@remnic/core 9.7.15 → 9.8.0

package/dist/{chunk-D7FOKIY5.js → chunk-7AMFUATK.js}

@@ -1,6 +1,6 @@
 import {
   EngramAccessForbiddenError
-} from "./chunk-RANHFI3P.js";
+} from "./chunk-2Z24E5W2.js";
 
 // src/access-token-capabilities.ts
 import { AsyncLocalStorage } from "async_hooks";
@@ -137,14 +137,16 @@ function resolveEffectiveNamespace(namespace, defaultNamespace) {
   const normalized = namespace !== void 0 && namespace.length > 0 ? namespace : void 0;
   return normalized ?? defaultNamespace;
 }
-function enforceNamespaceAllowList(caps, namespace, defaultNamespace) {
-  if (caps?.namespaces === void 0) return;
+function isNamespaceAllowed(caps, namespace, defaultNamespace) {
+  if (caps?.namespaces === void 0) return true;
   const effective = resolveEffectiveNamespace(namespace, defaultNamespace);
-  if (effective === void 0 || !caps.namespaces.includes(effective)) {
-    throw new EngramAccessForbiddenError(
-      namespace === void 0 ? "token is scoped to specific namespaces; the server default namespace is not permitted \u2014 supply an allowed namespace" : `token is not permitted to access namespace: ${namespace}`
-    );
-  }
+  return effective !== void 0 && caps.namespaces.includes(effective);
+}
+function enforceNamespaceAllowList(caps, namespace, defaultNamespace) {
+  if (isNamespaceAllowed(caps, namespace, defaultNamespace)) return;
+  throw new EngramAccessForbiddenError(
+    namespace === void 0 ? "token is scoped to specific namespaces; the server default namespace is not permitted \u2014 supply an allowed namespace" : `token is not permitted to access namespace: ${namespace}`
+  );
 }
 function assertFleetWideOperationAllowed(caps) {
   if (!capabilityAllowsNamespace(caps, void 0)) {
@@ -166,8 +168,9 @@ export {
   assertOperationAllowed,
   assertNamespaceAllowed,
   resolveEffectiveNamespace,
+  isNamespaceAllowed,
   enforceNamespaceAllowList,
   assertFleetWideOperationAllowed,
   tokenCapabilityStore
 };
-//# sourceMappingURL=chunk-D7FOKIY5.js.map
+//# sourceMappingURL=chunk-7AMFUATK.js.map

package/dist/{chunk-D7FOKIY5.js.map → chunk-7AMFUATK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/access-token-capabilities.ts"],"sourcesContent":["/**\n * Per-token capabilities (issue #1837).\n *\n * A token entry MAY carry an explicit, versioned capabilities record. The\n * record's PRESENCE is mechanically detectable, which is load-bearing for\n * security:\n *\n *   - ABSENT `capabilities` field ⇒ a PRE-FEATURE legacy entry (minted\n *     before this feature). It is UNRESTRICTED — full access — purely for\n *     backward compatibility. This is the ONLY path by which \"full access\"\n *     is granted by omission.\n *\n *   - PRESENT `capabilities` record (always carries a `version` marker) ⇒ a\n *     token minted by the capability-aware path. Even a new token minted\n *     without `--ops`/`--namespaces` records an EXPLICIT unrestricted record\n *     (`{ version: 1 }`) — a deliberate, auditable choice, never an\n *     accidentally-omitted field. Within the record, the two axes follow\n *     absent-vs-present semantics:\n *       * axis ABSENT (e.g. no `ops` key)        ⇒ unrestricted on that axis.\n *       * axis PRESENT and empty (`ops: []`)     ⇒ deny all (fail-closed).\n *       * axis PRESENT and non-empty             ⇒ allow only the listed values.\n *\n * Malformed capability input at mint time (bad version, non-array axes,\n * non-string elements, unknown op names against the catalog, malformed\n * namespace values) is REJECTED — a token is never created from invalid\n * input (rule: invalid input rejected, not defaulted).\n *\n * This module owns the pure capability logic (shape validation, allow-list\n * checks) and the per-request AsyncLocalStorage carrying the presenting\n * token's resolved capabilities down to the access boundary. It imports\n * nothing else in the package except the forbidden-error class, so it can be\n * reused by the token store, the boundary, and the HTTP/MCP surfaces without\n * cycles.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\n\n/** Current capability-record schema version. */\nexport const TOKEN_CAPABILITIES_VERSION = 1 as const;\n\n/**\n * Versioned capabilities record stored on a token entry. Presence of this\n * record (vs. an absent field) is what distinguishes a capability-aware\n * token from a pre-feature legacy entry.\n */\nexport interface TokenCapabilities {\n  readonly version: typeof TOKEN_CAPABILITIES_VERSION;\n  /**\n   * Operations allow-list. `undefined` (key absent) ⇒ unrestricted on this\n   * axis. `[]` ⇒ deny all ops (fail-closed). Non-empty ⇒ allow only listed.\n   */\n  ops?: string[];\n  /**\n   * Namespaces allow-list. `undefined` ⇒ unrestricted. `[]` ⇒ deny all.\n   * Non-empty ⇒ allow only listed.\n   */\n  namespaces?: string[];\n}\n\n/**\n * Namespace value validation. Namespace identifiers are flexible (default,\n * team, self, principal-prefixed, project-prefixed) but must never contain\n * whitespace, path separators, traversal segments, or control characters —\n * such values are malformed at mint time and rejected, never silently\n * coerced.\n */\nconst NAMESPACE_VALUE_MAX_LENGTH = 128;\n// Non-empty, no whitespace, no path separators, no control chars. `.` and\n// `..` are rejected separately so legitimate dotted names (e.g. a domain)\n// remain allowed while traversal is not.\nconst NAMESPACE_VALUE_PATTERN = /^[^\\s\\/\\\\\\x00-\\x1F]+$/;\n\n/** True when `value` is an acceptable namespace allow-list entry. */\nexport function isValidNamespaceValue(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {\n    return false;\n  }\n  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;\n  if (value === \".\" || value === \"..\") return false;\n  return true;\n}\n\nfunction isStringArray(value: unknown): value is unknown[] {\n  return Array.isArray(value) && value.every((v) => typeof v === \"string\");\n}\n\nfunction dedupeSort(values: string[]): string[] {\n  return [...new Set(values)].sort();\n}\n\n/**\n * Parse one axis (ops or namespaces) for PERSISTENCE/LOAD. Returns the\n * cleaned array (deduped, sorted; possibly empty to preserve \"present ⇒\n * fail-closed\") or `undefined` when the key is absent. Throws on a malformed\n * shape (non-array, non-string elements, malformed namespace values). Op\n * validation against the catalog happens only at mint time.\n */\nfunction parseAxis(\n  obj: Record<string, unknown>,\n  key: \"ops\" | \"namespaces\",\n  validateValue: (v: unknown) => boolean,\n  valueLabel: string,\n): string[] | undefined {\n  if (!Object.prototype.hasOwnProperty.call(obj, key)) return undefined;\n  const value = obj[key];\n  if (value === undefined || value === null) return undefined;\n  if (!isStringArray(value)) {\n    throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n  }\n  const cleaned: string[] = [];\n  for (const v of value) {\n    if (typeof v !== \"string\" || v.length === 0) {\n      throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n    }\n    if (!validateValue(v)) {\n      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);\n    }\n    cleaned.push(v);\n  }\n  // Preserve presence: an explicitly empty array stays [] (fail-closed),\n  // NOT coerced to undefined (which would mean unrestricted).\n  return dedupeSort(cleaned);\n}\n\n/**\n * Normalize a capabilities record for PERSISTENCE/LOAD. Returns `undefined`\n * ONLY when the record is entirely absent (a pre-feature legacy entry ⇒\n * unrestricted). When present, an absent/`undefined` `version` is COERCED to\n * the current default (1) — mirroring {@link validateCapabilitiesForMint} — so\n * a record that mint-validated also load-normalizes without a schema throw.\n * An explicitly-present WRONG version (not 1) is still rejected. Throws on a\n * malformed record (non-object, explicitly-wrong version, malformed axes).\n */\nexport function normalizeCapabilities(raw: unknown): TokenCapabilities | undefined {\n  if (raw === undefined || raw === null) return undefined;\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with a version marker\");\n  }\n  const obj = raw as Record<string, unknown>;\n  // Coerce absent/undefined version → 1, mirroring validateCapabilitiesForMint\n  // (version 1 is the only schema version; coercing keeps mint-validated\n  // records reloadable). Only an explicitly-present WRONG version throws.\n  if (obj.version !== undefined && obj.version !== TOKEN_CAPABILITIES_VERSION) {\n    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n  }\n  const ops = parseAxis(obj, \"ops\", () => true, \"operation\");\n  const namespaces = parseAxis(obj, \"namespaces\", isValidNamespaceValue, \"namespace\");\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (ops !== undefined) result.ops = ops;\n  if (namespaces !== undefined) result.namespaces = namespaces;\n  return result;\n}\n\n/**\n * Validate a capabilities record at MINT time. ALWAYS returns a versioned\n * record (never `undefined`) so every newly-minted token carries an explicit\n * capability decision — a new token can never gain full access by OMITTING\n * the field. When `raw` is absent/null, the result is an explicit\n * unrestricted record (`{ version: 1 }`), a deliberate/auditable choice. A\n * present-but-`undefined` (or absent) `version` is coerced to the current\n * default (1); an explicitly-wrong version is rejected. This version rule is\n * identical to {@link normalizeCapabilities} (mint/load symmetry). Rejects\n * unknown op names against the catalog and malformed namespace values;\n * throws a plain Error — the caller must NOT create a token when this throws.\n */\nexport function validateCapabilitiesForMint(\n  raw: unknown,\n  validOps: readonly string[],\n): TokenCapabilities {\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (raw === undefined || raw === null) {\n    return result;\n  }\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with optional ops/namespaces arrays\");\n  }\n  const obj = raw as Record<string, unknown>;\n  if (Object.prototype.hasOwnProperty.call(obj, \"version\") && obj.version !== undefined) {\n    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {\n      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n    }\n  }\n  const validOpSet = new Set(validOps);\n\n  if (Object.prototype.hasOwnProperty.call(obj, \"ops\") && obj.ops !== undefined && obj.ops !== null) {\n    if (!isStringArray(obj.ops)) {\n      throw new Error(\"capabilities ops must be an array of non-empty strings\");\n    }\n    const ops = obj.ops as unknown[];\n    for (const v of ops) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities ops must be an array of non-empty strings\");\n      }\n    }\n    // Reject unknown op names against the catalog (unknown ⇒ reject, never drop).\n    const unknown = ops.filter((op) => typeof op === \"string\" && !validOpSet.has(op));\n    if (unknown.length > 0) {\n      throw new Error(\n        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(\", \")}`,\n      );\n    }\n    // Preserve presence (empty stays [] ⇒ deny all ops).\n    result.ops = dedupeSort(ops as string[]);\n  }\n\n  if (\n    Object.prototype.hasOwnProperty.call(obj, \"namespaces\") &&\n    obj.namespaces !== undefined &&\n    obj.namespaces !== null\n  ) {\n    if (!isStringArray(obj.namespaces)) {\n      throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n    }\n    const namespaces = obj.namespaces as unknown[];\n    for (const v of namespaces) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n      }\n      if (!isValidNamespaceValue(v)) {\n        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);\n      }\n    }\n    result.namespaces = dedupeSort(namespaces as string[]);\n  }\n\n  return result;\n}\n\n/**\n * True when `caps` imposes any restriction (a present record with at least\n * one axis key). `undefined` (legacy / absent record) ⇒ unrestricted. A\n * present `{ version: 1 }` record with no axes ⇒ also unrestricted (but\n * auditable — it is a deliberate new-token decision, not omission).