@remnic/core 9.4.2 → 9.6.0

package/dist/chunk-4GNEDXDI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-boundary.ts"],"sourcesContent":["/**\n * Single input-validation and error boundary for the CLI/MCP/HTTP access\n * surfaces (issue #1525, epic #1520 Phase 1).\n *\n * Every operation that crosses the access-service facade passes through ONE\n * registry entry: a zod-validated request envelope, a shared error mapper,\n * and the \"reject invalid input and list valid options\" behavior that\n * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented\n * per handler. The three surfaces become thin adapters — one operation\n * definition, three transports — so a validation fix lands everywhere at\n * once.\n *\n * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`\n * prefix. Session/namespace tenancy stays in the handler layer (resolved via\n * ScopePlan #1521); the boundary validates SHAPE, not tenancy.\n */\n\nimport { z } from \"zod\";\nimport { EngramAccessInputError, type EngramAccessService } from \"./access-service.js\";\nimport { assertFleetWideOperationAllowed, assertOperationAllowed, tokenCapabilityStore } from \"./access-token-capabilities.js\";\nimport { expandTildePath } from \"./utils/path.js\";\n\n// ---------------------------------------------------------------------------\n// Canonical operation names — host-agnostic (rule 31)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Add to this union as\n * each domain-group migration PR (memory ops → connectors → namespaces …)\n * lands; the fitness test in `access-surface-catalog.test.ts` treats the\n * registered set as the migration state.\n */\nexport const OPERATION_NAMES = [\n  \"memory_get\",\n  \"memory_search\",\n  \"memory_store\",\n  \"coding_decision\",\n  \"coding_architecture\",\n  // codegraph parity tools (issue #1554) -- each maps to one codegraph_*\n  // boundary operation that delegates to the surface handler in\n  // coding/codegraph-surfaces.ts. Names match the external tool suffixes.\n  \"codegraph_index\",\n  \"codegraph_list_projects\",\n  \"codegraph_delete_project\",\n  \"codegraph_index_status\",\n  \"codegraph_search_graph\",\n  \"codegraph_trace_path\",\n  \"codegraph_detect_changes\",\n  \"codegraph_query_graph\",\n  \"codegraph_get_schema\",\n  \"codegraph_get_snippet\",\n  \"codegraph_get_architecture\",\n  \"codegraph_search_code\",\n  \"codegraph_manage_adr\",\n  \"codegraph_ingest_traces\",\n  \"memory_correct_plan\",\n  \"memory_correct_apply\",\n  \"coding_delta\",\n  // Remaining MCP/HTTP handlers migrated through the boundary (issue #1525).\n  \"recall\",\n  \"recall_explain\",\n  \"set_coding_context\",\n  \"recall_tier_explain\",\n  \"recall_xray\",\n  \"wearables_status\",\n  \"wearables_sync\",\n  \"transcript_day\",\n  \"transcript_search\",\n  \"transcript_memories\",\n  \"action_confidence\",\n  \"chatgpt_memory_inspector\",\n  \"day_summary\",\n  \"capsule_export\",\n  \"capsule_import\",\n  \"capsule_list\",\n  \"memory_governance_run\",\n  \"procedure_mining_run\",\n  \"pattern_reinforcement_run\",\n  \"procedural_stats\",\n  \"memory_timeline\",\n  \"suggestion_submit\",\n  \"entity_get\",\n  \"review_queue_list\",\n  \"correction_pending\",\n  \"observe\",\n  \"lcm_search\",\n  \"lcm_compaction_flush\",\n  \"lcm_compaction_record\",\n  \"continuity_audit_generate\",\n  \"continuity_incident_open\",\n  \"continuity_incident_close\",\n  \"continuity_incident_list\",\n  \"continuity_loop_add_or_update\",\n  \"continuity_loop_review\",\n  \"identity_anchor_get\",\n  \"identity_anchor_update\",\n  \"memory_identity\",\n  \"work_task\",\n  \"work_project\",\n  \"work_board\",\n  \"shared_context_write_output\",\n  \"shared_feedback_record\",\n  \"shared_priorities_append\",\n  \"shared_context_cross_signals_run\",\n  \"shared_context_curate_daily\",\n  \"compounding_weekly_synthesize\",\n  \"compounding_promote_candidate\",\n  \"compression_guidelines_optimize\",\n  \"compression_guidelines_activate\",\n  \"memory_profile\",\n  \"memory_entities_list\",\n  \"memory_questions\",\n  \"memory_last_recall\",\n  \"memory_intent_debug\",\n  \"memory_qmd_debug\",\n  \"memory_graph_explain\",\n  \"graph_snapshot\",\n  \"memory_feedback\",\n  \"memory_promote\",\n  \"memory_outcome\",\n  \"memory_action_apply\",\n  \"context_checkpoint\",\n  \"briefing\",\n  \"review_list\",\n  \"review_resolve\",\n  \"contradiction_scan_run\",\n  \"memory_summarize_hourly\",\n  \"conversation_index_update\",\n  \"profiling_report\",\n  \"graph_edge_decay_run\",\n  \"live_connectors_run\",\n  \"peer_list\",\n  \"peer_get\",\n  \"peer_set\",\n  \"peer_delete\",\n  \"peer_profile_get\",\n  \"peer_forget\",\n  \"console_state\",\n  \"dreams_status\",\n  \"dreams_run\",\n  // HTTP-only routes (no direct MCP tool equivalent).\n  \"adapters_status\",\n  \"offline_sync_snapshot\",\n  \"offline_sync_snapshot_stream\",\n  \"offline_sync_files\",\n  \"offline_sync_file_content\",\n  \"offline_sync_apply_file_content\",\n  \"offline_sync_apply\",\n  \"lcm_status\",\n  \"memory_list\",\n  \"recall_timings\",\n  \"entity_list\",\n  \"maintenance_status\",\n  \"quality_status\",\n  \"trust_zones_status\",\n  \"trust_zones_records\",\n  \"review_disposition\",\n  \"trust_zones_promote\",\n  \"trust_zones_demo_seed\",\n  \"citations_observed\",\n  \"contradiction_detail\",\n  \"graph_events\",\n  // Chat surface — conversational memory inspection/correction (issue #1583).\n  \"chat_message\",\n  \"chat_events\",\n] as const;\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Derived from\n * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog\n * used for token-capability validation cannot drift from the type. The\n * fitness test in `access-surface-catalog.test.ts` treats the registered set\n * as the migration state.\n */\nexport type OperationName = (typeof OPERATION_NAMES)[number];\n\n// ---------------------------------------------------------------------------\n// Operation context — what every handler receives\n// ---------------------------------------------------------------------------\n\n/**\n * Per-call context. `service` is the facade the handler delegates to; the\n * boundary never reaches past it. `authenticatedPrincipal` is resolved by\n * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary\n * runs, so handlers stay principal-source-agnostic. `hooks` carries\n * transport-level callbacks (e.g. HTTP write-quota enforcement) that must\n * fire atomically inside the service call; surfaces that have no such hook\n * leave it undefined.\n */\nexport interface OperationContext {\n  readonly service: EngramAccessService;\n  readonly authenticatedPrincipal?: string;\n  readonly operatorPrincipal?: string;\n  readonly hooks?: OperationHooks;\n}\n\n/**\n * Transport-level callbacks a handler forwards into the service call. Kept\n * narrow on purpose: the boundary owns validation + dispatch shape, not\n * transport policy. Add fields here only when a surface genuinely needs a\n * callback the service itself consumes.\n */\nexport interface OperationHooks {\n  /** HTTP write-quota gate; throws to reject the write when exhausted. */\n  readonly enforceWriteQuota?: () => void | Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Operation spec + bound operation\n// ---------------------------------------------------------------------------\n\nexport interface OperationSpec<In, Out> {\n  /** Canonical operation id; matches an {@link OperationName}. */\n  readonly name: OperationName;\n  readonly description: string;\n  /** Zod schema validating the raw request envelope. */\n  readonly schema: z.ZodType<In>;\n  /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */\n  readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;\n  /**\n   * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL\n   * namespaces (or against a single non-namespaced global layer) and carries no\n   * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint\n   * never applies. When set, {@link defineOperation}'s run wrapper rejects any\n   * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed\n   * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens\n   * (cron, internal callers, no capability record) are unaffected (issue #1850).\n   */\n  readonly fleetWide?: boolean;\n}\n\nexport interface BoundOperation<In = unknown, Out = unknown> {\n  readonly spec: OperationSpec<In, Out>;\n  /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */\n  readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;\n}\n\n// ---------------------------------------------------------------------------\n// Shared normalizers the boundary owns (rules 17, 28, 36, 48, 51)\n// ---------------------------------------------------------------------------\n\n/**\n * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans\n * and the string spellings clients send (\"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\n * \"on\"/\"off\", case-insensitive). Rejects anything else loudly — `Boolean(\"false\")`\n * would silently be `true`, which is the bug rule 36 exists to prevent.\n *\n * `undefined`/`null`/`\"\"` → `undefined`, so callers can keep treating an\n * absent flag as \"use the default\" without a separate presence check.\n */\nexport function coerceBooleanLike(value: unknown): boolean | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\") {\n    const lower = value.trim().toLowerCase();\n    if (lower === \"true\" || lower === \"1\" || lower === \"yes\" || lower === \"on\") return true;\n    if (lower === \"false\" || lower === \"0\" || lower === \"no\" || lower === \"off\") return false;\n  }\n  throw new EngramAccessInputError(\n    `expected a boolean-like value (true|false|1|0|yes|no|on|off); got ${JSON.stringify(value)}`,\n  );\n}\n\n/**\n * Coerce + validate a positive integer from a numeric string or number\n * (rule 28). Loosely-typed MCP/CLI clients send `\"5\"`; `typeof saved === \"number\"`\n * on read-back would reject it later, so we coerce at the edge and reject\n * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).\n *\n * `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function coercePositiveInteger(value: unknown, label: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return value;\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!/^[+-]?\\d+$/.test(trimmed)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    const parsed = Number(trimmed);\n    if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return parsed;\n  }\n  throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n}\n\n/**\n * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;\n * ad-hoc regex drifts. `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function normalizeOptionalPath(value: unknown): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new EngramAccessInputError(`expected a path string; got ${JSON.stringify(value)}`);\n  }\n  return expandTildePath(value);\n}\n\n// ---------------------------------------------------------------------------\n// Error formatting — rule 51: list valid options, never silently default\n// ---------------------------------------------------------------------------\n\n/**\n * Turn a zod failure into an {@link EngramAccessInputError} whose message\n * names the offending field and — for enum/union issues — lists the valid\n * options, so the caller can correct rather than guess (rule 51).\n */\nexport function formatZodIssues(error: z.ZodError): string {\n  const parts: string[] = [];\n  for (const issue of error.issues) {\n    // Collapse array-index paths (e.g. [\"currentContextScopes\", 1]) to\n    // the field name so the message reads \"field: must be ...\" not\n    // \"field.1: must be ...\".\n    const hasNumeric = issue.path.some((p) => typeof p === \"number\");\n    const path = hasNumeric\n      ? issue.path.filter((p) => typeof p === \"string\").join(\".\") || \"(root)\"\n      : issue.path.length > 0 ? issue.path.join(\".\") : \"(root)\";\n    const options = enumOptionsFromIssue(issue);\n    const suffix = options ? `. Valid: ${options.join(\", \")}` : \"\";\n    parts.push(`${path}: ${issue.message}${suffix}`);\n  }\n  return parts.length > 0\n    ? `request validation failed: ${parts.join(\"; \")}`\n    : \"request validation failed\";\n}\n\nfunction enumOptionsFromIssue(issue: z.ZodIssue): readonly string[] | undefined {\n  // zod exposes accepted enum values on the issue for ZodEnum / ZodNativeEnum\n  // and on the options of invalid_union discriminators. Reading them here\n  // keeps \"list valid options\" in ONE place rather than per handler.\n  if (issue.code === z.ZodIssueCode.invalid_enum_value) {\n    const rawOptions = (issue as { options?: unknown }).options;\n    if (Array.isArray(rawOptions)) {\n      return rawOptions.map((opt) => String(opt));\n    }\n  }\n  return undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\nconst registry = new Map<OperationName, BoundOperation>();\n\n/**\n * Register an operation. Throws if the name is already registered — duplicate\n * registration is a programming error, not a runtime input fault, so it throws\n * a plain Error (not the input-error class surfaces translate for clients).\n */\n/**\n * Error map that converts Zod's generic type-mismatch messages into\n * human-readable \"must be a <type>\" messages (rule 51).  Applied at the\n * boundary chokepoint so every operation gets consistent messaging\n * without per-handler boilerplate.\n */\nconst humanReadableErrorMap: z.ZodErrorMap = (issue, ctx) => {\n  if (issue.code === z.ZodIssueCode.invalid_type) {\n    if (issue.received === \"undefined\") return { message: ctx.defaultError };\n    // Array-element type errors — collapse to field-level message.\n    if (issue.path.some((p) => typeof p === \"number\")) {\n      const arrField = issue.path.filter((p) => typeof p === \"string\").join(\".\");\n      return { message: `${arrField} must be an array of ${issue.expected}s` };\n    }\n    const fieldName = issue.path.length > 0 ? String(issue.path[issue.path.length - 1]) : \"value\";\n    switch (issue.expected) {\n      case \"string\": return { message: `${fieldName} must be a string` };\n      case \"boolean\": return { message: `${fieldName} must be a boolean` };\n      case \"number\": return { message: `${fieldName} must be a number` };\n      case \"array\": return { message: `${fieldName} must be an array` };\n      case \"object\": return { message: `${fieldName} must be an object` };\n      default: return { message: ctx.defaultError };\n    }\n  }\n  return { message: ctx.defaultError };\n};\n\nexport function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out> {\n  if (registry.has(spec.name)) {\n    throw new Error(`access-boundary: operation already registered: ${spec.name}`);\n  }\n  const bound: BoundOperation<In, Out> = {\n    spec,\n    run: async (rawInput, ctx) => {\n      const parseResult = spec.schema.safeParse(rawInput, { errorMap: humanReadableErrorMap });\n      if (!parseResult.success) {\n        throw new EngramAccessInputError(formatZodIssues(parseResult.error));\n      }\n      // Per-token capability enforcement (issue #1837): when the presenting\n      // token carries an ops allow-list, reject operations not in it. The\n      // capability record is carried via AsyncLocalStorage, set once per\n      // authorized HTTP/MCP request; absent (CLI/tests/direct callers) ⇒\n      // unrestricted. Default-deny ONLY when an ops axis is present — legacy\n      // tokens (absent record) and explicit-unrestricted new tokens are\n      // unaffected.\n      assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);\n      // Fleet-wide / global maintenance ops (issue #1850 round 10): these run\n      // across all namespaces with no `namespace` arg, so the tools/call\n      // effective-namespace gate never fires. A namespace-SCOPED token must not\n      // trigger cross-namespace maintenance — fail closed BEFORE the handler so\n      // a denial never leaks a partial mutation. No-op for unrestricted/legacy.\n      if (spec.fleetWide) {\n        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());\n      }\n      return spec.handler(parseResult.data, ctx);\n    },\n  };\n  // Store under the canonical name; the cast is safe because In/Out are\n  // erased at the registry boundary and recovered by callers via getOperation.\n  registry.set(spec.name, bound as unknown as BoundOperation);\n  return bound;\n}\n\n/** Look up a registered operation by canonical name. */\nexport function getOperation(name: OperationName): BoundOperation | undefined {\n  return registry.get(name);\n}\n\n/** All registered operation names. */\nexport function listRegisteredOperations(): readonly OperationName[] {\n  return [...registry.keys()];\n}\n\n/** Test-only: clear the registry so pilot definitions can be re-registered. */\nexport function __resetRegistryForTest(): void {\n  registry.clear();\n}\n"],"mappings":";;;;;;;;;;;;;AAiBA,SAAS,SAAS;AAgBX,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AAsFO,SAAS,kBAAkB,OAAqC;AACrE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,MAAM,KAAK,EAAE,YAAY;AACvC,QAAI,UAAU,UAAU,UAAU,OAAO,UAAU,SAAS,UAAU,KAAM,QAAO;AACnF,QAAI,UAAU,WAAW,UAAU,OAAO,UAAU,QAAQ,UAAU,MAAO,QAAO;AAAA,EACtF;AACA,QAAM,IAAI;AAAA,IACR,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,EAC5F;AACF;AAUO,SAAS,sBAAsB,OAAgB,OAAmC;AACvF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,KAAK,GAAG;AACrE,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAAG;AAChD,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AACtG;AAMO,SAAS,sBAAsB,OAAoC;AACxE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,uBAAuB,+BAA+B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EACzF;AACA,SAAO,gBAAgB,KAAK;AAC9B;AAWO,SAAS,gBAAgB,OAA2B;AACzD,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,MAAM,QAAQ;AAIhC,UAAM,aAAa,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC/D,UAAM,OAAO,aACT,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,WAC7D,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AACnD,UAAM,UAAU,qBAAqB,KAAK;AAC1C,UAAM,SAAS,UAAU,YAAY,QAAQ,KAAK,IAAI,CAAC,KAAK;AAC5D,UAAM,KAAK,GAAG,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD;AACA,SAAO,MAAM,SAAS,IAClB,8BAA8B,MAAM,KAAK,IAAI,CAAC,KAC9C;AACN;AAEA,SAAS,qBAAqB,OAAkD;AAI9E,MAAI,MAAM,SAAS,EAAE,aAAa,oBAAoB;AACpD,UAAM,aAAc,MAAgC;AACpD,QAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,aAAO,WAAW,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,IAAM,WAAW,oBAAI,IAAmC;AAaxD,IAAM,wBAAuC,CAAC,OAAO,QAAQ;AAC3D,MAAI,MAAM,SAAS,EAAE,aAAa,cAAc;AAC9C,QAAI,MAAM,aAAa,YAAa,QAAO,EAAE,SAAS,IAAI,aAAa;AAEvE,QAAI,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAG;AACjD,YAAM,WAAW,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AACzE,aAAO,EAAE,SAAS,GAAG,QAAQ,wBAAwB,MAAM,QAAQ,IAAI;AAAA,IACzE;AACA,UAAM,YAAY,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI;AACtF,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAW,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MACnE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAS,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MAChE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MAClE;AAAS,eAAO,EAAE,SAAS,IAAI,aAAa;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,IAAI,aAAa;AACrC;AAEO,SAAS,gBAAyB,MAAuD;AAC9F,MAAI,SAAS,IAAI,KAAK,IAAI,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD,KAAK,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,QAAiC;AAAA,IACrC;AAAA,IACA,KAAK,OAAO,UAAU,QAAQ;AAC5B,YAAM,cAAc,KAAK,OAAO,UAAU,UAAU,EAAE,UAAU,sBAAsB,CAAC;AACvF,UAAI,CAAC,YAAY,SAAS;AACxB,cAAM,IAAI,uBAAuB,gBAAgB,YAAY,KAAK,CAAC;AAAA,MACrE;AAQA,6BAAuB,qBAAqB,SAAS,GAAG,KAAK,IAAI;AAMjE,UAAI,KAAK,WAAW;AAClB,wCAAgC,qBAAqB,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,KAAK,QAAQ,YAAY,MAAM,GAAG;AAAA,IAC3C;AAAA,EACF;AAGA,WAAS,IAAI,KAAK,MAAM,KAAkC;AAC1D,SAAO;AACT;AAGO,SAAS,aAAa,MAAiD;AAC5E,SAAO,SAAS,IAAI,IAAI;AAC1B;AAGO,SAAS,2BAAqD;AACnE,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;AAGO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;","names":[]}

