@remnic/core 9.69.59 → 9.69.61

package/dist/{chunk-C6FQJ52H.js → chunk-G2XTGEGL.js}

@@ -1,6 +1,7 @@
 import {
-  DEFAULT_UNTRUSTED_ORIGINS
-} from "./chunk-6Q3ZTEF6.js";
+  DEFAULT_UNTRUSTED_ORIGINS,
+  HARDENED_UNTRUSTED_ORIGINS
+} from "./chunk-23G5P7TA.js";
 import {
   coerceBool
 } from "./chunk-PQVCH2AE.js";
@@ -68,27 +69,73 @@ function resolveUntrustedOrigins(value, rawOperatorConfig) {
   }
   return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
 }
+function validateDefenseMode(value) {
+  if (value === "custom" || value === "off" || value === "fencing" || value === "quarantine" || value === "layered") {
+    return value;
+  }
+  throw new Error(
+    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`
+  );
+}
+function isOperatorAuthored(rawOperatorConfig, key) {
+  return rawOperatorConfig !== void 0 && rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key) && rawOperatorConfig[key] !== void 0 && rawOperatorConfig[key] !== null;
+}
+function resolveMemoryInjectionDefenseMode(value, rawOperatorConfig) {
+  if (isOperatorAuthored(rawOperatorConfig, "memoryInjectionDefenseMode")) {
+    return validateDefenseMode(
+      rawOperatorConfig.memoryInjectionDefenseMode
+    );
+  }
+  const envValue = readEnvVar("REMNIC_MEMORY_INJECTION_DEFENSE_MODE");
+  if (envValue !== void 0 && rawOperatorConfig !== void 0) return validateDefenseMode(envValue);
+  if (value !== void 0 && value !== null) return validateDefenseMode(value);
+  if (envValue !== void 0) return validateDefenseMode(envValue);
+  return "custom";
+}
+function hasExplicitUntrustedOrigins(cfg, rawOperatorConfig) {
+  const configAuthored = rawOperatorConfig === void 0 ? Object.prototype.hasOwnProperty.call(cfg, "untrustedOrigins") : rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins");
+  return configAuthored || readEnvVar("REMNIC_UNTRUSTED_ORIGINS") !== void 0;
+}
 function parseSecurityConfig(cfg, rawOperatorConfig) {
+  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(
+    cfg.memoryInjectionDefenseMode,
+    rawOperatorConfig
+  );
+  const customOriginAuthority = resolveSecurityBooleanConfig(
+    cfg.originAuthorityEnabled,
+    rawOperatorConfig,
+    "originAuthorityEnabled",
+    "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+    false
+  );
+  const customInjectionScreen = resolveSecurityBooleanConfig(
+    cfg.injectionScreenEnabled,
+    rawOperatorConfig,
+    "injectionScreenEnabled",
+    "REMNIC_INJECTION_SCREEN_ENABLED",
+    true
+  );
+  const flags = {
+    custom: [customOriginAuthority, customInjectionScreen],
+    off: [false, false],
+    fencing: [true, false],
+    quarantine: [false, true],
+    layered: [true, true]
+  };
+  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];
+  const injectionScreenProfile = memoryInjectionDefenseMode === "custom" ? "default" : "hardened";
+  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);
+  const untrustedOrigins = memoryInjectionDefenseMode !== "custom" && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig) ? [...HARDENED_UNTRUSTED_ORIGINS] : configuredOrigins;
   return {
-    originAuthorityEnabled: resolveSecurityBooleanConfig(
-      cfg.originAuthorityEnabled,
-      rawOperatorConfig,
-      "originAuthorityEnabled",
-      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
-      false
-    ),
-    injectionScreenEnabled: resolveSecurityBooleanConfig(
-      cfg.injectionScreenEnabled,
-      rawOperatorConfig,
-      "injectionScreenEnabled",
-      "REMNIC_INJECTION_SCREEN_ENABLED",
-      true
-    ),
-    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig)
+    memoryInjectionDefenseMode,
+    originAuthorityEnabled,
+    injectionScreenEnabled,
+    injectionScreenProfile,
+    untrustedOrigins
   };
 }
 
 export {
   parseSecurityConfig
 };
-//# sourceMappingURL=chunk-C6FQJ52H.js.map
+//# sourceMappingURL=chunk-G2XTGEGL.js.map