\n */\nexport function isCapabilityRestricted(caps: TokenCapabilities | undefined | null): boolean {\n  if (!caps) return false;\n  return caps.ops !== undefined || caps.namespaces !== undefined;\n}\n\n/**\n * True when `caps` permits `op`.\n *   - record ABSENT (legacy) ⇒ unrestricted (true).\n *   - ops axis ABSENT        ⇒ unrestricted on this axis (true).\n *   - ops axis PRESENT       ⇒ `op` must be listed; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, op: string): boolean {\n  if (caps?.ops === undefined) return true;\n  return caps.ops.includes(op);\n}\n\n/**\n * True when `caps` permits `namespace`.\n *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).\n *   - namespaces axis PRESENT ⇒ `namespace` must be listed; undefined\n *     namespace ⇒ false; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsNamespace(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true;\n  if (namespace === undefined) return false;\n  return caps.namespaces.includes(namespace);\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts ops and\n * `op` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  op: string,\n): void {\n  if (!capabilityAllowsOp(caps, op)) {\n    throw new EngramAccessForbiddenError(\n      `token is not permitted to call operation: ${op}`,\n    );\n  }\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts namespaces\n * and `namespace` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): void {\n  if (!capabilityAllowsNamespace(caps, namespace)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces and this operation requires an explicit namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Resolve the EFFECTIVE namespace an operation runs against: a present,\n * non-empty request namespace wins, otherwise the server default — the same\n * resolution downstream storage applies\n * (`getWritableStorageForNamespace(undefined)` → `defaultNamespace`). Empty\n * strings are treated as absent. Centralized so every invocation surface\n * (HTTP query/body, MCP `tools/call`, id-loaded records, legacy pairs that\n * carry no namespace) applies ONE rule and none can dodge the check by\n * dropping the param. (issue #1850)\n */\nexport function resolveEffectiveNamespace(\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): string | undefined {\n  const normalized = namespace !== undefined && namespace.length > 0 ? namespace : undefined;\n  return normalized ?? defaultNamespace;\n}\n\n/**\n * The single effective-namespace allow-list chokepoint (issues #1837/#1850).\n * Throws {@link EngramAccessForbiddenError} when `caps` carries a namespaces\n * allow-list and the EFFECTIVE namespace (request value OR server default) is\n * not a member. FAIL CLOSED:\n *   - a scoped token whose allow-list does not cover the effective namespace\n *     (explicit OR defaulted) is rejected;\n *   - an absent server default (unconfigured) is also rejected for scoped\n *     tokens, so omitting `?namespace=` can never bypass the allow-list.\n * No-op for unrestricted tokens (no namespaces axis) so legacy/unrestricted\n * behavior is unchanged. Both the HTTP transport (`resolveNamespace`) and the\n * MCP dispatch route through this ONE function so no surface is missed.\n */\nexport function enforceNamespaceAllowList(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): void {\n  if (caps?.namespaces === undefined) return; // unrestricted token — unchanged\n  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);\n  if (effective === undefined || !caps.namespaces.includes(effective)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces; the server default namespace is not permitted — supply an allowed namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Fleet-wide / global maintenance operation guard (issue #1850 round 10).\n *\n * A distinct escalation class from the id-addressed routes (round 9) and the\n * param-namespace ops (round 4): some boundary operations inherently run\n * ACROSS ALL namespaces — or against a single global layer (compression\n * guidelines, shared context, compounding) that is not namespace-partitioned\n * — and carry NO `namespace` argument, so the MCP `tools/call` effective-\n * namespace chokepoint ({@link enforceNamespaceAllowList}, which only fires\n * when `toolAcceptsNamespace`) never applies. Without this guard a bearer\n * scoped to ONE tenant could trigger maintenance that mutates state in EVERY\n * namespace (privilege escalation).\n *\n * Fail CLOSED exactly like the other shared guards: a namespace-SCOPED token\n * (namespaces axis present) is rejected; unrestricted / legacy tokens (absent\n * record or no namespaces axis — i.e. cron and internal callers that never\n * bind a capability record) are unaffected. Reuses the EXISTING capability\n * model via {@link capabilityAllowsNamespace} — no new \"all\"/\"*\" scope concept.\n * Must run BEFORE any side effect so a denial never leaks a partial mutation.\n */\nexport function assertFleetWideOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  // capabilityAllowsNamespace returns false for ANY scoped token when the\n  // namespace is undefined (a fleet-wide op has no single namespace), and\n  // true for unrestricted/legacy tokens — exactly the desired policy.\n  if (!capabilityAllowsNamespace(caps, undefined)) {\n    throw new EngramAccessForbiddenError(\n      \"token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token\",\n    );\n  }\n}\n\n/**\n * Per-request AsyncLocalStorage carrying the presenting token's resolved\n * capabilities. The HTTP surface binds the resolved capabilities with\n * `.run(caps, handler)` for the WHOLE authorized request dispatch (NOT\n * `.enterWith()`, which mutates the current async resource and does not\n * reliably isolate the store across the handler's awaits / concurrent\n * requests — risking a fail-open read of undefined mid-handler); the\n * access boundary reads `.getStore()` to enforce the ops allow-list for\n * every boundary operation without each dispatch site threading the value\n * explicitly. Unset (CLI, direct boundary callers, tests) ⇒ undefined ⇒\n * unrestricted (issue #1850 round 7).\n */\nexport const tokenCapabilityStore = new AsyncLocalStorage<TokenCapabilities | undefined>();\n"],"mappings":";;;;;AAmCA,SAAS,yBAAyB;AAI3B,IAAM,6BAA6B;AA4B1C,IAAM,6BAA6B;AAInC,IAAM,0BAA0B;AAGzB,SAAS,sBAAsB,OAAiC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,4BAA4B;AAChG,WAAO;AAAA,EACT;AACA,MAAI,CAAC,wBAAwB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,UAAU,OAAO,UAAU,KAAM,QAAO;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAoC;AACzD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACzE;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AACnC;AASA,SAAS,UACP,KACA,KACA,eACA,YACsB;AACtB,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC5D,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,EAC7E;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,OAAO;AACrB,QAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,IAC7E;AACA,QAAI,CAAC,cAAc,CAAC,GAAG;AACrB,YAAM,IAAI,MAAM,gBAAgB,GAAG,yBAAyB,UAAU,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,IAChG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,SAAO,WAAW,OAAO;AAC3B;AAWO,SAAS,sBAAsB,KAA6C;AACjF,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM;AAIZ,MAAI,IAAI,YAAY,UAAa,IAAI,YAAY,4BAA4B;AAC3E,UAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,EAC9E;AACA,QAAM,MAAM,UAAU,KAAK,OAAO,MAAM,MAAM,WAAW;AACzD,QAAM,aAAa,UAAU,KAAK,cAAc,uBAAuB,WAAW;AAClF,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,OAAW,QAAO,MAAM;AACpC,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,SAAO;AACT;AAcO,SAAS,4BACd,KACA,UACmB;AACnB,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,QAAM,MAAM;AACZ,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,KAAK,IAAI,YAAY,QAAW;AACrF,QAAI,IAAI,YAAY,4BAA4B;AAC9C,YAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ;AAEnC,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,KAAK,KAAK,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAM;AACjG,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,MAAM,IAAI;AAChB,eAAW,KAAK,KAAK;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,wDAAwD;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;AAChF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,wDAAwD,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,IACF;AAEA,WAAO,MAAM,WAAW,GAAe;AAAA,EACzC;AAEA,MACE,OAAO,UAAU,eAAe,KAAK,KAAK,YAAY,KACtD,IAAI,eAAe,UACnB,IAAI,eAAe,MACnB;AACA,QAAI,CAAC,cAAc,IAAI,UAAU,GAAG;AAClC,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa,IAAI;AACvB,eAAW,KAAK,YAAY;AAC1B,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,UAAI,CAAC,sBAAsB,CAAC,GAAG;AAC7B,cAAM,IAAI,MAAM,2DAA2D,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AACA,WAAO,aAAa,WAAW,UAAsB;AAAA,EACvD;AAEA,SAAO;AACT;AAQO,SAAS,uBAAuB,MAAqD;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,QAAQ,UAAa,KAAK,eAAe;AACvD;AAQO,SAAS,mBAAmB,MAA4C,IAAqB;AAClG,MAAI,MAAM,QAAQ,OAAW,QAAO;AACpC,SAAO,KAAK,IAAI,SAAS,EAAE;AAC7B;AAQO,SAAS,0BACd,MACA,WACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,KAAK,WAAW,SAAS,SAAS;AAC3C;AAMO,SAAS,uBACd,MACA,IACM;AACN,MAAI,CAAC,mBAAmB,MAAM,EAAE,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,6CAA6C,EAAE;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,uBACd,MACA,WACM;AACN,MAAI,CAAC,0BAA0B,MAAM,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6FACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAYO,SAAS,0BACd,WACA,kBACoB;AACpB,QAAM,aAAa,cAAc,UAAa,UAAU,SAAS,IAAI,YAAY;AACjF,SAAO,cAAc;AACvB;AAeO,SAAS,0BACd,MACA,WACA,kBACM;AACN,MAAI,MAAM,eAAe,OAAW;AACpC,QAAM,YAAY,0BAA0B,WAAW,gBAAgB;AACvE,MAAI,cAAc,UAAa,CAAC,KAAK,WAAW,SAAS,SAAS,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6HACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAsBO,SAAS,gCACd,MACM;AAIN,MAAI,CAAC,0BAA0B,MAAM,MAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,IAAI,kBAAiD;","names":[]}
