@remnic/core 9.69.87 → 9.69.88

package/dist/{capsule-crypto-7FJQINUR.js → capsule-crypto-YO5QJ6L3.js}

@@ -3,7 +3,7 @@ import {
   decryptCapsuleFileInMemory,
   encryptCapsuleFile,
   isEncryptedCapsuleFile
-} from "./chunk-X7Y7WX73.js";
+} from "./chunk-DQEMWVMT.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
@@ -15,4 +15,4 @@ export {
   encryptCapsuleFile,
   isEncryptedCapsuleFile
 };
-//# sourceMappingURL=capsule-crypto-7FJQINUR.js.map
+//# sourceMappingURL=capsule-crypto-YO5QJ6L3.js.map

package/dist/{capsule-merge-3MNURAQ3.js → capsule-merge-ZCXUPLNJ.js}

@@ -21,7 +21,6 @@ import "./chunk-42JKGUFJ.js";
 import {
   parseExportBundle
 } from "./chunk-WEHSQBFR.js";
-import "./chunk-FFAZ2XFU.js";
 import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot,
@@ -29,6 +28,7 @@ import {
   isPathInsideRoot,
   sha256String
 } from "./chunk-GCGJW34D.js";
+import "./chunk-FFAZ2XFU.js";
 import "./chunk-VS2IYZRU.js";
 import "./chunk-KNA3BXXL.js";
 import "./chunk-3WCASNQZ.js";
@@ -277,4 +277,4 @@ async function readLocalFile(absPath) {
 export {
   mergeCapsule
 };
-//# sourceMappingURL=capsule-merge-3MNURAQ3.js.map
+//# sourceMappingURL=capsule-merge-ZCXUPLNJ.js.map

package/dist/causal-behavior.js

@@ -1,11 +1,11 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-K4J4E7WV.js";
+} from "./chunk-LO4UKPKX.js";
 import "./chunk-B7RWBZXW.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-N4S4NUX5.js";
+} from "./chunk-B3O3IRZN.js";
 import {
   normalizeRecallTokens
 } from "./chunk-YCVB7X56.js";

package/dist/causal-chain.js

@@ -6,9 +6,9 @@ import {
   stitchCausalChain,
   validateCausalEdge,
   writeChainIndex
-} from "./chunk-K4J4E7WV.js";
+} from "./chunk-LO4UKPKX.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-N4S4NUX5.js";
+import "./chunk-B3O3IRZN.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-B6O2YLUR.js";

package/dist/causal-consolidation.js

@@ -1,15 +1,15 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-K4J4E7WV.js";
+} from "./chunk-LO4UKPKX.js";
 import {
   buildExtensionsBlockForConsolidation
-} from "./chunk-4BZP2B4U.js";
+} from "./chunk-M6C7SOR6.js";
 import "./chunk-5JMAGU26.js";
 import "./chunk-B7RWBZXW.js";
 import {
   runPostConsolidationMaterialize
-} from "./chunk-QVS22WTO.js";
+} from "./chunk-QI7K7BZ5.js";
 import "./chunk-3UXOZBHV.js";
 import "./chunk-PIWFNPQT.js";
 import "./chunk-TOTT6S2V.js";
@@ -18,20 +18,20 @@ import "./chunk-ZCUTSMR2.js";
 import "./chunk-QDW3E4RD.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-N4S4NUX5.js";
-import "./chunk-FRCESVV6.js";
+} from "./chunk-B3O3IRZN.js";
+import "./chunk-STEOT4DI.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-46WM6JX2.js";
-import "./chunk-D5F7TKMH.js";
-import "./chunk-RJLV4BKR.js";
-import "./chunk-SLEAJ67D.js";
-import "./chunk-S7LWX2PQ.js";
+import "./chunk-V4JZCTMK.js";
+import "./chunk-LV5H6FTN.js";
+import "./chunk-4OQET73E.js";
 import "./chunk-T2YX56QI.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-T3FMRLWQ.js";
 import "./chunk-7VO6E5UD.js";
-import "./chunk-4O6WRBGE.js";
 import "./chunk-Z4TXB4K7.js";
+import "./chunk-S7LWX2PQ.js";
+import "./chunk-4O6WRBGE.js";
 import "./chunk-GUMZC2BO.js";
 import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
@@ -40,15 +40,15 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
-import "./chunk-LDXUBPMO.js";
 import "./chunk-DM2T26WE.js";
+import "./chunk-LDXUBPMO.js";
 import "./chunk-FF6N7BXC.js";
 import "./chunk-2DT7PIDZ.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-DUJYRVUD.js";
+import "./chunk-6O2VUWV6.js";
+import "./chunk-ZIKENA2C.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-YXZG5TVN.js";
-import "./chunk-ZIKENA2C.js";
 import "./chunk-345MEMRU.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-5GINB5LC.js";
@@ -83,20 +83,20 @@ import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-Z7L72ZHL.js";
 import "./chunk-4O4TKIXQ.js";
-import "./chunk-GDYU6VF4.js";
+import "./chunk-5AYUHSAU.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-VYCOJKSX.js";
+import "./chunk-PO7NXNGC.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
 import "./chunk-L272A5QW.js";
-import "./chunk-JE334SIA.js";
+import "./chunk-22DYJLFN.js";
 import "./chunk-ZA53AZND.js";
 import "./chunk-7RJUVTVF.js";
 import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-C7HJ3NEI.js";
-import "./chunk-NB3LRY4T.js";
+import "./chunk-N4PYB235.js";
 import "./chunk-AW4QUFQF.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-FFAZ2XFU.js";
@@ -122,7 +122,7 @@ import {
   readJsonFile
 } from "./chunk-B6O2YLUR.js";
 import "./chunk-FF4KLI5W.js";
-import "./chunk-JN72EPOE.js";
+import "./chunk-MAAL6OZV.js";
 import "./chunk-A6XUJE5D.js";
 import "./chunk-VS2IYZRU.js";
 import "./chunk-KNA3BXXL.js";

