@remnic/core 9.6.1 → 9.6.3

package/dist/{chunk-4LV23CHK.js → chunk-VHJARF5R.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-PNLFN2PZ.js";
+} from "./chunk-23G3T2Q5.js";
 import {
   getConfiguredNamespaces
 } from "./chunk-BAVVI5GP.js";
@@ -2042,4 +2042,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-4LV23CHK.js.map
+//# sourceMappingURL=chunk-VHJARF5R.js.map

package/dist/{chunk-6MMONPHM.js → chunk-W2AHSCKY.js}

@@ -1,6 +1,6 @@
 import {
   isRecallDisclosure
-} from "./chunk-JS2HKKOK.js";
+} from "./chunk-3AC5UYKI.js";
 import {
   normalizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -292,4 +292,4 @@ export {
   RecallXrayBuilder,
   summarizeDisclosureTokens
 };
-//# sourceMappingURL=chunk-6MMONPHM.js.map
+//# sourceMappingURL=chunk-W2AHSCKY.js.map

package/dist/{chunk-4GNEDXDI.js → chunk-WULTHJRU.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-D7FOKIY5.js";
 import {
   EngramAccessInputError
-} from "./chunk-H2DXDQCQ.js";
+} from "./chunk-BT3PTVYZ.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -274,4 +274,4 @@ export {
   listRegisteredOperations,
   __resetRegistryForTest
 };
-//# sourceMappingURL=chunk-4GNEDXDI.js.map
+//# sourceMappingURL=chunk-WULTHJRU.js.map