+{"version":3,"sources":["../src/access-token-capabilities.ts"],"sourcesContent":["/**\n * Per-token capabilities (issue #1837).\n *\n * A token entry MAY carry an explicit, versioned capabilities record. The\n * record's PRESENCE is mechanically detectable, which is load-bearing for\n * security:\n *\n *   - ABSENT `capabilities` field ⇒ a PRE-FEATURE legacy entry (minted\n *     before this feature). It is UNRESTRICTED — full access — purely for\n *     backward compatibility. This is the ONLY path by which \"full access\"\n *     is granted by omission.\n *\n *   - PRESENT `capabilities` record (always carries a `version` marker) ⇒ a\n *     token minted by the capability-aware path. Even a new token minted\n *     without `--ops`/`--namespaces` records an EXPLICIT unrestricted record\n *     (`{ version: 1 }`) — a deliberate, auditable choice, never an\n *     accidentally-omitted field. Within the record, the two axes follow\n *     absent-vs-present semantics:\n *       * axis ABSENT (e.g. no `ops` key)        ⇒ unrestricted on that axis.\n *       * axis PRESENT and empty (`ops: []`)     ⇒ deny all (fail-closed).\n *       * axis PRESENT and non-empty             ⇒ allow only the listed values.\n *\n * Malformed capability input at mint time (bad version, non-array axes,\n * non-string elements, unknown op names against the catalog, malformed\n * namespace values) is REJECTED — a token is never created from invalid\n * input (rule: invalid input rejected, not defaulted).\n *\n * This module owns the pure capability logic (shape validation, allow-list\n * checks) and the per-request AsyncLocalStorage carrying the presenting\n * token's resolved capabilities down to the access boundary. It imports\n * nothing else in the package except the forbidden-error class, so it can be\n * reused by the token store, the boundary, and the HTTP/MCP surfaces without\n * cycles.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\n\n/** Current capability-record schema version. */\nexport const TOKEN_CAPABILITIES_VERSION = 1 as const;\n\n/**\n * Versioned capabilities record stored on a token entry. Presence of this\n * record (vs. an absent field) is what distinguishes a capability-aware\n * token from a pre-feature legacy entry.\n */\nexport interface TokenCapabilities {\n  readonly version: typeof TOKEN_CAPABILITIES_VERSION;\n  /**\n   * Operations allow-list. `undefined` (key absent) ⇒ unrestricted on this\n   * axis. `[]` ⇒ deny all ops (fail-closed). Non-empty ⇒ allow only listed.\n   */\n  ops?: string[];\n  /**\n   * Namespaces allow-list. `undefined` ⇒ unrestricted. `[]` ⇒ deny all.\n   * Non-empty ⇒ allow only listed.\n   */\n  namespaces?: string[];\n}\n\n/**\n * Namespace value validation. Namespace identifiers are flexible (default,\n * team, self, principal-prefixed, project-prefixed) but must never contain\n * whitespace, path separators, traversal segments, or control characters —\n * such values are malformed at mint time and rejected, never silently\n * coerced.\n */\nconst NAMESPACE_VALUE_MAX_LENGTH = 128;\n// Non-empty, no whitespace, no path separators, no control chars. `.` and\n// `..` are rejected separately so legitimate dotted names (e.g. a domain)\n// remain allowed while traversal is not.\nconst NAMESPACE_VALUE_PATTERN = /^[^\\s\\/\\\\\\x00-\\x1F]+$/;\n\n/** True when `value` is an acceptable namespace allow-list entry. */\nexport function isValidNamespaceValue(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {\n    return false;\n  }\n  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;\n  if (value === \".\" || value === \"..\") return false;\n  return true;\n}\n\nfunction isStringArray(value: unknown): value is unknown[] {\n  return Array.isArray(value) && value.every((v) => typeof v === \"string\");\n}\n\nfunction dedupeSort(values: string[]): string[] {\n  return [...new Set(values)].sort();\n}\n\n/**\n * Parse one axis (ops or namespaces) for PERSISTENCE/LOAD. Returns the\n * cleaned array (deduped, sorted; possibly empty to preserve \"present ⇒\n * fail-closed\") or `undefined` when the key is absent. Throws on a malformed\n * shape (non-array, non-string elements, malformed namespace values). Op\n * validation against the catalog happens only at mint time.\n */\nfunction parseAxis(\n  obj: Record<string, unknown>,\n  key: \"ops\" | \"namespaces\",\n  validateValue: (v: unknown) => boolean,\n  valueLabel: string,\n): string[] | undefined {\n  if (!Object.prototype.hasOwnProperty.call(obj, key)) return undefined;\n  const value = obj[key];\n  if (value === undefined || value === null) return undefined;\n  if (!isStringArray(value)) {\n    throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n  }\n  const cleaned: string[] = [];\n  for (const v of value) {\n    if (typeof v !== \"string\" || v.length === 0) {\n      throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n    }\n    if (!validateValue(v)) {\n      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);\n    }\n    cleaned.push(v);\n  }\n  // Preserve presence: an explicitly empty array stays [] (fail-closed),\n  // NOT coerced to undefined (which would mean unrestricted).\n  return dedupeSort(cleaned);\n}\n\n/**\n * Normalize a capabilities record for PERSISTENCE/LOAD. Returns `undefined`\n * ONLY when the record is entirely absent (a pre-feature legacy entry ⇒\n * unrestricted). When present, an absent/`undefined` `version` is COERCED to\n * the current default (1) — mirroring {@link validateCapabilitiesForMint} — so\n * a record that mint-validated also load-normalizes without a schema throw.\n * An explicitly-present WRONG version (not 1) is still rejected. Throws on a\n * malformed record (non-object, explicitly-wrong version, malformed axes).\n */\nexport function normalizeCapabilities(raw: unknown): TokenCapabilities | undefined {\n  if (raw === undefined || raw === null) return undefined;\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with a version marker\");\n  }\n  const obj = raw as Record<string, unknown>;\n  // Coerce absent/undefined version → 1, mirroring validateCapabilitiesForMint\n  // (version 1 is the only schema version; coercing keeps mint-validated\n  // records reloadable). Only an explicitly-present WRONG version throws.\n  if (obj.version !== undefined && obj.version !== TOKEN_CAPABILITIES_VERSION) {\n    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n  }\n  const ops = parseAxis(obj, \"ops\", () => true, \"operation\");\n  const namespaces = parseAxis(obj, \"namespaces\", isValidNamespaceValue, \"namespace\");\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (ops !== undefined) result.ops = ops;\n  if (namespaces !== undefined) result.namespaces = namespaces;\n  return result;\n}\n\n/**\n * Validate a capabilities record at MINT time. ALWAYS returns a versioned\n * record (never `undefined`) so every newly-minted token carries an explicit\n * capability decision — a new token can never gain full access by OMITTING\n * the field. When `raw` is absent/null, the result is an explicit\n * unrestricted record (`{ version: 1 }`), a deliberate/auditable choice. A\n * present-but-`undefined` (or absent) `version` is coerced to the current\n * default (1); an explicitly-wrong version is rejected. This version rule is\n * identical to {@link normalizeCapabilities} (mint/load symmetry). Rejects\n * unknown op names against the catalog and malformed namespace values;\n * throws a plain Error — the caller must NOT create a token when this throws.\n */\nexport function validateCapabilitiesForMint(\n  raw: unknown,\n  validOps: readonly string[],\n): TokenCapabilities {\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (raw === undefined || raw === null) {\n    return result;\n  }\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with optional ops/namespaces arrays\");\n  }\n  const obj = raw as Record<string, unknown>;\n  if (Object.prototype.hasOwnProperty.call(obj, \"version\") && obj.version !== undefined) {\n    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {\n      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n    }\n  }\n  const validOpSet = new Set(validOps);\n\n  if (Object.prototype.hasOwnProperty.call(obj, \"ops\") && obj.ops !== undefined && obj.ops !== null) {\n    if (!isStringArray(obj.ops)) {\n      throw new Error(\"capabilities ops must be an array of non-empty strings\");\n    }\n    const ops = obj.ops as unknown[];\n    for (const v of ops) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities ops must be an array of non-empty strings\");\n      }\n    }\n    // Reject unknown op names against the catalog (unknown ⇒ reject, never drop).\n    const unknown = ops.filter((op) => typeof op === \"string\" && !validOpSet.has(op));\n    if (unknown.length > 0) {\n      throw new Error(\n        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(\", \")}`,\n      );\n    }\n    // Preserve presence (empty stays [] ⇒ deny all ops).\n    result.ops = dedupeSort(ops as string[]);\n  }\n\n  if (\n    Object.prototype.hasOwnProperty.call(obj, \"namespaces\") &&\n    obj.namespaces !== undefined &&\n    obj.namespaces !== null\n  ) {\n    if (!isStringArray(obj.namespaces)) {\n      throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n    }\n    const namespaces = obj.namespaces as unknown[];\n    for (const v of namespaces) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n      }\n      if (!isValidNamespaceValue(v)) {\n        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);\n      }\n    }\n    result.namespaces = dedupeSort(namespaces as string[]);\n  }\n\n  return result;\n}\n\n/**\n * True when `caps` imposes any restriction (a present record with at least\n * one axis key). `undefined` (legacy / absent record) ⇒ unrestricted. A\n * present `{ version: 1 }` record with no axes ⇒ also unrestricted (but\n * auditable — it is a deliberate new-token decision, not omission).\n */\nexport function isCapabilityRestricted(caps: TokenCapabilities | undefined | null): boolean {\n  if (!caps) return false;\n  return caps.ops !== undefined || caps.namespaces !== undefined;\n}\n\n/**\n * True when `caps` permits `op`.\n *   - record ABSENT (legacy) ⇒ unrestricted (true).\n *   - ops axis ABSENT        ⇒ unrestricted on this axis (true).\n *   - ops axis PRESENT       ⇒ `op` must be listed; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, op: string): boolean {\n  if (caps?.ops === undefined) return true;\n  return caps.ops.includes(op);\n}\n\n/**\n * True when `caps` permits `namespace`.\n *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).\n *   - namespaces axis PRESENT ⇒ `namespace` must be listed; undefined\n *     namespace ⇒ false; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsNamespace(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true;\n  if (namespace === undefined) return false;\n  return caps.namespaces.includes(namespace);\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts ops and\n * `op` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  op: string,\n): void {\n  if (!capabilityAllowsOp(caps, op)) {\n    throw new EngramAccessForbiddenError(\n      `token is not permitted to call operation: ${op}`,\n    );\n  }\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts namespaces\n * and `namespace` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): void {\n  if (!capabilityAllowsNamespace(caps, namespace)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces and this operation requires an explicit namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Resolve the EFFECTIVE namespace an operation runs against: a present,\n * non-empty request namespace wins, otherwise the server default — the same\n * resolution downstream storage applies\n * (`getWritableStorageForNamespace(undefined)` → `defaultNamespace`). Empty\n * strings are treated as absent. Centralized so every invocation surface\n * (HTTP query/body, MCP `tools/call`, id-loaded records, legacy pairs that\n * carry no namespace) applies ONE rule and none can dodge the check by\n * dropping the param. (issue #1850)\n */\nexport function resolveEffectiveNamespace(\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): string | undefined {\n  const normalized = namespace !== undefined && namespace.length > 0 ? namespace : undefined;\n  return normalized ?? defaultNamespace;\n}\n\n/**\n * The single effective-namespace allow-list chokepoint (issues #1837/#1850).\n * Throws {@link EngramAccessForbiddenError} when `caps` carries a namespaces\n * allow-list and the EFFECTIVE namespace (request value OR server default) is\n * not a member. FAIL CLOSED:\n *   - a scoped token whose allow-list does not cover the effective namespace\n *     (explicit OR defaulted) is rejected;\n *   - an absent server default (unconfigured) is also rejected for scoped\n *     tokens, so omitting `?namespace=` can never bypass the allow-list.\n * No-op for unrestricted tokens (no namespaces axis) so legacy/unrestricted\n * behavior is unchanged. Both the HTTP transport (`resolveNamespace`) and the\n * MCP dispatch route through this ONE function so no surface is missed.