@remnic/core 9.3.751 → 9.3.752

package/dist/{chunk-WA7FECSG.js → chunk-6ROCH5JV.js}

@@ -11,23 +11,23 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-E4PFDD3N.js";
+} from "./chunk-MEPWWSTD.js";
 import {
   validateRequest
-} from "./chunk-TPLE6SNY.js";
+} from "./chunk-KFNG72W7.js";
 import {
   getOperation
-} from "./chunk-B35L45HZ.js";
+} from "./chunk-DC5OBZS3.js";
 import {
   CorrectionContractError,
   EngramAccessInputError
-} from "./chunk-UETBEHBA.js";
+} from "./chunk-VX2RYM2K.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
 import {
   projectTagProjectId
-} from "./chunk-W3M34XT4.js";
+} from "./chunk-GECEETQ3.js";
 import {
   subscribeGraphEvents
 } from "./chunk-DEUNUKTD.js";
@@ -1767,7 +1767,7 @@ var EngramAccessHttpServer = class {
     if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
       void getOperation("contradiction_scan_run");
       const body = await this.readJsonBody(req);
-      const { runContradictionScan } = await import("./contradiction-scan-3FJYWS3G.js");
+      const { runContradictionScan } = await import("./contradiction-scan-KO4WWCS4.js");
       const principal = this.resolveRequestPrincipal(req);
       const result = await runContradictionScan({
         storage: this.service.storageRef,
@@ -2627,4 +2627,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-WA7FECSG.js.map
+//# sourceMappingURL=chunk-6ROCH5JV.js.map

package/dist/{chunk-5QANTTY2.js → chunk-BIAMJUUJ.js}

@@ -3,12 +3,12 @@ import {
   refineCompressionGuidelineCandidateSemantically,
   renderCompressionGuidelinesMarkdown
 } from "./chunk-OD4FM2U7.js";
-import {
-  resolveCompressionCapabilities
-} from "./chunk-VSF7AAGE.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  resolveCompressionCapabilities
+} from "./chunk-VSF7AAGE.js";
 
 // src/orchestration/compression-guideline-coordinator.ts
 import { createHash } from "crypto";
@@ -283,4 +283,4 @@ export {
   CompressionGuidelineCoordinator,
   formatCompressionGuidelinesForRecall
 };
-//# sourceMappingURL=chunk-5QANTTY2.js.map
+//# sourceMappingURL=chunk-BIAMJUUJ.js.map

package/dist/{chunk-IKHKHADN.js → chunk-C4LNKQ3M.js}

@@ -1,6 +1,6 @@
 import {
   runPostConsolidationMaterialize
-} from "./chunk-SD34EK4Z.js";
+} from "./chunk-FEELYTRT.js";
 import {
   discoverMemoryExtensions,
   renderExtensionsBlock,
@@ -13,12 +13,12 @@ import {
 import {
   isSemanticConsolidationLlmOperator
 } from "./chunk-G7D6GZ5J.js";
-import {
-  resolvePipelineProcessingCapabilities
-} from "./chunk-VSF7AAGE.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  resolvePipelineProcessingCapabilities
+} from "./chunk-VSF7AAGE.js";
 
 // src/semantic-consolidation.ts
 function findSimilarClusters(memories, config) {
@@ -220,4 +220,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-IKHKHADN.js.map
+//# sourceMappingURL=chunk-C4LNKQ3M.js.map

package/dist/{chunk-B35L45HZ.js → chunk-DC5OBZS3.js}

@@ -1,6 +1,6 @@
 import {
   EngramAccessInputError
-} from "./chunk-UETBEHBA.js";
+} from "./chunk-VX2RYM2K.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -130,4 +130,4 @@ export {
   listRegisteredOperations,
   __resetRegistryForTest
 };
-//# sourceMappingURL=chunk-B35L45HZ.js.map
+//# sourceMappingURL=chunk-DC5OBZS3.js.map

package/dist/{chunk-ORAK3LNZ.js → chunk-ER3CCWK2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7FL4CNPV.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-SQNED75R.js";
+} from "./chunk-V5UV7BOA.js";
 import {
   normalizeRecallTokens
 } from "./chunk-ZBJMUXZH.js";
@@ -339,4 +339,4 @@ export {
   scoreStitchCandidate,
   stitchCausalChain
 };
-//# sourceMappingURL=chunk-ORAK3LNZ.js.map
+//# sourceMappingURL=chunk-ER3CCWK2.js.map

package/dist/{chunk-SD34EK4Z.js → chunk-FEELYTRT.js}

@@ -7,13 +7,13 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-ZBVQ4ZM4.js";
-import {
-  isSafeRouteNamespace
-} from "./chunk-U3PN77QT.js";
+} from "./chunk-YGNQG4Q6.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  isSafeRouteNamespace
+} from "./chunk-U3PN77QT.js";
 
 // src/connectors/codex-materialize-runner.ts
 import { existsSync } from "fs";
@@ -118,4 +118,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-SD34EK4Z.js.map
+//# sourceMappingURL=chunk-FEELYTRT.js.map

package/dist/{chunk-KQAFEZQX.js → chunk-FLVL4L3L.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-WEHSQBFR.js";
 import {
   encryptCapsuleFile
-} from "./chunk-X7Y7WX73.js";
+} from "./chunk-437S3G37.js";
 import {
   CAPSULE_SCHEMA_VERSION,
   EXPORT_FORMAT
@@ -261,4 +261,4 @@ export {
   exportCapsule,
   isValidCapsuleSince
 };
-//# sourceMappingURL=chunk-KQAFEZQX.js.map
+//# sourceMappingURL=chunk-FLVL4L3L.js.map

package/dist/{chunk-WIWPSQYU.js → chunk-FXRFFYWD.js}

@@ -1,9 +1,9 @@
-import {
-  validateRouteTarget
-} from "./chunk-U3PN77QT.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  validateRouteTarget
+} from "./chunk-U3PN77QT.js";
 
