@remnic/core 9.65.6 → 9.65.7

package/dist/{chunk-YWBOOBDP.js → chunk-I7EX6KSH.js}

@@ -1,3 +1,6 @@
+import {
+  openclawReplayNormalizer
+} from "./chunk-H4CKS5B2.js";
 import {
   chatgptReplayNormalizer
 } from "./chunk-MMACM5G2.js";
@@ -5,32 +8,29 @@ import {
   claudeReplayNormalizer
 } from "./chunk-54BGIBCR.js";
 import {
-  openclawReplayNormalizer
-} from "./chunk-H4CKS5B2.js";
+  exportSqlite
+} from "./chunk-BV2TIZ4F.js";
 import {
   importMarkdownBundle
 } from "./chunk-HDDRVXX4.js";
 import {
   importSqlite
 } from "./chunk-PYHOAXTI.js";
-import {
-  backupMemoryDir
-} from "./chunk-OWHERGF2.js";
-import {
-  exportJsonBundle
-} from "./chunk-UP6MOYCB.js";
-import {
-  exportSqlite
-} from "./chunk-BV2TIZ4F.js";
 import {
   detectImportFormat
 } from "./chunk-OZKVVUJB.js";
 import {
   importJsonBundle
 } from "./chunk-2DL3OFLD.js";
+import {
+  backupMemoryDir
+} from "./chunk-2NLLXCJG.js";
 import {
   exportMarkdownBundle
 } from "./chunk-765K3SAT.js";
+import {
+  exportJsonBundle
+} from "./chunk-UP6MOYCB.js";
 import {
   buildReplayNormalizerRegistry,
   clampBatchSize,
@@ -49,18 +49,18 @@ import {
 import {
   WebDavServer
 } from "./chunk-PYIFUBRK.js";
+import {
+  migrateObservations
+} from "./chunk-IIFFC3RL.js";
+import {
+  rebuildMemoryLifecycleLedger
+} from "./chunk-7WR462EM.js";
 import {
   rebuildObservations
 } from "./chunk-DQTCGVFK.js";
 import {
   archiveObservations
 } from "./chunk-YLBE6PLR.js";
-import {
-  migrateObservations
-} from "./chunk-IIFFC3RL.js";
-import {
-  rebuildMemoryLifecycleLedger
-} from "./chunk-KBOG7FJV.js";
 import {
   getBulkImportSource,
   listBulkImportSources,
@@ -70,9 +70,6 @@ import {
 import {
   runCompatChecks
 } from "./chunk-CDKHKZL5.js";
-import {
-  searchVerifiedEpisodes
-} from "./chunk-53MZQEBD.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
@@ -81,20 +78,23 @@ import {
   getUtilityTelemetryStatus,
   recordUtilityTelemetryEvent
 } from "./chunk-6FC3IZ26.js";
+import {
+  searchVerifiedEpisodes
+} from "./chunk-YWSQD2IB.js";
 import {
   ThreadingManager
 } from "./chunk-OJP3N7UK.js";
-import {
-  searchVerifiedSemanticRules
-} from "./chunk-TWBQQ3FT.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-IF4EY26E.js";
+} from "./chunk-5DH6PG4B.js";
+import {
+  searchVerifiedSemanticRules
+} from "./chunk-SEA6M7SS.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-AXGFOFNY.js";
+} from "./chunk-IY7UXD3J.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
@@ -106,19 +106,6 @@ import {
 import {
   parseXrayCliOptions
 } from "./chunk-R2MZCYA6.js";
-import {
-  collectPatternMemories,
-  explainPatternMemory,
-  parsePatternsExplainOptions,
-  parsePatternsListOptions,
-  parseStrictCliDate,
-  renderPatternExplain,
-  renderPatternsList
-} from "./chunk-3T74IZB3.js";
-import {
-  readRuntimePolicySnapshot,
-  sanitizeRuntimePolicyValues
-} from "./chunk-2LA3H54D.js";
 import {
   formatNamespaceMaintenanceHealthText,
   runBenchmarkRecall,
@@ -127,12 +114,25 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-ROEAEANL.js";
+} from "./chunk-6CPUQ5D6.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
   planSessionRepair
 } from "./chunk-KFY3SGN7.js";
+import {
+  collectPatternMemories,
+  explainPatternMemory,
+  parsePatternsExplainOptions,
+  parsePatternsListOptions,
+  parseStrictCliDate,
+  renderPatternExplain,
+  renderPatternsList
+} from "./chunk-3T74IZB3.js";
+import {
+  readRuntimePolicySnapshot,
+  sanitizeRuntimePolicyValues
+} from "./chunk-2LA3H54D.js";
 import {
   GITHUB_CONNECTOR_ID,
   GMAIL_CONNECTOR_ID,
@@ -150,12 +150,12 @@ import {
 import {
   listConnectorStates
 } from "./chunk-6GUG4YNM.js";
-import {
-  searchHarmonicRetrieval
-} from "./chunk-XUZ5CIEE.js";
 import {
   rescoreMemoryImportance
 } from "./chunk-UOBPK2OS.js";
+import {
+  searchHarmonicRetrieval
+} from "./chunk-YRVAKONL.js";
 import {
   createEvalBaselineSnapshot,
   getEvalHarnessStatus,
@@ -170,12 +170,12 @@ import {
 } from "./chunk-ACPCA4NO.js";
 import {
   GraphDashboardServer
-} from "./chunk-YNDLCWXS.js";
+} from "./chunk-EZ25VE3G.js";
 import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-JFWZRUKP.js";
+} from "./chunk-WTOZBZNN.js";
 import {
   buildConnectorRowsFromDefinitions,
   parseConnectorsListOptions,
@@ -196,11 +196,11 @@ import {
 } from "./chunk-6TBIWIAG.js";
 import {
   parseConfig
-} from "./chunk-DPNXADEI.js";
+} from "./chunk-D4QVPP3G.js";
 import {
   EngramAccessHttpServer,
   MeetingsInputError
-} from "./chunk-YUTTMSC7.js";
+} from "./chunk-FMQ4MOQO.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -210,13 +210,13 @@ import {
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal
-} from "./chunk-RQ2EQRRR.js";
+} from "./chunk-I4343FIA.js";
 import {
   getAbstractionNodeStoreStatus
 } from "./chunk-DJUKBGAD.js";
 import {
   EngramAccessService
-} from "./chunk-PNAGNVGK.js";
+} from "./chunk-RQE4TITU.js";
 import {
   WorkStorage
 } from "./chunk-GDB4J2H3.js";
@@ -236,7 +236,7 @@ import {
 } from "./chunk-YOXVZJFM.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-XAWIL7TC.js";
+} from "./chunk-5S4LQOPE.js";
 import {
   getObjectiveStateStoreStatus
 } from "./chunk-HTP6XRUI.js";
@@ -245,23 +245,23 @@ import {
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-DYO24BNB.js";
+} from "./chunk-SVVIASVX.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-IDQ6DKXC.js";
+} from "./chunk-5VPQSRQO.js";
 import {
   analyzeGraphHealth
-} from "./chunk-BIJAWZYW.js";
+} from "./chunk-YMOPYG3K.js";
 import {
   resolveNamespaceChildRoot
-} from "./chunk-O4BAGJDN.js";
+} from "./chunk-GEPACVWN.js";
 import {
   OKF_RESERVED_BASENAMES,
   meetingIdDate,
   okfTypeForCategory
-} from "./chunk-6LS5OX3U.js";
+} from "./chunk-BJTHRFFC.js";
 import {
   isValidTranscriptDate
 } from "./chunk-UHVXE24Y.js";
@@ -302,7 +302,7 @@ import {
 } from "./chunk-QDW3E4RD.js";
 import {
   getCausalTrajectoryStoreStatus
-} from "./chunk-PP7R754B.js";
+} from "./chunk-GPFZFCRN.js";
 import {
   padEndDisplay,
   truncateGraphemeSafe
@@ -5394,7 +5394,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           }
         }
         if (sourceArchive.endsWith(".enc")) {
-          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-GWVG7LGC.js");
+          const { isEncryptedCapsuleFile } = await import("./capsule-crypto-7FJQINUR.js");
           const encDetected = await isEncryptedCapsuleFile(sourceArchive).catch(() => true);
           if (encDetected) {
             throw new Error(
@@ -5557,7 +5557,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
           const { parseExportBundle } = await import("./transfer/types.js");
           let decryptedBuf;
           try {
-            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-GWVG7LGC.js");
+            const { decryptCapsuleFileInMemory } = await import("./capsule-crypto-7FJQINUR.js");
             decryptedBuf = await decryptCapsuleFileInMemory(archivePath, memoryDir);
           } catch (decErr) {
             const msg = decErr instanceof Error ? decErr.message : String(decErr);
@@ -8811,4 +8811,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-YWBOOBDP.js.map
+//# sourceMappingURL=chunk-I7EX6KSH.js.map

