@remnic/core 9.7.15 → 9.9.0

package/dist/{chunk-BFVEEB7W.js → chunk-7ON2JW73.js}

@@ -1,12 +1,16 @@
+import {
+  TAG_LIMITS,
+  composeMemoryEnvelope
+} from "./chunk-CGASUJVP.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-BFPETA3S.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
+} from "./chunk-SCCO46KZ.js";
 
 // src/explicit-capture.ts
 import { randomUUID } from "crypto";
@@ -274,15 +278,27 @@ function validateExplicitCaptureInput(input, mode = "strict_explicit") {
     throw new Error(`unsafe namespace: ${requestedNamespace}`);
   }
   const expiresAt = parseExplicitCaptureTtl(input.ttl);
+  const dedupedTags = Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean)));
+  if (dedupedTags.length > TAG_LIMITS.maxTags) {
+    throw new Error(`too many tags: ${dedupedTags.length} exceeds the ${TAG_LIMITS.maxTags}-tag limit`);
+  }
+  for (const tag of dedupedTags) {
+    if (tag.length > TAG_LIMITS.maxTagLength) {
+      throw new Error(`tag exceeds ${TAG_LIMITS.maxTagLength} characters: ${JSON.stringify(tag.slice(0, 40))}\u2026`);
+    }
+  }
   return {
     content,
     category,
     confidence,
     namespace: asTrimmed(input.namespace),
-    tags: Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean))),
+    tags: dedupedTags,
     entityRef: asTrimmed(input.entityRef),
     sourceReason: asTrimmed(input.sourceReason),
-    sourceConnector: input.sourceConnector,
+    // Trimmed like the other optional metadata (#2017 review round): a
+    // whitespace-only connector previously passed validation and then blew
+    // up at strict compose time - validated input must always compose.
+    sourceConnector: asTrimmed(input.sourceConnector),
     expiresAt
   };
 }
@@ -322,14 +338,20 @@ async function persistExplicitCapture(orchestrator, candidate, source) {
     return { id: duplicateOf, duplicateOf };
   }
   const storage = await orchestrator.getStorage(resolvedNamespace);
-  const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, candidate.content, {
-    confidence: candidate.confidence,
-    tags: candidate.tags,
-    entityRef: candidate.entityRef,
-    expiresAt: candidate.expiresAt,
-    source: source === "inline" ? "explicit-inline" : "explicit",
-    ...candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}
-  });
+  const captureEnvelope = composeMemoryEnvelope(
+    {
+      content: candidate.content,
+      category: candidate.category,
+      confidence: candidate.confidence,
+      tags: candidate.tags,
+      ...candidate.entityRef ? { entityRef: candidate.entityRef } : {},
+      ...candidate.expiresAt ? { ttl: candidate.expiresAt } : {},
+      ...candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {},
+      ...candidate.sourceReason ? { sourceReason: candidate.sourceReason } : {}
+    },
+    { source: source === "inline" ? "explicit-inline" : "explicit" }
+  );
+  const { id, tombstoneBlocked } = await storage.writeSealedMemory(captureEnvelope);
   const created = (/* @__PURE__ */ new Date()).toISOString();
   const event = {
     eventId: `mle-${randomUUID()}`,
@@ -402,13 +424,26 @@ async function queueExplicitCaptureForReview(orchestrator, input, source, error)
   const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory) ? requestedCategory : "fact";
   const requestedTags = sanitizeReviewTags(input.tags);
   const storage = await orchestrator.getStorage(queueNamespace);
-  const { id } = await storage.writeMemory(reviewCategory, content, {
-    confidence: 0.2,
-    tags: Array.from(/* @__PURE__ */ new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
-    entityRef: sanitizeReviewMetadata(input.entityRef),
-    source: source === "inline" ? "explicit-inline-review" : "explicit-review",
-    ...input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}
-  });
+  const reviewEnvelope = composeMemoryEnvelope(
+    {
+      content,
+      category: reviewCategory,
+      confidence: 0.2,
+      tags: Array.from(/* @__PURE__ */ new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),
+      ...sanitizeReviewMetadata(input.entityRef) ? { entityRef: sanitizeReviewMetadata(input.entityRef) } : {},
+      ...input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}
+    },
+    { source: source === "inline" ? "explicit-inline-review" : "explicit-review" },
+    // The review queue is the FALLBACK for a capture that already failed
+    // primary validation — it must never be un-queueable. The tag list is
+    // machine-assembled (requested tags + the two fixed review tags), so 49+
+    // requested tags would push past the 50-tag limit and strict compose
+    // would throw, losing the capture (#2014 review round). Salvage clamps
+    // instead; the fixed review tags sort first in the assembly above, so
+    // they always survive the clamp.
+    { salvage: true }
+  );
+  const { id } = await storage.writeSealedMemory(reviewEnvelope);
   try {
     const created = await storage.getMemoryById(id);
     if (created) {
@@ -452,4 +487,4 @@ export {
   shouldSkipImplicitExtraction,
   shouldProcessInlineExplicitCapture
 };
-//# sourceMappingURL=chunk-BFVEEB7W.js.map
+//# sourceMappingURL=chunk-7ON2JW73.js.map

package/dist/chunk-7ON2JW73.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/explicit-capture.ts"],"sourcesContent":["import { composeMemoryEnvelope, TAG_LIMITS } from \"./write-envelope.js\";\nimport { resolveNamespaceCapabilities } from \"./capabilities.js\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Orchestrator } from \"./orchestrator.js\";\nimport { isSafeRouteNamespace } from \"./routing/engine.js\";\nimport { sanitizeMemoryContent } from \"./sanitize.js\";\nimport { ContentHashIndex } from \"./storage.js\";\nimport type { CaptureMode, MemoryCategory, MemoryLifecycleEvent, PluginConfig } from \"./types.js\";\n\nexport type ExplicitCaptureInput = {\n  content: string;\n  category?: string;\n  confidence?: number;\n  namespace?: string;\n  tags?: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  ttl?: string;\n  sourceReason?: string;\n};\n\nexport type ValidExplicitCapture = {\n  content: string;\n  category: MemoryCategory;\n  confidence: number;\n  namespace?: string;\n  tags: string[];\n  entityRef?: string;\n  sourceConnector?: string;\n  expiresAt?: string;\n  sourceReason?: string;\n  /**\n   * When true, `namespace` was already resolved AND authorized by the caller\n   * (the access service's `resolveCodingScopedWriteNamespace`, which auth-checks\n   * the base and derives a session-owned `project-*` overlay). The persist /\n   * queue layer then routes to it directly instead of re-validating against the\n   * static policy allow-list — which would otherwise reject legitimately-derived\n   * dynamic project namespaces (#1434). Callers that do NOT pre-authorize the\n   * namespace must leave this unset so the allow-list guard still applies.\n   */\n  namespacePreResolved?: boolean;\n};\n\nexport type ExplicitCaptureSource = \"memory_store\" | \"memory_capture\" | \"suggestion_submit\" | \"inline\";\ntype ExplicitCaptureValidationMode = \"legacy_tool\" | \"strict_explicit\";\n\n// Bounded body {0,100000} instead of an unbounded lazy *? so scanning for the\n// closing tag cannot backtrack polynomially on unterminated <memory_note>\n// markup in hostile turn text (CodeQL js/polynomial-redos). 100 000 chars far\n// exceeds any real inline note, so matching is behavior-preserving; the outer\n// \\s* groups were also dropped (body absorbs whitespace; captures are trimmed).\nconst INLINE_NOTE_RE = /<memory_note>([\\s\\S]{0,100000}?)<\\/memory_note>/gi;\nconst INLINE_NOTE_MARKUP_RE = /<memory_note>[\\s\\S]{0,100000}?<\\/memory_note>/i;\nconst INLINE_ALLOWED_CATEGORIES = new Set<MemoryCategory>([\n  \"fact\",\n  \"preference\",\n  \"correction\",\n  \"entity\",\n  \"decision\",\n  \"relationship\",\n  \"principle\",\n  \"commitment\",\n  \"moment\",\n  \"skill\",\n  \"rule\",\n  \"procedure\",\n  \"reasoning_trace\",\n]);\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /\\bsk-[A-Za-z0-9]{16,}\\b/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n  /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/i,\n  /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/i,\n  /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/i,\n];\nconst SECRET_REDACTION_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [\n  { pattern: /\\bsk-[A-Za-z0-9]{16,}\\b/g, replacement: \"[redacted openai key]\" },\n  { pattern: /\\bAKIA[0-9A-Z]{16}\\b/g, replacement: \"[redacted aws key]\" },\n  { pattern: /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/gi, replacement: \"Bearer [redacted token]\" },\n  {\n    pattern: /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"[redacted credential]\",\n  },\n  {\n    pattern: /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"authorization: [redacted credential]\",\n  },\n];\nconst EXPLICIT_CAPTURE_REVIEW_TAGS = [\"explicit-capture\", \"queued-review\"];\n\nfunction explicitCaptureActor(source: ExplicitCaptureSource): string {\n  switch (source) {\n    case \"inline\":\n      return \"inline.memory_note\";\n    case \"memory_store\":\n      return \"tool.memory_store\";\n    case \"suggestion_submit\":\n      return \"tool.suggestion_submit\";\n    default:\n      return \"tool.memory_capture\";\n  }\n}\n\nfunction asTrimmed(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed && trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction normalizeCaptureContent(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction redactSecrets(value: string): string {\n  let redacted = value;\n  for (const { pattern, replacement } of SECRET_REDACTION_PATTERNS) {\n    redacted = redacted.replace(pattern, replacement);\n  }\n  return redacted;\n}\n\nfunction containsSecretLikeValue(value: string): boolean {\n  return SECRET_PATTERNS.some((pattern) => pattern.test(value));\n}\n\nfunction assertNoSecretLikeMetadata(field: string, value: string | undefined): void {\n  const trimmed = asTrimmed(value);\n  if (trimmed && containsSecretLikeValue(trimmed)) {\n    throw new Error(`${field} appears to contain a secret or credential`);\n  }\n}\n\nfunction assertNoSecretLikeMetadataList(field: string, values: string[] | undefined): void {\n  for (const value of values ?? []) {\n    assertNoSecretLikeMetadata(field, value);\n  }\n}\n\nfunction sanitizeReviewText(value: string | undefined, fallback: string): string {\n  const redacted = redactSecrets(asTrimmed(value) ?? fallback);\n  const sanitized = sanitizeMemoryContent(redacted);\n  const safe = sanitized.text.trim();\n  return safe.length > 0 ? safe : fallback;\n}\n\nfunction sanitizeReviewMetadata(value: string | undefined): string | undefined {\n  const trimmed = asTrimmed(value);\n  if (!trimmed) return undefined;\n  return sanitizeReviewText(trimmed, \"[redacted]\");\n}\n\nfunction sanitizeReviewTags(tags: string[] | undefined): string[] {\n  return Array.from(new Set((tags ?? [])\n    .map((tag) => sanitizeReviewMetadata(tag))\n    .filter((tag): tag is string => typeof tag === \"string\" && tag.length > 0)));\n}\n\nfunction normalizeExplicitCaptureError(error: unknown): string {\n  if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();\n  const rendered = String(error).trim();\n  return rendered.length > 0 ? rendered : \"explicit capture failed\";\n}\n\nfunction resolveExplicitCaptureReviewNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  return resolveExplicitCaptureNamespace(orchestrator, normalized);\n}\n\nfunction resolveExplicitCaptureNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {\n    if (normalized !