@remnic/core 9.69.39 → 9.69.40

package/dist/{chunk-TNZNSMVJ.js → chunk-DAZANIYU.js}

@@ -1,3 +1,6 @@
+import {
+  chatgptReplayNormalizer
+} from "./chunk-MMACM5G2.js";
 import {
   claudeReplayNormalizer
 } from "./chunk-54BGIBCR.js";
@@ -5,12 +8,12 @@ import {
   openclawReplayNormalizer
 } from "./chunk-H4CKS5B2.js";
 import {
-  chatgptReplayNormalizer
-} from "./chunk-MMACM5G2.js";
+  exportJsonBundle
+} from "./chunk-UP6MOYCB.js";
 import {
   exportOkfBundle,
   parseIncludeStatus
-} from "./chunk-VBSNUH4J.js";
+} from "./chunk-PKUJNICO.js";
 import {
   exportSqlite
 } from "./chunk-BV2TIZ4F.js";
@@ -32,9 +35,6 @@ import {
 import {
   exportMarkdownBundle
 } from "./chunk-765K3SAT.js";
-import {
-  exportJsonBundle
-} from "./chunk-UP6MOYCB.js";
 import {
   buildReplayNormalizerRegistry,
   clampBatchSize,
@@ -55,7 +55,7 @@ import {
 } from "./chunk-PYIFUBRK.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-TA4C3XB7.js";
+} from "./chunk-XM46Y66S.js";
 import {
   rebuildObservations
 } from "./chunk-DQTCGVFK.js";
@@ -65,18 +65,18 @@ import {
 import {
   migrateObservations
 } from "./chunk-IIFFC3RL.js";
-import {
-  lintOkfDir
-} from "./chunk-UJX4I26O.js";
-import {
-  runCompatChecks
-} from "./chunk-2524MOWK.js";
 import {
   getBulkImportSource,
   listBulkImportSources,
   registerBulkImportSource,
   runBulkImportPipeline
 } from "./chunk-HSSERO3E.js";
+import {
+  lintOkfDir
+} from "./chunk-UJX4I26O.js";
+import {
+  runCompatChecks
+} from "./chunk-2524MOWK.js";
 import {
   getUtilityLearningStatus,
   learnUtilityPromotionWeights
@@ -87,21 +87,21 @@ import {
 } from "./chunk-EBA5DA77.js";
 import {
   searchVerifiedEpisodes
-} from "./chunk-AAZEKXUP.js";
+} from "./chunk-ICNJ6J46.js";
 import {
   ThreadingManager
 } from "./chunk-OJP3N7UK.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-ENBPQEVU.js";
+} from "./chunk-QPVNK2VE.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-AENM6GKU.js";
+} from "./chunk-ZAEPD4C2.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-WBM2MVBK.js";
+} from "./chunk-7Z54NXVS.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
@@ -112,7 +112,7 @@ import {
 } from "./chunk-AM4T6CHX.js";
 import {
   parseXrayCliOptions
-} from "./chunk-4BCHFSC7.js";
+} from "./chunk-LFVZD5EC.js";
 import {
   collectPatternMemories,
   explainPatternMemory,
@@ -134,7 +134,7 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-MUTVRKKY.js";
+} from "./chunk-7D6SER6A.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -176,7 +176,7 @@ import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-UHRZ324M.js";
+} from "./chunk-BGRTZOJB.js";
 import {
   applyCommitmentLedgerLifecycle,
   getCommitmentLedgerStatus,
@@ -197,16 +197,20 @@ import {
 } from "./chunk-6TBIWIAG.js";
 import {
   parseConfig
-} from "./chunk-FWWWUPOE.js";
+} from "./chunk-5LYSEZOF.js";
 import {
+  applyManagedRegion,
   expandVaultTemplateTokens,
+  fileLines,
+  headingSurvivesRoundTrip,
+  parseAtxHeading,
   resolveVaultNotePath,
   validateRegionName
-} from "./chunk-5HYUUFMQ.js";
+} from "./chunk-XCPNH2MG.js";
 import {
   EngramAccessHttpServer,
   MeetingsInputError
-} from "./chunk-EYKIDK33.js";
+} from "./chunk-IS2IDFJP.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -216,10 +220,10 @@ import {
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal
-} from "./chunk-5SPCMAUC.js";
+} from "./chunk-ROEFLU37.js";
 import {
   EngramAccessService
-} from "./chunk-UZEHHXYC.js";
+} from "./chunk-SFHLQPBF.js";
 import {
   WorkStorage
 } from "./chunk-MPC7TYTZ.js";
@@ -234,26 +238,26 @@ import {
 } from "./chunk-P5FPO2BR.js";
 import {
   journalPath
-} from "./chunk-UZZ7SQT3.js";
+} from "./chunk-NVVZPBKI.js";
 import {
   parseRecallExplainFormat,
   renderRecallExplain,
   renderXray
-} from "./chunk-M6HBPLBA.js";
+} from "./chunk-KOTG3RXE.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-O4M4BDIJ.js";
+} from "./chunk-LKFVVN7R.js";
 import {
   getObjectiveStateStoreStatus
 } from "./chunk-HM7RHKS4.js";
 import {
   searchHarmonicRetrieval
-} from "./chunk-4RZLTZVM.js";
+} from "./chunk-IOPIGX7Y.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-GI4ZBWPQ.js";
+} from "./chunk-KY236SP5.js";
 import {
   getCueAnchorStoreStatus
 } from "./chunk-BMWN7B3Y.js";
@@ -262,7 +266,7 @@ import {
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-JTQR6L2N.js";
+} from "./chunk-2SKMZUOW.js";
 import {
   analyzeGraphHealth
 } from "./chunk-5FAGCOZD.js";
@@ -271,7 +275,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   meetingIdDate
-} from "./chunk-CZTPU65V.js";
+} from "./chunk-MVG3KXON.js";
 import {
   isValidTranscriptDate
 } from "./chunk-UHVXE24Y.js";
@@ -282,7 +286,7 @@ import {
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-IYKZJVL5.js";
+} from "./chunk-MDIEES23.js";
 import {
   normalizeProjectionPreview
 } from "./chunk-SCU65EZI.js";
@@ -393,9 +397,9 @@ import {
 } from "./chunk-3WCASNQZ.js";
 
 // src/cli.ts
-import path8 from "path";
+import path7 from "path";
 import { access, lstat as lstat3, readFile as readFile2, readdir as readdir3, realpath as realpath3, unlink } from "fs/promises";
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 
 // src/wearables/registry.ts