package/dist/{chunk-LOR6ZM5R.js → chunk-4LV23CHK.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-BGTAL46Y.js";
+} from "./chunk-PNLFN2PZ.js";
 import {
   getConfiguredNamespaces
 } from "./chunk-BAVVI5GP.js";
@@ -2042,4 +2042,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-LOR6ZM5R.js.map
+//# sourceMappingURL=chunk-4LV23CHK.js.map

package/dist/{chunk-E2SPGGUI.js → chunk-4OKLXWDZ.js}

@@ -1,3 +1,7 @@
+import {
+  TOKEN_CAPABILITIES_VERSION,
+  normalizeCapabilities
+} from "./chunk-D7FOKIY5.js";
 import {
   resolveHomeDir
 } from "./chunk-JUC24CTX.js";
@@ -55,10 +59,12 @@ function validateTokenEntry(raw, index) {
   if (typeof entry.connector !== "string" || entry.connector.length === 0) {
     throw new Error(`invalid token entry at index ${index}: connector must be a non-empty string`);
   }
+  const capabilities = entry.capabilities !== void 0 ? normalizeCapabilities(entry.capabilities) : void 0;
   return {
     token: entry.token,
     connector: entry.connector,
-    createdAt: typeof entry.createdAt === "string" && entry.createdAt.length > 0 ? entry.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+    createdAt: typeof entry.createdAt === "string" && entry.createdAt.length > 0 ? entry.createdAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+    ...capabilities ? { capabilities } : {}
   };
 }
 function parseTokenStore(rawText, filePath) {
@@ -170,13 +176,14 @@ function saveTokenStore(store, tokensPath) {
     throw error;
   }
 }
-function buildTokenEntry(connector) {
+function buildTokenEntry(connector, capabilities) {
   const prefix = TOKEN_PREFIXES[connector] ?? "remnic_xx_";
   const token = prefix + randomBytes(24).toString("hex");
   return {
     token,
     connector,
-    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    capabilities: capabilities ?? { version: TOKEN_CAPABILITIES_VERSION }
   };
 }
 function commitTokenEntry(entry, tokensPath) {
@@ -185,10 +192,10 @@ function commitTokenEntry(entry, tokensPath) {
   store.tokens.push(entry);
   saveTokenStore(store, tokensPath);
 }
-function generateToken(connector, tokensPath) {
+function generateToken(connector, tokensPath, capabilities) {
   const store = loadTokenStore(tokensPath);
   store.tokens = store.tokens.filter((t) => t.connector !== connector);
-  const entry = buildTokenEntry(connector);
+  const entry = buildTokenEntry(connector, capabilities);
   store.tokens.push(entry);
   saveTokenStore(store, tokensPath);
   return entry;
@@ -246,4 +253,4 @@ export {
   getAllValidTokensCached,
   resolveConnectorFromToken
 };
-//# sourceMappingURL=chunk-E2SPGGUI.js.map
+//# sourceMappingURL=chunk-4OKLXWDZ.js.map

