@remnic/core 9.3.692 → 9.3.693

package/dist/access-boundary.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { d as EngramAccessService } from './access-service-DvApf9LZ.js';
+import { f as EngramAccessService } from './access-service-DxCpgyVW.js';
 import './storage.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
@@ -96,7 +96,7 @@ import './action-confidence.js';
  * lands; the fitness test in `access-surface-catalog.test.ts` treats the
  * registered set as the migration state.
  */
-type OperationName = "memory_get" | "memory_search" | "memory_store" | "coding_decision" | "coding_architecture";
+type OperationName = "memory_get" | "memory_search" | "memory_store" | "coding_decision" | "coding_architecture" | "coding_delta";
 /**
  * Per-call context. `service` is the facade the handler delegates to; the
  * boundary never reaches past it. `authenticatedPrincipal` is resolved by

package/dist/access-boundary.js

@@ -7,8 +7,8 @@ import {
   getOperation,
   listRegisteredOperations,
   normalizeOptionalPath
-} from "./chunk-2EN5WZQB.js";
-import "./chunk-V56S3A23.js";
+} from "./chunk-5HGPDRQZ.js";
+import "./chunk-MQTPUPLP.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-ARV3AUOM.js";
@@ -16,7 +16,7 @@ import "./chunk-2D27ODNX.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
-import "./chunk-7MOTEVAA.js";
+import "./chunk-HRUULBBV.js";
 import "./chunk-RS25QOKZ.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-FF4KLI5W.js";

package/dist/access-cli.js

@@ -1,6 +1,6 @@
 import {
   Orchestrator
-} from "./chunk-W4MICQIZ.js";
+} from "./chunk-F7BVJ3IE.js";
 import "./chunk-5KBNNUXS.js";
 import "./chunk-6C2BMUZA.js";
 import "./chunk-666A3MOW.js";
@@ -125,14 +125,14 @@ import "./chunk-K6MV3TRQ.js";
 import "./chunk-LBJBNWS2.js";
 import "./chunk-OADWQ5CR.js";
 import "./chunk-7WV3F5DQ.js";
-import "./chunk-NEILAC3H.js";
+import "./chunk-JNKH2XWQ.js";
 import "./chunk-UDJLF3BO.js";
 import {
   getOperation
-} from "./chunk-2EN5WZQB.js";
+} from "./chunk-5HGPDRQZ.js";
 import {
   EngramAccessService
-} from "./chunk-V56S3A23.js";
+} from "./chunk-MQTPUPLP.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-ARV3AUOM.js";
@@ -142,7 +142,7 @@ import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
 import {
   projectTagProjectId
-} from "./chunk-7MOTEVAA.js";
+} from "./chunk-HRUULBBV.js";
 import "./chunk-RS25QOKZ.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-FF4KLI5W.js";
@@ -313,6 +313,7 @@ function usage() {
     "  engram-access store [options]",
     "  engram-access decision [options]",
     "  engram-access architecture [options]",
+    "  engram-access delta [options]",
     "",
     "Browse options:",
     "  --namespace <name>",
@@ -421,6 +422,17 @@ var COMMAND_SPECS = {
       "repo-root"
     ]),
     flagOptions: /* @__PURE__ */ new Set()
+  },
+  delta: {
+    valueOptions: /* @__PURE__ */ new Set([
+      "subcommand",
+      "namespace",
+      "session-key",
+      "principal",
+      "project-tag",
+      "repo-root"
+    ]),
+    flagOptions: /* @__PURE__ */ new Set()
   }
 };
 var BROWSE_SORT_VALUES = Object.freeze([
@@ -430,7 +442,7 @@ var BROWSE_SORT_VALUES = Object.freeze([
   "created_asc"
 ]);
 function isCommandName(value) {
-  return value === "browse" || value === "store" || value === "decision" || value === "architecture";
+  return value === "browse" || value === "store" || value === "decision" || value === "architecture" || value === "delta";
 }
 function parseArgs(argv) {
   const [commandRaw, ...rest] = argv;
@@ -725,6 +737,41 @@ async function runArchitecture(args, preferredId) {
   );
   console.log(JSON.stringify(output.result, null, 2));
 }
+async function runDelta(args, preferredId) {
+  const subcommand = requireOption(args, "subcommand");
+  const { config, service } = buildRuntime(preferredId);
+  const projectTag = getLastOption(args, "project-tag");
+  const sessionKey = getLastOption(args, "session-key");
+  if (sessionKey && sessionKey.trim().length > 0) {
+    const repoRoot = expandOptionalPath(getLastOption(args, "repo-root")) ?? process.cwd();
+    const projectId = projectTag && projectTag.trim().length > 0 ? projectTagProjectId(projectTag.trim()) : projectTagProjectId(path.basename(repoRoot));
+    service.setCodingContext({
+      sessionKey,
+      codingContext: {
+        projectId,
+        branch: null,
+        rootPath: repoRoot,
+        defaultBranch: null
+      }
+    });
+  }
+  const op = getOperation("coding_delta");
+  if (!op) {
+    throw new Error("access-boundary: operation not registered: coding_delta");
+  }
+  const output = await op.run(
+    {
+      subcommand,
+      namespace: getLastOption(args, "namespace"),
+      sessionKey
+    },
+    {
+      service,
+      authenticatedPrincipal: getLastOption(args, "principal") ?? config.agentAccessHttp.principal
+    }
+  );
+  console.log(JSON.stringify(output.result, null, 2));
+}
 async function main(argv = process.argv.slice(2), options = {}) {
   const args = parseArgs(argv);
   if (args.command === "browse") {
@@ -739,6 +786,10 @@ async function main(argv = process.argv.slice(2), options = {}) {
     await runArchitecture(args, options.preferredId);
     return;
   }
+  if (args.command === "delta") {
+    await runDelta(args, options.preferredId);
+    return;
+  }
   await runStore(args, options.preferredId);
 }
 function sanitizeAccessCliErrorMessage(message) {