package/dist/chunk-WULTHJRU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-boundary.ts"],"sourcesContent":["/**\n * Single input-validation and error boundary for the CLI/MCP/HTTP access\n * surfaces (issue #1525, epic #1520 Phase 1).\n *\n * Every operation that crosses the access-service facade passes through ONE\n * registry entry: a zod-validated request envelope, a shared error mapper,\n * and the \"reject invalid input and list valid options\" behavior that\n * CLAUDE.md rules 14/17/24/28/36/48/51 previously had to be re-implemented\n * per handler. The three surfaces become thin adapters — one operation\n * definition, three transports — so a validation fix lands everywhere at\n * once.\n *\n * Host-agnostic (rule 31): operation names carry no `openclaw-*`/`engram-*`\n * prefix. Session/namespace tenancy stays in the handler layer (resolved via\n * ScopePlan #1521); the boundary validates SHAPE, not tenancy.\n */\n\nimport { z } from \"zod\";\nimport { EngramAccessInputError, type EngramAccessService } from \"./access-service.js\";\nimport { assertFleetWideOperationAllowed, assertOperationAllowed, tokenCapabilityStore } from \"./access-token-capabilities.js\";\nimport { expandTildePath } from \"./utils/path.js\";\n\n// ---------------------------------------------------------------------------\n// Canonical operation names — host-agnostic (rule 31)\n// ---------------------------------------------------------------------------\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Add to this union as\n * each domain-group migration PR (memory ops → connectors → namespaces …)\n * lands; the fitness test in `access-surface-catalog.test.ts` treats the\n * registered set as the migration state.\n */\nexport const OPERATION_NAMES = [\n  \"memory_get\",\n  \"memory_search\",\n  \"memory_store\",\n  \"coding_decision\",\n  \"coding_architecture\",\n  // codegraph parity tools (issue #1554) -- each maps to one codegraph_*\n  // boundary operation that delegates to the surface handler in\n  // coding/codegraph-surfaces.ts. Names match the external tool suffixes.\n  \"codegraph_index\",\n  \"codegraph_list_projects\",\n  \"codegraph_delete_project\",\n  \"codegraph_index_status\",\n  \"codegraph_search_graph\",\n  \"codegraph_trace_path\",\n  \"codegraph_detect_changes\",\n  \"codegraph_query_graph\",\n  \"codegraph_get_schema\",\n  \"codegraph_get_snippet\",\n  \"codegraph_get_architecture\",\n  \"codegraph_search_code\",\n  \"codegraph_manage_adr\",\n  \"codegraph_ingest_traces\",\n  \"memory_correct_plan\",\n  \"memory_correct_apply\",\n  \"coding_delta\",\n  // Remaining MCP/HTTP handlers migrated through the boundary (issue #1525).\n  \"recall\",\n  \"recall_explain\",\n  \"set_coding_context\",\n  \"recall_tier_explain\",\n  \"recall_xray\",\n  \"wearables_status\",\n  \"wearables_sync\",\n  \"transcript_day\",\n  \"transcript_search\",\n  \"transcript_memories\",\n  \"action_confidence\",\n  \"chatgpt_memory_inspector\",\n  \"day_summary\",\n  \"capsule_export\",\n  \"capsule_import\",\n  \"capsule_list\",\n  \"memory_governance_run\",\n  \"procedure_mining_run\",\n  \"pattern_reinforcement_run\",\n  \"procedural_stats\",\n  \"memory_timeline\",\n  \"suggestion_submit\",\n  \"entity_get\",\n  \"review_queue_list\",\n  \"correction_pending\",\n  \"observe\",\n  \"lcm_search\",\n  \"lcm_compaction_flush\",\n  \"lcm_compaction_record\",\n  \"continuity_audit_generate\",\n  \"continuity_incident_open\",\n  \"continuity_incident_close\",\n  \"continuity_incident_list\",\n  \"continuity_loop_add_or_update\",\n  \"continuity_loop_review\",\n  \"identity_anchor_get\",\n  \"identity_anchor_update\",\n  \"memory_identity\",\n  \"work_task\",\n  \"work_project\",\n  \"work_board\",\n  \"shared_context_write_output\",\n  \"shared_feedback_record\",\n  \"shared_priorities_append\",\n  \"shared_context_cross_signals_run\",\n  \"shared_context_curate_daily\",\n  \"compounding_weekly_synthesize\",\n  \"compounding_promote_candidate\",\n  \"compression_guidelines_optimize\",\n  \"compression_guidelines_activate\",\n  \"memory_profile\",\n  \"memory_entities_list\",\n  \"memory_questions\",\n  \"memory_last_recall\",\n  \"memory_intent_debug\",\n  \"memory_qmd_debug\",\n  \"memory_graph_explain\",\n  \"graph_snapshot\",\n  \"memory_feedback\",\n  \"memory_promote\",\n  \"memory_outcome\",\n  \"memory_action_apply\",\n  \"context_checkpoint\",\n  \"briefing\",\n  \"review_list\",\n  \"review_resolve\",\n  \"contradiction_scan_run\",\n  \"memory_summarize_hourly\",\n  \"conversation_index_update\",\n  \"profiling_report\",\n  \"graph_edge_decay_run\",\n  \"live_connectors_run\",\n  \"peer_list\",\n  \"peer_get\",\n  \"peer_set\",\n  \"peer_delete\",\n  \"peer_profile_get\",\n  \"peer_forget\",\n  \"console_state\",\n  \"dreams_status\",\n  \"dreams_run\",\n  // HTTP-only routes (no direct MCP tool equivalent).\n  \"adapters_status\",\n  \"offline_sync_snapshot\",\n  \"offline_sync_snapshot_stream\",\n  \"offline_sync_files\",\n  \"offline_sync_file_content\",\n  \"offline_sync_apply_file_content\",\n  \"offline_sync_apply\",\n  \"lcm_status\",\n  \"memory_list\",\n  \"recall_timings\",\n  \"entity_list\",\n  \"maintenance_status\",\n  \"quality_status\",\n  \"trust_zones_status\",\n  \"trust_zones_records\",\n  \"review_disposition\",\n  \"trust_zones_promote\",\n  \"trust_zones_demo_seed\",\n  \"citations_observed\",\n  \"contradiction_detail\",\n  \"graph_events\",\n  // Chat surface — conversational memory inspection/correction (issue #1583).\n  \"chat_message\",\n  \"chat_events\",\n] as const;\n\n/**\n * Canonical operation ids. One id is shared by the MCP tool, the HTTP route,\n * and the CLI command that expose the same operation. Derived from\n * {@link OPERATION_NAMES} (single source of truth) so the runtime catalog\n * used for token-capability validation cannot drift from the type. The\n * fitness test in `access-surface-catalog.test.ts` treats the registered set\n * as the migration state.\n */\nexport type OperationName = (typeof OPERATION_NAMES)[number];\n\n// ---------------------------------------------------------------------------\n// Operation context — what every handler receives\n// ---------------------------------------------------------------------------\n\n/**\n * Per-call context. `service` is the facade the handler delegates to; the\n * boundary never reaches past it. `authenticatedPrincipal` is resolved by\n * the SURFACE (MCP header / HTTP identity / CLI flag) before the boundary\n * runs, so handlers stay principal-source-agnostic. `hooks` carries\n * transport-level callbacks (e.g. HTTP write-quota enforcement) that must\n * fire atomically inside the service call; surfaces that have no such hook\n * leave it undefined.\n */\nexport interface OperationContext {\n  readonly service: EngramAccessService;\n  readonly authenticatedPrincipal?: string;\n  readonly operatorPrincipal?: string;\n  /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */\n  readonly sourceConnector?: string;\n  readonly hooks?: OperationHooks;\n}\n\n/**\n * Transport-level callbacks a handler forwards into the service call. Kept\n * narrow on purpose: the boundary owns validation + dispatch shape, not\n * transport policy. Add fields here only when a surface genuinely needs a\n * callback the service itself consumes.\n */\nexport interface OperationHooks {\n  /** HTTP write-quota gate; throws to reject the write when exhausted. */\n  readonly enforceWriteQuota?: () => void | Promise<void>;\n}\n\n// ---------------------------------------------------------------------------\n// Operation spec + bound operation\n// ---------------------------------------------------------------------------\n\nexport interface OperationSpec<In, Out> {\n  /** Canonical operation id; matches an {@link OperationName}. */\n  readonly name: OperationName;\n  readonly description: string;\n  /** Zod schema validating the raw request envelope. */\n  readonly schema: z.ZodType<In>;\n  /** Handler invoked with the parsed input; throws EngramAccessInputError for domain faults. */\n  readonly handler: (input: In, ctx: OperationContext) => Promise<Out>;\n  /**\n   * Marks an operation as inherently FLEET-WIDE / global — it runs across ALL\n   * namespaces (or against a single non-namespaced global layer) and carries no\n   * `namespace` argument, so the MCP `tools/call` effective-namespace chokepoint\n   * never applies. When set, {@link defineOperation}'s run wrapper rejects any\n   * namespace-SCOPED token (fail closed) via assertFleetWideOperationAllowed\n   * BEFORE the handler — no side effect on denial. Unrestricted/legacy tokens\n   * (cron, internal callers, no capability record) are unaffected (issue #1850).\n   */\n  readonly fleetWide?: boolean;\n}\n\nexport interface BoundOperation<In = unknown, Out = unknown> {\n  readonly spec: OperationSpec<In, Out>;\n  /** Validate the raw envelope, then invoke the handler. Throws EngramAccessInputError on any validation failure. */\n  readonly run: (rawInput: unknown, ctx: OperationContext) => Promise<Out>;\n}\n\n// ---------------------------------------------------------------------------\n// Shared normalizers the boundary owns (rules 17, 28, 36, 48, 51)\n// ---------------------------------------------------------------------------\n\n/**\n * Coerce boolean-like strings at the edge (rule 36). Accepts actual booleans\n * and the string spellings clients send (\"true\"/\"false\"/\"1\"/\"0\"/\"yes\"/\"no\"/\n * \"on\"/\"off\", case-insensitive). Rejects anything else loudly — `Boolean(\"false\")`\n * would silently be `true`, which is the bug rule 36 exists to prevent.\n *\n * `undefined`/`null`/`\"\"` → `undefined`, so callers can keep treating an\n * absent flag as \"use the default\" without a separate presence check.\n */\nexport function coerceBooleanLike(value: unknown): boolean | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\") {\n    const lower = value.trim().toLowerCase();\n    if (lower === \"true\" || lower === \"1\" || lower === \"yes\" || lower === \"on\") return true;\n    if (lower === \"false\" || lower === \"0\" || lower === \"no\" || lower === \"off\") return false;\n  }\n  throw new EngramAccessInputError(\n    `expected a boolean-like value (true|false|1|0|yes|no|on|off); got ${JSON.stringify(value)}`,\n  );\n}\n\n/**\n * Coerce + validate a positive integer from a numeric string or number\n * (rule 28). Loosely-typed MCP/CLI clients send `\"5\"`; `typeof saved === \"number\"`\n * on read-back would reject it later, so we coerce at the edge and reject\n * booleans/objects loudly (`Number(true) === 1` would silently pass otherwise).\n *\n * `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function coercePositiveInteger(value: unknown, label: string): number | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value) || value <= 0 || !Number.isInteger(value)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return value;\n  }\n  if (typeof value === \"string\") {\n    const trimmed = value.trim();\n    if (!/^[+-]?\\d+$/.test(trimmed)) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    const parsed = Number(trimmed);\n    if (!Number.isSafeInteger(parsed) || parsed <= 0) {\n      throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n    }\n    return parsed;\n  }\n  throw new EngramAccessInputError(`${label} expects a positive integer; got ${JSON.stringify(value)}`);\n}\n\n/**\n * Expand `~` in a path-shaped input (rule 17). Node `fs` does NOT expand `~`;\n * ad-hoc regex drifts. `undefined`/`null`/`\"\"` → `undefined`.\n */\nexport function normalizeOptionalPath(value: unknown): string | undefined {\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new EngramAccessInputError(`expected a path string; got ${JSON.stringify(value)}`);\n  }\n  return expandTildePath(value);\n}\n\n// ---------------------------------------------------------------------------\n// Error formatting — rule 51: list valid options, never silently default\n// ---------------------------------------------------------------------------\n\n/**\n * Turn a zod failure into an {@link EngramAccessInputError} whose message\n * names the offending field and — for enum/union issues — lists the valid\n * options, so the caller can correct rather than guess (rule 51).\n */\nexport function formatZodIssues(error: z.ZodError): string {\n  const parts: string[] = [];\n  for (const issue of error.issues) {\n    // Collapse array-index paths (e.g. [\"currentContextScopes\", 1]) to\n    // the field name so the message reads \"field: must be ...\" not\n    // \"field.1: must be ...\".\n    const hasNumeric = issue.path.some((p) => typeof p === \"number\");\n    const path = hasNumeric\n      ? issue.path.filter((p) => typeof p === \"string\").join(\".\") || \"(root)\"\n      : issue.path.length > 0 ? issue.path.join(\".\") : \"(root)\";\n    const options = enumOptionsFromIssue(issue);\n    const suffix = options ? `. Valid: ${options.join(\", \")}` : \"\";\n    parts.push(`${path}: ${issue.message}${suffix}`);\n  }\n  return parts.length > 0\n    ? `request validation failed: ${parts.join(\"; \")}`\n    : \"request validation failed\";\n}\n\nfunction enumOptionsFromIssue(issue: z.ZodIssue): readonly string[] | undefined {\n  // zod exposes accepted enum values on the issue for ZodEnum / ZodNativeEnum\n  // and on the options of invalid_union discriminators. Reading them here\n  // keeps \"list valid options\" in ONE place rather than per handler.\n  if (issue.code === z.ZodIssueCode.invalid_enum_value) {\n    const rawOptions = (issue as { options?: unknown }).options;\n    if (Array.isArray(rawOptions)) {\n      return rawOptions.map((opt) => String(opt));\n    }\n  }\n  return undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Registry\n// ---------------------------------------------------------------------------\n\nconst registry = new Map<OperationName, BoundOperation>();\n\n/**\n * Register an operation. Throws if the name is already registered — duplicate\n * registration is a programming error, not a runtime input fault, so it throws\n * a plain Error (not the input-error class surfaces translate for clients).\n */\n/**\n * Error map that converts Zod's generic type-mismatch messages into\n * human-readable \"must be a <type>\" messages (rule 51).  Applied at the\n * boundary chokepoint so every operation gets consistent messaging\n * without per-handler boilerplate.\n */\nconst humanReadableErrorMap: z.ZodErrorMap = (issue, ctx) => {\n  if (issue.code === z.ZodIssueCode.invalid_type) {\n    if (issue.received === \"undefined\") return { message: ctx.defaultError };\n    // Array-element type errors — collapse to field-level message.\n    if (issue.path.some((p) => typeof p === \"number\")) {\n      const arrField = issue.path.filter((p) => typeof p === \"string\").join(\".\");\n      return { message: `${arrField} must be an array of ${issue.expected}s` };\n    }\n    const fieldName = issue.path.length > 0 ? String(issue.path[issue.path.length - 1]) : \"value\";\n    switch (issue.expected) {\n      case \"string\": return { message: `${fieldName} must be a string` };\n      case \"boolean\": return { message: `${fieldName} must be a boolean` };\n      case \"number\": return { message: `${fieldName} must be a number` };\n      case \"array\": return { message: `${fieldName} must be an array` };\n      case \"object\": return { message: `${fieldName} must be an object` };\n      default: return { message: ctx.defaultError };\n    }\n  }\n  return { message: ctx.defaultError };\n};\n\nexport function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOperation<In, Out> {\n  if (registry.has(spec.name)) {\n    throw new Error(`access-boundary: operation already registered: ${spec.name}`);\n  }\n  const bound: BoundOperation<In, Out> = {\n    spec,\n    run: async (rawInput, ctx) => {\n      const parseResult = spec.schema.safeParse(rawInput, { errorMap: humanReadableErrorMap });\n      if (!parseResult.success) {\n        throw new EngramAccessInputError(formatZodIssues(parseResult.error));\n      }\n      // Per-token capability enforcement (issue #1837): when the presenting\n      // token carries an ops allow-list, reject operations not in it. The\n      // capability record is carried via AsyncLocalStorage, set once per\n      // authorized HTTP/MCP request; absent (CLI/tests/direct callers) ⇒\n      // unrestricted. Default-deny ONLY when an ops axis is present — legacy\n      // tokens (absent record) and explicit-unrestricted new tokens are\n      // unaffected.\n      assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);\n      // Fleet-wide / global maintenance ops (issue #1850 round 10): these run\n      // across all namespaces with no `namespace` arg, so the tools/call\n      // effective-namespace gate never fires. A namespace-SCOPED token must not\n      // trigger cross-namespace maintenance — fail closed BEFORE the handler so\n      // a denial never leaks a partial mutation. No-op for unrestricted/legacy.\n      if (spec.fleetWide) {\n        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());\n      }\n      return spec.handler(parseResult.data, ctx);\n    },\n  };\n  // Store under the canonical name; the cast is safe because In/Out are\n  // erased at the registry boundary and recovered by callers via getOperation.\n  registry.set(spec.name, bound as unknown as BoundOperation);\n  return bound;\n}\n\n/** Look up a registered operation by canonical name. */\nexport function getOperation(name: OperationName): BoundOperation | undefined {\n  return registry.get(name);\n}\n\n/** All registered operation names. */\nexport function listRegisteredOperations(): readonly OperationName[] {\n  return [...registry.keys()];\n}\n\n/** Test-only: clear the registry so pilot definitions can be re-registered. */\nexport function __resetRegistryForTest(): void {\n  registry.clear();\n}\n"],"mappings":";;;;;;;;;;;;;AAiBA,SAAS,SAAS;AAgBX,IAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;AAwFO,SAAS,kBAAkB,OAAqC;AACrE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,QAAQ,MAAM,KAAK,EAAE,YAAY;AACvC,QAAI,UAAU,UAAU,UAAU,OAAO,UAAU,SAAS,UAAU,KAAM,QAAO;AACnF,QAAI,UAAU,WAAW,UAAU,OAAO,UAAU,QAAQ,UAAU,MAAO,QAAO;AAAA,EACtF;AACA,QAAM,IAAI;AAAA,IACR,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,EAC5F;AACF;AAUO,SAAS,sBAAsB,OAAgB,OAAmC;AACvF,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,KAAK,CAAC,OAAO,UAAU,KAAK,GAAG;AACrE,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,aAAa,KAAK,OAAO,GAAG;AAC/B,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,UAAM,SAAS,OAAO,OAAO;AAC7B,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,UAAU,GAAG;AAChD,YAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IACtG;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI,uBAAuB,GAAG,KAAK,oCAAoC,KAAK,UAAU,KAAK,CAAC,EAAE;AACtG;AAMO,SAAS,sBAAsB,OAAoC;AACxE,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI,uBAAuB,+BAA+B,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EACzF;AACA,SAAO,gBAAgB,KAAK;AAC9B;AAWO,SAAS,gBAAgB,OAA2B;AACzD,QAAM,QAAkB,CAAC;AACzB,aAAW,SAAS,MAAM,QAAQ;AAIhC,UAAM,aAAa,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ;AAC/D,UAAM,OAAO,aACT,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG,KAAK,WAC7D,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,GAAG,IAAI;AACnD,UAAM,UAAU,qBAAqB,KAAK;AAC1C,UAAM,SAAS,UAAU,YAAY,QAAQ,KAAK,IAAI,CAAC,KAAK;AAC5D,UAAM,KAAK,GAAG,IAAI,KAAK,MAAM,OAAO,GAAG,MAAM,EAAE;AAAA,EACjD;AACA,SAAO,MAAM,SAAS,IAClB,8BAA8B,MAAM,KAAK,IAAI,CAAC,KAC9C;AACN;AAEA,SAAS,qBAAqB,OAAkD;AAI9E,MAAI,MAAM,SAAS,EAAE,aAAa,oBAAoB;AACpD,UAAM,aAAc,MAAgC;AACpD,QAAI,MAAM,QAAQ,UAAU,GAAG;AAC7B,aAAO,WAAW,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;AAAA,IAC5C;AAAA,EACF;AACA,SAAO;AACT;AAMA,IAAM,WAAW,oBAAI,IAAmC;AAaxD,IAAM,wBAAuC,CAAC,OAAO,QAAQ;AAC3D,MAAI,MAAM,SAAS,EAAE,aAAa,cAAc;AAC9C,QAAI,MAAM,aAAa,YAAa,QAAO,EAAE,SAAS,IAAI,aAAa;AAEvE,QAAI,MAAM,KAAK,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAG;AACjD,YAAM,WAAW,MAAM,KAAK,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AACzE,aAAO,EAAE,SAAS,GAAG,QAAQ,wBAAwB,MAAM,QAAQ,IAAI;AAAA,IACzE;AACA,UAAM,YAAY,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,MAAM,KAAK,SAAS,CAAC,CAAC,IAAI;AACtF,YAAQ,MAAM,UAAU;AAAA,MACtB,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAW,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MACnE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MACjE,KAAK;AAAS,eAAO,EAAE,SAAS,GAAG,SAAS,oBAAoB;AAAA,MAChE,KAAK;AAAU,eAAO,EAAE,SAAS,GAAG,SAAS,qBAAqB;AAAA,MAClE;AAAS,eAAO,EAAE,SAAS,IAAI,aAAa;AAAA,IAC9C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,IAAI,aAAa;AACrC;AAEO,SAAS,gBAAyB,MAAuD;AAC9F,MAAI,SAAS,IAAI,KAAK,IAAI,GAAG;AAC3B,UAAM,IAAI,MAAM,kDAAkD,KAAK,IAAI,EAAE;AAAA,EAC/E;AACA,QAAM,QAAiC;AAAA,IACrC;AAAA,IACA,KAAK,OAAO,UAAU,QAAQ;AAC5B,YAAM,cAAc,KAAK,OAAO,UAAU,UAAU,EAAE,UAAU,sBAAsB,CAAC;AACvF,UAAI,CAAC,YAAY,SAAS;AACxB,cAAM,IAAI,uBAAuB,gBAAgB,YAAY,KAAK,CAAC;AAAA,MACrE;AAQA,6BAAuB,qBAAqB,SAAS,GAAG,KAAK,IAAI;AAMjE,UAAI,KAAK,WAAW;AAClB,wCAAgC,qBAAqB,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,KAAK,QAAQ,YAAY,MAAM,GAAG;AAAA,IAC3C;AAAA,EACF;AAGA,WAAS,IAAI,KAAK,MAAM,KAAkC;AAC1D,SAAO;AACT;AAGO,SAAS,aAAa,MAAiD;AAC5E,SAAO,SAAS,IAAI,IAAI;AAC1B;AAGO,SAAS,2BAAqD;AACnE,SAAO,CAAC,GAAG,SAAS,KAAK,CAAC;AAC5B;AAGO,SAAS,yBAA+B;AAC7C,WAAS,MAAM;AACjB;","names":[]}