 var registrations = /* @__PURE__ */ new Map();
@@ -2082,215 +2086,122 @@ function registerCreationLedgerCommands(cmd, orchestrator) {
 }
 
 // src/activity/timeline/publish-cli.ts
-import { existsSync, readFileSync as readFileSync4 } from "fs";
+import { existsSync, readFileSync as readFileSync3 } from "fs";
 
 // src/activity/vault-publisher.ts
-import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
-import { chmodSync, chownSync, lstatSync, mkdirSync, readFileSync as readFileSync3, realpathSync, renameSync as renameSync2, statSync as statSync3, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "fs";
-import path5 from "path";
-
-// src/activity/vault-publish.ts
 import { createHash, randomBytes } from "crypto";
-import { readFileSync as readFileSync2, renameSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "fs";
+import { chmodSync, chownSync, lstatSync, mkdirSync, readFileSync as readFileSync2, realpathSync, renameSync, statSync as statSync2, unlinkSync as unlinkSync2, writeFileSync } from "fs";
 import path4 from "path";
-function applyManagedRegion(fileText, opts) {
-  if (opts.strategy === "heading") return applyHeadingRegion(fileText, opts.name, opts.content);
-  const startMarker = `<!-- remnic:${opts.name}:start -->`;
-  const endMarker = `<!-- remnic:${opts.name}:end -->`;
-  const rows = fileLines(fileText);
-  let startRow;
-  let endRow;
-  for (const row of rows) {
-    if (row.fenced) continue;
-    const trimmed = row.line.trim();
-    if (startRow === void 0) {
-      if (trimmed === startMarker) startRow = row;
-    } else if (endRow === void 0 && trimmed === endMarker) {
-      endRow = row;
-      break;
-    }
+
+// src/activity/vault-frontmatter.ts
+function assertNoNewlineKey(key) {
+  if (key.includes("\n") || key.includes("\r")) {
+    throw new RangeError("Vault frontmatter keys must not contain newlines.");
+  }
+}
+function applyVaultFrontmatter(existingYaml, updates) {
+  const entries = Object.entries(updates);
+  if (entries.length === 0) return existingYaml;
+  const merged = /* @__PURE__ */ new Map();
+  for (const line of existingYaml.split("\n")) {
+    const idx = line.indexOf(":");
+    if (idx === -1) continue;
+    const key = line.slice(0, idx).trim();
+    if (key.length === 0) continue;
+    assertNoNewlineKey(key);
+    merged.set(key, line.slice(idx + 1).trim());
   }
-  if (startRow === void 0 || endRow === void 0) {
-    return { ok: false, reason: "no_marker", text: fileText };
+  for (const [key, value] of entries) {
+    assertNoNewlineKey(key);
+    merged.set(key, value);
   }
-  const { body, eol } = ownedBody(fileText, opts.content);
-  return {
-    ok: true,
-    text: `${fileText.slice(0, startRow.start + startRow.line.length)}${eol}${body}${eol}${fileText.slice(endRow.start)}`
-  };
+  return [...merged.keys()].sort((a, b) => a < b ? -1 : a > b ? 1 : 0).map((key) => `${key}: ${merged.get(key)}`).join("\n");
 }
-function applyHeadingRegion(fileText, name, content) {
-  const wanted = name.trim();
-  const rows = fileLines(fileText);
-  const hits = [];
-  for (const row of rows) {
-    if (row.fenced) continue;
-    const heading = parseAtxHeading(row.line);
-    if (heading && heading.text === wanted) {
-      hits.push({ line: row.number, level: heading.level, next: row.next });
-    }
+var VAULT_PROPERTY_KEY_MAX_CHARS = 64;
+var VAULT_PROPERTY_SCALAR_MAX_CHARS = 200;
+var VAULT_PROPERTY_LIST_MAX_ITEMS = 20;
+var VAULT_PROPERTY_TOTAL_MAX_CHARS = 2e3;
+var CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/;
+var INDICATOR_CHARS = ",[]{}#&*!|>'\"%@`";
+var INJECTION_RE = /: | #/;
+var FLOW_ITEM_DELIM_RE = /[[\]{},]/;
+function renderVaultPropertyValue(value) {
+  return typeof value === "string" ? value : `[${value.join(", ")}]`;
+}
+function hasLeadingYamlIndicator(text) {
+  const first = text[0];
+  if (first === void 0) return false;
+  return INDICATOR_CHARS.includes(first) || "-?:".includes(first) && text[1] === " ";
+}
+function validateScalar(value, label) {
+  if (value.length === 0) {
+    return { ok: false, reason: `${label} must not be empty` };
   }
-  if (hits.length === 0) return { ok: false, reason: "no_heading", text: fileText };
-  if (hits.length > 1) {
-    return { ok: false, reason: "duplicate_heading", lines: hits.map((hit2) => hit2.line), text: fileText };
+  if (value.length > VAULT_PROPERTY_SCALAR_MAX_CHARS) {
+    return { ok: false, reason: `${label} exceeds ${VAULT_PROPERTY_SCALAR_MAX_CHARS} characters` };
   }
-  const hit = hits[0];
-  let sectionEnd = fileText.length;
-  for (const row of rows) {
-    if (row.start < hit.next || row.fenced) continue;
-    const heading = parseAtxHeading(row.line);
-    if (heading && heading.level <= hit.level) {
-      sectionEnd = row.start;
-      break;
-    }
+  if (CONTROL_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain control characters or line breaks` };
   }
-  const { body, eol } = ownedBody(fileText, demoteOwnedHeadings(content, hit.level));
-  const prefix = hit.next === fileText.length && !fileText.endsWith("\n") && !fileText.endsWith("\r") ? `${fileText}${eol}` : fileText.slice(0, hit.next);
-  return { ok: true, text: `${prefix}${body}${eol}${fileText.slice(sectionEnd)}` };