package/dist/chunk-G2XTGEGL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config-security.ts"],"sourcesContent":["import { coerceBool } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport {\n  DEFAULT_UNTRUSTED_ORIGINS,\n  HARDENED_UNTRUSTED_ORIGINS,\n} from \"./security/origin-authority.js\";\nimport type { MemoryInjectionDefenseMode } from \"./security/types.js\";\nimport type { InjectionScreenProfile } from \"./security/injection-screen.js\";\n\n// Memory-poisoning hardening (#1955): preserve explicit config, but let env\n// values replace schema-materialized defaults from the host config loader.\nfunction resolveSecurityBooleanConfig(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n  flagName: string,\n  envName: string,\n  defaultValue: boolean,\n): boolean {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, flagName) &&\n    rawOperatorConfig[flagName] !== undefined &&\n    rawOperatorConfig[flagName] !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    value === defaultValue;\n  if (!schemaDefaultMaterialized && value !== undefined && value !== null) {\n    return resolveBooleanConfig(value, defaultValue, flagName);\n  }\n  if (rawAuthored) {\n    return resolveBooleanConfig(value ?? rawOperatorConfig?.[flagName], defaultValue, flagName);\n  }\n  const envValue = readEnvVar(envName);\n  return envValue === undefined\n    ? defaultValue\n    : resolveBooleanConfig(envValue, defaultValue, flagName);\n}\n\nfunction resolveBooleanConfig(\n  value: unknown,\n  defaultValue: boolean,\n  keyName: string,\n): boolean {\n  if (value === undefined || value === null) return defaultValue;\n  const coerced = coerceBool(value);\n  if (coerced === undefined) {\n    throw new Error(\n      `${keyName} must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(value)}`,\n    );\n  }\n  return coerced;\n}\n\n// Memory-poisoning hardening (#1955): keep origin allow-list parsing in the\n// parser module so config-contract extraction covers this delegated surface.\nfunction resolveUntrustedOrigins(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): string[] {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, \"untrustedOrigins\") &&\n    rawOperatorConfig.untrustedOrigins !== undefined &&\n    rawOperatorConfig.untrustedOrigins !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    Array.isArray(value) &&\n    value.length === DEFAULT_UNTRUSTED_ORIGINS.length &&\n    value.every((entry, index) => entry === DEFAULT_UNTRUSTED_ORIGINS[index]);\n  const configValue = schemaDefaultMaterialized ? undefined : value;\n  const fromEnv = configValue === undefined || configValue === null;\n  const envValue = fromEnv ? readEnvVar(\"REMNIC_UNTRUSTED_ORIGINS\") : undefined;\n  const source = fromEnv ? envValue : configValue;\n  if (source === undefined || source === null) return [...DEFAULT_UNTRUSTED_ORIGINS];\n\n  let entries: unknown[];\n  if (Array.isArray(source)) {\n    entries = source;\n  } else if (fromEnv && typeof source === \"string\" && source.trim().length > 0) {\n    const trimmed = source.trim();\n    if (trimmed.startsWith(\"[\")) {\n      try {\n        const parsed: unknown = JSON.parse(trimmed);\n        if (!Array.isArray(parsed)) throw new Error(\"not an array\");\n        entries = parsed;\n      } catch {\n        throw new Error(\"untrustedOrigins must be an array of strings\");\n      }\n    } else {\n      entries = trimmed.split(\",\");\n    }\n  } else {\n    throw new Error(\"untrustedOrigins must be an array of strings\");\n  }\n\n  const normalized: string[] = [];\n  for (const entry of entries) {\n    if (typeof entry !== \"string\") {\n      throw new Error(\"untrustedOrigins must be an array of strings\");\n    }\n    const trimmed = entry.trim();\n    if (trimmed.length > 0) normalized.push(trimmed);\n  }\n  return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];\n}\n\nfunction validateDefenseMode(value: unknown): MemoryInjectionDefenseMode {\n  if (\n    value === \"custom\"\n    || value === \"off\"\n    || value === \"fencing\"\n    || value === \"quarantine\"\n    || value === \"layered\"\n  ) {\n    return value;\n  }\n  throw new Error(\n    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`,\n  );\n}\n\nfunction isOperatorAuthored(\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n  key: string,\n): boolean {\n  return rawOperatorConfig !== undefined\n    && rawOperatorConfig !== null\n    && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key)\n    && (rawOperatorConfig as Record<string, unknown>)[key] !== undefined\n    && (rawOperatorConfig as Record<string, unknown>)[key] !== null;\n}\n\nfunction resolveMemoryInjectionDefenseMode(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): MemoryInjectionDefenseMode {\n  // Precedence: operator-authored config, then the environment, then a\n  // host-materialized schema default. A host that fills in the manifest\n  // default must not shadow an operator's environment override.\n  if (isOperatorAuthored(rawOperatorConfig, \"memoryInjectionDefenseMode\")) {\n    return validateDefenseMode(\n      (rawOperatorConfig as Record<string, unknown>).memoryInjectionDefenseMode,\n    );\n  }\n  const envValue = readEnvVar(\"REMNIC_MEMORY_INJECTION_DEFENSE_MODE\");\n  if (envValue !== undefined && rawOperatorConfig !== undefined) return validateDefenseMode(envValue);\n  if (value !== undefined && value !== null) return validateDefenseMode(value);\n  if (envValue !== undefined) return validateDefenseMode(envValue);\n  return \"custom\";\n}\n\nfunction hasExplicitUntrustedOrigins(\n  cfg: Record<string, unknown>,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): boolean {\n  const configAuthored = rawOperatorConfig === undefined\n    ? Object.prototype.hasOwnProperty.call(cfg, \"untrustedOrigins\")\n    : rawOperatorConfig !