@remnic/core 9.3.683 → 9.3.685

package/dist/{chunk-NQMBSSWW.js → chunk-B4XVLHJA.js}

@@ -1,10 +1,10 @@
 import {
   collectNativeKnowledgeChunks
-} from "./chunk-BEUDU7Y4.js";
+} from "./chunk-ZCWIH4LH.js";
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-TY5NT3T3.js";
+} from "./chunk-BLIWOONZ.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-FVQJYWH7.js";
@@ -679,4 +679,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-NQMBSSWW.js.map
+//# sourceMappingURL=chunk-B4XVLHJA.js.map

package/dist/{chunk-GSTYVG5L.js → chunk-BFVPIKDY.js}

@@ -1,10 +1,10 @@
 import {
   parseXrayFormat
-} from "./chunk-OHX52AOS.js";
+} from "./chunk-GTDH3IUH.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-FMSDA2D3.js";
+} from "./chunk-NGFEWFNK.js";
 
 // src/recall-xray-cli.ts
 function parseXrayDisclosureFlag(value) {
@@ -50,4 +50,4 @@ export {
   parseXrayBudgetFlag,
   parseXrayCliOptions
 };
-//# sourceMappingURL=chunk-GSTYVG5L.js.map
+//# sourceMappingURL=chunk-BFVPIKDY.js.map