== orchestrator.config.defaultNamespace) {\n      throw new Error(`unsupported namespace: ${normalized}`);\n    }\n    return normalized;\n  }\n  const allowed = new Set([\n    orchestrator.config.defaultNamespace,\n    orchestrator.config.sharedNamespace,\n    ...orchestrator.config.namespacePolicies.map((policy) => policy.name),\n  ].map((value) => value.trim()).filter(Boolean));\n  if (!allowed.has(normalized)) {\n    throw new Error(`unsupported namespace: ${normalized}`);\n  }\n  return normalized;\n}\n\nfunction parseExplicitCaptureTtl(ttl: string | undefined): string | undefined {\n  const raw = asTrimmed(ttl);\n  if (!raw) return undefined;\n\n  const absoluteMs = Date.parse(raw);\n  if (Number.isFinite(absoluteMs)) {\n    return new Date(absoluteMs).toISOString();\n  }\n\n  const relative = raw.match(/^(\\d+)\\s*([mhdw])$/i);\n  if (!relative) {\n    throw new Error(\"ttl must be an ISO-8601 timestamp or relative duration like 30m, 12h, 7d, or 2w\");\n  }\n\n  const amount = Number.parseInt(relative[1] ?? \"\", 10);\n  const unit = (relative[2] ?? \"\").toLowerCase();\n  if (!Number.isFinite(amount) || amount <= 0) {\n    throw new Error(\"ttl duration must be a positive integer\");\n  }\n\n  const multiplier =\n    unit === \"m\" ? 60_000\n      : unit === \"h\" ? 60 * 60_000\n        : unit === \"d\" ? 24 * 60 * 60_000\n          : 7 * 24 * 60 * 60_000;\n  return new Date(Date.now() + amount * multiplier).toISOString();\n}\n\nfunction parseInlineConfidence(value: string): number {\n  const trimmed = value.trim();\n  if (!/^[+-]?(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    return Number.NaN;\n  }\n  const parsed = Number(trimmed);\n  return Number.isFinite(parsed) ? parsed : Number.NaN;\n}\n\nfunction parseInlineNote(block: string): ExplicitCaptureInput | null {\n  const lines = block.replace(/\\r/g, \"\").split(\"\\n\");\n  const note: Partial<ExplicitCaptureInput> = {};\n  let idx = 0;\n\n  while (idx < lines.length) {\n    const rawLine = lines[idx] ?? \"\";\n    const line = rawLine.trim();\n    idx += 1;\n    if (line.length === 0) continue;\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx < 0) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n\n    if (key === \"content\" && value === \"|\") {\n      const contentLines: string[] = [];\n      while (idx < lines.length) {\n        const next = lines[idx] ?? \"\";\n        if (next.startsWith(\"  \") || next.startsWith(\"\\t\")) {\n          contentLines.push(next.replace(/^(  |\\t)/, \"\"));\n          idx += 1;\n          continue;\n        }\n        if (next.trim().length === 0) {\n          contentLines.push(\"\");\n          idx += 1;\n          continue;\n        }\n        break;\n      }\n      note.content = contentLines.join(\"\\n\").trim();\n      continue;\n    }\n\n    switch (key) {\n      case \"content\":\n        note.content = value;\n        break;\n      case \"category\":\n        note.category = value;\n        break;\n      case \"confidence\":\n        note.confidence = parseInlineConfidence(value);\n        break;\n      case \"namespace\":\n        note.namespace = value;\n        break;\n      case \"tags\":\n        note.tags = value\n          .split(\",\")\n          .map((entry) => entry.trim())\n          .filter(Boolean);\n        break;\n      case \"entityRef\":\n        note.entityRef = value;\n        break;\n      case \"ttl\":\n        note.ttl = value;\n        break;\n      case \"sourceReason\":\n        note.sourceReason = value;\n        break;\n      default:\n        break;\n    }\n  }\n\n  return asTrimmed(note.content) ? (note as ExplicitCaptureInput) : null;\n}\n\nexport function parseInlineExplicitCaptureNotes(text: string): ExplicitCaptureInput[] {\n  const notes: ExplicitCaptureInput[] = [];\n  for (const match of text.matchAll(INLINE_NOTE_RE)) {\n    const parsed = parseInlineNote(match[1] ?? \"\");\n    if (parsed) notes.push(parsed);\n  }\n  return notes;\n}\n\nexport function hasInlineExplicitCaptureMarkup(text: string): boolean {\n  return INLINE_NOTE_MARKUP_RE.test(text);\n}\n\nexport function stripInlineExplicitCaptureNotes(text: string): string {\n  return text.replace(INLINE_NOTE_RE, \"\").trim();\n}\n\nexport function validateExplicitCaptureInput(\n  input: ExplicitCaptureInput,\n  mode: ExplicitCaptureValidationMode = \"strict_explicit\",\n): ValidExplicitCapture {\n  const content = asTrimmed(input.content);\n  if (!content) throw new Error(\"content is required\");\n  if (mode === \"strict_explicit\") {\n    if (content.length < 10) throw new Error(\"content must be at least 10 characters\");\n    if (content.length > 4000) throw new Error(\"content must be 4000 characters or fewer\");\n  }\n  if (/<memory_note>/i.test(content) || /<\\/memory_note>/i.test(content)) {\n    throw new Error(\"nested memory_note blocks are not allowed\");\n  }\n\n  const category = (asTrimmed(input.category) ?? \"fact\") as MemoryCategory;\n  if (!INLINE_ALLOWED_CATEGORIES.has(category)) {\n    throw new Error(`unsupported category: ${input.category ?? category}`);\n  }\n\n  const sanitized = sanitizeMemoryContent(content);\n  if (!sanitized.clean) {\n    throw new Error(\"content failed memory sanitization\");\n  }\n  for (const pattern of SECRET_PATTERNS) {\n    if (pattern.test(content)) {\n      throw new Error(\"content appears to contain a secret or credential\");\n    }\n  }\n  assertNoSecretLikeMetadata(\"sourceReason\", input.sourceReason);\n  assertNoSecretLikeMetadata(\"entityRef\", input.entityRef);\n  assertNoSecretLikeMetadata(\"ttl\", input.ttl);\n  assertNoSecretLikeMetadataList(\"tags\", input.tags);\n\n  if (input.confidence !== undefined && !Number.isFinite(input.confidence)) {\n    throw new Error(\"confidence must be a finite number\");\n  }\n  const confidence = input.confidence === undefined ? 0.95 : Number(input.confidence);\n  if (confidence < 0 || confidence > 1) {\n    throw new Error(\"confidence must be between 0 and 1\");\n  }\n  const requestedNamespace = asTrimmed(input.namespace);\n  if (requestedNamespace && !isSafeRouteNamespace(requestedNamespace)) {\n    throw new Error(`unsafe namespace: ${requestedNamespace}`);\n  }\n  const expiresAt = parseExplicitCaptureTtl(input.ttl);\n\n  // #2014 review round: enforce the composer's tag contract HERE so a capture\n  // that passes validation can never fail later at strict compose time\n  // (validated-then-thrown was a broken contract). Same limits as TAG_LIMITS.\n  const dedupedTags = Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean)));\n  if (dedupedTags.length > TAG_LIMITS.maxTags) {\n    throw new Error(`too many tags: ${dedupedTags.length} exceeds the ${TAG_LIMITS.maxTags}-tag limit`);\n  }\n  for (const tag of dedupedTags) {\n    if (tag.length > TAG_LIMITS.maxTagLength) {\n      throw new Error(`tag exceeds ${TAG_LIMITS.maxTagLength} characters: ${JSON.stringify(tag.slice(0, 40))}…`);\n    }\n  }\n\n  return {\n    content,\n    category,\n    confidence,\n    namespace: asTrimmed(input.namespace),\n    tags: dedupedTags,\n    entityRef: asTrimmed(input.entityRef),\n    sourceReason: asTrimmed(input.sourceReason),\n    // Trimmed like the other optional metadata (#2017 review round): a\n    // whitespace-only connector previously passed validation and then blew\n    // up at strict compose time - validated input must always compose.\n    sourceConnector: asTrimmed(input.sourceConnector),\n    expiresAt,\n  };\n}\n\nasync function findDuplicateExplicitCapture(\n  orchestrator: Orchestrator,\n  resolvedNamespace: string | undefined,\n  candidate: ValidExplicitCapture,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  if (\n    candidate.category === \"fact\"\n    && typeof (storage as { hasFactContentHash?: (content: string) => Promise<boolean> }).hasFactContentHash === \"function\"\n  ) {\n    try {\n      const hasHash = await (storage as { hasFactContentHash: (content: string) => Promise<boolean> }).hasFactContentHash(\n        candidate.content,\n      );\n      if (!hasHash) {\n        const authoritative =\n          typeof (storage as { isFactContentHashAuthoritative?: () => Promise<boolean> | boolean }).isFactContentHashAuthoritative\n            === \"function\"\n            ? await (storage as { isFactContentHashAuthoritative: () => Promise<boolean> | boolean })\n              .isFactContentHashAuthoritative()\n            : false;\n        if (authoritative) return null;\n      }\n    } catch (err) {\n      // Fail open: hash index is only an optimization, so fall back to the full corpus scan.\n      void err;\n    }\n  }\n  const existing = await storage.readAllMemories();\n  const normalizedCandidate = normalizeCaptureContent(candidate.content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"active\") return false;\n    if (memory.frontmatter.category !== candidate.category) return false;\n    if (normalizeCaptureContent(memory.content) !== normalizedCandidate) return false;\n    // Connector-aware dedup: same content from different connectors is NOT\n    // a duplicate. Operator (undefined) and connector-tagged memories are\n    // always distinct. Normalize empty strings to undefined.\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = candidate.sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function persistExplicitCapture(\n  orchestrator: Orchestrator,\n  candidate: ValidExplicitCapture,\n  source: ExplicitCaptureSource,\n): Promise<{ id: string; duplicateOf?: string; tombstoneBlocked?: boolean }> {\n  const resolvedNamespace = candidate.namespacePreResolved\n    ? asTrimmed(candidate.namespace)\n    : resolveExplicitCaptureNamespace(orchestrator, candidate.namespace);\n  const duplicateOf = await findDuplicateExplicitCapture(orchestrator, resolvedNamespace, candidate);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  // #1645 (review thread yG-): surface the tombstone block so callers\n  // (memory_store tool, access-service HTTP/MCP) can report the capture as\n  // queued for review instead of a successfully stored active memory.\n  // Sealed-envelope write (issue #1989 PR2).\n  const captureEnvelope = composeMemoryEnvelope(\n    {\n      content: candidate.content,\n      category: candidate.category,\n      confidence: candidate.confidence,\n      tags: candidate.tags,\n      ...(candidate.entityRef ? { entityRef: candidate.entityRef } : {}),\n      ...(candidate.expiresAt ? { ttl: candidate.expiresAt } : {}),\n      ...(candidate.sourceConnector ? { sourceConnector: candidate.sourceConnector } : {}),\n      ...(candidate.sourceReason ? { sourceReason: candidate.sourceReason } : {}),\n    },\n    { source: source === \"inline\" ? \"explicit-inline\" : \"explicit\" },\n  );\n  const { id, tombstoneBlocked } = await storage.writeSealedMemory(captureEnvelope);\n  // #1522: catalog touch handled at the storage chokepoint — the StorageManager's\n  // post-write hook records the namespace touch automatically.