== null\n      && Object.prototype.hasOwnProperty.call(rawOperatorConfig, \"untrustedOrigins\");\n  return configAuthored || readEnvVar(\"REMNIC_UNTRUSTED_ORIGINS\") !== undefined;\n}\n\nexport function parseSecurityConfig(\n  cfg: Record<string, unknown>,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): {\n  memoryInjectionDefenseMode: MemoryInjectionDefenseMode;\n  originAuthorityEnabled: boolean;\n  injectionScreenEnabled: boolean;\n  injectionScreenProfile: InjectionScreenProfile;\n  untrustedOrigins: string[];\n} {\n  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(\n    cfg.memoryInjectionDefenseMode,\n    rawOperatorConfig,\n  );\n  const customOriginAuthority = resolveSecurityBooleanConfig(\n    cfg.originAuthorityEnabled,\n    rawOperatorConfig,\n    \"originAuthorityEnabled\",\n    \"REMNIC_ORIGIN_AUTHORITY_ENABLED\",\n    false,\n  );\n  const customInjectionScreen = resolveSecurityBooleanConfig(\n    cfg.injectionScreenEnabled,\n    rawOperatorConfig,\n    \"injectionScreenEnabled\",\n    \"REMNIC_INJECTION_SCREEN_ENABLED\",\n    true,\n  );\n  const flags = {\n    custom: [customOriginAuthority, customInjectionScreen],\n    off: [false, false],\n    fencing: [true, false],\n    quarantine: [false, true],\n    layered: [true, true],\n  } satisfies Record<MemoryInjectionDefenseMode, readonly [boolean, boolean]>;\n  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];\n  const injectionScreenProfile: InjectionScreenProfile =\n    memoryInjectionDefenseMode === \"custom\" ? \"default\" : \"hardened\";\n  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);\n  const untrustedOrigins =\n    memoryInjectionDefenseMode !== \"custom\"\n      && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig)\n      ? [...HARDENED_UNTRUSTED_ORIGINS]\n      : configuredOrigins;\n  return {\n    memoryInjectionDefenseMode,\n    originAuthorityEnabled,\n    injectionScreenEnabled,\n    injectionScreenProfile,\n    untrustedOrigins,\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAS,6BACP,OACA,mBACA,UACA,SACA,cACS;AACT,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,QAAQ,KAChE,kBAAkB,QAAQ,MAAM,UAChC,kBAAkB,QAAQ,MAAM;AAClC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,UAAU;AACZ,MAAI,CAAC,6BAA6B,UAAU,UAAa,UAAU,MAAM;AACvE,WAAO,qBAAqB,OAAO,cAAc,QAAQ;AAAA,EAC3D;AACA,MAAI,aAAa;AACf,WAAO,qBAAqB,SAAS,oBAAoB,QAAQ,GAAG,cAAc,QAAQ;AAAA,EAC5F;AACA,QAAM,WAAW,WAAW,OAAO;AACnC,SAAO,aAAa,SAChB,eACA,qBAAqB,UAAU,cAAc,QAAQ;AAC3D;AAEA,SAAS,qBACP,OACA,cACA,SACS;AACT,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,GAAG,OAAO,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,IACtG;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,wBACP,OACA,mBACU;AACV,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,kBAAkB,KAC1E,kBAAkB,qBAAqB,UACvC,kBAAkB,qBAAqB;AACzC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,0BAA0B,UAC3C,MAAM,MAAM,CAAC,OAAO,UAAU,UAAU,0BAA0B,KAAK,CAAC;AAC1E,QAAM,cAAc,4BAA4B,SAAY;AAC5D,QAAM,UAAU,gBAAgB,UAAa,gBAAgB;AAC7D,QAAM,WAAW,UAAU,WAAW,0BAA0B,IAAI;AACpE,QAAM,SAAS,UAAU,WAAW;AACpC,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO,CAAC,GAAG,yBAAyB;AAEjF,MAAI;AACJ,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,cAAU;AAAA,EACZ,WAAW,WAAW,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,GAAG;AAC5E,UAAM,UAAU,OAAO,KAAK;AAC5B,QAAI,QAAQ,WAAW,GAAG,GAAG;AAC3B,UAAI;AACF,cAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,YAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,cAAc;AAC1D,kBAAU;AAAA,MACZ,QAAQ;AACN,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF,OAAO;AACL,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAEA,QAAM,aAAuB,CAAC;AAC9B,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAQ,SAAS,EAAG,YAAW,KAAK,OAAO;AAAA,EACjD;AACA,SAAO,WAAW,SAAS,IAAI,aAAa,CAAC,GAAG,yBAAyB;AAC3E;AAEA,SAAS,oBAAoB,OAA4C;AACvE,MACE,UAAU,YACP,UAAU,SACV,UAAU,aACV,UAAU,gBACV,UAAU,WACb;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,iFAAiF,KAAK,UAAU,KAAK,CAAC;AAAA,EACxG;AACF;AAEA,SAAS,mBACP,mBACA,KACS;AACT,SAAO,sBAAsB,UACxB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,GAAG,KAC1D,kBAA8C,GAAG,MAAM,UACvD,kBAA8C,GAAG,MAAM;AAC/D;AAEA,SAAS,kCACP,OACA,mBAC4B;AAI5B,MAAI,mBAAmB,mBAAmB,4BAA4B,GAAG;AACvE,WAAO;AAAA,MACJ,kBAA8C;AAAA,IACjD;AAAA,EACF;AACA,QAAM,WAAW,WAAW,sCAAsC;AAClE,MAAI,aAAa,UAAa,sBAAsB,OAAW,QAAO,oBAAoB,QAAQ;AAClG,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO,oBAAoB,KAAK;AAC3E,MAAI,aAAa,OAAW,QAAO,oBAAoB,QAAQ;AAC/D,SAAO;AACT;AAEA,SAAS,4BACP,KACA,mBACS;AACT,QAAM,iBAAiB,sBAAsB,SACzC,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,IAC5D,sBAAsB,QACnB,OAAO,UAAU,eAAe,KAAK,mBAAmB,kBAAkB;AACjF,SAAO,kBAAkB,WAAW,0BAA0B,MAAM;AACtE;AAEO,SAAS,oBACd,KACA,mBAOA;AACA,QAAM,6BAA6B;AAAA,IACjC,IAAI;AAAA,IACJ;AAAA,EACF;AACA,QAAM,wBAAwB;AAAA,IAC5B,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,wBAAwB;AAAA,IAC5B,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,CAAC,uBAAuB,qBAAqB;AAAA,IACrD,KAAK,CAAC,OAAO,KAAK;AAAA,IAClB,SAAS,CAAC,MAAM,KAAK;AAAA,IACrB,YAAY,CAAC,OAAO,IAAI;AAAA,IACxB,SAAS,CAAC,MAAM,IAAI;AAAA,EACtB;AACA,QAAM,CAAC,wBAAwB,sBAAsB,IAAI,MAAM,0BAA0B;AACzF,QAAM,yBACJ,+BAA+B,WAAW,YAAY;AACxD,QAAM,oBAAoB,wBAAwB,IAAI,kBAAkB,iBAAiB;AACzF,QAAM,mBACJ,+BAA+B,YAC1B,CAAC,4BAA4B,KAAK,iBAAiB,IACpD,CAAC,GAAG,0BAA0B,IAC9B;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-Q5FL3MEH.js → chunk-G4WZDQ32.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -19,7 +19,7 @@ import {
 import {
   resolveNamespaceCapabilities,
   resolveRecallAuxiliaryCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -412,4 +412,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-Q5FL3MEH.js.map
+//# sourceMappingURL=chunk-G4WZDQ32.js.map