package/dist/causal-retrieval.js

@@ -1,12 +1,12 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-K4J4E7WV.js";
+} from "./chunk-LO4UKPKX.js";
 import "./chunk-B7RWBZXW.js";
 import {
   readCausalTrajectoryRecords,
   searchCausalTrajectories
-} from "./chunk-N4S4NUX5.js";
+} from "./chunk-B3O3IRZN.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-B6O2YLUR.js";

package/dist/causal-trajectory-graph.js

@@ -1,11 +1,11 @@
 import {
   appendEdge
-} from "./chunk-ICZQG4XE.js";
+} from "./chunk-5FAGCOZD.js";
 import "./chunk-EUT2WCWS.js";
+import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-LXY5VVGM.js";
 import "./chunk-GKCXTSFF.js";
-import "./chunk-2LSZVONP.js";
 import "./chunk-FFAZ2XFU.js";
 import "./chunk-KNA3BXXL.js";
 import "./chunk-PZ5AY32C.js";

package/dist/causal-trajectory.js

@@ -9,7 +9,7 @@ import {
   resolveCausalTrajectoryStoreDir,
   searchCausalTrajectories,
   validateCausalTrajectoryRecord
-} from "./chunk-N4S4NUX5.js";
+} from "./chunk-B3O3IRZN.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-B6O2YLUR.js";

package/dist/{chunk-JE334SIA.js → chunk-22DYJLFN.js}

@@ -31,7 +31,7 @@ import {
   MAGIC_HEADER_SIZE,
   SecureStoreLockedError,
   isEncryptedFile
-} from "./chunk-JN72EPOE.js";
+} from "./chunk-MAAL6OZV.js";
 import {
   isErrnoCode
 } from "./chunk-KNA3BXXL.js";
@@ -753,4 +753,4 @@ export {
   drainPendingLifecycleLedgerForSync,
   drainPendingLifecycleForSyncOrThrow
 };
-//# sourceMappingURL=chunk-JE334SIA.js.map
+//# sourceMappingURL=chunk-22DYJLFN.js.map

package/dist/{chunk-JGSQ6P4D.js → chunk-2DLWLNO4.js}

@@ -1,9 +1,9 @@
 import {
   NamespaceStorageRouter
-} from "./chunk-BFO3IR56.js";
+} from "./chunk-SWBC3UER.js";
 import {
   namespaceCollectionName
-} from "./chunk-RJLV4BKR.js";
+} from "./chunk-LV5H6FTN.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-PCXDUHQH.js";
@@ -213,4 +213,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-JGSQ6P4D.js.map
+//# sourceMappingURL=chunk-2DLWLNO4.js.map

