@remnic/core 9.3.700 → 9.3.702

package/dist/{chunk-3E5WRQNQ.js → chunk-OXEAMU42.js}

@@ -9,9 +9,12 @@ import {
 import {
   importCapsule
 } from "./chunk-DL6H3D7S.js";
+import {
+  planSessionTranscriptMigration
+} from "./chunk-IQ7WCZRW.js";
 import {
   toRecallExplainJson
-} from "./chunk-D75JXBV4.js";
+} from "./chunk-WN4GHSDH.js";
 import {
   applyTagFilter,
   normalizeTags,
@@ -29,9 +32,10 @@ import {
   projectTagProjectId,
   resolveCodingNamespaceOverlay,
   resolveGitContext,
+  resolveScopePlan,
   resolveScopeProfilePlan,
   sanitizeFragment
-} from "./chunk-HRUULBBV.js";
+} from "./chunk-SHRRWOVY.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -46,7 +50,7 @@ import {
 } from "./chunk-FF4KLI5W.js";
 import {
   estimateRecallTokens
-} from "./chunk-SDPDU2PM.js";
+} from "./chunk-YTMDF6S7.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-BMFZLLNI.js";
@@ -60,7 +64,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-RJ2THZ4H.js";
+} from "./chunk-MBUM2Y3L.js";
 import {
   namespaceCollectionName
 } from "./chunk-VPAFWWCL.js";
@@ -83,7 +87,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-U33LWTQQ.js";
+} from "./chunk-HV57RHMD.js";
 import {
   buildProcedurePersistBody,
   normalizeProcedureSteps
@@ -103,17 +107,17 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-6JDGADXK.js";
+} from "./chunk-6VVP6NK7.js";
 import {
   parseEntityFile
-} from "./chunk-X74FJSW7.js";
+} from "./chunk-GFIARMA7.js";
 import {
   stripAttributesSuffix
 } from "./chunk-SVOZFLIQ.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-IKNQAGBV.js";
+} from "./chunk-IX3UQT4H.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -2420,6 +2424,365 @@ function formatProcedureStatsText(report) {
   return lines.join("\n") + "\n";
 }
 
+// src/admin/admin-surfaces.ts
+import path5 from "path";
+var REDACTED = "<redacted>";
+var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
+var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
+var LONG_OPAQUE_RE = /^[A-Za-z0-9_\-]{32,}$/;
+var SAFE_DIAGNOSTIC_KEYS = /* @__PURE__ */ new Set(["identityToken"]);
+function redactSensitive(value) {
+  return walkRedact(value, void 0);
+}
+function walkRedact(value, key) {
+  if (typeof value === "string") {
+    if (key && SENSITIVE_KEY_RE.test(key) && !SAFE_DIAGNOSTIC_KEYS.has(key)) {
+      return REDACTED;
+    }
+    if (BEARER_VALUE_RE.test(value)) return REDACTED;
+    if (!(key && SAFE_DIAGNOSTIC_KEYS.has(key)) && LONG_OPAQUE_RE.test(value) && value.length >= 40 && !/^[0-9a-f]{16}$/.test(value)) {
+      return REDACTED;
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => walkRedact(entry, void 0));
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const out = {};
+    for (const [k, v] of Object.entries(record)) {
+      out[k] = walkRedact(v, k);
+    }
+    return out;
+  }
+  return value;
+}
+function inspectScope(options) {
+  const { config } = options;
+  const namespacesEnabled = options.namespacesEnabled ?? config.namespacesEnabled === true;
+  const plan = resolveScopePlan({
+    config,
+    sessionKey: options.sessionKey,
+    namespace: options.namespace,
+    principalOverride: options.principalOverride,
+    codingContext: options.codingContext ?? null,
+    namespacesEnabled
+  });
+  const warnings = [];
+  if (namespacesEnabled && !plan.principal) {
+    warnings.push("namespace routing is enabled but no principal resolved for this session key");
+  }
+  if (config.codingMode?.projectScope && namespacesEnabled && options.codingContext && !plan.codingOverlay) {
+    warnings.push("coding project scope is enabled but the overlay was suppressed by an explicit namespace override");
+  }
+  if (options.namespace && options.namespace.trim().length > 0 && !plan.namespaceOverride) {
+    warnings.push(
+      `requested namespace override '${options.namespace}' is not readable by this principal and was ignored`
+    );
+  }
+  const layers = [];
+  const scopeProfilePlan = plan.scopeProfilePlan;
+  if (scopeProfilePlan) {
+    for (const layer of scopeProfilePlan.layers) {