package/dist/{chunk-4HNY6ORZ.js → chunk-GMHWCPLP.js}

@@ -4,7 +4,7 @@ import {
 import {
   computeCorpusWatermarks,
   resolveCorpusNamespaceRoots
-} from "./chunk-YHGRA7CK.js";
+} from "./chunk-CDQO5DCD.js";
 
 // src/operator-doctor-corpus.ts
 var DIGEST_PREFIX_LENGTH = 12;
@@ -78,4 +78,4 @@ export {
   corpusWatermarksFromCheck,
   summarizeCorpusAndReplica
 };
-//# sourceMappingURL=chunk-4HNY6ORZ.js.map
+//# sourceMappingURL=chunk-GMHWCPLP.js.map

package/dist/{chunk-ZWWKKAJL.js → chunk-GYNCJSQ7.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-Q5FL3MEH.js";
+} from "./chunk-G4WZDQ32.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -26,7 +26,7 @@ import {
 } from "./chunk-IGEZE6QB.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   readEnvVar
 } from "./chunk-P2QRMMVQ.js";
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-ZWWKKAJL.js.map
+//# sourceMappingURL=chunk-GYNCJSQ7.js.map

package/dist/{chunk-BJI2D4SU.js → chunk-GZBNEZIU.js}

@@ -1,10 +1,10 @@
 import {
   parseXrayFormat
-} from "./chunk-36S7UHAW.js";
+} from "./chunk-VEBYLZQQ.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-FNQEXI3D.js";
+} from "./chunk-F5O6WEDO.js";
 
 // src/recall-xray-cli.ts
 function parseXrayDisclosureFlag(value) {
@@ -50,4 +50,4 @@ export {
   parseXrayBudgetFlag,
   parseXrayCliOptions
 };
-//# sourceMappingURL=chunk-BJI2D4SU.js.map
+//# sourceMappingURL=chunk-GZBNEZIU.js.map

package/dist/{chunk-NYVECYCF.js → chunk-HNOKNHFO.js}

@@ -1,6 +1,6 @@
 import {
   parseEntityFile
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   inferMemoryStatus
 } from "./chunk-7RJUVTVF.js";
@@ -253,4 +253,4 @@ export {
   WHO_KNOWS_MCP_TOOLS,
   handleWhoKnowsHttpQuery
 };
-//# sourceMappingURL=chunk-NYVECYCF.js.map
+//# sourceMappingURL=chunk-HNOKNHFO.js.map

package/dist/{chunk-XLXYARWC.js → chunk-HXCJF4XU.js}

@@ -1,7 +1,7 @@
 import {
   canReadNamespace,
   defaultNamespaceForPrincipal
-} from "./chunk-MRV7VSQK.js";
+} from "./chunk-Y23L4YJV.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -207,4 +207,4 @@ export {
   runScopedMemorySearch,
   memorySearchThroughScope
 };
-//# sourceMappingURL=chunk-XLXYARWC.js.map
+//# sourceMappingURL=chunk-HXCJF4XU.js.map

