@samjurnio_/memento 0.2.0

package/dist/mcp.js

@@ -0,0 +1,197 @@
+import { resolve } from "node:path";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { loadPacket } from "./artifacts.js";
+import { captureGitState, restoreWorkspace, snapshotRefExists, verifyWorkspace } from "./git.js";
+import { AGENTS, performHandoff, REASONS } from "./handoff.js";
+import { INJECT_TARGETS, injectPacket, isInjectTarget } from "./inject/dispatch.js";
+import { verifySeal } from "./packet.js";
+import { renderResumePrompt, renderStatus } from "./render.js";
+/**
+ * Memento as an MCP server (spec §6.3, stdio transport): the same tool
+ * vocabulary every agent CLI can call natively, removing the paste step from
+ * cross-agent handoff. Built on the SDK's low-level Server API with plain
+ * JSON Schema inputs — deliberately avoiding the high-level zod bridge so
+ * Memento's zod v4 never has to interoperate with the SDK's bundled zod.
+ *
+ * Register (examples):
+ *   claude mcp add memento -- memento mcp
+ *   codex config: [mcp_servers.memento] command = "memento" args = ["mcp"]
+ */
+const WORKSPACE_PROP = {
+    workspace: {
+        type: "string",
+        description: "Workspace directory. Defaults to the server process cwd.",
+    },
+};
+const TOOLS = [
+    {
+        name: "memento_handoff",
+        description: "Compile a sealed Continuation Packet from the workspace's latest agent session " +
+            "(or an explicit transcript) and write .memento/handoff.json + HANDOFF.md. " +
+            "Pass `to` to also inject it as a native session for that agent in one step. " +
+            "Successive calls chain automatically (same task, parent pointer, seq+1).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ...WORKSPACE_PROP,
+                agent: { type: "string", enum: [...AGENTS], description: "Which agent's session to capture (default claude-code)." },
+                to: { type: "string", enum: [...INJECT_TARGETS], description: "Optional: also inject the packet as a native session for this agent." },
+                transcript: { type: "string", description: "Explicit session file; defaults to newest for the workspace." },
+                reason: { type: "string", enum: [...REASONS], description: "Why the handoff is happening (default operator_switch)." },
+            },
+        },
+    },
+    {
+        name: "memento_resume",
+        description: "Return the resume prompt for the workspace's current packet: continuation " +
+            "instructions plus the full handoff. Refuses packets whose seal fails verification. " +
+            "Call this FIRST when continuing another agent's task.",
+        inputSchema: { type: "object", properties: { ...WORKSPACE_PROP } },
+    },
+    {
+        name: "memento_verify",
+        description: "Continuity check: compare the live workspace git state against the packet. " +
+            "Returns a drift report; isError is set when drift is detected. " +
+            "Run before editing anything after a resume.",
+        inputSchema: { type: "object", properties: { ...WORKSPACE_PROP } },
+    },
+    {
+        name: "memento_restore",
+        description: "Materialize the packet's working-tree snapshot into the workspace — the prior " +
+            "agent's actual uncommitted and untracked files, not just a summary of them. " +
+            "Refuses to overwrite diverging local edits unless force is set.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                ...WORKSPACE_PROP,
+                force: { type: "boolean", description: "Overwrite local edits that diverge from the packet." },
+            },
+        },
+    },
+    {
+        name: "memento_status",
+        description: "Summarize the workspace's current packet: ids, chain position, seal, next step.",
+        inputSchema: { type: "object", properties: { ...WORKSPACE_PROP } },
+    },
+];
+function requirePacket(workspace) {
+    const packet = loadPacket(workspace);
+    if (!packet) {
+        throw new Error(`No packet found in ${workspace}/.memento — run memento_handoff first.`);
+    }
+    return packet;
+}
+async function dispatch(name, args) {
+    const workspace = resolve(typeof args.workspace === "string" ? args.workspace : process.cwd());
+    switch (name) {
+        case "memento_handoff": {
+            const reason = typeof args.reason === "string" ? args.reason : undefined;
+            if (reason && !REASONS.includes(reason)) {
+                throw new Error(`Unknown reason "${reason}". One of: ${REASONS.join(", ")}`);
+            }
+            const to = typeof args.to === "string" ? args.to : undefined;
+            if (to && !isInjectTarget(to)) {
+                throw new Error(`Unknown target "${to}". One of: ${INJECT_TARGETS.join(", ")}`);
+            }
+            const result = await performHandoff({
+                workspaceDir: workspace,
+                ...(typeof args.agent === "string" ? { agent: args.agent } : {}),
+                ...(typeof args.transcript === "string" ? { transcript: args.transcript } : {}),
+                ...(reason ? { reason: reason } : {}),
+            });
+            const out = [
+                `Sealed packet ${result.packet.packet.id} (task ${result.packet.packet.taskId}, seq ${result.packet.packet.seq})`,
+                `ledger: ${result.transcriptPath} (${result.eventCount} events)`,
+                `snapshot: ${result.packet.workspace.git?.snapshotRef ?? "(none)"}`,
+                `redaction: ${result.packet.redaction.count} hit(s)`,
+                `wrote: ${result.artifacts.jsonPath}`,
+            ];
+            if (to && isInjectTarget(to)) {
+                out.push("", ...(await injectPacket(to, result.packet, workspace)));
+            }
+            return { text: out.join("\n") };
+        }
+        case "memento_resume": {
+            const packet = requirePacket(workspace);
+            if (!verifySeal(packet)) {
+                throw new Error("Packet seal does not verify — it was modified after sealing. Refusing.");
+            }
+            return { text: renderResumePrompt(packet) };
+        }
+        case "memento_verify": {
+            const packet = requirePacket(workspace);
+            if (!packet.workspace.git) {