package/dist/{chunk-TY5NT3T3.js → chunk-BLIWOONZ.js}

@@ -16,7 +16,7 @@ import {
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-FMSDA2D3.js";
+} from "./chunk-NGFEWFNK.js";
 import {
   readProjectedGovernanceRecord,
   readProjectedMemoryBrowse,
@@ -77,6 +77,12 @@ import {
   categoryDirName,
   getCategoryDir
 } from "./chunk-VS2IYZRU.js";
+import {
+  parseProvenanceSources,
+  parseProvenanceTag,
+  reconcileProvenanceRead,
+  serializeProvenanceFields
+} from "./chunk-ZPQVJEVQ.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
@@ -84,7 +90,7 @@ import {
 } from "./chunk-4DJQYKMN.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 
 // src/storage.ts
 import { access, lstat, readdir, readFile, realpath, stat, writeFile, mkdir, unlink, appendFile, open } from "fs/promises";
@@ -344,6 +350,7 @@ function serializeFrontmatter(fm) {
   if (fm.last_reinforced_at) {
     lines.push(`last_reinforced_at: ${fm.last_reinforced_at}`);
   }
+  serializeProvenanceFields(fm, lines);
   lines.push("---");
   return lines.join("\n");
 }
@@ -631,13 +638,11 @@ function parseFrontmatter(raw) {
       // PR; no code produces these fields yet.
       derived_from,
       derived_via,
-      // Pattern-reinforcement metadata (issue #687 PR 2/4).  Parse
-      // permissively: invalid values (negative, non-integer, blank
-      // ISO-strings) are dropped to undefined so a corrupt frontmatter
-      // never poisons downstream scoring.  Validation lives on the
-      // write path in serializeFrontmatter.
+      // Pattern-reinforcement metadata (issue #687 PR 2/4) — drop corrupt values on read (rule 34).
       reinforcement_count: parseReinforcementCountField(fm.reinforcement_count),
-      last_reinforced_at: fm.last_reinforced_at || void 0
+      last_reinforced_at: fm.last_reinforced_at || void 0,
+      sources: parseProvenanceSources(fm.sources),
+      provenance: reconcileProvenanceRead(parseProvenanceTag(fm.provenance), parseProvenanceSources(fm.sources))
     },
     content
   };
@@ -1698,24 +1703,12 @@ var StorageManager = class _StorageManager {
   static allMemoriesInFlight = /* @__PURE__ */ new Map();
   // Cache for readAllColdMemories() — keyed by cold root directory path.
   // Prevents an uncached full-tree directory scan on every structured-attribute
-  // write (Finding UOGi, PR #402 round-6).  The cache is only invalidated when
-  // cold-tier content actually changes (via invalidateColdMemoriesCache), NOT
-  // on every hot-tier write.  It also expires after COLD_SCAN_CACHE_TTL_MS as
-  // a safety net.
-  //
-  // Finding UvUy (PR #402 round-11): cache entries now carry a `coldVersion`
-  // sentinel that is bumped (via a file-size counter in state/cold-write.log)
-  // on every write that modifies cold-tier content.  Before serving a cached
-  // result, readAllColdMemories() reads the sentinel from disk and compares.
-  // If they differ the entry is dropped and the cold tree is re-scanned.  This
-  // makes the cache correct across process boundaries (gateway + CLI): a second
-  // process that writes a new cold memory bumps the sentinel on disk, so the
-  // first process's next readAllColdMemories() sees the change within one call
-  // (rather than waiting up to 30s for TTL expiry).
-  //
-  // After Finding UTsP broadened readAllColdMemories to scan the entire cold/
-  // subtree (not just facts/+corrections/), amortizing this I/O across
-  // back-to-back writes in the same burst is even more important.
+  // write (Finding UOGi, PR #402 round-6). Invalidated when cold-tier content
+  // changes (via invalidateColdMemoriesCache) and expires after COLD_SCAN_CACHE_TTL_MS.
+  // Entries carry a `coldVersion` sentinel (Finding UvUy, PR #402 round-11) bumped
+  // on every cold-tier write, making the cache correct across process boundaries
+  // (gateway + CLI). After Finding UTsP broadened the scan to the entire cold/
+  // subtree, amortizing across back-to-back writes is even more important.
   static COLD_SCAN_CACHE_TTL_MS = 3e4;
   // 30 seconds
   static coldMemoriesCache = /* @__PURE__ */ new Map();
@@ -1736,6 +1729,14 @@ var StorageManager = class _StorageManager {
   offlineSyncDigestCacheWriteTimer = null;
   /** Optional: set by the orchestrator after construction to enable template-aware citation stripping during legacy hash rebuild. */
   citationTemplate = DEFAULT_CITATION_FORMAT;
+  /** Post-write catalog hook (#1522). Installed by the namespace router; fire-and-forget. */
+  onCatalogWrite;
+  notifyCatalogWrite() {
+    try {
+      this.onCatalogWrite?.();
+    } catch {
+    }
+  }
   /** Page-versioning configuration.  Set by the orchestrator after construction. */
   _versioningConfig = null;
   /** Set the page-versioning configuration.  When `enabled` is false (default), all versioning calls are no-ops. */
@@ -1957,7 +1958,7 @@ var StorageManager = class _StorageManager {
   }
   async writeWearableDayTranscript(sourceId, date, serialized) {
     const targetPath = this.wearableTranscriptPath(sourceId, date);
-    await writeMaybeEncryptedFile(targetPath, serialized, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(targetPath, serialized);
   }
   /** Read a stored day transcript; null when the day has no file. */
   async readWearableDayTranscript(sourceId, date) {
@@ -2101,7 +2102,10 @@ var StorageManager = class _StorageManager {
     return readMaybeEncryptedFile(filePath, this._secureStoreKey, this.baseDir);
   }
   writeStorageSecureFile(filePath, content) {
-    return writeMaybeEncryptedFile(filePath, content, this.resolveWriteKey(), {}, this.baseDir);
+    return writeMaybeEncryptedFile(filePath, content, this.resolveWriteKey(), {}, this.baseDir).then(() => this.notifyCatalogWrite());
+  }
+  writeStorageSecureFileChunks(filePath, chunks) {
+    return writeMaybeEncryptedFileFromChunks(filePath, chunks, this.resolveWriteKey(), {}, this.baseDir).then(() => this.notifyCatalogWrite());
   }
   assertManagedStoragePath(filePath, method) {
     const resolved = path.resolve(filePath);
@@ -2247,16 +2251,16 @@ var StorageManager = class _StorageManager {
   }
   async writeOfflineSyncFile(filePath, content) {
     const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncFile");
-    await writeMaybeEncryptedFile(target, content, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(target, content);
     await this.invalidateAfterOfflineSyncMutation(target);
   }
   async writeOfflineSyncStagingFile(filePath, content) {
     const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncStagingFile");
-    await writeMaybeEncryptedFile(target, content, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(target, content);
   }
   async writeOfflineSyncFileChunks(filePath, chunks) {
     const target = this.assertManagedStoragePath(filePath, "storage.writeOfflineSyncFileChunks");
-    await writeMaybeEncryptedFileFromChunks(target, chunks, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFileChunks(target, chunks);
     await this.invalidateAfterOfflineSyncMutation(target);
   }
   async deleteOfflineSyncFile(filePath) {
@@ -2312,12 +2316,14 @@ var StorageManager = class _StorageManager {
         if (isEncryptedFile(await readFile(filePath))) {
           const existing2 = await this.readStorageSecureFile(filePath);
           await writeMaybeEncryptedFile(filePath, `${existing2}${content}`, null, {}, this.baseDir);
+          this.notifyCatalogWrite();
           return;
         }
       } catch (err) {
         if (!isErrnoCode(err, "ENOENT")) throw err;
       }
       await appendFile(filePath, content, "utf-8");
+      this.notifyCatalogWrite();
       return;
     }
     let existing = "";
@@ -2327,6 +2333,7 @@ var StorageManager = class _StorageManager {
       if (!isErrnoCode(err, "ENOENT")) throw err;
     }
     await writeMaybeEncryptedFile(filePath, `${existing}${content}`, writeKey, {}, this.baseDir);
+    this.notifyCatalogWrite();
   }
   get stateDir() {
     return path.join(this.baseDir, "state");
@@ -2635,7 +2642,7 @@ ${sanitized.text}
 `;
     const filePath = await this.resolveCategoryWritePath(category, id, today);
     await this.snapshotBeforeWrite(filePath, "write");
-    await writeMaybeEncryptedFile(filePath, fileContent, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(filePath, fileContent);
     this.invalidateAllMemoriesCache();
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.writeMemory", {
       memoryId: id,
@@ -2772,10 +2779,10 @@ ${sanitized.text}
       return "";
     }
     const filePath = path.join(dir, `${id}.md`);
-    await writeMaybeEncryptedFile(filePath, `${serializeFrontmatter(fm)}
+    await this.writeStorageSecureFile(filePath, `${serializeFrontmatter(fm)}
 