package/dist/{chunk-3I22VWB3.js → chunk-IP4ZNT4U.js}

@@ -1,6 +1,6 @@
 import {
   rebuildMemoryProjection
-} from "./chunk-JFWZRUKP.js";
+} from "./chunk-WTOZBZNN.js";
 
 // src/convergence-refresh.ts
 async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, getStorage, searchEnabled) {
@@ -32,4 +32,4 @@ async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, get
 export {
   refreshConvergedNamespaces
 };
-//# sourceMappingURL=chunk-3I22VWB3.js.map
+//# sourceMappingURL=chunk-IP4ZNT4U.js.map

package/dist/{chunk-AXGFOFNY.js → chunk-IY7UXD3J.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-NOB2T2FC.js";
 import {
   parseConfig
-} from "./chunk-DPNXADEI.js";
+} from "./chunk-D4QVPP3G.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-AXGFOFNY.js.map
+//# sourceMappingURL=chunk-IY7UXD3J.js.map

package/dist/{chunk-6FUMA6AA.js → chunk-JAQXUGLN.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-D35XLYQ7.js";
+} from "./chunk-RGCF4XNH.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
@@ -470,4 +470,4 @@ export {
   NamespaceSearchRouter,
   normalizeQmdResultPath
 };
-//# sourceMappingURL=chunk-6FUMA6AA.js.map
+//# sourceMappingURL=chunk-JAQXUGLN.js.map

package/dist/{chunk-RKNJBZ55.js → chunk-JBPKEARU.js}

@@ -1,3 +1,6 @@
+import {
+  ReplitAdapter
+} from "./chunk-TMSXWOBZ.js";
 import {
   ClaudeCodeAdapter
 } from "./chunk-J64TK33U.js";
@@ -7,9 +10,6 @@ import {
 import {
   HermesAdapter
 } from "./chunk-42NQ7AVG.js";
-import {
-  ReplitAdapter
-} from "./chunk-TMSXWOBZ.js";
 
 // src/adapters/registry.ts
 var AdapterRegistry = class {
@@ -53,4 +53,4 @@ var AdapterRegistry = class {
 export {
   AdapterRegistry
 };
-//# sourceMappingURL=chunk-RKNJBZ55.js.map
+//# sourceMappingURL=chunk-JBPKEARU.js.map