package/dist/{chunk-LS3XH3UE.js → chunk-2NAD4YCI.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-FRCESVV6.js";
+} from "./chunk-STEOT4DI.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-LS3XH3UE.js.map
+//# sourceMappingURL=chunk-2NAD4YCI.js.map

package/dist/{chunk-SY5KDWGU.js → chunk-2WLMWP2T.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-NHLLKEKK.js";
 import {
   parseConfig
-} from "./chunk-3GQC3NMB.js";
+} from "./chunk-H56VY4BY.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-SY5KDWGU.js.map
+//# sourceMappingURL=chunk-2WLMWP2T.js.map

package/dist/{chunk-P6WFK4ZJ.js → chunk-3O5BB45T.js}

@@ -3,7 +3,7 @@ import {
   headerConnector,
   renderExtractionConversation,
   resolveSourceConnector
-} from "./chunk-HESDNYRB.js";
+} from "./chunk-76M5OK7V.js";
 import {
   normalizeReasoningTrace
 } from "./chunk-54V4BZWP.js";
@@ -82,7 +82,7 @@ import {
 } from "./chunk-5MA7ZLPD.js";
 import {
   LocalLlmClient
-} from "./chunk-S7GCT7NU.js";
+} from "./chunk-RBITPCMK.js";
 import {
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
@@ -99,7 +99,7 @@ import {
 } from "./chunk-EP6BA7VV.js";
 import {
   isMemoryCategory
-} from "./chunk-GDYU6VF4.js";
+} from "./chunk-5AYUHSAU.js";
 import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
@@ -2437,4 +2437,4 @@ export {
   shouldEnableLocalExtractionThinking,
   ExtractionEngine
 };
-//# sourceMappingURL=chunk-P6WFK4ZJ.js.map
+//# sourceMappingURL=chunk-3O5BB45T.js.map

package/dist/{chunk-SOZUJCME.js → chunk-3SGTV7RD.js}

@@ -1,7 +1,7 @@
 import {
   buildStandup,
   parseStandupDate
-} from "./chunk-CUCWX3MO.js";
+} from "./chunk-AEHVZY3X.js";
 import {
   backfillMemoryStorage,
   runLocationBackfill,
@@ -9,23 +9,23 @@ import {
   runLocationDay,
   runLocationStatus,
   runLocationSync
-} from "./chunk-MQJL6CDZ.js";
+} from "./chunk-QAW55ZHJ.js";
 import {
   externalWikiSearchOperation
-} from "./chunk-FAN73COB.js";
+} from "./chunk-BGI4NUAO.js";
 import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-FOH7AMMI.js";
+} from "./chunk-QB57WIS6.js";
 import {
   CorrectionContractError
 } from "./chunk-QLK3SL7Q.js";
 import {
   memoryStoreRequestSchema,
   retainedCategoryAlias
-} from "./chunk-3C3J243X.js";
+} from "./chunk-LW3HKRL7.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1914,4 +1914,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-SOZUJCME.js.map
+//# sourceMappingURL=chunk-3SGTV7RD.js.map

package/dist/{chunk-YITN5WXI.js → chunk-4KN2JLQV.js}

@@ -3,7 +3,7 @@ import {
   getOperation,
   operationRequiresAuthorizedNamespace,
   operationUsesPrincipalNamespace
-} from "./chunk-FOH7AMMI.js";
+} from "./chunk-QB57WIS6.js";
 import {
   assertOperationAuthorizationAllowed
 } from "./chunk-IG747LRN.js";
@@ -60,4 +60,4 @@ export {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace
 };
-//# sourceMappingURL=chunk-YITN5WXI.js.map
+//# sourceMappingURL=chunk-4KN2JLQV.js.map

package/dist/{chunk-JKMHZF3Q.js → chunk-4MP7XR5J.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-FRCESVV6.js";
+} from "./chunk-STEOT4DI.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-JKMHZF3Q.js.map
+//# sourceMappingURL=chunk-4MP7XR5J.js.map