 // src/routing/store.ts
 import { lstat, mkdir, readFile, realpath, rename, rm, rmdir, stat, writeFile } from "fs/promises";
@@ -306,4 +306,4 @@ var RoutingRulesStore = class {
 export {
   RoutingRulesStore
 };
-//# sourceMappingURL=chunk-WIWPSQYU.js.map
+//# sourceMappingURL=chunk-FXRFFYWD.js.map

package/dist/{chunk-W3M34XT4.js → chunk-GECEETQ3.js}

@@ -5,6 +5,9 @@ import {
 import {
   launchProcessSync
 } from "./chunk-O75CRYGF.js";
+import {
+  expandTildePath
+} from "./chunk-EYIEWJNI.js";
 import {
   canReadNamespace,
   canWriteNamespace,
@@ -18,9 +21,6 @@ import {
 import {
   resolveNamespaceCapabilities
 } from "./chunk-VSF7AAGE.js";
-import {
-  expandTildePath
-} from "./chunk-EYIEWJNI.js";
 
 // src/coding/git-context.ts
 import path from "path";
@@ -772,4 +772,4 @@ export {
   resolveNamespaceFromStorageDir,
   resolveWritableNamespaceValue
 };
-//# sourceMappingURL=chunk-W3M34XT4.js.map
+//# sourceMappingURL=chunk-GECEETQ3.js.map

package/dist/{chunk-WWSXVOGY.js → chunk-GFGYHLON.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-ZBVQ4ZM4.js";
+} from "./chunk-YGNQG4Q6.js";
 
 // src/semantic-rule-promotion.ts
 import { createHash, randomUUID } from "crypto";
@@ -529,4 +529,4 @@ export {
   setSemanticRulePromotionTestHooks,
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-WWSXVOGY.js.map
+//# sourceMappingURL=chunk-GFGYHLON.js.map

package/dist/{chunk-BJMBJZ2Y.js → chunk-GWTFLF2P.js}

@@ -17,6 +17,58 @@ import {
   __export
 } from "./chunk-PZ5AY32C.js";
 
+// src/secure-store/keyring.ts
+var keyring_exports = {};
+__export(keyring_exports, {
+  getKey: () => getKey,
+  lock: () => lock,
+  lockAll: () => lockAll,
+  size: () => size,
+  status: () => status,
+  unlock: () => unlock
+});
+var ENTRIES = /* @__PURE__ */ new Map();
+function unlock(id, key, now = () => /* @__PURE__ */ new Date()) {
+  if (typeof id !== "string" || id.length === 0) {
+    throw new Error("keyring id must be a non-empty string");
+  }
+  if (!Buffer.isBuffer(key) || key.length !== 32) {
+    throw new Error(`keyring key must be a 32-byte Buffer, got length=${key?.length ?? "non-buffer"}`);
+  }
+  const existing = ENTRIES.get(id);
+  if (existing) {
+    existing.key.fill(0);
+  }
+  ENTRIES.set(id, { key, unlockedAt: now().toISOString() });
+}
+function getKey(id) {
+  const entry = ENTRIES.get(id);
+  return entry ? entry.key : null;
+}
+function lock(id) {
+  const entry = ENTRIES.get(id);
+  if (!entry) return false;
+  entry.key.fill(0);
+  ENTRIES.delete(id);
+  return true;
+}
+function lockAll() {
+  for (const entry of ENTRIES.values()) {
+    entry.key.fill(0);
+  }
+  ENTRIES.clear();
+}
+function status(id) {
+  const entry = ENTRIES.get(id);
+  if (!entry) {
+    return { unlocked: false, unlockedAt: null };
+  }
+  return { unlocked: true, unlockedAt: entry.unlockedAt };
+}
+function size() {
+  return ENTRIES.size;
+}
+
 // src/secure-store/header.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import path from "path";
@@ -213,59 +265,12 @@ function buildHeaderFromPassphrase(options) {
   return { header, derivedKey };
 }
 
-// src/secure-store/keyring.ts
-var keyring_exports = {};
-__export(keyring_exports, {
-  getKey: () => getKey,
-  lock: () => lock,
-  lockAll: () => lockAll,
-  size: () => size,
-  status: () => status,
-  unlock: () => unlock
-});
-var ENTRIES = /* @__PURE__ */ new Map();
-function unlock(id, key, now = () => /* @__PURE__ */ new Date()) {
-  if (typeof id !== "string" || id.length === 0) {
-    throw new Error("keyring id must be a non-empty string");
-  }
-  if (!Buffer.isBuffer(key) || key.length !== 32) {
-    throw new Error(`keyring key must be a 32-byte Buffer, got length=${key?.length ?? "non-buffer"}`);
-  }
-  const existing = ENTRIES.get(id);
-  if (existing) {
-    existing.key.fill(0);
-  }
-  ENTRIES.set(id, { key, unlockedAt: now().toISOString() });
-}
-function getKey(id) {
-  const entry = ENTRIES.get(id);
-  return entry ? entry.key : null;
-}
-function lock(id) {
-  const entry = ENTRIES.get(id);
-  if (!entry) return false;
-  entry.key.fill(0);
-  ENTRIES.delete(id);
-  return true;
-}
-function lockAll() {
-  for (const entry of ENTRIES.values()) {
-    entry.key.fill(0);
-  }
-  ENTRIES.clear();
-}
-function status(id) {
-  const entry = ENTRIES.get(id);
-  if (!entry) {
-    return { unlocked: false, unlockedAt: null };
-  }
-  return { unlocked: true, unlockedAt: entry.unlockedAt };
-}
-function size() {
-  return ENTRIES.size;
-}
-
 export {
+  unlock,
+  getKey,
+  lock,
+  status,
+  keyring_exports,
   SECURE_STORE_DIR_NAME,
   HEADER_FILENAME,
   HEADER_FORMAT,
@@ -280,11 +285,6 @@ export {
   deriveKeyFromHeader,
   readHeader,
   writeHeader,
-  buildHeaderFromPassphrase,
-  unlock,
-  getKey,
-  lock,
-  status,
-  keyring_exports
+  buildHeaderFromPassphrase
 };
-//# sourceMappingURL=chunk-BJMBJZ2Y.js.map
+//# sourceMappingURL=chunk-GWTFLF2P.js.map