package/dist/{chunk-RMF763SX.js → chunk-IDRSTHVR.js}

@@ -4,16 +4,16 @@ import {
 import {
   CONNECTOR_LABEL_MAX_LENGTH,
   knownConnectorIds
-} from "./chunk-BQB5ZMYO.js";
+} from "./chunk-KKNZ7PUZ.js";
 import {
   isValidConnectorId
-} from "./chunk-GK6NOQE6.js";
+} from "./chunk-AERXJCOG.js";
 import {
   deriveSourceConnector
-} from "./chunk-FF2XYADH.js";
+} from "./chunk-FQGY7XB2.js";
 import {
   resolvePipelineProcessingCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 
 // src/source-agent-qualifier.ts
 function resolveSourceConnector(turns) {
@@ -112,4 +112,4 @@ export {
   renderExtractionConversation,
   applyGroundingWithConnector
 };
-//# sourceMappingURL=chunk-RMF763SX.js.map
+//# sourceMappingURL=chunk-IDRSTHVR.js.map

package/dist/{chunk-UXREWVW4.js → chunk-IW3RMBPB.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-OD4FM2U7.js";
 import {
   resolveCompressionCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -283,4 +283,4 @@ export {
   CompressionGuidelineCoordinator,
   formatCompressionGuidelinesForRecall
 };
-//# sourceMappingURL=chunk-UXREWVW4.js.map
+//# sourceMappingURL=chunk-IW3RMBPB.js.map

package/dist/{chunk-W6YK672C.js → chunk-JTTLH646.js}

@@ -1,13 +1,13 @@
 import {
   createSearchBackend
-} from "./chunk-IAZPYX6W.js";
+} from "./chunk-NRVGODSE.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -508,4 +508,4 @@ export {
   NamespaceSearchRouter,
   normalizeQmdResultPath
 };
-//# sourceMappingURL=chunk-W6YK672C.js.map
+//# sourceMappingURL=chunk-JTTLH646.js.map