package/dist/chunk-4OKLXWDZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tokens.ts"],"sourcesContent":["/**\n * Token management for Remnic multi-connector auth.\n *\n * Manages per-connector tokens in ~/.remnic/tokens.json.\n * Each connector gets a unique token with a recognizable prefix.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { randomBytes, randomUUID } from \"node:crypto\";\nimport { resolveHomeDir } from \"./runtime/env.js\";\nimport {\n  TOKEN_CAPABILITIES_VERSION,\n  normalizeCapabilities,\n  type TokenCapabilities,\n} from \"./access-token-capabilities.js\";\n\nexport interface TokenEntry {\n  token: string;\n  connector: string;\n  createdAt: string;\n  /**\n   * Versioned capabilities record (issue #1837). PRESENT ⇒ the token was\n   * minted by the capability-aware path; its ops/namespaces axes are\n   * enforced (absent axis ⇒ unrestricted on that axis; empty array ⇒ deny\n   * all; non-empty ⇒ allow-list). ABSENT ⇒ a pre-feature legacy entry ⇒\n   * unrestricted (full access), purely for backward compatibility — this is\n   * the ONLY path by which full access is granted by omission. Every new\n   * token carries an explicit record (even `{ version: 1 }` for a deliberate\n   * unrestricted mint), so a new token can never silently gain full access.\n   */\n  capabilities?: TokenCapabilities;\n}\n\nexport interface TokenStore {\n  tokens: TokenEntry[];\n}\n\nconst TOKEN_PREFIXES: Record<string, string> = {\n  \"openclaw\": \"remnic_oc_\",\n  \"claude-code\": \"remnic_cc_\",\n  \"codex-cli\": \"remnic_cx_\",\n  \"codex\": \"remnic_cx_\",\n  \"hermes\": \"remnic_hm_\",\n  \"pi\": \"remnic_pi_\",\n  \"omp\": \"remnic_op_\",\n  \"replit\": \"remnic_rl_\",\n  \"cursor\": \"remnic_cu_\",\n  \"cline\": \"remnic_cl_\",\n  \"github-copilot\": \"remnic_gh_\",\n  \"roo-code\": \"remnic_rc_\",\n  \"windsurf\": \"remnic_ws_\",\n  \"amp\": \"remnic_am_\",\n  \"generic-mcp\": \"remnic_gm_\",\n  \"chatgpt\": \"remnic_cg_\",\n};\n\nfunction defaultTokensPath(): string {\n  return path.join(resolveHomeDir(), \".remnic\", \"tokens.json\");\n}\n\nfunction legacyTokensPath(): string {\n  return path.join(resolveHomeDir(), \".engram\", \"tokens.json\");\n}\n\nfunction resolveReadPath(tokensPath?: string): string {\n  const primary = tokensPath ?? defaultTokensPath();\n  if (tokensPath) return primary;\n  if (fs.existsSync(primary)) return primary;\n  const legacy = legacyTokensPath();\n  return fs.existsSync(legacy) ? legacy : primary;\n}\n\nfunction ensureDir(filePath: string): void {\n  const dir = path.dirname(filePath);\n  fs.mkdirSync(dir, { recursive: true });\n}\n\nfunction isEnoent(error: unknown): boolean {\n  return error instanceof Error && \"code\" in error && (error as NodeJS.ErrnoException).code === \"ENOENT\";\n}\n\nfunction validateTokenEntry(raw: unknown, index: number): TokenEntry {\n  if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n    throw new Error(`invalid token entry at index ${index}: expected object`);\n  }\n  const entry = raw as Record<string, unknown>;\n  if (typeof entry.token !== \"string\" || entry.token.length === 0) {\n    throw new Error(`invalid token entry at index ${index}: token must be a non-empty string`);\n  }\n  if (typeof entry.connector !== \"string\" || entry.connector.length === 0) {\n    throw new Error(`invalid token entry at index ${index}: connector must be a non-empty string`);\n  }\n  const capabilities = entry.capabilities !== undefined\n    ? normalizeCapabilities(entry.capabilities)\n    : undefined;\n  return {\n    token: entry.token,\n    connector: entry.connector,\n    createdAt:\n      typeof entry.createdAt === \"string\" && entry.createdAt.length > 0\n        ? entry.createdAt\n        : new Date(0).toISOString(),\n    ...(capabilities ? { capabilities } : {}),\n  };\n}\n\nfunction parseTokenStore(rawText: string, filePath: string): { store: TokenStore; migratedLegacy: boolean } {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(rawText);\n  } catch (error) {\n    throw new Error(\n      `failed to parse token store at ${filePath}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n\n  if (typeof raw === \"object\" && raw !== null && !Array.isArray(raw)) {\n    const record = raw as Record<string, unknown>;\n    if (record.tokens !== undefined) {\n      if (!Array.isArray(record.tokens)) {\n        throw new Error(`invalid token store at ${filePath}: tokens must be an array`);\n      }\n      return {\n        store: {\n          tokens: record.tokens.map((entry, index) => validateTokenEntry(entry, index)),\n        },\n        migratedLegacy: false,\n      };\n    }\n\n    // Migrate legacy flat-map format: { \"connector\": \"token_value\", ... }\n    const migrated: TokenEntry[] = [];\n    for (const [key, value] of Object.entries(record)) {\n      if (typeof value === \"string\" && value.length > 0) {\n        migrated.push(\n          validateTokenEntry(\n            { token: value, connector: key, createdAt: new Date().toISOString() },\n            migrated.length,\n          ),\n        );\n      }\n    }\n    if (migrated.length > 0) {\n      return { store: { tokens: migrated }, migratedLegacy: true };\n    }\n  }\n\n  throw new Error(`invalid token store at ${filePath}: expected token array or legacy connector map`);\n}\n\nexport function loadTokenStore(tokensPath?: string): TokenStore {\n  const p = resolveReadPath(tokensPath);\n  try {\n    const rawText = fs.readFileSync(p, \"utf8\");\n    const { store, migratedLegacy } = parseTokenStore(rawText, p);\n    if (migratedLegacy) {\n      // Auto-migrate legacy flat-map stores in new format. This is best-effort:\n      // a migration write failure must not hide the successfully parsed tokens.\n      try {\n        saveTokenStore(store, tokensPath);\n      } catch {\n        // Migration write failed (e.g., read-only fs) — still return parsed tokens.\n      }\n    }\n    return store;\n  } catch (error) {\n    if (isEnoent(error)) {\n      return { tokens: [] };\n    }\n    throw error;\n  }\n}\n\nfunction fsyncDirectoryBestEffort(dirPath: string): void {\n  let dirFd: number | null = null;\n  try {\n    dirFd = fs.openSync(dirPath, \"r\");\n    fs.fsyncSync(dirFd);\n  } catch {\n    // Directory fsync is not supported on every platform/filesystem.\n  } finally {\n    if (dirFd !== null) {\n      try { fs.closeSync(dirFd); } catch { /* ignore */ }\n    }\n  }\n}\n\nexport function saveTokenStore(store: TokenStore, tokensPath?: string): void {\n  const p = tokensPath ?? defaultTokensPath();\n  ensureDir(p);\n  const validated: TokenStore = {\n    tokens: store.tokens.map((entry, index) => validateTokenEntry(entry, index)),\n  };\n  const dir = path.dirname(p);\n  const tmpPath = path.join(dir, `.${path.basename(p)}.${process.pid}.${randomUUID()}.tmp`);\n  let fd: number | null = null;\n  try {\n    fd = fs.openSync(tmpPath, \"w\", 0o600);\n    fs.writeFileSync(fd, JSON.stringify(validated, null, 2) + \"\\n\", \"utf8\");\n    fs.fsyncSync(fd);\n    fs.closeSync(fd);\n    fd = null;\n    fs.renameSync(tmpPath, p);\n    // Tighten permissions on pre-existing files after atomic replacement.\n    try { fs.chmodSync(p, 0o600); } catch { /* ignore on platforms without chmod */ }\n    fsyncDirectoryBestEffort(dir);\n    invalidateTokenCache();\n  } catch (error) {\n    if (fd !== null) {\n      try { fs.closeSync(fd); } catch { /* ignore */ }\n    }\n    try { fs.rmSync(tmpPath, { force: true }); } catch { /* ignore cleanup failure */ }\n    throw error;\n  }\n}\n\n/**\n * Build a TokenEntry candidate WITHOUT saving it to the store.\n * Callers use this when they need to defer the save until after a\n * dependent write (e.g. Hermes config.yaml) succeeds — see\n * commitTokenEntry() to persist the candidate.\n */\nexport function buildTokenEntry(connector: string, capabilities?: TokenCapabilities): TokenEntry {\n  const prefix = TOKEN_PREFIXES[connector] ?? \"remnic_xx_\";\n  const token = prefix + randomBytes(24).toString(\"hex\");\n  // Every newly-built entry carries an EXPLICIT capabilities record (issue\n  // #1837). When none is requested, record a deliberate unrestricted\n  // `{ version: 1 }` — never an omitted field — so \"full access via omission\"\n  // is reachable only by pre-feature legacy entries lacking the marker.\n  return {\n    token,\n    connector,\n    createdAt: new Date().toISOString(),\n    capabilities: capabilities ?? { version: TOKEN_CAPABILITIES_VERSION },\n  };\n}\n\n/**\n * Persist a pre-built TokenEntry into the store, replacing any existing\n * entry for the same connector. Used together with buildTokenEntry() when\n * the caller wants to defer the save until after a dependent write succeeds.\n *\n * For transactional rollback, callers should snapshot the full store via\n * loadTokenStore() BEFORE calling commitTokenEntry() and restore it with\n * saveTokenStore() on failure. A full-store snapshot handles partial writes\n * of tokens.json atomically — single-entry restore via the return value is\n * insufficient because if this function throws during saveTokenStore, the\n * return statement never executes (UXJI/UXJT fix).\n */\nexport function commitTokenEntry(entry: TokenEntry, tokensPath?: string): void {\n  const store = loadTokenStore(tokensPath);\n  store.tokens = store.tokens.filter((t) => t.connector !== entry.connector);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n}\n\nexport function generateToken(\n  connector: string,\n  tokensPath?: string,\n  capabilities?: TokenCapabilities,\n): TokenEntry {\n  const store = loadTokenStore(tokensPath);\n\n  // Remove existing token for this connector\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n\n  const entry = buildTokenEntry(connector, capabilities);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n  return entry;\n}\n\nexport function listTokens(tokensPath?: string): TokenEntry[] {\n  return loadTokenStore(tokensPath).tokens;\n}\n\nexport function revokeToken(connector: string, tokensPath?: string): boolean {\n  const store = loadTokenStore(tokensPath);\n  const before = store.tokens.length;\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n  if (store.tokens.length < before) {\n    saveTokenStore(store, tokensPath);\n    return true;\n  }\n  return false;\n}\n\nexport function getAllValidTokens(tokensPath?: string): string[] {\n  return loadTokenStore(tokensPath).tokens.map((t) => t.token);\n}\n\n// Cached token-entry snapshot to avoid synchronous disk I/O on every HTTP\n// request. Re-reads tokens.json at most once per TTL interval (default 5s).\n// There is deliberately exactly ONE cache: validation (token strings) and\n// identity (connector ids) are derived from the SAME snapshot, so a token\n// can never validate against a fresher snapshot than the one that resolves\n// its connector. saveTokenStore() invalidates on every mutation, so a\n// freshly minted or revoked token is coherent immediately.\nconst TOKEN_CACHE_TTL_MS = 5_000;\nlet _cachedEntries: TokenEntry[] = [];\nlet _cachedAt = 0;\nlet _cachedPath: string | undefined;\n\nfunction invalidateTokenCache(): void {\n  _cachedEntries = [];\n  _cachedAt = 0;\n  _cachedPath = undefined;\n}\n\n/** Cached token-entry snapshot ({token, connector} pairs). */\nexport function getAllValidTokenEntriesCached(tokensPath?: string): readonly TokenEntry[] {\n  const now = Date.now();\n  if (now - _cachedAt < TOKEN_CACHE_TTL_MS && tokensPath === _cachedPath) return _cachedEntries;\n  _cachedEntries = loadTokenStore(tokensPath).tokens;\n  _cachedAt = now;\n  _cachedPath = tokensPath;\n  return _cachedEntries;\n}\n\nexport function getAllValidTokensCached(tokensPath?: string): string[] {\n  return getAllValidTokenEntriesCached(tokensPath).map((entry) => entry.token);\n}\n\nexport function resolveConnectorFromToken(token: string, tokensPath?: string): string | undefined {\n  return loadTokenStore(tokensPath).tokens.find((t) => t.token === token)?.connector;\n}\n"],"mappings":";;;;;;;;;AAOA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,aAAa,kBAAkB;AA6BxC,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,MAAM;AAAA,EACN,OAAO;AAAA,EACP,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,eAAe;AAAA,EACf,WAAW;AACb;AAEA,SAAS,oBAA4B;AACnC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,mBAA2B;AAClC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,gBAAgB,YAA6B;AACpD,QAAM,UAAU,cAAc,kBAAkB;AAChD,MAAI,WAAY,QAAO;AACvB,MAAI,GAAG,WAAW,OAAO,EAAG,QAAO;AACnC,QAAM,SAAS,iBAAiB;AAChC,SAAO,GAAG,WAAW,MAAM,IAAI,SAAS;AAC1C;AAEA,SAAS,UAAU,UAAwB;AACzC,QAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,KAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC;AAEA,SAAS,SAAS,OAAyB;AACzC,SAAO,iBAAiB,SAAS,UAAU,SAAU,MAAgC,SAAS;AAChG;AAEA,SAAS,mBAAmB,KAAc,OAA2B;AACnE,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gCAAgC,KAAK,mBAAmB;AAAA,EAC1E;AACA,QAAM,QAAQ;AACd,MAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,WAAW,GAAG;AAC/D,UAAM,IAAI,MAAM,gCAAgC,KAAK,oCAAoC;AAAA,EAC3F;AACA,MAAI,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,WAAW,GAAG;AACvE,UAAM,IAAI,MAAM,gCAAgC,KAAK,wCAAwC;AAAA,EAC/F;AACA,QAAM,eAAe,MAAM,iBAAiB,SACxC,sBAAsB,MAAM,YAAY,IACxC;AACJ,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,WAAW,MAAM;AAAA,IACjB,WACE,OAAO,MAAM,cAAc,YAAY,MAAM,UAAU,SAAS,IAC5D,MAAM,aACN,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IAC9B,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,EACzC;AACF;AAEA,SAAS,gBAAgB,SAAiB,UAAkE;AAC1G,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,OAAO;AAAA,EAC1B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kCAAkC,QAAQ,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACvG;AAAA,EACF;AAEA,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClE,UAAM,SAAS;AACf,QAAI,OAAO,WAAW,QAAW;AAC/B,UAAI,CAAC,MAAM,QAAQ,OAAO,MAAM,GAAG;AACjC,cAAM,IAAI,MAAM,0BAA0B,QAAQ,2BAA2B;AAAA,MAC/E;AACA,aAAO;AAAA,QACL,OAAO;AAAA,UACL,QAAQ,OAAO,OAAO,IAAI,CAAC,OAAO,UAAU,mBAAmB,OAAO,KAAK,CAAC;AAAA,QAC9E;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,IACF;AAGA,UAAM,WAAyB,CAAC;AAChC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,iBAAS;AAAA,UACP;AAAA,YACE,EAAE,OAAO,OAAO,WAAW,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,YACpE,SAAS;AAAA,UACX;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,aAAO,EAAE,OAAO,EAAE,QAAQ,SAAS,GAAG,gBAAgB,KAAK;AAAA,IAC7D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,0BAA0B,QAAQ,gDAAgD;AACpG;AAEO,SAAS,eAAe,YAAiC;AAC9D,QAAM,IAAI,gBAAgB,UAAU;AACpC,MAAI;AACF,UAAM,UAAU,GAAG,aAAa,GAAG,MAAM;AACzC,UAAM,EAAE,OAAO,eAAe,IAAI,gBAAgB,SAAS,CAAC;AAC5D,QAAI,gBAAgB;AAGlB,UAAI;AACF,uBAAe,OAAO,UAAU;AAAA,MAClC,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,SAAS,KAAK,GAAG;AACnB,aAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,IACtB;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,yBAAyB,SAAuB;AACvD,MAAI,QAAuB;AAC3B,MAAI;AACF,YAAQ,GAAG,SAAS,SAAS,GAAG;AAChC,OAAG,UAAU,KAAK;AAAA,EACpB,QAAQ;AAAA,EAER,UAAE;AACA,QAAI,UAAU,MAAM;AAClB,UAAI;AAAE,WAAG,UAAU,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,eAAe,OAAmB,YAA2B;AAC3E,QAAM,IAAI,cAAc,kBAAkB;AAC1C,YAAU,CAAC;AACX,QAAM,YAAwB;AAAA,IAC5B,QAAQ,MAAM,OAAO,IAAI,CAAC,OAAO,UAAU,mBAAmB,OAAO,KAAK,CAAC;AAAA,EAC7E;AACA,QAAM,MAAM,KAAK,QAAQ,CAAC;AAC1B,QAAM,UAAU,KAAK,KAAK,KAAK,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,QAAQ,GAAG,IAAI,WAAW,CAAC,MAAM;AACxF,MAAI,KAAoB;AACxB,MAAI;AACF,SAAK,GAAG,SAAS,SAAS,KAAK,GAAK;AACpC,OAAG,cAAc,IAAI,KAAK,UAAU,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM;AACtE,OAAG,UAAU,EAAE;AACf,OAAG,UAAU,EAAE;AACf,SAAK;AACL,OAAG,WAAW,SAAS,CAAC;AAExB,QAAI;AAAE,SAAG,UAAU,GAAG,GAAK;AAAA,IAAG,QAAQ;AAAA,IAA0C;AAChF,6BAAyB,GAAG;AAC5B,yBAAqB;AAAA,EACvB,SAAS,OAAO;AACd,QAAI,OAAO,MAAM;AACf,UAAI;AAAE,WAAG,UAAU,EAAE;AAAA,MAAG,QAAQ;AAAA,MAAe;AAAA,IACjD;AACA,QAAI;AAAE,SAAG,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,IAAG,QAAQ;AAAA,IAA+B;AAClF,UAAM;AAAA,EACR;AACF;AAQO,SAAS,gBAAgB,WAAmB,cAA8C;AAC/F,QAAM,SAAS,eAAe,SAAS,KAAK;AAC5C,QAAM,QAAQ,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AAKrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,cAAc,gBAAgB,EAAE,SAAS,2BAA2B;AAAA,EACtE;AACF;AAcO,SAAS,iBAAiB,OAAmB,YAA2B;AAC7E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,MAAM,SAAS;AACzE,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAClC;AAEO,SAAS,cACd,WACA,YACA,cACY;AACZ,QAAM,QAAQ,eAAe,UAAU;AAGvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AAEnE,QAAM,QAAQ,gBAAgB,WAAW,YAAY;AACrD,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAChC,SAAO;AACT;AAEO,SAAS,WAAW,YAAmC;AAC5D,SAAO,eAAe,UAAU,EAAE;AACpC;AAEO,SAAS,YAAY,WAAmB,YAA8B;AAC3E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO;AAC5B,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AACnE,MAAI,MAAM,OAAO,SAAS,QAAQ;AAChC,mBAAe,OAAO,UAAU;AAChC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,YAA+B;AAC/D,SAAO,eAAe,UAAU,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC7D;AASA,IAAM,qBAAqB;AAC3B,IAAI,iBAA+B,CAAC;AACpC,IAAI,YAAY;AAChB,IAAI;AAEJ,SAAS,uBAA6B;AACpC,mBAAiB,CAAC;AAClB,cAAY;AACZ,gBAAc;AAChB;AAGO,SAAS,8BAA8B,YAA4C;AACxF,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,MAAM,YAAY,sBAAsB,eAAe,YAAa,QAAO;AAC/E,mBAAiB,eAAe,UAAU,EAAE;AAC5C,cAAY;AACZ,gBAAc;AACd,SAAO;AACT;AAEO,SAAS,wBAAwB,YAA+B;AACrE,SAAO,8BAA8B,UAAU,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK;AAC7E;AAEO,SAAS,0BAA0B,OAAe,YAAyC;AAChG,SAAO,eAAe,UAAU,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC3E;","names":[]}