package/dist/chunk-4NSLQ7EU.js

@@ -0,0 +1,137 @@
+// src/offline-sync-exclude-globs.ts
+var OFFLINE_DECRYPT_STAGING_DIR_PREFIX = ".remnic-offline-decrypt-";
+var DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS = [
+  // Leading `**/` matches zero or more segments, so each pattern covers both
+  // the root `state/` dir AND per-namespace `namespaces/<ns>/state/` dirs
+  // (Cursor review on PR #1793: multi-namespace deployments previously kept
+  // pushing their namespaced live sqlite files).
+  "**/state/*.sqlite",
+  "**/state/*.sqlite-*",
+  "**/state/index_tags.json",
+  "**/state/entity-mention-index.json",
+  "**/state/memory-governance/runs/**",
+  // Rotated recall-impression archives (issue #1910). The active
+  // recall_impressions.jsonl stays remote-authoritative; only the .1..N
+  // archives and the .lock are node-local and never pushed/hashed.
+  "**/state/recall_impressions.jsonl.*",
+  // Durable recall-impression pending spill directory (issue #2033). Node-local:
+  // an impression spills a per-event file here when its rotation lock cannot be
+  // acquired, and the next lock holder folds them back into the synced active
+  // recall_impressions.jsonl. The `.*` glob above matches the directory name but
+  // not its children, so exclude the contents explicitly.
+  "**/state/recall_impressions.jsonl.pending.d/**",
+  // Durable lifecycle-append pending spill directory (issue #2033). Node-local:
+  // an append spills a per-event file here when it cannot get the ledger lock,
+  // and the next lock holder folds them back into the synced
+  // memory-lifecycle-ledger.jsonl. Pushing them would duplicate rows remotely.
+  // The offline-sync snapshot entrypoints drain this queue first (access-service
+  // `drainPendingLifecycleForSync` -> `StorageManager.drainPendingMemoryLifecycleEventsForSync`),
+  // aborting the snapshot when durable rows cannot be folded, so excluding the
+  // dir never silently drops append-only lifecycle history (promotions/imports).
+  "**/state/memory-lifecycle-ledger.jsonl.pending.d/**",
+  // The active lifecycle ledger lock is node-local and must never be
+  // transferred to another node during an offline snapshot.
+  "**/state/memory-lifecycle-ledger.jsonl.lock",
+  // Transient plaintext decrypt staging (issue #2033 P1). The CLI offline
+  // decrypt path materializes a decrypted secure-store file under an owner-only
+  // `<OFFLINE_DECRYPT_STAGING_DIR_PREFIX>*` dir before hashing/pushing, removing
+  // it in a `finally`. A hard crash between create and cleanup would otherwise
+  // let a later snapshot walk `<prefix>*/content` and push decrypted secure-store
+  // plaintext to the remote. Exclude the dir and its contents unconditionally so
+  // a crash-orphan can never be enumerated into a snapshot; the leading `**/`
+  // matches the root-level dir (zero segments) and any nested placement.
+  "**/.remnic-offline-decrypt-*/**",
+  // Embedding-index transaction leftovers (issue #3146, PR #3148). The
