C,WAAW,QAAQ;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,2BACpB,SAC2C;AAC3C,OAAK,QAAQ;AACb,QAAM,cAAc,sBAAsB,QAAQ,WAAW,QAAQ,KAAK;AAC1E,QAAM,MAAM,KAAK,MAAM,MAAM,SAAS,aAAa,OAAO,CAAC;AAC3D,MAAI,kBAAkB;AAEtB,aAAW,SAAS,CAAC,GAAG,IAAI,OAAO,EAAE,QAAQ,GAAG;AAC9C,QAAI,CAAC,MAAM,SAAS;AAClB;AAAA,IACF;AACA,UAAM,aAAa,MAAM,SAAS,MAAM,WAAW;AACnD,QAAI,MAAM,sBAAsB,eAAe,MAAM,oBAAoB;AACvE,YAAM,IAAI,MAAM,wBAAwB,MAAM,QAAQ,iDAAiD;AAAA,IACzG;AACA,QAAI,MAAM,WAAW,WAAW;AAC9B,YAAM,GAAG,MAAM,aAAa,EAAE,OAAO,KAAK,CAAC;AAAA,IAC7C;AACA,UAAM,MAAM,KAAK,QAAQ,MAAM,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AACjE,UAAM,UAAU,MAAM,cAAc,MAAM,WAAW,OAAO;AAC5D,uBAAmB;AAAA,EACrB;AAEA,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,yBAAyB,WAAsC;AACnF,MAAI;AACF,YAAQ,MAAM,QAAQ,kBAAkB,SAAS,CAAC,GAAG,KAAK,EAAE,QAAQ;AAAA,EACtE,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,gCACpB,WACA,OAYC;AACD,QAAM,SAAS,iBAAiB,WAAW,KAAK;AAChD,QAAM,UAAU,KAAK,MAAM,MAAM,SAAS,KAAK,KAAK,QAAQ,cAAc,GAAG,OAAO,CAAC;AACrF,QAAM,UAAU,KAAK,MAAM,MAAM,SAAS,KAAK,KAAK,QAAQ,cAAc,GAAG,OAAO,CAAC;AACrF,UAAQ,iBAAiB,kBAAkB,QAAQ,aAAa;AAChE,QAAM,gBAAgB,KAAK,MAAM,MAAM,SAAS,KAAK,KAAK,QAAQ,oBAAoB,GAAG,OAAO,CAAC;AACjG,QAAM,cAAc,KAAK;AAAA,IACvB,MAAM,SAAS,KAAK,KAAK,QAAQ,mBAAmB,GAAG,OAAO;AAAA,EAChE;AACA,QAAM,iBAAiB,KAAK;AAAA,IAC1B,MAAM,SAAS,KAAK,KAAK,QAAQ,sBAAsB,GAAG,OAAO;AAAA,EACnE;AACA,QAAM,kBAAkB,MAAM,SAAS,KAAK,KAAK,QAAQ,oBAAoB,CAAC;AAC9E,QAAM,sBAAsB,MAAM,SAAS,KAAK,KAAK,QAAQ,yBAAyB,CAAC;AACvF,QAAM,WAAW,KAAK;AAAA,IACpB,MAAM,SAAS,KAAK,KAAK,QAAQ,eAAe,GAAG,OAAO;AAAA,EAC5D;AACA,QAAM,SAAS,MAAM,SAAS,KAAK,KAAK,QAAQ,WAAW,GAAG,OAAO;AACrE,QAAM,aAAa,MAAM,SAAS,KAAK,KAAK,QAAQ,cAAc,CAAC;AACnE,QAAM,eAAe,kBACjB,KAAK,MAAM,eAAe,IAC1B,QAAQ,gBAAgB,kBAAkB,QAAQ,aAAa;AACnE,QAAM,mBAAmB,sBACrB,KAAK,MAAM,mBAAmB,IAC9B;AAAA,IACE,UAAU,CAAC;AAAA,IACX,SAAS,qBAAqB,cAAc;AAAA,EAC9C;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,aAAa,KAAK,MAAM,UAAU,IAAuC;AAAA,EACpF;AACF;","names":["restoreManifest","reviewEntry"]}

package/dist/{chunk-QXHBWFR3.js → chunk-IHG6CC7T.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 
 // src/semantic-rule-promotion.ts
 import { createHash, randomUUID } from "crypto";
@@ -529,4 +529,4 @@ export {
   setSemanticRulePromotionTestHooks,
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-QXHBWFR3.js.map
+//# sourceMappingURL=chunk-IHG6CC7T.js.map

package/dist/{chunk-4KDLCMLK.js → chunk-IROWLAWG.js}

@@ -6,10 +6,10 @@ import {
 } from "./chunk-7WV3F5DQ.js";
 import {
   EngramMcpServer
-} from "./chunk-2KDQI363.js";
+} from "./chunk-2HEZXPYU.js";
 import {
   EngramAccessInputError
-} from "./chunk-DFAXGZKI.js";
+} from "./chunk-JIX3ZL2J.js";
 import {
   projectTagProjectId
 } from "./chunk-GYSYLGNE.js";
@@ -30,12 +30,12 @@ import {
 } from "./chunk-2ODBA7MQ.js";
 import {
   validateRequest
-} from "./chunk-UAU5U5ML.js";
+} from "./chunk-UDJLF3BO.js";
 import {
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-ZLDUQWT2.js";
+} from "./chunk-PWWWLD7D.js";
 
 // src/access-http.ts
 import { createServer } from "http";
@@ -2030,4 +2030,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-4KDLCMLK.js.map
+//# sourceMappingURL=chunk-IROWLAWG.js.map

package/dist/{chunk-ILXTATKK.js → chunk-J2HSAU72.js}

@@ -10,6 +10,9 @@ import {
   parseEnvelope,
   seal
 } from "./chunk-A6XUJE5D.js";
+import {
+  RECALL_FALLBACK_DIRS
+} from "./chunk-VS2IYZRU.js";
 
 // src/secure-store/secure-fs.ts
 import { createCipheriv, randomBytes, randomUUID } from "crypto";
@@ -402,10 +405,7 @@ function normalizeStorageRelativePath(rel) {
   return normalized;
 }
 var ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = /* @__PURE__ */ new Set([
-  "facts",
-  "corrections",
-  "procedures",
-  "reasoning-traces",
+  ...RECALL_FALLBACK_DIRS,
   "artifacts",
   "archive",
   "entities",
@@ -453,4 +453,4 @@ export {
   migrateMemoryDirToEncrypted,
   decryptMemoryDirToPlaintext
 };
-//# sourceMappingURL=chunk-ILXTATKK.js.map
+//# sourceMappingURL=chunk-J2HSAU72.js.map

package/dist/chunk-J2HSAU72.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/secure-fs.ts"],"sourcesContent":["/**\n * Transparent file-level encryption for the secure-store module.\n *\n * Issue #690 (PR 3/4) — storage.ts integration layer.\n *\n * This module sits between the raw filesystem and StorageManager.\n * Every memory file is either:\n *   - a plain UTF-8 text file (legacy, back-compat), or\n *   - a REMNIC-ENC sealed file (AES-256-GCM, see format below).\n *\n * On-disk format\n * --------------\n * Encrypted files begin with a 9-byte magic header:\n *\n *   REMNIC-ENC  (7 ASCII bytes)\n *   VER         (1 byte, currently 0x01)\n *   FLAGS       (1 byte, reserved, must be 0x00)\n *\n * Followed immediately by a `seal()` envelope from `cipher.ts`:\n *\n *   [VERSION:1][SALT:16][IV:12][AUTHTAG:16][CIPHERTEXT:...]\n *\n * The magic header makes encrypted files sniffable without attempting\n * a full `open()` call and gives operators a clear signal that the\n * file cannot be read by opening it in an editor.\n *\n * AAD\n * ---\n * The file path relative to the memory root is bound as Associated\n * Authenticated Data (AAD) on both encrypt and decrypt. This means\n * moving or renaming an encrypted file without re-encrypting it will\n * cause auth-tag failure on the next read — the file is tied to its\n * path. Callers that move files must re-encrypt them.