package/dist/{chunk-AER6MT24.js → chunk-6SXVCD7W.js}

@@ -1,6 +1,6 @@
 import {
   assertPathInsideRoot
-} from "./chunk-5GPPACXK.js";
+} from "./chunk-VSMRDBFT.js";
 import {
   RECALL_FALLBACK_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -92,4 +92,4 @@ async function scanMemoryDir(memoryDir) {
 export {
   scanMemoryDir
 };
-//# sourceMappingURL=chunk-AER6MT24.js.map
+//# sourceMappingURL=chunk-6SXVCD7W.js.map

package/dist/{chunk-OHDJ34CC.js → chunk-72WG5QKN.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-SVOHGUMI.js";
 
 // src/semantic-rule-promotion.ts
 import { createHash, randomUUID } from "crypto";
@@ -529,4 +529,4 @@ export {
   setSemanticRulePromotionTestHooks,
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-OHDJ34CC.js.map
+//# sourceMappingURL=chunk-72WG5QKN.js.map

package/dist/{chunk-CZAZX7JP.js → chunk-7MW3CVLD.js}

@@ -1,10 +1,10 @@
+import {
+  scanMemoryDir
+} from "./chunk-6SXVCD7W.js";
 import {
   isSearchAborted,
   throwIfSearchAborted
 } from "./chunk-CINZGPSJ.js";
-import {
-  scanMemoryDir
-} from "./chunk-AER6MT24.js";
 import {
   reportSearchDegradation,
   resolveEnsureCollectionArgs
@@ -613,4 +613,4 @@ export {
   resolveOramaCollectionDbFilePath,
   OramaBackend
 };
-//# sourceMappingURL=chunk-CZAZX7JP.js.map
+//# sourceMappingURL=chunk-7MW3CVLD.js.map

package/dist/{chunk-CXLNZXG5.js → chunk-7XGSIUP5.js}

@@ -216,4 +216,4 @@ export {
   getCausalTrajectoryStoreStatus,
   searchCausalTrajectories
 };
-//# sourceMappingURL=chunk-CXLNZXG5.js.map
+//# sourceMappingURL=chunk-7XGSIUP5.js.map

package/dist/{chunk-CZAA5N5S.js → chunk-AYZJID4S.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-UI4FVU6T.js";
 import {
   StorageManager
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-SVOHGUMI.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1276,4 +1276,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-CZAA5N5S.js.map
+//# sourceMappingURL=chunk-AYZJID4S.js.map

package/dist/{chunk-M7XQSUBB.js → chunk-B3ABVQ36.js}

@@ -2,6 +2,16 @@
 import { promises as fsPromises } from "fs";
 import * as path from "path";
 var DEFAULT_SELF_NAME = "Me";
+var SELF_MARKER_SUFFIX = " (you)";
+var SELF_MARKER = "(you)";
+function stripSelfMarker(name) {
+  const trimmed = name.trimEnd();
+  if (!trimmed.endsWith(SELF_MARKER)) return trimmed;
+  return trimmed.slice(0, -SELF_MARKER.length).trimEnd();
+}
+function hasSelfMarker(label) {
+  return label.trimEnd().endsWith(SELF_MARKER);
+}
 function emptySpeakerRegistry() {
   return { version: 1, selfName: DEFAULT_SELF_NAME, speakers: {} };
 }
@@ -63,18 +73,22 @@ function resolveSpeaker(sourceId, segment, registry) {
   const override = registry.speakers[speakerRegistryKey(sourceId, segment.speakerKey)];
   if (override) {
     const isSelf = override.isSelf === true;
+    const base = stripSelfMarker(override.name);
     return {
-      label: isSelf ? `${override.name} (you)` : override.name,
+      label: isSelf ? `${base}${SELF_MARKER_SUFFIX}` : base,
       isSelf
     };
   }
   if (segment.isWearer === true) {
-    return { label: `${registry.selfName} (you)`, isSelf: true };
+    return {
+      label: `${stripSelfMarker(registry.selfName)}${SELF_MARKER_SUFFIX}`,
+      isSelf: true
+    };
   }
   if (typeof segment.speakerName === "string" && segment.speakerName.trim().length > 0) {
-    return { label: segment.speakerName.trim(), isSelf: false };
+    return { label: stripSelfMarker(segment.speakerName.trim()), isSelf: false };
   }
-  const key = segment.speakerKey.trim();
+  const key = stripSelfMarker(segment.speakerKey.trim());
   if (/^\d+$/.test(key)) {
     return { label: `Speaker ${key}`, isSelf: false };
   }
@@ -97,13 +111,46 @@ function distinctSpeakerLabels(sourceId, segments, registry) {
 import { createHash } from "crypto";
 var WEARABLES_DIR_NAME = "wearables";
 var DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+var TRANSCRIPT_FORMAT_VERSION = 2;
+function isRegexWhitespace(code) {
+  return code >= 9 && code <= 13 || code === 32 || code === 160 || code === 5760 || code >= 8192 && code <= 8202 || code === 8232 || code === 8233 || code === 8239 || code === 8287 || code === 12288 || code === 65279;
+}
+function parseTranscriptSegmentLine(line) {
+  if (!line.startsWith("**")) return null;
+  let labelEnd = -1;
+  for (let i = 3; i < line.length; i++) {
+    if (line.charCodeAt(i) !== 42 || i + 3 >= line.length || line.charCodeAt(i + 1) !== 42 || !isRegexWhitespace(line.charCodeAt(i + 2)) || line.charCodeAt(i + 3) !== 91) {
+      continue;
+    }
+    labelEnd = i;
+    break;
+  }
+  if (labelEnd === -1) return null;
+  const label = line.slice(2, labelEnd);
+  const clockStart = labelEnd + 4;
+  let clockEnd = -1;
+  for (let i = clockStart + 1; i < line.length; i++) {
+    if (line.charCodeAt(i) !== 93 || i + 2 >= line.length || line.charCodeAt(i + 1) !== 58 || !isRegexWhitespace(line.charCodeAt(i + 2))) {
+      continue;
+    }
+    clockEnd = i;
+    break;
+  }
+  if (clockEnd === -1) return null;
+  return {
+    label,
+    clock: line.slice(clockStart, clockEnd),
+    text: line.slice(clockEnd + 3)
+  };
+}
 function isValidTranscriptDate(date) {
   if (!DATE_PATTERN.test(date)) return false;
   const parsed = /* @__PURE__ */ new Date(`${date}T00:00:00Z`);
   return !Number.isNaN(parsed.getTime()) && parsed.toISOString().slice(0, 10) === date;
 }
 function hashTranscriptBody(body) {
-  return createHash("sha256").update(body, "utf-8").digest("hex");
+  return createHash("sha256").update(`v${TRANSCRIPT_FORMAT_VERSION}
+${body}`, "utf-8").digest("hex");
 }
 function formatClockTime(iso, timezone) {
   if (!iso) return "--:--";
@@ -126,6 +173,48 @@ function conversationDurationMinutes(conversation) {
   if (Number.isNaN(start) || Number.isNaN(end) || end <= start) return 0;
   return (end - start) / 6e4;
 }
+function escapeSegmentText(text) {
+  return text.replace(/\\/g, "\\\\").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+}
+function unescapeSegmentText(text) {
+  return text.replace(/\\(.)/g, (_match, ch) => {
+    if (ch === "n") return "\n";
+    if (ch === "r") return "\r";
+    if (ch === "\\") return "\\";
+    return "\\" + ch;
+  });
+}
+function escapeSpeakerLabel(label) {
+  return label.replace(/\\/g, "\\\\").replace(/\*/g, "\\*").replace(/\[/g, "\\[").replace(/\]/g, "\\]").replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+}
+function unescapeSpeakerLabel(label) {
+  return label.replace(/\\(.)/g, (_match, ch) => {
+    if (ch === "\\") return "\\";
+    if (ch === "*") return "*";
+    if (ch === "[") return "[";
+    if (ch === "]") return "]";
+    if (ch === "n") return "\n";
+    if (ch === "r") return "\r";
+    return "\\" + ch;
+  });
+}
+function bodyIsEscaped(meta) {
+  return meta !== null && meta !== void 0 && typeof meta.formatVersion === "number" && meta.formatVersion >= TRANSCRIPT_FORMAT_VERSION;
+}
+function decodeTranscriptBody(body, escaped = false) {
+  if (!escaped) return body;
+  const lines = body.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const match = parseTranscriptSegmentLine(lines[i]);
+    if (match === null) continue;
+    const { label, clock, text: rawText } = match;
+    const decodedText = unescapeSegmentText(rawText);
+    const decodedLabel = unescapeSpeakerLabel(label);
+    if (decodedText === rawText && decodedLabel === label) continue;
+    lines[i] = `**${decodedLabel}** [${clock}]: ${decodedText}`;
+  }
+  return lines.join("\n");
+}
 function composeDayTranscriptBody(sourceId, date, timezone, conversations, registry) {
   const lines = [];
   lines.push(`# ${sourceId} transcript \u2014 ${date}`);
@@ -150,7 +239,9 @@ function composeDayTranscriptBody(sourceId, date, timezone, conversations, regis
     for (const segment of conversation.segments) {
       const { label } = resolveSpeaker(sourceId, segment, registry);
       const at = formatClockTime(segment.startIso, timezone);
-      lines.push(`**${label}** [${at}]: ${segment.text}`);
+      lines.push(
+        `**${escapeSpeakerLabel(label)}** [${at}]: ${escapeSegmentText(segment.text)}`
+      );
     }
     lines.push("");
   }
@@ -172,12 +263,16 @@ function composeDayTranscriptMeta(sourceId, date, timezone, conversations, regis
     speakers: distinctSpeakerLabels(sourceId, allSegments, registry),
     durationMinutes,
     contentHash: hashTranscriptBody(body),
-    syncedAt
+    syncedAt,
+    formatVersion: TRANSCRIPT_FORMAT_VERSION
   };
 }
 function serializeDayTranscript(meta, body) {
   const lines = ["---"];
   lines.push(`kind: ${meta.kind}`);
+  if (typeof meta.formatVersion === "number") {
+    lines.push(`formatVersion: ${meta.formatVersion}`);
+  }
   lines.push(`source: ${JSON.stringify(meta.source)}`);
   lines.push(`date: ${JSON.stringify(meta.date)}`);
   lines.push(`timezone: ${JSON.stringify(meta.timezone)}`);
@@ -230,9 +325,13 @@ function parseDayTranscript(raw) {
   if (!source || !date) return null;
   const meta = {
     kind: "wearable-transcript",
+    ...scalars.has("formatVersion") ? { formatVersion: parseNonNegativeInt(scalars.get("formatVersion")) } : {},
     source,
     date,
-    timezone: scalars.get("timezone") ?? "UTC",
+    // Preserve a missing timezone field as "" rather than coercing to a
+    // default: the fusion identity guard must see "no resolvable tz id"
+    // and skip, never silently match a known zone.
+    timezone: scalars.get("timezone") ?? "",
     conversationCount: parseNonNegativeInt(scalars.get("conversationCount")),
     segmentCount: parseNonNegativeInt(scalars.get("segmentCount")),
     speakers,
@@ -262,6 +361,7 @@ function parseNonNegativeInt(value) {
 