\n */\nexport function isNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true; // unrestricted token\n  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);\n  return effective !== undefined && caps.namespaces.includes(effective);\n}\n\nexport function enforceNamespaceAllowList(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): void {\n  if (isNamespaceAllowed(caps, namespace, defaultNamespace)) return;\n  throw new EngramAccessForbiddenError(\n    namespace === undefined\n      ? \"token is scoped to specific namespaces; the server default namespace is not permitted — supply an allowed namespace\"\n      : `token is not permitted to access namespace: ${namespace}`,\n  );\n}\n\n/**\n * Fleet-wide / global maintenance operation guard (issue #1850 round 10).\n *\n * A distinct escalation class from the id-addressed routes (round 9) and the\n * param-namespace ops (round 4): some boundary operations inherently run\n * ACROSS ALL namespaces — or against a single global layer (compression\n * guidelines, shared context, compounding) that is not namespace-partitioned\n * — and carry NO `namespace` argument, so the MCP `tools/call` effective-\n * namespace chokepoint ({@link enforceNamespaceAllowList}, which only fires\n * when `toolAcceptsNamespace`) never applies. Without this guard a bearer\n * scoped to ONE tenant could trigger maintenance that mutates state in EVERY\n * namespace (privilege escalation).\n *\n * Fail CLOSED exactly like the other shared guards: a namespace-SCOPED token\n * (namespaces axis present) is rejected; unrestricted / legacy tokens (absent\n * record or no namespaces axis — i.e. cron and internal callers that never\n * bind a capability record) are unaffected. Reuses the EXISTING capability\n * model via {@link capabilityAllowsNamespace} — no new \"all\"/\"*\" scope concept.\n * Must run BEFORE any side effect so a denial never leaks a partial mutation.\n */\nexport function assertFleetWideOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  // capabilityAllowsNamespace returns false for ANY scoped token when the\n  // namespace is undefined (a fleet-wide op has no single namespace), and\n  // true for unrestricted/legacy tokens — exactly the desired policy.\n  if (!capabilityAllowsNamespace(caps, undefined)) {\n    throw new EngramAccessForbiddenError(\n      \"token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token\",\n    );\n  }\n}\n\n/**\n * Per-request AsyncLocalStorage carrying the presenting token's resolved\n * capabilities. The HTTP surface binds the resolved capabilities with\n * `.run(caps, handler)` for the WHOLE authorized request dispatch (NOT\n * `.enterWith()`, which mutates the current async resource and does not\n * reliably isolate the store across the handler's awaits / concurrent\n * requests — risking a fail-open read of undefined mid-handler); the\n * access boundary reads `.getStore()` to enforce the ops allow-list for\n * every boundary operation without each dispatch site threading the value\n * explicitly. Unset (CLI, direct boundary callers, tests) ⇒ undefined ⇒\n * unrestricted (issue #1850 round 7).\n */\nexport const tokenCapabilityStore = new AsyncLocalStorage<TokenCapabilities | undefined>();\n"],"mappings":";;;;;AAmCA,SAAS,yBAAyB;AAI3B,IAAM,6BAA6B;AA4B1C,IAAM,6BAA6B;AAInC,IAAM,0BAA0B;AAGzB,SAAS,sBAAsB,OAAiC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,4BAA4B;AAChG,WAAO;AAAA,EACT;AACA,MAAI,CAAC,wBAAwB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,UAAU,OAAO,UAAU,KAAM,QAAO;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAoC;AACzD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACzE;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AACnC;AASA,SAAS,UACP,KACA,KACA,eACA,YACsB;AACtB,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC5D,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,EAC7E;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,OAAO;AACrB,QAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,IAC7E;AACA,QAAI,CAAC,cAAc,CAAC,GAAG;AACrB,YAAM,IAAI,MAAM,gBAAgB,GAAG,yBAAyB,UAAU,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,IAChG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,SAAO,WAAW,OAAO;AAC3B;AAWO,SAAS,sBAAsB,KAA6C;AACjF,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM;AAIZ,MAAI,IAAI,YAAY,UAAa,IAAI,YAAY,4BAA4B;AAC3E,UAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,EAC9E;AACA,QAAM,MAAM,UAAU,KAAK,OAAO,MAAM,MAAM,WAAW;AACzD,QAAM,aAAa,UAAU,KAAK,cAAc,uBAAuB,WAAW;AAClF,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,OAAW,QAAO,MAAM;AACpC,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,SAAO;AACT;AAcO,SAAS,4BACd,KACA,UACmB;AACnB,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,QAAM,MAAM;AACZ,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,KAAK,IAAI,YAAY,QAAW;AACrF,QAAI,IAAI,YAAY,4BAA4B;AAC9C,YAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ;AAEnC,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,KAAK,KAAK,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAM;AACjG,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,MAAM,IAAI;AAChB,eAAW,KAAK,KAAK;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,wDAAwD;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;AAChF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,wDAAwD,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,IACF;AAEA,WAAO,MAAM,WAAW,GAAe;AAAA,EACzC;AAEA,MACE,OAAO,UAAU,eAAe,KAAK,KAAK,YAAY,KACtD,IAAI,eAAe,UACnB,IAAI,eAAe,MACnB;AACA,QAAI,CAAC,cAAc,IAAI,UAAU,GAAG;AAClC,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa,IAAI;AACvB,eAAW,KAAK,YAAY;AAC1B,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,UAAI,CAAC,sBAAsB,CAAC,GAAG;AAC7B,cAAM,IAAI,MAAM,2DAA2D,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AACA,WAAO,aAAa,WAAW,UAAsB;AAAA,EACvD;AAEA,SAAO;AACT;AAQO,SAAS,uBAAuB,MAAqD;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,QAAQ,UAAa,KAAK,eAAe;AACvD;AAQO,SAAS,mBAAmB,MAA4C,IAAqB;AAClG,MAAI,MAAM,QAAQ,OAAW,QAAO;AACpC,SAAO,KAAK,IAAI,SAAS,EAAE;AAC7B;AAQO,SAAS,0BACd,MACA,WACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,KAAK,WAAW,SAAS,SAAS;AAC3C;AAMO,SAAS,uBACd,MACA,IACM;AACN,MAAI,CAAC,mBAAmB,MAAM,EAAE,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,6CAA6C,EAAE;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,uBACd,MACA,WACM;AACN,MAAI,CAAC,0BAA0B,MAAM,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6FACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAYO,SAAS,0BACd,WACA,kBACoB;AACpB,QAAM,aAAa,cAAc,UAAa,UAAU,SAAS,IAAI,YAAY;AACjF,SAAO,cAAc;AACvB;AAeO,SAAS,mBACd,MACA,WACA,kBACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,QAAM,YAAY,0BAA0B,WAAW,gBAAgB;AACvE,SAAO,cAAc,UAAa,KAAK,WAAW,SAAS,SAAS;AACtE;AAEO,SAAS,0BACd,MACA,WACA,kBACM;AACN,MAAI,mBAAmB,MAAM,WAAW,gBAAgB,EAAG;AAC3D,QAAM,IAAI;AAAA,IACR,cAAc,SACV,6HACA,+CAA+C,SAAS;AAAA,EAC9D;AACF;AAsBO,SAAS,gCACd,MACM;AAIN,MAAI,CAAC,0BAA0B,MAAM,MAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,IAAI,kBAAiD;","names":[]}

package/dist/{chunk-BFVEEB7W.js → chunk-7ON2JW73.js}

@@ -1,12 +1,16 @@
+import {
+  TAG_LIMITS,
+  composeMemoryEnvelope
+} from "./chunk-CGASUJVP.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-BFPETA3S.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
+} from "./chunk-SCCO46KZ.js";
 
 // src/explicit-capture.ts
 import { randomUUID } from "crypto";
@@ -274,15 +278,27 @@ function validateExplicitCaptureInput(input, mode = "strict_explicit") {
     throw new Error(`unsafe namespace: ${requestedNamespace}`);
   }
   const expiresAt = parseExplicitCaptureTtl(input.ttl);
+  const dedupedTags = Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean)));
+  if (dedupedTags.length > TAG_LIMITS.maxTags) {
+    throw new Error(`too many tags: ${dedupedTags.length} exceeds the ${TAG_LIMITS.maxTags}-tag limit`);
+  }
+  for (const tag of dedupedTags) {
+    if (tag.length > TAG_LIMITS.maxTagLength) {
+      throw new Error(`tag exceeds ${TAG_LIMITS.maxTagLength} characters: ${JSON.stringify(tag.slice(0, 40))}\u2026`);
+    }
+  }
   return {
     content,
     category,
     confidence,
     namespace: asTrimmed(input.namespace),
-    tags: Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean))),
+    tags: dedupedTags,
     entityRef: asTrimmed(input.entityRef),
     sourceReason: asTrimmed(input.sourceReason),
-    sourceConnector: input.sourceConnector,
+    // Trimmed like the other optional metadata (#2017 review round): a
+    // whitespace-only connector previously passed validation and then blew
+    // up at strict compose time - validated input must always compose.
+    sourceConnector: asTrimmed(input.sourceConnector),
     expiresAt
   };
 }
@@ -322,14 +338,20 @@ async function persistExplicitCapture(orchestrator, candidate, source) {
     return { id: duplicateOf, duplicateOf };
   }
   const storage = await orchestrator.getStorage(resolvedNamespace);
-  const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, candidate.content, {
-    confidence: candidate.confidence,
-    tags: candidate.tags,
-    entityRef: candidate.entityRef,
-    expiresAt: candidate.expiresAt,
-    source: source === "inline" ? "explicit-inline" : "explicit",
-    ...candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}
-  });
+  const captureEnvelope = composeMemoryEnvelope(
+    {
+      content: candidate.content,
+      category: candidate.category,
+      confidence: candidate.confidence,
+      tags: candidate.tags,
+      ...candidate.entityRef ? { entityRef: candidate.entityRef } : {},
+      ...candidate.expiresAt ? { ttl: candidate.expiresAt } : {},
+      ...candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {},
+      ...candidate.sourceReason ? { sourceReason: candidate.sourceReason } : {}
+    },
+    { source: source === "inline" ? "explicit-inline" : "explicit" }
+  );
+  const { id, tombstoneBlocked } = await storage.writeSealedMemory(captureEnvelope);
   const created = (/* @__PURE__ */ new Date()).toISOString();
   const event = {
     eventId: `mle-${randomUUID()}`,
@@ -402,13 +424,26 @@ async function queueExplicitCaptureForReview(orchestrator, input, source, error)
   const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory) ? requestedCategory : "fact";
   const requestedTags = sanitizeReviewTags(input.tags);
   const storage = await orchestrator.getStorage(queueNamespace);
-  const { id } = await storage.writeMemory(reviewCategory, content, {
-    confidence: 0.2,
-    tags: Array.from(/* @__PURE__ */ new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
-    entityRef: sanitizeReviewMetadata(input.entityRef),
-    source: source === "inline" ? "explicit-inline-review" : "explicit-review",
-    ...input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}
-  });
+  const reviewEnvelope = composeMemoryEnvelope(
+    {
+      content,
+      category: reviewCategory,
+      confidence: 0.2,
+      tags: Array.from(/* @__PURE__ */ new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
+      ...sanitizeReviewMetadata(input.entityRef) ? { entityRef: sanitizeReviewMetadata(input.entityRef) } : {},
+      ...input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}
+    },
+    { source: source === "inline" ? "explicit-inline-review" : "explicit-review" },
+    // The review queue is the FALLBACK for a capture that already failed
+    // primary validation — it must never be un-queueable. The tag list is
+    // machine-assembled (requested tags + the two fixed review tags), so 49+
+    // requested tags would push past the 50-tag limit and strict compose
+    // would throw, losing the capture (#2014 review round). Salvage clamps
+    // instead; the fixed review tags sort first in the assembly above, so
+    // they always survive the clamp.