\n\n  const created = new Date().toISOString();\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_accepted\",\n    timestamp: created,\n    actor: explicitCaptureActor(source),\n    reasonCode: candidate.sourceReason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n\n  return { id, tombstoneBlocked };\n}\n\nfunction buildExplicitCaptureReviewContent(input: ExplicitCaptureInput, reason: string): string {\n  const requestedContent = asTrimmed(input.content);\n  const safeContent = sanitizeReviewText(requestedContent, \"[empty explicit capture]\");\n  const safeCategory = sanitizeReviewMetadata(input.category);\n  const safeNamespace = sanitizeReviewMetadata(input.namespace);\n  const safeEntityRef = sanitizeReviewMetadata(input.entityRef);\n  const safeTtl = sanitizeReviewMetadata(input.ttl);\n  const safeSourceReason = sanitizeReviewMetadata(input.sourceReason);\n  const safeTags = sanitizeReviewTags(input.tags);\n  const lines = [\n    \"Explicit capture queued for review.\",\n    \"\",\n    `Reason: ${reason}`,\n    \"\",\n    \"Submitted content:\",\n    safeContent,\n  ];\n  const metadata = [\n    safeCategory ? `Requested category: ${safeCategory}` : undefined,\n    safeNamespace ? `Requested namespace: ${safeNamespace}` : undefined,\n    safeEntityRef ? `Requested entityRef: ${safeEntityRef}` : undefined,\n    safeTtl ? `Requested ttl: ${safeTtl}` : undefined,\n    safeSourceReason ? `Requested sourceReason: ${safeSourceReason}` : undefined,\n    safeTags.length > 0 ? `Requested tags: ${safeTags.join(\", \")}` : undefined,\n  ].filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n  if (metadata.length > 0) {\n    lines.push(\"\", ...metadata);\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function findQueuedExplicitCaptureDuplicate(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n  content: string,\n  sourceConnector?: string,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(namespace);\n  const existing = await storage.readAllMemories();\n  const normalized = normalizeCaptureContent(content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"pending_review\") return false;\n    if (!(memory.frontmatter.tags ?? []).includes(\"queued-review\")) return false;\n    if (normalizeCaptureContent(memory.content) !== normalized) return false;\n    const existingConnector = memory.frontmatter.sourceConnector?.trim() || undefined;\n    const newConnector = sourceConnector?.trim() || undefined;\n    if (existingConnector !== newConnector) return false;\n    return true;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function queueExplicitCaptureForReview(\n  orchestrator: Orchestrator,\n  input: ExplicitCaptureInput,\n  source: ExplicitCaptureSource,\n  error: unknown,\n): Promise<{ id: string; duplicateOf?: string }> {\n  const reason = sanitizeReviewText(normalizeExplicitCaptureError(error), \"explicit capture failed\");\n  const requestedNamespace = asTrimmed(input.namespace);\n  // A caller-pre-authorized namespace (e.g. a session-owned project overlay\n  // from the access service) routes directly; otherwise apply the static\n  // policy allow-list guard (#1434).\n  const queueNamespace = (input as { namespacePreResolved?: boolean }).namespacePreResolved\n    ? requestedNamespace\n    : resolveExplicitCaptureReviewNamespace(orchestrator, requestedNamespace);\n  const content = buildExplicitCaptureReviewContent(input, reason);\n  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content, input.sourceConnector);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const requestedCategory = asTrimmed(input.category);\n  const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory as MemoryCategory)\n    ? requestedCategory as MemoryCategory\n    : \"fact\";\n  const requestedTags = sanitizeReviewTags(input.tags);\n  const storage = await orchestrator.getStorage(queueNamespace);\n  const reviewEnvelope = composeMemoryEnvelope(\n    {\n      content,\n      category: reviewCategory,\n      confidence: 0.2,\n      tags: Array.from(new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),\n      ...(sanitizeReviewMetadata(input.entityRef) ? { entityRef: sanitizeReviewMetadata(input.entityRef) } : {}),\n      ...(input.sourceConnector ? { sourceConnector: input.sourceConnector } : {}),\n    },\n    { source: source === \"inline\" ? \"explicit-inline-review\" : \"explicit-review\" },\n    // The review queue is the FALLBACK for a capture that already failed\n    // primary validation — it must never be un-queueable. The tag list is\n    // machine-assembled (requested tags + the two fixed review tags), so 49+\n    // requested tags would push past the 50-tag limit and strict compose\n    // would throw, losing the capture (#2014 review round). Salvage clamps\n    // instead; the fixed review tags sort first in the assembly above, so\n    // they always survive the clamp.\n    { salvage: true },\n  );\n  const { id: id } = await storage.writeSealedMemory(reviewEnvelope);\n  try {\n    const created = await storage.getMemoryById(id);\n    if (created) {\n      await storage.writeMemoryFrontmatter(created, {\n        status: \"pending_review\",\n        updated: new Date().toISOString(),\n      }, {\n        actor: explicitCaptureActor(source),\n        reasonCode: reason,\n        ruleVersion: \"explicit-capture.v1\",\n      });\n    }\n  } finally {\n    // Record the catalog write touch (issue #1499, round 5/6 codex P2; NIhUg).\n    // A queued review capture writes memory to the namespace's root (the DEFAULT\n    // root when undefined), so its `lastWriteAt` must reflect the write once\n    // `writeMemory` returns an id. If the later pending-review frontmatter update\n    // fails, the memory file is still durable and must not disappear from\n    // writtenSince/maintenance scheduling. Guarded optional hook (rule #33).\n    // #1522: catalog touch handled at the storage chokepoint.\n  }\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_queued\",\n    timestamp: new Date().toISOString(),\n    actor: explicitCaptureActor(source),\n    reasonCode: reason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n  return { id };\n}\n\nexport function shouldSkipImplicitExtraction(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode === \"explicit\";\n}\n\nexport function shouldProcessInlineExplicitCapture(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode !== \"implicit\";\n}\n"],"mappings":";;;;;;;;;;;;;;;AAEA,SAAS,kBAAkB;AAiD3B,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,oBAAI,IAAoB;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,kBAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4BAA6E;AAAA,EACjF,EAAE,SAAS,4BAA4B,aAAa,wBAAwB;AAAA,EAC5E,EAAE,SAAS,yBAAyB,aAAa,qBAAqB;AAAA,EACtE,EAAE,SAAS,sCAAsC,aAAa,0BAA0B;AAAA,EACxF;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AACA,IAAM,+BAA+B,CAAC,oBAAoB,eAAe;AAEzE,SAAS,qBAAqB,QAAuC;AACnE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,WAAW,QAAQ,SAAS,IAAI,UAAU;AACnD;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MACJ,YAAY,EACZ,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,WAAW;AACf,aAAW,EAAE,SAAS,YAAY,KAAK,2BAA2B;AAChE,eAAW,SAAS,QAAQ,SAAS,WAAW;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAC9D;AAEA,SAAS,2BAA2B,OAAe,OAAiC;AAClF,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,WAAW,wBAAwB,OAAO,GAAG;AAC/C,UAAM,IAAI,MAAM,GAAG,KAAK,4CAA4C;AAAA,EACtE;AACF;AAEA,SAAS,+BAA+B,OAAe,QAAoC;AACzF,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,+BAA2B,OAAO,KAAK;AAAA,EACzC;AACF;AAEA,SAAS,mBAAmB,OAA2B,UAA0B;AAC/E,QAAM,WAAW,cAAc,UAAU,KAAK,KAAK,QAAQ;AAC3D,QAAM,YAAY,sBAAsB,QAAQ;AAChD,QAAM,OAAO,UAAU,KAAK,KAAK;AACjC,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,uBAAuB,OAA+C;AAC7E,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,mBAAmB,SAAS,YAAY;AACjD;AAEA,SAAS,mBAAmB,MAAsC;AAChE,SAAO,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC,GACjC,IAAI,CAAC,QAAQ,uBAAuB,GAAG,CAAC,EACxC,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC;AAC/E;AAEA,SAAS,8BAA8B,OAAwB;AAC7D,MAAI,iBAAiB,SAAS,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,QAAQ,KAAK;AACzF,QAAM,WAAW,OAAO,KAAK,EAAE,KAAK;AACpC,SAAO,SAAS,SAAS,IAAI,WAAW;AAC1C;AAEA,SAAS,sCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,gCAAgC,cAAc,UAAU;AACjE;AAEA,SAAS,gCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,CAAC,6BAA6B,aAAa,MAAM,EAAE,YAAY;AACjE,QAAI,eAAe,aAAa,OAAO,kBAAkB;AACvD,YAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI;AAAA,IACtB,aAAa,OAAO;AAAA,IACpB,aAAa,OAAO;AAAA,IACpB,GAAG,aAAa,OAAO,kBAAkB,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,EACtE,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;AAC9C,MAAI,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC5B,UAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA6C;AAC5E,QAAM,MAAM,UAAU,GAAG;AACzB,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,aAAa,KAAK,MAAM,GAAG;AACjC,MAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,WAAO,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,EAC1C;AAEA,QAAM,WAAW,IAAI,MAAM,qBAAqB;AAChD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AAEA,QAAM,SAAS,OAAO,SAAS,SAAS,CAAC,KAAK,IAAI,EAAE;AACpD,QAAM,QAAQ,SAAS,CAAC,KAAK,IAAI,YAAY;AAC7C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AAC3C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,aACJ,SAAS,MAAM,MACX,SAAS,MAAM,KAAK,MAClB,SAAS,MAAM,KAAK,KAAK,MACvB,IAAI,KAAK,KAAK;AACxB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,UAAU,EAAE,YAAY;AAChE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,gDAAgD,KAAK,OAAO,GAAG;AAClE,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;AAEA,SAAS,gBAAgB,OAA4C;AACnE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACjD,QAAM,OAAsC,CAAC;AAC7C,MAAI,MAAM;AAEV,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,UAAU,MAAM,GAAG,KAAK;AAC9B,UAAM,OAAO,QAAQ,KAAK;AAC1B,WAAO;AACP,QAAI,KAAK,WAAW,EAAG;AACvB,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAE5C,QAAI,QAAQ,aAAa,UAAU,KAAK;AACtC,YAAM,eAAyB,CAAC;AAChC,aAAO,MAAM,MAAM,QAAQ;AACzB,cAAM,OAAO,MAAM,GAAG,KAAK;AAC3B,YAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,GAAI,GAAG;AAClD,uBAAa,KAAK,KAAK,QAAQ,YAAY,EAAE,CAAC;AAC9C,iBAAO;AACP;AAAA,QACF;AACA,YAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAC5B,uBAAa,KAAK,EAAE;AACpB,iBAAO;AACP;AAAA,QACF;AACA;AAAA,MACF;AACA,WAAK,UAAU,aAAa,KAAK,IAAI,EAAE,KAAK;AAC5C;AAAA,IACF;AAEA,YAAQ,KAAK;AAAA,MACX,KAAK;AACH,aAAK,UAAU;AACf;AAAA,MACF,KAAK;AACH,aAAK,WAAW;AAChB;AAAA,MACF,KAAK;AACH,aAAK,aAAa,sBAAsB,KAAK;AAC7C;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,OAAO,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACjB;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,MAAM;AACX;AAAA,MACF,KAAK;AACH,aAAK,eAAe;AACpB;AAAA,MACF;AACE;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,UAAU,KAAK,OAAO,IAAK,OAAgC;AACpE;AAEO,SAAS,gCAAgC,MAAsC;AACpF,QAAM,QAAgC,CAAC;AACvC,aAAW,SAAS,KAAK,SAAS,cAAc,GAAG;AACjD,UAAM,SAAS,gBAAgB,MAAM,CAAC,KAAK,EAAE;AAC7C,QAAI,OAAQ,OAAM,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,+BAA+B,MAAuB;AACpE,SAAO,sBAAsB,KAAK,IAAI;AACxC;AAEO,SAAS,gCAAgC,MAAsB;AACpE,SAAO,KAAK,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAC/C;AAEO,SAAS,6BACd,OACA,OAAsC,mBAChB;AACtB,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,qBAAqB;AACnD,MAAI,SAAS,mBAAmB;AAC9B,QAAI,QAAQ,SAAS,GAAI,OAAM,IAAI,MAAM,wCAAwC;AACjF,QAAI,QAAQ,SAAS,IAAM,OAAM,IAAI,MAAM,0CAA0C;AAAA,EACvF;AACA,MAAI,iBAAiB,KAAK,OAAO,KAAK,mBAAmB,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,WAAY,UAAU,MAAM,QAAQ,KAAK;AAC/C,MAAI,CAAC,0BAA0B,IAAI,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,yBAAyB,MAAM,YAAY,QAAQ,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,sBAAsB,OAAO;AAC/C,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,aAAW,WAAW,iBAAiB;AACrC,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF;AACA,6BAA2B,gBAAgB,MAAM,YAAY;AAC7D,6BAA2B,aAAa,MAAM,SAAS;AACvD,6BAA2B,OAAO,MAAM,GAAG;AAC3C,iCAA+B,QAAQ,MAAM,IAAI;AAEjD,MAAI,MAAM,eAAe,UAAa,CAAC,OAAO,SAAS,MAAM,UAAU,GAAG;AACxE,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,aAAa,MAAM,eAAe,SAAY,OAAO,OAAO,MAAM,UAAU;AAClF,MAAI,aAAa,KAAK,aAAa,GAAG;AACpC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,qBAAqB,UAAU,MAAM,SAAS;AACpD,MAAI,sBAAsB,CAAC,qBAAqB,kBAAkB,GAAG;AACnE,UAAM,IAAI,MAAM,qBAAqB,kBAAkB,EAAE;AAAA,EAC3D;AACA,QAAM,YAAY,wBAAwB,MAAM,GAAG;AAKnD,QAAM,cAAc,MAAM,KAAK,IAAI,KAAK,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AACnG,MAAI,YAAY,SAAS,WAAW,SAAS;AAC3C,UAAM,IAAI,MAAM,kBAAkB,YAAY,MAAM,gBAAgB,WAAW,OAAO,YAAY;AAAA,EACpG;AACA,aAAW,OAAO,aAAa;AAC7B,QAAI,IAAI,SAAS,WAAW,cAAc;AACxC,YAAM,IAAI,MAAM,eAAe,WAAW,YAAY,gBAAgB,KAAK,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,QAAG;AAAA,IAC3G;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,MAAM;AAAA,IACN,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,cAAc,UAAU,MAAM,YAAY;AAAA;AAAA;AAAA;AAAA,IAI1C,iBAAiB,UAAU,MAAM,eAAe;AAAA,IAChD;AAAA,EACF;AACF;AAEA,eAAe,6BACb,cACA,mBACA,WACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAC/D,MACE,UAAU,aAAa,UACpB,OAAQ,QAA2E,uBAAuB,YAC7G;AACA,QAAI;AACF,YAAM,UAAU,MAAO,QAA0E;AAAA,QAC/F,UAAU;AAAA,MACZ;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,gBACJ,OAAQ,QAAkF,mCACpF,aACF,MAAO,QACN,+BAA+B,IAChC;AACN,YAAI,cAAe,QAAO;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AAEZ,WAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,sBAAsB,wBAAwB,UAAU,OAAO;AACrE,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,SAAU,QAAO;AAChC,QAAI,OAAO,YAAY,aAAa,UAAU,SAAU,QAAO;AAC/D,QAAI,wBAAwB,OAAO,OAAO,MAAM,oBAAqB,QAAO;AAI5E,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,UAAU,iBAAiB,KAAK,KAAK;AAC1D,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,uBACpB,cACA,WACA,QAC2E;AAC3E,QAAM,oBAAoB,UAAU,uBAChC,UAAU,UAAU,SAAS,IAC7B,gCAAgC,cAAc,UAAU,SAAS;AACrE,QAAM,cAAc,MAAM,6BAA6B,cAAc,mBAAmB,SAAS;AACjG,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAK/D,QAAM,kBAAkB;AAAA,IACtB;AAAA,MACE,SAAS,UAAU;AAAA,MACnB,UAAU,UAAU;AAAA,MACpB,YAAY,UAAU;AAAA,MACtB,MAAM,UAAU;AAAA,MAChB,GAAI,UAAU,YAAY,EAAE,WAAW,UAAU,UAAU,IAAI,CAAC;AAAA,MAChE,GAAI,UAAU,YAAY,EAAE,KAAK,UAAU,UAAU,IAAI,CAAC;AAAA,MAC1D,GAAI,UAAU,kBAAkB,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,MAClF,GAAI,UAAU,eAAe,EAAE,cAAc,UAAU,aAAa,IAAI,CAAC;AAAA,IAC3E;AAAA,IACA,EAAE,QAAQ,WAAW,WAAW,oBAAoB,WAAW;AAAA,EACjE;AACA,QAAM,EAAE,IAAI,iBAAiB,IAAI,MAAM,QAAQ,kBAAkB,eAAe;AAIhF,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY,UAAU;AAAA,IACtB,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AAEjD,SAAO,EAAE,IAAI,iBAAiB;AAChC;AAEA,SAAS,kCAAkC,OAA6B,QAAwB;AAC9F,QAAM,mBAAmB,UAAU,MAAM,OAAO;AAChD,QAAM,cAAc,mBAAmB,kBAAkB,0BAA0B;AACnF,QAAM,eAAe,uBAAuB,MAAM,QAAQ;AAC1D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,UAAU,uBAAuB,MAAM,GAAG;AAChD,QAAM,mBAAmB,uBAAuB,MAAM,YAAY;AAClE,QAAM,WAAW,mBAAmB,MAAM,IAAI;AAC9C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,eAAe,uBAAuB,YAAY,KAAK;AAAA,IACvD,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,UAAU,kBAAkB,OAAO,KAAK;AAAA,IACxC,mBAAmB,2BAA2B,gBAAgB,KAAK;AAAA,IACnE,SAAS,SAAS,IAAI,mBAAmB,SAAS,KAAK,IAAI,CAAC,KAAK;AAAA,EACnE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAClF,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,GAAG,QAAQ;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,mCACb,cACA,WACA,SACA,iBACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,SAAS;AACvD,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,iBAAkB,QAAO;AACxC,QAAI,EAAE,OAAO,YAAY,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAG,QAAO;AACvE,QAAI,wBAAwB,OAAO,OAAO,MAAM,WAAY,QAAO;AACnE,UAAM,oBAAoB,OAAO,YAAY,iBAAiB,KAAK,KAAK;AACxE,UAAM,eAAe,iBAAiB,KAAK,KAAK;AAChD,QAAI,sBAAsB,aAAc,QAAO;AAC/C,WAAO;AAAA,EACT,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,8BACpB,cACA,OACA,QACA,OAC+C;AAC/C,QAAM,SAAS,mBAAmB,8BAA8B,KAAK,GAAG,yBAAyB;AACjG,QAAM,qBAAqB,UAAU,MAAM,SAAS;AAIpD,QAAM,iBAAkB,MAA6C,uBACjE,qBACA,sCAAsC,cAAc,kBAAkB;AAC1E,QAAM,UAAU,kCAAkC,OAAO,MAAM;AAC/D,QAAM,cAAc,MAAM,mCAAmC,cAAc,gBAAgB,SAAS,MAAM,eAAe;AACzH,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,oBAAoB,UAAU,MAAM,QAAQ;AAClD,QAAM,iBAAiB,qBAAqB,0BAA0B,IAAI,iBAAmC,IACzG,oBACA;AACJ,QAAM,gBAAgB,mBAAmB,MAAM,IAAI;AACnD,QAAM,UAAU,MAAM,aAAa,WAAW,cAAc;AAC5D,QAAM,iBAAiB;AAAA,IACrB;AAAA,MACE;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,MAAM,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,8BAA8B,GAAG,aAAa,CAAC,CAAC;AAAA,MAC7E,GAAI,uBAAuB,MAAM,SAAS,IAAI,EAAE,WAAW,uBAAuB,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,MACxG,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;AAAA,IAC5E;AAAA,IACA,EAAE,QAAQ,WAAW,WAAW,2BAA2B,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQ7E,EAAE,SAAS,KAAK;AAAA,EAClB;AACA,QAAM,EAAE,GAAO,IAAI,MAAM,QAAQ,kBAAkB,cAAc;AACjE,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,cAAc,EAAE;AAC9C,QAAI,SAAS;AACX,YAAM,QAAQ,uBAAuB,SAAS;AAAA,QAC5C,QAAQ;AAAA,QACR,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,QACD,OAAO,qBAAqB,MAAM;AAAA,QAClC,YAAY;AAAA,QACZ,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AAAA,EAQF;AACA,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AACjD,SAAO,EAAE,GAAG;AACd;AAEO,SAAS,6BAA6B,KAAiD;AAC5F,SAAO,IAAI,gBAAgB;AAC7B;AAEO,SAAS,mCAAmC,KAAiD;AAClG,SAAO,IAAI,gBAAgB;AAC7B;","names":[]}

package/dist/chunk-7RNBVZZO.js

@@ -0,0 +1,270 @@
+import {
+  toBackupStamp
+} from "./chunk-KJTKLXTH.js";
+import {
+  copyExistingFileToBackup,
+  writeFileAtomically
+} from "./chunk-R6YJI3HE.js";
+import {
+  StorageManager
+} from "./chunk-4BJQODZF.js";
+import {
+  withHeldFileLock
+} from "./chunk-WL5EBRDH.js";
+import {
+  displayErrorDetail
+} from "./chunk-RL6NEVXT.js";
+import {
+  MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS,
+  buildLifecycleEventsForMemory,
+  compareMemoryLifecycleEvents,
+  memoryLifecycleLedgerLockPath,
+  sortMemoryLifecycleEvents
+} from "./chunk-ILGC6JH6.js";
+import {
+  probeEncryptedRegularFileHeader
+} from "./chunk-AIK5W3IW.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
+
+// src/maintenance/rebuild-memory-lifecycle-ledger.ts
+import path from "path";
+import { stat } from "fs/promises";
+var FRONTMATTER_DERIVED_EVENT_TYPES = {
+  created: true,
+  updated: true,
+  superseded: true,
+  archived: true
+};
+function isNodeError(err) {
+  return typeof err === "object" && err !== null && "code" in err;
+}
+function lifecycleRowBytes(event) {
+  return Buffer.byteLength(`${JSON.stringify(event)}
+`, "utf8");
+}
+function boundLifecycleEventsToByteCap(events, cap) {
+  if (!(cap > 0)) return { kept: events, dropped: 0 };
+  const sizes = /* @__PURE__ */ new Map();
+  let total = 0;
+  for (const event of events) {
+    const bytes = lifecycleRowBytes(event);
+    sizes.set(event, bytes);
+    total += bytes;
+  }
+  if (total <= cap) return { kept: events, dropped: 0 };
+  const byRecency = [...events].sort((a, b) => {
+    if (a.timestamp !== b.timestamp) return b.timestamp.localeCompare(a.timestamp);
+    return -compareMemoryLifecycleEvents(a, b);
+  });
+  const keep = /* @__PURE__ */ new Set();
+  let running = 0;
+  for (const event of byRecency) {
+    const bytes = sizes.get(event);
+    if (running + bytes > cap) continue;
+    running += bytes;
+    keep.add(event);
+  }
+  const kept = events.filter((event) => keep.has(event));
+  return { kept, dropped: events.length - kept.length };
+}
+async function backupExistingLedger(memoryDir, outputPath, now) {
+  try {
+    await stat(outputPath);
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") {
+      return void 0;
+    }
+    throw err;
+  }
+  const backupPath = path.join(
+    memoryDir,
+    "archive",
+    "memory-lifecycle-ledger",
+    toBackupStamp(now),
+    "state",
+    "memory-lifecycle-ledger.jsonl"
+  );
+  return backupPath;
+}
+async function rebuildMemoryLifecycleLedger(options) {
+  const dryRun = options.dryRun !== false;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const outputPath = path.join(options.memoryDir, "state", "memory-lifecycle-ledger.jsonl");
+  const storage = options.storage ?? new StorageManager(options.memoryDir);
+  if (options.storage && path.resolve(storage.dir) !== path.resolve(options.memoryDir)) {
+    throw new Error(
+      `rebuildMemoryLifecycleLedger: storage.dir (${storage.dir}) must match memoryDir (${options.memoryDir})`
+    );
+  }
+  const secureRewrite = options.storage !== void 0;
+  const tiers = [
+    await storage.readAllMemories(),
+    await storage.readAllColdMemories(),
+    await storage.readArchivedMemories()
+  ];
+  const allMemories = tiers.flat();
+  const skippedBlankIdMemories = [];
+  const eventCandidates = [];
+  for (const tier of tiers) {
+    for (const memory of [...tier].sort((left, right) => left.path.localeCompare(right.path))) {
+      if (!memory.frontmatter.id.trim()) {
+        skippedBlankIdMemories.push({ path: memory.path });
+        log.warn(`lifecycle ledger rebuild skipped blank memory id: path=${memory.path}`);
+        continue;
+      }
+      for (const event of buildLifecycleEventsForMemory(memory)) {
+        eventCandidates.push({ event, path: memory.path });
+      }
+    }
+  }
+  const orderedEvents = sortMemoryLifecycleEvents(eventCandidates.map((candidate) => candidate.event));
+  const candidateByEvent = new Map(
+    eventCandidates.map((candidate) => [candidate.event, candidate])
+  );
+  const keptByEventId = /* @__PURE__ */ new Map();
+  const events = [];
+  const skippedDuplicateEvents = [];
+  for (const event of orderedEvents) {
+    const candidate = candidateByEvent.get(event);
+    const kept = keptByEventId.get(event.eventId);
+    if (kept) {
+      skippedDuplicateEvents.push({
+        eventId: event.eventId,
+        keptPath: kept.path,
+        skippedPath: candidate.path
+      });
+      log.warn(
+        `lifecycle ledger rebuild skipped duplicate event_id=${event.eventId}: kept=${kept.path} skipped=${candidate.path}`
+      );
+      continue;
+    }
+    keptByEventId.set(event.eventId, candidate);
+    events.push(event);
+  }
+  let finalEvents = events;
+  let preservedAppendOnlyRows;
+  let archivedOverflowRows;
+  let backupPath;
+  let rewritten = false;
+  const runLedgerCriticalSection = async (acquired, lock) => {
+    if (!dryRun && !acquired) {
+      throw new Error(
+        "lifecycle ledger rebuild aborted: could not acquire the ledger lock within the acquisition budget; refusing to read or rewrite unlocked so a concurrent append or compaction cannot be clobbered (issue #1910)."