+  // identity-replacement backup (`embeddings.pre-replace.tmp`) can hold a
+  // full obsolete generation and `embeddings.staging.tmp-*` holds a
+  // partially staged one; both are node-local recovery state that must
+  // never be enumerated into a snapshot. The demoted legacy recovery file
+  // (`embeddings.json.pre-migration.tmp-*`) is likewise node-local.
+  "**/state/embeddings.pre-replace.tmp/**",
+  "**/state/embeddings.staging.tmp-*/**",
+  "**/state/embeddings.json.pre-migration.tmp-*",
+  "**/namespaces/*/state/embeddings.pre-replace.tmp/**",
+  "**/namespaces/*/state/embeddings.staging.tmp-*/**",
+  "**/namespaces/*/state/embeddings.json.pre-migration.tmp-*"
+];
+var DEFAULT_OFFLINE_SYNC_EXCLUDE_REGEXPS = DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS.map((glob) => globToRegExp(glob));
+function matchesOfflineSyncDefaultExclude(relPosix) {
+  for (const regexp of DEFAULT_OFFLINE_SYNC_EXCLUDE_REGEXPS) {
+    if (regexp.test(relPosix)) return true;
+  }
+  return false;
+}
+function globToRegExp(glob) {
+  if (typeof glob !== "string" || glob.length === 0) {
+    throw new Error("offlineSyncExcludes entry must be a non-empty string");
+  }
+  if (glob.includes("\0")) {
+    throw new Error("offlineSyncExcludes entry must not contain NUL bytes");
+  }
+  let source = "";
+  for (let i = 0; i < glob.length; i += 1) {
+    const ch = glob[i];
+    if (ch === "*") {
+      if (glob[i + 1] === "*") {
+        if (glob[i + 2] === "/") {
+          source += "(?:.*/)?";
+          i += 2;
+          continue;
+        }
+        source += ".*";
+        i += 1;
+        continue;
+      }
+      source += "[^/]*";
+      continue;
+    }
+    if (ch === "?") {
+      source += "[^/]";
+      continue;
+    }
+    if (ch === "/") {
+      source += "/";
+      continue;
+    }
+    source += ch.replace(/[\\^$.+()|{}\[\]]/g, "\\$&");
+  }
+  return new RegExp(`^${source}$`);
+}
+function compileOfflineSyncExcludeGlobs(globs) {
+  const out = [];
+  for (const entry of globs) {
+    if (typeof entry !== "string" || entry.length === 0) {
+      throw new Error("offlineSyncExcludes must contain only non-empty strings");
+    }
+    out.push(globToRegExp(entry));
+  }
+  return out;
+}
+function parseOfflineSyncExcludes(raw) {
+  if (raw === void 0 || raw === null) return [];
+  if (!Array.isArray(raw)) {
+    throw new Error(
+      `offlineSyncExcludes must be an array of non-empty glob strings; got ${typeof raw}`
+    );
+  }
+  for (const entry of raw) {
+    if (typeof entry !== "string" || entry.trim().length === 0) {
+      throw new Error(
+        "offlineSyncExcludes must contain only non-empty glob strings"
+      );
+    }
+  }
+  const globs = raw.map((entry) => entry.trim());
+  compileOfflineSyncExcludeGlobs(globs);
+  return globs;
+}
+
+export {
+  OFFLINE_DECRYPT_STAGING_DIR_PREFIX,
+  DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS,
+  matchesOfflineSyncDefaultExclude,
+  globToRegExp,
+  compileOfflineSyncExcludeGlobs,
+  parseOfflineSyncExcludes
+};
+//# sourceMappingURL=chunk-4NSLQ7EU.js.map