package/dist/chunk-GWTFLF2P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/secure-store/keyring.ts","../src/secure-store/header.ts"],"sourcesContent":["/**\n * In-memory keyring for the secure-store module (issue #690 PR 2/4).\n *\n * Holds derived AES-256-GCM master keys for unlocked stores. The\n * keyring is process-local: keys are NEVER persisted to disk, never\n * logged, and never serialized. A daemon restart re-locks every\n * registered store.\n *\n * Scoping\n * -------\n * Entries are keyed by a stable string id (typically the absolute\n * path to the secure-store directory, after `~` expansion). This\n * lets multiple memory roots share a single daemon process without\n * one store's key bleeding into another (matches the per-`serviceId`\n * scoping discipline called out in CLAUDE.md gotcha #11).\n *\n * Lifecycle\n * ---------\n *   - `unlock(id, key)` — register a derived key.\n *   - `getKey(id)` — read a registered key (or `null`).\n *   - `lock(id)` — clear a single entry, zeroing the key bytes.\n *   - `lockAll()` — clear every entry, zeroing every key.\n *   - `status(id)` — non-secret status snapshot for `secure-store\n *     status`.\n *\n * Zeroization\n * -----------\n * `lock` and `lockAll` overwrite the key buffer with zeros before\n * dropping the reference. The JS engine may keep additional copies\n * outside our control; this is best-effort hygiene, not a defense\n * against memory-dump attacks.\n */\n\nconst ENTRIES = new Map<string, KeyringEntry>();\n\n/** A single unlocked store. The key buffer is never copied out. */\ninterface KeyringEntry {\n  key: Buffer;\n  unlockedAt: string;\n}\n\n/** Status snapshot — no secret material. */\nexport interface KeyringStatus {\n  /** True iff a key is currently registered for this id. */\n  unlocked: boolean;\n  /** ISO-8601 timestamp the key was registered, or null when locked. */\n  unlockedAt: string | null;\n}\n\n/**\n * Register a derived key for the given id. If an entry already\n * exists, its old key is zeroed before being replaced.\n *\n * The caller MUST pass an exclusive 32-byte buffer; the keyring\n * takes ownership and will zero it on lock.\n */\nexport function unlock(id: string, key: Buffer, now: () => Date = () => new Date()): void {\n  if (typeof id !== \"string\" || id.length === 0) {\n    throw new Error(\"keyring id must be a non-empty string\");\n  }\n  if (!Buffer.isBuffer(key) || key.length !== 32) {\n    throw new Error(`keyring key must be a 32-byte Buffer, got length=${key?.length ?? \"non-buffer\"}`);\n  }\n  const existing = ENTRIES.get(id);\n  if (existing) {\n    existing.key.fill(0);\n  }\n  ENTRIES.set(id, { key, unlockedAt: now().toISOString() });\n}\n\n/** Read the registered key for `id`, or `null` if locked. */\nexport function getKey(id: string): Buffer | null {\n  const entry = ENTRIES.get(id);\n  return entry ? entry.key : null;\n}\n\n/** Clear a single entry. Zeros the underlying buffer. Returns true if cleared. */\nexport function lock(id: string): boolean {\n  const entry = ENTRIES.get(id);\n  if (!entry) return false;\n  entry.key.fill(0);\n  ENTRIES.delete(id);\n  return true;\n}\n\n/** Clear every registered key. Used on shutdown or for tests. */\nexport function lockAll(): void {\n  for (const entry of ENTRIES.values()) {\n    entry.key.fill(0);\n  }\n  ENTRIES.clear();\n}\n\n/** Non-secret status snapshot. */\nexport function status(id: string): KeyringStatus {\n  const entry = ENTRIES.get(id);\n  if (!entry) {\n    return { unlocked: false, unlockedAt: null };\n  }\n  return { unlocked: true, unlockedAt: entry.unlockedAt };\n}\n\n/** Test-only helper: how many entries are currently registered. */\nexport function size(): number {\n  return ENTRIES.size;\n}\n","/**\n * On-disk header for an initialized secure-store (issue #690 PR 2/4).\n *\n * The header file is the persistent record that a memory directory\n * has had `remnic secure-store init` run against it. It is a JSON\n * file at `<memoryDir>/.secure-store/header.json` with two parts:\n *\n *   1. The KDF metadata from PR 1/4 (`SecureStoreMetadata`) —\n *      algorithm, params, and salt. Public; safe to read/copy.\n *   2. A \"verifier\" — a tiny AES-GCM-encrypted envelope sealed under\n *      the derived key at init time. Unlock re-derives the key from\n *      the entered passphrase and tries to `open()` the verifier; if\n *      the auth tag validates, the passphrase is correct.\n *\n * Why a verifier?\n * ---------------\n * Without one, \"wrong passphrase\" can only be detected when the\n * daemon tries to decrypt actual memory data — too late for a\n * useful CLI error. The verifier gives the unlock command a fast,\n * data-independent passphrase check.\n *\n * The verifier plaintext is a fixed magic string (no secret content).\n * Its only role is to be sealable + openable; the auth-tag check is\n * what proves the key.