+    { salvage: true }
+  );
+  const { id } = await storage.writeSealedMemory(reviewEnvelope);
   try {
     const created = await storage.getMemoryById(id);
     if (created) {
@@ -452,4 +487,4 @@ export {
   shouldSkipImplicitExtraction,
   shouldProcessInlineExplicitCapture
 };
-//# sourceMappingURL=chunk-BFVEEB7W.js.map
+//# sourceMappingURL=chunk-7ON2JW73.js.map

package/dist/chunk-7ON2JW73.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/explicit-capture.ts"],"sourcesContent":["import { composeMemoryEnvelope, TAG_LIMITS } from \"./write-envelope.js\";\nimport { resolveNamespaceCapabilities } from \"./capabilities.js\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Orchestrator } from \"./orchestrator.js\";\nimport { isSafeRouteNamespace } from \"./routing/engine.js\";\nimport { sanitizeMemoryContent } from \"./sanitize.js\";\nimport { ContentHashIndex } from \"./storage.js\";\nimport type { CaptureMode, MemoryCategory, MemoryLifecycleEvent, PluginConfig } from \"./types.js\";\n\nexport type ExplicitCaptureInput = {\n  content: string;\n  category?: string;\n  confidence?: number;\n  namespace?: string;\n  tags?: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  ttl?: string;\n  sourceReason?: string;\n};\n\nexport type ValidExplicitCapture = {\n  content: string;\n  category: MemoryCategory;\n  confidence: number;\n  namespace?: string;\n  tags: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  expiresAt?: string;\n  sourceReason?: string;\n  /**\n   * When true, `namespace` was already resolved AND authorized by the caller\n   * (the access service's `resolveCodingScopedWriteNamespace`, which auth-checks\n   * the base and derives a session-owned `project-*` overlay). The persist /\n   * queue layer then routes to it directly instead of re-validating against the\n   * static policy allow-list — which would otherwise reject legitimately-derived\n   * dynamic project namespaces (#1434). Callers that do NOT pre-authorize the\n   * namespace must leave this unset so the allow-list guard still applies.\n   */\n  namespacePreResolved?: boolean;\n};\n\nexport type ExplicitCaptureSource = \"memory_store\" | \"memory_capture\" | \"suggestion_submit\" | \"inline\";\ntype ExplicitCaptureValidationMode = \"legacy_tool\" | \"strict_explicit\";\n\n// Bounded body {0,100000} instead of an unbounded lazy *? so scanning for the\n// closing tag cannot backtrack polynomially on unterminated <memory_note>\n// markup in hostile turn text (CodeQL js/polynomial-redos). 100 000 chars far\n// exceeds any real inline note, so matching is behavior-preserving; the outer\n// \\s* groups were also dropped (body absorbs whitespace; captures are trimmed).\nconst INLINE_NOTE_RE = /<memory_note>([\\s\\S]{0,100000}?)<\\/memory_note>/gi;\nconst INLINE_NOTE_MARKUP_RE = /<memory_note>[\\s\\S]{0,100000}?<\\/memory_note>/i;\nconst INLINE_ALLOWED_CATEGORIES = new Set<MemoryCategory>([\n  \"fact\",\n  \"preference\",\n  \"correction\",\n  \"entity\",\n  \"decision\",\n  \"relationship\",\n  \"principle\",\n  \"commitment\",\n  \"moment\",\n  \"skill\",\n  \"rule\",\n  \"procedure\",\n  \"reasoning_trace\",\n]);\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /\\bsk-[A-Za-z0-9]{16,}\\b/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n  /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/i,\n  /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/i,\n  /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/i,\n];\nconst SECRET_REDACTION_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [\n  { pattern: /\\bsk-[A-Za-z0-9]{16,}\\b/g, replacement: \"[redacted openai key]\" },\n  { pattern: /\\bAKIA[0-9A-Z]{16}\\b/g, replacement: \"[redacted aws key]\" },\n  { pattern: /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/gi, replacement: \"Bearer [redacted token]\" },\n  {\n    pattern: /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"[redacted credential]\",\n  },\n  {\n    pattern: /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"authorization: [redacted credential]\",\n  },\n];\nconst EXPLICIT_CAPTURE_REVIEW_TAGS = [\"explicit-capture\", \"queued-review\"];\n\nfunction explicitCaptureActor(source: ExplicitCaptureSource): string {\n  switch (source) {\n    case \"inline\":\n      return \"inline.memory_note\";\n    case \"memory_store\":\n      return \"tool.memory_store\";\n    case \"suggestion_submit\":\n      return \"tool.suggestion_submit\";\n    default:\n      return \"tool.memory_capture\";\n  }\n}\n\nfunction asTrimmed(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed && trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction normalizeCaptureContent(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction redactSecrets(value: string): string {\n  let redacted = value;\n  for (const { pattern, replacement } of SECRET_REDACTION_PATTERNS) {\n    redacted = redacted.replace(pattern, replacement);\n  }\n  return redacted;\n}\n\nfunction containsSecretLikeValue(value: string): boolean {\n  return SECRET_PATTERNS.some((pattern) => pattern.test(value));\n}\n\nfunction assertNoSecretLikeMetadata(field: string, value: string | undefined): void {\n  const trimmed = asTrimmed(value);\n  if (trimmed && containsSecretLikeValue(trimmed)) {\n    throw new Error(`${field} appears to contain a secret or credential`);\n  }\n}\n\nfunction assertNoSecretLikeMetadataList(field: string, values: string[] | undefined): void {\n  for (const value of values ?? []) {\n    assertNoSecretLikeMetadata(field, value);\n  }\n}\n\nfunction sanitizeReviewText(value: string | undefined, fallback: string): string {\n  const redacted = redactSecrets(asTrimmed(value) ?? fallback);\n  const sanitized = sanitizeMemoryContent(redacted);\n  const safe = sanitized.text.trim();\n  return safe.length > 0 ? safe : fallback;\n}\n\nfunction sanitizeReviewMetadata(value: string | undefined): string | undefined {\n  const trimmed = asTrimmed(value);\n  if (!trimmed) return undefined;\n  return sanitizeReviewText(trimmed, \"[redacted]\");\n}\n\nfunction sanitizeReviewTags(tags: string[] | undefined): string[] {\n  return Array.from(new Set((tags ?? [])\n    .map((tag) => sanitizeReviewMetadata(tag))\n    .filter((tag): tag is string => typeof tag === \"string\" && tag.length > 0)));\n}\n\nfunction normalizeExplicitCaptureError(error: unknown): string {\n  if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();\n  const rendered = String(error).trim();\n  return rendered.length > 0 ? rendered : \"explicit capture failed\";\n}\n\nfunction resolveExplicitCaptureReviewNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  return resolveExplicitCaptureNamespace(orchestrator, normalized);\n}\n\nfunction resolveExplicitCaptureNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {\n    if (normalized !== orchestrator.config.defaultNamespace) {\n      throw new Error(`unsupported namespace: ${normalized}`);\n    }\n    return normalized;\n  }\n  const allowed = new Set([\n    orchestrator.config.defaultNamespace,\n    orchestrator.config.sharedNamespace,\n    ...orchestrator.config.namespacePolicies.map((policy) => policy.name),\n  ].map((value) => value.trim()).filter(Boolean));\n  if (!allowed.has(normalized)) {\n    throw new Error(`unsupported namespace: ${normalized}`);\n  }\n  return normalized;\n}\n\nfunction parseExplicitCaptureTtl(ttl: string | undefined): string | undefined {\n  const raw = asTrimmed(ttl);\n  if (!raw) return undefined;\n\n  const absoluteMs = Date.parse(raw);\n  if (Number.isFinite(absoluteMs)) {\n    return new Date(absoluteMs).toISOString();\n  }\n\n  const relative = raw.match(/^(\\d+)\\s*([mhdw])$/i);\n  if (!relative) {\n    throw new Error(\"ttl must be an ISO-8601 timestamp or relative duration like 30m, 12h, 7d, or 2w\");\n  }\n\n  const amount = Number.parseInt(relative[1] ?? \"\", 10);\n  const unit = (relative[2] ?? \"\").toLowerCase();\n  if (!Number.isFinite(amount) || amount <= 0) {\n    throw new Error(\"ttl duration must be a positive integer\");\n  }\n\n  const multiplier =\n    unit === \"m\" ? 60_000\n      : unit === \"h\" ? 60 * 60_000\n        : unit === \"d\" ? 24 * 60 * 60_000\n          : 7 * 24 * 60 * 60_000;\n  return new Date(Date.now() + amount * multiplier).toISOString();\n}\n\nfunction parseInlineConfidence(value: string): number {\n  const trimmed = value.trim();\n  if (!/^[+-]?(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    return Number.NaN;\n  }\n  const parsed = Number(trimmed);\n  return Number.isFinite(parsed) ? parsed : Number.NaN;\n}\n\nfunction parseInlineNote(block: string): ExplicitCaptureInput | null {\n  const lines = block.replace(/\\r/g, \"\").split(\"\\n\");\n  const note: Partial<ExplicitCaptureInput> = {};\n  let idx = 0;\n\n  while (idx < lines.length) {\n    const rawLine = lines[idx] ?? \"\";\n    const line = rawLine.trim();\n    idx += 1;\n    if (line.length === 0) continue;\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx < 0) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n\n    if (key === \"content\" && value === \"|\") {\n      const contentLines: string[] = [];\n      while (idx < lines.length) {\n        const next = lines[idx] ?? \"\";\n        if (next.startsWith(\"  \") || next.startsWith(\"\\t\")) {\n          contentLines.push(next.replace(/^(  |\\t)/, \"\"));\n          idx += 1;\n          continue;\n        }\n        if (next.trim().length === 0) {\n          contentLines.push(\"\");\n          idx += 1;\n          continue;\n        }\n        break;\n      }\n      note.content = contentLines.join(\"\\n\").trim();\n      continue;\n    }\n\n    switch (key) {\n      case \"content\":\n        note.content = value;\n        break;\n      case \"category\":\n        note.category = value;\n        break;\n      case \"confidence\":\n        note.confidence = parseInlineConfidence(value);\n        break;\n      case \"namespace\":\n        note.namespace = value;\n        break;\n      case \"tags\":\n        note.tags = value\n          .split(\",\")\n          .map((entry) => entry.trim())\n          .filter(Boolean);\n        break;\n      case \"entityRef\":\n        note.entityRef = value;\n        break;\n      case \"ttl\":\n        note.ttl = value;\n        break;\n      case \"sourceReason\":\n        note.sourceReason = value;\n        break;\n      default:\n        break;\n    }\n  }\n\n  return asTrimmed(note.content) ? (note as ExplicitCaptureInput) : null;\n}\n\nexport function parseInlineExplicitCaptureNotes(text: string): ExplicitCaptureInput[] {\n  const notes: ExplicitCaptureInput[] = [];\n  for (const match of text.matchAll(INLINE_NOTE_RE)) {\n    const parsed = parseInlineNote(match[1] ?? \"\");\n    if (parsed) notes.push(parsed);\n  }\n  return notes;\n}\n\nexport function hasInlineExplicitCaptureMarkup(text: string): boolean {\n  return INLINE_NOTE_MARKUP_RE.test(text);\n}\n\nexport function stripInlineExplicitCaptureNotes(text: string): string {\n  return text.replace(INLINE_NOTE_RE, \"\").trim();\n}\n\nexport function validateExplicitCaptureInput(\n  input: ExplicitCaptureInput,\n  mode: ExplicitCaptureValidationMode = \"strict_explicit\",\n): ValidExplicitCapture {\n  const content = asTrimmed(input.content);\n  if (!content) throw new Error(\"content is required\");\n  if (mode === \"strict_explicit\") {\n    if (content.length < 10) throw new Error(\"content must be at least 10 characters\");\n    if (content.length > 4000) throw new Error(\"content must be 4000 characters or fewer\");\n  }\n  if (/<memory_note>/i.test(content) || /<\\/memory_note>/i.test(content)) {\n    throw new Error(\"nested memory_note blocks are not allowed\");\n  }\n\n  const category = (asTrimmed(input.category) ?? \"fact\") as MemoryCategory;\n  if (!INLINE_ALLOWED_CATEGORIES.has(category)) {\n    throw new Error(`unsupported category: ${input.category ?? category}`);\n  }\n\n  const sanitized = sanitizeMemoryContent(content);\n  if (!sanitized.clean) {\n    throw new Error(\"content failed memory sanitization\");\n  }\n  for (const pattern of SECRET_PATTERNS) {\n    if (pattern.test(content)) {\n      throw new Error(\"content appears to contain a secret or credential\");\n    }\n  }\n  assertNoSecretLikeMetadata(\"sourceReason\", input.sourceReason);\n  assertNoSecretLikeMetadata(\"entityRef\", input.entityRef);\n  assertNoSecretLikeMetadata(\"ttl\", input.ttl);\n  assertNoSecretLikeMetadataList(\"tags\", input.tags);\n\n  if (input.confidence !