package/dist/chunk-4NSLQ7EU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/offline-sync-exclude-globs.ts"],"sourcesContent":["// Issue #1786: node-local runtime state that each node rebuilds from synced\n// records. Pushing these wastes bandwidth, corrupts the remote's live state\n// dir, and trips the large-file push retry loop on a live SQLite database.\n// Extracted from offline-sync.ts (issue #1995) so the god-file line-count\n// ratchet does not grow when the list gains entries; behavior is unchanged.\n/**\n * Directory-name prefix for the transient plaintext staging dir the CLI offline\n * decrypt path (`offline-storage-io.ts`) creates under the memory root when it\n * must materialize a decrypted secure-store file before hashing/pushing (#2033\n * P1). Shared here so the hard-exclude glob below and the CLI's `mkdtemp` prefix\n * can never drift apart: a crash-orphaned staging dir must NEVER be enumerated\n * into an offline snapshot, or decrypted secure-store plaintext would leak into\n * the remote push.\n */\nexport const OFFLINE_DECRYPT_STAGING_DIR_PREFIX = \".remnic-offline-decrypt-\";\n\nexport const DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS: readonly string[] = [\n  // Leading `**/` matches zero or more segments, so each pattern covers both\n  // the root `state/` dir AND per-namespace `namespaces/<ns>/state/` dirs\n  // (Cursor review on PR #1793: multi-namespace deployments previously kept\n  // pushing their namespaced live sqlite files).\n  \"**/state/*.sqlite\",\n  \"**/state/*.sqlite-*\",\n  \"**/state/index_tags.json\",\n  \"**/state/entity-mention-index.json\",\n  \"**/state/memory-governance/runs/**\",\n  // Rotated recall-impression archives (issue #1910). The active\n  // recall_impressions.jsonl stays remote-authoritative; only the .1..N\n  // archives and the .lock are node-local and never pushed/hashed.\n  \"**/state/recall_impressions.jsonl.*\",\n  // Durable recall-impression pending spill directory (issue #2033). Node-local:\n  // an impression spills a per-event file here when its rotation lock cannot be\n  // acquired, and the next lock holder folds them back into the synced active\n  // recall_impressions.jsonl. The `.*` glob above matches the directory name but\n  // not its children, so exclude the contents explicitly.\n  \"**/state/recall_impressions.jsonl.pending.d/**\",\n  // Durable lifecycle-append pending spill directory (issue #2033). Node-local:\n  // an append spills a per-event file here when it cannot get the ledger lock,\n  // and the next lock holder folds them back into the synced\n  // memory-lifecycle-ledger.jsonl. Pushing them would duplicate rows remotely.\n  // The offline-sync snapshot entrypoints drain this queue first (access-service\n  // `drainPendingLifecycleForSync` -> `StorageManager.drainPendingMemoryLifecycleEventsForSync`),\n  // aborting the snapshot when durable rows cannot be folded, so excluding the\n  // dir never silently drops append-only lifecycle history (promotions/imports).\n  \"**/state/memory-lifecycle-ledger.jsonl.pending.d/**\",\n  // The active lifecycle ledger lock is node-local and must never be\n  // transferred to another node during an offline snapshot.\n  \"**/state/memory-lifecycle-ledger.jsonl.lock\",\n  // Transient plaintext decrypt staging (issue #2033 P1). The CLI offline\n  // decrypt path materializes a decrypted secure-store file under an owner-only\n  // `<OFFLINE_DECRYPT_STAGING_DIR_PREFIX>*` dir before hashing/pushing, removing\n  // it in a `finally`. A hard crash between create and cleanup would otherwise\n  // let a later snapshot walk `<prefix>*/content` and push decrypted secure-store\n  // plaintext to the remote. Exclude the dir and its contents unconditionally so\n  // a crash-orphan can never be enumerated into a snapshot; the leading `**/`\n  // matches the root-level dir (zero segments) and any nested placement.\n  \"**/.remnic-offline-decrypt-*/**\",\n  // Embedding-index transaction leftovers (issue #3146, PR #3148). The\n  // identity-replacement backup (`embeddings.pre-replace.tmp`) can hold a\n  // full obsolete generation and `embeddings.staging.tmp-*` holds a\n  // partially staged one; both are node-local recovery state that must\n  // never be enumerated into a snapshot. The demoted legacy recovery file\n  // (`embeddings.json.pre-migration.tmp-*`) is likewise node-local.\n  \"**/state/embeddings.pre-replace.tmp/**\",\n  \"**/state/embeddings.staging.tmp-*/**\",\n  \"**/state/embeddings.json.pre-migration.tmp-*\",\n  \"**/namespaces/*/state/embeddings.pre-replace.tmp/**\",\n  \"**/namespaces/*/state/embeddings.staging.tmp-*/**\",\n  \"**/namespaces/*/state/embeddings.json.pre-migration.tmp-*\",\n];\n\n\nconst DEFAULT_OFFLINE_SYNC_EXCLUDE_REGEXPS: readonly RegExp[] =\n  DEFAULT_OFFLINE_SYNC_EXCLUDE_GLOBS.map((glob) => globToRegExp(glob));\n\n/**\n * Precompiled-once default-exclude check for the snapshot enumeration hot\n * path (Kilo review, PR #1793). Moved here from offline-sync.ts with the\n * glob list so the two can never drift (issue #1995).