\n *\n * Naming\n * ------\n * Directory: `.secure-store/` (leading dot — hidden, hints at\n * sensitivity). File: `header.json`. Avoids collision with\n * `.secure-store-metadata.json` from PR 1/4 docs since the header\n * is a strict superset.\n */\n\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { open, seal } from \"./cipher.js\";\nimport {\n  KDF_KEY_LENGTH,\n  KDF_SALT_LENGTH,\n  deriveKey,\n  type Argon2idParams,\n  type ScryptParams,\n} from \"./kdf.js\";\nimport {\n  buildMetadata,\n  decodeMetadataSalt,\n  parseMetadata,\n  serializeMetadata,\n  type SecureStoreMetadata,\n} from \"./metadata.js\";\n\n/** Subdirectory under `memoryDir` that holds the header + future state. */\nexport const SECURE_STORE_DIR_NAME = \".secure-store\";\n\n/** Header filename. Stable name so operators can locate it. */\nexport const HEADER_FILENAME = \"header.json\";\n\n/** Stable identifier so the file shape is sniffable without parsing JSON. */\nexport const HEADER_FORMAT = \"remnic.secure-store.header\" as const;\n\n/** Current header format version. Bump on breaking schema changes. */\nexport const HEADER_FORMAT_VERSION = 1 as const;\n\n/**\n * Magic bytes sealed under the master key at init time. Constant\n * across stores — there's no value in randomizing it because the\n * salt + IV + auth tag already make every verifier envelope unique.\n *\n * The string never appears in plaintext on disk; it only exists\n * inside an AES-GCM-sealed envelope. Its job is purely to give the\n * cipher something to authenticate.\n */\nexport const VERIFIER_PLAINTEXT = Buffer.from(\"remnic-secure-store-v1\", \"utf8\");\n\n/** AAD bound into the verifier envelope. */\nconst VERIFIER_AAD = Buffer.from(\"remnic-secure-store/verifier\", \"utf8\");\n\nexport interface SecureStoreHeader {\n  format: typeof HEADER_FORMAT;\n  formatVersion: number;\n  /** KDF metadata (algorithm + params + salt). */\n  metadata: SecureStoreMetadata;\n  /** Hex-encoded sealed envelope. */\n  verifier: string;\n  /** ISO-8601 timestamp recorded at init time. */\n  createdAt: string;\n}\n\n/** Resolve the canonical secure-store directory for a memory root. */\nexport function secureStoreDir(memoryDir: string): string {\n  return path.join(memoryDir, SECURE_STORE_DIR_NAME);\n}\n\n/** Resolve the canonical header path for a memory root. */\nexport function headerPath(memoryDir: string): string {\n  return path.join(secureStoreDir(memoryDir), HEADER_FILENAME);\n}\n\n/**\n * Build a `SecureStoreHeader` in memory from an already-derived key\n * and metadata. Pure: does not touch the filesystem. The clock is\n * read once if `createdAt` is omitted.\n */\nexport function buildHeader(options: {\n  metadata: SecureStoreMetadata;\n  derivedKey: Buffer;\n  createdAt?: string;\n}): SecureStoreHeader {\n  const { metadata, derivedKey } = options;\n  if (!Buffer.isBuffer(derivedKey) || derivedKey.length !== KDF_KEY_LENGTH) {\n    throw new Error(\n      `derivedKey must be a ${KDF_KEY_LENGTH}-byte Buffer, got length=${derivedKey?.length ?? \"non-buffer\"}`,\n    );\n  }\n  const salt = decodeMetadataSalt(metadata);\n  if (salt.length !== KDF_SALT_LENGTH) {\n    throw new Error(`metadata salt is ${salt.length} bytes, expected ${KDF_SALT_LENGTH}`);\n  }\n  const envelope = seal(derivedKey, salt, VERIFIER_PLAINTEXT, { aad: VERIFIER_AAD });\n  return {\n    format: HEADER_FORMAT,\n    formatVersion: HEADER_FORMAT_VERSION,\n    metadata,\n    verifier: envelope.toString(\"hex\"),\n    createdAt: options.createdAt ?? new Date().toISOString(),\n  };\n}\n\n/** Stable JSON serialization with locked top-level key order. */\nexport function serializeHeader(header: SecureStoreHeader): string {\n  validateHeader(header);\n  // Inline metadata as a parsed object so it shares the same\n  // canonical key ordering as the standalone metadata file.\n  const metadataString = serializeMetadata(header.metadata);\n  const metadataObject = JSON.parse(metadataString) as Record<string, unknown>;\n  const ordered = {\n    format: header.format,\n    formatVersion: header.formatVersion,\n    metadata: metadataObject,\n    verifier: header.verifier,\n    createdAt: header.createdAt,\n  };\n  return JSON.stringify(ordered, null, 2);\n}\n\n/** Parse a header JSON string. Throws on any structural problem. */\nexport function parseHeader(json: string): SecureStoreHeader {\n  if (typeof json !== \"string\") {\n    throw new Error(\"header input must be a string\");\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(json);\n  } catch (e) {\n    const msg = e instanceof Error ? e.message : String(e);\n    throw new Error(`header is not valid JSON: ${msg}`);\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(\"header must be a JSON object\");\n  }\n  const obj = parsed as Record<string, unknown>;\n  if (obj.format !