package/dist/access-cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/access-cli.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseConfig } from \"./config.js\";\nimport type { PluginConfig } from \"./types.js\";\nimport { Orchestrator } from \"./orchestrator.js\";\nimport { EngramAccessService } from \"./access-service.js\";\nimport { readEnvVar, resolveHomeDir } from \"./runtime/env.js\";\nimport { resolvePluginEntry } from \"./plugin-entry-resolver.js\";\nimport { expandTildePath } from \"./utils/path.js\";\nimport { getOperation } from \"./access-boundary.js\";\n// Importing access-operations registers the pilot boundary operations as a\n// side effect; the store command dispatches through the registry (issue #1525).\nimport \"./access-operations.js\";\nimport { projectTagProjectId } from \"./coding/coding-namespace.js\";\n\nconst OPENCLAW_REMNIC_PLUGIN_IDS = [\"openclaw-remnic\", \"openclaw-engram\"] as const;\n\ntype CommandName = \"browse\" | \"store\" | \"decision\" | \"architecture\";\n\ntype ParsedArgs = {\n  command: CommandName;\n  options: Record<string, string[]>;\n  flags: Set<string>;\n};\n\ntype CommandSpec = {\n  valueOptions: ReadonlySet<string>;\n  flagOptions: ReadonlySet<string>;\n};\n\ntype Runtime = {\n  config: PluginConfig;\n  service: EngramAccessService;\n};\n\nexport type AccessCliOptions = {\n  /**\n   * The calling plugin's own id (e.g. `\"openclaw-engram\"` when invoked by the\n   * shim binary).  Forwarded to the plugin-entry resolver so shim CLI\n   * users target their own `plugins.entries[\"openclaw-engram\"]` block instead\n   * of accidentally resolving to the canonical `\"openclaw-remnic\"` entry when\n   * `plugins.slots.memory` is unset (#403).\n   */\n  preferredId?: string;\n};\n\nfunction getOpenClawPluginEntries(raw: Record<string, unknown>): Record<string, unknown> | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const entries =\n    plugins && plugins[\"entries\"] && typeof plugins[\"entries\"] === \"object\" && !Array.isArray(plugins[\"entries\"])\n      ? (plugins[\"entries\"] as Record<string, unknown>)\n      : undefined;\n  return entries;\n}\n\nfunction getOpenClawMemorySlotId(raw: Record<string, unknown>): string | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const slots =\n    plugins && plugins[\"slots\"] && typeof plugins[\"slots\"] === \"object\" && !Array.isArray(plugins[\"slots\"])\n      ? (plugins[\"slots\"] as Record<string, unknown>)\n      : undefined;\n  const slotId = slots?.[\"memory\"];\n  return typeof slotId === \"string\" ? slotId : undefined;\n}\n\nfunction resolveOpenClawRemnicPluginEntry(raw: unknown, preferredId?: string): Record<string, unknown> | undefined {\n  return resolvePluginEntry(raw, {\n    candidateIds: OPENCLAW_REMNIC_PLUGIN_IDS,\n    preferredId,\n    getEntries: getOpenClawPluginEntries,\n    getSlotId: getOpenClawMemorySlotId,\n  });\n}\n\nfunction hasAllowedOpenClawRemnicPluginId(value: string): boolean {\n  return (OPENCLAW_REMNIC_PLUGIN_IDS as readonly string[]).includes(value);\n}\n\ntype UsageErrorKind =\n  | \"unsupported-command\"\n  | \"unexpected-positional\"\n  | \"unknown-option\"\n  | \"invalid-option\"\n  | \"option-does-not-take-value\"\n  | \"missing-option\"\n  | \"missing-content\"\n  | \"invalid-integer\"\n  | \"invalid-number\";\n\nclass UsageError extends Error {\n  constructor(\n    readonly kind: UsageErrorKind,\n    readonly optionName?: string,\n    readonly acceptedValues?: readonly string[],\n  ) {\n    super(\"invalid access-cli arguments\");\n  }\n}\n\nfunction formatUsageError(error: UsageError): string {\n  switch (error.kind) {\n    case \"unsupported-command\":\n      return \"unsupported command\";\n    case \"unexpected-positional\":\n      return \"unexpected positional argument\";\n    case \"unknown-option\":\n      return `unknown option: --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-option\": {\n      const accepted = error.acceptedValues?.length ? `. Accepted: ${error.acceptedValues.join(\", \")}.` : \"\";\n      return `invalid value for --${error.optionName ?? \"unknown\"}${accepted}`;\n    }\n    case \"option-does-not-take-value\":\n      return `option does not accept a value: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-option\":\n      return `missing required option: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-content\":\n      return \"missing required option: --content or --content-file\";\n    case \"invalid-integer\":\n      return `invalid integer for --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-number\":\n      return `invalid number for --${error.optionName ?? \"unknown\"}`;\n  }\n}\n\nfunction writeCliOutput(text: string = \"\"): void {\n  process.stdout.write(`${text}\\n`);\n}\n\nfunction usage(): string {\n  return [\n    \"  engram-access browse [options]\",\n    \"  engram-access store [options]\",\n    \"  engram-access decision [options]\",\n    \"  engram-access architecture [options]\",\n    \"\",\n    \"Browse options:\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --query <text>\",\n    \"  --category <name>\",\n    \"  --status <name>\",\n    \"  --sort <updated_desc|updated_asc|created_desc|created_asc>\",\n    \"  --limit <n>\",\n    \"  --offset <n>\",\n    \"\",\n    \"Store options:\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --content <text> | --content-file <path>\",\n    \"  --category <name>\",\n    \"  --confidence <0-1>\",\n    \"  --tag <tag> (repeatable)\",\n    \"  --entity-ref <ref>\",\n    \"  --ttl <duration>\",\n    \"  --source-reason <text>\",\n    \"  --idempotency-key <key>\",\n    \"  --dry-run\",\n    \"\",\n    \"Decision options:\",\n    \"  --subcommand <list|get|record|supersede>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --id <id> (get/supersede)\",\n    \"  --title <title> (record/supersede)\",\n    \"  --status <proposed|accepted|superseded|rejected> (record)\",\n    \"  --context <text> (record/supersede)\",\n    \"  --decision <text> (record/supersede)\",\n    \"  --consequences <text> (record/supersede)\",\n    \"  --entity-ref <ref> (repeatable)\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --supersedes-id <id> (alias for --id on supersede)\",\n    \"\",\n    \"Architecture options:\",\n    \"  --subcommand <get|refresh>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --repo-root <path> (repo to scan for refresh; defaults to the current directory)\",\n  ].join(\"\\n\");\n}\n\nconst COMMAND_SPECS: Record<CommandName, CommandSpec> = {\n  browse: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"principal\",\n      \"query\",\n      \"category\",\n      \"status\",\n      \"sort\",\n      \"limit\",\n      \"offset\",\n    ]),\n    flagOptions: new Set(),\n  },\n  store: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"content\",\n      \"content-file\",\n      \"category\",\n      \"confidence\",\n      \"tag\",\n      \"entity-ref\",\n      \"ttl\",\n      \"source-reason\",\n      \"idempotency-key\",\n    ]),\n    flagOptions: new Set([\"dry-run\"]),\n  },\n  decision: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"id\",\n      \"title\",\n      \"status\",\n      \"context\",\n      \"decision\",\n      \"consequences\",\n      \"entity-ref\",\n      \"project-tag\",\n      \"supersedes-id\",\n    ]),\n    flagOptions: new Set(),\n  },\n  architecture: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n};\nconst BROWSE_SORT_VALUES = Object.freeze([\n  \"updated_desc\",\n  \"updated_asc\",\n  \"created_desc\",\n  \"created_asc\",\n] as const);\n\ntype BrowseSort = (typeof BROWSE_SORT_VALUES)[number];\n\n/**\n * Type guard for {@link CommandName}. Enumerating the union (rather than a\n * bare `value in COMMAND_SPECS`) is what lets TypeScript NARROW the string\n * to `CommandName` — the `in` operator alone yields TS2322 on the\n * `command: commandRaw` assignment below (codex review P2).\n */\nfunction isCommandName(value: string): value is CommandName {\n  return value === \"browse\" || value === \"store\" || value === \"decision\" || value === \"architecture\";\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const [commandRaw, ...rest] = argv;\n  if (!isCommandName(commandRaw)) {\n    throw new UsageError(\"unsupported-command\");\n  }\n  const spec = COMMAND_SPECS[commandRaw];\n\n  const options: Record<string, string[]> = {};\n  const flags = new Set<string>();\n\n  for (let i = 0; i < rest.length; i += 1) {\n    const token = rest[i];\n    if (!token.startsWith(\"--\")) {\n      throw new UsageError(\"unexpected-positional\");\n    }\n    const rawKey = token.slice(2);\n    if (!rawKey) {\n      throw new UsageError(\"unknown-option\", rawKey);\n    }\n    const equalsIndex = rawKey.indexOf(\"=\");\n    const key = equalsIndex === -1 ? rawKey : rawKey.slice(0, equalsIndex);\n    const inlineValue = equalsIndex === -1 ? undefined : rawKey.slice(equalsIndex + 1);\n\n    if (!spec.valueOptions.has(key) && !spec.flagOptions.has(key)) {\n      throw new UsageError(\"unknown-option\", key);\n    }\n\n    if (spec.flagOptions.has(key)) {\n      if (inlineValue !== undefined) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      const next = rest[i + 1];\n      if (next && !next.startsWith(\"--\")) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      flags.add(key);\n      continue;\n    }\n\n    if (inlineValue !== undefined) {\n      if (inlineValue.length === 0) {\n        throw new UsageError(\"missing-option\", key);\n      }\n      if (!options[key]) {\n        options[key] = [];\n      }\n      options[key].push(inlineValue);\n      continue;\n    }\n\n    const next = rest[i + 1];\n    if (next === undefined || next.length === 0 || next.startsWith(\"--\")) {\n      throw new UsageError(\"missing-option\", key);\n    }\n    if (!options[key]) {\n      options[key] = [];\n    }\n    options[key].push(next);\n    i += 1;\n  }\n\n  return {\n    command: commandRaw,\n    options,\n    flags,\n  };\n}\n\nfunction getLastOption(args: ParsedArgs, name: string): string | undefined {\n  const values = args.options[name];\n  if (!values || values.length === 0) return undefined;\n  return values[values.length - 1];\n}\n\nfunction getAllOptions(args: ParsedArgs, name: string): string[] {\n  return args.options[name] ?? [];\n}\n\nfunction requireOption(args: ParsedArgs, name: string): string {\n  const value = getLastOption(args, name);\n  if (!value || value.trim().length === 0) {\n    throw new UsageError(\"missing-option\", name);\n  }\n  return value;\n}\n\nfunction parseIntegerOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?\\d+$/.test(trimmed)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isSafeInteger(value)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-option\", name, [`integer >= ${options.min}`]);\n  }\n  return value;\n}\n\nfunction parseBrowseSortOption(args: ParsedArgs, name: string): BrowseSort | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  if ((BROWSE_SORT_VALUES as readonly string[]).includes(raw)) {\n    return raw as BrowseSort;\n  }\n  throw new UsageError(\"invalid-option\", name, BROWSE_SORT_VALUES);\n}\n\nfunction parseFloatOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number; max?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?(?:(?:\\d+\\.?\\d*)|(?:\\.\\d+))(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isFinite(value)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.max !== undefined && value > options.max) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  return value;\n}\n\nfunction loadPluginConfig(preferredId?: string): Record<string, unknown> {\n  const configPath =\n    expandOptionalPath(readEnvVar(\"OPENCLAW_CONFIG_PATH\")) ||\n    expandOptionalPath(readEnvVar(\"OPENCLAW_ENGRAM_CONFIG_PATH\")) ||\n    path.join(resolveHomeDir(), \".openclaw\", \"openclaw.json\");\n  const raw = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n  const slotId =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? getOpenClawMemorySlotId(raw as Record<string, unknown>)\n      : undefined;\n  if (typeof slotId === \"string\" && !hasAllowedOpenClawRemnicPluginId(slotId)) {\n    throw new Error(\n      `OpenClaw memory slot points to non-Remnic plugin \"${slotId}\"; refusing to use default Remnic access config.