\n *\n * Back-compat\n * -----------\n * `readMaybeEncryptedFile` transparently handles both formats: if the\n * file does NOT start with the magic bytes, it is returned as-is (plain\n * text). This lets an operator migrate incrementally: newly-written\n * files are encrypted while existing files continue to be read in plain\n * form until `migrateMemoryDirToEncrypted` is run.\n *\n * Naming: `secure-fs.ts` (not `vault-fs.ts`) — see `kdf.ts` naming note.\n */\n\nimport { createCipheriv, randomBytes, randomUUID } from \"node:crypto\";\nimport { lstat, mkdir, open as openFile, readFile, readdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport {\n  AUTH_TAG_LENGTH,\n  ENVELOPE_HEADER_SIZE,\n  ENVELOPE_LAYOUT,\n  ENVELOPE_SALT_LENGTH,\n  ENVELOPE_VERSION,\n  IV_LENGTH,\n  generateSalt,\n  open as openEnvelope,\n  parseEnvelope,\n  seal,\n} from \"./cipher.js\";\nimport { RECALL_FALLBACK_DIRS } from \"../utils/category-dir.js\";\n\n// ---------------------------------------------------------------------------\n// Error classes\n// ---------------------------------------------------------------------------\n\n/**\n * Thrown when a read is attempted but the keyring entry for this\n * store is absent (i.e. `secure-store unlock` has not been run\n * since the last daemon start).\n */\nexport class SecureStoreLockedError extends Error {\n  constructor(message = \"secure-store is locked — run `remnic secure-store unlock` to decrypt\") {\n    super(message);\n    this.name = \"SecureStoreLockedError\";\n  }\n}\n\n/**\n * Thrown when `open()` fails because the auth tag does not validate.\n * This covers both wrong-key and tampered-ciphertext scenarios —\n * intentionally indistinguishable from the caller's perspective.\n */\nexport class SecureStoreDecryptError extends Error {\n  constructor(message = \"secure-store decryption failed — wrong key or tampered ciphertext\") {\n    super(message);\n    this.name = \"SecureStoreDecryptError\";\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Magic header\n// ---------------------------------------------------------------------------\n\n/** Magic bytes: the ASCII string \"REMNIC-ENC\" (10 bytes). */\nexport const MAGIC_BYTES = Buffer.from(\"REMNIC-ENC\", \"ascii\");\n\n/** Current on-disk version byte. */\nexport const FILE_FORMAT_VERSION = 0x01;\n\n/** Reserved flags byte — must be 0x00. */\nexport const FILE_FORMAT_FLAGS = 0x00;\n\n/** Total size of the magic header prefix (magic + version + flags). */\nexport const MAGIC_HEADER_SIZE = MAGIC_BYTES.length + 2; // 12 bytes\n\n// ---------------------------------------------------------------------------\n// Detection\n// ---------------------------------------------------------------------------\n\n/**\n * Return true iff `buf` begins with the REMNIC-ENC magic header.\n * Does not validate the envelope; just identifies the format.\n */\nexport function isEncryptedFile(buf: Uint8Array): boolean {\n  if (buf.length < MAGIC_HEADER_SIZE) return false;\n  const b = Buffer.isBuffer(buf) ? buf : Buffer.from(buf);\n  return b.subarray(0, MAGIC_BYTES.length).equals(MAGIC_BYTES);\n}\n\n// ---------------------------------------------------------------------------\n// Encrypt / decrypt file body\n// ---------------------------------------------------------------------------\n\n/**\n * Encrypt `plain` (UTF-8 content of a memory file) and return a\n * Buffer ready to write to disk.\n *\n * @param plain  Plain-text file content (UTF-8 string or Buffer).\n * @param key    32-byte AES-256 key from the keyring.\n * @param aad    Optional associated data — defaults to empty if omitted.\n *               Callers should pass the file path relative to memoryDir\n *               so the ciphertext is bound to its location.\n */\nexport function encryptFileBody(plain: string | Buffer, key: Buffer, aad?: Buffer): Buffer {\n  const plainBuf = typeof plain === \"string\" ? Buffer.from(plain, \"utf8\") : plain;\n  const salt = generateSalt();\n  const envelope = seal(key, salt, plainBuf, aad ? { aad } : {});\n\n  const header = Buffer.alloc(MAGIC_HEADER_SIZE);\n  MAGIC_BYTES.copy(header, 0);\n  header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n  header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n\n  return Buffer.concat([header, envelope]);\n}\n\n/**\n * Decrypt a buffer produced by `encryptFileBody` and return the\n * original UTF-8 content.\n *\n * Throws `SecureStoreDecryptError` on auth failure (wrong key or\n * tampered ciphertext). Throws a plain `Error` for structural problems\n * (truncated buffer, wrong magic, unsupported version).\n */\nexport function decryptFileBody(buf: Buffer, key: Buffer, aad?: Buffer): Buffer {\n  if (!isEncryptedFile(buf)) {\n    throw new Error(\"decryptFileBody: buffer does not start with REMNIC-ENC magic header\");\n  }\n  const version = buf.readUInt8(MAGIC_BYTES.length);\n  if (version !== FILE_FORMAT_VERSION) {\n    throw new Error(\n      `decryptFileBody: unsupported file format version ${version} (this build supports ${FILE_FORMAT_VERSION})`\n    );\n  }\n  const flags = buf.readUInt8(MAGIC_BYTES.length + 1);\n  if (flags !