\n */\nexport function matchesOfflineSyncDefaultExclude(relPosix: string): boolean {\n  for (const regexp of DEFAULT_OFFLINE_SYNC_EXCLUDE_REGEXPS) {\n    if (regexp.test(relPosix)) return true;\n  }\n  return false;\n}\n\nexport function globToRegExp(glob: string): RegExp {\n  if (typeof glob !== \"string\" || glob.length === 0) {\n    throw new Error(\"offlineSyncExcludes entry must be a non-empty string\");\n  }\n  if (glob.includes(\"\\0\")) {\n    throw new Error(\"offlineSyncExcludes entry must not contain NUL bytes\");\n  }\n  let source = \"\";\n  for (let i = 0; i < glob.length; i += 1) {\n    const ch = glob[i];\n    if (ch === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        // `**` is cross-segment wherever it appears:\n        //   leading `**/`  -> zero or more whole segments\n        //   `/**` at end   -> everything under the directory\n        //   `a/**/b`       -> any depth between segments\n        // (Cursor review on PR #1793: trailing `scratch/**` must match\n        // nested `scratch/a/b.md`, matching the offline-mode guide.)\n        if (glob[i + 2] === \"/\") {\n          source += \"(?:.*/)?\";\n          i += 2;\n          continue;\n        }\n        source += \".*\";\n        i += 1;\n        continue;\n      }\n      source += \"[^/]*\";\n      continue;\n    }\n    if (ch === \"?\") {\n      source += \"[^/]\";\n      continue;\n    }\n    if (ch === \"/\") {\n      source += \"/\";\n      continue;\n    }\n    source += ch.replace(/[\\\\^$.+()|{}\\[\\]]/g, \"\\\\$&\");\n  }\n  return new RegExp(`^${source}$`);\n}\n\nexport function compileOfflineSyncExcludeGlobs(\n  globs: readonly unknown[],\n): RegExp[] {\n  const out: RegExp[] = [];\n  for (const entry of globs) {\n    if (typeof entry !== \"string\" || entry.length === 0) {\n      throw new Error(\"offlineSyncExcludes must contain only non-empty strings\");\n    }\n    out.push(globToRegExp(entry));\n  }\n  return out;\n}\n\n/**\n * Validate the operator-supplied offline-sync exclude list (#1786).\n * Rejects loudly instead of silently defaulting (CLAUDE.md rule 39):\n * a misspelled key value must fail config parse, not be ignored.\n * Lives next to the glob compiler so config.ts only carries the call.\n */\nexport function parseOfflineSyncExcludes(raw: unknown): string[] {\n  if (raw === undefined || raw === null) return [];\n  if (!Array.isArray(raw)) {\n    throw new Error(\n      `offlineSyncExcludes must be an array of non-empty glob strings; got ${typeof raw}`,\n    );\n  }\n  for (const entry of raw) {\n    if (typeof entry !== \"string\" || entry.trim().length === 0) {\n      throw new Error(\n        \"offlineSyncExcludes must contain only non-empty glob strings\",\n      );\n    }\n  }\n  const globs = raw.map((entry) => (entry as string).trim());\n  // Compile-check every glob now so a bad pattern fails at parse time\n  // rather than mid-sync. compileOfflineSyncExcludeGlobs throws with a\n  // per-entry message.\n  compileOfflineSyncExcludeGlobs(globs);\n  return globs;\n}\n"],"mappings":";AAcO,IAAM,qCAAqC;AAE3C,IAAM,qCAAwD;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,uCACJ,mCAAmC,IAAI,CAAC,SAAS,aAAa,IAAI,CAAC;AAO9D,SAAS,iCAAiC,UAA2B;AAC1E,aAAW,UAAU,sCAAsC;AACzD,QAAI,OAAO,KAAK,QAAQ,EAAG,QAAO;AAAA,EACpC;AACA,SAAO;AACT;AAEO,SAAS,aAAa,MAAsB;AACjD,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,KAAK,SAAS,IAAI,GAAG;AACvB,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK,GAAG;AACvC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,OAAO,KAAK;AACd,UAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AAOvB,YAAI,KAAK,IAAI,CAAC,MAAM,KAAK;AACvB,oBAAU;AACV,eAAK;AACL;AAAA,QACF;AACA,kBAAU;AACV,aAAK;AACL;AAAA,MACF;AACA,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,gBAAU;AACV;AAAA,IACF;AACA,cAAU,GAAG,QAAQ,sBAAsB,MAAM;AAAA,EACnD;AACA,SAAO,IAAI,OAAO,IAAI,MAAM,GAAG;AACjC;AAEO,SAAS,+BACd,OACU;AACV,QAAM,MAAgB,CAAC;AACvB,aAAW,SAAS,OAAO;AACzB,QAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AACA,QAAI,KAAK,aAAa,KAAK,CAAC;AAAA,EAC9B;AACA,SAAO;AACT;AAQO,SAAS,yBAAyB,KAAwB;AAC/D,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO,CAAC;AAC/C,MAAI,CAAC,MAAM,QAAQ,GAAG,GAAG;AACvB,UAAM,IAAI;AAAA,MACR,uEAAuE,OAAO,GAAG;AAAA,IACnF;AAAA,EACF;AACA,aAAW,SAAS,KAAK;AACvB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,WAAW,GAAG;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,IAAI,IAAI,CAAC,UAAW,MAAiB,KAAK,CAAC;AAIzD,iCAA+B,KAAK;AACpC,SAAO;AACT;","names":[]}