`,\n    );\n  }\n  // Delegate slot → preferredId → canonical → legacy resolution to the\n  // generic helper so all config loaders stay in sync (#403).  Shim CLI\n  // callers pass `preferredId: \"openclaw-engram\"` so legacy shim installs\n  // target their own config block instead of falling through to the canonical\n  // \"openclaw-remnic\" entry.\n  const entry = resolveOpenClawRemnicPluginEntry(raw, preferredId);\n  if (!entry) {\n    throw new Error(\n      \"OpenClaw config does not contain an allowed Remnic plugin entry; refusing to use default Remnic access config.\",\n    );\n  }\n  return (entry?.[\"config\"] as Record<string, unknown> | undefined) ?? {};\n}\n\nfunction buildRuntime(preferredId?: string): Runtime {\n  const config = parseConfig(loadPluginConfig(preferredId));\n  return {\n    config,\n    service: new EngramAccessService(new Orchestrator(config)),\n  };\n}\n\nasync function runBrowse(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const browseArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    principal: getLastOption(args, \"principal\"),\n    query: getLastOption(args, \"query\"),\n    category: getLastOption(args, \"category\"),\n    status: getLastOption(args, \"status\"),\n    sort: parseBrowseSortOption(args, \"sort\"),\n    limit: parseIntegerOption(args, \"limit\", { min: 1 }),\n    offset: parseIntegerOption(args, \"offset\", { min: 0 }),\n  };\n  const { config, service } = buildRuntime(preferredId);\n  const request = {\n    namespace: browseArgs.namespace,\n    authenticatedPrincipal: browseArgs.principal ?? config.agentAccessHttp.principal,\n    query: browseArgs.query,\n    category: browseArgs.category,\n    status: browseArgs.status,\n    sort: browseArgs.sort,\n    limit: browseArgs.limit,\n    offset: browseArgs.offset,\n  };\n  const result = await service.memoryBrowse(request);\n  console.log(JSON.stringify(result, null, 2));\n}\n\nasync function runStore(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const contentFile = getLastOption(args, \"content-file\");\n  const inlineContent = getLastOption(args, \"content\");\n  const content = contentFile\n    ? fs.readFileSync(expandTildePath(contentFile), \"utf8\")\n    : inlineContent;\n  if (!content || content.trim().length === 0) {\n    throw new UsageError(\"missing-content\");\n  }\n  const storeArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    sessionKey: getLastOption(args, \"session-key\"),\n    content,\n    category: requireOption(args, \"category\"),\n    confidence: parseFloatOption(args, \"confidence\", { min: 0, max: 1 }),\n    tags: getAllOptions(args, \"tag\"),\n    entityRef: getLastOption(args, \"entity-ref\"),\n    ttl: getLastOption(args, \"ttl\"),\n    sourceReason: getLastOption(args, \"source-reason\"),\n    idempotencyKey: getLastOption(args, \"idempotency-key\"),\n    dryRun: args.flags.has(\"dry-run\"),\n  };\n\n  const { config, service } = buildRuntime(preferredId);\n  // Migrated through the access boundary (issue #1525): the store command\n  // dispatches through the same registry entry as the MCP tool and HTTP\n  // route, so validation/normalization is owned in ONE place. The CLI has no\n  // write-quota hook (it is a one-shot process), so no hooks are forwarded.\n  const op = getOperation(\"memory_store\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: memory_store\");\n  }\n  const output = (await op.run(\n    {\n      namespace: storeArgs.namespace,\n      sessionKey: storeArgs.sessionKey,\n      content: storeArgs.content,\n      category: storeArgs.category,\n      confidence: storeArgs.confidence,\n      tags: storeArgs.tags,\n      entityRef: storeArgs.entityRef,\n      ttl: storeArgs.ttl,\n      sourceReason: storeArgs.sourceReason,\n      idempotencyKey: storeArgs.idempotencyKey,\n      dryRun: storeArgs.dryRun,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nfunction expandOptionalPath(value: string | undefined): string | undefined {\n  return value === undefined ? undefined : expandTildePath(value);\n}\n\n/**\n * Decision-record surface (issue #1548 Track A PR 2). Dispatches through the\n * same `coding_decision` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDecision(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // The CLI creates a fresh Orchestrator per invocation, so the session\n  // coding-context map is empty. If --project-tag + --session-key are\n  // provided, attach a coding context BEFORE dispatching so the gate\n  // passes and project-scoped writes resolve to the right namespace\n  // (review P2).\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (projectTag && projectTag.trim().length > 0 && sessionKey && sessionKey.trim().length > 0) {\n    const projectId = projectTagProjectId(projectTag.trim());\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: projectId,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_decision\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_decision\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n      id: getLastOption(args, \"id\"),\n      supersedesId: getLastOption(args, \"supersedes-id\"),\n      title: getLastOption(args, \"title\"),\n      status: getLastOption(args, \"status\"),\n      context: getLastOption(args, \"context\"),\n      decision: getLastOption(args, \"decision\"),\n      consequences: getLastOption(args, \"consequences\"),\n      entityRefs: getAllOptions(args, \"entity-ref\"),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Architecture-card surface (issue #1548 Track A PR 3). Dispatches through\n * the same `coding_architecture` operation as the MCP tool and HTTP route —\n * one validation boundary, three transports.\n */\nasync function runArchitecture(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runDecision (review P2): the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach\n  // a context BEFORE dispatching when --project-tag + --session-key are\n  // given, so the gate passes and writes resolve to the right namespace.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    // refresh scans codingContext.rootPath, so it must be a REAL checkout\n    // path. Default to the CWD (or an explicit --repo-root) so a one-shot\n    // CLI refresh scans the caller's repo, not a non-existent tag path.\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    // --project-tag supplies the context id (namespace); when absent, derive\n    // a default from the repo-root basename so refresh works with just\n    // --session-key + --repo-root (codex review).\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_architecture\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_architecture\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nexport async function main(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  const args = parseArgs(argv);\n  if (args.command === \"browse\") {\n    await runBrowse(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"decision\") {\n    await runDecision(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"architecture\") {\n    await runArchitecture(args, options.preferredId);\n    return;\n  }\n  await runStore(args, options.preferredId);\n}\n\nexport function sanitizeAccessCliErrorMessage(message: string): string {\n  return message.replace(\n    /\\b(openaiApiKey|localLlmApiKey)\\b(\\s*[:=]\\s*)(?:\"[^\"]*\"|'[^']*'|[^\\s,}\\]]+)/gi,\n    (_match, name: string, separator: string) => `${name}${separator}[redacted]`,\n  );\n}\n\nexport function printUsage(): void {\n  writeCliOutput(usage());\n}\n\nexport async function runCli(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  try {\n    await main(argv, options);\n  } catch (error) {\n    if (error instanceof UsageError) {\n      writeCliOutput(formatUsageError(error));\n      writeCliOutput();\n      printUsage();\n      process.exit(1);\n    }\n\n    console.error(\"access-cli failed: runtime error\");\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcjB,IAAM,6BAA6B,CAAC,mBAAmB,iBAAiB;AA+BxE,SAAS,yBAAyB,KAAmE;AACnG,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,UACJ,WAAW,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,SAAS,CAAC,IACvG,QAAQ,SAAS,IAClB;AACN,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAkD;AACjF,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,QACJ,WAAW,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,IACjG,QAAQ,OAAO,IAChB;AACN,QAAM,SAAS,QAAQ,QAAQ;AAC/B,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAEA,SAAS,iCAAiC,KAAc,aAA2D;AACjH,SAAO,mBAAmB,KAAK;AAAA,IAC7B,cAAc;AAAA,IACd;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,iCAAiC,OAAwB;AAChE,SAAQ,2BAAiD,SAAS,KAAK;AACzE;AAaA,IAAM,aAAN,cAAyB,MAAM;AAAA,EAC7B,YACW,MACA,YACA,gBACT;AACA,UAAM,8BAA8B;AAJ3B;AACA;AACA;AAAA,EAGX;AAAA,EALW;AAAA,EACA;AAAA,EACA;AAIb;AAEA,SAAS,iBAAiB,OAA2B;AACnD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,qBAAqB,MAAM,cAAc,SAAS;AAAA,IAC3D,KAAK,kBAAkB;AACrB,YAAM,WAAW,MAAM,gBAAgB,SAAS,eAAe,MAAM,eAAe,KAAK,IAAI,CAAC,MAAM;AACpG,aAAO,uBAAuB,MAAM,cAAc,SAAS,GAAG,QAAQ;AAAA,IACxE;AAAA,IACA,KAAK;AACH,aAAO,qCAAqC,MAAM,cAAc,SAAS;AAAA,IAC3E,KAAK;AACH,aAAO,8BAA8B,MAAM,cAAc,SAAS;AAAA,IACpE,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,yBAAyB,MAAM,cAAc,SAAS;AAAA,IAC/D,KAAK;AACH,aAAO,wBAAwB,MAAM,cAAc,SAAS;AAAA,EAChE;AACF;AAEA,SAAS,eAAe,OAAe,IAAU;AAC/C,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAClC;AAEA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,gBAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,CAAC;AAAA,EAClC;AAAA,EACA,UAAU;AAAA,IACR,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,cAAc;AAAA,IACZ,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AACF;AACA,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAUV,SAAS,cAAc,OAAqC;AAC1D,SAAO,UAAU,YAAY,UAAU,WAAW,UAAU,cAAc,UAAU;AACtF;AAEA,SAAS,UAAU,MAA4B;AAC7C,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAC9B,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AACA,QAAM,OAAO,cAAc,UAAU;AAErC,QAAM,UAAoC,CAAC;AAC3C,QAAM,QAAQ,oBAAI,IAAY;AAE9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC3B,YAAM,IAAI,WAAW,uBAAuB;AAAA,IAC9C;AACA,UAAM,SAAS,MAAM,MAAM,CAAC;AAC5B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,WAAW,kBAAkB,MAAM;AAAA,IAC/C;AACA,UAAM,cAAc,OAAO,QAAQ,GAAG;AACtC,UAAM,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,GAAG,WAAW;AACrE,UAAM,cAAc,gBAAgB,KAAK,SAAY,OAAO,MAAM,cAAc,CAAC;AAEjF,QAAI,CAAC,KAAK,aAAa,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7D,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AAEA,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,UAAI,gBAAgB,QAAW;AAC7B,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAMA,QAAO,KAAK,IAAI,CAAC;AACvB,UAAIA,SAAQ,CAACA,MAAK,WAAW,IAAI,GAAG;AAClC,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAM,IAAI,GAAG;AACb;AAAA,IACF;AAEA,QAAI,gBAAgB,QAAW;AAC7B,UAAI,YAAY,WAAW,GAAG;AAC5B,cAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,MAC5C;AACA,UAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,gBAAQ,GAAG,IAAI,CAAC;AAAA,MAClB;AACA,cAAQ,GAAG,EAAE,KAAK,WAAW;AAC7B;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,SAAS,UAAa,KAAK,WAAW,KAAK,KAAK,WAAW,IAAI,GAAG;AACpE,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AACA,QAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,cAAQ,GAAG,IAAI,CAAC;AAAA,IAClB;AACA,YAAQ,GAAG,EAAE,KAAK,IAAI;AACtB,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAkB,MAAkC;AACzE,QAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO;AAC3C,SAAO,OAAO,OAAO,SAAS,CAAC;AACjC;AAEA,SAAS,cAAc,MAAkB,MAAwB;AAC/D,SAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;AAChC;AAEA,SAAS,cAAc,MAAkB,MAAsB;AAC7D,QAAM,QAAQ,cAAc,MAAM,IAAI;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACA,MACA,UAA4B,CAAC,GACT;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAChC,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,MAAM,CAAC,cAAc,QAAQ,GAAG,EAAE,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAkB,MAAsC;AACrF,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAK,mBAAyC,SAAS,GAAG,GAAG;AAC3D,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,kBAAkB,MAAM,kBAAkB;AACjE;AAEA,SAAS,iBACP,MACA,MACA,UAA0C,CAAC,GACvB;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,oDAAoD,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,aAA+C;AACvE,QAAM,aACJ,mBAAmB,WAAW,sBAAsB,CAAC,KACrD,mBAAmB,WAAW,6BAA6B,CAAC,KAC5D,KAAK,KAAK,eAAe,GAAG,aAAa,eAAe;AAC1D,QAAM,MAAM,KAAK,MAAM,GAAG,aAAa,YAAY,MAAM,CAAC;AAC1D,QAAM,SACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAChD,wBAAwB,GAA8B,IACtD;AACN,MAAI,OAAO,WAAW,YAAY,CAAC,iCAAiC,MAAM,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,qDAAqD,MAAM;AAAA,IAC7D;AAAA,EACF;AAMA,QAAM,QAAQ,iCAAiC,KAAK,WAAW;AAC/D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAQ,QAAQ,QAAQ,KAA6C,CAAC;AACxE;AAEA,SAAS,aAAa,aAA+B;AACnD,QAAM,SAAS,YAAY,iBAAiB,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,oBAAoB,IAAI,aAAa,MAAM,CAAC;AAAA,EAC3D;AACF;AAEA,eAAe,UAAU,MAAkB,aAAqC;AAC9E,QAAM,aAAa;AAAA,IACjB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,OAAO,cAAc,MAAM,OAAO;AAAA,IAClC,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,QAAQ,cAAc,MAAM,QAAQ;AAAA,IACpC,MAAM,sBAAsB,MAAM,MAAM;AAAA,IACxC,OAAO,mBAAmB,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,IACnD,QAAQ,mBAAmB,MAAM,UAAU,EAAE,KAAK,EAAE,CAAC;AAAA,EACvD;AACA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,UAAU;AAAA,IACd,WAAW,WAAW;AAAA,IACtB,wBAAwB,WAAW,aAAa,OAAO,gBAAgB;AAAA,IACvE,OAAO,WAAW;AAAA,IAClB,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW;AAAA,IAClB,QAAQ,WAAW;AAAA,EACrB;AACA,QAAM,SAAS,MAAM,QAAQ,aAAa,OAAO;AACjD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,gBAAgB,cAAc,MAAM,SAAS;AACnD,QAAM,UAAU,cACZ,GAAG,aAAa,gBAAgB,WAAW,GAAG,MAAM,IACpD;AACJ,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,WAAW,iBAAiB;AAAA,EACxC;AACA,QAAM,YAAY;AAAA,IAChB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,YAAY,cAAc,MAAM,aAAa;AAAA,IAC7C;AAAA,IACA,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,YAAY,iBAAiB,MAAM,cAAc,EAAE,KAAK,GAAG,KAAK,EAAE,CAAC;AAAA,IACnE,MAAM,cAAc,MAAM,KAAK;AAAA,IAC/B,WAAW,cAAc,MAAM,YAAY;AAAA,IAC3C,KAAK,cAAc,MAAM,KAAK;AAAA,IAC9B,cAAc,cAAc,MAAM,eAAe;AAAA,IACjD,gBAAgB,cAAc,MAAM,iBAAiB;AAAA,IACrD,QAAQ,KAAK,MAAM,IAAI,SAAS;AAAA,EAClC;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,YAAY,UAAU;AAAA,MACtB,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,WAAW,UAAU;AAAA,MACrB,KAAK,UAAU;AAAA,MACf,cAAc,UAAU;AAAA,MACxB,gBAAgB,UAAU;AAAA,MAC1B,QAAQ,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,SAAS,mBAAmB,OAA+C;AACzE,SAAO,UAAU,SAAY,SAAY,gBAAgB,KAAK;AAChE;AAOA,eAAe,YAAY,MAAkB,aAAqC;AAChF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAMpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5F,UAAM,YAAY,oBAAoB,WAAW,KAAK,CAAC;AACvD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,iBAAiB;AACzC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,MACA,IAAI,cAAc,MAAM,IAAI;AAAA,MAC5B,cAAc,cAAc,MAAM,eAAe;AAAA,MACjD,OAAO,cAAc,MAAM,OAAO;AAAA,MAClC,QAAQ,cAAc,MAAM,QAAQ;AAAA,MACpC,SAAS,cAAc,MAAM,SAAS;AAAA,MACtC,UAAU,cAAc,MAAM,UAAU;AAAA,MACxC,cAAc,cAAc,MAAM,cAAc;AAAA,MAChD,YAAY,cAAc,MAAM,YAAY;AAAA,IAC9C;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,gBAAgB,MAAkB,aAAqC;AACpF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAI9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AAIrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,qBAAqB;AAC7C,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,eAAsB,KACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,QAAM,OAAO,UAAU,IAAI;AAC3B,MAAI,KAAK,YAAY,UAAU;AAC7B,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,UAAM,YAAY,MAAM,QAAQ,WAAW;AAC3C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,UAAM,gBAAgB,MAAM,QAAQ,WAAW;AAC/C;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAC1C;AAEO,SAAS,8BAA8B,SAAyB;AACrE,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,CAAC,QAAQ,MAAc,cAAsB,GAAG,IAAI,GAAG,SAAS;AAAA,EAClE;AACF;AAEO,SAAS,aAAmB;AACjC,iBAAe,MAAM,CAAC;AACxB;AAEA,eAAsB,OACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,QAAI,iBAAiB,YAAY;AAC/B,qBAAe,iBAAiB,KAAK,CAAC;AACtC,qBAAe;AACf,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":["next"]}
+{"version":3,"sources":["../src/access-cli.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { parseConfig } from \"./config.js\";\nimport type { PluginConfig } from \"./types.js\";\nimport { Orchestrator } from \"./orchestrator.js\";\nimport { EngramAccessService } from \"./access-service.js\";\nimport { readEnvVar, resolveHomeDir } from \"./runtime/env.js\";\nimport { resolvePluginEntry } from \"./plugin-entry-resolver.js\";\nimport { expandTildePath } from \"./utils/path.js\";\nimport { getOperation } from \"./access-boundary.js\";\n// Importing access-operations registers the pilot boundary operations as a\n// side effect; the store command dispatches through the registry (issue #1525).\nimport \"./access-operations.js\";\nimport { projectTagProjectId } from \"./coding/coding-namespace.js\";\n\nconst OPENCLAW_REMNIC_PLUGIN_IDS = [\"openclaw-remnic\", \"openclaw-engram\"] as const;\n\ntype CommandName = \"browse\" | \"store\" | \"decision\" | \"architecture\" | \"delta\";\n\ntype ParsedArgs = {\n  command: CommandName;\n  options: Record<string, string[]>;\n  flags: Set<string>;\n};\n\ntype CommandSpec = {\n  valueOptions: ReadonlySet<string>;\n  flagOptions: ReadonlySet<string>;\n};\n\ntype Runtime = {\n  config: PluginConfig;\n  service: EngramAccessService;\n};\n\nexport type AccessCliOptions = {\n  /**\n   * The calling plugin's own id (e.g. `\"openclaw-engram\"` when invoked by the\n   * shim binary).  Forwarded to the plugin-entry resolver so shim CLI\n   * users target their own `plugins.entries[\"openclaw-engram\"]` block instead\n   * of accidentally resolving to the canonical `\"openclaw-remnic\"` entry when\n   * `plugins.slots.memory` is unset (#403).\n   */\n  preferredId?: string;\n};\n\nfunction getOpenClawPluginEntries(raw: Record<string, unknown>): Record<string, unknown> | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const entries =\n    plugins && plugins[\"entries\"] && typeof plugins[\"entries\"] === \"object\" && !Array.isArray(plugins[\"entries\"])\n      ? (plugins[\"entries\"] as Record<string, unknown>)\n      : undefined;\n  return entries;\n}\n\nfunction getOpenClawMemorySlotId(raw: Record<string, unknown>): string | undefined {\n  const plugins =\n    raw[\"plugins\"] && typeof raw[\"plugins\"] === \"object\" && !Array.isArray(raw[\"plugins\"])\n      ? (raw[\"plugins\"] as Record<string, unknown>)\n      : undefined;\n  const slots =\n    plugins && plugins[\"slots\"] && typeof plugins[\"slots\"] === \"object\" && !Array.isArray(plugins[\"slots\"])\n      ? (plugins[\"slots\"] as Record<string, unknown>)\n      : undefined;\n  const slotId = slots?.[\"memory\"];\n  return typeof slotId === \"string\" ? slotId : undefined;\n}\n\nfunction resolveOpenClawRemnicPluginEntry(raw: unknown, preferredId?: string): Record<string, unknown> | undefined {\n  return resolvePluginEntry(raw, {\n    candidateIds: OPENCLAW_REMNIC_PLUGIN_IDS,\n    preferredId,\n    getEntries: getOpenClawPluginEntries,\n    getSlotId: getOpenClawMemorySlotId,\n  });\n}\n\nfunction hasAllowedOpenClawRemnicPluginId(value: string): boolean {\n  return (OPENCLAW_REMNIC_PLUGIN_IDS as readonly string[]).includes(value);\n}\n\ntype UsageErrorKind =\n  | \"unsupported-command\"\n  | \"unexpected-positional\"\n  | \"unknown-option\"\n  | \"invalid-option\"\n  | \"option-does-not-take-value\"\n  | \"missing-option\"\n  | \"missing-content\"\n  | \"invalid-integer\"\n  | \"invalid-number\";\n\nclass UsageError extends Error {\n  constructor(\n    readonly kind: UsageErrorKind,\n    readonly optionName?: string,\n    readonly acceptedValues?: readonly string[],\n  ) {\n    super(\"invalid access-cli arguments\");\n  }\n}\n\nfunction formatUsageError(error: UsageError): string {\n  switch (error.kind) {\n    case \"unsupported-command\":\n      return \"unsupported command\";\n    case \"unexpected-positional\":\n      return \"unexpected positional argument\";\n    case \"unknown-option\":\n      return `unknown option: --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-option\": {\n      const accepted = error.acceptedValues?.length ? `. Accepted: ${error.acceptedValues.join(\", \")}.` : \"\";\n      return `invalid value for --${error.optionName ?? \"unknown\"}${accepted}`;\n    }\n    case \"option-does-not-take-value\":\n      return `option does not accept a value: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-option\":\n      return `missing required option: --${error.optionName ?? \"unknown\"}`;\n    case \"missing-content\":\n      return \"missing required option: --content or --content-file\";\n    case \"invalid-integer\":\n      return `invalid integer for --${error.optionName ?? \"unknown\"}`;\n    case \"invalid-number\":\n      return `invalid number for --${error.optionName ?? \"unknown\"}`;\n  }\n}\n\nfunction writeCliOutput(text: string = \"\"): void {\n  process.stdout.write(`${text}\\n`);\n}\n\nfunction usage(): string {\n  return [\n    \"  engram-access browse [options]\",\n    \"  engram-access store [options]\",\n    \"  engram-access decision [options]\",\n    \"  engram-access architecture [options]\",\n    \"  engram-access delta [options]\",\n    \"\",\n    \"Browse options:\",\n    \"  --namespace <name>\",\n    \"  --principal <principal>\",\n    \"  --query <text>\",\n    \"  --category <name>\",\n    \"  --status <name>\",\n    \"  --sort <updated_desc|updated_asc|created_desc|created_asc>\",\n    \"  --limit <n>\",\n    \"  --offset <n>\",\n    \"\",\n    \"Store options:\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --content <text> | --content-file <path>\",\n    \"  --category <name>\",\n    \"  --confidence <0-1>\",\n    \"  --tag <tag> (repeatable)\",\n    \"  --entity-ref <ref>\",\n    \"  --ttl <duration>\",\n    \"  --source-reason <text>\",\n    \"  --idempotency-key <key>\",\n    \"  --dry-run\",\n    \"\",\n    \"Decision options:\",\n    \"  --subcommand <list|get|record|supersede>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --id <id> (get/supersede)\",\n    \"  --title <title> (record/supersede)\",\n    \"  --status <proposed|accepted|superseded|rejected> (record)\",\n    \"  --context <text> (record/supersede)\",\n    \"  --decision <text> (record/supersede)\",\n    \"  --consequences <text> (record/supersede)\",\n    \"  --entity-ref <ref> (repeatable)\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --supersedes-id <id> (alias for --id on supersede)\",\n    \"\",\n    \"Architecture options:\",\n    \"  --subcommand <get|refresh>\",\n    \"  --namespace <name>\",\n    \"  --session-key <key>\",\n    \"  --principal <principal>\",\n    \"  --project-tag <tag> (attach coding context for this invocation)\",\n    \"  --repo-root <path> (repo to scan for refresh; defaults to the current directory)\",\n  ].join(\"\\n\");\n}\n\nconst COMMAND_SPECS: Record<CommandName, CommandSpec> = {\n  browse: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"principal\",\n      \"query\",\n      \"category\",\n      \"status\",\n      \"sort\",\n      \"limit\",\n      \"offset\",\n    ]),\n    flagOptions: new Set(),\n  },\n  store: {\n    valueOptions: new Set([\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"content\",\n      \"content-file\",\n      \"category\",\n      \"confidence\",\n      \"tag\",\n      \"entity-ref\",\n      \"ttl\",\n      \"source-reason\",\n      \"idempotency-key\",\n    ]),\n    flagOptions: new Set([\"dry-run\"]),\n  },\n  decision: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"id\",\n      \"title\",\n      \"status\",\n      \"context\",\n      \"decision\",\n      \"consequences\",\n      \"entity-ref\",\n      \"project-tag\",\n      \"supersedes-id\",\n    ]),\n    flagOptions: new Set(),\n  },\n  architecture: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n  delta: {\n    valueOptions: new Set([\n      \"subcommand\",\n      \"namespace\",\n      \"session-key\",\n      \"principal\",\n      \"project-tag\",\n      \"repo-root\",\n    ]),\n    flagOptions: new Set(),\n  },\n};\nconst BROWSE_SORT_VALUES = Object.freeze([\n  \"updated_desc\",\n  \"updated_asc\",\n  \"created_desc\",\n  \"created_asc\",\n] as const);\n\ntype BrowseSort = (typeof BROWSE_SORT_VALUES)[number];\n\n/**\n * Type guard for {@link CommandName}. Enumerating the union (rather than a\n * bare `value in COMMAND_SPECS`) is what lets TypeScript NARROW the string\n * to `CommandName` — the `in` operator alone yields TS2322 on the\n * `command: commandRaw` assignment below (codex review P2).