== FILE_FORMAT_FLAGS) {\n    throw new Error(`decryptFileBody: unknown flags byte 0x${flags.toString(16).padStart(2, \"0\")}`);\n  }\n  const envelope = buf.subarray(MAGIC_HEADER_SIZE);\n  parseEnvelope(envelope);\n  try {\n    return openEnvelope(key, envelope, aad ? { aad } : {});\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    throw new SecureStoreDecryptError(`secure-store decryption failed: ${msg}`);\n  }\n}\n\nfunction buildHeaderAad(salt: Uint8Array): Buffer {\n  const out = Buffer.alloc(1 + ENVELOPE_SALT_LENGTH);\n  out.writeUInt8(ENVELOPE_VERSION, 0);\n  Buffer.from(salt).copy(out, 1);\n  return out;\n}\n\n// ---------------------------------------------------------------------------\n// Path → AAD helper\n// ---------------------------------------------------------------------------\n\n/**\n * Build the AAD buffer for a file at `filePath` relative to\n * `memoryDir`. The AAD binds the ciphertext to its path so a\n * file cannot be silently relocated without re-encryption.\n *\n * When `memoryDir` is supplied and `filePath` is absolute, the\n * relative sub-path is used. Otherwise `filePath` is used verbatim.\n */\nexport function filePathAad(filePath: string, memoryDir?: string): Buffer {\n  let rel = filePath;\n  if (memoryDir && path.isAbsolute(filePath)) {\n    rel = path.relative(memoryDir, filePath);\n  }\n  return Buffer.from(rel, \"utf8\");\n}\n\n// ---------------------------------------------------------------------------\n// High-level read / write helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Read a file from `filePath`.\n *\n * - If the file is plaintext (no magic header), return its content\n *   as-is — back-compat with unencrypted stores.\n * - If the file is encrypted AND `key` is provided, decrypt and return\n *   the plaintext content.\n * - If the file is encrypted AND `key` is null, throw\n *   `SecureStoreLockedError`.\n *\n * @param filePath  Absolute path to the file.\n * @param key       32-byte AES-256 key, or null when the store is locked.\n * @param memoryDir Memory root for path-bound AAD.  Should be absolute.\n */\nexport async function readMaybeEncryptedFileBuffer(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string\n): Promise<Buffer> {\n  const buf = await readFile(filePath);\n  if (!isEncryptedFile(buf)) {\n    // Plain file — legacy or unencrypted store.\n    return buf;\n  }\n  // Encrypted — key required.\n  if (key === null) {\n    throw new SecureStoreLockedError(\n      `secure-store is locked — cannot read encrypted file at ${filePath}. Run \\`remnic secure-store unlock\\` to decrypt.`\n    );\n  }\n  return decryptFileBodyForPath(buf, key, filePath, memoryDir);\n}\n\nexport async function readMaybeEncryptedFile(\n  filePath: string,\n  key: Buffer | null,\n  memoryDir?: string\n): Promise<string> {\n  return (await readMaybeEncryptedFileBuffer(filePath, key, memoryDir)).toString(\"utf8\");\n}\n\nexport interface WriteMaybeEncryptedFileOptions {\n  /**\n   * File mode bits. Default 0o600 (owner read/write only).\n   * Applied only on create; existing files inherit their existing mode.\n   */\n  mode?: number;\n  /**\n   * If true, write atomically via a temp file + rename (CLAUDE.md gotcha #54).\n   * Default true.\n   */\n  atomic?: boolean;\n}\n\n/**\n * Write `content` to `filePath`.\n *\n * - If `key` is provided and non-null, encrypt the content first.\n * - If `key` is null, write the content as plain UTF-8 (unencrypted store).\n *\n * Writes atomically: content is written to a unique temp file\n * first, then renamed into place (CLAUDE.md gotcha #54 — never delete\n * before write).\n */\nexport async function writeMaybeEncryptedFile(\n  filePath: string,\n  content: string | Buffer,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n\n  let data: Buffer | string;\n  if (key !== null) {\n    const aad = filePathAad(filePath, memoryDir);\n    data = encryptFileBody(content, key, aad);\n  } else {\n    data = content;\n  }\n\n  if (atomic) {\n    const tempPath = uniqueAtomicTempPath(filePath, \"tmp\");\n    try {\n      await writeFile(tempPath, data, { mode });\n      await rename(tempPath, filePath);\n    } catch (err) {\n      // Best-effort cleanup of the temp file.\n      try {\n        await unlink(tempPath);\n      } catch {\n        // ignore\n      }\n      throw err;\n    }\n  } else {\n    await writeFile(filePath, data, { mode });\n  }\n}\n\nexport async function writeMaybeEncryptedFileFromChunks(\n  filePath: string,\n  chunks: AsyncIterable<Buffer>,\n  key: Buffer | null,\n  options: WriteMaybeEncryptedFileOptions = {},\n  memoryDir?: string\n): Promise<void> {\n  const { mode = 0o600, atomic = true } = options;\n  await mkdir(path.dirname(filePath), { recursive: true });\n  const writePath = atomic ? `${filePath}.tmp-${process.pid}-${Date.now()}` : filePath;\n  let completed = false;\n  try {\n    const handle = await openFile(writePath, \"w\", mode);\n    try {\n      if (key !