+      );
+    }
+    if (options.preserveExistingEvents) {
+      let existing;
+      try {
+        existing = await storage.readAllMemoryLifecycleEventsForCompaction();
+      } catch (err) {
+        throw new Error(
+          `lifecycle ledger rebuild aborted: cannot read existing events to preserve (${displayErrorDetail(err) || "unknown error"})`
+        );
+      }
+      const contentKey = (event) => `${event.memoryId}\0${event.eventType}\0${event.timestamp}`;
+      const reconstructedKeys = new Set(events.map(contentKey));
+      const racedFrontmatterByKey = /* @__PURE__ */ new Map();
+      const appendOnly = [];
+      for (const event of existing) {
+        if (!FRONTMATTER_DERIVED_EVENT_TYPES[event.eventType]) {
+          appendOnly.push(event);
+          continue;
+        }
+        const key = contentKey(event);
+        if (reconstructedKeys.has(key)) continue;
+        if (!racedFrontmatterByKey.has(key)) racedFrontmatterByKey.set(key, event);
+      }
+      const mergedById = /* @__PURE__ */ new Map();
+      for (const event of sortMemoryLifecycleEvents([
+        ...events,
+        ...racedFrontmatterByKey.values(),
+        ...appendOnly
+      ])) {
+        if (!mergedById.has(event.eventId)) mergedById.set(event.eventId, event);
+      }
+      finalEvents = [...mergedById.values()];
+      preservedAppendOnlyRows = finalEvents.length - events.length;
+      if (options.maxLedgerBytes && options.maxLedgerBytes > 0) {
+        const bounded = boundLifecycleEventsToByteCap(finalEvents, options.maxLedgerBytes);
+        if (bounded.dropped > 0) {
+          finalEvents = bounded.kept;
+          archivedOverflowRows = bounded.dropped;
+          log.warn(
+            `lifecycle ledger rebuild bounded to ${options.maxLedgerBytes} bytes: dropped ${bounded.dropped} oldest row(s) from the active ledger (preserved in the backup) to stay under the read/decrypt cap.`
+          );
+        }
+      }
+    }
+    const abortIfLockLost = async () => {
+      if (lock && await lock.refresh()) return;
+      throw new Error(
+        "lifecycle ledger rebuild aborted: lost the ledger lock during the compaction rewrite (a peer stale-broke it while the event loop was blocked by CPU-bound merge/serialize); refusing to clobber a concurrent append (issue #1910/#2033)."
+      );
+    };
+    if (!dryRun) {
+      const payload = finalEvents.map((event) => JSON.stringify(event)).join("\n");
+      const content = payload.length > 0 ? `${payload}
+` : "";
+      let currentEncrypted = false;
+      let priorRawBuffer = null;
+      try {
+        currentEncrypted = await probeEncryptedRegularFileHeader(outputPath);
+        priorRawBuffer = await storage.readMemoryLifecycleLedgerRawBufferForCompaction();
+      } catch (err) {
+        if (!isNodeError(err) || err.code !== "ENOENT") throw err;
+      }
+      const forceEncrypt = secureRewrite && currentEncrypted && storage.isSecureStoreUnlocked();
+      const replacementEncrypted = secureRewrite && (storage.willEncryptStateWrites() || forceEncrypt);
+      if (priorRawBuffer !== null && currentEncrypted === replacementEncrypted && priorRawBuffer.equals(Buffer.from(content, "utf8"))) {
+        rewritten = false;
+      } else {
+        const desiredBackup = await backupExistingLedger(options.memoryDir, outputPath, now);
+        if (secureRewrite) {
+          if (desiredBackup && currentEncrypted) {
+            const rawForBackup = priorRawBuffer ?? await storage.readMemoryLifecycleLedgerRawBufferForCompaction();
+            await storage.writeMemoryLifecycleLedgerContent(rawForBackup, desiredBackup, forceEncrypt);
+            backupPath = desiredBackup;
+          } else {
+            backupPath = desiredBackup ? await copyExistingFileToBackup(outputPath, desiredBackup) : void 0;
+          }
+          await abortIfLockLost();
+          await storage.writeMemoryLifecycleLedgerContent(content, void 0, forceEncrypt);
+        } else {
+          await abortIfLockLost();
+          backupPath = await writeFileAtomically(outputPath, content, desiredBackup);
+        }
+        rewritten = true;
+      }
+    }
+  };
+  if (!dryRun) {
+    await withHeldFileLock(
+      memoryLifecycleLedgerLockPath(outputPath),
+      { staleMs: MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS, ...options.lockOptions },
+      runLedgerCriticalSection
+    );
+  } else if (options.preserveExistingEvents) {
+    await runLedgerCriticalSection(true, null);
+  }
+  return {
+    dryRun,
+    scannedMemories: allMemories.length,
+    rebuiltRows: finalEvents.length,
+    outputPath,
+    backupPath,
+    skippedBlankIdMemories,
+    skippedDuplicateEvents,
+    preservedAppendOnlyRows,
+    archivedOverflowRows,
+    rewritten
+  };
+}
+
+export {
+  boundLifecycleEventsToByteCap,
+  backupExistingLedger,
+  rebuildMemoryLifecycleLedger
+};
+//# sourceMappingURL=chunk-7RNBVZZO.js.map

package/dist/chunk-7RNBVZZO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/maintenance/rebuild-memory-lifecycle-ledger.ts"],"sourcesContent":["import path from \"node:path\";\nimport { stat } from \"node:fs/promises\";\nimport { StorageManager } from \"../storage.js\";\nimport { log } from \"../logger.js\";\nimport { displayErrorDetail } from \"../runtime/better-sqlite.js\";\nimport type { MemoryLifecycleEvent } from \"../types.js\";\nimport { toBackupStamp } from \"./backup-stamp.js\";\nimport { copyExistingFileToBackup, writeFileAtomically } from \"./atomic-file.js\";\nimport {\n  buildLifecycleEventsForMemory,\n  compareMemoryLifecycleEvents,\n  sortMemoryLifecycleEvents,\n  memoryLifecycleLedgerLockPath,\n  MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS,\n} from \"../memory-lifecycle-ledger-utils.js\";\nimport { withHeldFileLock, type HeldFileLockOptions, type HeldFileLockController } from \"../utils/serialize-mutations.js\";\nimport { probeEncryptedRegularFileHeader } from \"../secure-store/secure-fs.js\";\n\n/**\n * Event types `buildLifecycleEventsForMemory` reconstructs from frontmatter.\n * Everything else in the ledger is append-only history with no frontmatter\n * equivalent and must be carried over by a preserving rebuild (issue #1910).\n */\nconst FRONTMATTER_DERIVED_EVENT_TYPES: Record<string, true> = {\n  created: true,\n  updated: true,\n  superseded: true,\n  archived: true,\n};\n\nexport interface RebuildMemoryLifecycleLedgerOptions {\n  memoryDir: string;\n  dryRun?: boolean;\n  now?: Date;\n  /**\n   * Active storage context (issue #1910). When provided, memories are read\n   * through it (so encrypted-at-rest memories in a secure-store deployment are\n   * decrypted with the live key) and the rebuilt ledger is rewritten through\n   * its secure writer (so it stays encrypted at rest). Its `dir` MUST equal\n   * `memoryDir`. When omitted, a fresh plaintext `StorageManager` is used and\n   * the ledger is written as plaintext — the CLI default.\n   */\n  storage?: StorageManager;\n  /**\n   * Preserve append-only lifecycle events that have no frontmatter equivalent\n   * (issue #1910). `buildLifecycleEventsForMemory` only reconstructs\n   * `created`/`updated`/`superseded`/`archived` from frontmatter, so a bare\n   * rebuild silently drops history like `explicit_capture_accepted`,\n   * `explicit_capture_queued`, `imported`, `promoted`, `merged`, `restored`,\n   * and `rejected`. When true, the existing ledger's non-reconstructable rows\n   * are read (via the same secure/permissive `readAllMemoryLifecycleEvents`\n   * path), merged with the rebuilt rows, deduplicated by `eventId`, and sorted\n   * canonically. Background auto-compaction sets this so it never loses events;\n   * the manual/CLI repair rebuild leaves it off (reconstruct purely from\n   * frontmatter).\n   */\n  preserveExistingEvents?: boolean;\n  /**\n   * Override the ledger-lock acquisition timing (issue #2033). Only\n   * `maxWaitMs`/`pollMs` are honored; `staleMs` stays fixed at\n   * `MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS`. Used by tests to force the\n   * lock-acquisition-failure branch (`acquired=false`) deterministically\n   * without a multi-second wait.\n   */\n  lockOptions?: Pick<HeldFileLockOptions, \"maxWaitMs\" | \"pollMs\">;\n  /**\n   * Upper bound (bytes) on the rewritten ledger when preserving events (issue\n   * #2033). A preserving compaction carries over ALL append-only history, which\n   * — if the history alone is large — could leave the rewritten ledger over the\n   * whole-file read/decrypt cap (STATE_FILE_MAX_DECRYPT_BYTES), the exact\n   * unreadable-ledger failure compaction exists to prevent. When set and the\n   * preserved payload would exceed it, the OLDEST rows are dropped from the\n   * active ledger until it fits; because the full pre-compaction ledger is\n   * copied verbatim to the timestamped backup first, those rows are archived,\n   * not lost. Ignored when `preserveExistingEvents` is off (a frontmatter-only\n   * rebuild is already bounded by the corpus). `0`/undefined disables bounding.