-}
-function demoteOwnedHeadings(content, owningLevel) {
-  const rows = fileLines(content);
-  let out = "";
-  let cursor = 0;
-  for (const row of rows) {
-    const heading = row.fenced ? null : parseAtxHeading(row.line);
-    if (heading === null) continue;
-    const level = Math.min(owningLevel + heading.level, 6);
-    const replacement = level > owningLevel ? `${"#".repeat(level)} ${heading.text}` : `**${heading.text}**`;
-    out += content.slice(cursor, row.start) + replacement;
-    cursor = row.start + row.line.length;
+  if (value !== value.trim()) {
+    return { ok: false, reason: `${label} must not carry leading or trailing whitespace` };
+  }
+  if (hasLeadingYamlIndicator(value)) {
+    return { ok: false, reason: `${label} must be a plain scalar (leading "${value[0]}" changes its YAML shape)` };
+  }
+  if (INJECTION_RE.test(value)) {
+    return { ok: false, reason: `${label} must not contain ": " or " #"` };
+  }
+  if (value.endsWith(":")) {
+    return { ok: false, reason: `${label} must not end with ":"` };
   }
-  return out + content.slice(cursor);
+  return { ok: true };
 }
-function ownedBody(fileText, content) {
-  const eol = fileText.includes("\r\n") ? "\r\n" : "\n";
-  let body = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-  if (eol === "\r\n") body = body.replace(/\n/g, "\r\n");
-  if (body.endsWith(eol)) body = body.slice(0, -eol.length);
-  return { body, eol };
-}
-function fileLines(fileText) {
-  const rows = [];
-  let start = 0;
-  let number = 1;
-  let fence = null;
-  while (start < fileText.length) {
-    let i = start;
-    while (i < fileText.length && fileText[i] !== "\n" && fileText[i] !== "\r") i++;
-    let next = i;
-    if (fileText[i] === "\r" && fileText[i + 1] === "\n") next = i + 2;
-    else if (fileText[i] === "\n" || fileText[i] === "\r") next = i + 1;
-    else next = fileText.length;
-    const line = fileText.slice(start, i);
-    const indentedCode = indentColumn(line) >= 4;
-    const run = indentedCode ? null : fenceRun(line);
-    let fenced;
-    if (fence === null) {
-      if (run !== null && !(run.char === "`" && run.info.includes("`"))) {
-        fence = { char: run.char, len: run.len };
-      }
-      fenced = fence !== null || indentedCode;
+function validateVaultProperties(entries) {
+  let total = 0;
+  for (const { key, value } of entries) {
+    if (key.length === 0) {
+      return { ok: false, reason: "property keys must not be empty" };
+    }
+    if (key.length > VAULT_PROPERTY_KEY_MAX_CHARS) {
+      return { ok: false, reason: `property key exceeds ${VAULT_PROPERTY_KEY_MAX_CHARS} characters` };
+    }
+    if (CONTROL_RE.test(key) || key !== key.trim() || key.includes(":") || key.includes("#") || hasLeadingYamlIndicator(key)) {
+      return { ok: false, reason: `property key ${JSON.stringify(key)} is not a plain mapping key` };
+    }
+    if (typeof value === "string") {
+      const scalar = validateScalar(value, `property ${key}`);
+      if (!scalar.ok) return scalar;
     } else {
-      fenced = true;
-      if (run !== null && run.char === fence.char && run.len >= fence.len && run.info.length === 0) {
-        fence = null;
+      if (!Array.isArray(value) || value.length === 0) {
+        return { ok: false, reason: `property ${key} must be a scalar string or a non-empty list of scalar strings` };
+      }
+      if (value.length > VAULT_PROPERTY_LIST_MAX_ITEMS) {
+        return { ok: false, reason: `property ${key} exceeds ${VAULT_PROPERTY_LIST_MAX_ITEMS} list items` };
+      }
+      for (const item of value) {
+        if (typeof item !== "string") {
+          return { ok: false, reason: `property ${key} must be a scalar string or a list of scalar strings` };
+        }
+        const scalar = validateScalar(item, `property ${key} list item`);
+        if (!scalar.ok) return scalar;
+        if (FLOW_ITEM_DELIM_RE.test(item)) {
+          return {
+            ok: false,
+            reason: `property ${key} list item must not contain flow delimiters "[", "]", "{", "}", or ","`
+          };
+        }
       }
     }
-    rows.push({ line, start, next, number, fenced });
-    number += 1;
-    start = next;
-  }
-  return rows;
-}
-function indentColumn(line) {
-  let col = 0;
-  for (let i = 0; i < line.length; i += 1) {
-    const ch = line[i];
-    if (ch === " ") col += 1;
-    else if (ch === "	") col += 4 - col % 4;
-    else break;
-  }
-  return col;
-}
-function fenceRun(line) {
-  const body = line.trimStart();
-  const char = body[0];
-  if (char !== "`" && char !== "~") return null;
-  let len = 0;
-  while (len < body.length && body[len] === char) len++;
-  if (len < 3) return null;
-  return { char, len, info: body.slice(len).trim() };
-}
-function parseAtxHeading(line) {
-  let at = 0;
-  let indent = 0;
-  while (at < line.length && (line[at] === " " || line[at] === "	")) {
-    indent += line[at] === " " ? 1 : 4 - indent % 4;
-    if (indent >= 4) return null;
-    at += 1;
-  }
-  let level = 0;
-  while (level < 6 && line[at + level] === "#") level++;
-  if (level === 0) return null;
-  const after = line[at + level];
-  if (after !== " " && after !== "	") return null;