\n */\nfunction isCommandName(value: string): value is CommandName {\n  return value === \"browse\" || value === \"store\" || value === \"decision\" || value === \"architecture\" || value === \"delta\";\n}\n\nfunction parseArgs(argv: string[]): ParsedArgs {\n  const [commandRaw, ...rest] = argv;\n  if (!isCommandName(commandRaw)) {\n    throw new UsageError(\"unsupported-command\");\n  }\n  const spec = COMMAND_SPECS[commandRaw];\n\n  const options: Record<string, string[]> = {};\n  const flags = new Set<string>();\n\n  for (let i = 0; i < rest.length; i += 1) {\n    const token = rest[i];\n    if (!token.startsWith(\"--\")) {\n      throw new UsageError(\"unexpected-positional\");\n    }\n    const rawKey = token.slice(2);\n    if (!rawKey) {\n      throw new UsageError(\"unknown-option\", rawKey);\n    }\n    const equalsIndex = rawKey.indexOf(\"=\");\n    const key = equalsIndex === -1 ? rawKey : rawKey.slice(0, equalsIndex);\n    const inlineValue = equalsIndex === -1 ? undefined : rawKey.slice(equalsIndex + 1);\n\n    if (!spec.valueOptions.has(key) && !spec.flagOptions.has(key)) {\n      throw new UsageError(\"unknown-option\", key);\n    }\n\n    if (spec.flagOptions.has(key)) {\n      if (inlineValue !== undefined) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      const next = rest[i + 1];\n      if (next && !next.startsWith(\"--\")) {\n        throw new UsageError(\"option-does-not-take-value\", key);\n      }\n      flags.add(key);\n      continue;\n    }\n\n    if (inlineValue !== undefined) {\n      if (inlineValue.length === 0) {\n        throw new UsageError(\"missing-option\", key);\n      }\n      if (!options[key]) {\n        options[key] = [];\n      }\n      options[key].push(inlineValue);\n      continue;\n    }\n\n    const next = rest[i + 1];\n    if (next === undefined || next.length === 0 || next.startsWith(\"--\")) {\n      throw new UsageError(\"missing-option\", key);\n    }\n    if (!options[key]) {\n      options[key] = [];\n    }\n    options[key].push(next);\n    i += 1;\n  }\n\n  return {\n    command: commandRaw,\n    options,\n    flags,\n  };\n}\n\nfunction getLastOption(args: ParsedArgs, name: string): string | undefined {\n  const values = args.options[name];\n  if (!values || values.length === 0) return undefined;\n  return values[values.length - 1];\n}\n\nfunction getAllOptions(args: ParsedArgs, name: string): string[] {\n  return args.options[name] ?? [];\n}\n\nfunction requireOption(args: ParsedArgs, name: string): string {\n  const value = getLastOption(args, name);\n  if (!value || value.trim().length === 0) {\n    throw new UsageError(\"missing-option\", name);\n  }\n  return value;\n}\n\nfunction parseIntegerOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?\\d+$/.test(trimmed)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isSafeInteger(value)) {\n    throw new UsageError(\"invalid-integer\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-option\", name, [`integer >= ${options.min}`]);\n  }\n  return value;\n}\n\nfunction parseBrowseSortOption(args: ParsedArgs, name: string): BrowseSort | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  if ((BROWSE_SORT_VALUES as readonly string[]).includes(raw)) {\n    return raw as BrowseSort;\n  }\n  throw new UsageError(\"invalid-option\", name, BROWSE_SORT_VALUES);\n}\n\nfunction parseFloatOption(\n  args: ParsedArgs,\n  name: string,\n  options: { min?: number; max?: number } = {},\n): number | undefined {\n  const raw = getLastOption(args, name);\n  if (!raw) return undefined;\n  const trimmed = raw.trim();\n  if (!/^[+-]?(?:(?:\\d+\\.?\\d*)|(?:\\.\\d+))(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  const value = Number(trimmed);\n  if (!Number.isFinite(value)) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.min !== undefined && value < options.min) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  if (options.max !== undefined && value > options.max) {\n    throw new UsageError(\"invalid-number\", name);\n  }\n  return value;\n}\n\nfunction loadPluginConfig(preferredId?: string): Record<string, unknown> {\n  const configPath =\n    expandOptionalPath(readEnvVar(\"OPENCLAW_CONFIG_PATH\")) ||\n    expandOptionalPath(readEnvVar(\"OPENCLAW_ENGRAM_CONFIG_PATH\")) ||\n    path.join(resolveHomeDir(), \".openclaw\", \"openclaw.json\");\n  const raw = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n  const slotId =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? getOpenClawMemorySlotId(raw as Record<string, unknown>)\n      : undefined;\n  if (typeof slotId === \"string\" && !hasAllowedOpenClawRemnicPluginId(slotId)) {\n    throw new Error(\n      `OpenClaw memory slot points to non-Remnic plugin \"${slotId}\"; refusing to use default Remnic access config.`,\n    );\n  }\n  // Delegate slot → preferredId → canonical → legacy resolution to the\n  // generic helper so all config loaders stay in sync (#403).  Shim CLI\n  // callers pass `preferredId: \"openclaw-engram\"` so legacy shim installs\n  // target their own config block instead of falling through to the canonical\n  // \"openclaw-remnic\" entry.\n  const entry = resolveOpenClawRemnicPluginEntry(raw, preferredId);\n  if (!entry) {\n    throw new Error(\n      \"OpenClaw config does not contain an allowed Remnic plugin entry; refusing to use default Remnic access config.\",\n    );\n  }\n  return (entry?.[\"config\"] as Record<string, unknown> | undefined) ?? {};\n}\n\nfunction buildRuntime(preferredId?: string): Runtime {\n  const config = parseConfig(loadPluginConfig(preferredId));\n  return {\n    config,\n    service: new EngramAccessService(new Orchestrator(config)),\n  };\n}\n\nasync function runBrowse(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const browseArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    principal: getLastOption(args, \"principal\"),\n    query: getLastOption(args, \"query\"),\n    category: getLastOption(args, \"category\"),\n    status: getLastOption(args, \"status\"),\n    sort: parseBrowseSortOption(args, \"sort\"),\n    limit: parseIntegerOption(args, \"limit\", { min: 1 }),\n    offset: parseIntegerOption(args, \"offset\", { min: 0 }),\n  };\n  const { config, service } = buildRuntime(preferredId);\n  const request = {\n    namespace: browseArgs.namespace,\n    authenticatedPrincipal: browseArgs.principal ?? config.agentAccessHttp.principal,\n    query: browseArgs.query,\n    category: browseArgs.category,\n    status: browseArgs.status,\n    sort: browseArgs.sort,\n    limit: browseArgs.limit,\n    offset: browseArgs.offset,\n  };\n  const result = await service.memoryBrowse(request);\n  console.log(JSON.stringify(result, null, 2));\n}\n\nasync function runStore(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const contentFile = getLastOption(args, \"content-file\");\n  const inlineContent = getLastOption(args, \"content\");\n  const content = contentFile\n    ? fs.readFileSync(expandTildePath(contentFile), \"utf8\")\n    : inlineContent;\n  if (!content || content.trim().length === 0) {\n    throw new UsageError(\"missing-content\");\n  }\n  const storeArgs = {\n    namespace: getLastOption(args, \"namespace\"),\n    sessionKey: getLastOption(args, \"session-key\"),\n    content,\n    category: requireOption(args, \"category\"),\n    confidence: parseFloatOption(args, \"confidence\", { min: 0, max: 1 }),\n    tags: getAllOptions(args, \"tag\"),\n    entityRef: getLastOption(args, \"entity-ref\"),\n    ttl: getLastOption(args, \"ttl\"),\n    sourceReason: getLastOption(args, \"source-reason\"),\n    idempotencyKey: getLastOption(args, \"idempotency-key\"),\n    dryRun: args.flags.has(\"dry-run\"),\n  };\n\n  const { config, service } = buildRuntime(preferredId);\n  // Migrated through the access boundary (issue #1525): the store command\n  // dispatches through the same registry entry as the MCP tool and HTTP\n  // route, so validation/normalization is owned in ONE place. The CLI has no\n  // write-quota hook (it is a one-shot process), so no hooks are forwarded.\n  const op = getOperation(\"memory_store\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: memory_store\");\n  }\n  const output = (await op.run(\n    {\n      namespace: storeArgs.namespace,\n      sessionKey: storeArgs.sessionKey,\n      content: storeArgs.content,\n      category: storeArgs.category,\n      confidence: storeArgs.confidence,\n      tags: storeArgs.tags,\n      entityRef: storeArgs.entityRef,\n      ttl: storeArgs.ttl,\n      sourceReason: storeArgs.sourceReason,\n      idempotencyKey: storeArgs.idempotencyKey,\n      dryRun: storeArgs.dryRun,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nfunction expandOptionalPath(value: string | undefined): string | undefined {\n  return value === undefined ? undefined : expandTildePath(value);\n}\n\n/**\n * Decision-record surface (issue #1548 Track A PR 2). Dispatches through the\n * same `coding_decision` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDecision(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // The CLI creates a fresh Orchestrator per invocation, so the session\n  // coding-context map is empty. If --project-tag + --session-key are\n  // provided, attach a coding context BEFORE dispatching so the gate\n  // passes and project-scoped writes resolve to the right namespace\n  // (review P2).\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (projectTag && projectTag.trim().length > 0 && sessionKey && sessionKey.trim().length > 0) {\n    const projectId = projectTagProjectId(projectTag.trim());\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: projectId,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_decision\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_decision\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n      id: getLastOption(args, \"id\"),\n      supersedesId: getLastOption(args, \"supersedes-id\"),\n      title: getLastOption(args, \"title\"),\n      status: getLastOption(args, \"status\"),\n      context: getLastOption(args, \"context\"),\n      decision: getLastOption(args, \"decision\"),\n      consequences: getLastOption(args, \"consequences\"),\n      entityRefs: getAllOptions(args, \"entity-ref\"),\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Architecture-card surface (issue #1548 Track A PR 3). Dispatches through\n * the same `coding_architecture` operation as the MCP tool and HTTP route —\n * one validation boundary, three transports.\n */\nasync function runArchitecture(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runDecision (review P2): the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach\n  // a context BEFORE dispatching when --project-tag + --session-key are\n  // given, so the gate passes and writes resolve to the right namespace.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    // refresh scans codingContext.rootPath, so it must be a REAL checkout\n    // path. Default to the CWD (or an explicit --repo-root) so a one-shot\n    // CLI refresh scans the caller's repo, not a non-existent tag path.\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    // --project-tag supplies the context id (namespace); when absent, derive\n    // a default from the repo-root basename so refresh works with just\n    // --session-key + --repo-root (codex review).\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_architecture\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_architecture\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\n/**\n * Session-delta surface (issue #1548 Track A PR 4). Dispatches through the\n * same `coding_delta` operation as the MCP tool and HTTP route — one\n * validation boundary, three transports.\n */\nasync function runDelta(args: ParsedArgs, preferredId?: string): Promise<void> {\n  const subcommand = requireOption(args, \"subcommand\");\n  const { config, service } = buildRuntime(preferredId);\n  // Same coding-context attachment as runArchitecture/runDecision: the CLI's\n  // fresh Orchestrator has an empty session coding-context map, so attach a\n  // context BEFORE dispatching so the gate passes.