package/dist/{chunk-K5LLP4CY.js → chunk-ZGPDSEKG.js}

@@ -281,8 +281,9 @@ function validateExplicitCaptureInput(input, mode = "strict_explicit") {
     namespace: asTrimmed(input.namespace),
     tags: Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean))),
     entityRef: asTrimmed(input.entityRef),
-    expiresAt,
-    sourceReason: asTrimmed(input.sourceReason)
+    sourceReason: asTrimmed(input.sourceReason),
+    sourceConnector: input.sourceConnector,
+    expiresAt
   };
 }
 async function findDuplicateExplicitCapture(orchestrator, resolvedNamespace, candidate) {
@@ -306,7 +307,11 @@ async function findDuplicateExplicitCapture(orchestrator, resolvedNamespace, can
     const status = memory.frontmatter.status ?? "active";
     if (status !== "active") return false;
     if (memory.frontmatter.category !== candidate.category) return false;
-    return normalizeCaptureContent(memory.content) === normalizedCandidate;
+    if (normalizeCaptureContent(memory.content) !== normalizedCandidate) return false;
+    const existingConnector = memory.frontmatter.sourceConnector?.trim() || void 0;
+    const newConnector = candidate.sourceConnector?.trim() || void 0;
+    if (existingConnector !== newConnector) return false;
+    return true;
   });
   return match?.frontmatter.id ?? null;
 }
@@ -322,7 +327,8 @@ async function persistExplicitCapture(orchestrator, candidate, source) {
     tags: candidate.tags,
     entityRef: candidate.entityRef,
     expiresAt: candidate.expiresAt,
-    source: source === "inline" ? "explicit-inline" : "explicit"
+    source: source === "inline" ? "explicit-inline" : "explicit",
+    ...candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}
   });
   const created = (/* @__PURE__ */ new Date()).toISOString();
   const event = {
@@ -367,7 +373,7 @@ function buildExplicitCaptureReviewContent(input, reason) {
   }
   return lines.join("\n");
 }
-async function findQueuedExplicitCaptureDuplicate(orchestrator, namespace, content) {
+async function findQueuedExplicitCaptureDuplicate(orchestrator, namespace, content, sourceConnector) {
   const storage = await orchestrator.getStorage(namespace);
   const existing = await storage.readAllMemories();
   const normalized = normalizeCaptureContent(content);
@@ -375,7 +381,11 @@ async function findQueuedExplicitCaptureDuplicate(orchestrator, namespace, conte
     const status = memory.frontmatter.status ?? "active";
     if (status !== "pending_review") return false;
     if (!(memory.frontmatter.tags ?? []).includes("queued-review")) return false;
-    return normalizeCaptureContent(memory.content) === normalized;
+    if (normalizeCaptureContent(memory.content) !== normalized) return false;
+    const existingConnector = memory.frontmatter.sourceConnector?.trim() || void 0;
+    const newConnector = sourceConnector?.trim() || void 0;
+    if (existingConnector !== newConnector) return false;
+    return true;
   });
   return match?.frontmatter.id ?? null;
 }
@@ -384,7 +394,7 @@ async function queueExplicitCaptureForReview(orchestrator, input, source, error)
   const requestedNamespace = asTrimmed(input.namespace);
   const queueNamespace = input.namespacePreResolved ? requestedNamespace : resolveExplicitCaptureReviewNamespace(orchestrator, requestedNamespace);
   const content = buildExplicitCaptureReviewContent(input, reason);
-  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content);
+  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content, input.sourceConnector);
   if (duplicateOf) {
     return { id: duplicateOf, duplicateOf };
   }
@@ -396,7 +406,8 @@ async function queueExplicitCaptureForReview(orchestrator, input, source, error)
     confidence: 0.2,
     tags: Array.from(/* @__PURE__ */ new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
     entityRef: sanitizeReviewMetadata(input.entityRef),
-    source: source === "inline" ? "explicit-inline-review" : "explicit-review"
+    source: source === "inline" ? "explicit-inline-review" : "explicit-review",
+    ...input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}
   });
   try {
     const created = await storage.getMemoryById(id);
@@ -441,4 +452,4 @@ export {
   shouldSkipImplicitExtraction,
   shouldProcessInlineExplicitCapture
 };
-//# sourceMappingURL=chunk-K5LLP4CY.js.map
+//# sourceMappingURL=chunk-ZGPDSEKG.js.map