-  let start = at + level + 1;
-  let end = line.length;
-  while (start < end && (line[start] === " " || line[start] === "	")) start++;
-  while (end > start && (line[end - 1] === " " || line[end - 1] === "	")) end--;
-  let hashEnd = end;
-  while (hashEnd > start && line[hashEnd - 1] === "#") hashEnd--;
-  if (hashEnd < end && hashEnd > start && (line[hashEnd - 1] === " " || line[end - 1] === "	")) {
-    end = hashEnd;
-    while (end > start && (line[end - 1] === " " || line[end - 1] === "	")) end--;
-  }
-  return { level, text: line.slice(start, end) };
-}
-function publishVaultRegion(input) {
-  const vault = expandTildePath(input.vaultPath);
-  try {
-    if (!statSync2(vault).isDirectory()) return { ok: false, reason: "not_directory" };
-  } catch {
-    return { ok: false, reason: "not_directory" };
-  }
-  if (input.relativeFile.length === 0 || path4.isAbsolute(input.relativeFile)) {
-    return { ok: false, reason: "missing_file" };
-  }
-  const root = path4.resolve(vault);
-  const dest = path4.resolve(root, input.relativeFile);
-  const rel = path4.relative(root, dest);
-  if (rel.length === 0 || rel.startsWith("..") || path4.isAbsolute(rel)) {
-    return { ok: false, reason: "missing_file" };
-  }
-  let existing;
-  try {
-    if (!statSync2(dest).isFile()) return { ok: false, reason: "missing_file" };
-    existing = readFileSync2(dest, "utf8");
-  } catch (err) {
-    if (err.code === "ENOENT") return { ok: false, reason: "missing_file" };
-    throw err;
-  }
-  const applied = applyManagedRegion(existing, {
-    strategy: "markers",
-    name: input.name,
-    content: input.content
-  });
-  if (!applied.ok) return { ok: false, reason: "no_marker" };
-  const prevHash = createHash("sha256").update(existing, "utf8").digest("hex");
-  const nextHash = createHash("sha256").update(applied.text, "utf8").digest("hex");
-  if (prevHash === nextHash) return { ok: true, status: "unchanged" };
-  const tmpPath = path4.join(path4.dirname(dest), `.remnic-vault-${randomBytes(8).toString("hex")}.tmp`);
-  writeFileSync(tmpPath, applied.text);
-  try {
-    renameSync(tmpPath, dest);
-  } catch (renameErr) {
-    try {
-      unlinkSync2(tmpPath);
-    } catch {
+    total += key.length + 2 + renderVaultPropertyValue(value).length;
+    if (total > VAULT_PROPERTY_TOTAL_MAX_CHARS) {
+      return {
+        ok: false,
+        reason: `frontmatter properties exceed the ${VAULT_PROPERTY_TOTAL_MAX_CHARS}-character total`
+      };
     }
-    throw renameErr;
   }
-  return { ok: true, status: "updated" };
+  return { ok: true };
 }
 
 // src/activity/vault-insert.ts
@@ -2420,6 +2331,32 @@ function publishVaultNote(input) {
       throw new RangeError(`Section name ${JSON.stringify(section.name)} is not a valid region name.`);
     }
   }
+  const headingsToProbe = strategy === "heading" ? input.sections.map((section) => section.name) : [];
+  if (typeof input.insertUnderHeading === "string" && input.insertUnderHeading.length > 0) {
+    headingsToProbe.push(input.insertUnderHeading);
+  }
+  for (const headingName of headingsToProbe) {
+    if (!headingSurvivesRoundTrip(headingName)) {
+      throw new RangeError(
+        `Section name ${JSON.stringify(headingName)} is not matchable by the heading parser; it must survive a render-and-parse round trip.`
+      );
+    }
+  }
+  const propertyEntries = [];
+  for (const section of input.sections) {
+    if (!section.properties) continue;
+    for (const key of Object.keys(section.properties)) {
+      const value = section.properties[key];
+      if (value === void 0) continue;
+      propertyEntries.push({ key: `${prefix}${key}`, value });
+    }
+  }
+  if (propertyEntries.length > 0) {
+    const checked = validateVaultProperties(propertyEntries);
+    if (!checked.ok) {
+      throw new RangeError(`Vault publish properties rejected: ${checked.reason}.`);
+    }
+  }
   const relative = resolveVaultNotePath(input.notePathTemplate, input.date);
   const result = publishRelative(input, relative, { strategy, propertiesMode, prefix });
   return summarizeVaultPublish(result);
@@ -2432,10 +2369,10 @@ function publishRelative(input, relative, opts) {
   } catch {
     return refuse(relative, "error", "not_directory");
   }
-  const root = path5.resolve(vault);
-  const dest = path5.resolve(root, relative);
-  const lexical = path5.relative(root, dest);
-  if (lexical.length === 0 || lexical === ".." || lexical.startsWith(`..${path5.sep}`) || path5.isAbsolute(lexical)) {
+  const root = path4.resolve(vault);
+  const dest = path4.resolve(root, relative);
+  const lexical = path4.relative(root, dest);
+  if (lexical.length === 0 || lexical === ".." || lexical.startsWith(`..${path4.sep}`) || path4.isAbsolute(lexical)) {
     return refuse(relative, "error", "path_escape");
   }
   if (!containedBySymlinks(root, dest)) {
@@ -2447,14 +2384,14 @@ function publishRelative(input, relative, opts) {
     if (lstatSync(dest).isSymbolicLink()) {
       return refuse(relative, "error", "symlinked_note");
     }
-    const st = statSync3(dest);
+    const st = statSync2(dest);
     if (st.isFile()) {
-      currentText = readFileSync3(dest, "utf8");
+      currentText = readFileSync2(dest, "utf8");