== HEADER_FORMAT) {\n    throw new Error(\n      `unexpected header format: ${String(obj.format)} (expected ${HEADER_FORMAT})`,\n    );\n  }\n  if (obj.formatVersion !== HEADER_FORMAT_VERSION) {\n    throw new Error(\n      `unsupported header formatVersion: ${String(obj.formatVersion)} (this build supports ${HEADER_FORMAT_VERSION})`,\n    );\n  }\n  if (typeof obj.verifier !== \"string\" || obj.verifier.length === 0) {\n    throw new Error(\"header.verifier must be a non-empty hex string\");\n  }\n  if (!/^[0-9a-fA-F]+$/.test(obj.verifier)) {\n    throw new Error(\"header.verifier must be a hex-encoded string\");\n  }\n  // Codex P2 on PR #737: odd-length hex strings produce a malformed\n  // Buffer via `Buffer.from(hex, \"hex\")` — Node silently truncates the\n  // trailing nibble, yielding a buffer that is one byte shorter than\n  // expected. Reject odd-length strings before they reach the cipher.\n  if (obj.verifier.length % 2 !== 0) {\n    throw new Error(\n      \"header.verifier hex string must have even length (each byte encodes as two hex digits)\",\n    );\n  }\n  if (typeof obj.createdAt !== \"string\" || obj.createdAt.length === 0) {\n    throw new Error(\"header.createdAt must be a non-empty string\");\n  }\n  if (typeof obj.metadata !== \"object\" || obj.metadata === null) {\n    throw new Error(\"header.metadata must be an object\");\n  }\n  // Reuse the metadata parser for nested validation. We re-stringify\n  // the nested object and feed it through `parseMetadata` so any\n  // schema drift is caught in one place.\n  const metadata = parseMetadata(JSON.stringify(obj.metadata));\n  const header: SecureStoreHeader = {\n    format: HEADER_FORMAT,\n    formatVersion: HEADER_FORMAT_VERSION,\n    metadata,\n    verifier: obj.verifier,\n    createdAt: obj.createdAt,\n  };\n  validateHeader(header);\n  return header;\n}\n\n/** Validate a header object's invariants. Throws on the first problem. */\nexport function validateHeader(header: SecureStoreHeader): void {\n  if (header.format !== HEADER_FORMAT) {\n    throw new Error(`header.format must be ${HEADER_FORMAT}`);\n  }\n  if (header.formatVersion !== HEADER_FORMAT_VERSION) {\n    throw new Error(`header.formatVersion must be ${HEADER_FORMAT_VERSION}`);\n  }\n  if (typeof header.createdAt !== \"string\" || header.createdAt.length === 0) {\n    throw new Error(\"header.createdAt must be a non-empty ISO-8601 string\");\n  }\n  if (typeof header.verifier !== \"string\" || header.verifier.length === 0) {\n    throw new Error(\"header.verifier must be a non-empty hex string\");\n  }\n  if (!/^[0-9a-fA-F]+$/.test(header.verifier)) {\n    throw new Error(\"header.verifier must be a hex-encoded string\");\n  }\n  // Enforce even length: odd-length hex is silently truncated by\n  // `Buffer.from(hex, \"hex\")` which yields a malformed envelope.\n  if (header.verifier.length % 2 !== 0) {\n    throw new Error(\n      \"header.verifier hex string must have even length (each byte encodes as two hex digits)\",\n    );\n  }\n  // The nested metadata object is already validated by `parseMetadata`\n  // when read from disk; on the build path, `buildHeader` constructs\n  // it via `buildMetadata`. We still re-run shape validation here as\n  // a belt-and-braces guard for callers that hand-construct headers.\n  if (header.metadata.format !== \"remnic.secure-store.metadata\") {\n    throw new Error(\"header.metadata.format must be remnic.secure-store.metadata\");\n  }\n}\n\n/**\n * Verify a candidate key against the header's verifier envelope.\n *\n * Returns true iff the AES-GCM auth tag validates. Wrong passphrase,\n * tampered envelope, and tampered AAD all return false.\n */\nexport function verifyKey(header: SecureStoreHeader, candidateKey: Buffer): boolean {\n  if (!Buffer.isBuffer(candidateKey) || candidateKey.length !== KDF_KEY_LENGTH) {\n    return false;\n  }\n  const envelope = Buffer.from(header.verifier, \"hex\");\n  try {\n    const plaintext = open(candidateKey, envelope, { aad: VERIFIER_AAD });\n    return plaintext.equals(VERIFIER_PLAINTEXT);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Derive a key from the passphrase using the algorithm + params +\n * salt recorded in the header. Pure: no I/O.\n */\nexport function deriveKeyFromHeader(header: SecureStoreHeader, passphrase: string): Buffer {\n  const salt = decodeMetadataSalt(header.metadata);\n  // Cursor low on PR #737: a previous version branched on the\n  // algorithm and returned `header.metadata.kdf.params` from both\n  // arms — a no-op conditional. Pass the discriminated union member\n  // through directly; `deriveKey` performs the algorithm dispatch.\n  const params: ScryptParams | Argon2idParams = header.metadata.kdf.params;\n  return deriveKey(header.metadata.kdf.algorithm, passphrase, salt, params);\n}\n\n/**\n * Read and parse the header at `<memoryDir>/.secure-store/header.json`.