\n  const projectTag = getLastOption(args, \"project-tag\");\n  const sessionKey = getLastOption(args, \"session-key\");\n  if (sessionKey && sessionKey.trim().length > 0) {\n    const repoRoot = expandOptionalPath(getLastOption(args, \"repo-root\")) ?? process.cwd();\n    const projectId =\n      projectTag && projectTag.trim().length > 0\n        ? projectTagProjectId(projectTag.trim())\n        : projectTagProjectId(path.basename(repoRoot));\n    service.setCodingContext({\n      sessionKey,\n      codingContext: {\n        projectId,\n        branch: null,\n        rootPath: repoRoot,\n        defaultBranch: null,\n      },\n    });\n  }\n  const op = getOperation(\"coding_delta\");\n  if (!op) {\n    throw new Error(\"access-boundary: operation not registered: coding_delta\");\n  }\n  const output = (await op.run(\n    {\n      subcommand,\n      namespace: getLastOption(args, \"namespace\"),\n      sessionKey,\n    },\n    {\n      service,\n      authenticatedPrincipal: getLastOption(args, \"principal\") ?? config.agentAccessHttp.principal,\n    },\n  )) as { result: unknown };\n  console.log(JSON.stringify(output.result, null, 2));\n}\n\nexport async function main(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  const args = parseArgs(argv);\n  if (args.command === \"browse\") {\n    await runBrowse(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"decision\") {\n    await runDecision(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"architecture\") {\n    await runArchitecture(args, options.preferredId);\n    return;\n  }\n  if (args.command === \"delta\") {\n    await runDelta(args, options.preferredId);\n    return;\n  }\n  await runStore(args, options.preferredId);\n}\n\nexport function sanitizeAccessCliErrorMessage(message: string): string {\n  return message.replace(\n    /\\b(openaiApiKey|localLlmApiKey)\\b(\\s*[:=]\\s*)(?:\"[^\"]*\"|'[^']*'|[^\\s,}\\]]+)/gi,\n    (_match, name: string, separator: string) => `${name}${separator}[redacted]`,\n  );\n}\n\nexport function printUsage(): void {\n  writeCliOutput(usage());\n}\n\nexport async function runCli(\n  argv: string[] = process.argv.slice(2),\n  options: AccessCliOptions = {},\n): Promise<void> {\n  try {\n    await main(argv, options);\n  } catch (error) {\n    if (error instanceof UsageError) {\n      writeCliOutput(formatUsageError(error));\n      writeCliOutput();\n      printUsage();\n      process.exit(1);\n    }\n\n    console.error(\"access-cli failed: runtime error\");\n    process.exit(1);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AAcjB,IAAM,6BAA6B,CAAC,mBAAmB,iBAAiB;AA+BxE,SAAS,yBAAyB,KAAmE;AACnG,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,UACJ,WAAW,QAAQ,SAAS,KAAK,OAAO,QAAQ,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,SAAS,CAAC,IACvG,QAAQ,SAAS,IAClB;AACN,SAAO;AACT;AAEA,SAAS,wBAAwB,KAAkD;AACjF,QAAM,UACJ,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,MAAM,YAAY,CAAC,MAAM,QAAQ,IAAI,SAAS,CAAC,IAChF,IAAI,SAAS,IACd;AACN,QAAM,QACJ,WAAW,QAAQ,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,QAAQ,OAAO,CAAC,IACjG,QAAQ,OAAO,IAChB;AACN,QAAM,SAAS,QAAQ,QAAQ;AAC/B,SAAO,OAAO,WAAW,WAAW,SAAS;AAC/C;AAEA,SAAS,iCAAiC,KAAc,aAA2D;AACjH,SAAO,mBAAmB,KAAK;AAAA,IAC7B,cAAc;AAAA,IACd;AAAA,IACA,YAAY;AAAA,IACZ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,iCAAiC,OAAwB;AAChE,SAAQ,2BAAiD,SAAS,KAAK;AACzE;AAaA,IAAM,aAAN,cAAyB,MAAM;AAAA,EAC7B,YACW,MACA,YACA,gBACT;AACA,UAAM,8BAA8B;AAJ3B;AACA;AACA;AAAA,EAGX;AAAA,EALW;AAAA,EACA;AAAA,EACA;AAIb;AAEA,SAAS,iBAAiB,OAA2B;AACnD,UAAQ,MAAM,MAAM;AAAA,IAClB,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,qBAAqB,MAAM,cAAc,SAAS;AAAA,IAC3D,KAAK,kBAAkB;AACrB,YAAM,WAAW,MAAM,gBAAgB,SAAS,eAAe,MAAM,eAAe,KAAK,IAAI,CAAC,MAAM;AACpG,aAAO,uBAAuB,MAAM,cAAc,SAAS,GAAG,QAAQ;AAAA,IACxE;AAAA,IACA,KAAK;AACH,aAAO,qCAAqC,MAAM,cAAc,SAAS;AAAA,IAC3E,KAAK;AACH,aAAO,8BAA8B,MAAM,cAAc,SAAS;AAAA,IACpE,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,yBAAyB,MAAM,cAAc,SAAS;AAAA,IAC/D,KAAK;AACH,aAAO,wBAAwB,MAAM,cAAc,SAAS;AAAA,EAChE;AACF;AAEA,SAAS,eAAe,OAAe,IAAU;AAC/C,UAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAClC;AAEA,SAAS,QAAgB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;AAEA,IAAM,gBAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI,CAAC,SAAS,CAAC;AAAA,EAClC;AAAA,EACA,UAAU;AAAA,IACR,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,cAAc;AAAA,IACZ,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AAAA,EACA,OAAO;AAAA,IACL,cAAc,oBAAI,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,aAAa,oBAAI,IAAI;AAAA,EACvB;AACF;AACA,IAAM,qBAAqB,OAAO,OAAO;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAUV,SAAS,cAAc,OAAqC;AAC1D,SAAO,UAAU,YAAY,UAAU,WAAW,UAAU,cAAc,UAAU,kBAAkB,UAAU;AAClH;AAEA,SAAS,UAAU,MAA4B;AAC7C,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAC9B,MAAI,CAAC,cAAc,UAAU,GAAG;AAC9B,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AACA,QAAM,OAAO,cAAc,UAAU;AAErC,QAAM,UAAoC,CAAC;AAC3C,QAAM,QAAQ,oBAAI,IAAY;AAE9B,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,QAAQ,KAAK,CAAC;AACpB,QAAI,CAAC,MAAM,WAAW,IAAI,GAAG;AAC3B,YAAM,IAAI,WAAW,uBAAuB;AAAA,IAC9C;AACA,UAAM,SAAS,MAAM,MAAM,CAAC;AAC5B,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI,WAAW,kBAAkB,MAAM;AAAA,IAC/C;AACA,UAAM,cAAc,OAAO,QAAQ,GAAG;AACtC,UAAM,MAAM,gBAAgB,KAAK,SAAS,OAAO,MAAM,GAAG,WAAW;AACrE,UAAM,cAAc,gBAAgB,KAAK,SAAY,OAAO,MAAM,cAAc,CAAC;AAEjF,QAAI,CAAC,KAAK,aAAa,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7D,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AAEA,QAAI,KAAK,YAAY,IAAI,GAAG,GAAG;AAC7B,UAAI,gBAAgB,QAAW;AAC7B,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAMA,QAAO,KAAK,IAAI,CAAC;AACvB,UAAIA,SAAQ,CAACA,MAAK,WAAW,IAAI,GAAG;AAClC,cAAM,IAAI,WAAW,8BAA8B,GAAG;AAAA,MACxD;AACA,YAAM,IAAI,GAAG;AACb;AAAA,IACF;AAEA,QAAI,gBAAgB,QAAW;AAC7B,UAAI,YAAY,WAAW,GAAG;AAC5B,cAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,MAC5C;AACA,UAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,gBAAQ,GAAG,IAAI,CAAC;AAAA,MAClB;AACA,cAAQ,GAAG,EAAE,KAAK,WAAW;AAC7B;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,SAAS,UAAa,KAAK,WAAW,KAAK,KAAK,WAAW,IAAI,GAAG;AACpE,YAAM,IAAI,WAAW,kBAAkB,GAAG;AAAA,IAC5C;AACA,QAAI,CAAC,QAAQ,GAAG,GAAG;AACjB,cAAQ,GAAG,IAAI,CAAC;AAAA,IAClB;AACA,YAAQ,GAAG,EAAE,KAAK,IAAI;AACtB,SAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAc,MAAkB,MAAkC;AACzE,QAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,CAAC,UAAU,OAAO,WAAW,EAAG,QAAO;AAC3C,SAAO,OAAO,OAAO,SAAS,CAAC;AACjC;AAEA,SAAS,cAAc,MAAkB,MAAwB;AAC/D,SAAO,KAAK,QAAQ,IAAI,KAAK,CAAC;AAChC;AAEA,SAAS,cAAc,MAAkB,MAAsB;AAC7D,QAAM,QAAQ,cAAc,MAAM,IAAI;AACtC,MAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,mBACP,MACA,MACA,UAA4B,CAAC,GACT;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,cAAc,KAAK,GAAG;AAChC,UAAM,IAAI,WAAW,mBAAmB,IAAI;AAAA,EAC9C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,MAAM,CAAC,cAAc,QAAQ,GAAG,EAAE,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAkB,MAAsC;AACrF,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,MAAK,mBAAyC,SAAS,GAAG,GAAG;AAC3D,WAAO;AAAA,EACT;AACA,QAAM,IAAI,WAAW,kBAAkB,MAAM,kBAAkB;AACjE;AAEA,SAAS,iBACP,MACA,MACA,UAA0C,CAAC,GACvB;AACpB,QAAM,MAAM,cAAc,MAAM,IAAI;AACpC,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,oDAAoD,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,QAAM,QAAQ,OAAO,OAAO;AAC5B,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,MAAI,QAAQ,QAAQ,UAAa,QAAQ,QAAQ,KAAK;AACpD,UAAM,IAAI,WAAW,kBAAkB,IAAI;AAAA,EAC7C;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,aAA+C;AACvE,QAAM,aACJ,mBAAmB,WAAW,sBAAsB,CAAC,KACrD,mBAAmB,WAAW,6BAA6B,CAAC,KAC5D,KAAK,KAAK,eAAe,GAAG,aAAa,eAAe;AAC1D,QAAM,MAAM,KAAK,MAAM,GAAG,aAAa,YAAY,MAAM,CAAC;AAC1D,QAAM,SACJ,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,GAAG,IAChD,wBAAwB,GAA8B,IACtD;AACN,MAAI,OAAO,WAAW,YAAY,CAAC,iCAAiC,MAAM,GAAG;AAC3E,UAAM,IAAI;AAAA,MACR,qDAAqD,MAAM;AAAA,IAC7D;AAAA,EACF;AAMA,QAAM,QAAQ,iCAAiC,KAAK,WAAW;AAC/D,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAQ,QAAQ,QAAQ,KAA6C,CAAC;AACxE;AAEA,SAAS,aAAa,aAA+B;AACnD,QAAM,SAAS,YAAY,iBAAiB,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IACA,SAAS,IAAI,oBAAoB,IAAI,aAAa,MAAM,CAAC;AAAA,EAC3D;AACF;AAEA,eAAe,UAAU,MAAkB,aAAqC;AAC9E,QAAM,aAAa;AAAA,IACjB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,OAAO,cAAc,MAAM,OAAO;AAAA,IAClC,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,QAAQ,cAAc,MAAM,QAAQ;AAAA,IACpC,MAAM,sBAAsB,MAAM,MAAM;AAAA,IACxC,OAAO,mBAAmB,MAAM,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,IACnD,QAAQ,mBAAmB,MAAM,UAAU,EAAE,KAAK,EAAE,CAAC;AAAA,EACvD;AACA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AACpD,QAAM,UAAU;AAAA,IACd,WAAW,WAAW;AAAA,IACtB,wBAAwB,WAAW,aAAa,OAAO,gBAAgB;AAAA,IACvE,OAAO,WAAW;AAAA,IAClB,UAAU,WAAW;AAAA,IACrB,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,OAAO,WAAW;AAAA,IAClB,QAAQ,WAAW;AAAA,EACrB;AACA,QAAM,SAAS,MAAM,QAAQ,aAAa,OAAO;AACjD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;AAEA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,cAAc,cAAc,MAAM,cAAc;AACtD,QAAM,gBAAgB,cAAc,MAAM,SAAS;AACnD,QAAM,UAAU,cACZ,GAAG,aAAa,gBAAgB,WAAW,GAAG,MAAM,IACpD;AACJ,MAAI,CAAC,WAAW,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC3C,UAAM,IAAI,WAAW,iBAAiB;AAAA,EACxC;AACA,QAAM,YAAY;AAAA,IAChB,WAAW,cAAc,MAAM,WAAW;AAAA,IAC1C,YAAY,cAAc,MAAM,aAAa;AAAA,IAC7C;AAAA,IACA,UAAU,cAAc,MAAM,UAAU;AAAA,IACxC,YAAY,iBAAiB,MAAM,cAAc,EAAE,KAAK,GAAG,KAAK,EAAE,CAAC;AAAA,IACnE,MAAM,cAAc,MAAM,KAAK;AAAA,IAC/B,WAAW,cAAc,MAAM,YAAY;AAAA,IAC3C,KAAK,cAAc,MAAM,KAAK;AAAA,IAC9B,cAAc,cAAc,MAAM,eAAe;AAAA,IACjD,gBAAgB,cAAc,MAAM,iBAAiB;AAAA,IACrD,QAAQ,KAAK,MAAM,IAAI,SAAS;AAAA,EAClC;AAEA,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE,WAAW,UAAU;AAAA,MACrB,YAAY,UAAU;AAAA,MACtB,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,WAAW,UAAU;AAAA,MACrB,KAAK,UAAU;AAAA,MACf,cAAc,UAAU;AAAA,MACxB,gBAAgB,UAAU;AAAA,MAC1B,QAAQ,UAAU;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,SAAS,mBAAmB,OAA+C;AACzE,SAAO,UAAU,SAAY,SAAY,gBAAgB,KAAK;AAChE;AAOA,eAAe,YAAY,MAAkB,aAAqC;AAChF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAMpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,KAAK,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC5F,UAAM,YAAY,oBAAoB,WAAW,KAAK,CAAC;AACvD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,iBAAiB;AACzC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,MACA,IAAI,cAAc,MAAM,IAAI;AAAA,MAC5B,cAAc,cAAc,MAAM,eAAe;AAAA,MACjD,OAAO,cAAc,MAAM,OAAO;AAAA,MAClC,QAAQ,cAAc,MAAM,QAAQ;AAAA,MACpC,SAAS,cAAc,MAAM,SAAS;AAAA,MACtC,UAAU,cAAc,MAAM,UAAU;AAAA,MACxC,cAAc,cAAc,MAAM,cAAc;AAAA,MAChD,YAAY,cAAc,MAAM,YAAY;AAAA,IAC9C;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,gBAAgB,MAAkB,aAAqC;AACpF,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAKpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAI9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AAIrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,qBAAqB;AAC7C,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAOA,eAAe,SAAS,MAAkB,aAAqC;AAC7E,QAAM,aAAa,cAAc,MAAM,YAAY;AACnD,QAAM,EAAE,QAAQ,QAAQ,IAAI,aAAa,WAAW;AAIpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,QAAM,aAAa,cAAc,MAAM,aAAa;AACpD,MAAI,cAAc,WAAW,KAAK,EAAE,SAAS,GAAG;AAC9C,UAAM,WAAW,mBAAmB,cAAc,MAAM,WAAW,CAAC,KAAK,QAAQ,IAAI;AACrF,UAAM,YACJ,cAAc,WAAW,KAAK,EAAE,SAAS,IACrC,oBAAoB,WAAW,KAAK,CAAC,IACrC,oBAAoB,KAAK,SAAS,QAAQ,CAAC;AACjD,YAAQ,iBAAiB;AAAA,MACvB;AAAA,MACA,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,eAAe;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,KAAK,aAAa,cAAc;AACtC,MAAI,CAAC,IAAI;AACP,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,QAAM,SAAU,MAAM,GAAG;AAAA,IACvB;AAAA,MACE;AAAA,MACA,WAAW,cAAc,MAAM,WAAW;AAAA,MAC1C;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA,wBAAwB,cAAc,MAAM,WAAW,KAAK,OAAO,gBAAgB;AAAA,IACrF;AAAA,EACF;AACA,UAAQ,IAAI,KAAK,UAAU,OAAO,QAAQ,MAAM,CAAC,CAAC;AACpD;AAEA,eAAsB,KACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,QAAM,OAAO,UAAU,IAAI;AAC3B,MAAI,KAAK,YAAY,UAAU;AAC7B,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC;AAAA,EACF;AACA,MAAI,KAAK,YAAY,YAAY;AAC/B,UAAM,YAAY,MAAM,QAAQ,WAAW;AAC3C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,gBAAgB;AACnC,UAAM,gBAAgB,MAAM,QAAQ,WAAW;AAC/C;AAAA,EACF;AACA,MAAI,KAAK,YAAY,SAAS;AAC5B,UAAM,SAAS,MAAM,QAAQ,WAAW;AACxC;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,WAAW;AAC1C;AAEO,SAAS,8BAA8B,SAAyB;AACrE,SAAO,QAAQ;AAAA,IACb;AAAA,IACA,CAAC,QAAQ,MAAc,cAAsB,GAAG,IAAI,GAAG,SAAS;AAAA,EAClE;AACF;AAEO,SAAS,aAAmB;AACjC,iBAAe,MAAM,CAAC;AACxB;AAEA,eAAsB,OACpB,OAAiB,QAAQ,KAAK,MAAM,CAAC,GACrC,UAA4B,CAAC,GACd;AACf,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,QAAI,iBAAiB,YAAY;AAC/B,qBAAe,iBAAiB,KAAK,CAAC;AACtC,qBAAe;AACf,iBAAW;AACX,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,MAAM,kCAAkC;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AACF;","names":["next"]}