== null) {\n        const salt = generateSalt();\n        const iv = randomBytes(IV_LENGTH);\n        const header = Buffer.alloc(MAGIC_HEADER_SIZE + ENVELOPE_HEADER_SIZE);\n        MAGIC_BYTES.copy(header, 0);\n        header.writeUInt8(FILE_FORMAT_VERSION, MAGIC_BYTES.length);\n        header.writeUInt8(FILE_FORMAT_FLAGS, MAGIC_BYTES.length + 1);\n        const envelopeOffset = MAGIC_HEADER_SIZE;\n        header.writeUInt8(ENVELOPE_VERSION, envelopeOffset + ENVELOPE_LAYOUT.version);\n        salt.copy(header, envelopeOffset + ENVELOPE_LAYOUT.salt);\n        iv.copy(header, envelopeOffset + ENVELOPE_LAYOUT.iv);\n        await handle.write(header);\n\n        const cipher = createCipheriv(\"aes-256-gcm\", key, iv, { authTagLength: AUTH_TAG_LENGTH });\n        const aad = filePathAad(filePath, memoryDir);\n        cipher.setAAD(Buffer.concat([buildHeaderAad(salt), aad]));\n        for await (const chunk of chunks) {\n          if (chunk.length === 0) continue;\n          const encrypted = cipher.update(chunk);\n          if (encrypted.length > 0) await handle.write(encrypted);\n        }\n        const final = cipher.final();\n        if (final.length > 0) await handle.write(final);\n        const authTag = cipher.getAuthTag();\n        await handle.write(authTag, 0, authTag.length, MAGIC_HEADER_SIZE + ENVELOPE_LAYOUT.authTag);\n      } else {\n        for await (const chunk of chunks) {\n          if (chunk.length > 0) await handle.write(chunk);\n        }\n      }\n    } finally {\n      await handle.close();\n    }\n    if (atomic) {\n      await rename(writePath, filePath);\n    }\n    completed = true;\n  } finally {\n    if (!completed && atomic) {\n      await unlink(writePath).catch(() => {});\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Migration\n// ---------------------------------------------------------------------------\n\nexport interface MigrateResult {\n  /** Number of files successfully encrypted. */\n  encrypted: number;\n  /** Number of files already encrypted (skipped). */\n  skipped: number;\n  /** Files that failed to encrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\nexport interface DecryptResult {\n  /** Number of files successfully decrypted back to plaintext. */\n  decrypted: number;\n  /** Number of files already plaintext (skipped). */\n  skipped: number;\n  /** Files that failed to decrypt (path → error message). */\n  errors: Array<{ filePath: string; error: string }>;\n}\n\n/**\n * Walk `dir` recursively, find encryptable storage-managed files that are not\n * yet encrypted, and re-write them as encrypted files under `key`.\n *\n * Safety rules per CLAUDE.md gotchas #54 and #25:\n *   1. A page-version snapshot is taken (via `createVersion`) BEFORE\n *      each overwrite so the plaintext version is preserved in history.\n *      Since this module has no direct access to `page-versioning.ts`\n *      internals, callers who have page-versioning configured should\n *      pass `onBeforeEncrypt` to take the snapshot.\n *   2. The new encrypted content is written to a temp file first,\n *      then renamed atomically — never deleted before written.\n *   3. If encryption of any file fails, the error is recorded and the\n *      original file is left intact (partial migration is safe).\n *\n * @param dir              Absolute path to the memory directory.\n * @param key              32-byte AES-256 key.\n * @param onBeforeEncrypt  Optional callback invoked before encrypting\n *                         each file. Can be used to take page-version\n *                         snapshots. Errors here are non-fatal.\n */\nexport async function migrateMemoryDirToEncrypted(\n  dir: string,\n  key: Buffer,\n  onBeforeEncrypt?: (filePath: string) => Promise<void>\n): Promise<MigrateResult> {\n  const result: MigrateResult = { encrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectEncryptableStorageFiles(dir);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n      // Call optional pre-encryption hook (e.g. page-version snapshot).\n      if (onBeforeEncrypt) {\n        try {\n          await onBeforeEncrypt(filePath);\n        } catch {\n          // Non-fatal — continue with encryption even if snapshot fails.\n        }\n      }\n      const content = buf.toString(\"utf8\");\n      const aad = filePathAad(filePath, dir);\n      const encrypted = encryptFileBody(content, key, aad);\n\n      // Atomic write: temp → rename (gotcha #54).\n      const tempPath = uniqueAtomicTempPath(filePath, \"enc-tmp\");\n      try {\n        await writeFile(tempPath, encrypted, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.encrypted++;\n      } catch (writeErr) {\n        // Clean up temp file, leave original intact.\n        try {\n          const { unlink } = await import(\"node:fs/promises\");\n          await unlink(tempPath);\n        } catch {\n          // ignore\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n/**\n * Walk `dir` recursively, find storage-managed encrypted files, and\n * re-write them as plaintext under the same paths.\n *\n * This is the reversible counterpart to {@link migrateMemoryDirToEncrypted}.\n * It only touches files under the same storage-managed roots, skips\n * plaintext files, skips symlinks, excludes `.secure-store/`, and writes\n * each plaintext replacement via temp-file + rename so a per-file failure\n * leaves the ciphertext intact.\n */\nexport async function decryptMemoryDirToPlaintext(dir: string, key: Buffer): Promise<DecryptResult> {\n  const result: DecryptResult = { decrypted: 0, skipped: 0, errors: [] };\n\n  const files = await collectStorageManagedFiles(dir, isDecryptableStoragePath);\n  for (const filePath of files) {\n    try {\n      const buf = await readFile(filePath);\n      if (!isEncryptedFile(buf)) {\n        result.skipped++;\n        continue;\n      }\n\n      const plaintext = decryptFileBodyForPath(buf, key, filePath, dir);\n      const tempPath = uniqueAtomicTempPath(filePath, \"dec-tmp\");\n      try {\n        await writeFile(tempPath, plaintext, { mode: 0o600 });\n        await rename(tempPath, filePath);\n        result.decrypted++;\n      } catch (writeErr) {\n        try {\n          await unlink(tempPath);\n        } catch {\n          // ignore cleanup errors; original ciphertext is still intact.