\n * Returns `null` if the file does not exist; throws on malformed\n * content.\n */\nexport async function readHeader(memoryDir: string): Promise<SecureStoreHeader | null> {\n  const target = headerPath(memoryDir);\n  let raw: string;\n  try {\n    raw = await readFile(target, \"utf8\");\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return null;\n    }\n    throw e;\n  }\n  return parseHeader(raw);\n}\n\n/**\n * Write the header with atomic exclusive-create semantics.\n *\n * Uses the `wx` flag (`O_CREAT | O_EXCL`) so the OS rejects the call\n * atomically when the file already exists. Two concurrent\n * `secure-store init` invocations cannot both observe \"missing\" and\n * race to overwrite each other — the second writer reliably gets\n * `EEXIST` and surfaces \"Refusing to overwrite\".\n *\n * Codex P1 on PR #737: a previous version pre-checked existence with\n * `readFile` then `writeFile`+`rename`, which is a check-then-act\n * race. The `wx` flag closes that window at the kernel layer.\n *\n * Crash safety: if the write is interrupted mid-flight, a partial\n * `header.json` may remain on disk. `parseHeader` rejects partial\n * files cleanly and the operator can delete the stub and retry. We\n * don't use temp+rename here because (a) headers are tiny (≤ 1 KiB),\n * (b) there is no prior valid file to destroy, and (c) `wx` already\n * gives us atomic exclusivity — the rename trick (CLAUDE.md gotcha\n * #54) is for replacing an existing valid file, which is exactly the\n * scenario this function refuses.\n */\nexport async function writeHeader(memoryDir: string, header: SecureStoreHeader): Promise<string> {\n  validateHeader(header);\n  const dir = secureStoreDir(memoryDir);\n  await mkdir(dir, { recursive: true });\n  const target = headerPath(memoryDir);\n  try {\n    await writeFile(target, serializeHeader(header), {\n      encoding: \"utf8\",\n      mode: 0o600,\n      flag: \"wx\",\n    });\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"EEXIST\") {\n      throw new Error(\n        `secure-store header already exists at ${target}. Refusing to overwrite — initialize a fresh store or remove the existing header explicitly.`,\n      );\n    }\n    throw e;\n  }\n  return target;\n}\n\n/** Convenience: build metadata + header in one call from a passphrase. */\nexport function buildHeaderFromPassphrase(options: {\n  passphrase: string;\n  salt: Buffer;\n  /** Optional override; defaults to Argon2id with `DEFAULT_ARGON2ID_PARAMS`. */\n  algorithm?: \"scrypt\" | \"argon2id\";\n  params?: ScryptParams | Argon2idParams;\n  createdAt?: string;\n  note?: string;\n}): { header: SecureStoreHeader; derivedKey: Buffer } {\n  const { passphrase, salt } = options;\n  const algorithm = options.algorithm ?? \"argon2id\";\n  const metadataOpts: {\n    algorithm: \"scrypt\" | \"argon2id\";\n    salt: Buffer;\n    params?: ScryptParams | Argon2idParams;\n    createdAt?: string;\n    note?: string;\n  } = { algorithm, salt };\n  if (options.params !== undefined) metadataOpts.params = options.params;\n  if (options.createdAt !== undefined) metadataOpts.createdAt = options.createdAt;\n  if (options.note !== undefined) metadataOpts.note = options.note;\n  const metadata = buildMetadata(metadataOpts);\n  // Cursor low on PR #737: same identical-branches ternary as in\n  // `deriveKeyFromHeader`. The discriminated union already carries\n  // the right shape; `deriveKey` dispatches on `algorithm`.\n  const params: ScryptParams | Argon2idParams = metadata.kdf.params;\n  const derivedKey = deriveKey(algorithm, passphrase, salt, params);\n  const headerOpts: { metadata: SecureStoreMetadata; derivedKey: Buffer; createdAt?: string } = {\n    metadata,\n    derivedKey,\n  };\n  if (options.createdAt !== undefined) headerOpts.createdAt = options.createdAt;\n  const header = buildHeader(headerOpts);\n  return { header, derivedKey };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiCA,IAAM,UAAU,oBAAI,IAA0B;AAuBvC,SAAS,OAAO,IAAY,KAAa,MAAkB,MAAM,oBAAI,KAAK,GAAS;AACxF,MAAI,OAAO,OAAO,YAAY,GAAG,WAAW,GAAG;AAC7C,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,MAAI,CAAC,OAAO,SAAS,GAAG,KAAK,IAAI,WAAW,IAAI;AAC9C,UAAM,IAAI,MAAM,oDAAoD,KAAK,UAAU,YAAY,EAAE;AAAA,EACnG;AACA,QAAM,WAAW,QAAQ,IAAI,EAAE;AAC/B,MAAI,UAAU;AACZ,aAAS,IAAI,KAAK,CAAC;AAAA,EACrB;AACA,UAAQ,IAAI,IAAI,EAAE,KAAK,YAAY,IAAI,EAAE,YAAY,EAAE,CAAC;AAC1D;AAGO,SAAS,OAAO,IAA2B;AAChD,QAAM,QAAQ,QAAQ,IAAI,EAAE;AAC5B,SAAO,QAAQ,MAAM,MAAM;AAC7B;AAGO,SAAS,KAAK,IAAqB;AACxC,QAAM,QAAQ,QAAQ,IAAI,EAAE;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,IAAI,KAAK,CAAC;AAChB,UAAQ,OAAO,EAAE;AACjB,SAAO;AACT;AAGO,SAAS,UAAgB;AAC9B,aAAW,SAAS,QAAQ,OAAO,GAAG;AACpC,UAAM,IAAI,KAAK,CAAC;AAAA,EAClB;AACA,UAAQ,MAAM;AAChB;AAGO,SAAS,OAAO,IAA2B;AAChD,QAAM,QAAQ,QAAQ,IAAI,EAAE;AAC5B,