package/dist/chunk-ZGPDSEKG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/explicit-capture.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"./capabilities.js\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Orchestrator } from \"./orchestrator.js\";\nimport { isSafeRouteNamespace } from \"./routing/engine.js\";\nimport { sanitizeMemoryContent } from \"./sanitize.js\";\nimport { ContentHashIndex } from \"./storage.js\";\nimport type { CaptureMode, MemoryCategory, MemoryLifecycleEvent, PluginConfig } from \"./types.js\";\n\nexport type ExplicitCaptureInput = {\n  content: string;\n  category?: string;\n  confidence?: number;\n  namespace?: string;\n  tags?: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  ttl?: string;\n  sourceReason?: string;\n};\n\nexport type ValidExplicitCapture = {\n  content: string;\n  category: MemoryCategory;\n  confidence: number;\n  namespace?: string;\n  tags: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  expiresAt?: string;\n  sourceReason?: string;\n  /**\n   * When true, `namespace` was already resolved AND authorized by the caller\n   * (the access service's `resolveCodingScopedWriteNamespace`, which auth-checks\n   * the base and derives a session-owned `project-*` overlay). The persist /\n   * queue layer then routes to it directly instead of re-validating against the\n   * static policy allow-list — which would otherwise reject legitimately-derived\n   * dynamic project namespaces (#1434). Callers that do NOT pre-authorize the\n   * namespace must leave this unset so the allow-list guard still applies.\n   */\n  namespacePreResolved?: boolean;\n};\n\nexport type ExplicitCaptureSource = \"memory_store\" | \"memory_capture\" | \"suggestion_submit\" | \"inline\";\ntype ExplicitCaptureValidationMode = \"legacy_tool\" | \"strict_explicit\";\n\n// Bounded body {0,100000} instead of an unbounded lazy *? so scanning for the\n// closing tag cannot backtrack polynomially on unterminated <memory_note>\n// markup in hostile turn text (CodeQL js/polynomial-redos). 100 000 chars far\n// exceeds any real inline note, so matching is behavior-preserving; the outer\n// \\s* groups were also dropped (body absorbs whitespace; captures are trimmed).\nconst INLINE_NOTE_RE = /<memory_note>([\\s\\S]{0,100000}?)<\\/memory_note>/gi;\nconst INLINE_NOTE_MARKUP_RE = /<memory_note>[\\s\\S]{0,100000}?<\\/memory_note>/i;\nconst INLINE_ALLOWED_CATEGORIES = new Set<MemoryCategory>([\n  \"fact\",\n  \"preference\",\n  \"correction\",\n  \"entity\",\n  \"decision\",\n  \"relationship\",\n  \"principle\",\n  \"commitment\",\n  \"moment\",\n  \"skill\",\n  \"rule\",\n  \"procedure\",\n  \"reasoning_trace\",\n]);\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /\\bsk-[A-Za-z0-9]{16,}\\b/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n  /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/i,\n  /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/i,\n  /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/i,\n];\nconst SECRET_REDACTION_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [\n  { pattern: /\\bsk-[A-Za-z0-9]{16,}\\b/g, replacement: \"[redacted openai key]\" },\n  { pattern: /\\bAKIA[0-9A-Z]{16}\\b/g, replacement: \"[redacted aws key]\" },\n  { pattern: /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/gi, replacement: \"Bearer [redacted token]\" },\n  {\n    pattern: /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"[redacted credential]\",\n  },\n  {\n    pattern: /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"authorization: [redacted credential]\",\n  },\n];\nconst EXPLICIT_CAPTURE_REVIEW_TAGS = [\"explicit-capture\", \"queued-review\"];\n\nfunction explicitCaptureActor(source: ExplicitCaptureSource): string {\n  switch (source) {\n    case \"inline\":\n      return \"inline.memory_note\";\n    case \"memory_store\":\n      return \"tool.memory_store\";\n    case \"suggestion_submit\":\n      return \"tool.suggestion_submit\";\n    default:\n      return \"tool.memory_capture\";\n  }\n}\n\nfunction asTrimmed(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed && trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction normalizeCaptureContent(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction redactSecrets(value: string): string {\n  let redacted = value;\n  for (const { pattern, replacement } of SECRET_REDACTION_PATTERNS) {\n    redacted = redacted.replace(pattern, replacement);\n  }\n  return redacted;\n}\n\nfunction containsSecretLikeValue(value: string): boolean {\n  return SECRET_PATTERNS.some((pattern) => pattern.test(value));\n}\n\nfunction assertNoSecretLikeMetadata(field: string, value: string | undefined): void {\n  const trimmed = asTrimmed(value);\n  if (trimmed && containsSecretLikeValue(trimmed)) {\n    throw new Error(`${field} appears to contain a secret or credential`);\n  }\n}\n\nfunction assertNoSecretLikeMetadataList(field: string, values: string[] | undefined): void {\n  for (const value of values ?? []) {\n    assertNoSecretLikeMetadata(field, value);\n  }\n}\n\nfunction sanitizeReviewText(value: string | undefined, fallback: string): string {\n  const redacted = redactSecrets(asTrimmed(value) ?? fallback);\n  const sanitized = sanitizeMemoryContent(redacted);\n  const safe = sanitized.text.trim();\n  return safe.length > 0 ? safe : fallback;\n}\n\nfunction sanitizeReviewMetadata(value: string | undefined): string | undefined {\n  const trimmed = asTrimmed(value);\n  if (!trimmed) return undefined;\n  return sanitizeReviewText(trimmed, \"[redacted]\");\n}\n\nfunction sanitizeReviewTags(tags: string[] | undefined): string[] {\n  return Array.from(new Set((tags ?? [])\n    .map((tag) => sanitizeReviewMetadata(tag))\n    .filter((tag): tag is string => typeof tag === \"string\" && tag.length > 0)));\n}\n\nfunction normalizeExplicitCaptureError(error: unknown): string {\n  if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();\n  const rendered = String(error).trim();\n  return rendered.length > 0 ? rendered : \"explicit capture failed\";\n}\n\nfunction resolveExplicitCaptureReviewNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  return resolveExplicitCaptureNamespace(orchestrator, normalized);\n}\n\nfunction resolveExplicitCaptureNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {\n    if (normalized !== orchestrator.config.defaultNamespace) {\n      throw new Error(`unsupported namespace: ${normalized}`);\n    }\n    return normalized;\n  }\n  const allowed = new Set([\n    orchestrator.config.defaultNamespace,\n    orchestrator.config.sharedNamespace,\n    ...orchestrator.config.namespacePolicies.map((policy) => policy.name),\n  ].map((value) => value.trim()).filter(Boolean));\n  if (!allowed.has(normalized)) {\n    throw new Error(`unsupported namespace: ${normalized}`);\n  }\n  return normalized;\n}\n\nfunction parseExplicitCaptureTtl(ttl: string | undefined): string | undefined {\n  const raw = asTrimmed(ttl);\n  if (!raw) return undefined;\n\n  const absoluteMs = Date.parse(raw);\n  if (Number.isFinite(absoluteMs)) {\n    return new Date(absoluteMs).toISOString();\n  }\n\n  const relative = raw.match(/^(\\d+)\\s*([mhdw])$/i);\n  if (!relative) {\n    throw new Error(\"ttl must be an ISO-8601 timestamp or relative duration like 30m, 12h, 7d, or 2w\");\n  }\n\n  const amount = Number.parseInt(relative[1] ?? \"\", 10);\n  const unit = (relative[2] ?? \"\").toLowerCase();\n  if (!Number.isFinite(amount) || amount <= 0) {\n    throw new Error(\"ttl duration must be a positive integer\");\n  }\n\n  const multiplier =\n    unit === \"m\" ? 60_000\n      : unit === \"h\" ? 60 * 60_000\n        : unit === \"d\" ? 24 * 60 * 60_000\n          : 7 * 24 * 60 * 60_000;\n  return new Date(Date.now() + amount * multiplier).toISOString();\n}\n\nfunction parseInlineConfidence(value: string): number {\n  const trimmed = value.trim();\n  if (!/^[+-]?(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    return Number.NaN;\n  }\n  const parsed = Number(trimmed);\n  return Number.isFinite(parsed) ? parsed : Number.NaN;\n}\n\nfunction parseInlineNote(block: string): ExplicitCaptureInput | null {\n  const lines = block.replace(/\\r/g, \"\").split(\"\\n\");\n  const note: Partial<ExplicitCaptureInput> = {};\n  let idx = 0;\n\n  while (idx < lines.length) {\n    const rawLine = lines[idx] ?? \"\";\n    const line = rawLine.trim();\n    idx += 1;\n    if (line.length === 0) continue;\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx < 0) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n\n    if (key === \"content\" && value === \"|\") {\n      const contentLines: string[] = [];\n      while (idx < lines.length) {\n        const next = lines[idx] ?? \"\";\n        if (next.startsWith(\"  \") || next.startsWith(\"\\t\")) {\n          contentLines.push(next.replace(/^(  |\\t)/, \"\"));\n          idx += 1;\n          continue;\n        }\n        if (next.trim().length === 0) {\n          contentLines.push(\"\");\n          idx += 1;\n          continue;\n        }\n        break;\n      }\n      note.content = contentLines.join(\"\\n\").trim();\n      continue;\n    }\n\n    switch (key) {\n      case \"content\":\n        note.content = value;\n        break;\n      case \"category\":\n        note.category = value;\n        break;\n      case \"confidence\":\n        note.confidence = parseInlineConfidence(value);\n        break;\n      case \"namespace\":\n        note.namespace = value;\n        break;\n      case \"tags\":\n        note.tags = value\n          .split(\",\")\n          .map((entry) => entry.trim())\n          .filter(Boolean);\n        break;\n      case \"entityRef\":\n        note.entityRef = value;\n        break;\n      case \"ttl\":\n        note.ttl = value;\n        break;\n      case \"sourceReason\":\n        note.sourceReason = value;\n        break;\n      default:\n        break;\n    }\n  }\n\n  return asTrimmed(note.content) ? (note as ExplicitCaptureInput) : null;\n}\n\nexport function parseInlineExplicitCaptureNotes(text: string): ExplicitCaptureInput[] {\n  const notes: ExplicitCaptureInput[] = [];\n  for (const match of text.matchAll(INLINE_NOTE_RE)) {\n    const parsed = parseInlineNote(match[1] ?? \"\");\n    if (parsed) notes.push(parsed);\n  }\n  return notes;\n}\n\nexport function hasInlineExplicitCaptureMarkup(text: string): boolean {\n  return INLINE_NOTE_MARKUP_RE.test(text);\n}\n\nexport function stripInlineExplicitCaptureNotes(text: string): string {\n  return text.replace(INLINE_NOTE_RE, \"\").trim();\n}\n\nexport function validateExplicitCaptureInput(\n  input: ExplicitCaptureInput,\n  mode: ExplicitCaptureValidationMode = \"strict_explicit\",\n): ValidExplicitCapture {\n  const content = asTrimmed(input.content);\n  if (!content) throw new Error(\"content is required\");\n  if (mode === \"strict_explicit\") {\n    if (content.length < 10) throw new Error(\"content must be at least 10 characters\");\n    if (content.length > 4000) throw new Error(\"content must be 4000 characters or fewer\");\n  }\n  if (/<memory_note>/i.test(content) || /<\\/memory_note>/i.test(content)) {\n    throw new Error(\"nested memory_note blocks are not allowed\");\n  }\n\n  const category = (asTrimmed(input.category) ?? \"fact\") as MemoryCategory;\n  if (!INLINE_ALLOWED_CATEGORIES.has(category)) {\n    throw new Error(`unsupported category: ${input.category ?? category}`);\n  }\n\n  const sanitized = sanitizeMemoryContent(content);\n  if (!sanitized.clean) {\n    throw new Error(\"content failed memory sanitization\");\n  }\n  for (const pattern of SECRET_PATTERNS) {\n    if (pattern.test(content)) {\n      throw new Error(\"content appears to contain a secret or credential\");\n    }\n  }\n  assertNoSecretLikeMetadata(\"sourceReason\", input.sourceReason);\n  assertNoSecretLikeMetadata(\"entityRef\", input.entityRef);\n  assertNoSecretLikeMetadata(\"ttl\", input.ttl);\n  assertNoSecretLikeMetadataList(\"tags\", input.tags);\n\n  if (input.confidence !== undefined && !Number.isFinite(input.confidence)) {\n    throw new Error(\"confidence must be a finite number\");\n  }\n  const confidence = input.confidence === undefined ? 0.95 : Number(input.confidence);\n  if (confidence < 0 || confidence > 1) {\n    throw new Error(\"confidence must be between 0 and 1\");\n  }\n  const requestedNamespace = asTrimmed(input.namespace);\n  if (requestedNamespace && !isSafeRouteNamespace(requestedNamespace)) {\n    throw new Error(`unsafe namespace: ${requestedNamespace}`);\n  }\n  const expiresAt = parseExplicitCaptureTtl(input.ttl);\n\n  return {\n    content,\n    category,\n    confidence,\n    namespace: asTrimmed(input.namespace),\n    tags: Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean))),\n    entityRef: asTrimmed(input.entityRef),\n    sourceReason: asTrimmed(input.sourceReason),\n    sourceConnector: input.sourceConnector,\n    expiresAt,\n  };\n}\n\nasync function findDuplicateExplicitCapture(\n  orchestrator: Orchestrator,\n  resolvedNamespace: string | undefined,\n  candidate: ValidExplicitCapture,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  if (\n    candidate.category === \"fact\"\n    && typeof (storage as { hasFactContentHash?: (content: string) => Promise<boolean> }).hasFactContentHash === \"function\"\n  ) {\n    try {\n      const hasHash = await (storage as { hasFactContentHash: (content: string) => Promise<boolean> }).hasFactContentHash(\n        candidate.content,\n      );\n      if (!hasHash) {\n        const authoritative =\n          typeof (storage as { isFactContentHashAuthoritative?: () => Promise<boolean> | boolean }).isFactContentHashAuthoritative\n            === \"function\"\n            ? await (storage as { isFactContentHashAuthoritative: () => Promise<boolean> | boolean })\n              .isFactContentHashAuthoritative()\n            : false;\n        if (authoritative) return null;\n      }\n    } catch (err) {\n      // Fail open: hash index is only an optimization, so fall back to the full corpus scan.\n      void err;\n    }\n  }\n  const existing = await storage.readAllMemories();\n  const normalizedCandidate = normalizeCaptureContent(candidate.content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"active\") return false;\n    if (memory.frontmatter.category !== candidate.category) return false;\n    if (normalizeCaptureContent(memory.content) !== normalizedCandidate) return false;\n    // Connector-aware dedup: same content from different connectors is NOT\n    // a duplicate. Operator (undefined) and connector-tagged memories are\n    // always distinct. Normalize empty strings to undefined.\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = candidate.sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function persistExplicitCapture(\n  orchestrator: Orchestrator,\n  candidate: ValidExplicitCapture,\n  source: ExplicitCaptureSource,\n): Promise<{ id: string; duplicateOf?: string; tombstoneBlocked?: boolean }> {\n  const resolvedNamespace = candidate.namespacePreResolved\n    ? asTrimmed(candidate.namespace)\n    : resolveExplicitCaptureNamespace(orchestrator, candidate.namespace);\n  const duplicateOf = await findDuplicateExplicitCapture(orchestrator, resolvedNamespace, candidate);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  // #1645 (review thread yG-): surface the tombstone block so callers\n  // (memory_store tool, access-service HTTP/MCP) can report the capture as\n  // queued for review instead of a successfully stored active memory.\n  const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, candidate.content, {\n    confidence: candidate.confidence,\n    tags: candidate.tags,\n    entityRef: candidate.entityRef,\n    expiresAt: candidate.expiresAt,\n    source: source === \"inline\" ? \"explicit-inline\" : \"explicit\",\n    ...(candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}),\n  });\n  // #1522: catalog touch handled at the storage chokepoint — the StorageManager's\n  // post-write hook records the namespace touch automatically.\n\n  const created = new Date().toISOString();\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_accepted\",\n    timestamp: created,\n    actor: explicitCaptureActor(source),\n    reasonCode: candidate.sourceReason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n\n  return { id, tombstoneBlocked };\n}\n\nfunction buildExplicitCaptureReviewContent(input: ExplicitCaptureInput, reason: string): string {\n  const requestedContent = asTrimmed(input.content);\n  const safeContent = sanitizeReviewText(requestedContent, \"[empty explicit capture]\");\n  const safeCategory = sanitizeReviewMetadata(input.category);\n  const safeNamespace = sanitizeReviewMetadata(input.namespace);\n  const safeEntityRef = sanitizeReviewMetadata(input.entityRef);\n  const safeTtl = sanitizeReviewMetadata(input.ttl);\n  const safeSourceReason = sanitizeReviewMetadata(input.sourceReason);\n  const safeTags = sanitizeReviewTags(input.tags);\n  const lines = [\n    \"Explicit capture queued for review.\",\n    \"\",\n    `Reason: ${reason}`,\n    \"\",\n    \"Submitted content:\",\n    safeContent,\n  ];\n  const metadata = [\n    safeCategory ? `Requested category: ${safeCategory}` : undefined,\n    safeNamespace ? `Requested namespace: ${safeNamespace}` : undefined,\n    safeEntityRef ? `Requested entityRef: ${safeEntityRef}` : undefined,\n    safeTtl ? `Requested ttl: ${safeTtl}` : undefined,\n    safeSourceReason ? `Requested sourceReason: ${safeSourceReason}` : undefined,\n    safeTags.length > 0 ? `Requested tags: ${safeTags.join(\", \")}` : undefined,\n  ].filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n  if (metadata.length > 0) {\n    lines.push(\"\", ...metadata);\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function findQueuedExplicitCaptureDuplicate(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n  content: string,\n  sourceConnector?: string,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(namespace);\n  const existing = await storage.readAllMemories();\n  const normalized = normalizeCaptureContent(content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"pending_review\") return false;\n    if (!(memory.frontmatter.tags ?? []).includes(\"queued-review\")) return false;\n    if (normalizeCaptureContent(memory.content) !== normalized) return false;\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function queueExplicitCaptureForReview(\n  orchestrator: Orchestrator,\n  input: ExplicitCaptureInput,\n  source: ExplicitCaptureSource,\n  error: unknown,\n): Promise<{ id: string; duplicateOf?: string }> {\n  const reason = sanitizeReviewText(normalizeExplicitCaptureError(error), \"explicit capture failed\");\n  const requestedNamespace = asTrimmed(input.namespace);\n  // A caller-pre-authorized namespace (e.g. a session-owned project overlay\n  // from the access service) routes directly; otherwise apply the static\n  // policy allow-list guard (#1434).\n  const queueNamespace = (input as { namespacePreResolved?: boolean }).namespacePreResolved\n    ? requestedNamespace\n    : resolveExplicitCaptureReviewNamespace(orchestrator, requestedNamespace);\n  const content = buildExplicitCaptureReviewContent(input, reason);\n  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content, input.sourceConnector);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const requestedCategory = asTrimmed(input.category);\n  const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory as MemoryCategory)\n    ? requestedCategory as MemoryCategory\n    : \"fact\";\n  const requestedTags = sanitizeReviewTags(input.tags);\n  const storage = await orchestrator.getStorage(queueNamespace);\n  const { id: id } = await storage.writeMemory(reviewCategory, content, {\n    confidence: 0.2,\n    tags: Array.from(new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),\n    entityRef: sanitizeReviewMetadata(input.entityRef),\n    source: source === \"inline\" ? \"explicit-inline-review\" : \"explicit-review\",\n    ...(input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}),\n  });\n  try {\n    const created = await storage.getMemoryById(id);\n    if (created) {\n      await storage.writeMemoryFrontmatter(created, {\n        status: \"pending_review\",\n        updated: new Date().toISOString(),\n      }, {\n        actor: explicitCaptureActor(source),\n        reasonCode: reason,\n        ruleVersion: \"explicit-capture.v1\",\n      });\n    }\n  } finally {\n    // Record the catalog write touch (issue #1499, round 5/6 codex P2; NIhUg).\n    // A queued review capture writes memory to the namespace's root (the DEFAULT\n    // root when undefined), so its `lastWriteAt` must reflect the write once\n    // `writeMemory` returns an id. If the later pending-review frontmatter update\n    // fails, the memory file is still durable and must not disappear from\n    // writtenSince/maintenance scheduling. Guarded optional hook (rule #33).\n    // #1522: catalog touch handled at the storage chokepoint.\n  }\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_queued\",\n    timestamp: new Date().toISOString(),\n    actor: explicitCaptureActor(source),\n    reasonCode: reason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n  return { id };\n}\n\nexport function shouldSkipImplicitExtraction(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode === \"explicit\";\n}\n\nexport function shouldProcessInlineExplicitCapture(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode !== \"implicit\";\n}\n"],"mappings":";;;;;;;;;;;AACA,SAAS,kBAAkB;AAiD3B,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,oBAAI,IAAoB;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,kBAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4BAA6E;AAAA,EACjF,EAAE,SAAS,4BAA4B,aAAa,wBAAwB;AAAA,EAC5E,EAAE,SAAS,yBAAyB,aAAa,qBAAqB;AAAA,EACtE,EAAE,SAAS,sCAAsC,aAAa,0BAA0B;AAAA,EACxF;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AACA,IAAM,+BAA+B,CAAC,oBAAoB,eAAe;AAEzE,SAAS,qBAAqB,QAAuC;AACnE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,WAAW,QAAQ,SAAS,IAAI,UAAU;AACnD;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MACJ,YAAY,EACZ,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,WAAW;AACf,aAAW,EAAE,SAAS,YAAY,KAAK,2BAA2B;AAChE,eAAW,SAAS,QAAQ,SAAS,WAAW;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAC9D;AAEA,SAAS,2BAA2B,OAAe,OAAiC;AAClF,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,WAAW,wBAAwB,OAAO,GAAG;AAC/C,UAAM,IAAI,MAAM,GAAG,KAAK,4CAA4C;AAAA,EACtE;AACF;AAEA,SAAS,+BAA+B,OAAe,QAAoC;AACzF,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,+BAA2B,OAAO,KAAK;AAAA,EACzC;AACF;AAEA,SAAS,mBAAmB,OAA2B,UAA0B;AAC/E,QAAM,WAAW,cAAc,UAAU,KAAK,KAAK,QAAQ;AAC3D,QAAM,YAAY,sBAAsB,QAAQ;AAChD,QAAM,OAAO,UAAU,KAAK,KAAK;AACjC,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,uBAAuB,OAA+C;AAC7E,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,mBAAmB,SAAS,YAAY;AACjD;AAEA,SAAS,mBAAmB,MAAsC;AAChE,SAAO,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC,GACjC,IAAI,CAAC,QAAQ,uBAAuB,GAAG,CAAC,EACxC,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC;AAC/E;AAEA,SAAS,8BAA8B,OAAwB;AAC7D,MAAI,iBAAiB,SAAS,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,QAAQ,KAAK;AACzF,QAAM,WAAW,OAAO,KAAK,EAAE,KAAK;AACpC,SAAO,SAAS,SAAS,IAAI,WAAW;AAC1C;AAEA,SAAS,sCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,gCAAgC,cAAc,UAAU;AACjE;AAEA,SAAS,gCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,CAAC,6BAA6B,aAAa,MAAM,EAAE,YAAY;AACjE,QAAI,eAAe,aAAa,OAAO,kBAAkB;AACvD,YAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI;AAAA,IACtB,aAAa,OAAO;AAAA,IACpB,aAAa,OAAO;AAAA,IACpB,GAAG,aAAa,OAAO,kBAAkB,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,EACtE,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;AAC9C,MAAI,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC5B,UAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA6C;AAC5E,QAAM,MAAM,UAAU,GAAG;AACzB,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,aAAa,KAAK,MAAM,GAAG;AACjC,MAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,WAAO,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,EAC1C;AAEA,QAAM,WAAW,IAAI,MAAM,qBAAqB;AAChD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AAEA,QAAM,SAAS,OAAO,SAAS,SAAS,CAAC,KAAK,IAAI,EAAE;AACpD,QAAM,QAAQ,SAAS,CAAC,KAAK,IAAI,YAAY;AAC7C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AAC3C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,aACJ,SAAS,MAAM,MACX,SAAS,MAAM,KAAK,MAClB,SAAS,MAAM,KAAK,KAAK,MACvB,IAAI,KAAK,KAAK;AACxB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,UAAU,EAAE,YAAY;AAChE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,gDAAgD,KAAK,OAAO,GAAG;AAClE,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;AAEA,SAAS,gBAAgB,OAA4C;AACnE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACjD,QAAM,OAAsC,CAAC;AAC7C,MAAI,MAAM;AAEV,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,UAAU,MAAM,GAAG,KAAK;AAC9B,UAAM,OAAO,QAAQ,KAAK;AAC1B,WAAO;AACP,QAAI,KAAK,WAAW,EAAG;AACvB,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAE5C,QAAI,QAAQ,aAAa,UAAU,KAAK;AACtC,YAAM,eAAyB,CAAC;AAChC,aAAO,MAAM,MAAM,QAAQ;AACzB,cAAM,OAAO,MAAM,GAAG,KAAK;AAC3B,YAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,GAAI,GAAG;AAClD,uBAAa,KAAK,KAAK,QAAQ,YAAY,EAAE,CAAC;AAC9C,iBAAO;AACP;AAAA,QACF;AACA,YAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAC5B,uBAAa,KAAK,EAAE;AACpB,iBAAO;AACP;AAAA,QACF;AACA;AAAA,MACF;AACA,WAAK,UAAU,aAAa,KAAK,IAAI,EAAE,KAAK;AAC5C;AAAA,IACF;AAEA,YAAQ,KAAK;AAAA,MACX,KAAK;AACH,aAAK,UAAU;AACf;AAAA,MACF,KAAK;AACH,aAAK,WAAW;AAChB;AAAA,MACF,KAAK;AACH,aAAK,aAAa,sBAAsB,KAAK;AAC7C;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,OAAO,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACjB;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,MAAM;AACX;AAAA,MACF,KAAK;AACH,aAAK,eAAe;AACpB;AAAA,MACF;AACE;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,UAAU,KAAK,OAAO,IAAK,OAAgC;AACpE;AAEO,SAAS,gCAAgC,MAAsC;AACpF,QAAM,QAAgC,CAAC;AACvC,aAAW,SAAS,KAAK,SAAS,cAAc,GAAG;AACjD,UAAM,SAAS,gBAAgB,MAAM,CAAC,KAAK,EAAE;AAC7C,QAAI,OAAQ,OAAM,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,+BAA+B,MAAuB;AACpE,SAAO,sBAAsB,KAAK,IAAI;AACxC;AAEO,SAAS,gCAAgC,MAAsB;AACpE,SAAO,KAAK,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAC/C;AAEO,SAAS,6BACd,OACA,OAAsC,mBAChB;AACtB,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,qBAAqB;AACnD,MAAI,SAAS,mBAAmB;AAC9B,QAAI,QAAQ,SAAS,GAAI,OAAM,IAAI,MAAM,wCAAwC;AACjF,QAAI,QAAQ,SAAS,IAAM,OAAM,IAAI,MAAM,0CAA0C;AAAA,EACvF;AACA,MAAI,iBAAiB,KAAK,OAAO,KAAK,mBAAmB,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,WAAY,UAAU,MAAM,QAAQ,KAAK;AAC/C,MAAI,CAAC,0BAA0B,IAAI,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,yBAAyB,MAAM,YAAY,QAAQ,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,sBAAsB,OAAO;AAC/C,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,aAAW,WAAW,iBAAiB;AACrC,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF;AACA,6BAA2B,gBAAgB,MAAM,YAAY;AAC7D,6BAA2B,aAAa,MAAM,SAAS;AACvD,6BAA2B,OAAO,MAAM,GAAG;AAC3C,iCAA+B,QAAQ,MAAM,IAAI;AAEjD,MAAI,MAAM,eAAe,UAAa,CAAC,OAAO,SAAS,MAAM,UAAU,GAAG;AACxE,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,aAAa,MAAM,eAAe,SAAY,OAAO,OAAO,MAAM,UAAU;AAClF,MAAI,aAAa,KAAK,aAAa,GAAG;AACpC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,qBAAqB,UAAU,MAAM,SAAS;AACpD,MAAI,sBAAsB,CAAC,qBAAqB,kBAAkB,GAAG;AACnE,UAAM,IAAI,MAAM,qBAAqB,kBAAkB,EAAE;AAAA,EAC3D;AACA,QAAM,YAAY,wBAAwB,MAAM,GAAG;AAEnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,IACrF,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,cAAc,UAAU,MAAM,YAAY;AAAA,IAC1C,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,eAAe,6BACb,cACA,mBACA,WACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAC/D,MACE,UAAU,aAAa,UACpB,OAAQ,QAA2E,uBAAuB,YAC7G;AACA,QAAI;AACF,YAAM,UAAU,MAAO,QAA0E;AAAA,QAC/F,UAAU;AAAA,MACZ;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,gBACJ,OAAQ,QAAkF,mCACpF,aACF,MAAO,QACN,+BAA+B,IAChC;AACN,YAAI,cAAe,QAAO;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AAEZ,WAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,sBAAsB,wBAAwB,UAAU,OAAO;AACrE,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,SAAU,QAAO;AAChC,QAAI,OAAO,YAAY,aAAa,UAAU,SAAU,QAAO;AAC/D,QAAI,wBAAwB,OAAO,OAAO,MAAM,oBAAqB,QAAO;AAI5E,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,UAAU,iBAAiB,KAAK,KAAK;AAC1D,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,uBACpB,cACA,WACA,QAC2E;AAC3E,QAAM,oBAAoB,UAAU,uBAChC,UAAU,UAAU,SAAS,IAC7B,gCAAgC,cAAc,UAAU,SAAS;AACrE,QAAM,cAAc,MAAM,6BAA6B,cAAc,mBAAmB,SAAS;AACjG,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAI/D,QAAM,EAAE,IAAI,iBAAiB,IAAI,MAAM,QAAQ,YAAY,UAAU,UAAU,UAAU,SAAS;AAAA,IAChG,YAAY,UAAU;AAAA,IACtB,MAAM,UAAU;AAAA,IAChB,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,IACrB,QAAQ,WAAW,WAAW,oBAAoB;AAAA,IAClD,GAAI,UAAU,kBAAkB,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,EACpF,CAAC;AAID,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY,UAAU;AAAA,IACtB,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AAEjD,SAAO,EAAE,IAAI,iBAAiB;AAChC;AAEA,SAAS,kCAAkC,OAA6B,QAAwB;AAC9F,QAAM,mBAAmB,UAAU,MAAM,OAAO;AAChD,QAAM,cAAc,mBAAmB,kBAAkB,0BAA0B;AACnF,QAAM,eAAe,uBAAuB,MAAM,QAAQ;AAC1D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,UAAU,uBAAuB,MAAM,GAAG;AAChD,QAAM,mBAAmB,uBAAuB,MAAM,YAAY;AAClE,QAAM,WAAW,mBAAmB,MAAM,IAAI;AAC9C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,eAAe,uBAAuB,YAAY,KAAK;AAAA,IACvD,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,UAAU,kBAAkB,OAAO,KAAK;AAAA,IACxC,mBAAmB,2BAA2B,gBAAgB,KAAK;AAAA,IACnE,SAAS,SAAS,IAAI,mBAAmB,SAAS,KAAK,IAAI,CAAC,KAAK;AAAA,EACnE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAClF,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,GAAG,QAAQ;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,mCACb,cACA,WACA,SACA,iBACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,SAAS;AACvD,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,iBAAkB,QAAO;AACxC,QAAI,EAAE,OAAO,YAAY,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAG,QAAO;AACvE,QAAI,wBAAwB,OAAO,OAAO,MAAM,WAAY,QAAO;AACnE,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,iBAAiB,KAAK,KAAK;AAChD,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,8BACpB,cACA,OACA,QACA,OAC+C;AAC/C,QAAM,SAAS,mBAAmB,8BAA8B,KAAK,GAAG,yBAAyB;AACjG,QAAM,qBAAqB,UAAU,MAAM,SAAS;AAIpD,QAAM,iBAAkB,MAA6C,uBACjE,qBACA,sCAAsC,cAAc,kBAAkB;AAC1E,QAAM,UAAU,kCAAkC,OAAO,MAAM;AAC/D,QAAM,cAAc,MAAM,mCAAmC,cAAc,gBAAgB,SAAS,MAAM,eAAe;AACzH,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,oBAAoB,UAAU,MAAM,QAAQ;AAClD,QAAM,iBAAiB,qBAAqB,0BAA0B,IAAI,iBAAmC,IACzG,oBACA;AACJ,QAAM,gBAAgB,mBAAmB,MAAM,IAAI;AACnD,QAAM,UAAU,MAAM,aAAa,WAAW,cAAc;AAC5D,QAAM,EAAE,GAAO,IAAI,MAAM,QAAQ,YAAY,gBAAgB,SAAS;AAAA,IACpE,YAAY;AAAA,IACZ,MAAM,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,8BAA8B,GAAG,aAAa,CAAC,CAAC;AAAA,IAC7E,WAAW,uBAAuB,MAAM,SAAS;AAAA,IACjD,QAAQ,WAAW,WAAW,2BAA2B;AAAA,IACzD,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,EAC5E,CAAC;AACD,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,cAAc,EAAE;AAC9C,QAAI,SAAS;AACX,YAAM,QAAQ,uBAAuB,SAAS;AAAA,QAC5C,QAAQ;AAAA,QACR,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,QACD,OAAO,qBAAqB,MAAM;AAAA,QAClC,YAAY;AAAA,QACZ,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AAAA,EAQF;AACA,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AACjD,SAAO,EAAE,GAAG;AACd;AAEO,SAAS,6BAA6B,KAAiD;AAC5F,SAAO,IAAI,gBAAgB;AAC7B;AAEO,SAAS,mCAAmC,KAAiD;AAClG,SAAO,IAAI,gBAAgB;AAC7B;","names":[]}