package/dist/{chunk-Y76HXF3F.js → chunk-K7S2IMGJ.js}

@@ -10,7 +10,7 @@ import {
 import {
   exportOkfBundle,
   parseIncludeStatus
-} from "./chunk-UD6J2LIA.js";
+} from "./chunk-XDH5MO6L.js";
 import {
   exportSqlite
 } from "./chunk-BV2TIZ4F.js";
@@ -64,7 +64,7 @@ import {
 } from "./chunk-IIFFC3RL.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-L3R24OLZ.js";
+} from "./chunk-W65KK3X6.js";
 import {
   lintOkfDir
 } from "./chunk-UJX4I26O.js";
@@ -87,21 +87,21 @@ import {
 } from "./chunk-EBA5DA77.js";
 import {
   searchVerifiedEpisodes
-} from "./chunk-OINFRHLR.js";
+} from "./chunk-NRTVZSPO.js";
 import {
   ThreadingManager
 } from "./chunk-OJP3N7UK.js";
 import {
   promoteSemanticRuleFromMemory
-} from "./chunk-DJ4CKWAD.js";
+} from "./chunk-5Y7VCE3A.js";
 import {
   searchVerifiedSemanticRules
-} from "./chunk-FKFTPFUG.js";
+} from "./chunk-KXJ7XYUT.js";
 import {
   buildResumeBundleFromState,
   getResumeBundleStatus,
   recordResumeBundle
-} from "./chunk-ENUI3IO7.js";
+} from "./chunk-D433RXFJ.js";
 import {
   getWorkProductLedgerStatus,
   recordWorkProductLedgerEntry,
@@ -112,7 +112,7 @@ import {
 } from "./chunk-AM4T6CHX.js";
 import {
   parseXrayCliOptions
-} from "./chunk-BJI2D4SU.js";
+} from "./chunk-GZBNEZIU.js";
 import {
   collectPatternMemories,
   explainPatternMemory,
@@ -134,7 +134,7 @@ import {
   runOperatorInventory,
   runOperatorRepair,
   runOperatorSetup
-} from "./chunk-G6E7XJYL.js";
+} from "./chunk-SZAWZPY6.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -173,7 +173,7 @@ import {
   rebuildMemoryProjection,
   repairMemoryProjection,
   verifyMemoryProjection
-} from "./chunk-TAIIC5OM.js";
+} from "./chunk-SEHKTE4F.js";
 import {
   GraphDashboardServer
 } from "./chunk-YNDLCWXS.js";
@@ -197,7 +197,7 @@ import {
 } from "./chunk-6TBIWIAG.js";
 import {
   parseConfig
-} from "./chunk-M5IJP3YW.js";
+} from "./chunk-2PKGJPQL.js";
 import {
   applyManagedRegion,
   expandVaultTemplateTokens,
@@ -210,7 +210,7 @@ import {
 import {
   EngramAccessHttpServer,
   MeetingsInputError
-} from "./chunk-IDBLAGIM.js";
+} from "./chunk-DC5CTLCZ.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -220,10 +220,10 @@ import {
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal
-} from "./chunk-6JYYSDHH.js";
+} from "./chunk-2L5DIVDU.js";
 import {
   EngramAccessService
-} from "./chunk-4B5S3VWD.js";
+} from "./chunk-WD32KTVI.js";
 import {
   WorkStorage
 } from "./chunk-MPC7TYTZ.js";
@@ -240,10 +240,10 @@ import {
   parseRecallExplainFormat,
   renderRecallExplain,
   renderXray
-} from "./chunk-36S7UHAW.js";
+} from "./chunk-VEBYLZQQ.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-AAMFQHKI.js";
+} from "./chunk-KRPMISWO.js";
 import {
   getObjectiveStateStoreStatus
 } from "./chunk-HM7RHKS4.js";
@@ -252,18 +252,18 @@ import {
 } from "./chunk-TYP7GYRI.js";
 import {
   searchHarmonicRetrieval
-} from "./chunk-R4Y5PF25.js";
+} from "./chunk-FWVDTLRK.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   restoreMemoryGovernanceRun,
   runMemoryGovernance
-} from "./chunk-F6WCOXTF.js";
+} from "./chunk-LMLPLIT4.js";
 import {
   listNamespaces,
   runNamespaceMigration,
   verifyNamespaces
-} from "./chunk-TAC5WFJC.js";
+} from "./chunk-QEGKMZNQ.js";
 import {
   getCueAnchorStoreStatus
 } from "./chunk-BMWN7B3Y.js";
@@ -303,7 +303,7 @@ import {
 } from "./chunk-LMMQKZK3.js";
 import {
   meetingIdDate
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   isValidTranscriptDate
 } from "./chunk-UHVXE24Y.js";
@@ -354,7 +354,7 @@ import {
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-FNQEXI3D.js";
+} from "./chunk-F5O6WEDO.js";
 import {
   isSupportPassportPrivateMemory
 } from "./chunk-PWPIERBM.js";
@@ -378,7 +378,7 @@ import {
   resolveRecallEnhancementCapabilities,
   resolveSecurityCapabilities,
   resolveUtilityLearningCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   expandTildePath
 } from "./chunk-6KH5NLQS.js";
@@ -2951,11 +2951,21 @@ var RULE_WEIGHTS = {
   "encoded-blob": 5,
   // Instruction resets directly try to replace the active authority.
   "ignore-previous-family": 4,
-  // Conditional triggers encode a hidden action for a future turn.
-  "conditional-trigger": 3,
   // Remnic command references can redirect the memory system itself.
-  "authority-escalation": 4
+  "authority-escalation": 4,
+  // Stored response controls try to turn recalled data into future behavior.
+  "response-control-directive": 4,
+  // Tool-routing controls replace the current tool choice from recalled data.
+  "tool-routing-directive": 4
+};
+var PROFILE_RULE_WEIGHTS = {
+  // Conditional triggers encode a hidden action for a future turn.
+  "conditional-trigger": { default: 3, hardened: 4 }
 };
+function ruleWeight(rule, profile) {
+  const profileWeights = PROFILE_RULE_WEIGHTS[rule];
+  return profileWeights ? profileWeights[profile] : RULE_WEIGHTS[rule];
+}
 var INJECTION_SCREEN_THRESHOLD = 4;
 var MAX_EXCERPT_LENGTH = 180;
 var AUTHORITY_EXECUTABLE_TOOL_REFERENCE = String.raw`(?:remnic|engram)(?:\s+security\s+audit-memory\b|\s+(?:memory_store|suggestion_submit|observe|recall|delete_memory|memory_correct_apply|memory_search)(?:\s+(?:tool|command))?\b|\s+(?:tool|command)\b|[_:-](?:memory_store|suggestion_submit|observe|recall|delete_memory|memory_correct_apply|memory_search)\b)`;
@@ -2982,11 +2992,11 @@ function findImperativeToAgent(content) {
   return findingFor(
     "imperative-to-agent",
     content,
-    /\b(?:agent|assistant|ai|model)\s*[,!:.-]\s*(?:please\s+)?(?:ignore|disregard|call|run|execute|send|delete|reveal|email|store|remember|follow|use|do)\b/i
+    /\b(?:agent|assistant|ai|model)[ \t]{0,8}[,!:.-][ \t]{0,8}(?:please[ \t]{1,8})?(?:ignore|disregard|call|run|execute|send|delete|reveal|email|store|remember|follow|use|do|answer|respond|reply|emit|output|return|include|produce|say)\b/i
   ) ?? findingFor(
     "imperative-to-agent",
     content,