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,UAAU,OAAO,YAAY,KAAK;AAAA,EAC7C;AACA,SAAO,EAAE,UAAU,MAAM,YAAY,MAAM,WAAW;AACxD;AAGO,SAAS,OAAe;AAC7B,SAAO,QAAQ;AACjB;;;ACxEA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,OAAO,UAAU;AAmBV,IAAM,wBAAwB;AAG9B,IAAM,kBAAkB;AAGxB,IAAM,gBAAgB;AAGtB,IAAM,wBAAwB;AAW9B,IAAM,qBAAqB,OAAO,KAAK,0BAA0B,MAAM;AAG9E,IAAM,eAAe,OAAO,KAAK,gCAAgC,MAAM;AAchE,SAAS,eAAe,WAA2B;AACxD,SAAO,KAAK,KAAK,WAAW,qBAAqB;AACnD;AAGO,SAAS,WAAW,WAA2B;AACpD,SAAO,KAAK,KAAK,eAAe,SAAS,GAAG,eAAe;AAC7D;AAOO,SAAS,YAAY,SAIN;AACpB,QAAM,EAAE,UAAU,WAAW,IAAI;AACjC,MAAI,CAAC,OAAO,SAAS,UAAU,KAAK,WAAW,WAAW,gBAAgB;AACxE,UAAM,IAAI;AAAA,MACR,wBAAwB,cAAc,4BAA4B,YAAY,UAAU,YAAY;AAAA,IACtG;AAAA,EACF;AACA,QAAM,OAAO,mBAAmB,QAAQ;AACxC,MAAI,KAAK,WAAW,iBAAiB;AACnC,UAAM,IAAI,MAAM,oBAAoB,KAAK,MAAM,oBAAoB,eAAe,EAAE;AAAA,EACtF;AACA,QAAM,WAAW,KAAK,YAAY,MAAM,oBAAoB,EAAE,KAAK,aAAa,CAAC;AACjF,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,eAAe;AAAA,IACf;AAAA,IACA,UAAU,SAAS,SAAS,KAAK;AAAA,IACjC,WAAW,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACzD;AACF;AAGO,SAAS,gBAAgB,QAAmC;AACjE,iBAAe,MAAM;AAGrB,QAAM,iBAAiB,kBAAkB,OAAO,QAAQ;AACxD,QAAM,iBAAiB,KAAK,MAAM,cAAc;AAChD,QAAM,UAAU;AAAA,IACd,QAAQ,OAAO;AAAA,IACf,eAAe,OAAO;AAAA,IACtB,UAAU;AAAA,IACV,UAAU,OAAO;AAAA,IACjB,WAAW,OAAO;AAAA,EACpB;AACA,SAAO,KAAK,UAAU,SAAS,MAAM,CAAC;AACxC;AAGO,SAAS,YAAY,MAAiC;AAC3D,MAAI,OAAO,SAAS,UAAU;AAC5B,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,IAAI;AAAA,EAC1B,SAAS,GAAG;AACV,UAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AACrD,UAAM,IAAI,MAAM,6BAA6B,GAAG,EAAE;AAAA,EACpD;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACA,QAAM,MAAM;AACZ,MAAI,IAAI,WAAW,eAAe;AAChC,UAAM,IAAI;AAAA,MACR,6BAA6B,OAAO,IAAI,MAAM,CAAC,cAAc,aAAa;AAAA,IAC5E;AAAA,EACF;AACA,MAAI,IAAI,kBAAkB,uBAAuB;AAC/C,UAAM,IAAI;AAAA,MACR,qCAAqC,OAAO,IAAI,aAAa,CAAC,yBAAyB,qBAAqB;AAAA,IAC9G;AAAA,EACF;AACA,MAAI,OAAO,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG;AACjE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,iBAAiB,KAAK,IAAI,QAAQ,GAAG;AACxC,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAKA,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AACjC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,IAAI,cAAc,YAAY,IAAI,UAAU,WAAW,GAAG;AACnE,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,MAAM;AAC7D,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAIA,QAAM,WAAW,cAAc,KAAK,UAAU,IAAI,QAAQ,CAAC;AAC3D,QAAM,SAA4B;AAAA,IAChC,QAAQ;AAAA,IACR,eAAe;AAAA,IACf;AAAA,IACA,UAAU,IAAI;AAAA,IACd,WAAW,IAAI;AAAA,EACjB;AACA,iBAAe,MAAM;AACrB,SAAO;AACT;AAGO,SAAS,eAAe,QAAiC;AAC9D,MAAI,OAAO,WAAW,eAAe;AACnC,UAAM,IAAI,MAAM,yBAAyB,aAAa,EAAE;AAAA,EAC1D;AACA,MAAI,OAAO,kBAAkB,uBAAuB;AAClD,UAAM,IAAI,MAAM,gCAAgC,qBAAqB,EAAE;AAAA,EACzE;AACA,MAAI,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,WAAW,GAAG;AACzE,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,WAAW,GAAG;AACvE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,iBAAiB,KAAK,OAAO,QAAQ,GAAG;AAC3C,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAGA,MAAI,OAAO,SAAS,SAAS,MAAM,GAAG;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAKA,MAAI,OAAO,SAAS,WAAW,gCAAgC;AAC7D,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACF;AAQO,SAAS,UAAU,QAA2B,cAA+B;AAClF,MAAI,CAAC,OAAO,SAAS,YAAY,KAAK,aAAa,WAAW,gBAAgB;AAC5E,WAAO;AAAA,EACT;AACA,QAAM,WAAW,OAAO,KAAK,OAAO,UAAU,KAAK;AACnD,MAAI;AACF,UAAM,YAAY,KAAK,cAAc,UAAU,EAAE,KAAK,aAAa,CAAC;AACpE,WAAO,UAAU,OAAO,kBAAkB;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,oBAAoB,QAA2B,YAA4B;AACzF,QAAM,OAAO,mBAAmB,OAAO,QAAQ;AAK/C,QAAM,SAAwC,OAAO,SAAS,IAAI;AAClE,SAAO,UAAU,OAAO,SAAS,IAAI,WAAW,YAAY,MAAM,MAAM;AAC1E;AAOA,eAAsB,WAAW,WAAsD;AACrF,QAAM,SAAS,WAAW,SAAS;AACnC,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,QAAQ,MAAM;AAAA,EACrC,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,UAAU;AAClD,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AACA,SAAO,YAAY,GAAG;AACxB;AAwBA,eAAsB,YAAY,WAAmB,QAA4C;AAC/F,iBAAe,MAAM;AACrB,QAAM,MAAM,eAAe,SAAS;AACpC,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,SAAS,WAAW,SAAS;AACnC,MAAI;AACF,UAAM,UAAU,QAAQ,gBAAgB,MAAM,GAAG;AAAA,MAC/C,UAAU;AAAA,MACV,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,EACH,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,UAAU;AAClD,YAAM,IAAI;AAAA,QACR,yCAAyC,MAAM;AAAA,MACjD;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAGO,SAAS,0BAA0B,SAQY;AACpD,QAAM,EAAE,YAAY,KAAK,IAAI;AAC7B,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,eAMF,EAAE,WAAW,KAAK;AACtB,MAAI,QAAQ,WAAW,OAAW,cAAa,SAAS,QAAQ;AAChE,MAAI,QAAQ,cAAc,OAAW,cAAa,YAAY,QAAQ;AACtE,MAAI,QAAQ,SAAS,OAAW,cAAa,OAAO,QAAQ;AAC5D,QAAM,WAAW,cAAc,YAAY;AAI3C,QAAM,SAAwC,SAAS,IAAI;AAC3D,QAAM,aAAa,UAAU,WAAW,YAAY,MAAM,MAAM;AAChE,QAAM,aAAwF;AAAA,IAC5F;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,OAAW,YAAW,YAAY,QAAQ;AACpE,QAAM,SAAS,YAAY,UAAU;AACrC,SAAO,EAAE,QAAQ,WAAW;AAC9B;","names":[]}