\n        }\n        throw writeErr;\n      }\n    } catch (err) {\n      result.errors.push({\n        filePath,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction uniqueAtomicTempPath(filePath: string, label: string): string {\n  return `${filePath}.${label}-${process.pid}-${Date.now()}-${randomUUID()}`;\n}\n\nfunction decryptFileBodyForPath(buf: Buffer, key: Buffer, filePath: string, memoryDir?: string): Buffer {\n  const aad = filePathAad(filePath, memoryDir);\n  try {\n    return decryptFileBody(buf, key, aad);\n  } catch (err) {\n    if (!(err instanceof SecureStoreDecryptError)) {\n      throw err;\n    }\n    const legacyRoot = legacyNamespaceAadRootForFile(filePath, memoryDir);\n    if (legacyRoot) {\n      try {\n        return decryptFileBody(buf, key, filePathAad(filePath, legacyRoot));\n      } catch {\n        // Fall through to the namespace-reader fallback below.\n      }\n    }\n\n    const topLevelRoot = topLevelAadRootForNamespaceReader(filePath, memoryDir);\n    if (topLevelRoot) {\n      try {\n        return decryptFileBody(buf, key, filePathAad(filePath, topLevelRoot));\n      } catch {\n        // Preserve the caller-facing error from the canonical decrypt attempt.\n      }\n    }\n\n    throw err;\n  }\n}\n\nfunction topLevelAadRootForNamespaceReader(filePath: string, memoryDir?: string): string | null {\n  if (!memoryDir || !path.isAbsolute(filePath)) return null;\n  const resolvedMemoryDir = path.resolve(memoryDir);\n  const rel = path.relative(resolvedMemoryDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return null;\n  const parts = resolvedMemoryDir.split(path.sep);\n  if (parts.length < 3 || parts.at(-2) !== \"namespaces\" || !parts.at(-1)) return null;\n  const topLevelRoot = parts.slice(0, -2).join(path.sep) || path.sep;\n  const topRel = path.relative(topLevelRoot, filePath);\n  if (topRel === \"\" || topRel.startsWith(\"..\") || path.isAbsolute(topRel)) {\n    return null;\n  }\n  const topParts = topRel.split(path.sep);\n  if (topParts[0] !== \"namespaces\" || topParts[1] !== parts.at(-1)) {\n    return null;\n  }\n  return topLevelRoot;\n}\n\nfunction legacyNamespaceAadRootForFile(filePath: string, memoryDir?: string): string | null {\n  if (!memoryDir || !path.isAbsolute(filePath)) return null;\n  const rel = path.relative(memoryDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return null;\n  const parts = rel.split(path.sep);\n  if (parts[0] === \"namespaces\" && parts.length >= 3 && parts[1]) {\n    return path.join(memoryDir, \"namespaces\", parts[1]);\n  }\n  return null;\n}\n\n/**\n * Recursively collect files under `dir` that are read through the\n * storage-layer secure-store helpers, excluding symlinked entries and\n * `.secure-store/` metadata.\n */\nasync function collectEncryptableStorageFiles(dir: string, rootDir = dir): Promise<string[]> {\n  return collectStorageManagedFiles(dir, isEncryptableStoragePath, rootDir);\n}\n\n/**\n * Recursively collect regular files under storage-managed roots, excluding\n * symlinked entries and `.secure-store/` metadata. This broader collector is\n * used by the decrypt/disable path so future encrypted sidecars can be\n * restored without requiring extension-specific logic.\n */\nasync function collectStorageManagedFiles(\n  dir: string,\n  includeFile: (filePath: string, rootDir: string) => boolean,\n  rootDir = dir\n): Promise<string[]> {\n  const results: string[] = [];\n  let scanDir = dir;\n  let scanRootDir = rootDir;\n  if (path.resolve(dir) === path.resolve(rootDir)) {\n    const normalizedRoot = await resolveStorageManagedRootForScan(dir);\n    if (!normalizedRoot) return results;\n    scanDir = normalizedRoot;\n    scanRootDir = normalizedRoot;\n  }\n  let names: string[];\n  try {\n    names = await readdir(scanDir, { encoding: \"utf8\" });\n  } catch {\n    return results;\n  }\n  for (const name of names) {\n    if (name.startsWith(\".secure-store\")) continue;\n    const full = path.join(scanDir, name);\n    let isDir = false;\n    let isFile = false;\n    try {\n      const s = await lstat(full);\n      if (s.isSymbolicLink()) continue;\n      isDir = s.isDirectory();\n      isFile = s.isFile();\n    } catch {\n      continue;\n    }\n    if (isDir) {\n      const sub = await collectStorageManagedFiles(full, includeFile, scanRootDir);\n      results.push(...sub);\n    } else if (isFile && includeFile(full, scanRootDir)) {\n      results.push(full);\n    }\n  }\n  return results;\n}\n\nasync function resolveStorageManagedRootForScan(dir: string): Promise<string | null> {\n  const lstatPath = normalizePathForLstat(dir);\n  let stat: Awaited<ReturnType<typeof lstat>>;\n  try {\n    stat = await lstat(lstatPath);\n  } catch (error) {\n    if (isFsErrorWithCode(error, \"ENOENT\")) return null;\n    throw error;\n  }\n  if (stat.isSymbolicLink()) {\n    throw new Error(`secure-store migration root must not be a symlink: ${dir}`);\n  }\n  if (!stat.isDirectory()) {\n    throw new Error(`secure-store migration root must be a directory: ${dir}`);\n  }\n  return lstatPath;\n}\n\nfunction normalizePathForLstat(filePath: string): string {\n  return stripTrailingPathSeparators(path.normalize(filePath));\n}\n\nfunction isFsErrorWithCode(error: unknown, code: string): boolean {\n  return typeof error === \"object\" && error !