package/dist/chunk-JCCWJHOP.js

@@ -0,0 +1,240 @@
+import {
+  DEFAULT_EVAL_TRAJECTORY_REPORT_MAX_AGE_MS,
+  DESTRUCTIVE_ACTION_TYPES,
+  EVAL_TRAJECTORY_PROMOTION_THRESHOLDS,
+  EVAL_TRAJECTORY_REPORT_SCHEMA_VERSION,
+  canonicalJson,
+  compareRows,
+  isFiniteNumber,
+  isHexSha256,
+  isIsoTimestamp,
+  isMemoryActionType,
+  isRowStatus,
+  resolveEvalTrajectoryRunConfig,
+  serializeEvalTrajectoryReport,
+  sha256Hex
+} from "./chunk-ULM7JCDH.js";
+import {
+  resolveEvalStoreDir
+} from "./chunk-MCA2X4WH.js";
+
+// src/eval-trajectory-store.ts
+import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import path from "path";
+function deriveUnifiedMemoryPromotionReport(report) {
+  const { aggregates } = report;
+  const trustViolations = report.rows.reduce(
+    (sum, row) => sum + (row.status === "joined" && row.trustViolation === 1 ? 1 : 0),
+    0
+  );
+  const staleHarms = report.rows.reduce(
+    (sum, row) => sum + (row.status === "joined" && row.staleMemoryHarm > 0 ? 1 : 0),
+    0
+  );
+  const destructiveJoinedRows = aggregates.byAction.filter((group) => DESTRUCTIVE_ACTION_TYPES[group.action] === true).reduce((sum, group) => sum + group.rowCount, 0);
+  const reasons = [];
+  let state;
+  if (trustViolations > 0 || staleHarms > 0) {
+    state = "demote_to_shadow";
+    reasons.push("safety_fault_present");
+  } else if (aggregates.coverage.joined < EVAL_TRAJECTORY_PROMOTION_THRESHOLDS.minJoinedRows) {
+    state = "insufficient_evidence";
+    reasons.push("insufficient_joined_rows");
+  } else if (aggregates.coverage.reach !== null && aggregates.coverage.reach < EVAL_TRAJECTORY_PROMOTION_THRESHOLDS.minReach) {
+    state = "shadow_eligible";
+    reasons.push("reach_below_floor");
+  } else if (destructiveJoinedRows > 0) {
+    state = "active_destructive_review_only";
+    reasons.push("destructive_actions_present");
+  } else if (aggregates.metricMeans.actionConditionedUtility === null) {
+    state = "shadow_eligible";
+    reasons.push("utility_mean_unavailable");
+  } else {
+    state = "active_reversible_eligible";
+  }
+  const draft = {
+    schemaVersion: 1,
+    sourceReportId: report.reportId,
+    namespaceDigest: report.namespaceDigest,
+    asOf: report.asOf,
+    inputFingerprint: report.inputFingerprint,
+    state,
+    reasons,
+    evidence: {
+      joinedRows: aggregates.coverage.joined,
+      reach: aggregates.coverage.reach,
+      meanUtility: aggregates.metricMeans.actionConditionedUtility,
+      trustViolations,
+      staleHarms,
+      destructiveJoinedRows
+    },
+    contentHash: ""
+  };
+  draft.contentHash = sha256Hex(canonicalJson({ ...draft, contentHash: void 0 }));
+  return draft;
+}
+var FORBIDDEN_EXPORT_KEYS = {
+  inputSummary: true,
+  goal: true,
+  actionSummary: true,
+  observationSummary: true,
+  outcomeSummary: true,
+  prompt: true,
+  promptText: true,
+  promptHash: true,
+  memoryText: true,
+  noteText: true,
+  sessionKey: true,
+  sourceSessionKey: true,
+  filePath: true,
+  path: true,
+  storeDir: true,
+  memoryDir: true,
+  actionId: true,
+  trajectoryId: true,
+  memoryId: true,
+  outcomeId: true,
+  namespace: true,
+  salt: true,
+  rationale: true,
+  summary: true,
+  content: true,
+  text: true
+};
+function assertEvalTrajectoryReportRedacted(value, label = "report") {
+  const scan = (node, trail) => {
+    if (Array.isArray(node)) {
+      node.forEach((item, index) => scan(item, `${trail}[${index}]`));
+      return;
+    }
+    if (typeof node === "object" && node !== null) {
+      for (const [key, child] of Object.entries(node)) {
+        if (FORBIDDEN_EXPORT_KEYS[key] === true) {
+          throw new Error(`${label} contains forbidden field '${key}' at ${trail} \u2014 redaction fails closed`);
+        }
+        scan(child, `${trail}.${key}`);
+      }
+    }
+  };
+  scan(value, "$");
+}
+function validateEvalTrajectoryReport(raw) {
+  if (typeof raw !== "object" || raw === null) throw new Error("eval trajectory report must be an object");
+  assertEvalTrajectoryReportRedacted(raw, "eval trajectory report");
+  const report = raw;
+  if (report.schemaVersion !== EVAL_TRAJECTORY_REPORT_SCHEMA_VERSION) {
+    throw new Error("eval trajectory report schemaVersion must be 1");
+  }
+  if (!isHexSha256(report.reportId) || !isHexSha256(report.namespaceDigest) || !isHexSha256(report.inputFingerprint)) {
+    throw new Error("eval trajectory report ids and digests must be sha256 hex");
+  }
+  if (!isIsoTimestamp(report.asOf)) throw new Error("eval trajectory report asOf must be an ISO timestamp");
+  if (!Array.isArray(report.rows)) throw new Error("eval trajectory report rows must be an array");
+  const contentHash = report.contentHash;
+  if (!isHexSha256(contentHash)) throw new Error("eval trajectory report contentHash must be sha256 hex");
+  const expectedHash = sha256Hex(canonicalJson({ ...report, contentHash: void 0 }));
+  if (contentHash !== expectedHash) {
+    throw new Error("eval trajectory report contentHash mismatch \u2014 tampered or corrupted report");
+  }
+  resolveEvalTrajectoryRunConfig(report.config);
+  for (const row of report.rows) {
+    if (typeof row !== "object" || row === null) throw new Error("report rows must be objects");
+    const candidate = row;
+    if (candidate.schemaVersion !== 1 || !isHexSha256(candidate.actionDigest)) {
+      throw new Error("report row has invalid schemaVersion or actionDigest");
+    }
+    if (!isRowStatus(candidate.status)) throw new Error("report row has invalid status");
+    if (candidate.outcomeDigest !== null && candidate.outcomeDigest !== void 0 && !isHexSha256(candidate.outcomeDigest)) {
+      throw new Error("report row outcomeDigest must be sha256 hex or null");
+    }
+    if (candidate.status === "joined" && (candidate.outcomeDigest == null || candidate.join == null) || candidate.status !== "joined" && candidate.actionConditionedUtility !== null) {
+      throw new Error("report row join/utility invariants violated");
+    }
+    for (const metric of ["taskOutcome", "contextTokenCost", "actionConditionedUtility"]) {
+      const value = candidate[metric];
+      if (value !== null && value !== void 0 && !isFiniteNumber(value)) {
+        throw new Error(`report row ${metric} must be numeric or null`);
+      }
+    }
+    if (candidate.trustViolation !== 0 && candidate.trustViolation !== 1) {
+      throw new Error("report row trustViolation must be 0 or 1");
+    }
+    if (candidate.staleMemoryHarm !== 0 && candidate.staleMemoryHarm !== 0.5 && candidate.staleMemoryHarm !== 1) {
+      throw new Error("report row staleMemoryHarm must be 0, 0.5, or 1");
+    }
+  }
+  for (let index = 1; index < report.rows.length; index += 1) {
+    if (compareRows(report.rows[index - 1], report.rows[index]) > 0) {
+      throw new Error("report rows must be sorted by (outcomeRecordedAt, actionDigest)");
+    }
+  }
+  const rows = report.rows;
+  const statusCounts = {
+    joined: 0,
+    ambiguous: 0,
+    late_outcome: 0,
+    future_outcome: 0,
+    missing_within_window: 0
+  };
+  for (const row of rows) statusCounts[row.status] += 1;
+  const joinedRows = rows.filter((row) => row.status === "joined");
+  const mean = (values) => values.length === 0 ? null : values.reduce((sum, value) => sum + value, 0) / values.length;
+  const aggregates = report.aggregates;
+  if (typeof aggregates !== "object" || aggregates === null || aggregates.rowCount !== rows.length || canonicalJson(aggregates.statusCounts) !== canonicalJson(statusCounts) || aggregates.coverage.joined !== statusCounts.joined || aggregates.coverage.missingWithinWindow !== statusCounts.missing_within_window || aggregates.coverage.lateOutcome !== statusCounts.late_outcome || aggregates.coverage.futureOutcome !== statusCounts.future_outcome || aggregates.coverage.ambiguous !== statusCounts.ambiguous || aggregates.coverage.excludedFromMeans !== rows.length - statusCounts.joined || aggregates.metricMeans.taskOutcome !== mean(joinedRows.map((row) => row.taskOutcome).filter(isFiniteNumber)) || aggregates.metricMeans.actionConditionedUtility !== mean(joinedRows.map((row) => row.actionConditionedUtility).filter(isFiniteNumber)) || !Array.isArray(aggregates.byAction) || !aggregates.byAction.every((group) => isMemoryActionType(group.action))) {
+    throw new Error("eval trajectory report aggregates do not match rows \u2014 tampered or corrupted report");
+  }
+  return raw;
+}
+function assertPathWithin(rootDir, targetPath, field) {
+  const relative = path.relative(path.resolve(rootDir), path.resolve(targetPath));
+  if (relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative)) return;
+  throw new Error(`${field} must stay within ${rootDir}`);
+}
+async function writeEvalTrajectoryReport(options) {
+  const validated = validateEvalTrajectoryReport(options.report);
+  if (!options.memoryDir && !options.evalStoreDir) {
+    throw new Error("writeEvalTrajectoryReport requires memoryDir or evalStoreDir");
+  }
+  const rootDir = resolveEvalStoreDir(options.memoryDir ?? "", options.evalStoreDir);
+  const trajectoryDir = path.join(rootDir, "trajectory", validated.asOf.slice(0, 10));
+  const targetPath = path.join(trajectoryDir, `${validated.reportId}.json`);
+  assertPathWithin(rootDir, targetPath, "eval trajectory report path");
+  const payload = serializeEvalTrajectoryReport(validated);
+  const tmpPath = `${targetPath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;
+  await mkdir(trajectoryDir, { recursive: true });
+  try {
+    await writeFile(tmpPath, payload, "utf8");
+    await rename(tmpPath, targetPath);
+  } catch (error) {
+    await rm(tmpPath, { force: true }).catch(() => {
+    });
+    throw error;
+  }
+  return targetPath;
+}
+async function readEvalTrajectoryReport(options) {
+  const raw = await readFile(options.reportPath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("eval trajectory report file is not valid JSON");
+  }
+  const report = validateEvalTrajectoryReport(parsed);
+  const nowMs = options.now !== void 0 ? Date.parse(options.now) : Date.now();
+  if (!Number.isFinite(nowMs)) throw new Error("now must be a parseable timestamp");
+  const maxAgeMs = options.maxReportAgeMs ?? DEFAULT_EVAL_TRAJECTORY_REPORT_MAX_AGE_MS;
+  const asOfMs = Date.parse(report.asOf);
+  if (nowMs < asOfMs) throw new Error("eval trajectory report is dated after now \u2014 rejected");
+  if (nowMs - asOfMs > maxAgeMs) throw new Error("eval trajectory report is expired \u2014 rejected");
+  return report;
+}
+
+export {
+  deriveUnifiedMemoryPromotionReport,
+  assertEvalTrajectoryReportRedacted,
+  validateEvalTrajectoryReport,
+  writeEvalTrajectoryReport,
+  readEvalTrajectoryReport
+};
+//# sourceMappingURL=chunk-JCCWJHOP.js.map