package/dist/{chunk-WOX2UW4K.js → chunk-IBPEVGP5.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-SFQ6QNL7.js";
 import {
   StorageManager
-} from "./chunk-ZBVQ4ZM4.js";
+} from "./chunk-YGNQG4Q6.js";
 import {
   buildLifecycleEventsForMemory,
   sortMemoryLifecycleEvents
@@ -74,4 +74,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-WOX2UW4K.js.map
+//# sourceMappingURL=chunk-IBPEVGP5.js.map

package/dist/{chunk-JZ7P26GF.js → chunk-IQWFWSCP.js}

@@ -1,12 +1,12 @@
 import {
   scanSignals
 } from "./chunk-H3FZVNRN.js";
-import {
-  resolvePresentationCapabilities
-} from "./chunk-VSF7AAGE.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  resolvePresentationCapabilities
+} from "./chunk-VSF7AAGE.js";
 
 // src/buffer.ts
 var MAX_BUFFER_ENTRY_COUNT = 200;
@@ -609,4 +609,4 @@ function probeWithTimeout(inflight, timeoutMs) {
 export {
   SmartBuffer
 };
-//# sourceMappingURL=chunk-JZ7P26GF.js.map
+//# sourceMappingURL=chunk-IQWFWSCP.js.map

package/dist/{chunk-6SXNQFHB.js → chunk-J2JB6BHT.js}

@@ -1,24 +1,24 @@
 import {
   SharedFeedbackEntrySchema,
   resolveSharedContextDir
-} from "./chunk-JRZV3767.js";
+} from "./chunk-33NX5BLR.js";
 import {
   StorageManager
-} from "./chunk-ZBVQ4ZM4.js";
+} from "./chunk-YGNQG4Q6.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
-import {
-  resolveConsolidationCapabilities,
-  resolveConversationContextCapabilities,
-  resolveQmdCapabilities
-} from "./chunk-VSF7AAGE.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
 import {
   log
 } from "./chunk-NU3CSQ4H.js";
+import {
+  resolveConsolidationCapabilities,
+  resolveConversationContextCapabilities,
+  resolveQmdCapabilities
+} from "./chunk-VSF7AAGE.js";
 
 // src/compounding/engine.ts
 import { createHash } from "crypto";
@@ -1276,4 +1276,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-6SXNQFHB.js.map
+//# sourceMappingURL=chunk-J2JB6BHT.js.map

package/dist/{chunk-K2JM4DZZ.js → chunk-JHZ3LEM7.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TBBDFYXW.js";
 import {
   StorageManager
-} from "./chunk-ZBVQ4ZM4.js";
+} from "./chunk-YGNQG4Q6.js";
 import {
   assertPathInsideRoot
 } from "./chunk-5GPPACXK.js";
@@ -751,4 +751,4 @@ export {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
 };
-//# sourceMappingURL=chunk-K2JM4DZZ.js.map
+//# sourceMappingURL=chunk-JHZ3LEM7.js.map