 export {
   DEFAULT_SELF_NAME,
+  hasSelfMarker,
   emptySpeakerRegistry,
   speakersFilePath,
   loadSpeakerRegistry,
@@ -270,11 +370,18 @@ export {
   resolveSpeaker,
   distinctSpeakerLabels,
   WEARABLES_DIR_NAME,
+  TRANSCRIPT_FORMAT_VERSION,
+  parseTranscriptSegmentLine,
   isValidTranscriptDate,
   hashTranscriptBody,
+  escapeSegmentText,
+  unescapeSegmentText,
+  unescapeSpeakerLabel,
+  bodyIsEscaped,
+  decodeTranscriptBody,
   composeDayTranscriptBody,
   composeDayTranscriptMeta,
   serializeDayTranscript,
   parseDayTranscript
 };
-//# sourceMappingURL=chunk-M7XQSUBB.js.map
+//# sourceMappingURL=chunk-B3ABVQ36.js.map

package/dist/chunk-B3ABVQ36.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/wearables/speakers.ts","../src/wearables/day-store.ts"],"sourcesContent":["/**\n * Wearable speaker registry — maps provider diarization labels to\n * human names, persistently, per source.\n *\n * Providers expose speakers differently (Limitless: names + a \"user\"\n * marker; Bee: opaque labels like \"0\"/\"1\"; Omi: \"SPEAKER_00\" + is_user\n * + optional person ids). The registry stores operator-confirmed\n * mappings keyed `<sourceId>:<speakerKey>` in\n * `state/wearables/speakers.json`, plus the wearer's display name.\n *\n * Resolution precedence (most-authoritative first):\n *   1. registry override for `<sourceId>:<speakerKey>`\n *   2. provider-identified wearer  -> selfName\n *   3. provider-supplied speaker name\n *   4. the raw speaker key, prefixed \"Speaker\" when it is bare digits\n */\n\nimport { promises as fsPromises } from \"node:fs\";\nimport * as path from \"node:path\";\n\nexport interface SpeakerOverride {\n  name: string;\n  /** Mark this speaker as the wearer (their words become \"you\"). */\n  isSelf?: boolean;\n  updatedAt: string;\n}\n\nexport interface SpeakerRegistry {\n  version: 1;\n  /** Display name used for the wearer across all sources. */\n  selfName: string;\n  /** Overrides keyed `<sourceId>:<speakerKey>`. */\n  speakers: Record<string, SpeakerOverride>;\n}\n\nexport const DEFAULT_SELF_NAME = \"Me\";\n\n/**\n * Reserved self marker appended to a wearer's display label so the\n * rendered transcript carries explicit, parseable self metadata. It is\n * RESERVED: a non-self display label can never carry it (see\n * `stripSelfMarker`), so when `reconstructFusionInputs` reads it back it\n * is authoritative self metadata — never a coincidental display-name\n * suffix that would misattribute another speaker as the wearer\n * (issue #1849).\n */\nexport const SELF_MARKER_SUFFIX = \" (you)\";\nconst SELF_MARKER = \"(you)\";\n\n/**\n * Remove a reserved `(you)` self marker from a display name. Applied to\n * every base name before it becomes a label so the marker can only ever\n * appear as the renderer-appended self flag, never as part of a stored\n * non-self display name.\n *\n * Implemented with plain string ops instead of a regex so the leading\n * `\\s*` (no anchor) cannot cause the O(n²) backtracking CodeQL flags\n * on whitespace-only input (js/polynomial-redos).\n */\nexport function stripSelfMarker(name: string): string {\n  const trimmed = name.trimEnd();\n  if (!trimmed.endsWith(SELF_MARKER)) return trimmed;\n  return trimmed.slice(0, -SELF_MARKER.length).trimEnd();\n}\n\n/**\n * Whether a rendered label carries the reserved self marker. This is the\n * single authoritative self-status detector shared by the renderer and\n * the fusion reconstructor (issue #1849).\n */\nexport function hasSelfMarker(label: string): boolean {\n  return label.trimEnd().endsWith(SELF_MARKER);\n}\n\nexport function emptySpeakerRegistry(): SpeakerRegistry {\n  return { version: 1, selfName: DEFAULT_SELF_NAME, speakers: {} };\n}\n\nexport function speakersFilePath(memoryDir: string): string {\n  return path.join(memoryDir, \"state\", \"wearables\", \"speakers.json\");\n}\n\nexport async function loadSpeakerRegistry(\n  memoryDir: string,\n): Promise<SpeakerRegistry> {\n  const filePath = speakersFilePath(memoryDir);\n  let raw: string;\n  try {\n    raw = await fsPromises.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n      return emptySpeakerRegistry();\n    }\n    throw err;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (err) {\n    throw new Error(\n      `wearables speakers file is not valid JSON (state/wearables/speakers.json): ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    );\n  }\n  if (\n    typeof parsed !== \"object\" ||\n    parsed === null ||\n    Array.isArray(parsed) ||\n    typeof (parsed as SpeakerRegistry).speakers !== \"object\" ||\n    (parsed as SpeakerRegistry).speakers === null\n  ) {\n    throw new Error(\n      'wearables speakers file has an unexpected shape (state/wearables/speakers.json); expected {\"version\":1,\"selfName\":\"...\",\"speakers\":{}}',\n    );\n  }\n  const registry = parsed as SpeakerRegistry;\n  return {\n    version: 1,\n    selfName:\n      typeof registry.selfName === \"string\" && registry.selfName.trim().length > 0\n        ? registry.selfName.trim()\n        : DEFAULT_SELF_NAME,\n    speakers: registry.speakers,\n  };\n}\n\nexport async function saveSpeakerRegistry(\n  memoryDir: string,\n  registry: SpeakerRegistry,\n): Promise<void> {\n  const filePath = speakersFilePath(memoryDir);\n  await fsPromises.mkdir(path.dirname(filePath), { recursive: true });\n  const tmpPath = `${filePath}.tmp-${process.pid}-${Date.now().toString(36)}`;\n  await fsPromises.writeFile(\n    tmpPath,\n    `${JSON.stringify(registry, null, 2)}\\n`,\n    \"utf-8\",\n  );\n  try {\n    await fsPromises.rename(tmpPath, filePath);\n  } catch (err) {\n    await fsPromises.unlink(tmpPath).catch(() => undefined);\n    throw err;\n  }\n}\n\nexport function speakerRegistryKey(\n  sourceId: string,\n  speakerKey: string,\n): string {\n  return `${sourceId}:${speakerKey}`;\n}\n\nexport interface ResolvedSpeaker {\n  /** Display label used in transcripts, e.g. \"Jane\" or \"Me (you)\". */\n  label: string;\n  /** Whether this speaker is the wearer. */\n  isSelf: boolean;\n}\n\nexport function resolveSpeaker(\n  sourceId: string,\n  segment: { speakerKey: string; speakerName?: string; isWearer?: boolean },\n  registry: SpeakerRegistry,\n): ResolvedSpeaker {\n  const override = registry.speakers[speakerRegistryKey(sourceId, segment.speakerKey)];\n  if (override) {\n    const isSelf = override.isSelf === true;\n    // Reserve the `(you)` marker: strip any pre-existing marker from the\n    // base name so a NON-self label can never carry it. Without this, a\n    // speaker override like \"Pat (you)\" set WITHOUT --self would render\n    // as \"Pat (you)\" and the fusion reconstructor would read the suffix\n    // as self metadata, attributing Pat's words to the wearer (issue\n    // #1849).\n    const base = stripSelfMarker(override.name);\n    return {\n      label: isSelf ? `${base}${SELF_MARKER_SUFFIX}` : base,\n      isSelf,\n    };\n  }\n  if (segment.isWearer === true) {\n    return {\n      label: `${stripSelfMarker(registry.selfName)}${SELF_MARKER_SUFFIX}`,\n      isSelf: true,\n    };\n  }\n  if (\n    typeof segment.speakerName === \"string\" &&\n    segment.speakerName.trim().length > 0\n  ) {\n    // Provider-supplied names are never self here; strip a stray marker\n    // so a provider label cannot masquerade as the reserved self flag.\n    return { label: stripSelfMarker(segment.speakerName.trim()), isSelf: false };\n  }\n  // Strip the reserved `(you)` marker from the raw key so a provider\n  // speakerKey like \"Pat (you)\" can never leak the marker into a non-self\n  // rendered label — the fusion reconstructor reads the suffix as\n  // authoritative self metadata and would misattribute the speaker as the\n  // wearer (issue #1849).\n  const key = stripSelfMarker(segment.speakerKey.trim());\n  // Bare diarization indexes read better with a prefix.\n  if (/^\\d+$/.test(key)) {\n    return { label: `Speaker ${key}`, isSelf: false };\n  }\n  return { label: key.length > 0 ? key : \"Unknown speaker\", isSelf: false };\n}\n\n/**\n * Distinct speaker labels for a set of segments, in first-appearance\n * order — used for day-transcript frontmatter.\n */\nexport function distinctSpeakerLabels(\n  sourceId: string,\n  segments: Array<{ speakerKey: string; speakerName?: string; isWearer?: boolean }>,\n  registry: SpeakerRegistry,\n): string[] {\n  const labels: string[] = [];\n  const seen = new Set<string>();\n  for (const segment of segments) {\n    const { label } = resolveSpeaker(sourceId, segment, registry);\n    if (!seen.has(label)) {\n      seen.add(label);\n      labels.push(label);\n    }\n  }\n  return labels;\n}\n","/**\n * Wearable day-transcript composition and parsing.\n *\n * One markdown file per source per day, stored under\n * `<memoryDir>/wearables/<source>/<YYYY-MM-DD>.md` with YAML\n * frontmatter. The location is deliberate:\n *\n *  - it is OUTSIDE the memory scan roots (facts/, procedures/,\n *    reasoning-traces/, corrections/), so transcripts never appear as\n *    memories in recall or governance passes;\n *  - it is INSIDE the QMD collection root (the memory dir), so day\n *    transcripts are full-text searchable after the next index update.\n *\n * Files are rebuilt idempotently from provider data on every sync; the\n * body hash in frontmatter lets the pipeline skip rewriting (and\n * re-extracting) unchanged days.\n *\n * This module is pure composition/parsing — file IO lives in\n * `StorageManager` so encrypted-at-rest deployments and atomic write\n * semantics are inherited from the same code paths memories use.\n */\n\nimport { createHash } from \"node:crypto\";\n\nimport type { SpeakerRegistry } from \"./speakers.js\";\nimport { distinctSpeakerLabels, resolveSpeaker } from \"./speakers.js\";\nimport type {\n  WearableConversation,\n  WearableDayTranscript,\n  WearableDayTranscriptMeta,\n} from \"./types.js\";\n\nexport const WEARABLES_DIR_NAME = \"wearables\";\n\nconst DATE_PATTERN = /^\\d{4}-\\d{2}-\\d{2}$/;\n\n/**\n * Day-transcript body serialization format version. Folded into\n * `hashTranscriptBody` so a version bump invalidates files written by an\n * older serializer and forces an idempotent rewrite. Decoders gate on this:\n * only bodies whose parsed meta carries >= this version have escape\n * sequences decoded; legacy bodies (absent / older) are left byte-for-byte\n * unchanged so a literal two-character `\\n`/`\\r` in a pre-escaper\n * transcript is never altered (issue #1849).\n */\nexport const TRANSCRIPT_FORMAT_VERSION = 2;\n\n/**\n * Result of parsing a rendered transcript segment line.\n */\nexport interface TranscriptSegmentMatch {\n  /** Speaker label text between the `**` delimiters. */\n  label: string;\n  /** Clock text between the `[` `]` delimiters. */\n  clock: string;\n  /** Segment text after the colon. */\n  text: string;\n}\n\n/**\n * Test a single character code point against the JavaScript regex `\\s`\n * whitespace class without invoking a regex. Used by the linear segment\n * line parser so no quantified pattern is ever evaluated on untrusted\n * transcript content (CodeQL polynomial-redos, issue #1849).\n */\nfunction isRegexWhitespace(code: number): boolean {\n  return (\n    (code >= 0x09 && code <= 0x0d) ||\n    code === 0x20 ||\n    code === 0xa0 ||\n    code === 0x1680 ||\n    (code >= 0x2000 && code <= 0x200a) ||\n    code === 0x2028 ||\n    code === 0x2029 ||\n    code === 0x202f ||\n    code === 0x205f ||\n    code === 0x3000 ||\n    code === 0xfeff\n  );\n}\n\n/**\n * Parse a rendered transcript segment line (`**label** [clock]: text`)\n * into its three components using a linear, bounded scan — a CodeQL-safe\n * replacement for the polynomial-risk regex that previously matched this\n * format. Returns null when the line is not a segment line.\n *\n * The scan finds the FIRST occurrence of each structural delimiter\n * (`**` after the label, `]` after the clock) exactly as the original\n * non-greedy regex did, and verifies the fixed separator characters\n * (`\\s`, `[`, `:`, `\\s`) by single-character code-point comparison.\n * No quantified regex is evaluated on the line (#1849).\n *\n * Escaped labels (formatVersion >= 2) never contain an unescaped `**`,\n * `[`, or `]`, and rendered clocks are always `HH:MM` / `--:--`, so the\n * first delimiter is always the correct one for every well-formed\n * transcript. Legacy unescaped labels are used verbatim by the caller\n * and parsed identically here.\n */\nexport function parseTranscriptSegmentLine(\n  line: string,\n): TranscriptSegmentMatch | null {\n  // Must start with '**'.