package/dist/{cli-CqdPA6z9.d.ts → cli-SBWBw_eK.d.ts}

@@ -1,22 +1,21 @@
 import { CompoundingPromotionReport } from './compounding/engine.js';
 import { MigrateObservationsResult } from './maintenance/migrate-observations.js';
 import { MemoryGovernanceRunResult, MemoryGovernanceSummary, MemoryGovernanceMetrics, MemoryGovernanceQualityScore, MemoryGovernanceReviewQueueEntry, MemoryGovernanceAppliedAction, MemoryGovernanceTransitionReport, MemoryGovernanceManifest, MemoryGovernanceRestoreManifest, RestoreMemoryGovernanceRunResult } from './maintenance/memory-governance.js';
-import { u as MemoryStatus, M as MemoryFile, B as BehaviorSignalEvent, Q as QmdSearchResult, a2 as MemoryActionEvent, w as MemoryLifecycleEvent } from './types-CGgcNWCG.js';
+import { v as MemoryStatus, M as MemoryFile, B as BehaviorSignalEvent, Q as QmdSearchResult, a0 as BulkImportResult, a7 as MemoryActionEvent, x as MemoryLifecycleEvent } from './types-DDUDgd7T.js';
 import { RebuildMemoryProjectionResult, RepairMemoryProjectionResult, VerifyMemoryProjectionResult } from './maintenance/rebuild-memory-projection.js';
 import { RebuildMemoryLifecycleLedgerResult } from './maintenance/rebuild-memory-lifecycle-ledger.js';
 import { RebuildObservationsResult } from './maintenance/rebuild-observations.js';
 import { ArchiveObservationsResult } from './maintenance/archive-observations.js';
 import { Writable, Readable } from 'node:stream';
-import { O as Orchestrator } from './orchestrator-CWFrT8AF.js';
+import { O as Orchestrator } from './orchestrator-B0YrUl2H.js';
 import { ReplayRunSummary } from './replay/runner.js';
 import { ReplaySource, ReplayTurn } from './replay/types.js';
-import { b as BulkImportResult } from './types-gb_SNtjR.js';
-import { P as ProcessBatchFn } from './pipeline-DmqtvION.js';
+import { P as ProcessBatchFn } from './pipeline-CiD86zIk.js';
 import { WorkProjectStatus, WorkTaskStatus, WorkTaskPriority } from './work/types.js';
 import { RoutePatternType } from './routing/engine.js';
 import { TailscaleSyncOptions } from './network/tailscale.js';
 import { DashboardStatus } from './dashboard-runtime.js';
-import { F as EngramAccessService } from './access-service-CXJaql3A.js';
+import { F as EngramAccessService } from './access-service-Bps_9G1t.js';
 import { ResolveSecretRefFn } from './resolve-auth-token.js';
 import { CompatRunner, CompatReport } from './compat/types.js';
 import { EvalBaselineDeltaReport, EvalBaselineSnapshot, EvalCiGateReport, EvalBenchmarkPackSummary, EvalHarnessStatus, EvalStoredBaselineCiGateReport } from './evals.js';