package/dist/{chunk-7DE2NOON.js → chunk-4O4XCBOS.js}

@@ -2,11 +2,11 @@ import {
   buildExplicitCaptureDedupKey,
   isTombstoneBlockedCaptureWriteLockBusy,
   normalizeExplicitCaptureContent
-} from "./chunk-DUJYRVUD.js";
+} from "./chunk-6O2VUWV6.js";
 import {
   TAG_LIMITS,
   composeMemoryEnvelope
-} from "./chunk-GDYU6VF4.js";
+} from "./chunk-5AYUHSAU.js";
 import {
   isSupportPassportPrivateMemory
 } from "./chunk-PWPIERBM.js";
@@ -787,4 +787,4 @@ export {
   shouldProcessInlineExplicitCapture,
   InlineExplicitCaptureProcessor
 };
-//# sourceMappingURL=chunk-7DE2NOON.js.map
+//# sourceMappingURL=chunk-4O4XCBOS.js.map

package/dist/{chunk-SLEAJ67D.js → chunk-4OQET73E.js}

@@ -1,6 +1,3 @@
-import {
-  LanceDbBackend
-} from "./chunk-S7LWX2PQ.js";
 import {
   MeilisearchBackend
 } from "./chunk-T2YX56QI.js";
@@ -16,6 +13,9 @@ import {
 import {
   EmbedHelper
 } from "./chunk-Z4TXB4K7.js";
+import {
+  LanceDbBackend
+} from "./chunk-S7LWX2PQ.js";
 import {
   createConversationIndexBackend
 } from "./chunk-TFA6HPOA.js";
@@ -179,4 +179,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-SLEAJ67D.js.map
+//# sourceMappingURL=chunk-4OQET73E.js.map

package/dist/{chunk-GDYU6VF4.js → chunk-5AYUHSAU.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-BT7NVCML.js";
 import {
   isMemorySubject
-} from "./chunk-VYCOJKSX.js";
+} from "./chunk-PO7NXNGC.js";
 import {
   assemblePersistedBody
 } from "./chunk-JDSVLVCG.js";
@@ -443,4 +443,4 @@ export {
   buildAccessWriteRequestFingerprint,
   buildObserveRequestFingerprint
 };
-//# sourceMappingURL=chunk-GDYU6VF4.js.map
+//# sourceMappingURL=chunk-5AYUHSAU.js.map

package/dist/{chunk-QWW2JDDX.js → chunk-5E6RYRYW.js}

@@ -1,6 +1,6 @@
 import {
   runGraphEdgeDecayMaintenanceAcrossNamespaces
-} from "./chunk-BJRAELDH.js";
+} from "./chunk-SCXURCVT.js";
 import {
   normalizeDreamsStatusWindowHours
 } from "./chunk-EQWEIIKQ.js";
@@ -8,7 +8,7 @@ import {
   executeResolution,
   isValidResolutionVerb,
   runPreferenceDriftScan
-} from "./chunk-NE7I2RCT.js";
+} from "./chunk-R3X2T2LP.js";
 import {
   getRecallTimingStatus,
   isRecallTimingsOperator
@@ -21,13 +21,13 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-FOH7AMMI.js";
+} from "./chunk-QB57WIS6.js";
 import {
   parseSharedWriteOutputControls
 } from "./chunk-IFBSZGW3.js";
 import {
   validateBriefingFormat
-} from "./chunk-P2WZHLUF.js";
+} from "./chunk-JVPWRNHA.js";
 import {
   parseDeepRecallMaxSteps
 } from "./chunk-A7AISUJI.js";
@@ -36,7 +36,7 @@ import {
   recallRequestSchema,
   retainedCategoryAlias,
   suggestionSubmitRequestSchema
-} from "./chunk-3C3J243X.js";
+} from "./chunk-LW3HKRL7.js";
 import {
   enforceNamespaceAllowList,
   tokenCapabilityStore
@@ -603,4 +603,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-QWW2JDDX.js.map
+//# sourceMappingURL=chunk-5E6RYRYW.js.map