       expected = {
         ino: st.ino,
         mtimeMs: st.mtimeMs,
         size: st.size,
-        sha256: createHash2("sha256").update(currentText, "utf8").digest("hex")
+        sha256: createHash("sha256").update(currentText, "utf8").digest("hex")
       };
     } else return refuse(relative, "error", "not_a_file");
   } catch (err) {
@@ -2463,13 +2400,13 @@ function publishRelative(input, relative, opts) {
   let created = false;
   if (currentText === null) {
     if (input.createMissingNotes === true && typeof input.noteTemplate === "string" && input.noteTemplate.length > 0) {
-      const templatePath = path5.resolve(root, input.noteTemplate);
-      const templateRel = path5.relative(root, templatePath);
-      if (templateRel === ".." || templateRel.startsWith(`..${path5.sep}`) || path5.isAbsolute(templateRel) || templateRel.length === 0 || !containedBySymlinks(root, templatePath)) {
+      const templatePath = path4.resolve(root, input.noteTemplate);
+      const templateRel = path4.relative(root, templatePath);
+      if (templateRel === ".." || templateRel.startsWith(`..${path4.sep}`) || path4.isAbsolute(templateRel) || templateRel.length === 0 || !containedBySymlinks(root, templatePath)) {
         return refuse(relative, "error", "template_escape");
       }
       try {
-        const templateText = readFileSync3(templatePath, "utf8");
+        const templateText = readFileSync2(templatePath, "utf8");
         currentText = expandVaultTemplateTokens(templateText, input.date);
         if (!currentText.endsWith("\n")) currentText += "\n";
         created = true;
@@ -2516,8 +2453,8 @@ function publishRelative(input, relative, opts) {
       text = merged.text;
     }
   }
-  const prevHash = createHash2("sha256").update(original, "utf8").digest("hex");
-  const nextHash = createHash2("sha256").update(text, "utf8").digest("hex");
+  const prevHash = createHash("sha256").update(original, "utf8").digest("hex");
+  const nextHash = createHash("sha256").update(text, "utf8").digest("hex");
   if (prevHash === nextHash) {
     return withSkipped([{ path: relative, outcome: "unchanged" }]);
   }
@@ -2526,7 +2463,7 @@ function publishRelative(input, relative, opts) {
   }
   if (created) {
     try {
-      mkdirSync(path5.dirname(dest), { recursive: true });
+      mkdirSync(path4.dirname(dest), { recursive: true });
     } catch {
       return refuse(relative, "error", "mkdir_failed");
     }
@@ -2547,7 +2484,7 @@ function decorate(section, prefixed, mode) {
   const parts = [section.content];
   if (prefixed !== void 0 && mode === "dataview-inline") {
     for (const [key, value] of Object.entries(prefixed)) {
-      parts.push(`${key}:: ${value}`);
+      parts.push(`${key}:: ${renderVaultPropertyValue(value)}`);
     }
   }
   if (section.provenance !== void 0) {
@@ -2641,17 +2578,21 @@ function frontmatterUpdates(sections, prefix) {
 function mergeFrontmatterKeys(noteText, updates) {
   const entries = Object.entries(updates);
   if (entries.length === 0) return { ok: true, text: noteText };
-  for (const [key] of entries) {
-    if (key.includes("\n") || key.includes("\r") || key.trim() !== key || key.length === 0) {
-      return { ok: false, reason: "invalid_property_key" };
-    }
+  const checked = validateVaultProperties(entries.map(([key, value]) => ({ key, value })));
+  if (!checked.ok) {
+    return { ok: false, reason: "invalid_property" };
   }
   const eol = noteText.includes("\r\n") ? "\r\n" : "\n";
   const openRe = /^---\r?$/;
   const firstLineEnd = noteText.indexOf("\n");
   const firstLine = firstLineEnd === -1 ? noteText : noteText.slice(0, firstLineEnd);
   if (!openRe.test(firstLine)) {
-    const block = ["---", ...entries.map(([key, value]) => `${key}: ${value}`), "---", ""].join(eol);
+    const block = [
+      "---",
+      ...entries.map(([key, value]) => `${key}: ${renderVaultPropertyValue(value)}`),
+      "---",
+      ""
+    ].join(eol);
     return { ok: true, text: block + eol + noteText };
   }
   const lines = noteText.split(eol);
@@ -2674,13 +2615,13 @@ function mergeFrontmatterKeys(noteText, updates) {
     if (rawKey !== rawKey.trimStart()) continue;
     const key = rawKey.trimEnd();
     if (!pending.has(key)) continue;
-    lines[i] = `${rawKey}: ${pending.get(key)}`;
+    lines[i] = `${rawKey}: ${renderVaultPropertyValue(pending.get(key))}`;
     pending.delete(key);
   }
   const insertAt = closeIdx;
   const added = [];
   for (const [key, value] of pending.entries()) {
-    added.push(`${key}: ${value}`);
+    added.push(`${key}: ${renderVaultPropertyValue(value)}`);
   }
   lines.splice(insertAt, 0, ...added);
   return { ok: true, text: lines.join(eol) };
@@ -2690,13 +2631,13 @@ function containedBySymlinks(root, dest) {
   let probe = dest;
   for (; ; ) {
     try {
-      if (lstatSync(probe).isSymbolicLink() || statSync3(probe).isFile() || statSync3(probe).isDirectory()) {
+      if (lstatSync(probe).isSymbolicLink() || statSync2(probe).isFile() || statSync2(probe).isDirectory()) {
         const real = realpathSync(probe);
-        return real === realRoot || real.startsWith(`${realRoot}${path5.sep}`);
+        return real === realRoot || real.startsWith(`${realRoot}${path4.sep}`);