package/dist/cli.d.ts

@@ -1,22 +1,21 @@
 import './compounding/engine.js';
 import './maintenance/migrate-observations.js';
 import './maintenance/memory-governance.js';
-import './types-CGgcNWCG.js';
+import './types-DDUDgd7T.js';
 import './maintenance/rebuild-memory-projection.js';
 import './maintenance/rebuild-memory-lifecycle-ledger.js';
 import './maintenance/rebuild-observations.js';
 import './maintenance/archive-observations.js';
 import 'node:stream';
-import './orchestrator-CWFrT8AF.js';
+import './orchestrator-B0YrUl2H.js';
 import './replay/runner.js';
 import './replay/types.js';
-import './types-gb_SNtjR.js';
-import './pipeline-DmqtvION.js';
+import './pipeline-CiD86zIk.js';
 import './work/types.js';
 import './routing/engine.js';
 import './network/tailscale.js';
 import './dashboard-runtime.js';
-import './access-service-CXJaql3A.js';
+import './access-service-Bps_9G1t.js';
 import './resolve-auth-token.js';
 import './compat/types.js';
 import './evals.js';
@@ -38,9 +37,9 @@ import './trust-zones.js';
 import './session-integrity.js';
 import './recall-state.js';
 import './policy-runtime.js';
-export { A as AccessHttpServeCliCommandOptions, a as ArchiveObservationsCliCommandOptions, B as BulkImportCliCommandOptions, C as CliApi, b as CliCommand, c as CliProgram, d as CompatCliCommandOptions, e as ConnectorsRunCliOutputOptions, f as ConversationIndexHealthCliOrchestrator, D as DashboardStartCliCommandOptions, g as DedupeCandidate, E as ExactDedupePlan, G as GraphHealthCliCommandOptions, M as MemoryActionAuditCliCommandOptions, h as MemoryActionAuditCliNamespaceSummary, i as MemoryActionAuditCliReport, j as MemoryGovernanceCliCommandOptions, k as MemoryGovernanceReportCliCommandOptions, l as MemoryGovernanceRestoreCliCommandOptions, m as MemoryReviewDispositionCliCommandOptions, n as MemoryTimelineCliCommandOptions, o as MigrateCliOrchestrator, q as MigrateCliReport, s as MigrateObservationsCliCommandOptions, P as PolicyDiffCliReport, t as PolicyDiffEntry, u as PolicyRollbackCliReport, v as PolicyStatusCliReport, w as PolicyTuningCliOrchestrator, R as RebuildMemoryLifecycleLedgerCliCommandOptions, x as RebuildMemoryProjectionCliCommandOptions, y as RebuildObservationsCliCommandOptions, z as RepairMemoryProjectionCliCommandOptions, F as ReplayCliCommandOptions, H as ReplayCliOrchestrator, I as RouteCliCommandOptions, S as SessionIntegrityCliCommandOptions, J as SessionRepairCliCommandOptions, T as TailscaleStatusCliCommandOptions, K as TailscaleSyncCliCommandOptions, L as TierMigrationCliOrchestrator, N as TrainingExportCliCommandOptions, V as VerifyMemoryProjectionCliCommandOptions, W as WebDavServeCliCommandOptions, O as WorkProjectCliCommandOptions, Q as WorkTaskCliCommandOptions, U as emitConnectorsRunCliResult, X as filterNormalMemorySearchResults, Y as hasDestructivePurgeFailures, Z as isNormalRetrievalVisibleMemory, _ as listMemoryMarkdownFilePaths, $ as parseDurationToMs, a0 as parseStrictCliDate, a1 as planAggressiveDuplicateDeletions, a2 as planExactDuplicateDeletions, a3 as registerCli, a4 as resolveAccessPrincipalOverride, a5 as resolveMemoryDirForNamespace, a6 as runAbstractionNodeStatusCliCommand, a7 as runAccessHttpServeCliCommand, a8 as runAccessHttpStatusCliCommand, a9 as runAccessHttpStopCliCommand, aa as runAccessMcpServeCliCommand, ab as runArchiveObservationsCliCommand, ac as runBenchmarkBaselineReportCliCommand, ad as runBenchmarkBaselineSnapshotCliCommand, ae as runBenchmarkCiGateCliCommand, af as runBenchmarkImportCliCommand, ag as runBenchmarkStatusCliCommand, ah as runBenchmarkStoredBaselineCiGateCliCommand, ai as runBenchmarkValidateCliCommand, r as runBulkImportCliCommand, aj as runCausalTrajectoryStatusCliCommand, ak as runCommitmentLifecycleCliCommand, al as runCommitmentRecordCliCommand, am as runCommitmentSetStateCliCommand, an as runCommitmentStatusCliCommand, ao as runCompatCliCommand, ap as runCompoundingPromoteCliCommand, aq as runConversationIndexHealthCliCommand, ar as runConversationIndexInspectCliCommand, as as runConversationIndexRebuildCliCommand, at as runCueAnchorStatusCliCommand, au as runDashboardStartCliCommand, av as runDashboardStatusCliCommand, aw as runDashboardStopCliCommand, ax as runGraphHealthCliCommand, ay as runHarmonicSearchCliCommand, az as runMemoryActionAuditCliCommand, aA as runMemoryGovernanceCliCommand, aB as runMemoryGovernanceReportCliCommand, aC as runMemoryGovernanceRestoreCliCommand, aD as runMemoryReviewDispositionCliCommand, aE as runMemoryTimelineCliCommand, aF as runMigrateNormalizeFrontmatterCliCommand, aG as runMigrateObservationsCliCommand, aH as runMigrateRechunkCliCommand, aI as runMigrateReextractCliCommand, aJ as runMigrateRescoreImportanceCliCommand, aK as runObjectiveStateStatusCliCommand, aL as runPolicyDiffCliCommand, aM as runPolicyRollbackCliCommand, aN as runPolicyStatusCliCommand, aO as runRebuildMemoryLifecycleLedgerCliCommand, aP as runRebuildMemoryProjectionCliCommand, aQ as runRebuildObservationsCliCommand, aR as runRepairMemoryProjectionCliCommand, aS as runReplayCliCommand, aT as runResumeBundleBuildCliCommand, aU as runResumeBundleRecordCliCommand, aV as runResumeBundleStatusCliCommand, aW as runRouteCliCommand, aX as runSemanticRulePromoteCliCommand, aY as runSemanticRuleVerifyCliCommand, aZ as runSessionCheckCliCommand, a_ as runSessionRepairCliCommand, a$ as runTailscaleStatusCliCommand, b0 as runTailscaleSyncCliCommand, b1 as runTierMigrateCliCommand, b2 as runTierStatusCliCommand, b3 as runTrainingExportCliCommand, b4 as runTrustZoneDemoSeedCliCommand, b5 as runTrustZonePromoteCliCommand, b6 as runTrustZoneStatusCliCommand, b7 as runUtilityLearningCliCommand, b8 as runUtilityLearningStatusCliCommand, b9 as runUtilityTelemetryRecordCliCommand, ba as runUtilityTelemetryStatusCliCommand, bb as runVerifiedRecallSearchCliCommand, bc as runVerifyMemoryProjectionCliCommand, bd as runWebDavServeCliCommand, be as runWebDavStopCliCommand, bf as runWorkProductRecallSearchCliCommand, bg as runWorkProductRecordCliCommand, bh as runWorkProductStatusCliCommand, bi as runWorkProjectCliCommand, bj as runWorkTaskCliCommand } from './cli-CqdPA6z9.js';
+export { A as AccessHttpServeCliCommandOptions, a as ArchiveObservationsCliCommandOptions, B as BulkImportCliCommandOptions, C as CliApi, b as CliCommand, c as CliProgram, d as CompatCliCommandOptions, e as ConnectorsRunCliOutputOptions, f as ConversationIndexHealthCliOrchestrator, D as DashboardStartCliCommandOptions, g as DedupeCandidate, E as ExactDedupePlan, G as GraphHealthCliCommandOptions, M as MemoryActionAuditCliCommandOptions, h as MemoryActionAuditCliNamespaceSummary, i as MemoryActionAuditCliReport, j as MemoryGovernanceCliCommandOptions, k as MemoryGovernanceReportCliCommandOptions, l as MemoryGovernanceRestoreCliCommandOptions, m as MemoryReviewDispositionCliCommandOptions, n as MemoryTimelineCliCommandOptions, o as MigrateCliOrchestrator, q as MigrateCliReport, s as MigrateObservationsCliCommandOptions, P as PolicyDiffCliReport, t as PolicyDiffEntry, u as PolicyRollbackCliReport, v as PolicyStatusCliReport, w as PolicyTuningCliOrchestrator, R as RebuildMemoryLifecycleLedgerCliCommandOptions, x as RebuildMemoryProjectionCliCommandOptions, y as RebuildObservationsCliCommandOptions, z as RepairMemoryProjectionCliCommandOptions, F as ReplayCliCommandOptions, H as ReplayCliOrchestrator, I as RouteCliCommandOptions, S as SessionIntegrityCliCommandOptions, J as SessionRepairCliCommandOptions, T as TailscaleStatusCliCommandOptions, K as TailscaleSyncCliCommandOptions, L as TierMigrationCliOrchestrator, N as TrainingExportCliCommandOptions, V as VerifyMemoryProjectionCliCommandOptions, W as WebDavServeCliCommandOptions, O as WorkProjectCliCommandOptions, Q as WorkTaskCliCommandOptions, U as emitConnectorsRunCliResult, X as filterNormalMemorySearchResults, Y as hasDestructivePurgeFailures, Z as isNormalRetrievalVisibleMemory, _ as listMemoryMarkdownFilePaths, $ as parseDurationToMs, a0 as parseStrictCliDate, a1 as planAggressiveDuplicateDeletions, a2 as planExactDuplicateDeletions, a3 as registerCli, a4 as resolveAccessPrincipalOverride, a5 as resolveMemoryDirForNamespace, a6 as runAbstractionNodeStatusCliCommand, a7 as runAccessHttpServeCliCommand, a8 as runAccessHttpStatusCliCommand, a9 as runAccessHttpStopCliCommand, aa as runAccessMcpServeCliCommand, ab as runArchiveObservationsCliCommand, ac as runBenchmarkBaselineReportCliCommand, ad as runBenchmarkBaselineSnapshotCliCommand, ae as runBenchmarkCiGateCliCommand, af as runBenchmarkImportCliCommand, ag as runBenchmarkStatusCliCommand, ah as runBenchmarkStoredBaselineCiGateCliCommand, ai as runBenchmarkValidateCliCommand, r as runBulkImportCliCommand, aj as runCausalTrajectoryStatusCliCommand, ak as runCommitmentLifecycleCliCommand, al as runCommitmentRecordCliCommand, am as runCommitmentSetStateCliCommand, an as runCommitmentStatusCliCommand, ao as runCompatCliCommand, ap as runCompoundingPromoteCliCommand, aq as runConversationIndexHealthCliCommand, ar as runConversationIndexInspectCliCommand, as as runConversationIndexRebuildCliCommand, at as runCueAnchorStatusCliCommand, au as runDashboardStartCliCommand, av as runDashboardStatusCliCommand, aw as runDashboardStopCliCommand, ax as runGraphHealthCliCommand, ay as runHarmonicSearchCliCommand, az as runMemoryActionAuditCliCommand, aA as runMemoryGovernanceCliCommand, aB as runMemoryGovernanceReportCliCommand, aC as runMemoryGovernanceRestoreCliCommand, aD as runMemoryReviewDispositionCliCommand, aE as runMemoryTimelineCliCommand, aF as runMigrateNormalizeFrontmatterCliCommand, aG as runMigrateObservationsCliCommand, aH as runMigrateRechunkCliCommand, aI as runMigrateReextractCliCommand, aJ as runMigrateRescoreImportanceCliCommand, aK as runObjectiveStateStatusCliCommand, aL as runPolicyDiffCliCommand, aM as runPolicyRollbackCliCommand, aN as runPolicyStatusCliCommand, aO as runRebuildMemoryLifecycleLedgerCliCommand, aP as runRebuildMemoryProjectionCliCommand, aQ as runRebuildObservationsCliCommand, aR as runRepairMemoryProjectionCliCommand, aS as runReplayCliCommand, aT as runResumeBundleBuildCliCommand, aU as runResumeBundleRecordCliCommand, aV as runResumeBundleStatusCliCommand, aW as runRouteCliCommand, aX as runSemanticRulePromoteCliCommand, aY as runSemanticRuleVerifyCliCommand, aZ as runSessionCheckCliCommand, a_ as runSessionRepairCliCommand, a$ as runTailscaleStatusCliCommand, b0 as runTailscaleSyncCliCommand, b1 as runTierMigrateCliCommand, b2 as runTierStatusCliCommand, b3 as runTrainingExportCliCommand, b4 as runTrustZoneDemoSeedCliCommand, b5 as runTrustZonePromoteCliCommand, b6 as runTrustZoneStatusCliCommand, b7 as runUtilityLearningCliCommand, b8 as runUtilityLearningStatusCliCommand, b9 as runUtilityTelemetryRecordCliCommand, ba as runUtilityTelemetryStatusCliCommand, bb as runVerifiedRecallSearchCliCommand, bc as runVerifyMemoryProjectionCliCommand, bd as runWebDavServeCliCommand, be as runWebDavStopCliCommand, bf as runWorkProductRecallSearchCliCommand, bg as runWorkProductRecordCliCommand, bh as runWorkProductStatusCliCommand, bi as runWorkProjectCliCommand, bj as runWorkTaskCliCommand } from './cli-SBWBw_eK.js';
 import './connectors-cli-2iaQ5tX2.js';
-import './storage-C1maCNbc.js';
+import './storage-DxPDAiU9.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -63,12 +62,12 @@ import './transcript.js';
 import './summarizer.js';
 import './orchestration/maintenance.js';
 import './namespaces/search.js';
-import './catalog-C9cu67Ig.js';
+import './catalog-9WanSGtt.js';
 import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-O5lMZ4LG.js';
+import './semantic-consolidation-BTShF2Fo.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -92,7 +91,7 @@ import './framework-CNDn2164.js';
 import './relevance.js';
 import './negative.js';
 import './session-observer-state.js';
-import './semantic-DJR8_DMQ.js';
+import './semantic-TddhF0y7.js';
 import './extraction-judge.js';
 import './lcm/engine.js';
 import './lcm/archive.js';