\n  if (!line.startsWith(\"**\")) return null;\n\n  // Find the closing '**' of the label: the first '**' at index >= 3\n  // (label is at least 1 char) that is immediately followed by \\s and\n  // then '['. This mirrors the non-greedy regex: the engine tries the\n  // shortest label first and extends only when the subsequent fixed\n  // delimiters do not line up. An escaped label ending with '\\*' is\n  // correctly handled because the spurious '**' (escape-star + close-\n  // star) is not followed by \\s and the scan continues.\n  let labelEnd = -1;\n  for (let i = 3; i < line.length; i++) {\n    if (\n      line.charCodeAt(i) !== 0x2a /* '*' */ ||\n      i + 3 >= line.length ||\n      line.charCodeAt(i + 1) !== 0x2a /* '*' */ ||\n      !isRegexWhitespace(line.charCodeAt(i + 2)) ||\n      line.charCodeAt(i + 3) !== 0x5b /* '[' */\n    ) {\n      continue;\n    }\n    labelEnd = i;\n    break;\n  }\n  if (labelEnd === -1) return null;\n\n  const label = line.slice(2, labelEnd);\n  // Clock content starts after the closing '**', the \\s, and the '['.\n  const clockStart = labelEnd + 4;\n\n  // Find the closing ']' of the clock: the first ']' at index >=\n  // clockStart + 1 (clock is at least 1 char) that is immediately\n  // followed by ':' and \\s — matching the non-greedy regex.\n  let clockEnd = -1;\n  for (let i = clockStart + 1; i < line.length; i++) {\n    if (\n      line.charCodeAt(i) !== 0x5d /* ']' */ ||\n      i + 2 >= line.length ||\n      line.charCodeAt(i + 1) !== 0x3a /* ':' */ ||\n      !isRegexWhitespace(line.charCodeAt(i + 2))\n    ) {\n      continue;\n    }\n    clockEnd = i;\n    break;\n  }\n  if (clockEnd === -1) return null;\n\n  return {\n    label,\n    clock: line.slice(clockStart, clockEnd),\n    text: line.slice(clockEnd + 3),\n  };\n}\n\nexport function isValidTranscriptDate(date: string): boolean {\n  if (!DATE_PATTERN.test(date)) return false;\n  const parsed = new Date(`${date}T00:00:00Z`);\n  return !Number.isNaN(parsed.getTime()) && parsed.toISOString().slice(0, 10) === date;\n}\n\nexport function hashTranscriptBody(body: string): string {\n  // The version prefix makes the hash an idempotency key for the body AS\n  // SERIALIZED under the current format: when the escape encoding changes\n  // (version bump) every existing file's stored hash no longer matches and\n  // the pipeline rewrites it with the new marker — no separate migration\n  // pass needed (issue #1849).\n  return createHash(\"sha256\")\n    .update(`v${TRANSCRIPT_FORMAT_VERSION}\\n${body}`, \"utf-8\")\n    .digest(\"hex\");\n}\n\nfunction formatClockTime(iso: string | undefined, timezone: string): string {\n  if (!iso) return \"--:--\";\n  const ms = Date.parse(iso);\n  if (Number.isNaN(ms)) return \"--:--\";\n  try {\n    return new Intl.DateTimeFormat(\"en-US\", {\n      timeZone: timezone,\n      hour12: false,\n      hour: \"2-digit\",\n      minute: \"2-digit\",\n    }).format(new Date(ms));\n  } catch {\n    // Unknown timezone identifiers fall back to UTC rather than\n    // crashing a sync that already fetched data.\n    return new Date(ms).toISOString().slice(11, 16);\n  }\n}\n\nfunction conversationDurationMinutes(conversation: WearableConversation): number {\n  const start = Date.parse(conversation.startIso);\n  const end = conversation.endIso ? Date.parse(conversation.endIso) : NaN;\n  if (Number.isNaN(start) || Number.isNaN(end) || end <= start) return 0;\n  return (end - start) / 60_000;\n}\n\n/**\n * Escape segment text for the line-based markdown format so that embedded\n * newlines, carriage returns, and backslashes survive the serialize →\n * reconstruct round-trip losslessly.  Reversed by `unescapeSegmentText`\n * (this module — the single decode primitive shared with the fusion\n * reconstruct path and every view/search/index surface).\n *\n * Without this, a segment whose text contains a newline is split across\n * multiple physical lines; the reconstruct path treats each line\n * independently and the continuation is silently dropped (or worse, a\n * continuation line that looks like a heading/clock is mis-parsed).\n */\nexport function escapeSegmentText(text: string): string {\n  return text\n    .replace(/\\\\/g, \"\\\\\\\\\")\n    .replace(/\\n/g, \"\\\\n\")\n    .replace(/\\r/g, \"\\\\r\");\n}\n\n/**\n * Reverse `escapeSegmentText`. Unknown escape sequences (a lone\n * backslash followed by a character the escaper never emits) are passed\n * through literally so legacy transcripts that never went through the\n * escaper still round-trip their original text. This is the SINGLE\n * decode primitive: the fusion reconstruct path and every user-facing\n * view/search/index surface call it so escaped storage never leaks to\n * display (#1849).\n */\nexport function unescapeSegmentText(text: string): string {\n  return text.replace(/\\\\(.)/g, (_match, ch: string) => {\n    if (ch === \"n\") return \"\\n\";\n    if (ch === \"r\") return \"\\r\";\n    if (ch === \"\\\\\") return \"\\\\\";\n    return \"\\\\\" + ch;\n  });\n}\n\n/**\n * Escape a speaker label for the line-based markdown format so that\n * markdown-delimiter characters in an arbitrary user/provider label\n * (`**`, `[`, `]`), the escape character (`\\`), and embedded newlines/\n * carriage returns cannot break `parseTranscriptSegmentLine` parsing.\n * Without this, a label containing `**` (or `** [clock]:`) can make the\n * non-greedy delimiter match land on the wrong `**` and mis-parse the\n * clock/text — or fail to parse the line at all. Reversed by\n * `unescapeSpeakerLabel` (this module). Legacy transcripts whose labels\n * were never escaped still parse: `unescapeSpeakerLabel` is a no-op on\n * any label without a backslash escape sequence (#1849).\n */\nexport function escapeSpeakerLabel(label: string): string {\n  return label\n    .replace(/\\\\/g, \"\\\\\\\\\")\n    .replace(/\\*/g, \"\\\\*\")\n    .replace(/\\[/g, \"\\\\[\")\n    .replace(/\\]/g, \"\\\\]\")\n    .replace(/\\n/g, \"\\\\n\")\n    .replace(/\\r/g, \"\\\\r\");\n}\n\n/**\n * Reverse `escapeSpeakerLabel`. Unknown escape sequences (a backslash\n * followed by a character the escaper never emits) are passed through\n * literally so legacy transcripts with raw labels still round-trip\n * their original text, mirroring `unescapeSegmentText` for segment text.\n */\nexport function unescapeSpeakerLabel(label: string): string {\n  return label.replace(/\\\\(.)/g, (_match, ch: string) => {\n    if (ch === \"\\\\\") return \"\\\\\";\n    if (ch === \"*\") return \"*\";\n    if (ch === \"[\") return \"[\";\n    if (ch === \"]\") return \"]\";\n    if (ch === \"n\") return \"\\n\";\n    if (ch === \"r\") return \"\\r\";\n    return \"\\\\\" + ch;\n  });\n}\n\n/**\n * Whether a parsed day-transcript's body was written by the escape-aware\n * serializer (meta carries `formatVersion` >= `TRANSCRIPT_FORMAT_VERSION`).\n * Legacy bodies (no marker, or an older version) must NOT be decoded: their\n * literal two-character `\\n`, `\\r`, and lone backslashes are original\n * content, not escape sequences (issue #1849).\n */\nexport function bodyIsEscaped(\n  meta: { formatVersion?: number } | null | undefined,\n): boolean {\n  return (\n    meta !== null &&\n    meta !== undefined &&\n    typeof meta.formatVersion === \"number\" &&\n    meta.formatVersion >= TRANSCRIPT_FORMAT_VERSION\n  );\n}\n\n/**\n * Decode the escaped segment text AND speaker label of a stored\n * transcript body into the ORIGINAL forms for user-facing\n * view/search/index surfaces. Only segment lines are touched: the text\n * is decoded via `unescapeSegmentText` and the label via\n * `unescapeSpeakerLabel`; headings, locations, and the H1 header are\n * NOT escaped on write and pass through unchanged, so a title or\n * location containing a literal backslash is never altered. The fusion\n * reconstruct path does NOT use this — it decodes each segment once\n * during parse — so callers feeding bodies back into reconstruct must\n * pass the RAW stored body, not a decoded one, to avoid double-decoding.\n *\n * FORMAT-AWARE (issue #1849): when `escaped` is falsy (the default) the\n * body is returned byte-for-byte unchanged. Only bodies written by the\n * escape-aware serializer (`escaped = true`, derived from\n * `bodyIsEscaped(meta)`) are decoded, so a legacy transcript's literal\n * two-character `\\n`/`\\r` or lone backslash is never altered. Callers\n * that have the parsed meta should pass `bodyIsEscaped(meta)`.\n */\nexport function decodeTranscriptBody(body: string, escaped = false): string {\n  if (!escaped) return body;\n  const lines = body.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const match = parseTranscriptSegmentLine(lines[i]);\n    if (match === null) continue;\n    const { label, clock, text: rawText } = match;\n    const decodedText = unescapeSegmentText(rawText);\n    const decodedLabel = unescapeSpeakerLabel(label);\n    if (decodedText === rawText && decodedLabel === label) continue;\n    lines[i] = `**${decodedLabel}** [${clock}]: ${decodedText}`;\n  }\n  return lines.join(\"\\n\");\n}\n\n/** Compose the markdown body (no frontmatter) for one source/day. */\nexport function composeDayTranscriptBody(\n  sourceId: string,\n  date: string,\n  timezone: string,\n  conversations: WearableConversation[],\n  registry: SpeakerRegistry,\n): string {\n  const lines: string[] = [];\n  lines.push(`# ${sourceId} transcript — ${date}`);\n  lines.push(\"\");\n  const ordered = [...conversations].sort((a, b) => {\n    const aMs = Date.parse(a.startIso);\n    const bMs = Date.parse(b.startIso);\n    if (aMs < bMs) return -1;\n    if (aMs > bMs) return 1;\n    // Stable secondary key so equal start times order deterministically.\n    return a.id < b.id ? -1 : a.id > b.id ? 1 : 0;\n  });\n  for (const conversation of ordered) {\n    const start = formatClockTime(conversation.startIso, timezone);\n    const end = formatClockTime(conversation.endIso, timezone);\n    const title = conversation.title?.trim();\n    const heading = title && title.length > 0 ? ` · ${title}` : \"\";\n    lines.push(`## ${start}–${end}${heading} (conversation ${conversation.id})`);\n    if (conversation.location) {\n      lines.push(`*Location: ${conversation.location}*`);\n    }\n    lines.push(\"\");\n    for (const segment of conversation.segments) {\n      const { label } = resolveSpeaker(sourceId, segment, registry);\n      const at = formatClockTime(segment.startIso, timezone);\n      lines.push(\n        `**${escapeSpeakerLabel(label)}** [${at}]: ${escapeSegmentText(segment.text)}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  return `${lines.join(\"\\n\").trimEnd()}\\n`;\n}\n\nexport function composeDayTranscriptMeta(\n  sourceId: string,\n  date: string,\n  timezone: string,\n  conversations: WearableConversation[],\n  registry: SpeakerRegistry,\n  body: string,\n  syncedAt: string,\n): WearableDayTranscriptMeta {\n  const allSegments = conversations.flatMap((c) => c.segments);\n  const durationMinutes = Math.round(\n    conversations.reduce((sum, c) => sum + conversationDurationMinutes(c), 0),\n  );\n  return {\n    kind: \"wearable-transcript\",\n    source: sourceId,\n    date,\n    timezone,\n    conversationCount: conversations.length,\n    segmentCount: allSegments.length,\n    speakers: distinctSpeakerLabels(sourceId, allSegments, registry),\n    durationMinutes,\n    contentHash: hashTranscriptBody(body),\n    syncedAt,\n    formatVersion: TRANSCRIPT_FORMAT_VERSION,\n  };\n}\n\n/** Serialize meta + body into the persisted file format. */\nexport function serializeDayTranscript(\n  meta: WearableDayTranscriptMeta,\n  body: string,\n): string {\n  const lines: string[] = [\"---\"];\n  lines.push(`kind: ${meta.kind}`);\n  if (typeof meta.formatVersion === \"number\") {\n    lines.push(`formatVersion: ${meta.formatVersion}`);\n  }\n  lines.push(`source: ${JSON.stringify(meta.source)}`);\n  lines.push(`date: ${JSON.stringify(meta.date)}`);\n  lines.push(`timezone: ${JSON.stringify(meta.timezone)}`);\n  lines.push(`conversationCount: ${meta.conversationCount}`);\n  lines.push(`segmentCount: ${meta.segmentCount}`);\n  if (meta.speakers.length === 0) {\n    lines.push(\"speakers: []\");\n  } else {\n    lines.push(\"speakers:\");\n    for (const speaker of meta.speakers) {\n      lines.push(`  - ${JSON.stringify(speaker)}`);\n    }\n  }\n  lines.push(`durationMinutes: ${meta.durationMinutes}`);\n  lines.push(`contentHash: ${JSON.stringify(meta.contentHash)}`);\n  lines.push(`syncedAt: ${JSON.stringify(meta.syncedAt)}`);\n  lines.push(\"---\");\n  lines.push(\"\");\n  return `${lines.join(\"\\n\")}${body}`;\n}\n\n/**\n * Parse a persisted day-transcript file. Returns null when the content\n * does not look like a wearable transcript (wrong kind, missing\n * frontmatter) so callers can distinguish \"not a transcript\" from a\n * read error.