== undefined && !Number.isFinite(input.confidence)) {\n    throw new Error(\"confidence must be a finite number\");\n  }\n  const confidence = input.confidence === undefined ? 0.95 : Number(input.confidence);\n  if (confidence < 0 || confidence > 1) {\n    throw new Error(\"confidence must be between 0 and 1\");\n  }\n  const requestedNamespace = asTrimmed(input.namespace);\n  if (requestedNamespace && !isSafeRouteNamespace(requestedNamespace)) {\n    throw new Error(`unsafe namespace: ${requestedNamespace}`);\n  }\n  const expiresAt = parseExplicitCaptureTtl(input.ttl);\n\n  // #2014 review round: enforce the composer's tag contract HERE so a capture\n  // that passes validation can never fail later at strict compose time\n  // (validated-then-thrown was a broken contract). Same limits as TAG_LIMITS.\n  const dedupedTags = Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean)));\n  if (dedupedTags.length > TAG_LIMITS.maxTags) {\n    throw new Error(`too many tags: ${dedupedTags.length} exceeds the ${TAG_LIMITS.maxTags}-tag limit`);\n  }\n  for (const tag of dedupedTags) {\n    if (tag.length > TAG_LIMITS.maxTagLength) {\n      throw new Error(`tag exceeds ${TAG_LIMITS.maxTagLength} characters: ${JSON.stringify(tag.slice(0, 40))}…`);\n    }\n  }\n\n  return {\n    content,\n    category,\n    confidence,\n    namespace: asTrimmed(input.namespace),\n    tags: dedupedTags,\n    entityRef: asTrimmed(input.entityRef),\n    sourceReason: asTrimmed(input.sourceReason),\n    // Trimmed like the other optional metadata (#2017 review round): a\n    // whitespace-only connector previously passed validation and then blew\n    // up at strict compose time - validated input must always compose.\n    sourceConnector: asTrimmed(input.sourceConnector),\n    expiresAt,\n  };\n}\n\nasync function findDuplicateExplicitCapture(\n  orchestrator: Orchestrator,\n  resolvedNamespace: string | undefined,\n  candidate: ValidExplicitCapture,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  if (\n    candidate.category === \"fact\"\n    && typeof (storage as { hasFactContentHash?: (content: string) => Promise<boolean> }).hasFactContentHash === \"function\"\n  ) {\n    try {\n      const hasHash = await (storage as { hasFactContentHash: (content: string) => Promise<boolean> }).hasFactContentHash(\n        candidate.content,\n      );\n      if (!hasHash) {\n        const authoritative =\n          typeof (storage as { isFactContentHashAuthoritative?: () => Promise<boolean> | boolean }).isFactContentHashAuthoritative\n            === \"function\"\n            ? await (storage as { isFactContentHashAuthoritative: () => Promise<boolean> | boolean })\n              .isFactContentHashAuthoritative()\n            : false;\n        if (authoritative) return null;\n      }\n    } catch (err) {\n      // Fail open: hash index is only an optimization, so fall back to the full corpus scan.\n      void err;\n    }\n  }\n  const existing = await storage.readAllMemories();\n  const normalizedCandidate = normalizeCaptureContent(candidate.content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"active\") return false;\n    if (memory.frontmatter.category !== candidate.category) return false;\n    if (normalizeCaptureContent(memory.content) !== normalizedCandidate) return false;\n    // Connector-aware dedup: same content from different connectors is NOT\n    // a duplicate. Operator (undefined) and connector-tagged memories are\n    // always distinct. Normalize empty strings to undefined.\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = candidate.sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function persistExplicitCapture(\n  orchestrator: Orchestrator,\n  candidate: ValidExplicitCapture,\n  source: ExplicitCaptureSource,\n): Promise<{ id: string; duplicateOf?: string; tombstoneBlocked?: boolean }> {\n  const resolvedNamespace = candidate.namespacePreResolved\n    ? asTrimmed(candidate.namespace)\n    : resolveExplicitCaptureNamespace(orchestrator, candidate.namespace);\n  const duplicateOf = await findDuplicateExplicitCapture(orchestrator, resolvedNamespace, candidate);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  // #1645 (review thread yG-): surface the tombstone block so callers\n  // (memory_store tool, access-service HTTP/MCP) can report the capture as\n  // queued for review instead of a successfully stored active memory.\n  // Sealed-envelope write (issue #1989 PR2).\n  const captureEnvelope = composeMemoryEnvelope(\n    {\n      content: candidate.content,\n      category: candidate.category,\n      confidence: candidate.confidence,\n      tags: candidate.tags,\n      ...(candidate.entityRef ? { entityRef: candidate.entityRef } : {}),\n      ...(candidate.expiresAt ? { ttl: candidate.expiresAt } : {}),\n      ...(candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}),\n      ...(candidate.sourceReason ? { sourceReason: candidate.sourceReason } : {}),\n    },\n    { source: source === \"inline\" ? \"explicit-inline\" : \"explicit\" },\n  );\n  const { id, tombstoneBlocked } = await storage.writeSealedMemory(captureEnvelope);\n  // #1522: catalog touch handled at the storage chokepoint — the StorageManager's\n  // post-write hook records the namespace touch automatically.\n\n  const created = new Date().toISOString();\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_accepted\",\n    timestamp: created,\n    actor: explicitCaptureActor(source),\n    reasonCode: candidate.sourceReason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n\n  return { id, tombstoneBlocked };\n}\n\nfunction buildExplicitCaptureReviewContent(input: ExplicitCaptureInput, reason: string): string {\n  const requestedContent = asTrimmed(input.content);\n  const safeContent = sanitizeReviewText(requestedContent, \"[empty explicit capture]\");\n  const safeCategory = sanitizeReviewMetadata(input.category);\n  const safeNamespace = sanitizeReviewMetadata(input.namespace);\n  const safeEntityRef = sanitizeReviewMetadata(input.entityRef);\n  const safeTtl = sanitizeReviewMetadata(input.ttl);\n  const safeSourceReason = sanitizeReviewMetadata(input.sourceReason);\n  const safeTags = sanitizeReviewTags(input.tags);\n  const lines = [\n    \"Explicit capture queued for review.\",\n    \"\",\n    `Reason: ${reason}`,\n    \"\",\n    \"Submitted content:\",\n    safeContent,\n  ];\n  const metadata = [\n    safeCategory ? `Requested category: ${safeCategory}` : undefined,\n    safeNamespace ? `Requested namespace: ${safeNamespace}` : undefined,\n    safeEntityRef ? `Requested entityRef: ${safeEntityRef}` : undefined,\n    safeTtl ? `Requested ttl: ${safeTtl}` : undefined,\n    safeSourceReason ? `Requested sourceReason: ${safeSourceReason}` : undefined,\n    safeTags.length > 0 ? `Requested tags: ${safeTags.join(\", \")}` : undefined,\n  ].filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n  if (metadata.length > 0) {\n    lines.push(\"\", ...metadata);\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function findQueuedExplicitCaptureDuplicate(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n  content: string,\n  sourceConnector?: string,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(namespace);\n  const existing = await storage.readAllMemories();\n  const normalized = normalizeCaptureContent(content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"pending_review\") return false;\n    if (!(memory.frontmatter.tags ?? []).includes(\"queued-review\")) return false;\n    if (normalizeCaptureContent(memory.content) !== normalized) return false;\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function queueExplicitCaptureForReview(\n  orchestrator: Orchestrator,\n  input: ExplicitCaptureInput,\n  source: ExplicitCaptureSource,\n  error: unknown,\n): Promise<{ id: string; duplicateOf?: string }> {\n  const reason = sanitizeReviewText(normalizeExplicitCaptureError(error), \"explicit capture failed\");\n  const requestedNamespace = asTrimmed(input.namespace);\n  // A caller-pre-authorized namespace (e.g. a session-owned project overlay\n  // from the access service) routes directly; otherwise apply the static\n  // policy allow-list guard (#1434).\n  const queueNamespace = (input as { namespacePreResolved?: boolean }).namespacePreResolved\n    ? requestedNamespace\n    : resolveExplicitCaptureReviewNamespace(orchestrator, requestedNamespace);\n  const content = buildExplicitCaptureReviewContent(input, reason);\n  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content, input.sourceConnector);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const requestedCategory = asTrimmed(input.category);\n  const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory as MemoryCategory)\n    ? requestedCategory as MemoryCategory\n    : \"fact\";\n  const requestedTags = sanitizeReviewTags(input.tags);\n  const storage = await orchestrator.getStorage(queueNamespace);\n  const reviewEnvelope = composeMemoryEnvelope(\n    {\n      content,\n      category: reviewCategory,\n      confidence: 0.2,\n      tags: Array.from(new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),\n      ...(sanitizeReviewMetadata(input.entityRef) ? { entityRef: sanitizeReviewMetadata(input.entityRef) } : {}),\n      ...(input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}),\n    },\n    { source: source === \"inline\" ? \"explicit-inline-review\" : \"explicit-review\" },\n    // The review queue is the FALLBACK for a capture that already failed\n    // primary validation — it must never be un-queueable. The tag list is\n    // machine-assembled (requested tags + the two fixed review tags), so 49+\n    // requested tags would push past the 50-tag limit and strict compose\n    // would throw, losing the capture (#2014 review round). Salvage clamps\n    // instead; the fixed review tags sort first in the assembly above, so\n    // they always survive the clamp.