+      layers.push({
+        id: layer.id,
+        namespace: layer.namespace,
+        readable: layer.readable,
+        writable: layer.writable,
+        promotable: layer.promotable,
+        reason: layer.reason
+      });
+    }
+    for (const target of scopeProfilePlan.promotionTargets) {
+      if (!layers.some((layer) => layer.id === target.target)) {
+        layers.push({
+          id: target.target,
+          namespace: target.namespace,
+          readable: false,
+          writable: false,
+          promotable: target.authorized,
+          reason: target.reason
+        });
+      }
+    }
+  } else {
+    layers.push({
+      id: "self",
+      namespace: plan.baseNamespace,
+      readable: canReadNamespace(plan.principal, plan.baseNamespace, config),
+      writable: canWriteNamespace(plan.principal, plan.baseNamespace, config),
+      promotable: false,
+      reason: "principal self namespace (no scope profile active)"
+    });
+  }
+  if (plan.codingOverlay) {
+    layers.push({
+      id: "coding",
+      namespace: plan.codingOverlay.namespace,
+      readable: true,
+      writable: true,
+      promotable: false,
+      reason: "coding overlay namespace combined with the principal base (rule 42)"
+    });
+  }
+  if (plan.namespaceOverride) {
+    layers.push({
+      id: "explicit",
+      namespace: plan.namespaceOverride,
+      readable: true,
+      writable: canWriteNamespace(plan.principal, plan.namespaceOverride, config),
+      promotable: false,
+      reason: "explicit namespace override authorized for this principal"
+    });
+  }
+  const promotionTargets = scopeProfilePlan ? scopeProfilePlan.promotionTargets.map((target) => ({
+    target: target.target,
+    namespace: target.namespace,
+    authorized: target.authorized,
+    reason: target.reason
+  })) : [];
+  for (const warning of scopeProfilePlan?.warnings ?? []) {
+    warnings.push(warning);
+  }
+  return {
+    principal: plan.principal,
+    namespaceOverride: plan.namespaceOverride,
+    writeNamespace: plan.baseNamespace,
+    readNamespaces: [...plan.readNamespaces],
+    codingOverlay: plan.codingOverlay ? {
+      namespace: plan.codingOverlay.namespace,
+      readFallbacks: plan.codingOverlay.readFallbacks
+    } : null,
+    scopeProfileId: scopeProfilePlan?.profileId ?? null,
+    layers,
+    promotionTargets,
+    warnings,
+    plan
+  };
+}
+async function listAdminNamespaces(options) {
+  const { catalog, filter } = options;
+  if (!catalog.enabled) {
+    return { enabled: false, entries: [] };
+  }
+  const staleMs = (options.staleThresholdDays ?? 30) * 24 * 60 * 60 * 1e3;
+  const staleBefore = new Date(Date.now() - staleMs);
+  const records = await catalog.listNamespaces({
+    kind: filter?.kind,
+    discoveredBy: filter?.discoveredBy,
+    writtenSince: filter?.writtenSince
+  });
+  let entries = records.map((record) => toAdminEntry(record, staleBefore));
+  if (filter?.principal) {
+    entries = entries.filter((entry) => entry.principal === filter.principal);
+  }
+  if (filter?.projectId) {
+    entries = entries.filter((entry) => entry.projectId === filter.projectId);
+  }
+  if (filter?.staleBefore) {
+    const cutoff = filter.staleBefore.getTime();
+    entries = entries.filter((entry) => {
+      if (!entry.lastWriteAt) return true;
+      const ms = Date.parse(entry.lastWriteAt);
+      return Number.isFinite(ms) && ms <= cutoff;
+    });
+  }
+  return { enabled: true, entries };
+}
+function toAdminEntry(record, staleBefore) {
+  const lastWriteMs = record.lastWriteAt ? Date.parse(record.lastWriteAt) : Number.NaN;
+  const stale = !Number.isFinite(lastWriteMs) || lastWriteMs < staleBefore.getTime();
+  return {
+    namespace: record.namespace,
+    identityToken: record.identityToken,
+    kind: record.kind,
+    principal: record.principal,
+    projectId: record.projectId,
+    branch: record.branch,
+    parentNamespace: record.parentNamespace,
+    createdAt: record.createdAt,
+    lastReadAt: record.lastReadAt,