== null && (error as { code?: unknown }).code === code;\n}\n\nfunction stripTrailingPathSeparators(filePath: string): string {\n  const root = path.parse(filePath).root;\n  let end = filePath.length;\n  while (\n    end > root.length &&\n    (filePath[end - 1] === path.sep || filePath[end - 1] === path.posix.sep || filePath[end - 1] === path.win32.sep)\n  ) {\n    end -= 1;\n  }\n  return end === filePath.length ? filePath : filePath.slice(0, end);\n}\n\nfunction isEncryptableStoragePath(filePath: string, rootDir: string): boolean {\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  if (normalized === \"profile.md\") return true;\n  if (isEncryptableStateSidecar(normalized)) return true;\n  if (isEncryptableSummarySidecar(normalized)) return true;\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS.has(firstSegment) && normalized.endsWith(\".md\");\n}\n\nfunction isDecryptableStoragePath(filePath: string, rootDir: string): boolean {\n  if (isEncryptableStoragePath(filePath, rootDir)) return true;\n  const rel = path.relative(rootDir, filePath);\n  if (rel === \"\" || rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n  const normalized = normalizeStorageRelativePath(rel);\n  const firstSegment = normalized.split(\"/\", 1)[0];\n  return DECRYPTABLE_SIDECAR_ROOTS.has(firstSegment);\n}\n\nfunction normalizeStorageRelativePath(rel: string): string {\n  const normalized = rel.split(path.sep).join(\"/\");\n  const parts = normalized.split(\"/\");\n  if (parts[0] === \"namespaces\" && parts.length >= 3) {\n    return parts.slice(2).join(\"/\");\n  }\n  return normalized;\n}\n\n// Every recall MEMORY category directory (facts/ + the CATEGORY_DIR_MAP memory\n// dirs) must be encryptable at rest — #1546 routes decision/preference/moment/...\n// memories into their own dirs, so hardcoding only facts/corrections/procedures/\n// reasoning-traces would silently write those categories in plaintext on\n// encrypted stores. RECALL_FALLBACK_DIRS is the single source of truth for that\n// set; the extra non-category markdown roots (artifacts/archive/entities/\n// identity) are appended.\n//\n// questions/ is deliberately EXCLUDED (RECALL_FALLBACK_DIRS omits the non-memory\n// queue dirs): the question queue is written/resolved through plain readFile/\n// writeFile (StorageManager.writeQuestion/resolveQuestion), NOT the secure-file\n// helpers. Encrypting questions/ here would make migration seal those files,\n// after which resolveQuestion() would read ciphertext as UTF-8, fail to update\n// the frontmatter, and overwrite/corrupt the file while returning success\n// (codex #1563 review). Keeping questions/ plaintext preserves the queue's\n// existing behavior; #1546 does not change question encryption.\nconst ENCRYPTABLE_MARKDOWN_STORAGE_ROOTS = new Set<string>([\n  ...RECALL_FALLBACK_DIRS,\n  \"artifacts\",\n  \"archive\",\n  \"entities\",\n  \"identity\",\n]);\n\nconst ENCRYPTABLE_STATE_SIDECARS = new Set([\n  \"state/behavior-signals.jsonl\",\n  \"state/buffer-surprise-ledger.jsonl\",\n  \"state/buffer.json\",\n  \"state/compression-guideline-draft-state.json\",\n  \"state/compression-guideline-state.json\",\n  \"state/compression-guidelines.draft.md\",\n  \"state/compression-guidelines.md\",\n  \"state/entity-synthesis-queue.json\",\n  \"state/fact-hashes.txt\",\n  \"state/memory-actions.jsonl\",\n  \"state/memory-lifecycle-ledger.jsonl\",\n  \"state/meta.json\",\n  \"state/reextract-jobs.jsonl\",\n  \"state/topics.json\",\n]);\n\nfunction isEncryptableStateSidecar(normalized: string): boolean {\n  return ENCRYPTABLE_STATE_SIDECARS.has(normalized);\n}\n\nfunction isEncryptableSummarySidecar(normalized: string): boolean {\n  return normalized.startsWith(\"summaries/\") && normalized.endsWith(\".json\");\n}\n\nconst DECRYPTABLE_SIDECAR_ROOTS = new Set([\"state\", \"indexes\", \"index\", \"provenance\"]);\n"],"mappings":";;;;;;;;;;;;;;;;;AA6CA,SAAS,gBAAgB,aAAa,kBAAkB;AACxD,SAAS,OAAO,OAAO,QAAQ,UAAU,UAAU,SAAS,QAAQ,QAAQ,iBAAiB;AAC7F,OAAO,UAAU;AAyBV,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,UAAU,6EAAwE;AAC5F,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,0BAAN,cAAsC,MAAM;AAAA,EACjD,YAAY,UAAU,0EAAqE;AACzF,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,cAAc,OAAO,KAAK,cAAc,OAAO;AAGrD,IAAM,sBAAsB;AAG5B,IAAM,oBAAoB;AAG1B,IAAM,oBAAoB,YAAY,SAAS;AAU/C,SAAS,gBAAgB,KAA0B;AACxD,MAAI,IAAI,SAAS,kBAAmB,QAAO;AAC3C,QAAM,IAAI,OAAO,SAAS,GAAG,IAAI,MAAM,OAAO,KAAK,GAAG;AACtD,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,EAAE,OAAO,WAAW;AAC7D;AAgBO,SAAS,gBAAgB,OAAwB,KAAa,KAAsB;AACzF,QAAM,WAAW,OAAO,UAAU,WAAW,OAAO,KAAK,OAAO,MAAM,IAAI;AAC1E,QAAM,OAAO,aAAa;AAC1B,QAAM,WAAW,KAAK,KAAK,MAAM,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAE7D,QAAM,SAAS,OAAO,MAAM,iBAAiB;AAC7C,cAAY,KAAK,QAAQ,CAAC;AAC1B,SAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,SAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAE3D,SAAO,OAAO,OAAO,CAAC,QAAQ,QAAQ,CAAC;AACzC;AAUO,SAAS,gBAAgB,KAAa,KAAa,KAAsB;AAC9E,MAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,IAAI,UAAU,YAAY,MAAM;AAChD,MAAI,YAAY,qBAAqB;AACnC,UAAM,IAAI;AAAA,MACR,oDAAoD,OAAO,yBAAyB,mBAAmB;AAAA,IACzG;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,UAAU,YAAY,SAAS,CAAC;AAClD,MAAI,UAAU,mBAAmB;AAC/B,UAAM,IAAI,MAAM,yCAAyC,MAAM,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,WAAW,IAAI,SAAS,iBAAiB;AAC/C,gBAAc,QAAQ;AACtB,MAAI;AACF,WAAO,KAAa,KAAK,UAAU,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAM,IAAI,wBAAwB,mCAAmC,GAAG,EAAE;AAAA,EAC5E;AACF;AAEA,SAAS,eAAe,MAA0B;AAChD,QAAM,MAAM,OAAO,MAAM,IAAI,oBAAoB;AACjD,MAAI,WAAW,kBAAkB,CAAC;AAClC,SAAO,KAAK,IAAI,EAAE,KAAK,KAAK,CAAC;AAC7B,SAAO;AACT;AAcO,SAAS,YAAY,UAAkB,WAA4B;AACxE,MAAI,MAAM;AACV,MAAI,aAAa,KAAK,WAAW,QAAQ,GAAG;AAC1C,UAAM,KAAK,SAAS,WAAW,QAAQ;AAAA,EACzC;AACA,SAAO,OAAO,KAAK,KAAK,MAAM;AAChC;AAoBA,eAAsB,6BACpB,UACA,KACA,WACiB;AACjB,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI,CAAC,gBAAgB,GAAG,GAAG;AAEzB,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI;AAAA,MACR,+DAA0D,QAAQ;AAAA,IACpE;AAAA,EACF;AACA,SAAO,uBAAuB,KAAK,KAAK,UAAU,SAAS;AAC7D;AAEA,eAAsB,uBACpB,UACA,KACA,WACiB;AACjB,UAAQ,MAAM,6BAA6B,UAAU,KAAK,SAAS,GAAG,SAAS,MAAM;AACvF;AAyBA,eAAsB,wBACpB,UACA,SACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAEvD,MAAI;AACJ,MAAI,QAAQ,MAAM;AAChB,UAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,WAAO,gBAAgB,SAAS,KAAK,GAAG;AAAA,EAC1C,OAAO;AACL,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ;AACV,UAAM,WAAW,qBAAqB,UAAU,KAAK;AACrD,QAAI;AACF,YAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AACxC,YAAM,OAAO,UAAU,QAAQ;AAAA,IACjC,SAAS,KAAK;AAEZ,UAAI;AACF,cAAM,OAAO,QAAQ;AAAA,MACvB,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,UAAU,UAAU,MAAM,EAAE,KAAK,CAAC;AAAA,EAC1C;AACF;AAEA,eAAsB,kCACpB,UACA,QACA,KACA,UAA0C,CAAC,GAC3C,WACe;AACf,QAAM,EAAE,OAAO,KAAO,SAAS,KAAK,IAAI;AACxC,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,YAAY,SAAS,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,KAAK;AAC5E,MAAI,YAAY;AAChB,MAAI;AACF,UAAM,SAAS,MAAM,SAAS,WAAW,KAAK,IAAI;AAClD,QAAI;AACF,UAAI,QAAQ,MAAM;AAChB,cAAM,OAAO,aAAa;AAC1B,cAAM,KAAK,YAAY,SAAS;AAChC,cAAM,SAAS,OAAO,MAAM,oBAAoB,oBAAoB;AACpE,oBAAY,KAAK,QAAQ,CAAC;AAC1B,eAAO,WAAW,qBAAqB,YAAY,MAAM;AACzD,eAAO,WAAW,mBAAmB,YAAY,SAAS,CAAC;AAC3D,cAAM,iBAAiB;AACvB,eAAO,WAAW,kBAAkB,iBAAiB,gBAAgB,OAAO;AAC5E,aAAK,KAAK,QAAQ,iBAAiB,gBAAgB,IAAI;AACvD,WAAG,KAAK,QAAQ,iBAAiB,gBAAgB,EAAE;AACnD,cAAM,OAAO,MAAM,MAAM;AAEzB,cAAM,SAAS,eAAe,eAAe,KAAK,IAAI,EAAE,eAAe,gBAAgB,CAAC;AACxF,cAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,eAAO,OAAO,OAAO,OAAO,CAAC,eAAe,IAAI,GAAG,GAAG,CAAC,CAAC;AACxD,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,WAAW,EAAG;AACxB,gBAAM,YAAY,OAAO,OAAO,KAAK;AACrC,cAAI,UAAU,SAAS,EAAG,OAAM,OAAO,MAAM,SAAS;AAAA,QACxD;AACA,cAAM,QAAQ,OAAO,MAAM;AAC3B,YAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAC9C,cAAM,UAAU,OAAO,WAAW;AAClC,cAAM,OAAO,MAAM,SAAS,GAAG,QAAQ,QAAQ,oBAAoB,gBAAgB,OAAO;AAAA,MAC5F,OAAO;AACL,yBAAiB,SAAS,QAAQ;AAChC,cAAI,MAAM,SAAS,EAAG,OAAM,OAAO,MAAM,KAAK;AAAA,QAChD;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,QAAI,QAAQ;AACV,YAAM,OAAO,WAAW,QAAQ;AAAA,IAClC;AACA,gBAAY;AAAA,EACd,UAAE;AACA,QAAI,CAAC,aAAa,QAAQ;AACxB,YAAM,OAAO,SAAS,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACxC;AAAA,EACF;AACF;AA6CA,eAAsB,4BACpB,KACA,KACA,iBACwB;AACxB,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,+BAA+B,GAAG;AACtD,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,gBAAgB,GAAG,GAAG;AACxB,eAAO;AACP;AAAA,MACF;AAEA,UAAI,iBAAiB;AACnB,YAAI;AACF,gBAAM,gBAAgB,QAAQ;AAAA,QAChC,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM,UAAU,IAAI,SAAS,MAAM;AACnC,YAAM,MAAM,YAAY,UAAU,GAAG;AACrC,YAAM,YAAY,gBAAgB,SAAS,KAAK,GAAG;AAGnD,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AAEjB,YAAI;AACF,gBAAM,EAAE,QAAAA,QAAO,IAAI,MAAM,OAAO,aAAkB;AAClD,gBAAMA,QAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAYA,eAAsB,4BAA4B,KAAa,KAAqC;AAClG,QAAM,SAAwB,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE;AAErE,QAAM,QAAQ,MAAM,2BAA2B,KAAK,wBAAwB;AAC5E,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,UAAI,CAAC,gBAAgB,GAAG,GAAG;AACzB,eAAO;AACP;AAAA,MACF;AAEA,YAAM,YAAY,uBAAuB,KAAK,KAAK,UAAU,GAAG;AAChE,YAAM,WAAW,qBAAqB,UAAU,SAAS;AACzD,UAAI;AACF,cAAM,UAAU,UAAU,WAAW,EAAE,MAAM,IAAM,CAAC;AACpD,cAAM,OAAO,UAAU,QAAQ;AAC/B,eAAO;AAAA,MACT,SAAS,UAAU;AACjB,YAAI;AACF,gBAAM,OAAO,QAAQ;AAAA,QACvB,QAAQ;AAAA,QAER;AACA,cAAM;AAAA,MACR;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,OAAO,KAAK;AAAA,QACjB;AAAA,QACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAMA,SAAS,qBAAqB,UAAkB,OAAuB;AACrE,SAAO,GAAG,QAAQ,IAAI,KAAK,IAAI,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,WAAW,CAAC;AAC1E;AAEA,SAAS,uBAAuB,KAAa,KAAa,UAAkB,WAA4B;AACtG,QAAM,MAAM,YAAY,UAAU,SAAS;AAC3C,MAAI;AACF,WAAO,gBAAgB,KAAK,KAAK,GAAG;AAAA,EACtC,SAAS,KAAK;AACZ,QAAI,EAAE,eAAe,0BAA0B;AAC7C,YAAM;AAAA,IACR;AACA,UAAM,aAAa,8BAA8B,UAAU,SAAS;AACpE,QAAI,YAAY;AACd,UAAI;AACF,eAAO,gBAAgB,KAAK,KAAK,YAAY,UAAU,UAAU,CAAC;AAAA,MACpE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM,eAAe,kCAAkC,UAAU,SAAS;AAC1E,QAAI,cAAc;AAChB,UAAI;AACF,eAAO,gBAAgB,KAAK,KAAK,YAAY,UAAU,YAAY,CAAC;AAAA,MACtE,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,kCAAkC,UAAkB,WAAmC;AAC9F,MAAI,CAAC,aAAa,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AACrD,QAAM,oBAAoB,KAAK,QAAQ,SAAS;AAChD,QAAM,MAAM,KAAK,SAAS,mBAAmB,QAAQ;AACrD,