package/dist/chunk-JCCWJHOP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/eval-trajectory-store.ts"],"sourcesContent":["/**\n * Issue #2345 — validation, redaction, persistence, and the promotion gate for\n * trajectory-eval reports.\n *\n * Fail-closed by construction:\n *   - every report is redaction-scanned before it can be validated or written,\n *   - the content hash and row-derived aggregates are recomputed on read,\n *   - the checked reader rejects tampered, future-dated, and expired reports,\n *   - the promotion gate can only recommend; it never runs an action.\n */\n\nimport { mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport {\n  DEFAULT_EVAL_TRAJECTORY_REPORT_MAX_AGE_MS,\n  DESTRUCTIVE_ACTION_TYPES,\n  EVAL_TRAJECTORY_PROMOTION_THRESHOLDS,\n  EVAL_TRAJECTORY_REPORT_SCHEMA_VERSION,\n  type EvalActionOutcomeRow,\n  type EvalTrajectoryReport,\n  type EvalTrajectoryRowStatus,\n  type EvalTrajectoryRunConfig,\n  type UnifiedMemoryPromotionReport,\n  type UnifiedMemoryPromotionState,\n  canonicalJson,\n  compareRows,\n  isFiniteNumber,\n  isHexSha256,\n  isIsoTimestamp,\n  isMemoryActionType,\n  isRowStatus,\n  resolveEvalTrajectoryRunConfig,\n  serializeEvalTrajectoryReport,\n  sha256Hex,\n} from \"./eval-trajectory-contracts.js\";\nimport { resolveEvalStoreDir } from \"./evals.js\";\n\n// ---------------------------------------------------------------------------\n// Promotion gate derivation (#2348 consumes this; it never runs actions here)\n// ---------------------------------------------------------------------------\n\nexport function deriveUnifiedMemoryPromotionReport(report: EvalTrajectoryReport): UnifiedMemoryPromotionReport {\n  const { aggregates } = report;\n  const trustViolations = report.rows.reduce(\n    (sum, row) => sum + (row.status === \"joined\" && row.trustViolation === 1 ? 1 : 0),\n    0\n  );\n  const staleHarms = report.rows.reduce(\n    (sum, row) => sum + (row.status === \"joined\" && row.staleMemoryHarm > 0 ? 1 : 0),\n    0\n  );\n  const destructiveJoinedRows = aggregates.byAction\n    .filter((group) => DESTRUCTIVE_ACTION_TYPES[group.action] === true)\n    .reduce((sum, group) => sum + group.rowCount, 0);\n\n  const reasons: string[] = [];\n  let state: UnifiedMemoryPromotionState;\n  if (trustViolations > 0 || staleHarms > 0) {\n    state = \"demote_to_shadow\";\n    reasons.push(\"safety_fault_present\");\n  } else if (aggregates.coverage.joined < EVAL_TRAJECTORY_PROMOTION_THRESHOLDS.minJoinedRows) {\n    state = \"insufficient_evidence\";\n    reasons.push(\"insufficient_joined_rows\");\n  } else if (\n    aggregates.coverage.reach !== null &&\n    aggregates.coverage.reach < EVAL_TRAJECTORY_PROMOTION_THRESHOLDS.minReach\n  ) {\n    state = \"shadow_eligible\";\n    reasons.push(\"reach_below_floor\");\n  } else if (destructiveJoinedRows > 0) {\n    state = \"active_destructive_review_only\";\n    reasons.push(\"destructive_actions_present\");\n  } else if (aggregates.metricMeans.actionConditionedUtility === null) {\n    state = \"shadow_eligible\";\n    reasons.push(\"utility_mean_unavailable\");\n  } else {\n    state = \"active_reversible_eligible\";\n  }\n\n  const draft: UnifiedMemoryPromotionReport = {\n    schemaVersion: 1,\n    sourceReportId: report.reportId,\n    namespaceDigest: report.namespaceDigest,\n    asOf: report.asOf,\n    inputFingerprint: report.inputFingerprint,\n    state,\n    reasons,\n    evidence: {\n      joinedRows: aggregates.coverage.joined,\n      reach: aggregates.coverage.reach,\n      meanUtility: aggregates.metricMeans.actionConditionedUtility,\n      trustViolations,\n      staleHarms,\n      destructiveJoinedRows,\n    },\n    contentHash: \"\",\n  };\n  draft.contentHash = sha256Hex(canonicalJson({ ...draft, contentHash: undefined }));\n  return draft;\n}\n\n// ---------------------------------------------------------------------------\n// Redaction (fail closed) + validation\n// ---------------------------------------------------------------------------\n\nconst FORBIDDEN_EXPORT_KEYS: Record<string, true> = {\n  inputSummary: true,\n  goal: true,\n  actionSummary: true,\n  observationSummary: true,\n  outcomeSummary: true,\n  prompt: true,\n  promptText: true,\n  promptHash: true,\n  memoryText: true,\n  noteText: true,\n  sessionKey: true,\n  sourceSessionKey: true,\n  filePath: true,\n  path: true,\n  storeDir: true,\n  memoryDir: true,\n  actionId: true,\n  trajectoryId: true,\n  memoryId: true,\n  outcomeId: true,\n  namespace: true,\n  salt: true,\n  rationale: true,\n  summary: true,\n  content: true,\n  text: true,\n};\n\nexport function assertEvalTrajectoryReportRedacted(value: unknown, label = \"report\"): void {\n  const scan = (node: unknown, trail: string): void => {\n    if (Array.isArray(node)) {\n      node.forEach((item, index) => scan(item, `${trail}[${index}]`));\n      return;\n    }\n    if (typeof node === \"object\" && node !