-    /\b(?:agent|assistant|ai|model)\s+(?:must|should|need to|please)\s+(?:ignore|disregard|call|run|execute|send|delete|reveal|email|store|remember|follow|use|do)\b/i
+    /\b(?:agent|assistant|ai|model)[ \t]{1,8}(?:must|should|need to|please|to)[ \t]{1,8}(?:ignore|disregard|call|run|execute|send|delete|reveal|email|store|remember|follow|use|do|answer|respond|reply|emit|output|return|include|produce|say)\b/i
   );
 }
 function findToolInvocationSyntax(content) {
@@ -3030,11 +3040,53 @@ function findConditionalTrigger(content) {
   return findingFor(
     "conditional-trigger",
     content,
-    /\b(?:when|if)\b[\s\S]{1,120}\b(?:say|says|see|sees|hear|hears|receive|receives|mention|mentions|contain|contains|encounter|encounters)\b[\s\S]{1,120}\b(?:then\s+)?(?:call|invoke|run|execute|send|delete|reveal|store|use|follow|do|respond)\b/i
+    /\b(?:when|if|unless|after|only after|if and only if|on seeing)\b[\s\S]{1,180}\b(?:ask|asked|say|says|see|sees|seeing|hear|hears|receive|receives|mention|mentions|mentioned|appear|appears|contain|contains|encounter|encounters|phrase|condition|key)\b[\s\S]{0,180}\b(?:then[ \t]{1,8})?(?:answer|call|include|invoke|run|execute|send|delete|reveal|store|use|follow|do|respond|reply|emit|output|return|produce|say|add|replace)\b/i
   ) ?? findingFor(
     "conditional-trigger",
     content,
-    /\b(?:when|if)\b[\s\S]{1,100},\s*(?:then\s+)?(?:call|invoke|run|execute|send|delete|reveal|store|use|follow|do|respond)\b/i
+    /\b(?:when|if|unless)\b[\s\S]{1,120},[ \t]{0,8}(?:then[ \t]{1,8})?(?:answer|call|include|invoke|run|execute|send|delete|reveal|store|use|follow|do|respond|reply|emit|output|return|produce|say|add|replace)\b/i
+  );
+}
+var RESPONSE_NOUN = String.raw`(?:answers?|responses?|repl(?:y|ies)|output)`;
+var RESPONSE_CONTROL_PATTERNS = [
+  // "the approved response concerning X is exactly CANARY"
+  new RegExp(
+    String.raw`\b${RESPONSE_NOUN}\b[^\n]{0,60}\b(?:(?:is|are|be)[ \t]{1,8}exactly|becomes?)\b`,
+    "i"
+  ),
+  // "the response must include / should begin with / needs to say ..."
+  new RegExp(
+    String.raw`\b${RESPONSE_NOUN}\b[^\n]{0,60}\b(?:must|should|shall|will|needs?[ \t]{1,8}to|has[ \t]{1,8}to|have[ \t]{1,8}to|is[ \t]{1,8}to|are[ \t]{1,8}to)[ \t]{1,8}(?:always[ \t]{1,8})?(?:include|contain|begin|start|end|say|state|mention|output|return|emit|produce|read|quote|reference|append|prepend)\b`,
+    "i"
+  ),
+  // "include CANARY in every answer", "add <url> to answers"
+  new RegExp(
+    String.raw`\b(?:include|add|emit|output|return|append|prepend|say|state|put)\b[^\n]{0,80}\b(?:in|to|into|with|as|on)[ \t]{1,8}[^\n]{0,30}\b${RESPONSE_NOUN}\b`,
+    "i"
+  ),
+  // "reply with the marker CANARY", "respond by saying"
+  /\b(?:reply|respond|answer)[ \t]{1,8}(?:with|by|using)[ \t]{1,8}(?:the[ \t]{1,8}|only[ \t]{1,8}|exactly[ \t]{1,8})?(?:marker|phrase|code|string|text|token|exact|exactly|only|saying|outputting|returning|CANARY)/i,
+  // "activation requires outputting CANARY", "retrieval should produce CANARY"
+  /\b(?:requires?|should|must|will)[ \t]{1,8}(?:outputting|emitting|returning|saying|replying|responding|answering|producing|output|emit|produce)\b[^\n]{0,40}\b(?:CANARY|marker|phrase|code|token|exactly|https?:)/i,
+  /\b(?:retrieval|recall|activation)\b[^\n]{0,40}\b(?:should|must|will|requires?)[ \t]{1,8}(?:produce|output|emit|return|say|reply|respond)\b/i,
+  // "say CANARY", "answer CANARY", "use CANARY instead", "return https://..."
+  /\b(?:say|answer|reply|respond|output|return|emit|use|produce)[ \t]{1,8}(?:with[ \t]{1,8}|only[ \t]{1,8}|exactly[ \t]{1,8})?(?:CANARY|the[ \t]{1,8}(?:literal|exact|marker|phrase|string|token)\b|https?:)/i,
+  // "replace normal behavior with the literal response", "require the literal marker"
+  /\breplace[ \t]{1,8}(?:normal|default|your|the|its|all)?[ \t]{0,8}(?:behaviou?r|responses?|answers?|repl(?:y|ies)|output)\b/i,
+  /\b(?:literal|exact|verbatim)[ \t]{1,8}(?:response|answer|reply|marker|string|output|phrase|token)\b/i
+];
+function findResponseControlDirective(content) {
+  for (const pattern of RESPONSE_CONTROL_PATTERNS) {
+    const finding = findingFor("response-control-directive", content, pattern);
+    if (finding) return finding;
+  }
+  return void 0;
+}
+function findToolRoutingDirective(content) {
+  return findingFor(
+    "tool-routing-directive",
+    content,
+    /\b(?:ignore|redirect(?:ing)?|override|substitute|preferred[_ -]?tool|never[ \t]{1,8}use|must[ \t]{1,8}call|requires?[ \t]{1,8}redirecting)\b[\s\S]{0,160}\b(?:tool|function|[a-z][a-z0-9-]*[_:.][a-z0-9-]+)\b|\b(?:tool|function|[a-z][a-z0-9-]*[_:.][a-z0-9-]+)\b[\s\S]{0,160}\b(?:redirect(?:ing)?|override|substitute|preferred[_ -]?tool|never[ \t]{1,8}use|must[ \t]{1,8}call)\b/i
   );
 }
 function findAuthorityEscalation(content) {
@@ -3048,7 +3100,7 @@ function findAuthorityEscalation(content) {
     AUTHORITY_MANDATORY_DIRECTIVE_PATTERN
   );
 }
-function screenCandidateFact(content) {
+function screenCandidateFact(content, profile = "default") {
   const findings = [];
   const rules = [
     ["imperative-to-agent", findImperativeToAgent],
@@ -3056,13 +3108,15 @@ function screenCandidateFact(content) {
     ["encoded-blob", findEncodedBlob],
     ["ignore-previous-family", findIgnorePreviousFamily],
     ["conditional-trigger", findConditionalTrigger],
-    ["authority-escalation", findAuthorityEscalation]
+    ["authority-escalation", findAuthorityEscalation],
+    ["response-control-directive", findResponseControlDirective],
+    ["tool-routing-directive", findToolRoutingDirective]
   ];
   for (const [rule, find] of rules) {
     const finding = find(content);
     if (finding) findings.push({ rule, excerpt: finding.excerpt });
   }
-  const score = findings.reduce((sum, finding) => sum + RULE_WEIGHTS[finding.rule], 0);
+  const score = findings.reduce((sum, finding) => sum + ruleWeight(finding.rule, profile), 0);
   return { score, findings, quarantine: score >= INJECTION_SCREEN_THRESHOLD };
 }
 