\n    { salvage: true },\n  );\n  const { id: id } = await storage.writeSealedMemory(reviewEnvelope);\n  try {\n    const created = await storage.getMemoryById(id);\n    if (created) {\n      await storage.writeMemoryFrontmatter(created, {\n        status: \"pending_review\",\n        updated: new Date().toISOString(),\n      }, {\n        actor: explicitCaptureActor(source),\n        reasonCode: reason,\n        ruleVersion: \"explicit-capture.v1\",\n      });\n    }\n  } finally {\n    // Record the catalog write touch (issue #1499, round 5/6 codex P2; NIhUg).\n    // A queued review capture writes memory to the namespace's root (the DEFAULT\n    // root when undefined), so its `lastWriteAt` must reflect the write once\n    // `writeMemory` returns an id. If the later pending-review frontmatter update\n    // fails, the memory file is still durable and must not disappear from\n    // writtenSince/maintenance scheduling. Guarded optional hook (rule #33).\n    // #1522: catalog touch handled at the storage chokepoint.\n  }\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_queued\",\n    timestamp: new Date().toISOString(),\n    actor: explicitCaptureActor(source),\n    reasonCode: reason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n  return { id };\n}\n\nexport function shouldSkipImplicitExtraction(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode === \"explicit\";\n}\n\nexport function shouldProcessInlineExplicitCapture(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode !== \"implicit\";\n}\n"],"mappings":";;;;;;;;;;;;;;;AAEA,SAAS,kBAAkB;AAiD3B,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,oBAAI,IAAoB;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,kBAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4BAA6E;AAAA,EACjF,EAAE,SAAS,4BAA4B,aAAa,wBAAwB;AAAA,EAC5E,EAAE,SAAS,yBAAyB,aAAa,qBAAqB;AAAA,EACtE,EAAE,SAAS,sCAAsC,aAAa,0BAA0B;AAAA,EACxF;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AACA,IAAM,+BAA+B,CAAC,oBAAoB,eAAe;AAEzE,SAAS,qBAAqB,QAAuC;AACnE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,WAAW,QAAQ,SAAS,IAAI,UAAU;AACnD;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MACJ,YAAY,EACZ,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,WAAW;AACf,aAAW,EAAE,SAAS,YAAY,KAAK,2BAA2B;AAChE,eAAW,SAAS,QAAQ,SAAS,WAAW;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAC9D;AAEA,SAAS,2BAA2B,OAAe,OAAiC;AAClF,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,WAAW,wBAAwB,OAAO,GAAG;AAC/C,UAAM,IAAI,MAAM,GAAG,KAAK,4CAA4C;AAAA,EACtE;AACF;AAEA,SAAS,+BAA+B,OAAe,QAAoC;AACzF,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,+BAA2B,OAAO,KAAK;AAAA,EACzC;AACF;AAEA,SAAS,mBAAmB,OAA2B,UAA0B;AAC/E,QAAM,WAAW,cAAc,UAAU,KAAK,KAAK,QAAQ;AAC3D,QAAM,YAAY,sBAAsB,QAAQ;AAChD,QAAM,OAAO,UAAU,KAAK,KAAK;AACjC,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,uBAAuB,OAA+C;AAC7E,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,mBAAmB,SAAS,YAAY;AACjD;AAEA,SAAS,mBAAmB,MAAsC;AAChE,SAAO,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC,GACjC,IAAI,CAAC,QAAQ,uBAAuB,GAAG,CAAC,EACxC,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC;AAC/E;AAEA,SAAS,8BAA8B,OAAwB;AAC7D,MAAI,iBAAiB,SAAS,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,QAAQ,KAAK;AACzF,QAAM,WAAW,OAAO,KAAK,EAAE,KAAK;AACpC,SAAO,SAAS,SAAS,IAAI,WAAW;AAC1C;AAEA,SAAS,sCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,gCAAgC,cAAc,UAAU;AACjE;AAEA,SAAS,gCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,CAAC,6BAA6B,aAAa,MAAM,EAAE,YAAY;AACjE,QAAI,eAAe,aAAa,OAAO,kBAAkB;AACvD,YAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI;AAAA,IACtB,aAAa,OAAO;AAAA,IACpB,aAAa,OAAO;AAAA,IACpB,GAAG,aAAa,OAAO,kBAAkB,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,EACtE,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;AAC9C,MAAI,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC5B,UAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA6C;AAC5E,QAAM,MAAM,UAAU,GAAG;AACzB,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,aAAa,KAAK,MAAM,GAAG;AACjC,MAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,WAAO,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,EAC1C;AAEA,QAAM,WAAW,IAAI,MAAM,qBAAqB;AAChD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AAEA,QAAM,SAAS,OAAO,SAAS,SAAS,CAAC,KAAK,IAAI,EAAE;AACpD,QAAM,QAAQ,SAAS,CAAC,KAAK,IAAI,YAAY;AAC7C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AAC3C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,aACJ,SAAS,MAAM,MACX,SAAS,MAAM,KAAK,MAClB,SAAS,MAAM,KAAK,KAAK,MACvB,IAAI,KAAK,KAAK;AACxB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,UAAU,EAAE,YAAY;AAChE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,gDAAgD,KAAK,OAAO,GAAG;AAClE,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;AAEA,SAAS,gBAAgB,OAA4C;AACnE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACjD,QAAM,OAAsC,CAAC;AAC7C,MAAI,MAAM;AAEV,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,UAAU,MAAM,GAAG,KAAK;AAC9B,UAAM,OAAO,QAAQ,KAAK;AAC1B,WAAO;AACP,QAAI,KAAK,WAAW,EAAG;AACvB,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAE5C,QAAI,QAAQ,aAAa,UAAU,KAAK;AACtC,YAAM,eAAyB,CAAC;AAChC,aAAO,MAAM,MAAM,QAAQ;AACzB,cAAM,OAAO,MAAM,GAAG,KAAK;AAC3B,YAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,GAAI,GAAG;AAClD,uBAAa,KAAK,KAAK,QAAQ,YAAY,EAAE,CAAC;AAC9C,iBAAO;AACP;AAAA,QACF;AACA,YAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAC5B,uBAAa,KAAK,EAAE;AACpB,iBAAO;AACP;AAAA,QACF;AACA;AAAA,MACF;AACA,WAAK,UAAU,aAAa,KAAK,IAAI,EAAE,KAAK;AAC5C;AAAA,IACF;AAEA,YAAQ,KAAK;AAAA,MACX,KAAK;AACH,aAAK,UAAU;AACf;AAAA,MACF,KAAK;AACH,aAAK,WAAW;AAChB;AAAA,MACF,KAAK;AACH,aAAK,aAAa,sBAAsB,KAAK;AAC7C;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,OAAO,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACjB;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,MAAM;AACX;AAAA,MACF,KAAK;AACH,aAAK,eAAe;AACpB;AAAA,MACF;AACE;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,UAAU,KAAK,OAAO,IAAK,OAAgC;AACpE;AAEO,SAAS,gCAAgC,MAAsC;AACpF,QAAM,QAAgC,CAAC;AACvC,aAAW,SAAS,KAAK,SAAS,cAAc,GAAG;AACjD,UAAM,SAAS,gBAAgB,MAAM,CAAC,KAAK,EAAE;AAC7C,QAAI,OAAQ,OAAM,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,+BAA+B,MAAuB;AACpE,SAAO,sBAAsB,KAAK,IAAI;AACxC;AAEO,SAAS,gCAAgC,MAAsB;AACpE,SAAO,KAAK,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAC/C;AAEO,SAAS,6BACd,OACA,OAAsC,mBAChB;AACtB,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,qBAAqB;AACnD,MAAI,SAAS,mBAAmB;AAC9B,QAAI,QAAQ,SAAS,GAAI,OAAM,IAAI,MAAM,wCAAwC;AACjF,QAAI,QAAQ,SAAS,IAAM,OAAM,IAAI,MAAM,0CAA0C;AAAA,EACvF;AACA,MAAI,iBAAiB,KAAK,OAAO,KAAK,mBAAmB,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,WAAY,UAAU,MAAM,QAAQ,KAAK;AAC/C,MAAI,CAAC,0BAA0B,IAAI,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,yBAAyB,MAAM,YAAY,QAAQ,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,sBAAsB,OAAO;AAC/C,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,aAAW,WAAW,iBAAiB;AACrC,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF;AACA,6BAA2B,gBAAgB,MAAM,YAAY;AAC7D,6BAA2B,aAAa,MAAM,SAAS;AACvD,6BAA2B,OAAO,MAAM,GAAG;AAC3C,iCAA+B,QAAQ,MAAM,IAAI;AAEjD,MAAI,MAAM,eAAe,UAAa,CAAC,OAAO,SAAS,MAAM,UAAU,GAAG;AACxE,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,aAAa,MAAM,eAAe,SAAY,OAAO,OAAO,MAAM,UAAU;AAClF,MAAI,aAAa,KAAK,aAAa,GAAG;AACpC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,qBAAqB,UAAU,MAAM,SAAS;AACpD,MAAI,sBAAsB,CAAC,qBAAqB,kBAAkB,GAAG;AACnE,UAAM,IAAI,MAAM,qBAAqB,kBAAkB,EAAE;AAAA,EAC3D;AACA,QAAM,YAAY,wBAAwB,MAAM,GAAG;AAKnD,QAAM,cAAc,MAAM,KAAK,IAAI,KAAK,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACnG,MAAI,YAAY,SAAS,WAAW,SAAS;AAC3C,UAAM,IAAI,MAAM,kBAAkB,YAAY,MAAM,gBAAgB,WAAW,OAAO,YAAY;AAAA,EACpG;AACA,aAAW,OAAO,aAAa;AAC7B,QAAI,IAAI,SAAS,WAAW,cAAc;AACxC,YAAM,IAAI,MAAM,eAAe,WAAW,YAAY,gBAAgB,KAAK,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,QAAG;AAAA,IAC3G;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,MAAM;AAAA,IACN,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,cAAc,UAAU,MAAM,YAAY;AAAA;AAAA;AAAA;AAAA,IAI1C,iBAAiB,UAAU,MAAM,eAAe;AAAA,IAChD;AAAA,EACF;AACF;AAEA,eAAe,6BACb,cACA,mBACA,WACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAC/D,MACE,UAAU,aAAa,UACpB,OAAQ,QAA2E,uBAAuB,YAC7G;AACA,QAAI;AACF,YAAM,UAAU,MAAO,QAA0E;AAAA,QAC/F,UAAU;AAAA,MACZ;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,gBACJ,OAAQ,QAAkF,mCACpF,aACF,MAAO,QACN,+BAA+B,IAChC;AACN,YAAI,cAAe,QAAO;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AAEZ,WAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,sBAAsB,wBAAwB,UAAU,OAAO;AACrE,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,SAAU,QAAO;AAChC,QAAI,OAAO,YAAY,aAAa,UAAU,SAAU,QAAO;AAC/D,QAAI,wBAAwB,OAAO,OAAO,MAAM,oBAAqB,QAAO;AAI5E,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,UAAU,iBAAiB,KAAK,KAAK;AAC1D,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,uBACpB,cACA,WACA,QAC2E;AAC3E,QAAM,oBAAoB,UAAU,uBAChC,UAAU,UAAU,SAAS,IAC7B,gCAAgC,cAAc,UAAU,SAAS;AACrE,QAAM,cAAc,MAAM,6BAA6B,cAAc,mBAAmB,SAAS;AACjG,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAK/D,QAAM,kBAAkB;AAAA,IACtB;AAAA,MACE,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,GAAI,UAAU,YAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,MAChE,GAAI,UAAU,YAAY,EAAE,KAAK,UAAU,UAAU,IAAI,CAAC;AAAA,MAC1D,GAAI,UAAU,kBAAkB,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,MAClF,GAAI,UAAU,eAAe,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;AAAA,IAC3E;AAAA,IACA,EAAE,QAAQ,WAAW,WAAW,oBAAoB,WAAW;AAAA,EACjE;AACA,QAAM,EAAE,IAAI,iBAAiB,IAAI,MAAM,QAAQ,kBAAkB,eAAe;AAIhF,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY,UAAU;AAAA,IACtB,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AAEjD,SAAO,EAAE,IAAI,iBAAiB;AAChC;AAEA,SAAS,kCAAkC,OAA6B,QAAwB;AAC9F,QAAM,mBAAmB,UAAU,MAAM,OAAO;AAChD,QAAM,cAAc,mBAAmB,kBAAkB,0BAA0B;AACnF,QAAM,eAAe,uBAAuB,MAAM,QAAQ;AAC1D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,UAAU,uBAAuB,MAAM,GAAG;AAChD,QAAM,mBAAmB,uBAAuB,MAAM,YAAY;AAClE,QAAM,WAAW,mBAAmB,MAAM,IAAI;AAC9C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,eAAe,uBAAuB,YAAY,KAAK;AAAA,IACvD,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,UAAU,kBAAkB,OAAO,KAAK;AAAA,IACxC,mBAAmB,2BAA2B,gBAAgB,KAAK;AAAA,IACnE,SAAS,SAAS,IAAI,mBAAmB,SAAS,KAAK,IAAI,CAAC,KAAK;AAAA,EACnE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAClF,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,GAAG,QAAQ;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,mCACb,cACA,WACA,SACA,iBACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,SAAS;AACvD,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,iBAAkB,QAAO;AACxC,QAAI,EAAE,OAAO,YAAY,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAG,QAAO;AACvE,QAAI,wBAAwB,OAAO,OAAO,MAAM,WAAY,QAAO;AACnE,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,iBAAiB,KAAK,KAAK;AAChD,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,8BACpB,cACA,OACA,QACA,OAC+C;AAC/C,QAAM,SAAS,mBAAmB,8BAA8B,KAAK,GAAG,yBAAyB;AACjG,QAAM,qBAAqB,UAAU,MAAM,SAAS;AAIpD,QAAM,iBAAkB,MAA6C,uBACjE,qBACA,sCAAsC,cAAc,kBAAkB;AAC1E,QAAM,UAAU,kCAAkC,OAAO,MAAM;AAC/D,QAAM,cAAc,MAAM,mCAAmC,cAAc,gBAAgB,SAAS,MAAM,eAAe;AACzH,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,oBAAoB,UAAU,MAAM,QAAQ;AAClD,QAAM,iBAAiB,qBAAqB,0BAA0B,IAAI,iBAAmC,IACzG,oBACA;AACJ,QAAM,gBAAgB,mBAAmB,MAAM,IAAI;AACnD,QAAM,UAAU,MAAM,aAAa,WAAW,cAAc;AAC5D,QAAM,iBAAiB;AAAA,IACrB;AAAA,MACE;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,MAAM,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,8BAA8B,GAAG,aAAa,CAAC,CAAC;AAAA,MAC7E,GAAI,uBAAuB,MAAM,SAAS,IAAI,EAAE,WAAW,uBAAuB,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,MACxG,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA,EAAE,QAAQ,WAAW,WAAW,2BAA2B,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQ7E,EAAE,SAAS,KAAK;AAAA,EAClB;AACA,QAAM,EAAE,GAAO,IAAI,MAAM,QAAQ,kBAAkB,cAAc;AACjE,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,cAAc,EAAE;AAC9C,QAAI,SAAS;AACX,YAAM,QAAQ,uBAAuB,SAAS;AAAA,QAC5C,QAAQ;AAAA,QACR,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,QACD,OAAO,qBAAqB,MAAM;AAAA,QAClC,YAAY;AAAA,QACZ,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AAAA,EAQF;AACA,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AACjD,SAAO,EAAE,GAAG;AACd;AAEO,SAAS,6BAA6B,KAAiD;AAC5F,SAAO,IAAI,gBAAgB;AAC7B;AAEO,SAAS,mCAAmC,KAAiD;AAClG,SAAO,IAAI,gBAAgB;AAC7B;","names":[]}