== null) {\n      for (const [key, child] of Object.entries(node as Record<string, unknown>)) {\n        if (FORBIDDEN_EXPORT_KEYS[key] === true) {\n          throw new Error(`${label} contains forbidden field '${key}' at ${trail} — redaction fails closed`);\n        }\n        scan(child, `${trail}.${key}`);\n      }\n    }\n  };\n  scan(value, \"$\");\n}\n\nexport function validateEvalTrajectoryReport(raw: unknown): EvalTrajectoryReport {\n  if (typeof raw !== \"object\" || raw === null) throw new Error(\"eval trajectory report must be an object\");\n  assertEvalTrajectoryReportRedacted(raw, \"eval trajectory report\");\n  const report = raw as Partial<EvalTrajectoryReport> & Record<string, unknown>;\n  if (report.schemaVersion !== EVAL_TRAJECTORY_REPORT_SCHEMA_VERSION) {\n    throw new Error(\"eval trajectory report schemaVersion must be 1\");\n  }\n  if (!isHexSha256(report.reportId) || !isHexSha256(report.namespaceDigest) || !isHexSha256(report.inputFingerprint)) {\n    throw new Error(\"eval trajectory report ids and digests must be sha256 hex\");\n  }\n  if (!isIsoTimestamp(report.asOf)) throw new Error(\"eval trajectory report asOf must be an ISO timestamp\");\n  if (!Array.isArray(report.rows)) throw new Error(\"eval trajectory report rows must be an array\");\n  const contentHash = report.contentHash;\n  if (!isHexSha256(contentHash)) throw new Error(\"eval trajectory report contentHash must be sha256 hex\");\n  const expectedHash = sha256Hex(canonicalJson({ ...report, contentHash: undefined }));\n  if (contentHash !== expectedHash) {\n    throw new Error(\"eval trajectory report contentHash mismatch — tampered or corrupted report\");\n  }\n  // Bounds-check the embedded config through the same parser builders use.\n  resolveEvalTrajectoryRunConfig(report.config as Partial<EvalTrajectoryRunConfig>);\n\n  for (const row of report.rows) {\n    if (typeof row !== \"object\" || row === null) throw new Error(\"report rows must be objects\");\n    const candidate = row as Partial<EvalActionOutcomeRow>;\n    if (candidate.schemaVersion !== 1 || !isHexSha256(candidate.actionDigest)) {\n      throw new Error(\"report row has invalid schemaVersion or actionDigest\");\n    }\n    if (!isRowStatus(candidate.status)) throw new Error(\"report row has invalid status\");\n    if (\n      candidate.outcomeDigest !== null &&\n      candidate.outcomeDigest !== undefined &&\n      !isHexSha256(candidate.outcomeDigest)\n    ) {\n      throw new Error(\"report row outcomeDigest must be sha256 hex or null\");\n    }\n    if (\n      (candidate.status === \"joined\" && (candidate.outcomeDigest == null || candidate.join == null)) ||\n      (candidate.status !== \"joined\" && candidate.actionConditionedUtility !== null)\n    ) {\n      throw new Error(\"report row join/utility invariants violated\");\n    }\n    for (const metric of [\"taskOutcome\", \"contextTokenCost\", \"actionConditionedUtility\"] as const) {\n      const value = candidate[metric];\n      if (value !== null && value !== undefined && !isFiniteNumber(value)) {\n        throw new Error(`report row ${metric} must be numeric or null`);\n      }\n    }\n    if (candidate.trustViolation !== 0 && candidate.trustViolation !== 1) {\n      throw new Error(\"report row trustViolation must be 0 or 1\");\n    }\n    if (candidate.staleMemoryHarm !== 0 && candidate.staleMemoryHarm !== 0.5 && candidate.staleMemoryHarm !== 1) {\n      throw new Error(\"report row staleMemoryHarm must be 0, 0.5, or 1\");\n    }\n  }\n  for (let index = 1; index < report.rows.length; index += 1) {\n    if (compareRows(report.rows[index - 1] as EvalActionOutcomeRow, report.rows[index] as EvalActionOutcomeRow) > 0) {\n      throw new Error(\"report rows must be sorted by (outcomeRecordedAt, actionDigest)\");\n    }\n  }\n\n  // Derivable-aggregate verification: recompute from rows so tampering fails closed.\n  const rows = report.rows as EvalActionOutcomeRow[];\n  const statusCounts: Record<EvalTrajectoryRowStatus, number> = {\n    joined: 0,\n    ambiguous: 0,\n    late_outcome: 0,\n    future_outcome: 0,\n    missing_within_window: 0,\n  };\n  for (const row of rows) statusCounts[row.status] += 1;\n  const joinedRows = rows.filter((row) => row.status === \"joined\");\n  const mean = (values: number[]): number | null =>\n    values.length === 0 ? null : values.reduce((sum, value) => sum + value, 0) / values.length;\n  const aggregates = report.aggregates;\n  if (\n    typeof aggregates !== \"object\" ||\n    aggregates === null ||\n    aggregates.rowCount !== rows.length ||\n    canonicalJson(aggregates.statusCounts) !== canonicalJson(statusCounts) ||\n    aggregates.coverage.joined !== statusCounts.joined ||\n    aggregates.coverage.missingWithinWindow !== statusCounts.missing_within_window ||\n    aggregates.coverage.lateOutcome !== statusCounts.late_outcome ||\n    aggregates.coverage.futureOutcome !