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,kBAAkB,MAAM,KAAK,GAAG;AAC9C,MAAI,MAAM,SAAS,KAAK,MAAM,GAAG,EAAE,MAAM,gBAAgB,CAAC,MAAM,GAAG,EAAE,EAAG,QAAO;AAC/E,QAAM,eAAe,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,KAAK,GAAG,KAAK,KAAK;AAC/D,QAAM,SAAS,KAAK,SAAS,cAAc,QAAQ;AACnD,MAAI,WAAW,MAAM,OAAO,WAAW,IAAI,KAAK,KAAK,WAAW,MAAM,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,MAAM,KAAK,GAAG;AACtC,MAAI,SAAS,CAAC,MAAM,gBAAgB,SAAS,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG;AAChE,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,8BAA8B,UAAkB,WAAmC;AAC1F,MAAI,CAAC,aAAa,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AACrD,QAAM,MAAM,KAAK,SAAS,WAAW,QAAQ;AAC7C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,QAAQ,IAAI,MAAM,KAAK,GAAG;AAChC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG;AAC9D,WAAO,KAAK,KAAK,WAAW,cAAc,MAAM,CAAC,CAAC;AAAA,EACpD;AACA,SAAO;AACT;AAOA,eAAe,+BAA+B,KAAa,UAAU,KAAwB;AAC3F,SAAO,2BAA2B,KAAK,0BAA0B,OAAO;AAC1E;AAQA,eAAe,2BACb,KACA,aACA,UAAU,KACS;AACnB,QAAM,UAAoB,CAAC;AAC3B,MAAI,UAAU;AACd,MAAI,cAAc;AAClB,MAAI,KAAK,QAAQ,GAAG,MAAM,KAAK,QAAQ,OAAO,GAAG;AAC/C,UAAM,iBAAiB,MAAM,iCAAiC,GAAG;AACjE,QAAI,CAAC,eAAgB,QAAO;AAC5B,cAAU;AACV,kBAAc;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS,EAAE,UAAU,OAAO,CAAC;AAAA,EACrD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,eAAe,EAAG;AACtC,UAAM,OAAO,KAAK,KAAK,SAAS,IAAI;AACpC,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI;AACF,YAAM,IAAI,MAAM,MAAM,IAAI;AAC1B,UAAI,EAAE,eAAe,EAAG;AACxB,cAAQ,EAAE,YAAY;AACtB,eAAS,EAAE,OAAO;AAAA,IACpB,QAAQ;AACN;AAAA,IACF;AACA,QAAI,OAAO;AACT,YAAM,MAAM,MAAM,2BAA2B,MAAM,aAAa,WAAW;AAC3E,cAAQ,KAAK,GAAG,GAAG;AAAA,IACrB,WAAW,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,cAAQ,KAAK,IAAI;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,iCAAiC,KAAqC;AACnF,QAAM,YAAY,sBAAsB,GAAG;AAC3C,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,MAAM,SAAS;AAAA,EAC9B,SAAS,OAAO;AACd,QAAI,kBAAkB,OAAO,QAAQ,EAAG,QAAO;AAC/C,UAAM;AAAA,EACR;AACA,MAAI,KAAK,eAAe,GAAG;AACzB,UAAM,IAAI,MAAM,sDAAsD,GAAG,EAAE;AAAA,EAC7E;AACA,MAAI,CAAC,KAAK,YAAY,GAAG;AACvB,UAAM,IAAI,MAAM,oDAAoD,GAAG,EAAE;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAA0B;AACvD,SAAO,4BAA4B,KAAK,UAAU,QAAQ,CAAC;AAC7D;AAEA,SAAS,kBAAkB,OAAgB,MAAuB;AAChE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAS,MAA6B,SAAS;AAC/F;AAEA,SAAS,4BAA4B,UAA0B;AAC7D,QAAM,OAAO,KAAK,MAAM,QAAQ,EAAE;AAClC,MAAI,MAAM,SAAS;AACnB,SACE,MAAM,KAAK,WACV,SAAS,MAAM,CAAC,MAAM,KAAK,OAAO,SAAS,MAAM,CAAC,MAAM,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC,MAAM,KAAK,MAAM,MAC5G;AACA,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,SAAS,SAAS,WAAW,SAAS,MAAM,GAAG,GAAG;AACnE;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,MAAI,eAAe,aAAc,QAAO;AACxC,MAAI,0BAA0B,UAAU,EAAG,QAAO;AAClD,MAAI,4BAA4B,UAAU,EAAG,QAAO;AACpD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,mCAAmC,IAAI,YAAY,KAAK,WAAW,SAAS,KAAK;AAC1F;AAEA,SAAS,yBAAyB,UAAkB,SAA0B;AAC5E,MAAI,yBAAyB,UAAU,OAAO,EAAG,QAAO;AACxD,QAAM,MAAM,KAAK,SAAS,SAAS,QAAQ;AAC3C,MAAI,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AACvE,QAAM,aAAa,6BAA6B,GAAG;AACnD,QAAM,eAAe,WAAW,MAAM,KAAK,CAAC,EAAE,CAAC;AAC/C,SAAO,0BAA0B,IAAI,YAAY;AACnD;AAEA,SAAS,6BAA6B,KAAqB;AACzD,QAAM,aAAa,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AAC/C,QAAM,QAAQ,WAAW,MAAM,GAAG;AAClC,MAAI,MAAM,CAAC,MAAM,gBAAgB,MAAM,UAAU,GAAG;AAClD,WAAO,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,EAChC;AACA,SAAO;AACT;AAkBA,IAAM,qCAAqC,oBAAI,IAAY;AAAA,EACzD,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,6BAA6B,oBAAI,IAAI;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,0BAA0B,YAA6B;AAC9D,SAAO,2BAA2B,IAAI,UAAU;AAClD;AAEA,SAAS,4BAA4B,YAA6B;AAChE,SAAO,WAAW,WAAW,YAAY,KAAK,WAAW,SAAS,OAAO;AAC3E;AAEA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,SAAS,WAAW,SAAS,YAAY,CAAC;","names":["unlink"]}

package/dist/{chunk-DFAXGZKI.js → chunk-JIX3ZL2J.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-DHGSZ3UD.js";
+} from "./chunk-ARV3AUOM.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
@@ -27,7 +27,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-A7EF2XRO.js";
+} from "./chunk-EXXBA5OM.js";
 import {
   clusterByKey,
   combineNamespaces,
@@ -55,7 +55,7 @@ import {
 } from "./chunk-2MXEVL75.js";
 import {
   namespaceCollectionName
-} from "./chunk-WOQIHC67.js";
+} from "./chunk-DQY7NJ5L.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-ZFXCQPNO.js";
@@ -94,10 +94,10 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-GY3V3SUI.js";
+} from "./chunk-KHGE6PMF.js";
 import {
   parseEntityFile
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
@@ -152,10 +152,10 @@ import {
   buildOfflineSyncSnapshotFromBase,
   iterateOfflineSyncSnapshotFileRecords,
   readOfflineSyncFileContentChunk
-} from "./chunk-ZLDUQWT2.js";
+} from "./chunk-PWWWLD7D.js";
 import {
   SecureStoreLockedError
-} from "./chunk-ILXTATKK.js";
+} from "./chunk-J2HSAU72.js";
 import {
   evaluateActionConfidence
 } from "./chunk-AH2JUU6X.js";
@@ -5579,4 +5579,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-DFAXGZKI.js.map
+//# sourceMappingURL=chunk-JIX3ZL2J.js.map

package/dist/{chunk-GY3V3SUI.js → chunk-KHGE6PMF.js}

@@ -1,7 +1,7 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -870,4 +870,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-GY3V3SUI.js.map
+//# sourceMappingURL=chunk-KHGE6PMF.js.map