+    lastWriteAt: record.lastWriteAt,
+    lastMaintenanceAt: record.lastMaintenanceAt,
+    storageDir: record.storageDir,
+    discoveredBy: record.discoveredBy,
+    stale
+  };
+}
+async function gatherMaintenanceHealth(options) {
+  const { catalog, qmdHealthProvider } = options;
+  if (!catalog.enabled) {
+    return { enabled: false, degradedMode: false, perNamespace: [] };
+  }
+  const records = await catalog.listNamespaces();
+  let degradedMode = false;
+  const perNamespace = await Promise.all(
+    records.map(async (record) => {
+      const entry = {
+        namespace: record.namespace,
+        kind: record.kind,
+        lastMaintenanceAt: record.lastMaintenanceAt,
+        maintenanceMissing: !record.lastMaintenanceAt || Object.keys(record.lastMaintenanceAt).length === 0,
+        qmdDegraded: false
+      };
+      if (qmdHealthProvider) {
+        try {
+          const qmd = await qmdHealthProvider(record.namespace);
+          if (qmd) {
+            entry.qmd = qmd;
+            entry.qmdDegraded = !qmd.available || qmd.collectionState === "missing" || qmd.collectionState === "unknown";
+          }
+        } catch (err) {
+          entry.qmdDegraded = true;
+          entry.qmdError = "QMD health probe failed";
+        }
+      }
+      if (entry.qmdDegraded) degradedMode = true;
+      return entry;
+    })
+  );
+  return { enabled: true, degradedMode, perNamespace };
+}
+async function auditTranscripts(memoryDir) {
+  const plan = await planSessionTranscriptMigration({
+    memoryDir,
+    apply: false
+  });
+  const files = plan.files.map((file) => ({
+    sourceRelPath: file.sourceRelPath,
+    fileName: file.fileName,
+    distinctSessions: file.groups.length,
+    movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
+    unmovableLines: file.unmovableLines
+  }));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path5.sep).includes("other"));
+  const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
+  return {
+    generatedAt: plan.generatedAt,
+    dryRun: true,
+    transcriptsDir: plan.transcriptsDir,
+    mixedOtherDefault,
+    distinctSessions: plan.distinctSessions,
+    movedEntries: plan.movedEntries,
+    files,
+    summary
+  };
+}
+var AdminPromotionError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "AdminPromotionError";
+    this.code = code;
+  }
+};
+async function promoteMemory(options) {
+  const reason = options.reason.trim();
+  if (reason.length === 0) {
+    throw new AdminPromotionError("reason_required", "promotion requires a non-empty reason");
+  }
+  if (options.targets.length === 0) {
+    throw new AdminPromotionError("targets_required", "promotion requires at least one target");
+  }
+  const { config, principal, scopeProfilePlan } = options;
+  const resolvedTargets = options.targets.map((requested) => {
+    if (requested.kind === "explicit") {
+      const namespace = requested.namespace?.trim();
+      if (!namespace) {
+        return {
+          target: requested.kind,
+          namespace: "",
+          authorized: false,
+          promoted: false,
+          reason: "explicit promotion requires a namespace"
+        };
+      }
+      const authorized = canWriteNamespace(principal, namespace, config);
+      return {
+        target: requested.kind,
+        namespace,
+        authorized,
+        promoted: false,
+        reason: authorized ? "explicit namespace writable by this principal" : "explicit namespace is not writable by this principal"
+      };
+    }
+    const layer = scopeProfilePlan?.promotionTargets.find((t) => t.target === requested.kind);
+    if (!layer) {
+      return {
+        target: requested.kind,
+        namespace: "",
+        authorized: false,
+        promoted: false,
+        reason: `promotion target '${requested.kind}' is not configured on the active scope profile`
+      };
+    }
+    return {
+      target: requested.kind,
+      namespace: layer.namespace ?? "",
+      authorized: layer.authorized && Boolean(layer.namespace),
+      promoted: false,