== statusCounts.future_outcome ||\n    aggregates.coverage.ambiguous !== statusCounts.ambiguous ||\n    aggregates.coverage.excludedFromMeans !== rows.length - statusCounts.joined ||\n    aggregates.metricMeans.taskOutcome !== mean(joinedRows.map((row) => row.taskOutcome).filter(isFiniteNumber)) ||\n    aggregates.metricMeans.actionConditionedUtility !==\n      mean(joinedRows.map((row) => row.actionConditionedUtility).filter(isFiniteNumber)) ||\n    !Array.isArray(aggregates.byAction) ||\n    !aggregates.byAction.every((group) => isMemoryActionType(group.action))\n  ) {\n    throw new Error(\"eval trajectory report aggregates do not match rows — tampered or corrupted report\");\n  }\n\n  return raw as EvalTrajectoryReport;\n}\n\n// ---------------------------------------------------------------------------\n// Persistence (atomic write beside the existing shadow artifacts)\n// ---------------------------------------------------------------------------\n\nfunction assertPathWithin(rootDir: string, targetPath: string, field: string): void {\n  const relative = path.relative(path.resolve(rootDir), path.resolve(targetPath));\n  if (relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative))) return;\n  throw new Error(`${field} must stay within ${rootDir}`);\n}\n\nexport async function writeEvalTrajectoryReport(options: {\n  memoryDir?: string;\n  evalStoreDir?: string;\n  report: EvalTrajectoryReport;\n}): Promise<string> {\n  const validated = validateEvalTrajectoryReport(options.report);\n  if (!options.memoryDir && !options.evalStoreDir) {\n    throw new Error(\"writeEvalTrajectoryReport requires memoryDir or evalStoreDir\");\n  }\n  const rootDir = resolveEvalStoreDir(options.memoryDir ?? \"\", options.evalStoreDir);\n  const trajectoryDir = path.join(rootDir, \"trajectory\", validated.asOf.slice(0, 10));\n  const targetPath = path.join(trajectoryDir, `${validated.reportId}.json`);\n  assertPathWithin(rootDir, targetPath, \"eval trajectory report path\");\n  const payload = serializeEvalTrajectoryReport(validated);\n  const tmpPath = `${targetPath}.tmp-${process.pid}-${Math.random().toString(36).slice(2)}`;\n  await mkdir(trajectoryDir, { recursive: true });\n  try {\n    await writeFile(tmpPath, payload, \"utf8\");\n    await rename(tmpPath, targetPath);\n  } catch (error) {\n    await rm(tmpPath, { force: true }).catch(() => {});\n    throw error;\n  }\n  return targetPath;\n}\n\nexport async function readEvalTrajectoryReport(options: {\n  reportPath: string;\n  now?: string;\n  maxReportAgeMs?: number;\n}): Promise<EvalTrajectoryReport> {\n  const raw = await readFile(options.reportPath, \"utf8\");\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"eval trajectory report file is not valid JSON\");\n  }\n  const report = validateEvalTrajectoryReport(parsed);\n  const nowMs = options.now !== undefined ? Date.parse(options.now) : Date.now();\n  if (!Number.isFinite(nowMs)) throw new Error(\"now must be a parseable timestamp\");\n  const maxAgeMs = options.maxReportAgeMs ?? DEFAULT_EVAL_TRAJECTORY_REPORT_MAX_AGE_MS;\n  const asOfMs = Date.parse(report.asOf);\n  if (nowMs < asOfMs) throw new Error(\"eval trajectory report is dated after now — rejected\");\n  if (nowMs - asOfMs > maxAgeMs) throw new Error(\"eval trajectory report is expired — rejected\");\n  return report;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,OAAO,UAAU,QAAQ,IAAI,iBAAiB;AACvD,OAAO,UAAU;AA6BV,SAAS,mCAAmC,QAA4D;AAC7G,QAAM,EAAE,WAAW,IAAI;AACvB,QAAM,kBAAkB,OAAO,KAAK;AAAA,IAClC,CAAC,KAAK,QAAQ,OAAO,IAAI,WAAW,YAAY,IAAI,mBAAmB,IAAI,IAAI;AAAA,IAC/E;AAAA,EACF;AACA,QAAM,aAAa,OAAO,KAAK;AAAA,IAC7B,CAAC,KAAK,QAAQ,OAAO,IAAI,WAAW,YAAY,IAAI,kBAAkB,IAAI,IAAI;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,wBAAwB,WAAW,SACtC,OAAO,CAAC,UAAU,yBAAyB,MAAM,MAAM,MAAM,IAAI,EACjE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,UAAU,CAAC;AAEjD,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACJ,MAAI,kBAAkB,KAAK,aAAa,GAAG;AACzC,YAAQ;AACR,YAAQ,KAAK,sBAAsB;AAAA,EACrC,WAAW,WAAW,SAAS,SAAS,qCAAqC,eAAe;AAC1F,YAAQ;AACR,YAAQ,KAAK,0BAA0B;AAAA,EACzC,WACE,WAAW,SAAS,UAAU,QAC9B,WAAW,SAAS,QAAQ,qCAAqC,UACjE;AACA,YAAQ;AACR,YAAQ,KAAK,mBAAmB;AAAA,EAClC,WAAW,wBAAwB,GAAG;AACpC,YAAQ;AACR,YAAQ,KAAK,6BAA6B;AAAA,EAC5C,WAAW,WAAW,YAAY,6BAA6B,MAAM;AACnE,YAAQ;AACR,YAAQ,KAAK,0BAA0B;AAAA,EACzC,OAAO;AACL,YAAQ;AAAA,EACV;AAEA,QAAM,QAAsC;AAAA,IAC1C,eAAe;AAAA,IACf,gBAAgB,OAAO;AAAA,IACvB,iBAAiB,OAAO;AAAA,IACxB,MAAM,OAAO;AAAA,IACb,kBAAkB,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA,UAAU;AAAA,MACR,YAAY,WAAW,SAAS;AAAA,MAChC,OAAO,WAAW,SAAS;AAAA,MAC3B,aAAa,WAAW,YAAY;AAAA,MACpC;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,aAAa;AAAA,EACf;AACA,QAAM,cAAc,UAAU,cAAc,EAAE,GAAG,OAAO,aAAa,OAAU,CAAC,CAAC;AACjF,SAAO;AACT;AAMA,IAAM,wBAA8C;AAAA,EAClD,cAAc;AAAA,EACd,MAAM;AAAA,EACN,eAAe;AAAA,EACf,oBAAoB;AAAA,EACpB,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