\n   */\n  maxLedgerBytes?: number;\n}\n\nexport interface SkippedLifecycleBlankIdMemory {\n  path: string;\n}\n\nexport interface SkippedDuplicateLifecycleEvent {\n  eventId: string;\n  keptPath: string;\n  skippedPath: string;\n}\n\nexport interface RebuildMemoryLifecycleLedgerResult {\n  dryRun: boolean;\n  scannedMemories: number;\n  rebuiltRows: number;\n  outputPath: string;\n  backupPath?: string;\n  skippedBlankIdMemories: SkippedLifecycleBlankIdMemory[];\n  skippedDuplicateEvents: SkippedDuplicateLifecycleEvent[];\n  /**\n   * Count of existing-ledger rows carried over beyond the frontmatter\n   * reconstruction (only set when `preserveExistingEvents` is on; issue #1910):\n   * append-only history with no frontmatter equivalent, plus any\n   * frontmatter-derived row that raced in after the corpus scan and so was not\n   * reproduced by the reconstruction (#2033).\n   */\n  preservedAppendOnlyRows?: number;\n  /**\n   * Count of oldest rows dropped from the ACTIVE ledger to keep it under\n   * `maxLedgerBytes` (issue #2033). They remain in the verbatim timestamped\n   * backup, so this is a bound-and-archive, not a loss. Set only when bounding\n   * actually trimmed rows.\n   */\n  archivedOverflowRows?: number;\n  /**\n   * Whether the active ledger was actually backed up and rewritten (issue #2033\n   * thread PRRT_kwDORJXyws6SExst). A preserving write-mode rebuild that would\n   * reproduce the current ledger byte-for-byte (same decrypted content AND same\n   * at-rest format) skips the backup+rewrite, so callers can distinguish a real\n   * compaction from a no-op and avoid re-archiving an unchanged ledger every\n   * interval. `true` for every dry run's non-write preview is never set — only\n   * write-mode results carry it; defaults to `false` when no rewrite happened.\n   */\n  rewritten?: boolean;\n}\n\nfunction isNodeError(err: unknown): err is NodeJS.ErrnoException {\n  return typeof err === \"object\" && err !== null && \"code\" in err;\n}\n\n/** Serialized on-disk size (bytes, incl. trailing newline) of one ledger row. */\nfunction lifecycleRowBytes(event: MemoryLifecycleEvent): number {\n  return Buffer.byteLength(`${JSON.stringify(event)}\\n`, \"utf8\");\n}\n\n/**\n * Keep the NEWEST canonically-ordered events whose serialized payload fits\n * strictly under `cap` bytes (issue #2033). Recency is by `timestamp` (newest\n * first), tie-broken by the canonical comparator, so a large append-only\n * history is trimmed to its most recent rows rather than to a single memoryId\n * group (the ledger's on-disk order is by memoryId then time).\n *\n * A row too large to fit the remaining budget is SKIPPED, and scanning\n * continues to older rows that still fit — one oversized (or future-dated,\n * hence recency-first) row cannot truncate the entire older history. The kept\n * subset is returned in the input's canonical order; the caller relies on the\n * verbatim backup to retain the dropped rows.\n */\nexport function boundLifecycleEventsToByteCap(\n  events: MemoryLifecycleEvent[],\n  cap: number,\n): { kept: MemoryLifecycleEvent[]; dropped: number } {\n  if (!(cap > 0)) return { kept: events, dropped: 0 };\n  const sizes = new Map<MemoryLifecycleEvent, number>();\n  let total = 0;\n  for (const event of events) {\n    const bytes = lifecycleRowBytes(event);\n    sizes.set(event, bytes);\n    total += bytes;\n  }\n  if (total <= cap) return { kept: events, dropped: 0 };\n  const byRecency = [...events].sort((a, b) => {\n    if (a.timestamp !== b.timestamp) return b.timestamp.localeCompare(a.timestamp);\n    return -compareMemoryLifecycleEvents(a, b);\n  });\n  const keep = new Set<MemoryLifecycleEvent>();\n  let running = 0;\n  for (const event of byRecency) {\n    const bytes = sizes.get(event)!;\n    if (running + bytes > cap) continue; // skip this row, keep scanning older rows that still fit\n    running += bytes;\n    keep.add(event);\n  }\n  const kept = events.filter((event) => keep.has(event));\n  return { kept, dropped: events.length - kept.length };\n}\n\nexport async function backupExistingLedger(\n  memoryDir: string,\n  outputPath: string,\n  now: Date,\n): Promise<string | undefined> {\n  try {\n    await stat(outputPath);\n  } catch (err) {\n    if (isNodeError(err) && err.code === \"ENOENT\") {\n      return undefined;\n    }\n    throw err;\n  }\n\n  const backupPath = path.join(\n    memoryDir,\n    \"archive\",\n    \"memory-lifecycle-ledger\",\n    toBackupStamp(now),\n    \"state\",\n    \"memory-lifecycle-ledger.jsonl\",\n  );\n  return backupPath;\n}\n\nexport async function rebuildMemoryLifecycleLedger(\n  options: RebuildMemoryLifecycleLedgerOptions,\n): Promise<RebuildMemoryLifecycleLedgerResult> {\n  const dryRun = options.dryRun !== false;\n  const now = options.now ?? new Date();\n  const outputPath = path.join(options.memoryDir, \"state\", \"memory-lifecycle-ledger.jsonl\");\n  const storage = options.storage ?? new StorageManager(options.memoryDir);\n  if (options.storage && path.resolve(storage.dir) !== path.resolve(options.memoryDir)) {\n    throw new Error(\n      `rebuildMemoryLifecycleLedger: storage.dir (${storage.dir}) must match `\n      + `memoryDir (${options.memoryDir})`,\n    );\n  }\n  const secureRewrite = options.storage !== undefined;\n  const tiers = [\n    await storage.readAllMemories(),\n    await storage.readAllColdMemories(),\n    await storage.readArchivedMemories(),\n  ];\n  const allMemories = tiers.flat();\n  const skippedBlankIdMemories: SkippedLifecycleBlankIdMemory[] = [];\n  const eventCandidates: Array<{ event: MemoryLifecycleEvent; path: string }> = [];\n  for (const tier of tiers) {\n    for (const memory of [...tier].sort((left, right) => left.path.localeCompare(right.path))) {\n      if (!memory.frontmatter.id.trim()) {\n        skippedBlankIdMemories.push({ path: memory.path });\n        log.warn(`lifecycle ledger rebuild skipped blank memory id: path=${memory.path}`);\n        continue;\n      }\n      for (const event of buildLifecycleEventsForMemory(memory)) {\n        eventCandidates.push({ event, path: memory.path });\n      }\n    }\n  }\n\n  const orderedEvents = sortMemoryLifecycleEvents(eventCandidates.map((candidate) => candidate.event));\n  const candidateByEvent = new Map(\n    eventCandidates.map((candidate) => [candidate.event, candidate]),\n  );\n  const keptByEventId = new Map<string, { event: MemoryLifecycleEvent; path: string }>();\n  const events: MemoryLifecycleEvent[] = [];\n  const skippedDuplicateEvents: SkippedDuplicateLifecycleEvent[] = [];\n  for (const event of orderedEvents) {\n    const candidate = candidateByEvent.get(event)!;\n    const kept = keptByEventId.get(event.eventId);\n    if (kept) {\n      skippedDuplicateEvents.push({\n        eventId: event.eventId,\n        keptPath: kept.path,\n        skippedPath: candidate.path,\n      });\n      log.warn(\n        `lifecycle ledger rebuild skipped duplicate event_id=${event.eventId}: `\n        + `kept=${kept.path} skipped=${candidate.path}`,\n      );\n      continue;\n    }\n    keptByEventId.set(event.eventId, candidate);\n    events.push(event);\n  }\n\n  let finalEvents = events;\n  let preservedAppendOnlyRows: number | undefined;\n  let archivedOverflowRows: number | undefined;\n  let backupPath: string | undefined;\n  let rewritten = false;\n  // The preserve-read + whole-file rewrite are serialized against concurrent\n  // lifecycle appends ONLY in write mode (issue #1910, codex):\n  // appendMemoryLifecycleEvents holds this same cross-process lock, so an event\n  // appended after the preserve-read but before the atomic rename waits and\n  // lands on the compacted ledger instead of being clobbered by the rename. A\n  // DRY RUN takes no lock — it reads the ledger read-only to compute the\n  // preserve/merge/byte-cap PREVIEW and never rewrites, so it must not block\n  // appends (#2033 Cursor). The corpus scan above stays outside the lock in\n  // both modes — frontmatter-derived rows come from the memory files.\n  const runLedgerCriticalSection = async (\n    acquired: boolean,\n    lock: HeldFileLockController | null,\n  ): Promise<void> => {\n    // A WRITE that read or rewrote the ledger without the lock could race a\n    // concurrent append/rewrite and lose data, so REFUSE the unlocked fallback\n    // withHeldFileLock takes on acquisition timeout (issue #2033 CodeRabbit\n    // Critical / codex). A dry run passes lock=null and acquired=true: it never\n    // reaches the rewrite, so the unlocked preview read is safe.\n    if (!dryRun && !acquired) {\n      throw new Error(\n        \"lifecycle ledger rebuild aborted: could not acquire the ledger lock within the \"\n        + \"acquisition budget; refusing to read or rewrite unlocked so a concurrent append \"\n        + \"or compaction cannot be clobbered (issue #1910).\",\n      );\n    }\n    if (options.preserveExistingEvents) {\n      // Merge the frontmatter reconstruction (`events`) with the CURRENT ledger\n      // so compaction never deletes a lifecycle row that raced the scan (issue\n      // #1910, #2033). Read the existing ledger through the uncapped BUFFER\n      // path — it decrypts with the live key when `storage` carries the secure\n      // context and bypasses the whole-file string decrypt cap, so an oversize\n      // encrypted ledger (the exact file compaction must shrink) is still\n      // readable here rather than aborting (#2033 Cursor High).\n      // preserveExistingEvents means \"never lose history\": if the current\n      // ledger genuinely cannot be read (corruption, or a locked required\n      // store), ABORT rather than rewrite from frontmatter only and silently\n      // drop that history. An absent ledger reads as [] (ENOENT swallowed\n      // downstream), so a throw here is always a real read failure.