package/dist/access-http.d.ts

@@ -1,5 +1,5 @@
 import { IncomingMessage } from 'node:http';
-import { d as EngramAccessService } from './access-service-DvApf9LZ.js';
+import { f as EngramAccessService } from './access-service-DxCpgyVW.js';
 import { ResolvedIdentity } from './adapters/types.js';
 import { AdapterRegistry } from './adapters/registry.js';
 import './storage.js';

package/dist/access-http.js

@@ -1,6 +1,6 @@
 import {
   EngramAccessHttpServer
-} from "./chunk-SEK4XIDN.js";
+} from "./chunk-WYB44HHV.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-JBPKEARU.js";
 import "./chunk-TMSXWOBZ.js";
@@ -9,13 +9,13 @@ import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-7RXCMVFQ.js";
 import "./chunk-7WV3F5DQ.js";
-import "./chunk-DO7MDZMU.js";
+import "./chunk-RHWFMBO5.js";
 import "./chunk-T4WDJPEZ.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-NEILAC3H.js";
+import "./chunk-JNKH2XWQ.js";
 import "./chunk-UDJLF3BO.js";
-import "./chunk-2EN5WZQB.js";
-import "./chunk-V56S3A23.js";
+import "./chunk-5HGPDRQZ.js";
+import "./chunk-MQTPUPLP.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-ARV3AUOM.js";
@@ -23,7 +23,7 @@ import "./chunk-2D27ODNX.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
-import "./chunk-7MOTEVAA.js";
+import "./chunk-HRUULBBV.js";
 import "./chunk-RS25QOKZ.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-FF4KLI5W.js";

package/dist/access-mcp.d.ts

@@ -1,5 +1,5 @@
 import { Readable, Writable } from 'node:stream';
-import { d as EngramAccessService } from './access-service-DvApf9LZ.js';
+import { f as EngramAccessService } from './access-service-DxCpgyVW.js';
 import './storage.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
@@ -134,6 +134,7 @@ declare class EngramMcpServer {
      * (issue #1548 Track A PR 3, rule 39).
      */
     private readonly architectureCardVisible;
+    private readonly sessionDeltaVisible;
     constructor(service: EngramAccessService, options?: {
         principal?: string;
         citationsEnabled?: boolean;
@@ -141,6 +142,7 @@ declare class EngramMcpServer {
         emitLegacyTools?: boolean;
         codingDecisionVisible?: boolean;
         architectureCardVisible?: boolean;
+        sessionDeltaVisible?: boolean;
     });
     /** Get clientInfo for a specific MCP session. Returns undefined for non-MCP requests. */
     getClientInfo(sessionId?: string): {

package/dist/access-mcp.js

@@ -1,12 +1,12 @@
 import {
   EngramMcpServer
-} from "./chunk-DO7MDZMU.js";
+} from "./chunk-RHWFMBO5.js";
 import "./chunk-T4WDJPEZ.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-NEILAC3H.js";
+import "./chunk-JNKH2XWQ.js";
 import "./chunk-UDJLF3BO.js";
-import "./chunk-2EN5WZQB.js";
-import "./chunk-V56S3A23.js";
+import "./chunk-5HGPDRQZ.js";
+import "./chunk-MQTPUPLP.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-ARV3AUOM.js";
@@ -14,7 +14,7 @@ import "./chunk-2D27ODNX.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
-import "./chunk-7MOTEVAA.js";
+import "./chunk-HRUULBBV.js";
 import "./chunk-RS25QOKZ.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-FF4KLI5W.js";

package/dist/access-operations.d.ts

@@ -1,6 +1,6 @@
 import { OperationName, BoundOperation } from './access-boundary.js';
 import { MemoryStoreRequest } from './access-schema.js';
-import { A as ArchitectureSurfaceRequest, a as ArchitectureSurfaceResponse, D as DecisionSurfaceRequest, b as DecisionSurfaceResponse, E as EngramAccessMemoryResponse, c as EngramAccessWriteResponse } from './access-service-DvApf9LZ.js';
+import { A as ArchitectureSurfaceRequest, a as ArchitectureSurfaceResponse, D as DecisionSurfaceRequest, b as DecisionSurfaceResponse, c as DeltaSurfaceRequest, d as DeltaSurfaceResponse, E as EngramAccessMemoryResponse, e as EngramAccessWriteResponse } from './access-service-DxCpgyVW.js';
 import 'zod';
 import './storage.js';
 import './page-versioning.js';
@@ -130,11 +130,16 @@ type CodingArchitectureOutput = {
     result: ArchitectureSurfaceResponse;
 };
 declare const codingArchitectureOperation: BoundOperation<ArchitectureSurfaceRequest, CodingArchitectureOutput>;
+type CodingDeltaInput = DeltaSurfaceRequest;
+type CodingDeltaOutput = {
+    result: DeltaSurfaceResponse;
+};
+declare const codingDeltaOperation: BoundOperation<DeltaSurfaceRequest, CodingDeltaOutput>;
 /**
  * The canonical short names (no `engram.`/`remnic.` prefix) of the operations
  * the boundary owns today. The fitness test treats this set as the migrated
  * set; everything else on a surface is unmigrated and counted by the ratchet.
  */
-declare const REGISTERED_OPERATIONS: readonly [OperationName, OperationName, OperationName, OperationName, OperationName];
+declare const REGISTERED_OPERATIONS: readonly [OperationName, OperationName, OperationName, OperationName, OperationName, OperationName];
 
-export { type CodingArchitectureInput, type CodingArchitectureOutput, type CodingDecisionInput, type CodingDecisionOutput, type MemoryGetInput, type MemoryGetOutput, type MemorySearchInput, type MemorySearchOutput, type MemoryStoreInput, type MemoryStoreOutput, REGISTERED_OPERATIONS, codingArchitectureOperation, codingDecisionOperation, memoryGetOperation, memorySearchOperation, memoryStoreOperation };
+export { type CodingArchitectureInput, type CodingArchitectureOutput, type CodingDecisionInput, type CodingDecisionOutput, type CodingDeltaInput, type CodingDeltaOutput, type MemoryGetInput, type MemoryGetOutput, type MemorySearchInput, type MemorySearchOutput, type MemoryStoreInput, type MemoryStoreOutput, REGISTERED_OPERATIONS, codingArchitectureOperation, codingDecisionOperation, codingDeltaOperation, memoryGetOperation, memorySearchOperation, memoryStoreOperation };

package/dist/access-operations.js

@@ -2,13 +2,14 @@ import {
   REGISTERED_OPERATIONS,
   codingArchitectureOperation,
   codingDecisionOperation,
+  codingDeltaOperation,
   memoryGetOperation,
   memorySearchOperation,
   memoryStoreOperation
-} from "./chunk-NEILAC3H.js";
+} from "./chunk-JNKH2XWQ.js";
 import "./chunk-UDJLF3BO.js";
-import "./chunk-2EN5WZQB.js";
-import "./chunk-V56S3A23.js";
+import "./chunk-5HGPDRQZ.js";
+import "./chunk-MQTPUPLP.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-ARV3AUOM.js";
@@ -16,7 +17,7 @@ import "./chunk-2D27ODNX.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-H7XKCNR6.js";
-import "./chunk-7MOTEVAA.js";
+import "./chunk-HRUULBBV.js";
 import "./chunk-RS25QOKZ.js";
 import "./chunk-JGSKJHF7.js";
 import "./chunk-FF4KLI5W.js";
@@ -114,6 +115,7 @@ export {
   REGISTERED_OPERATIONS,
   codingArchitectureOperation,
   codingDecisionOperation,
+  codingDeltaOperation,
   memoryGetOperation,
   memorySearchOperation,
   memoryStoreOperation

package/dist/{access-service-DvApf9LZ.d.ts → access-service-DxCpgyVW.d.ts}

@@ -219,6 +219,90 @@ type ArchitectureSurfaceResponse = {
     buildCode?: string;
 };
 