       }
     } catch {
     }
-    const parent = path5.dirname(probe);
+    const parent = path4.dirname(probe);
     if (parent === probe) return false;
     probe = parent;
   }
@@ -2706,11 +2647,11 @@ function setVaultPublisherTestHooks(hooks) {
   vaultPublisherTestHooks = hooks;
 }
 function writeAtomic(dest, text, expect) {
-  const tmpPath = path5.join(path5.dirname(dest), `.remnic-vault-${randomBytes2(8).toString("hex")}.tmp`);
-  writeFileSync2(tmpPath, text);
+  const tmpPath = path4.join(path4.dirname(dest), `.remnic-vault-${randomBytes(8).toString("hex")}.tmp`);
+  writeFileSync(tmpPath, text);
   let prev = null;
   try {
-    prev = statSync3(dest);
+    prev = statSync2(dest);
   } catch {
     prev = null;
   }
@@ -2724,30 +2665,30 @@ function writeAtomic(dest, text, expect) {
   vaultPublisherTestHooks?.beforeReplaceVerify?.(dest);
   try {
     const concurrent = expect === null ? prev !== null : prev === null || // the note vanished since it was read
-    prev.ino !== expect.ino || prev.mtimeMs !== expect.mtimeMs || prev.size !== expect.size || createHash2("sha256").update(readFileSync3(dest, "utf8"), "utf8").digest("hex") !== expect.sha256;
+    prev.ino !== expect.ino || prev.mtimeMs !== expect.mtimeMs || prev.size !== expect.size || createHash("sha256").update(readFileSync2(dest, "utf8"), "utf8").digest("hex") !== expect.sha256;
     if (concurrent) {
       try {
-        unlinkSync3(tmpPath);
+        unlinkSync2(tmpPath);
       } catch {
       }
       return "concurrent";
     }
   } catch {
     try {
-      unlinkSync3(tmpPath);
+      unlinkSync2(tmpPath);
     } catch {
     }
     return "concurrent";
   }
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
-      renameSync2(tmpPath, dest);
+      renameSync(tmpPath, dest);
       return "written";
     } catch (err) {
       const code = err.code;
       if (attempt === 1 || code !== "EBUSY" && code !== "EPERM") {
         try {
-          unlinkSync3(tmpPath);
+          unlinkSync2(tmpPath);
         } catch {
         }
         if (code === "EBUSY" || code === "EPERM") return "failed";
@@ -2778,6 +2719,11 @@ function runTimelinePublishCli(config, options, io) {
     );
     return 1;
   }
+  if (options.date !== void 0 && (typeof options.date !== "string" || options.date.length === 0)) {
+    io.stderr.write(`Invalid --date ${JSON.stringify(options.date ?? "")}; expected YYYY-MM-DD.
+`);
+    return 1;
+  }
   const date = typeof options.date === "string" && options.date.length > 0 ? options.date : activityDateInTimezone(/* @__PURE__ */ new Date(), config.activity?.timezone ?? "UTC");
   if (!isValidActivityDate(date)) {
     io.stderr.write(`Invalid --date "${date}"; expected YYYY-MM-DD.
@@ -2813,7 +2759,7 @@ function runTimelinePublishCli(config, options, io) {
       );
       return 1;
     }
-    sections.push({ name: target.section, content: readFileSync4(source, "utf8").trimEnd() });
+    sections.push({ name: target.section, content: readFileSync3(source, "utf8").trimEnd() });
   }
   const status = publishVaultNote({
     vaultPath: vault.vaultPath,
@@ -2861,6 +2807,11 @@ function parseKinds(raw) {
 function registerTimelineCommands(cmd, orchestrator) {
   const timelineCmd = cmd.command("timeline").description("Timeline artifacts: publish the day's recap into a markdown vault (issue #1985)");
   timelineCmd.command("publish").description("Publish timeline artifacts into the vault daily note via managed regions").option("--date <date>", "Local day to publish (YYYY-MM-DD; defaults to today)").option("--week <week>", "ISO week to publish (YYYY-Www)").option("--what <kinds>", "Comma-separated artifacts to publish (default: timeline)").option("--dry-run", "Report per-file outcomes without writing").action((...args) => {
+    if (args.some((arg) => typeof arg === "string")) {
+      process.stderr.write("timeline publish takes no positional arguments.\n");
+      process.exitCode = 1;
+      return;
+    }
     const options = args[0] ?? {};
     const code = runTimelinePublishCli(orchestrator.config, options, {
       stdout: process.stdout,
@@ -2871,10 +2822,10 @@ function registerTimelineCommands(cmd, orchestrator) {
 }
 
 // src/maintenance/rebuild-memory-lifecycle-ledger-cli.ts
-import path6 from "path";
+import path5 from "path";
 async function runRebuildMemoryLifecycleLedgerCliCommand(options) {
   const storage = options.storage;
-  const ledgerPath = path6.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
+  const ledgerPath = path5.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
   const encrypted = await probeEncryptedRegularFileHeader(ledgerPath);
   if (encrypted && !(storage?.isSecureStoreUnlocked() ?? false)) {
     throw new Error(
@@ -3372,7 +3323,7 @@ assistant> ${result.reply}
 // src/training-export/converter.ts
 import { constants } from "fs";
 import { lstat as lstat2, open, readdir as readdir2, realpath as realpath2 } from "fs/promises";
-import path7 from "path";
+import path6 from "path";
 function parseFrontmatter(raw) {
   const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
   if (!match) return null;
@@ -3412,7 +3363,7 @@ async function safeRealpath(p) {