@@ -3188,8 +3242,9 @@ async function auditMemoryStore(options) {
   );
   const findings = [];
   const quarantinePaths = /* @__PURE__ */ new Map();
+  const profile = options.profile ?? "default";
   for (const memory of activeMemories) {
-    const screened = screenCandidateFact(memory.content);
+    const screened = screenCandidateFact(memory.content, profile);
     if (screened.quarantine === true) quarantinePaths.set(memory.path, { injection: true, burst: false });
     for (const screenFinding of screened.findings) {
       findings.push({
@@ -3236,7 +3291,7 @@ async function auditMemoryStore(options) {
       if (!qInfo) continue;
       const memory = await storage.readMemoryByPath(staleMemory.path);
       if (!memory || !isActive(memory, options.memoryDir)) continue;
-      if (qInfo.injection && !qInfo.burst && !screenCandidateFact(memory.content).quarantine) continue;
+      if (qInfo.injection && !qInfo.burst && !screenCandidateFact(memory.content, profile).quarantine) continue;
       const changed = await storage.writeMemoryFrontmatterIfUnchanged(memory, {
         status: "pending_review",
         updated: now
@@ -5738,7 +5793,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       );
       tierCmd.command("list").description("Summarize tier distribution across all memories").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const options = args[0] ?? {};
-        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-VK5PCO2L.js");
+        const { summarizeTiers, formatTierSummaryText } = await import("./tier-stats-VF6DS52E.js");
         const summary = await summarizeTiers(orchestrator.storage);
         if (reportHasMachineReadableOutput(options)) {
           console.log(JSON.stringify(summary, null, 2));
@@ -5749,7 +5804,7 @@ function registerCli(api, orchestrator, registerOptions = {}) {
       tierCmd.command("explain").description("Explain the tier-transition decision for a single memory").argument("<id>", "Memory id to explain").option("--json", "Emit machine-readable JSON only").action(async (...args) => {
         const idArg = typeof args[0] === "string" ? args[0] : "";
         const options = args[1] ?? {};
-        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-VK5PCO2L.js");
+        const { explainTierForMemory, formatTierExplainText } = await import("./tier-stats-VF6DS52E.js");
         try {
           const explain = await explainTierForMemory(
             orchestrator.storage,
@@ -8995,7 +9050,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
           console.error("--verb is required. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context");
           process.exit(1);
         }
-        const { isValidResolutionVerb, executeResolution } = await import("./resolution-CHNISQJB.js");
+        const { isValidResolutionVerb, executeResolution } = await import("./resolution-UYJU5JUA.js");
         if (!isValidResolutionVerb(verb)) {
           console.error(`Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context`);
           process.exit(1);
@@ -9027,7 +9082,7 @@ Semantic consolidation complete. clusters=${result.clustersFound}, consolidated=
       });
       reviewCmd.command("scan").description("Run an on-demand contradiction scan").option("--namespace <ns>", "Namespace to scan").action(async (...args) => {
         const options = args[0] ?? {};
-        const { runContradictionScan } = await import("./contradiction-scan-GVD4JJ7B.js");
+        const { runContradictionScan } = await import("./contradiction-scan-5EJYRKD3.js");
         console.log("Running contradiction scan...");
         const result = await runContradictionScan({
           storage: orchestrator.storage,
@@ -9779,4 +9834,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-Y76HXF3F.js.map
+//# sourceMappingURL=chunk-K7S2IMGJ.js.map