+/** Persisted marker: the HEAD we last computed a delta against, and when. */
+interface LastSeenState {
+    /** HEAD SHA at the time of the last delta. */
+    head: string;
+    /** ISO timestamp of the last delta computation. */
+    at: string;
+}
+
+/**
+ * Session-delta surface contract + handler (issue #1548 Track A PR 4).
+ *
+ * The single shared implementation behind the MCP, HTTP, and CLI
+ * session-delta surfaces. All three transports dispatch through the
+ * `coding_delta` boundary operation, which calls {@link handleCodingDelta}
+ * via the service delegate.
+ *
+ * Gate (rule 39): `codingKnowledge.enabled + sessionDelta + coding
+ * context` — one predicate, identical on every surface. The tools/list
+ * visibility gate checks conditions 1–2 only (config-level).
+ *
+ * Persistence (rule 25): the new last-seen-head marker is written AFTER
+ * the delta is computed from the old one. State writes use temp-file-then-
+ * rename (rule 54) via the pure module's `writeLastSeenState`.
+ *
+ * Subcommand: `get` — computes the delta against the persisted last-seen
+ * head and updates the marker in the same call (so the NEXT session sees
+ * this one as the baseline). Read-only semantically, but it mutates the
+ * state file: it is therefore NOT counted against the write-quota (the
+ * state file is operator-side bookkeeping, not user memory content — the
+ * same way `calibration.ts` writes are uncounted).
+ */
+
+declare const DELTA_SUBCOMMANDS: readonly ["get"];
+type DeltaSubcommand = (typeof DELTA_SUBCOMMANDS)[number];
+/** Canonical surface request — one shape for all three transports. */
+interface DeltaSurfaceRequest {
+    subcommand: DeltaSubcommand;
+    sessionKey?: string;
+    namespace?: string;
+}
+/**
+ * Surface response. Mirrors {@link SessionDeltaResult} but flattened for
+ * transport: every outcome carries `nextState` so callers can observe the
+ * new marker even on failure (the head still advanced).
+ */
+type DeltaSurfaceResponse = {
+    subcommand: "get";
+    ok: true;
+    /** A real delta was computed. */
+    kind: "changed";
+    delta: {
+        commits: ReadonlyArray<{
+            sha: string;
+            subject: string;
+        }>;
+        touchedFiles: readonly string[];
+        summaryLine: string;
+    };
+    nextState: LastSeenState;
+} | {
+    subcommand: "get";
+    ok: true;
+    /** Prior head equals current — no changes. */
+    kind: "unchanged";
+    nextState: LastSeenState;
+} | {
+    subcommand: "get";
+    ok: true;
+    /** No prior state — first session for this namespace. */
+    kind: "first_run";
+    nextState: LastSeenState;
+} | {
+    subcommand: "get";
+    /**
+     * Delta unavailable. `code` is one of `unreachable_head` (force-push/
+     * rebase erased the prior head) or `git_failed` (invoker error). The
+     * state file is still advanced when `nextState` is present.
+     */
+    ok: false;
+    code: "unreachable_head" | "git_failed";
+    detail: string;
+    nextState?: LastSeenState;
+};
+
 /**
  * Procedural memory stats surface (issue #567 PR 5/5).
  *
@@ -1257,6 +1341,16 @@ declare class EngramAccessService {
      * Namespace resolution uses the SAME coding-scoped path as decision records.
      */
     codingArchitecture(request: ArchitectureSurfaceRequest, authenticatedPrincipal?: string): Promise<ArchitectureSurfaceResponse>;
+    /** Whether the coding_delta tool should appear in tools/list (rule 39). */
+    get sessionDeltaSurfaceVisible(): boolean;
+    /**
+     * Thin delegate — handler logic in coding/session-delta-surfaces.ts (#1548 PR4).
+     * All three surfaces (MCP/HTTP/CLI) arrive here via the boundary operation.
+     * Namespace resolution uses the SAME coding-scoped read path as the other
+     * coding surfaces; the delta state file lives under
+     * `<memoryDir>/state/coding-knowledge/<namespace>.json`.
+     */
+    codingDelta(request: DeltaSurfaceRequest, authenticatedPrincipal?: string): Promise<DeltaSurfaceResponse>;
     memoryBrowse(request?: EngramAccessMemoryBrowseRequest): Promise<EngramAccessMemoryBrowseResponse>;
     memoryTimeline(memoryId: string, namespace?: string, limit?: number, principal?: string): Promise<EngramAccessTimelineResponse>;
     entityList(options?: {
@@ -2023,4 +2117,4 @@ declare class EngramAccessService {
     }): Promise<Awaited<ReturnType<WearablesService["transcriptMemories"]>>>;
 }
 
-export { type EngramAccessOfflineSyncSnapshotStreamResponse as $, type ArchitectureSurfaceRequest as A, type EngramAccessLcmSearchRequest as B, type CodingScopedWriteInput as C, type DecisionSurfaceRequest as D, type EngramAccessMemoryResponse as E, type EngramAccessLcmSearchResponse as F, type EngramAccessLcmStatusResponse as G, type EngramAccessMaintenanceResponse as H, type EngramAccessMemoryBrowseRequest as I, type EngramAccessMemoryBrowseResponse as J, type EngramAccessMemoryRecord as K, type EngramAccessMemoryStoreRequest as L, type EngramAccessMemorySummary as M, type EngramAccessObserveMessage as N, type EngramAccessObserveRequest as O, type ProcedureStatsConfigSnapshot as P, type EngramAccessObserveResponse as Q, type EngramAccessOfflineSyncApplyFileContentRequest as R, type EngramAccessOfflineSyncApplyFileContentResponse as S, type EngramAccessOfflineSyncApplyRequest as T, type EngramAccessOfflineSyncApplyResponse as U, type EngramAccessOfflineSyncFileContentRequest as V, type EngramAccessOfflineSyncFileContentResponse as W, type EngramAccessOfflineSyncFilesRequest as X, type EngramAccessOfflineSyncFilesResponse as Y, type EngramAccessOfflineSyncSnapshotRequest as Z, type EngramAccessOfflineSyncSnapshotResponse as _, type ArchitectureSurfaceResponse as a, type EngramAccessQmdCollectionState as a0, type EngramAccessQmdHealthResponse as a1, type EngramAccessQualityResponse as a2, type EngramAccessRecallExplainRequest as a3, type EngramAccessRecallExplainResponse as a4, type EngramAccessRecallRequest as a5, type EngramAccessReviewDispositionRequest as a6, type EngramAccessReviewDispositionResponse as a7, type EngramAccessReviewQueueResponse as a8, type EngramAccessScopeDebug as a9, type EngramAccessSetCodingContextRequest as aa, type EngramAccessSuggestionSubmitRequest as ab, type EngramAccessTimelineResponse as ac, type EngramAccessTrustZoneBrowseRequest as ad, type EngramAccessTrustZoneBrowseResponse as ae, type EngramAccessTrustZoneDemoSeedRequest as af, type EngramAccessTrustZoneDemoSeedResponse as ag, type EngramAccessTrustZonePromoteRequest as ah, type EngramAccessTrustZonePromoteResponse as ai, type EngramAccessTrustZoneRecordSummary as aj, type EngramAccessTrustZoneStatusResponse as ak, type EngramAccessWriteEnvelope as al, type MemoryScopePlan as am, shapeMemorySummary as an, type DecisionSurfaceResponse as b, type EngramAccessWriteResponse as c, EngramAccessService as d, type EngramAccessRecallResponse as e, EngramAccessInputError as f, type ProcedureStatsRecent as g, type ProcedureStatsReport as h, type ProcedureStatusCounts as i, computeProcedureStats as j, formatProcedureStatsText as k, ENGRAM_ACCESS_WRITE_SCHEMA_VERSION as l, type EngramAccessActionConfidenceRequest as m, type EngramAccessActionConfidenceResponse as n, type EngramAccessBriefingRequest as o, type EngramAccessBriefingResponse as p, type EngramAccessCapsuleListResponse as q, type EngramAccessDaySummaryRequest as r, type EngramAccessEntityListResponse as s, type EngramAccessEntityResponse as t, type EngramAccessEntitySummary as u, type EngramAccessHealthResponse as v, type EngramAccessLcmCompactionFlushRequest as w, type EngramAccessLcmCompactionFlushResponse as x, type EngramAccessLcmCompactionRecordRequest as y, type EngramAccessLcmCompactionRecordResponse as z };
+export { type EngramAccessOfflineSyncSnapshotRequest as $, type ArchitectureSurfaceRequest as A, type EngramAccessLcmCompactionRecordRequest as B, type CodingScopedWriteInput as C, type DecisionSurfaceRequest as D, type EngramAccessMemoryResponse as E, type EngramAccessLcmCompactionRecordResponse as F, type EngramAccessLcmSearchRequest as G, type EngramAccessLcmSearchResponse as H, type EngramAccessLcmStatusResponse as I, type EngramAccessMaintenanceResponse as J, type EngramAccessMemoryBrowseRequest as K, type EngramAccessMemoryBrowseResponse as L, type EngramAccessMemoryRecord as M, type EngramAccessMemoryStoreRequest as N, type EngramAccessMemorySummary as O, type ProcedureStatsConfigSnapshot as P, type EngramAccessObserveMessage as Q, type EngramAccessObserveRequest as R, type EngramAccessObserveResponse as S, type EngramAccessOfflineSyncApplyFileContentRequest as T, type EngramAccessOfflineSyncApplyFileContentResponse as U, type EngramAccessOfflineSyncApplyRequest as V, type EngramAccessOfflineSyncApplyResponse as W, type EngramAccessOfflineSyncFileContentRequest as X, type EngramAccessOfflineSyncFileContentResponse as Y, type EngramAccessOfflineSyncFilesRequest as Z, type EngramAccessOfflineSyncFilesResponse as _, type ArchitectureSurfaceResponse as a, type EngramAccessOfflineSyncSnapshotResponse as a0, type EngramAccessOfflineSyncSnapshotStreamResponse as a1, type EngramAccessQmdCollectionState as a2, type EngramAccessQmdHealthResponse as a3, type EngramAccessQualityResponse as a4, type EngramAccessRecallExplainRequest as a5, type EngramAccessRecallExplainResponse as a6, type EngramAccessRecallRequest as a7, type EngramAccessReviewDispositionRequest as a8, type EngramAccessReviewDispositionResponse as a9, type EngramAccessReviewQueueResponse as aa, type EngramAccessScopeDebug as ab, type EngramAccessSetCodingContextRequest as ac, type EngramAccessSuggestionSubmitRequest as ad, type EngramAccessTimelineResponse as ae, type EngramAccessTrustZoneBrowseRequest as af, type EngramAccessTrustZoneBrowseResponse as ag, type EngramAccessTrustZoneDemoSeedRequest as ah, type EngramAccessTrustZoneDemoSeedResponse as ai, type EngramAccessTrustZonePromoteRequest as aj, type EngramAccessTrustZonePromoteResponse as ak, type EngramAccessTrustZoneRecordSummary as al, type EngramAccessTrustZoneStatusResponse as am, type EngramAccessWriteEnvelope as an, type MemoryScopePlan as ao, shapeMemorySummary as ap, type DecisionSurfaceResponse as b, type DeltaSurfaceRequest as c, type DeltaSurfaceResponse as d, type EngramAccessWriteResponse as e, EngramAccessService as f, type EngramAccessRecallResponse as g, EngramAccessInputError as h, type ProcedureStatsRecent as i, type ProcedureStatsReport as j, type ProcedureStatusCounts as k, computeProcedureStats as l, formatProcedureStatsText as m, ENGRAM_ACCESS_WRITE_SCHEMA_VERSION as n, type EngramAccessActionConfidenceRequest as o, type EngramAccessActionConfidenceResponse as p, type EngramAccessBriefingRequest as q, type EngramAccessBriefingResponse as r, type EngramAccessCapsuleListResponse as s, type EngramAccessDaySummaryRequest as t, type EngramAccessEntityListResponse as u, type EngramAccessEntityResponse as v, type EngramAccessEntitySummary as w, type EngramAccessHealthResponse as x, type EngramAccessLcmCompactionFlushRequest as y, type EngramAccessLcmCompactionFlushResponse as z };