\n */\nexport function parseDayTranscript(raw: string): WearableDayTranscript | null {\n  if (!raw.startsWith(\"---\\n\")) return null;\n  const closeIndex = raw.indexOf(\"\\n---\\n\", 4);\n  if (closeIndex === -1) return null;\n  const header = raw.slice(4, closeIndex);\n  const body = raw.slice(closeIndex + 5).replace(/^\\n/, \"\");\n\n  const scalars = new Map<string, string>();\n  const speakers: string[] = [];\n  let inSpeakers = false;\n  for (const line of header.split(\"\\n\")) {\n    if (inSpeakers) {\n      const item = line.match(/^ {2}- (.*)$/);\n      if (item) {\n        speakers.push(parseYamlScalar(item[1]));\n        continue;\n      }\n      inSpeakers = false;\n    }\n    if (line === \"speakers:\") {\n      inSpeakers = true;\n      continue;\n    }\n    if (line === \"speakers: []\") continue;\n    const match = line.match(/^([A-Za-z][A-Za-z0-9]*): (.*)$/);\n    if (match) scalars.set(match[1], parseYamlScalar(match[2]));\n  }\n\n  if (scalars.get(\"kind\") !== \"wearable-transcript\") return null;\n  const source = scalars.get(\"source\");\n  const date = scalars.get(\"date\");\n  if (!source || !date) return null;\n\n  const meta: WearableDayTranscriptMeta = {\n    kind: \"wearable-transcript\",\n    ...(scalars.has(\"formatVersion\")\n      ? { formatVersion: parseNonNegativeInt(scalars.get(\"formatVersion\")) }\n      : {}),\n    source,\n    date,\n    // Preserve a missing timezone field as \"\" rather than coercing to a\n    // default: the fusion identity guard must see \"no resolvable tz id\"\n    // and skip, never silently match a known zone.\n    timezone: scalars.get(\"timezone\") ?? \"\",\n    conversationCount: parseNonNegativeInt(scalars.get(\"conversationCount\")),\n    segmentCount: parseNonNegativeInt(scalars.get(\"segmentCount\")),\n    speakers,\n    durationMinutes: parseNonNegativeInt(scalars.get(\"durationMinutes\")),\n    contentHash: scalars.get(\"contentHash\") ?? \"\",\n    syncedAt: scalars.get(\"syncedAt\") ?? \"\",\n  };\n  return { meta, body };\n}\n\nfunction parseYamlScalar(value: string): string {\n  const trimmed = value.trim();\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"') && trimmed.length >= 2) {\n    try {\n      const parsed = JSON.parse(trimmed);\n      if (typeof parsed === \"string\") return parsed;\n    } catch {\n      // Fall through to the raw value below.\n    }\n  }\n  return trimmed;\n}\n\nfunction parseNonNegativeInt(value: string | undefined): number {\n  if (value === undefined) return 0;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed < 0) return 0;\n  return Math.floor(parsed);\n}\n"],"mappings":";AAiBA,SAAS,YAAY,kBAAkB;AACvC,YAAY,UAAU;AAiBf,IAAM,oBAAoB;AAW1B,IAAM,qBAAqB;AAClC,IAAM,cAAc;AAYb,SAAS,gBAAgB,MAAsB;AACpD,QAAM,UAAU,KAAK,QAAQ;AAC7B,MAAI,CAAC,QAAQ,SAAS,WAAW,EAAG,QAAO;AAC3C,SAAO,QAAQ,MAAM,GAAG,CAAC,YAAY,MAAM,EAAE,QAAQ;AACvD;AAOO,SAAS,cAAc,OAAwB;AACpD,SAAO,MAAM,QAAQ,EAAE,SAAS,WAAW;AAC7C;AAEO,SAAS,uBAAwC;AACtD,SAAO,EAAE,SAAS,GAAG,UAAU,mBAAmB,UAAU,CAAC,EAAE;AACjE;AAEO,SAAS,iBAAiB,WAA2B;AAC1D,SAAY,UAAK,WAAW,SAAS,aAAa,eAAe;AACnE;AAEA,eAAsB,oBACpB,WAC0B;AAC1B,QAAM,WAAW,iBAAiB,SAAS;AAC3C,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,WAAW,SAAS,UAAU,OAAO;AAAA,EACnD,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,UAAU;AACpD,aAAO,qBAAqB;AAAA,IAC9B;AACA,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,8EACE,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,WAAW,YAClB,WAAW,QACX,MAAM,QAAQ,MAAM,KACpB,OAAQ,OAA2B,aAAa,YAC/C,OAA2B,aAAa,MACzC;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW;AACjB,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UACE,OAAO,SAAS,aAAa,YAAY,SAAS,SAAS,KAAK,EAAE,SAAS,IACvE,SAAS,SAAS,KAAK,IACvB;AAAA,IACN,UAAU,SAAS;AAAA,EACrB;AACF;AAEA,eAAsB,oBACpB,WACA,UACe;AACf,QAAM,WAAW,iBAAiB,SAAS;AAC3C,QAAM,WAAW,MAAW,aAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AAClE,QAAM,UAAU,GAAG,QAAQ,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC;AACzE,QAAM,WAAW;AAAA,IACf;AAAA,IACA,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA;AAAA,IACpC;AAAA,EACF;AACA,MAAI;AACF,UAAM,WAAW,OAAO,SAAS,QAAQ;AAAA,EAC3C,SAAS,KAAK;AACZ,UAAM,WAAW,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AACtD,UAAM;AAAA,EACR;AACF;AAEO,SAAS,mBACd,UACA,YACQ;AACR,SAAO,GAAG,QAAQ,IAAI,UAAU;AAClC;AASO,SAAS,eACd,UACA,SACA,UACiB;AACjB,QAAM,WAAW,SAAS,SAAS,mBAAmB,UAAU,QAAQ,UAAU,CAAC;AACnF,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,WAAW;AAOnC,UAAM,OAAO,gBAAgB,SAAS,IAAI;AAC1C,WAAO;AAAA,MACL,OAAO,SAAS,GAAG,IAAI,GAAG,kBAAkB,KAAK;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,aAAa,MAAM;AAC7B,WAAO;AAAA,MACL,OAAO,GAAG,gBAAgB,SAAS,QAAQ,CAAC,GAAG,kBAAkB;AAAA,MACjE,QAAQ;AAAA,IACV;AAAA,EACF;AACA,MACE,OAAO,QAAQ,gBAAgB,YAC/B,QAAQ,YAAY,KAAK,EAAE,SAAS,GACpC;AAGA,WAAO,EAAE,OAAO,gBAAgB,QAAQ,YAAY,KAAK,CAAC,GAAG,QAAQ,MAAM;AAAA,EAC7E;AAMA,QAAM,MAAM,gBAAgB,QAAQ,WAAW,KAAK,CAAC;AAErD,MAAI,QAAQ,KAAK,GAAG,GAAG;AACrB,WAAO,EAAE,OAAO,WAAW,GAAG,IAAI,QAAQ,MAAM;AAAA,EAClD;AACA,SAAO,EAAE,OAAO,IAAI,SAAS,IAAI,MAAM,mBAAmB,QAAQ,MAAM;AAC1E;AAMO,SAAS,sBACd,UACA,UACA,UACU;AACV,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,WAAW,UAAU;AAC9B,UAAM,EAAE,MAAM,IAAI,eAAe,UAAU,SAAS,QAAQ;AAC5D,QAAI,CAAC,KAAK,IAAI,KAAK,GAAG;AACpB,WAAK,IAAI,KAAK;AACd,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;;;AC7MA,SAAS,kBAAkB;AAUpB,IAAM,qBAAqB;AAElC,IAAM,eAAe;AAWd,IAAM,4BAA4B;AAoBzC,SAAS,kBAAkB,MAAuB;AAChD,SACG,QAAQ,KAAQ,QAAQ,MACzB,SAAS,MACT,SAAS,OACT,SAAS,QACR,QAAQ,QAAU,QAAQ,QAC3B,SAAS,QACT,SAAS,QACT,SAAS,QACT,SAAS,QACT,SAAS,SACT,SAAS;AAEb;AAoBO,SAAS,2BACd,MAC+B;AAE/B,MAAI,CAAC,KAAK,WAAW,IAAI,EAAG,QAAO;AASnC,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,QACE,KAAK,WAAW,CAAC,MAAM,MACvB,IAAI,KAAK,KAAK,UACd,KAAK,WAAW,IAAI,CAAC,MAAM,MAC3B,CAAC,kBAAkB,KAAK,WAAW,IAAI,CAAC,CAAC,KACzC,KAAK,WAAW,IAAI,CAAC,MAAM,IAC3B;AACA;AAAA,IACF;AACA,eAAW;AACX;AAAA,EACF;AACA,MAAI,aAAa,GAAI,QAAO;AAE5B,QAAM,QAAQ,KAAK,MAAM,GAAG,QAAQ;AAEpC,QAAM,aAAa,WAAW;AAK9B,MAAI,WAAW;AACf,WAAS,IAAI,aAAa,GAAG,IAAI,KAAK,QAAQ,KAAK;AACjD,QACE,KAAK,WAAW,CAAC,MAAM,MACvB,IAAI,KAAK,KAAK,UACd,KAAK,WAAW,IAAI,CAAC,MAAM,MAC3B,CAAC,kBAAkB,KAAK,WAAW,IAAI,CAAC,CAAC,GACzC;AACA;AAAA,IACF;AACA,eAAW;AACX;AAAA,EACF;AACA,MAAI,aAAa,GAAI,QAAO;AAE5B,SAAO;AAAA,IACL;AAAA,IACA,OAAO,KAAK,MAAM,YAAY,QAAQ;AAAA,IACtC,MAAM,KAAK,MAAM,WAAW,CAAC;AAAA,EAC/B;AACF;AAEO,SAAS,sBAAsB,MAAuB;AAC3D,MAAI,CAAC,aAAa,KAAK,IAAI,EAAG,QAAO;AACrC,QAAM,SAAS,oBAAI,KAAK,GAAG,IAAI,YAAY;AAC3C,SAAO,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,KAAK,OAAO,YAAY,EAAE,MAAM,GAAG,EAAE,MAAM;AAClF;AAEO,SAAS,mBAAmB,MAAsB;AAMvD,SAAO,WAAW,QAAQ,EACvB,OAAO,IAAI,yBAAyB;AAAA,EAAK,IAAI,IAAI,OAAO,EACxD,OAAO,KAAK;AACjB;AAEA,SAAS,gBAAgB,KAAyB,UAA0B;AAC1E,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,KAAK,KAAK,MAAM,GAAG;AACzB,MAAI,OAAO,MAAM,EAAE,EAAG,QAAO;AAC7B,MAAI;AACF,WAAO,IAAI,KAAK,eAAe,SAAS;AAAA,MACtC,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC;AAAA,EACxB,QAAQ;AAGN,WAAO,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE,MAAM,IAAI,EAAE;AAAA,EAChD;AACF;AAEA,SAAS,4BAA4B,cAA4C;AAC/E,QAAM,QAAQ,KAAK,MAAM,aAAa,QAAQ;AAC9C,QAAM,MAAM,aAAa,SAAS,KAAK,MAAM,aAAa,MAAM,IAAI;AACpE,MAAI,OAAO,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG,KAAK,OAAO,MAAO,QAAO;AACrE,UAAQ,MAAM,SAAS;AACzB;AAcO,SAAS,kBAAkB,MAAsB;AACtD,SAAO,KACJ,QAAQ,OAAO,MAAM,EACrB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAWO,SAAS,oBAAoB,MAAsB;AACxD,SAAO,KAAK,QAAQ,UAAU,CAAC,QAAQ,OAAe;AACpD,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,KAAM,QAAO;AACxB,WAAO,OAAO;AAAA,EAChB,CAAC;AACH;AAcO,SAAS,mBAAmB,OAAuB;AACxD,SAAO,MACJ,QAAQ,OAAO,MAAM,EACrB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,KAAK;AACzB;AAQO,SAAS,qBAAqB,OAAuB;AAC1D,SAAO,MAAM,QAAQ,UAAU,CAAC,QAAQ,OAAe;AACrD,QAAI,OAAO,KAAM,QAAO;AACxB,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,IAAK,QAAO;AACvB,QAAI,OAAO,IAAK,QAAO;AACvB,WAAO,OAAO;AAAA,EAChB,CAAC;AACH;AASO,SAAS,cACd,MACS;AACT,SACE,SAAS,QACT,SAAS,UACT,OAAO,KAAK,kBAAkB,YAC9B,KAAK,iBAAiB;AAE1B;AAqBO,SAAS,qBAAqB,MAAc,UAAU,OAAe;AAC1E,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,QAAQ,2BAA2B,MAAM,CAAC,CAAC;AACjD,QAAI,UAAU,KAAM;AACpB,UAAM,EAAE,OAAO,OAAO,MAAM,QAAQ,IAAI;AACxC,UAAM,cAAc,oBAAoB,OAAO;AAC/C,UAAM,eAAe,qBAAqB,KAAK;AAC/C,QAAI,gBAAgB,WAAW,iBAAiB,MAAO;AACvD,UAAM,CAAC,IAAI,KAAK,YAAY,OAAO,KAAK,MAAM,WAAW;AAAA,EAC3D;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAGO,SAAS,yBACd,UACA,MACA,UACA,eACA,UACQ;AACR,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,KAAK,QAAQ,sBAAiB,IAAI,EAAE;AAC/C,QAAM,KAAK,EAAE;AACb,QAAM,UAAU,CAAC,GAAG,aAAa,EAAE,KAAK,CAAC,GAAG,MAAM;AAChD,UAAM,MAAM,KAAK,MAAM,EAAE,QAAQ;AACjC,UAAM,MAAM,KAAK,MAAM,EAAE,QAAQ;AACjC,QAAI,MAAM,IAAK,QAAO;AACtB,QAAI,MAAM,IAAK,QAAO;AAEtB,WAAO,EAAE,KAAK,EAAE,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI;AAAA,EAC9C,CAAC;AACD,aAAW,gBAAgB,SAAS;AAClC,UAAM,QAAQ,gBAAgB,aAAa,UAAU,QAAQ;AAC7D,UAAM,MAAM,gBAAgB,aAAa,QAAQ,QAAQ;AACzD,UAAM,QAAQ,aAAa,OAAO,KAAK;AACvC,UAAM,UAAU,SAAS,MAAM,SAAS,IAAI,SAAM,KAAK,KAAK;AAC5D,UAAM,KAAK,MAAM,KAAK,SAAI,GAAG,GAAG,OAAO,kBAAkB,aAAa,EAAE,GAAG;AAC3E,QAAI,aAAa,UAAU;AACzB,YAAM,KAAK,cAAc,aAAa,QAAQ,GAAG;AAAA,IACnD;AACA,UAAM,KAAK,EAAE;AACb,eAAW,WAAW,aAAa,UAAU;AAC3C,YAAM,EAAE,MAAM,IAAI,eAAe,UAAU,SAAS,QAAQ;AAC5D,YAAM,KAAK,gBAAgB,QAAQ,UAAU,QAAQ;AACrD,YAAM;AAAA,QACJ,KAAK,mBAAmB,KAAK,CAAC,OAAO,EAAE,MAAM,kBAAkB,QAAQ,IAAI,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,SAAO,GAAG,MAAM,KAAK,IAAI,EAAE,QAAQ,CAAC;AAAA;AACtC;AAEO,SAAS,yBACd,UACA,MACA,UACA,eACA,UACA,MACA,UAC2B;AAC3B,QAAM,cAAc,cAAc,QAAQ,CAAC,MAAM,EAAE,QAAQ;AAC3D,QAAM,kBAAkB,KAAK;AAAA,IAC3B,cAAc,OAAO,CAAC,KAAK,MAAM,MAAM,4BAA4B,CAAC,GAAG,CAAC;AAAA,EAC1E;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,mBAAmB,cAAc;AAAA,IACjC,cAAc,YAAY;AAAA,IAC1B,UAAU,sBAAsB,UAAU,aAAa,QAAQ;AAAA,IAC/D;AAAA,IACA,aAAa,mBAAmB,IAAI;AAAA,IACpC;AAAA,IACA,eAAe;AAAA,EACjB;AACF;AAGO,SAAS,uBACd,MACA,MACQ;AACR,QAAM,QAAkB,CAAC,KAAK;AAC9B,QAAM,KAAK,SAAS,KAAK,IAAI,EAAE;AAC/B,MAAI,OAAO,KAAK,kBAAkB,UAAU;AAC1C,UAAM,KAAK,kBAAkB,KAAK,aAAa,EAAE;AAAA,EACnD;AACA,QAAM,KAAK,WAAW,KAAK,UAAU,KAAK,MAAM,CAAC,EAAE;AACnD,QAAM,KAAK,SAAS,KAAK,UAAU,KAAK,IAAI,CAAC,EAAE;AAC/C,QAAM,KAAK,aAAa,KAAK,UAAU,KAAK,QAAQ,CAAC,EAAE;AACvD,QAAM,KAAK,sBAAsB,KAAK,iBAAiB,EAAE;AACzD,QAAM,KAAK,iBAAiB,KAAK,YAAY,EAAE;AAC/C,MAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,UAAM,KAAK,cAAc;AAAA,EAC3B,OAAO;AACL,UAAM,KAAK,WAAW;AACtB,eAAW,WAAW,KAAK,UAAU;AACnC,YAAM,KAAK,OAAO,KAAK,UAAU,OAAO,CAAC,EAAE;AAAA,IAC7C;AAAA,EACF;AACA,QAAM,KAAK,oBAAoB,KAAK,eAAe,EAAE;AACrD,QAAM,KAAK,gBAAgB,KAAK,UAAU,KAAK,WAAW,CAAC,EAAE;AAC7D,QAAM,KAAK,aAAa,KAAK,UAAU,KAAK,QAAQ,CAAC,EAAE;AACvD,QAAM,KAAK,KAAK;AAChB,QAAM,KAAK,EAAE;AACb,SAAO,GAAG,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI;AACnC;AAQO,SAAS,mBAAmB,KAA2C;AAC5E,MAAI,CAAC,IAAI,WAAW,OAAO,EAAG,QAAO;AACrC,QAAM,aAAa,IAAI,QAAQ,WAAW,CAAC;AAC3C,MAAI,eAAe,GAAI,QAAO;AAC9B,QAAM,SAAS,IAAI,MAAM,GAAG,UAAU;AACtC,QAAM,OAAO,IAAI,MAAM,aAAa,CAAC,EAAE,QAAQ,OAAO,EAAE;AAExD,QAAM,UAAU,oBAAI,IAAoB;AACxC,QAAM,WAAqB,CAAC;AAC5B,MAAI,aAAa;AACjB,aAAW,QAAQ,OAAO,MAAM,IAAI,GAAG;AACrC,QAAI,YAAY;AACd,YAAM,OAAO,KAAK,MAAM,cAAc;AACtC,UAAI,MAAM;AACR,iBAAS,KAAK,gBAAgB,KAAK,CAAC,CAAC,CAAC;AACtC;AAAA,MACF;AACA,mBAAa;AAAA,IACf;AACA,QAAI,SAAS,aAAa;AACxB,mBAAa;AACb;AAAA,IACF;AACA,QAAI,SAAS,eAAgB;AAC7B,UAAM,QAAQ,KAAK,MAAM,gCAAgC;AACzD,QAAI,MAAO,SAAQ,IAAI,MAAM,CAAC,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAAA,EAC5D;AAEA,MAAI,QAAQ,IAAI,MAAM,MAAM,sBAAuB,QAAO;AAC1D,QAAM,SAAS,QAAQ,IAAI,QAAQ;AACnC,QAAM,OAAO,QAAQ,IAAI,MAAM;AAC/B,MAAI,CAAC,UAAU,CAAC,KAAM,QAAO;AAE7B,QAAM,OAAkC;AAAA,IACtC,MAAM;AAAA,IACN,GAAI,QAAQ,IAAI,eAAe,IAC3B,EAAE,eAAe,oBAAoB,QAAQ,IAAI,eAAe,CAAC,EAAE,IACnE,CAAC;AAAA,IACL;AAAA,IACA;AAAA;AAAA;AAAA;AAAA,IAIA,UAAU,QAAQ,IAAI,UAAU,KAAK;AAAA,IACrC,mBAAmB,oBAAoB,QAAQ,IAAI,mBAAmB,CAAC;AAAA,IACvE,cAAc,oBAAoB,QAAQ,IAAI,cAAc,CAAC;AAAA,IAC7D;AAAA,IACA,iBAAiB,oBAAoB,QAAQ,IAAI,iBAAiB,CAAC;AAAA,IACnE,aAAa,QAAQ,IAAI,aAAa,KAAK;AAAA,IAC3C,UAAU,QAAQ,IAAI,UAAU,KAAK;AAAA,EACvC;AACA,SAAO,EAAE,MAAM,KAAK;AACtB;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,KAAK,QAAQ,UAAU,GAAG;AAC3E,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,OAAO,WAAW,SAAU,QAAO;AAAA,IACzC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAmC;AAC9D,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO;AACnD,SAAO,KAAK,MAAM,MAAM;AAC1B;","names":[]}