+      reason: layer.reason
+    };
+  });
+  const sourceMemory = await options.storage.readMemory(options.sourceNamespace, options.sourceMemoryId);
+  if (!sourceMemory) {
+    throw new AdminPromotionError(
+      "source_not_found",
+      `source memory ${options.sourceMemoryId} not found in namespace ${options.sourceNamespace}`
+    );
+  }
+  const auditTargets = [];
+  for (const target of resolvedTargets) {
+    if (!target.authorized || !target.namespace) {
+      auditTargets.push({ target: target.target, namespace: target.namespace, promoted: false });
+      continue;
+    }
+    if (target.namespace === options.sourceNamespace) {
+      target.reason = "target namespace equals source namespace; nothing to promote";
+      auditTargets.push({ target: target.target, namespace: target.namespace, promoted: false });
+      continue;
+    }
+    try {
+      const promotedId = await options.storage.writePromotedMemory(target.namespace, {
+        category: sourceMemory.category,
+        content: sourceMemory.content,
+        confidence: sourceMemory.frontmatter.confidence ?? 0.5,
+        tags: [...sourceMemory.frontmatter.tags ?? [], `admin-promotion-${target.target}`],
+        entityRef: sourceMemory.frontmatter.entityRef,
+        sourceMemoryId: options.sourceMemoryId,
+        sourceNamespace: options.sourceNamespace,
+        reason,
+        actor: options.actor,
+        validAt: sourceMemory.frontmatter.valid_at,
+        lineage: [options.sourceMemoryId]
+      });
+      target.promoted = true;
+      target.promotedMemoryId = promotedId;
+      auditTargets.push({ target: target.target, namespace: target.namespace, promoted: true });
+    } catch (err) {
+      target.reason = "promotion write failed";
+      auditTargets.push({ target: target.target, namespace: target.namespace, promoted: false });
+    }
+  }
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  const audit = {
+    at,
+    actor: options.actor,
+    sourceMemoryId: options.sourceMemoryId,
+    sourceNamespace: options.sourceNamespace,
+    reason,
+    targets: auditTargets
+  };
+  return {
+    ok: resolvedTargets.some((t) => t.promoted),
+    sourceMemoryId: options.sourceMemoryId,
+    sourceNamespace: options.sourceNamespace,
+    targets: resolvedTargets,
+    audit
+  };
+}
+
 // src/access-service.ts
 import * as nodePath from "path";
 var EngramAccessInputError = class extends Error {
@@ -7730,6 +8093,163 @@ ${next}`);
       limit: request.limit
     });
   }
+  // ── Admin console surfaces (issue #1502) ────────────────────────────────
+  //
+  // Thin delegators. Every method threads `this.orchestrator` references
+  // into the pure `admin/admin-surfaces.ts` functions so the dashboard
+  // never re-resolves scope, re-derives promotion targets, or re-lists
+  // namespaces.
+  /**
+   * Resolve an effective scope inspection for the console. Inputs are
+   * redacted before return so an operator-supplied principal preview /
+   * namespace override never echoes a pasted credential back.
+   */
+  async adminInspectScope(options) {
+    const config = this.orchestrator.config;
+    const codingContext = options.sessionKey ? this.orchestrator.getCodingContextForSession(options.sessionKey) ?? null : null;
+    const inspection = inspectScope({
+      config,
+      sessionKey: options.sessionKey,
+      namespace: options.namespace,
+      principalOverride: options.principalOverride,
+      codingContext,
+      operation: options.operation
+    });
+    return redactSensitive(inspection);
+  }
+  /**
+   * List configured + discovered namespaces from the catalog with the
+   * admin filters the console exposes.
+   */
+  async adminListNamespaces(filter) {
+    const result = await listAdminNamespaces({
+      catalog: this.orchestrator.namespaceCatalog,
+      filter
+    });
+    return redactSensitive(result);
+  }
+  /**
+   * Per-namespace maintenance + QMD health. QMD diagnostics are probed via
+   * the orchestrator's search health accessor (one probe per namespace).