package/dist/cli.js

@@ -90,11 +90,11 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-P454KXD6.js";
-import "./chunk-MC4FJXPA.js";
-import "./chunk-LQHDIS7L.js";
-import "./chunk-7F7Z6MOS.js";
-import "./chunk-JJEJJ7RK.js";
+} from "./chunk-CJPVWAJF.js";
+import "./chunk-MMACM5G2.js";
+import "./chunk-54BGIBCR.js";
+import "./chunk-H4CKS5B2.js";
+import "./chunk-FXZTL7F7.js";
 import "./chunk-HDDRVXX4.js";
 import "./chunk-PYHOAXTI.js";
 import "./chunk-EEIROWEG.js";
@@ -105,39 +105,39 @@ import "./chunk-OZKVVUJB.js";
 import "./chunk-2DL3OFLD.js";
 import "./chunk-G4IAEX6D.js";
 import "./chunk-765K3SAT.js";
-import "./chunk-HOJZMQ4J.js";
-import "./chunk-2PRQG7PV.js";
+import "./chunk-FGDKJJZS.js";
+import "./chunk-AJVLDJU6.js";
 import "./chunk-KQPJLK3X.js";
 import "./chunk-EEC4PCG5.js";
 import "./chunk-PYIFUBRK.js";
 import "./chunk-D6RIFG4O.js";
-import "./chunk-TLUDFPZL.js";
-import "./chunk-BEM4D2QG.js";
+import "./chunk-CAZ3Z5M6.js";
+import "./chunk-KJIJNLXT.js";
 import "./chunk-LZZNTPLR.js";
 import "./chunk-JCK7V6SN.js";
 import "./chunk-WMWVO45V.js";
 import "./chunk-KJTKLXTH.js";
-import "./chunk-CKITWVWJ.js";
-import "./chunk-OUELRE5E.js";
+import "./chunk-HSSERO3E.js";
+import "./chunk-NOUJNHWG.js";
 import "./chunk-GQL52GQ5.js";
 import "./chunk-2F6NP3NT.js";
 import "./chunk-TERNBNJB.js";
-import "./chunk-SIRPLF54.js";
+import "./chunk-2K3OSLHE.js";
 import "./chunk-DBRYEIGY.js";
-import "./chunk-72WG5QKN.js";
-import "./chunk-RGK27ELN.js";
+import "./chunk-SDAXPXER.js";
+import "./chunk-DEKIXXIG.js";
 import "./chunk-TGQ2NTWH.js";
 import "./chunk-YQB32INI.js";
 import "./chunk-ZRWB5D4H.js";
 import "./chunk-5EZXHU36.js";
-import "./chunk-DANV2HTH.js";
+import "./chunk-GQGDRLDM.js";
 import "./chunk-SFQ6QNL7.js";
 import "./chunk-3T74IZB3.js";
 import "./chunk-33JBK2XP.js";
-import "./chunk-PVUJ6WVV.js";
-import "./chunk-4LV23CHK.js";
-import "./chunk-DS7MM2ES.js";
-import "./chunk-PNLFN2PZ.js";
+import "./chunk-5MH5NF3U.js";
+import "./chunk-VHJARF5R.js";
+import "./chunk-JZKR6ZAV.js";
+import "./chunk-23G3T2Q5.js";
 import "./chunk-KFY3SGN7.js";
 import "./chunk-CMTINOFS.js";
 import "./chunk-HL4DB7TO.js";
@@ -168,7 +168,7 @@ import "./chunk-G6NKALRN.js";
 import "./chunk-OO42R444.js";
 import "./chunk-K6MV3TRQ.js";
 import "./chunk-OADWQ5CR.js";
-import "./chunk-UFUKHGZD.js";
+import "./chunk-EIGE4IMQ.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-RKNJBZ55.js";
@@ -177,13 +177,13 @@ import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-TMSXWOBZ.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-PCLIWBGD.js";
+import "./chunk-N2RP4K5Q.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-5RUE3GHQ.js";
-import "./chunk-XCL57M6Q.js";
+import "./chunk-DPZKMGEP.js";
 import "./chunk-UPSAT4PY.js";
-import "./chunk-LADFWYHY.js";
+import "./chunk-QMC3BI3K.js";
 import "./chunk-HLTAPHZZ.js";
 import "./chunk-YF6FMLBT.js";
 import "./chunk-KQDNAXOM.js";
@@ -191,9 +191,9 @@ import "./chunk-PRTA6444.js";
 import "./chunk-35NN3ZFA.js";
 import "./chunk-FTYDWKO6.js";
 import "./chunk-T4WDJPEZ.js";
-import "./chunk-4GNEDXDI.js";
+import "./chunk-WULTHJRU.js";
 import "./chunk-D7FOKIY5.js";
-import "./chunk-H2DXDQCQ.js";
+import "./chunk-BT3PTVYZ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-CYWCKFCL.js";
@@ -205,9 +205,9 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-2KK5WNQB.js";
+import "./chunk-DQ42IQSK.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-6MMONPHM.js";
+import "./chunk-W2AHSCKY.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
@@ -224,7 +224,7 @@ import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-3XIY7MDQ.js";
+import "./chunk-O6YI4CVI.js";
 import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
@@ -238,7 +238,7 @@ import "./chunk-EI6V5UXY.js";
 import "./chunk-MTWKDOVO.js";
 import "./chunk-O75CRYGF.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-K5LLP4CY.js";
+import "./chunk-ZGPDSEKG.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
@@ -248,8 +248,8 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-TBBDFYXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-Y7UNNAZD.js";
-import "./chunk-SVOHGUMI.js";
+import "./chunk-7ZYBDQ7V.js";
+import "./chunk-H4FHR4UM.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -260,7 +260,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-JS2HKKOK.js";
+import "./chunk-3AC5UYKI.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/dist/compounding/engine.d.ts

@@ -1,5 +1,5 @@
-import { S as StorageManager } from '../storage-C1maCNbc.js';
-import { P as PluginConfig } from '../types-CGgcNWCG.js';
+import { S as StorageManager } from '../storage-DxPDAiU9.js';
+import { P as PluginConfig } from '../types-DDUDgd7T.js';
 import { SharedFeedbackEntry } from '../shared-context/manager.js';
 import { QmdConfigProjection } from '../capabilities.js';
 import '../page-versioning.js';
@@ -9,7 +9,6 @@ import '../maintenance/memory-governance.js';
 import '../runtime/better-sqlite.js';
 import 'better-sqlite3';
 import '../structured-attributes.js';
-import '../types-gb_SNtjR.js';
 import '../message-parts/index.js';
 import 'zod';
 

package/dist/compounding/engine.js

@@ -1,9 +1,9 @@
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "../chunk-AYZJID4S.js";
+} from "../chunk-B5GBWBCZ.js";
 import "../chunk-UI4FVU6T.js";
-import "../chunk-SVOHGUMI.js";
+import "../chunk-H4FHR4UM.js";
 import "../chunk-B3ABVQ36.js";
 import "../chunk-L2B3EE7B.js";
 import "../chunk-5UZXUTVO.js";
@@ -14,7 +14,7 @@ import "../chunk-J6A3CX5N.js";
 import "../chunk-4KJLYTLS.js";
 import "../chunk-SVOZFLIQ.js";
 import "../chunk-LTJAMRGI.js";
-import "../chunk-JS2HKKOK.js";
+import "../chunk-3AC5UYKI.js";
 import "../chunk-RHOZ5LLO.js";
 import "../chunk-RL6NEVXT.js";
 import "../chunk-AWJ2FHCF.js";

package/dist/compounding/preference-consolidator.d.ts

@@ -1,6 +1,5 @@
-import { t as MemoryCategory, M as MemoryFile } from '../types-CGgcNWCG.js';
+import { u as MemoryCategory, M as MemoryFile } from '../types-DDUDgd7T.js';
 import { LcmEngine } from '../lcm/engine.js';
-import '../types-gb_SNtjR.js';
 import '../message-parts/index.js';
 import '../lcm/archive.js';
 import 'better-sqlite3';

package/dist/compression-optimizer.d.ts

@@ -1,5 +1,4 @@
-import { _ as CompressionGuidelineOptimizerEventCounts, $ as CompressionGuidelineOptimizerActionSummary, a0 as CompressionGuidelineOptimizerRuleUpdate, a1 as MemoryActionType, a2 as MemoryActionEvent, a3 as CompressionGuidelineOptimizerState } from './types-CGgcNWCG.js';
-import './types-gb_SNtjR.js';
+import { a3 as CompressionGuidelineOptimizerEventCounts, a4 as CompressionGuidelineOptimizerActionSummary, a5 as CompressionGuidelineOptimizerRuleUpdate, a6 as MemoryActionType, a7 as MemoryActionEvent, a8 as CompressionGuidelineOptimizerState } from './types-DDUDgd7T.js';
 import './message-parts/index.js';
 
 interface CompressionGuidelineCandidate {

package/dist/config.d.ts

@@ -1,5 +1,4 @@
-import { P as PluginConfig } from './types-CGgcNWCG.js';
-import './types-gb_SNtjR.js';
+import { P as PluginConfig } from './types-DDUDgd7T.js';
 import './message-parts/index.js';
 
 declare function isOpenaiApiKeyDisabled(value: unknown): boolean;

package/dist/connectors/codex-materialize-runner.d.ts

@@ -1,6 +1,5 @@
-import { P as PluginConfig, M as MemoryFile } from '../types-CGgcNWCG.js';
+import { P as PluginConfig, M as MemoryFile } from '../types-DDUDgd7T.js';
 import { RolloutSummaryInput, MaterializeResult } from './codex-materialize.js';
-import '../types-gb_SNtjR.js';
 import '../message-parts/index.js';
 
 /**