,kBAAkB;AAAA,EAClB,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU;AAAA,EACV,cAAc;AAAA,EACd,UAAU;AAAA,EACV,WAAW;AAAA,EACX,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,MAAM;AACR;AAEO,SAAS,mCAAmC,OAAgB,QAAQ,UAAgB;AACzF,QAAM,OAAO,CAAC,MAAe,UAAwB;AACnD,QAAI,MAAM,QAAQ,IAAI,GAAG;AACvB,WAAK,QAAQ,CAAC,MAAM,UAAU,KAAK,MAAM,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9D;AAAA,IACF;AACA,QAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC1E,YAAI,sBAAsB,GAAG,MAAM,MAAM;AACvC,gBAAM,IAAI,MAAM,GAAG,KAAK,8BAA8B,GAAG,QAAQ,KAAK,gCAA2B;AAAA,QACnG;AACA,aAAK,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACA,OAAK,OAAO,GAAG;AACjB;AAEO,SAAS,6BAA6B,KAAoC;AAC/E,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,MAAM,0CAA0C;AACvG,qCAAmC,KAAK,wBAAwB;AAChE,QAAM,SAAS;AACf,MAAI,OAAO,kBAAkB,uCAAuC;AAClE,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACA,MAAI,CAAC,YAAY,OAAO,QAAQ,KAAK,CAAC,YAAY,OAAO,eAAe,KAAK,CAAC,YAAY,OAAO,gBAAgB,GAAG;AAClH,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,MAAI,CAAC,eAAe,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,sDAAsD;AACxG,MAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,8CAA8C;AAC/F,QAAM,cAAc,OAAO;AAC3B,MAAI,CAAC,YAAY,WAAW,EAAG,OAAM,IAAI,MAAM,uDAAuD;AACtG,QAAM,eAAe,UAAU,cAAc,EAAE,GAAG,QAAQ,aAAa,OAAU,CAAC,CAAC;AACnF,MAAI,gBAAgB,cAAc;AAChC,UAAM,IAAI,MAAM,iFAA4E;AAAA,EAC9F;AAEA,iCAA+B,OAAO,MAA0C;AAEhF,aAAW,OAAO,OAAO,MAAM;AAC7B,QAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,OAAM,IAAI,MAAM,6BAA6B;AAC1F,UAAM,YAAY;AAClB,QAAI,UAAU,kBAAkB,KAAK,CAAC,YAAY,UAAU,YAAY,GAAG;AACzE,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,QAAI,CAAC,YAAY,UAAU,MAAM,EAAG,OAAM,IAAI,MAAM,+BAA+B;AACnF,QACE,UAAU,kBAAkB,QAC5B,UAAU,kBAAkB,UAC5B,CAAC,YAAY,UAAU,aAAa,GACpC;AACA,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,QACG,UAAU,WAAW,aAAa,UAAU,iBAAiB,QAAQ,UAAU,QAAQ,SACvF,UAAU,WAAW,YAAY,UAAU,6BAA6B,MACzE;AACA,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,eAAW,UAAU,CAAC,eAAe,oBAAoB,0BAA0B,GAAY;AAC7F,YAAM,QAAQ,UAAU,MAAM;AAC9B,UAAI,UAAU,QAAQ,UAAU,UAAa,CAAC,eAAe,KAAK,GAAG;AACnE,cAAM,IAAI,MAAM,cAAc,MAAM,0BAA0B;AAAA,MAChE;AAAA,IACF;AACA,QAAI,UAAU,mBAAmB,KAAK,UAAU,mBAAmB,GAAG;AACpE,YAAM,IAAI,MAAM,0CAA0C;AAAA,IAC5D;AACA,QAAI,UAAU,oBAAoB,KAAK,UAAU,oBAAoB,OAAO,UAAU,oBAAoB,GAAG;AAC3G,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,OAAO,KAAK,QAAQ,SAAS,GAAG;AAC1D,QAAI,YAAY,OAAO,KAAK,QAAQ,CAAC,GAA2B,OAAO,KAAK,KAAK,CAAyB,IAAI,GAAG;AAC/G,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AAAA,EACF;AAGA,QAAM,OAAO,OAAO;AACpB,QAAM,eAAwD;AAAA,IAC5D,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,cAAc;AAAA,IACd,gBAAgB;AAAA,IAChB,uBAAuB;AAAA,EACzB;AACA,aAAW,OAAO,KAAM,cAAa,IAAI,MAAM,KAAK;AACpD,QAAM,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,WAAW,QAAQ;AAC/D,QAAM,OAAO,CAAC,WACZ,OAAO,WAAW,IAAI,OAAO,OAAO,OAAO,CAAC,KAAK,UAAU,MAAM,OAAO,CAAC,IAAI,OAAO;AACtF,QAAM,aAAa,OAAO;AAC1B,MACE,OAAO,eAAe,YACtB,eAAe,QACf,WAAW,aAAa,KAAK,UAC7B,cAAc,WAAW,YAAY,MAAM,cAAc,YAAY,KACrE,WAAW,SAAS,WAAW,aAAa,UAC5C,WAAW,SAAS,wBAAwB,aAAa,yBACzD,WAAW,SAAS,gBAAgB,aAAa,gBACjD,WAAW,SAAS,kBAAkB,aAAa,kBACnD,WAAW,SAAS,cAAc,aAAa,aAC/C,WAAW,SAAS,sBAAsB,KAAK,SAAS,aAAa,UACrE,WAAW,YAAY,gBAAgB,KAAK,WAAW,IAAI,CAAC,QAAQ,IAAI,WAAW,EAAE,OAAO,cAAc,CAAC,KAC3G,WAAW,YAAY,6BACrB,KAAK,WAAW,IAAI,CAAC,QAAQ,IAAI,wBAAwB,EAAE,OAAO,cAAc,CAAC,KACnF,CAAC,MAAM,QAAQ,WAAW,QAAQ,KAClC,CAAC,WAAW,SAAS,MAAM,CAAC,UAAU,mBAAmB,MAAM,MAAM,CAAC,GACtE;AACA,UAAM,IAAI,MAAM,yFAAoF;AAAA,EACtG;AAEA,SAAO;AACT;AAMA,SAAS,iBAAiB,SAAiB,YAAoB,OAAqB;AAClF,QAAM,WAAW,KAAK,SAAS,KAAK,QAAQ,OAAO,GAAG,KAAK,QAAQ,UAAU,CAAC;AAC9E,MAAI,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ,EAAI;AACnF,QAAM,IAAI,MAAM,GAAG,KAAK,qBAAqB,OAAO,EAAE;AACxD;AAEA,eAAsB,0BAA0B,SAI5B;AAClB,QAAM,YAAY,6BAA6B,QAAQ,MAAM;AAC7D,MAAI,CAAC,QAAQ,aAAa,CAAC,QAAQ,cAAc;AAC/C,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,QAAM,UAAU,oBAAoB,QAAQ,aAAa,IAAI,QAAQ,YAAY;AACjF,QAAM,gBAAgB,KAAK,KAAK,SAAS,cAAc,UAAU,KAAK,MAAM,GAAG,EAAE,CAAC;AAClF,QAAM,aAAa,KAAK,KAAK,eAAe,GAAG,UAAU,QAAQ,OAAO;AACxE,mBAAiB,SAAS,YAAY,6BAA6B;AACnE,QAAM,UAAU,8BAA8B,SAAS;AACvD,QAAM,UAAU,GAAG,UAAU,QAAQ,QAAQ,GAAG,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AACvF,QAAM,MAAM,eAAe,EAAE,WAAW,KAAK,CAAC;AAC9C,MAAI;AACF,UAAM,UAAU,SAAS,SAAS,MAAM;AACxC,UAAM,OAAO,SAAS,UAAU;AAAA,EAClC,SAAS,OAAO;AACd,UAAM,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjD,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,eAAsB,yBAAyB,SAIb;AAChC,QAAM,MAAM,MAAM,SAAS,QAAQ,YAAY,MAAM;AACrD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,SAAS,6BAA6B,MAAM;AAClD,QAAM,QAAQ,QAAQ,QAAQ,SAAY,KAAK,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI;AAC7E,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,mCAAmC;AAChF,QAAM,WAAW,QAAQ,kBAAkB;AAC3C,QAAM,SAAS,KAAK,MAAM,OAAO,IAAI;AACrC,MAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,2DAAsD;AAC1F,MAAI,QAAQ,SAAS,SAAU,OAAM,IAAI,MAAM,mDAA8C;AAC7F,SAAO;AACT;","names":[]}