package/dist/{chunk-6BISDEN6.js → chunk-BEM4D2QG.js}

@@ -10,21 +10,10 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-IC6QX5TC.js";
+} from "./chunk-3XIY7MDQ.js";
 import {
   StorageManager
-} from "./chunk-M7GGMGMZ.js";
-import {
-  MEMORY_LIFECYCLE_EVENT_SORT_ORDER,
-  buildLifecycleEventsForMemory,
-  inferMemoryStatus,
-  sortMemoryLifecycleEvents,
-  toMemoryPathRel
-} from "./chunk-RULE4VG5.js";
-import {
-  normalizeProjectionPreview,
-  normalizeProjectionTags
-} from "./chunk-SCU65EZI.js";
+} from "./chunk-SVOHGUMI.js";
 import {
   MEMORY_PROJECTION_SCHEMA_VERSION,
   getMemoryProjectionPath,
@@ -40,6 +29,17 @@ import {
 import {
   openBetterSqlite3
 } from "./chunk-RL6NEVXT.js";
+import {
+  MEMORY_LIFECYCLE_EVENT_SORT_ORDER,
+  buildLifecycleEventsForMemory,
+  inferMemoryStatus,
+  sortMemoryLifecycleEvents,
+  toMemoryPathRel
+} from "./chunk-RULE4VG5.js";
+import {
+  normalizeProjectionPreview,
+  normalizeProjectionTags
+} from "./chunk-SCU65EZI.js";
 import {
   log
 } from "./chunk-37CTGERM.js";
@@ -1023,4 +1023,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-6BISDEN6.js.map
+//# sourceMappingURL=chunk-BEM4D2QG.js.map

package/dist/{chunk-ZPOROUTX.js → chunk-CYWA2CXR.js}

@@ -4,17 +4,17 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-SVOHGUMI.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-VSF7AAGE.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
 import {
   normalizeEntityText,
   resolveRequestedEntitySectionKeys
 } from "./chunk-4DJQYKMN.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 
 // src/entity-retrieval.ts
 import { createHash } from "crypto";
@@ -682,4 +682,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-ZPOROUTX.js.map
+//# sourceMappingURL=chunk-CYWA2CXR.js.map