\n      let existing: MemoryLifecycleEvent[];\n      try {\n        existing = await storage.readAllMemoryLifecycleEventsForCompaction();\n      } catch (err) {\n        throw new Error(\n          `lifecycle ledger rebuild aborted: cannot read existing events to preserve `\n          + `(${displayErrorDetail(err) || \"unknown error\"})`,\n        );\n      }\n      // The corpus scan (`events`) runs OUTSIDE the lock and is therefore a\n      // stale snapshot; `existing` is read here under the lock and is\n      // authoritative for what the ledger holds at rewrite time. A\n      // frontmatter-derived row (created/updated/superseded/archived) is safe to\n      // collapse into the reconstruction ONLY when the scan actually reproduced\n      // the same logical event — same (memoryId, eventType, timestamp), which is\n      // exactly what the live append stamps (fm.created/updated/...) and what\n      // makeRebuiltMemoryLifecycleEvent emits. A frontmatter-derived row whose\n      // content key the reconstruction did NOT produce raced in after the scan\n      // (a memory created/updated between the scan and this locked read); the\n      // reconstruction has no equivalent, so dropping it by eventType alone\n      // would delete it. Preserve it instead, deduped by content key so a\n      // retried append of the same logical event still collapses to one. Rows\n      // that are not frontmatter-derived are append-only history with no\n      // reconstruction — always carried over, deduped by eventId in the merge.\n      const contentKey = (event: MemoryLifecycleEvent): string =>\n        `${event.memoryId}\\u0000${event.eventType}\\u0000${event.timestamp}`;\n      const reconstructedKeys = new Set(events.map(contentKey));\n      const racedFrontmatterByKey = new Map<string, MemoryLifecycleEvent>();\n      const appendOnly: MemoryLifecycleEvent[] = [];\n      for (const event of existing) {\n        if (!FRONTMATTER_DERIVED_EVENT_TYPES[event.eventType]) {\n          appendOnly.push(event);\n          continue;\n        }\n        const key = contentKey(event);\n        if (reconstructedKeys.has(key)) continue; // collapsed into reconstruction\n        if (!racedFrontmatterByKey.has(key)) racedFrontmatterByKey.set(key, event);\n      }\n      const mergedById = new Map<string, MemoryLifecycleEvent>();\n      for (const event of sortMemoryLifecycleEvents([\n        ...events,\n        ...racedFrontmatterByKey.values(),\n        ...appendOnly,\n      ])) {\n        if (!mergedById.has(event.eventId)) mergedById.set(event.eventId, event);\n      }\n      finalEvents = [...mergedById.values()];\n      preservedAppendOnlyRows = finalEvents.length - events.length;\n      // Bound the rewritten ledger so a preserving compaction can never leave it\n      // over the whole-file read/decrypt cap (#2033). This must run whenever a\n      // cap is set — NOT only when `existing.length > 0`: an oversized on-disk\n      // ledger whose every row fails validation reads as `existing === []`, yet\n      // `finalEvents` (the frontmatter reconstruction) can itself exceed the cap.\n      // Overflow (oldest) rows are dropped from the active ledger but survive\n      // both in the timestamped backup (a verbatim copy when the ledger is\n      // plaintext, re-encrypted under the backup path's own AAD when it is\n      // encrypted so it still decrypts there, #2033) and, for frontmatter-derived\n      // rows, in the memory files they were reconstructed from — so a later full\n      // rebuild regenerates them.\n      if (options.maxLedgerBytes && options.maxLedgerBytes > 0) {\n        const bounded = boundLifecycleEventsToByteCap(finalEvents, options.maxLedgerBytes);\n        if (bounded.dropped > 0) {\n          finalEvents = bounded.kept;\n          archivedOverflowRows = bounded.dropped;\n          log.warn(\n            `lifecycle ledger rebuild bounded to ${options.maxLedgerBytes} bytes: `\n            + `dropped ${bounded.dropped} oldest row(s) from the active ledger `\n            + `(preserved in the backup) to stay under the read/decrypt cap.`,\n          );\n        }\n      }\n    }\n\n    // Re-assert the lock immediately before the destructive active-ledger\n    // rewrite. Everything above (the preserve read, merge, sort, byte-cap\n    // bound, and JSON serialize) is CPU-bound and blocks the event loop, so the\n    // timer heartbeat inside withHeldFileLock cannot refresh the lock's mtime;\n    // a peer that judged the lock stale within the 30s window could have broken\n    // it and appended to the current ledger. `lock.refresh()` (a) reports the\n    // lock LOST so we ABORT rather than rename our compacted file over that\n    // peer's append, and (b) when still held, re-stamps the mtime so the bounded\n    // write below cannot itself be judged stale mid-rename (issue #1910/#2033).\n    const abortIfLockLost = async (): Promise<void> => {\n      if (lock && await lock.refresh()) return;\n      throw new Error(\n        \"lifecycle ledger rebuild aborted: lost the ledger lock during the compaction \"\n        + \"rewrite (a peer stale-broke it while the event loop was blocked by CPU-bound \"\n        + \"merge/serialize); refusing to clobber a concurrent append (issue #1910/#2033).\",\n      );\n    };\n    if (!dryRun) {\n      const payload = finalEvents.map((event) => JSON.stringify(event)).join(\"\\n\");\n      const content = payload.length > 0 ? `${payload}\\n` : \"\";\n      // No-op skip (#2033 thread PRRT_kwDORJXyws6SExst): a preserving rebuild\n      // bounds the ACTIVE ledger to the read/decrypt cap, so a VALID ledger that\n      // sits above the configured compaction trigger but below the cap would\n      // otherwise be rewritten to identical content and re-archived on every\n      // maintenance interval — unbounded growth of archive/memory-lifecycle-ledger\n      // plus pointless disk/CPU churn. Skip the backup+rewrite when it would\n      // change neither the logical (decrypted) content NOR the at-rest format.\n      // The raw read here doubles as the source for the encrypted verbatim backup\n      // below, so the current ledger is read at most once. An absent ledger reads\n      // as ENOENT (a create is always a real change) and any other read/probe\n      // error propagates rather than masking a needed rewrite.\n      let currentEncrypted = false;\n      let priorRawBuffer: Buffer | null = null;\n      try {\n        currentEncrypted = await probeEncryptedRegularFileHeader(outputPath);\n        priorRawBuffer = await storage.readMemoryLifecycleLedgerRawBufferForCompaction();\n      } catch (err) {\n        if (!isNodeError(err) || err.code !== \"ENOENT\") throw err;\n      }\n      // Preserve encryption at rest (#2033). An already-encrypted ledger (or its\n      // encrypted backup) MUST be rewritten encrypted even when the\n      // `secureStoreEncryptOnWrite` policy is paused — otherwise the compaction\n      // silently DOWNGRADES encrypted state to plaintext. Force encryption\n      // whenever the current ledger is encrypted and the store is unlocked (a\n      // key is available); reaching this point with an encrypted ledger already\n      // implies an unlocked store, since the raw read above decrypts and would\n      // have thrown under a locked key. A plaintext ledger keeps the ordinary\n      // policy (`willEncryptStateWrites`), so existing plaintext behavior holds.\n      const forceEncrypt =\n        secureRewrite && currentEncrypted && storage.isSecureStoreUnlocked();\n      const replacementEncrypted =\n        secureRewrite && (storage.willEncryptStateWrites() || forceEncrypt);\n      // Compare as buffers, never decoding the raw ledger to one giant string:\n      // a multi-hundred-MB decrypted ledger can exceed V8's max string length,\n      // so `priorRawBuffer.equals(...)` (byte compare) must be used, NOT\n      // `.toString()` (#2033 giant-string invariant). `content` is the freshly\n      // serialized replacement, already a string; Buffer.from() reuses it.\n      if (\n        priorRawBuffer !== null &&\n        currentEncrypted === replacementEncrypted &&\n        priorRawBuffer.equals(Buffer.from(content, \"utf8\"))\n      ) {\n        // Nothing to change: leave the active ledger and archive untouched.\n        rewritten = false;\n      } else {\n        const desiredBackup = await backupExistingLedger(options.memoryDir, outputPath, now);\n        if (secureRewrite) {\n          // Preserve encrypted-at-rest (issue #1910). The BACKUP needs care under\n          // secure-store (#2033): when the existing ledger is encrypted, its bytes\n          // are path-bound via AAD, so a byte-for-byte copy to the archive path\n          // cannot be decrypted there — it would silently orphan the overflow rows\n          // a bounded rewrite claims to preserve. Reuse the RAW decrypted ledger\n          // content read above (no event parsing, so malformed/truncated/future\n          // rows survive exactly as the plaintext verbatim copy keeps them) and\n          // re-encrypt it under the backup path's own AAD, yielding a directly\n          // decryptable backup that retains every original byte. A PLAINTEXT\n          // existing ledger is already readable, so a verbatim copy is correct.\n          // Then rewrite the active ledger through the secure writer.