 ${sanitized.text}
-`, this.resolveWriteKey(), {}, this.baseDir);
+`);
     const actor = typeof options.actor === "string" && options.actor.length > 0 ? options.actor : "storage.writeArtifact";
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.writeArtifact", {
       memoryId: id,
@@ -2964,7 +2971,7 @@ ${sanitized.text}
   async writeProfile(content) {
     await this.ensureDirectories();
     await this.snapshotBeforeWrite(this.profilePath, "consolidation");
-    await writeMaybeEncryptedFile(this.profilePath, content, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(this.profilePath, content);
     log.debug("updated profile.md");
   }
   /**
@@ -3482,6 +3489,7 @@ ${memory.content}
 `;
     await writeMaybeEncryptedFile(targetPath, fileContent, this.resolveWriteKey(), {}, this.baseDir);
     this.invalidateAllMemoriesCache();
+    this.notifyCatalogWrite();
   }
   async moveMemoryToPath(memory, targetPath) {
     await this.writeMemoryFileAtomic(targetPath, memory);
@@ -3552,7 +3560,7 @@ ${memory.content}
 ${memory.content}
 `;
       const destPath = path.join(destDir, path.basename(memory.path));
-      await writeMaybeEncryptedFile(destPath, fileContent, this.resolveWriteKey(), {}, this.baseDir);
+      await this.writeStorageSecureFile(destPath, fileContent);
       await unlink(memory.path);
       this.invalidateAllMemoriesCache();
       await this.appendGeneratedMemoryLifecycleEventFailOpen(
@@ -3679,7 +3687,7 @@ ${memory.content}
 
 ${sanitized.text}
 `;
-    await writeMaybeEncryptedFile(memory.path, fileContent, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(memory.path, fileContent);
     this.invalidateAllMemoriesCache();
     await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.updateMemory", {
       memoryId: id,
@@ -3711,7 +3719,7 @@ ${sanitized.text}
 
 ${memory.content}
 `;
-    await writeMaybeEncryptedFile(memory.path, fileContent, this.resolveWriteKey(), {}, this.baseDir);
+    await this.writeStorageSecureFile(memory.path, fileContent);
     this.invalidateAllMemoriesCache();
     if (memory.path.includes(`${path.sep}cold${path.sep}`)) {
       this.invalidateColdMemoriesCache();
@@ -4424,7 +4432,7 @@ ${question}
 **Context:** ${context}
 `;
     const filePath = path.join(this.questionsDir, `${id}.md`);
-    await writeFile(filePath, content, "utf-8");
+    await this.writeStorageSecureFile(filePath, content);
     log.debug(`wrote question ${id} to ${filePath}`);
     this.invalidateQuestionsCache();
     return id;
@@ -4491,7 +4499,7 @@ ${question}
     const questions = await this.readQuestions();
     const q = questions.find((q2) => q2.id === id);
     if (!q) return false;
-    let raw = await readFile(q.filePath, "utf-8");
+    let raw = await this.readStorageSecureFile(q.filePath);
     raw = raw.replace(/resolved: false/, "resolved: true");
     raw = raw.replace(
       /---\n\n/,
@@ -4500,7 +4508,7 @@ ${question}
 
 `
     );
-    await writeFile(q.filePath, raw, "utf-8");
+    await this.writeStorageSecureFile(q.filePath, raw);
     log.debug(`resolved question ${id}`);
     return true;
   }
@@ -5370,7 +5378,7 @@ ${sanitized.text}
 ${oldMemory.content}
 `;
     try {
-      await writeMaybeEncryptedFile(oldMemory.path, fileContent, this.resolveWriteKey(), {}, this.baseDir);
+      await this.writeStorageSecureFile(oldMemory.path, fileContent);
       await this.appendGeneratedMemoryLifecycleEventFailOpen("storage.supersedeMemory", {
         memoryId: oldMemoryId,
         eventType: "superseded",
@@ -5580,4 +5588,4 @@ export {
   serializeEntityFile,
   StorageManager
 };
-//# sourceMappingURL=chunk-TY5NT3T3.js.map
+//# sourceMappingURL=chunk-BLIWOONZ.js.map