package/dist/chunk-7RNBVZZO.js

@@ -0,0 +1,270 @@
+import {
+  toBackupStamp
+} from "./chunk-KJTKLXTH.js";
+import {
+  copyExistingFileToBackup,
+  writeFileAtomically
+} from "./chunk-R6YJI3HE.js";
+import {
+  StorageManager
+} from "./chunk-4BJQODZF.js";
+import {
+  withHeldFileLock
+} from "./chunk-WL5EBRDH.js";
+import {
+  displayErrorDetail
+} from "./chunk-RL6NEVXT.js";
+import {
+  MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS,
+  buildLifecycleEventsForMemory,
+  compareMemoryLifecycleEvents,
+  memoryLifecycleLedgerLockPath,
+  sortMemoryLifecycleEvents
+} from "./chunk-ILGC6JH6.js";
+import {
+  probeEncryptedRegularFileHeader
+} from "./chunk-AIK5W3IW.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
+
+// src/maintenance/rebuild-memory-lifecycle-ledger.ts
+import path from "path";
+import { stat } from "fs/promises";
+var FRONTMATTER_DERIVED_EVENT_TYPES = {
+  created: true,
+  updated: true,
+  superseded: true,
+  archived: true
+};
+function isNodeError(err) {
+  return typeof err === "object" && err !== null && "code" in err;
+}
+function lifecycleRowBytes(event) {
+  return Buffer.byteLength(`${JSON.stringify(event)}
+`, "utf8");
+}
+function boundLifecycleEventsToByteCap(events, cap) {
+  if (!(cap > 0)) return { kept: events, dropped: 0 };
+  const sizes = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const event of events) {
+    const bytes = lifecycleRowBytes(event);
+    sizes.set(event, bytes);
+    total += bytes;
+  }
+  if (total <= cap) return { kept: events, dropped: 0 };
+  const byRecency = [...events].sort((a, b) => {
+    if (a.timestamp !== b.timestamp) return b.timestamp.localeCompare(a.timestamp);
+    return -compareMemoryLifecycleEvents(a, b);
+  });
+  const keep = /* @__PURE__ */ new Set();
+  let running = 0;
+  for (const event of byRecency) {
+    const bytes = sizes.get(event);
+    if (running + bytes > cap) continue;
+    running += bytes;
+    keep.add(event);
+  }
+  const kept = events.filter((event) => keep.has(event));
+  return { kept, dropped: events.length - kept.length };
+}
+async function backupExistingLedger(memoryDir, outputPath, now) {
+  try {
+    await stat(outputPath);
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return void 0;
+    }
+    throw err;
+  }
+  const backupPath = path.join(
+    memoryDir,
+    "archive",
+    "memory-lifecycle-ledger",
+    toBackupStamp(now),
+    "state",
+    "memory-lifecycle-ledger.jsonl"
+  );
+  return backupPath;
+}
+async function rebuildMemoryLifecycleLedger(options) {
+  const dryRun = options.dryRun !== false;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const outputPath = path.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
+  const storage = options.storage ?? new StorageManager(options.memoryDir);
+  if (options.storage && path.resolve(storage.dir) !== path.resolve(options.memoryDir)) {
+    throw new Error(
+      `rebuildMemoryLifecycleLedger: storage.dir (${storage.dir}) must match memoryDir (${options.memoryDir})`
+    );
+  }
+  const secureRewrite = options.storage !== void 0;
+  const tiers = [
+    await storage.readAllMemories(),
+    await storage.readAllColdMemories(),
+    await storage.readArchivedMemories()
+  ];
+  const allMemories = tiers.flat();
+  const skippedBlankIdMemories = [];
+  const eventCandidates = [];
+  for (const tier of tiers) {
+    for (const memory of [...tier].sort((left, right) => left.path.localeCompare(right.path))) {
+      if (!memory.frontmatter.id.trim()) {
+        skippedBlankIdMemories.push({ path: memory.path });
+        log.warn(`lifecycle ledger rebuild skipped blank memory id: path=${memory.path}`);
+        continue;
+      }
+      for (const event of buildLifecycleEventsForMemory(memory)) {
+        eventCandidates.push({ event, path: memory.path });
+      }
+    }
+  }
+  const orderedEvents = sortMemoryLifecycleEvents(eventCandidates.map((candidate) => candidate.event));
+  const candidateByEvent = new Map(
+    eventCandidates.map((candidate) => [candidate.event, candidate])
+  );
+  const keptByEventId = /* @__PURE__ */ new Map();
+  const events = [];
+  const skippedDuplicateEvents = [];
+  for (const event of orderedEvents) {
+    const candidate = candidateByEvent.get(event);
+    const kept = keptByEventId.get(event.eventId);
+    if (kept) {
+      skippedDuplicateEvents.push({
+        eventId: event.eventId,
+        keptPath: kept.path,
+        skippedPath: candidate.path
+      });
+      log.warn(
+        `lifecycle ledger rebuild skipped duplicate event_id=${event.eventId}: kept=${kept.path} skipped=${candidate.path}`
+      );
+      continue;
+    }
+    keptByEventId.set(event.eventId, candidate);
+    events.push(event);
+  }
+  let finalEvents = events;
+  let preservedAppendOnlyRows;
+  let archivedOverflowRows;
+  let backupPath;
+  let rewritten = false;
+  const runLedgerCriticalSection = async (acquired, lock) => {
+    if (!dryRun && !acquired) {
+      throw new Error(
+        "lifecycle ledger rebuild aborted: could not acquire the ledger lock within the acquisition budget; refusing to read or rewrite unlocked so a concurrent append or compaction cannot be clobbered (issue #1910)."
+      );
+    }
+    if (options.preserveExistingEvents) {
+      let existing;
+      try {
+        existing = await storage.readAllMemoryLifecycleEventsForCompaction();
+      } catch (err) {
+        throw new Error(
+          `lifecycle ledger rebuild aborted: cannot read existing events to preserve (${displayErrorDetail(err) || "unknown error"})`
+        );
+      }
+      const contentKey = (event) => `${event.memoryId}\0${event.eventType}\0${event.timestamp}`;
+      const reconstructedKeys = new Set(events.map(contentKey));
+      const racedFrontmatterByKey = /* @__PURE__ */ new Map();
+      const appendOnly = [];
+      for (const event of existing) {
+        if (!FRONTMATTER_DERIVED_EVENT_TYPES[event.eventType]) {
+          appendOnly.push(event);
+          continue;
+        }
+        const key = contentKey(event);
+        if (reconstructedKeys.has(key)) continue;
+        if (!racedFrontmatterByKey.has(key)) racedFrontmatterByKey.set(key, event);
+      }
+      const mergedById = /* @__PURE__ */ new Map();
+      for (const event of sortMemoryLifecycleEvents([
+        ...events,
+        ...racedFrontmatterByKey.values(),
+        ...appendOnly
+      ])) {
+        if (!mergedById.has(event.eventId)) mergedById.set(event.eventId, event);
+      }
+      finalEvents = [...mergedById.values()];
+      preservedAppendOnlyRows = finalEvents.length - events.length;
+      if (options.maxLedgerBytes && options.maxLedgerBytes > 0) {
+        const bounded = boundLifecycleEventsToByteCap(finalEvents, options.maxLedgerBytes);
+        if (bounded.dropped > 0) {
+          finalEvents = bounded.kept;
+          archivedOverflowRows = bounded.dropped;
+          log.warn(
+            `lifecycle ledger rebuild bounded to ${options.maxLedgerBytes} bytes: dropped ${bounded.dropped} oldest row(s) from the active ledger (preserved in the backup) to stay under the read/decrypt cap.`
+          );
+        }
+      }
+    }
+    const abortIfLockLost = async () => {
+      if (lock && await lock.refresh()) return;
+      throw new Error(
+        "lifecycle ledger rebuild aborted: lost the ledger lock during the compaction rewrite (a peer stale-broke it while the event loop was blocked by CPU-bound merge/serialize); refusing to clobber a concurrent append (issue #1910/#2033)."
+      );
+    };
+    if (!dryRun) {
+      const payload = finalEvents.map((event) => JSON.stringify(event)).join("\n");
+      const content = payload.length > 0 ? `${payload}
+` : "";
+      let currentEncrypted = false;
+      let priorRawBuffer = null;
+      try {
+        currentEncrypted = await probeEncryptedRegularFileHeader(outputPath);
+        priorRawBuffer = await storage.readMemoryLifecycleLedgerRawBufferForCompaction();
+      } catch (err) {
+        if (!isNodeError(err) || err.code !== "ENOENT") throw err;
+      }
+      const forceEncrypt = secureRewrite && currentEncrypted && storage.isSecureStoreUnlocked();
+      const replacementEncrypted = secureRewrite && (storage.willEncryptStateWrites() || forceEncrypt);
+      if (priorRawBuffer !== null && currentEncrypted === replacementEncrypted && priorRawBuffer.equals(Buffer.from(content, "utf8"))) {
+        rewritten = false;
+      } else {
+        const desiredBackup = await backupExistingLedger(options.memoryDir, outputPath, now);
+        if (secureRewrite) {
+          if (desiredBackup && currentEncrypted) {
+            const rawForBackup = priorRawBuffer ?? await storage.readMemoryLifecycleLedgerRawBufferForCompaction();
+            await storage.writeMemoryLifecycleLedgerContent(rawForBackup, desiredBackup, forceEncrypt);
+            backupPath = desiredBackup;
+          } else {
+            backupPath = desiredBackup ? await copyExistingFileToBackup(outputPath, desiredBackup) : void 0;
+          }
+          await abortIfLockLost();
+          await storage.writeMemoryLifecycleLedgerContent(content, void 0, forceEncrypt);
+        } else {
+          await abortIfLockLost();
+          backupPath = await writeFileAtomically(outputPath, content, desiredBackup);
+        }
+        rewritten = true;
+      }
+    }
+  };
+  if (!dryRun) {
+    await withHeldFileLock(
+      memoryLifecycleLedgerLockPath(outputPath),
+      { staleMs: MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS, ...options.lockOptions },
+      runLedgerCriticalSection
+    );
+  } else if (options.preserveExistingEvents) {
+    await runLedgerCriticalSection(true, null);
+  }
+  return {
+    dryRun,
+    scannedMemories: allMemories.length,
+    rebuiltRows: finalEvents.length,
+    outputPath,
+    backupPath,
+    skippedBlankIdMemories,
+    skippedDuplicateEvents,
+    preservedAppendOnlyRows,
+    archivedOverflowRows,
+    rewritten
+  };
+}
+
+export {
+  boundLifecycleEventsToByteCap,
+  backupExistingLedger,
+  rebuildMemoryLifecycleLedger
+};
+//# sourceMappingURL=chunk-7RNBVZZO.js.map