\n          if (desiredBackup && currentEncrypted) {\n            const rawForBackup =\n              priorRawBuffer ?? (await storage.readMemoryLifecycleLedgerRawBufferForCompaction());\n            await storage.writeMemoryLifecycleLedgerContent(rawForBackup, desiredBackup, forceEncrypt);\n            backupPath = desiredBackup;\n          } else {\n            backupPath = desiredBackup\n              ? await copyExistingFileToBackup(outputPath, desiredBackup)\n              : undefined;\n          }\n          await abortIfLockLost();\n          await storage.writeMemoryLifecycleLedgerContent(content, undefined, forceEncrypt);\n        } else {\n          await abortIfLockLost();\n          backupPath = await writeFileAtomically(outputPath, content, desiredBackup);\n        }\n        rewritten = true;\n      }\n    }\n  };\n  // Write mode holds the ledger lock across the preserve-read and atomic\n  // rewrite so a concurrent append lands on the compacted ledger instead of\n  // being clobbered. A dry run computes the SAME preserve/merge/byte-cap\n  // preview but WITHOUT the lock (read-only, no rewrite), so `rebuiltRows`,\n  // `preservedAppendOnlyRows`, and `archivedOverflowRows` report what a --write\n  // would apply while never blocking concurrent appends (#2033 Cursor). A dry\n  // run with nothing to preserve touches nothing at all.\n  if (!dryRun) {\n    await withHeldFileLock(\n      memoryLifecycleLedgerLockPath(outputPath),\n      { staleMs: MEMORY_LIFECYCLE_LEDGER_LOCK_STALE_MS, ...options.lockOptions },\n      runLedgerCriticalSection,\n    );\n  } else if (options.preserveExistingEvents) {\n    await runLedgerCriticalSection(true, null);\n  }\n\n  return {\n    dryRun,\n    scannedMemories: allMemories.length,\n    rebuiltRows: finalEvents.length,\n    outputPath,\n    backupPath,\n    skippedBlankIdMemories,\n    skippedDuplicateEvents,\n    preservedAppendOnlyRows,\n    archivedOverflowRows,\n    rewritten,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,YAAY;AAsBrB,IAAM,kCAAwD;AAAA,EAC5D,SAAS;AAAA,EACT,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,UAAU;AACZ;AAiGA,SAAS,YAAY,KAA4C;AAC/D,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAQ,UAAU;AAC9D;AAGA,SAAS,kBAAkB,OAAqC;AAC9D,SAAO,OAAO,WAAW,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,GAAM,MAAM;AAC/D;AAeO,SAAS,8BACd,QACA,KACmD;AACnD,MAAI,EAAE,MAAM,GAAI,QAAO,EAAE,MAAM,QAAQ,SAAS,EAAE;AAClD,QAAM,QAAQ,oBAAI,IAAkC;AACpD,MAAI,QAAQ;AACZ,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,kBAAkB,KAAK;AACrC,UAAM,IAAI,OAAO,KAAK;AACtB,aAAS;AAAA,EACX;AACA,MAAI,SAAS,IAAK,QAAO,EAAE,MAAM,QAAQ,SAAS,EAAE;AACpD,QAAM,YAAY,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM;AAC3C,QAAI,EAAE,cAAc,EAAE,UAAW,QAAO,EAAE,UAAU,cAAc,EAAE,SAAS;AAC7E,WAAO,CAAC,6BAA6B,GAAG,CAAC;AAAA,EAC3C,CAAC;AACD,QAAM,OAAO,oBAAI,IAA0B;AAC3C,MAAI,UAAU;AACd,aAAW,SAAS,WAAW;AAC7B,UAAM,QAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,UAAU,QAAQ,IAAK;AAC3B,eAAW;AACX,SAAK,IAAI,KAAK;AAAA,EAChB;AACA,QAAM,OAAO,OAAO,OAAO,CAAC,UAAU,KAAK,IAAI,KAAK,CAAC;AACrD,SAAO,EAAE,MAAM,SAAS,OAAO,SAAS,KAAK,OAAO;AACtD;AAEA,eAAsB,qBACpB,WACA,YACA,KAC6B;AAC7B,MAAI;AACF,UAAM,KAAK,UAAU;AAAA,EACvB,SAAS,KAAK;AACZ,QAAI,YAAY,GAAG,KAAK,IAAI,SAAS,UAAU;AAC7C,aAAO;AAAA,IACT;AACA,UAAM;AAAA,EACR;AAEA,QAAM,aAAa,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc,GAAG;AAAA,IACjB;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,6BACpB,SAC6C;AAC7C,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AACpC,QAAM,aAAa,KAAK,KAAK,QAAQ,WAAW,SAAS,+BAA+B;AACxF,QAAM,UAAU,QAAQ,WAAW,IAAI,eAAe,QAAQ,SAAS;AACvE,MAAI,QAAQ,WAAW,KAAK,QAAQ,QAAQ,GAAG,MAAM,KAAK,QAAQ,QAAQ,SAAS,GAAG;AACpF,UAAM,IAAI;AAAA,MACR,8CAA8C,QAAQ,GAAG,2BACzC,QAAQ,SAAS;AAAA,IACnC;AAAA,EACF;AACA,QAAM,gBAAgB,QAAQ,YAAY;AAC1C,QAAM,QAAQ;AAAA,IACZ,MAAM,QAAQ,gBAAgB;AAAA,IAC9B,MAAM,QAAQ,oBAAoB;AAAA,IAClC,MAAM,QAAQ,qBAAqB;AAAA,EACrC;AACA,QAAM,cAAc,MAAM,KAAK;AAC/B,QAAM,yBAA0D,CAAC;AACjE,QAAM,kBAAwE,CAAC;AAC/E,aAAW,QAAQ,OAAO;AACxB,eAAW,UAAU,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,GAAG;AACzF,UAAI,CAAC,OAAO,YAAY,GAAG,KAAK,GAAG;AACjC,+BAAuB,KAAK,EAAE,MAAM,OAAO,KAAK,CAAC;AACjD,YAAI,KAAK,0DAA0D,OAAO,IAAI,EAAE;AAChF;AAAA,MACF;AACA,iBAAW,SAAS,8BAA8B,MAAM,GAAG;AACzD,wBAAgB,KAAK,EAAE,OAAO,MAAM,OAAO,KAAK,CAAC;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,0BAA0B,gBAAgB,IAAI,CAAC,cAAc,UAAU,KAAK,CAAC;AACnG,QAAM,mBAAmB,IAAI;AAAA,IAC3B,gBAAgB,IAAI,CAAC,cAAc,CAAC,UAAU,OAAO,SAAS,CAAC;AAAA,EACjE;AACA,QAAM,gBAAgB,oBAAI,IAA2D;AACrF,QAAM,SAAiC,CAAC;AACxC,QAAM,yBAA2D,CAAC;AAClE,aAAW,SAAS,eAAe;AACjC,UAAM,YAAY,iBAAiB,IAAI,KAAK;AAC5C,UAAM,OAAO,cAAc,IAAI,MAAM,OAAO;AAC5C,QAAI,MAAM;AACR,6BAAuB,KAAK;AAAA,QAC1B,SAAS,MAAM;AAAA,QACf,UAAU,KAAK;AAAA,QACf,aAAa,UAAU;AAAA,MACzB,CAAC;AACD,UAAI;AAAA,QACF,uDAAuD,MAAM,OAAO,UAC1D,KAAK,IAAI,YAAY,UAAU,IAAI;AAAA,MAC/C;AACA;AAAA,IACF;AACA,kBAAc,IAAI,MAAM,SAAS,SAAS;AAC1C,WAAO,KAAK,KAAK;AAAA,EACnB;AAEA,MAAI,cAAc;AAClB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY;AAUhB,QAAM,2BAA2B,OAC/B,UACA,SACkB;AAMlB,QAAI,CAAC,UAAU,CAAC,UAAU;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,QAAI,QAAQ,wBAAwB;AAalC,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,QAAQ,0CAA0C;AAAA,MACrE,SAAS,KAAK;AACZ,cAAM,IAAI;AAAA,UACR,8EACM,mBAAmB,GAAG,KAAK,eAAe;AAAA,QAClD;AAAA,MACF;AAgBA,YAAM,aAAa,CAAC,UAClB,GAAG,MAAM,QAAQ,KAAS,MAAM,SAAS,KAAS,MAAM,SAAS;AACnE,YAAM,oBAAoB,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC;AACxD,YAAM,wBAAwB,oBAAI,IAAkC;AACpE,YAAM,aAAqC,CAAC;AAC5C,iBAAW,SAAS,UAAU;AAC5B,YAAI,CAAC,gCAAgC,MAAM,SAAS,GAAG;AACrD,qBAAW,KAAK,KAAK;AACrB;AAAA,QACF;AACA,cAAM,MAAM,WAAW,KAAK;AAC5B,YAAI,kBAAkB,IAAI,GAAG,EAAG;AAChC,YAAI,CAAC,sBAAsB,IAAI,GAAG,EAAG,uBAAsB,IAAI,KAAK,KAAK;AAAA,MAC3E;AACA,YAAM,aAAa,oBAAI,IAAkC;AACzD,iBAAW,SAAS,0BAA0B;AAAA,QAC5C,GAAG;AAAA,QACH,GAAG,sBAAsB,OAAO;AAAA,QAChC,GAAG;AAAA,MACL,CAAC,GAAG;AACF,YAAI,CAAC,WAAW,IAAI,MAAM,OAAO,EAAG,YAAW,IAAI,MAAM,SAAS,KAAK;AAAA,MACzE;AACA,oBAAc,CAAC,GAAG,WAAW,OAAO,CAAC;AACrC,gCAA0B,YAAY,SAAS,OAAO;AAYtD,UAAI,QAAQ,kBAAkB,QAAQ,iBAAiB,GAAG;AACxD,cAAM,UAAU,8BAA8B,aAAa,QAAQ,cAAc;AACjF,YAAI,QAAQ,UAAU,GAAG;AACvB,wBAAc,QAAQ;AACtB,iCAAuB,QAAQ;AAC/B,cAAI;AAAA,YACF,uCAAuC,QAAQ,cAAc,mBAChD,QAAQ,OAAO;AAAA,UAE9B;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAWA,UAAM,kBAAkB,YAA2B;AACjD,UAAI,QAAQ,MAAM,KAAK,QAAQ,EAAG;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,UAAU,YAAY,IAAI,CAAC,UAAU,KAAK,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI;AAC3E,YAAM,UAAU,QAAQ,SAAS,IAAI,GAAG,OAAO;AAAA,IAAO;AAYtD,UAAI,mBAAmB;AACvB,UAAI,iBAAgC;AACpC,UAAI;AACF,2BAAmB,MAAM,gCAAgC,UAAU;AACnE,yBAAiB,MAAM,QAAQ,gDAAgD;AAAA,MACjF,SAAS,KAAK;AACZ,YAAI,CAAC,YAAY,GAAG,KAAK,IAAI,SAAS,SAAU,OAAM;AAAA,MACxD;AAUA,YAAM,eACJ,iBAAiB,oBAAoB,QAAQ,sBAAsB;AACrE,YAAM,uBACJ,kBAAkB,QAAQ,uBAAuB,KAAK;AAMxD,UACE,mBAAmB,QACnB,qBAAqB,wBACrB,eAAe,OAAO,OAAO,KAAK,SAAS,MAAM,CAAC,GAClD;AAEA,oBAAY;AAAA,MACd,OAAO;AACL,cAAM,gBAAgB,MAAM,qBAAqB,QAAQ,WAAW,YAAY,GAAG;AACnF,YAAI,eAAe;AAYjB,cAAI,iBAAiB,kBAAkB;AACrC,kBAAM,eACJ,kBAAmB,MAAM,QAAQ,gDAAgD;AACnF,kBAAM,QAAQ,kCAAkC,cAAc,eAAe,YAAY;AACzF,yBAAa;AAAA,UACf,OAAO;AACL,yBAAa,gBACT,MAAM,yBAAyB,YAAY,aAAa,IACxD;AAAA,UACN;AACA,gBAAM,gBAAgB;AACtB,gBAAM,QAAQ,kCAAkC,SAAS,QAAW,YAAY;AAAA,QAClF,OAAO;AACL,gBAAM,gBAAgB;AACtB,uBAAa,MAAM,oBAAoB,YAAY,SAAS,aAAa;AAAA,QAC3E;AACA,oBAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAQA,MAAI,CAAC,QAAQ;AACX,UAAM;AAAA,MACJ,8BAA8B,UAAU;AAAA,MACxC,EAAE,SAAS,uCAAuC,GAAG,QAAQ,YAAY;AAAA,MACzE;AAAA,IACF;AAAA,EACF,WAAW,QAAQ,wBAAwB;AACzC,UAAM,yBAAyB,MAAM,IAAI;AAAA,EAC3C;AAEA,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB,YAAY;AAAA,IAC7B,aAAa,YAAY;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-3FAMU5TX.js → chunk-A6USBZTO.js}

@@ -5,7 +5,7 @@ import {
 import {
   serializeMutations,
   withHeldFileLock
-} from "./chunk-LTJAMRGI.js";
+} from "./chunk-WL5EBRDH.js";
 
 // src/summary-snapshot.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -147,4 +147,4 @@ export {
   writeSummarySnapshot,
   upsertSummarySnapshot
 };
-//# sourceMappingURL=chunk-3FAMU5TX.js.map
+//# sourceMappingURL=chunk-A6USBZTO.js.map

package/dist/{chunk-ZHIVCODT.js → chunk-A72SWTWW.js}

@@ -1,24 +1,24 @@
 import {
   runPostConsolidationMaterialize
-} from "./chunk-RO4LQGT3.js";
+} from "./chunk-WON4APQY.js";
 import {
   discoverMemoryExtensions,
   renderExtensionsBlock,
   resolveExtensionsRoot
 } from "./chunk-JLNBQWZ2.js";
+import {
+  isSemanticConsolidationLlmOperator
+} from "./chunk-G7D6GZ5J.js";
 import {
   countRecallTokenOverlap,
   normalizeRecallTokens
 } from "./chunk-ZBJMUXZH.js";
-import {
-  isSemanticConsolidationLlmOperator
-} from "./chunk-G7D6GZ5J.js";
 import {
   resolvePipelineProcessingCapabilities
-} from "./chunk-BFPETA3S.js";
+} from "./chunk-SCCO46KZ.js";
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/semantic-consolidation.ts
 function findSimilarClusters(memories, config) {
@@ -220,4 +220,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-ZHIVCODT.js.map
+//# sourceMappingURL=chunk-A72SWTWW.js.map

package/dist/{chunk-FC77VUX5.js → chunk-A7Q43EUZ.js}

@@ -1,6 +1,6 @@
 import {
   log
-} from "./chunk-37CTGERM.js";
+} from "./chunk-3WCASNQZ.js";
 
 // src/conversation-index/search.ts
 async function searchConversationIndex(qmd, query, maxResults) {
@@ -26,4 +26,4 @@ export {
   searchConversationIndex,
   searchConversationIndexFaissFailOpen
 };
-//# sourceMappingURL=chunk-FC77VUX5.js.map
+//# sourceMappingURL=chunk-A7Q43EUZ.js.map