package/dist/{chunk-5W7CTZ2E.js → chunk-KQAFEZQX.js}

@@ -1,12 +1,12 @@
-import {
-  encryptCapsuleFile
-} from "./chunk-UVYI6VIX.js";
 import {
   CAPSULE_ID_PATTERN,
   CapsuleBlockSchema,
   ExportBundleV2Schema,
   ExportManifestV2Schema
 } from "./chunk-WEHSQBFR.js";
+import {
+  encryptCapsuleFile
+} from "./chunk-X7Y7WX73.js";
 import {
   CAPSULE_SCHEMA_VERSION,
   EXPORT_FORMAT
@@ -261,4 +261,4 @@ export {
   exportCapsule,
   isValidCapsuleSince
 };
-//# sourceMappingURL=chunk-5W7CTZ2E.js.map
+//# sourceMappingURL=chunk-KQAFEZQX.js.map

package/dist/{chunk-D2YNNDML.js → chunk-KWIGDKM2.js}

@@ -2,7 +2,7 @@ import {
   readCausalTrajectoryRecordsStrict,
   readCausalTrajectoryRevisionToken,
   resolveCausalTrajectoryStoreDir
-} from "./chunk-PP7R754B.js";
+} from "./chunk-GPFZFCRN.js";
 
 // src/coding/pre-action-gate.ts
 import { createHash } from "crypto";
@@ -221,4 +221,4 @@ export {
   normalizeActionIntent,
   PreActionFailureGate
 };
-//# sourceMappingURL=chunk-D2YNNDML.js.map
+//# sourceMappingURL=chunk-KWIGDKM2.js.map