+   */
+  async adminMaintenanceHealth() {
+    const report = await gatherMaintenanceHealth({
+      catalog: this.orchestrator.namespaceCatalog,
+      qmdHealthProvider: async (namespace) => {
+        try {
+          const health = await this.orchestrator.searchHealthForNamespace(namespace);
+          return {
+            namespace,
+            collection: health.collection,
+            available: health.available,
+            collectionState: health.collectionState,
+            debugStatus: health.debugStatus,
+            installedVersion: health.installedVersion,
+            supportedVersion: health.supportedVersion,
+            supported: health.supported,
+            upgradeAvailable: health.upgradeAvailable,
+            daemonMode: health.daemonMode
+          };
+        } catch (err) {
+          throw err;
+        }
+      }
+    });
+    return redactSensitive(report);
+  }
+  /**
+   * Dry-run transcript/session audit. Detects mixed `other/default` data
+   * and legacy stranded directories. Never applies a migration.
+   */
+  async adminTranscriptAudit() {
+    const result = await auditTranscripts(this.orchestrator.config.memoryDir);
+    return redactSensitive(result);
+  }
+  /**
+   * Manually promote a memory into one or more authorized targets. Requires
+   * a non-empty reason (audit-logged). Reuses the scope-profile promotion
+   * resolution and `canWriteNamespace` gate — there is no dashboard-only
+   * write path.
+   */
+  async adminPromoteMemory(request) {
+    const config = this.orchestrator.config;
+    const namespacesEnabled = config.namespacesEnabled === true;
+    let sourceNamespace;
+    if (request.namespace) {
+      sourceNamespace = this.resolveReadableNamespace(
+        request.namespace,
+        request.principal
+      );
+    } else {
+      const codingContext2 = request.sessionKey ? this.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+      const plan = resolveScopePlan({
+        config,
+        sessionKey: request.sessionKey,
+        principalOverride: request.principal,
+        codingContext: codingContext2,
+        namespacesEnabled
+      });
+      sourceNamespace = this.resolveReadableNamespace(
+        plan.baseNamespace,
+        request.principal
+      );
+    }
+    const codingContext = request.sessionKey ? this.orchestrator.getCodingContextForSession(request.sessionKey) ?? null : null;
+    const codingOverlay = codingContext ? resolveCodingNamespaceOverlay(
+      codingContext,
+      config.codingMode,
+      config.defaultNamespace
+    ) : null;
+    const scopeProfilePlan = resolveScopeProfilePlan({
+      config,
+      principal: request.principal,
+      codingContext,
+      codingOverlay
+    });
+    const storage = {
+      readMemory: async (namespace, memoryId) => {
+        const resolved = await this.orchestrator.getStorage(namespace);
+        const memory = await resolved.getMemoryById(memoryId);
+        if (!memory) return null;
+        return {
+          category: memory.frontmatter.category,
+          content: memory.content,
+          frontmatter: memory.frontmatter
+        };
+      },
+      writePromotedMemory: async (namespace, memory) => {
+        const resolved = await this.orchestrator.getStorage(namespace);
+        return resolved.writeMemory(memory.category, memory.content, {
+          confidence: memory.confidence,
+          tags: memory.tags,
+          entityRef: memory.entityRef,
+          source: `admin-promotion:${memory.sourceNamespace}:${memory.reason.slice(0, 120)}`,
+          lineage: memory.lineage,
+          sourceMemoryId: memory.sourceMemoryId,
+          actor: memory.actor,
+          validAt: memory.validAt
+        });
+      }
+    };
+    try {
+      return await promoteMemory({
+        config,
+        sourceMemoryId: request.sourceMemoryId,
+        sourceNamespace,
+        principal: request.principal,
+        targets: request.targets,
+        reason: request.reason,
+        actor: request.principal ?? "admin-console",
+        storage,
+        scopeProfilePlan
+      });
+    } catch (err) {
+      if (err instanceof AdminPromotionError) {
+        throw new EngramAccessInputError(err.message);
+      }
+      throw err;
+    }
+  }
 };
 
 export {
@@ -7743,4 +8263,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-3E5WRQNQ.js.map
+//# sourceMappingURL=chunk-OXEAMU42.js.map