   }
 }
 function isContainedPath(real, containmentRoot) {
-  return real === containmentRoot || real.startsWith(containmentRoot + path7.sep);
+  return real === containmentRoot || real.startsWith(containmentRoot + path6.sep);
 }
 async function collectMarkdownFiles(dir, containmentRoot) {
   const files = [];
@@ -3432,7 +3383,7 @@ async function collectMarkdownFiles(dir, containmentRoot) {
     }
     const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of sorted) {
-      const full = path7.join(d, entry.name);
+      const full = path6.join(d, entry.name);
       if (entry.isSymbolicLink()) continue;
       if (entry.isDirectory()) {
         await walk(full);
@@ -3514,9 +3465,9 @@ async function convertMemoriesToRecords(options) {
   const { memoryDir } = options;
   const containmentRoot = await safeRealpath(memoryDir);
   if (!containmentRoot) return [];
-  const dirs = RECALL_FALLBACK_DIRS.map((dir) => path7.join(memoryDir, dir));
+  const dirs = RECALL_FALLBACK_DIRS.map((dir) => path6.join(memoryDir, dir));
   if (options.includeEntities) {
-    dirs.push(path7.join(memoryDir, "entities"));
+    dirs.push(path6.join(memoryDir, "entities"));
   }
   const allFiles = [];
   for (const dir of dirs) {
@@ -3779,14 +3730,14 @@ async function runTrainingExportCliCommand(opts) {
       `Unknown training-export format "${opts.format}". ${validList}`
     );
   }
-  const { statSync: statSync4, existsSync: existsSync2 } = await import("fs");
+  const { statSync: statSync3, existsSync: existsSync2 } = await import("fs");
   if (!existsSync2(expandedMemoryDir)) {
     throw new Error(
       `--memory-dir "${opts.memoryDir}" does not exist. Provide the path to an existing memory directory.`
     );
   }
   try {
-    if (!statSync4(expandedMemoryDir).isDirectory()) {
+    if (!statSync3(expandedMemoryDir).isDirectory()) {
       throw new Error(
         `--memory-dir "${opts.memoryDir}" is not a directory. Provide the path to a memory directory, not a file.`
       );
@@ -4521,10 +4472,10 @@ function effectivePolicyValuesForVersion(values, config) {
 }
 function policyVersionForValues(values, config) {
   const normalized = effectivePolicyValuesForVersion(values, config);
-  return createHash3("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(JSON.stringify(normalized)).digest("hex").slice(0, 12);
 }
 async function readRuntimePolicySnapshot2(config, fileName) {
-  const filePath = path8.join(config.memoryDir, "state", fileName);
+  const filePath = path7.join(config.memoryDir, "state", fileName);
   const snapshot = await readRuntimePolicySnapshot(filePath, {
     maxStaleDecayThreshold: config.lifecycleArchiveDecayThreshold
   });
@@ -5301,7 +5252,7 @@ async function exists(p) {
   }
 }
 function assertSafeNamespaceSegment(namespace) {
-  if (namespace.length === 0 || namespace === "." || namespace === ".." || namespace.includes("/") || namespace.includes("\\") || path8.isAbsolute(namespace) || path8.win32.isAbsolute(namespace)) {
+  if (namespace.length === 0 || namespace === "." || namespace === ".." || namespace.includes("/") || namespace.includes("\\") || path7.isAbsolute(namespace) || path7.win32.isAbsolute(namespace)) {
     throw new Error(`invalid namespace: ${namespace}`);
   }
 }
@@ -5351,7 +5302,7 @@ async function walkMemoryMarkdownFiles(memoryDir, visit) {
     for (const entry of entries) {
       if (entry.isSymbolicLink()) continue;
       const entryName = typeof entry.name === "string" ? entry.name : entry.name.toString("utf-8");
-      const fullPath = path8.join(dir, entryName);
+      const fullPath = path7.join(dir, entryName);
       try {
         assertPathInsideRoot(memoryRootReal, await realpath3(fullPath), fullPath);
       } catch (err) {
@@ -5366,7 +5317,7 @@ async function walkMemoryMarkdownFiles(memoryDir, visit) {
       await visit(fullPath);
     }
   };
-  for (const root of RECALL_FALLBACK_DIRS.map((dir) => path8.join(memoryDir, dir))) {
+  for (const root of RECALL_FALLBACK_DIRS.map((dir) => path7.join(memoryDir, dir))) {
     await walk(root);
   }
 }
@@ -5976,7 +5927,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         if (plan.moved.length > 0) {
           console.log("\nEntries:");
           for (const move of plan.moved) {
-            console.log(`- ${path8.basename(move.from)}`);
+            console.log(`- ${path7.basename(move.from)}`);
           }
         }
         if (dryRun) {
@@ -6277,15 +6228,15 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const capsulesDir = defaultCapsulesDir(memoryDir);
         const { stat: statMerge } = await import("fs/promises");
         let sourceArchive = expandTildePath(parsed.archive);
-        const looksLikePath = sourceArchive.startsWith("/") || sourceArchive.startsWith("./") || sourceArchive.startsWith("../") || sourceArchive.includes(path8.sep);
+        const looksLikePath = sourceArchive.startsWith("/") || sourceArchive.startsWith("./") || sourceArchive.startsWith("../") || sourceArchive.includes(path7.sep);
         if (!looksLikePath) {
-          const cwdResolved = path8.resolve(sourceArchive);
+          const cwdResolved = path7.resolve(sourceArchive);
           const cwdSt = await statMerge(cwdResolved).catch(() => null);
           if (cwdSt && cwdSt.isFile()) {
             sourceArchive = cwdResolved;
           } else {
-            const byId = path8.join(capsulesDir, `${sourceArchive}.capsule.json.gz`);
-            const byIdEnc = path8.join(capsulesDir, `${sourceArchive}.capsule.json.gz.enc`);
+            const byId = path7.join(capsulesDir, `${sourceArchive}.capsule.json.gz`);
+            const byIdEnc = path7.join(capsulesDir, `${sourceArchive}.capsule.json.gz.enc`);
             const stId = await statMerge(byId).catch(() => null);
             if (stId && stId.isFile()) {
               sourceArchive = byId;
@@ -6366,10 +6317,10 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         ).sort();
         const entries = [];
         for (const archiveName of archives) {
-          const archivePath = path8.join(capsulesDir, archiveName);
+          const archivePath = path7.join(capsulesDir, archiveName);
           const id = archiveName.replace(/\.capsule\.json\.gz\.enc$/, "").replace(/\.capsule\.json\.gz$/, "");
           const manifestName = `${id}.manifest.json`;
-          const manifestPath = path8.join(capsulesDir, manifestName);
+          const manifestPath = path7.join(capsulesDir, manifestName);
           let createdAt = null;
           let pluginVersion = null;
           let fileCount = null;
@@ -6424,15 +6375,15 @@ function registerCli(api, orchestrator, registerOptions = {}) {
         const parsed = parseCapsuleInspectOptions(archiveArg, opts);
         const { stat } = await import("fs/promises");
         let archivePath = expandTildePath(parsed.archive);
-        const looksLikePath = archivePath.startsWith("/") || archivePath.startsWith("./") || archivePath.startsWith("../") || archivePath.includes(path8.sep);
+        const looksLikePath = archivePath.startsWith("/") || archivePath.startsWith("./") || archivePath.startsWith("../") || archivePath.includes(path7.sep);
         if (!looksLikePath) {
-          const cwdResolved = path8.resolve(archivePath);
+          const cwdResolved = path7.resolve(archivePath);
           const cwdSt = await stat(cwdResolved).catch(() => null);
           if (cwdSt && cwdSt.isFile()) {
             archivePath = cwdResolved;
           } else {
-            const byId = path8.join(capsulesDir, `${archivePath}.capsule.json.gz`);
-            const byIdEnc = path8.join(capsulesDir, `${archivePath}.capsule.json.gz.enc`);
+            const byId = path7.join(capsulesDir, `${archivePath}.capsule.json.gz`);
+            const byIdEnc = path7.join(capsulesDir, `${archivePath}.capsule.json.gz.enc`);
             const st = await stat(byId).catch(() => null);
             if (st && st.isFile()) {
               archivePath = byId;
@@ -8425,7 +8376,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           return;
         }
         const expandedTarget = expandTildePath(rawTarget);
-        const targetPath = path8.isAbsolute(expandedTarget) ? expandedTarget : path8.join(orchestrator.config.memoryDir, expandedTarget);
+        const targetPath = path7.isAbsolute(expandedTarget) ? expandedTarget : path7.join(orchestrator.config.memoryDir, expandedTarget);
         const { runConsolidationUndo, formatConsolidationUndoResult } = await import("./consolidation-undo.js");
         const result = await runConsolidationUndo({
           storage: orchestrator.storage,
@@ -8463,7 +8414,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         }
       });
       cmd.command("identity").description("Show agent identity reflections").action(async () => {
-        const workspaceDir = path8.join(resolveHomeDir(), ".openclaw", "workspace");
+        const workspaceDir = path7.join(resolveHomeDir(), ".openclaw", "workspace");
         const identity = await orchestrator.storage.readIdentity(workspaceDir);
         if (!identity) {
           console.log("No identity file found.");
@@ -8686,8 +8637,8 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
         const options = args[0] ?? {};
         const threadId = options.thread;
         const top = parseInt(options.top ?? "10", 10);
-        const memoryDir = path8.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
-        const threading = new ThreadingManager(path8.join(memoryDir, "threads"));
+        const memoryDir = path7.join(resolveHomeDir(), ".openclaw", "workspace", "memory", "local");
+        const threading = new ThreadingManager(path7.join(memoryDir, "threads"));
         if (threadId) {
           const thread = await threading.loadThread(threadId);
           if (!thread) {
@@ -9621,10 +9572,13 @@ export {
   runMeetingsCliCommand,
   runOkfCliCommand,
   runHarmonicSearchCliCommand,
-  applyManagedRegion,
-  fileLines,
-  parseAtxHeading,
-  publishVaultRegion,
+  applyVaultFrontmatter,
+  VAULT_PROPERTY_KEY_MAX_CHARS,
+  VAULT_PROPERTY_SCALAR_MAX_CHARS,
+  VAULT_PROPERTY_LIST_MAX_ITEMS,
+  VAULT_PROPERTY_TOTAL_MAX_CHARS,
+  renderVaultPropertyValue,
+  validateVaultProperties,
   insertMarkersUnderHeading,
   assertBeginEndPair,
   VAULT_PUBLISH_OUTCOMES,
@@ -9730,4 +9684,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-TNZNSMVJ.js.map
+//# sourceMappingURL=chunk-DAZANIYU.js.map