+                return { text: "Packet carries no git state; nothing to verify." };
+            }
+            const report = await verifyWorkspace(workspace, packet.workspace.git);
+            if (report.clean) {
+                return { text: `Workspace matches packet ${packet.packet.id} — safe to continue.` };
+            }
+            return {
+                text: [`Drift detected against packet ${packet.packet.id}:`, ...report.drift].join("\n"),
+                isError: true,
+            };
+        }
+        case "memento_restore": {
+            const packet = requirePacket(workspace);
+            const snapshotRef = packet.workspace.git?.snapshotRef;
+            if (!snapshotRef) {
+                return { text: "Packet carries no working-tree snapshot — nothing to restore.", isError: true };
+            }
+            if (!(await snapshotRefExists(workspace, snapshotRef))) {
+                return {
+                    text: `Snapshot ${snapshotRef} is not present in this repo (cross-machine restore needs a bundle).`,
+                    isError: true,
+                };
+            }
+            const force = args.force === true;
+            if (!force && packet.workspace.git) {
+                const current = await captureGitState(workspace);
+                if (current && current.dirty.length > 0) {
+                    const report = await verifyWorkspace(workspace, packet.workspace.git);
+                    if (!report.clean) {
+                        return {
+                            text: ["Workspace has uncommitted changes that diverge from the packet; restore would overwrite them. Pass force:true to proceed.", ...report.drift].join("\n"),
+                            isError: true,
+                        };
+                    }
+                }
+            }
+            const result = await restoreWorkspace(workspace, snapshotRef);
+            return { text: `Restored ${result.files.length} file(s) from ${snapshotRef}: ${result.files.slice(0, 20).join(", ")}${result.files.length > 20 ? ", …" : ""}` };
+        }
+        case "memento_status": {
+            const packet = requirePacket(workspace);
+            return { text: renderStatus(packet, verifySeal(packet)) };
+        }
+        default:
+            throw new Error(`Unknown tool "${name}".`);
+    }
+}
+export function buildMcpServer() {
+    const server = new Server({ name: "memento", version: "0.1.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        try {
+            const reply = await dispatch(request.params.name, (request.params.arguments ?? {}));
+            return {
+                content: [{ type: "text", text: reply.text }],
+                ...(reply.isError ? { isError: true } : {}),
+            };
+        }
+        catch (error) {
+            return {
+                content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+                isError: true,
+            };
+        }
+    });
+    return server;
+}
+export async function runMcpServer() {
+    await buildMcpServer().connect(new StdioServerTransport());
+    // stdio transport keeps the process alive until the client disconnects.
+}
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,EAAC,MAAM,EAAC,MAAM,2CAA2C,CAAC;AACjE,OAAO,EAAC,oBAAoB,EAAC,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EACH,qBAAqB,EACrB,sBAAsB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAC,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAC,MAAM,UAAU,CAAC;AAC/F,OAAO,EAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAC,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAC,cAAc,EAAE,YAAY,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAC,UAAU,EAAc,MAAM,aAAa,CAAC;AACpD,OAAO,EAAC,kBAAkB,EAAE,YAAY,EAAC,MAAM,aAAa,CAAC;AAE7D;;;;;;;;;;GAUG;AAEH,MAAM,cAAc,GAAG;IACnB,SAAS,EAAE;QACP,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0DAA0D;KAC1E;CACK,CAAC;AAEX,MAAM,KAAK,GAAG;IACV;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,iFAAiF;YACjF,4EAA4E;YAC5E,8EAA8E;YAC9E,0EAA0E;QAC9E,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,GAAG,cAAc;gBACjB,KAAK,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAC;gBAClH,EAAE,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,WAAW,EAAE,sEAAsE,EAAC;gBACpI,UAAU,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAC;gBACzG,MAAM,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAC;aACvH;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,4EAA4E;YAC5E,qFAAqF;YACrF,uDAAuD;QAC3D,WAAW,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAC,GAAG,cAAc,EAAC,EAAC;KACjE;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACP,6EAA6E;YAC7E,iEAAiE;YACjE,6CAA6C;QACjD,WAAW,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAC,GAAG,cAAc,EAAC,EAAC;KACjE;IACD;QACI,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACP,gFAAgF;YAChF,8EAA8E;YAC9E,iEAAiE;QACrE,WAAW,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,GAAG,cAAc;gBACjB,KAAK,EAAE,EAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,qDAAqD,EAAC;aAC/F;SACJ;KACJ;IACD;QACI,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,iFAAiF;QAC9F,WAAW,EAAE,EAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAC,GAAG,cAAc,EAAC,EAAC;KACjE;CACJ,CAAC;AAOF,SAAS,aAAa,CAAC,SAAiB;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,wCAAwC,CAAC,CAAC;IAC7F,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,IAA6B;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/F,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAEzE,IAAI,MAAM,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7D,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,cAAc,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;gBAChC,YAAY,EAAE,SAAS;gBACvB,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,MAAoC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpE,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG;gBACR,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG;gBACjH,WAAW,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,UAAU,UAAU;gBAChE,aAAa,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,IAAI,QAAQ,EAAE;gBACnE,cAAc,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,SAAS;gBACpD,UAAU,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE;aACxC,CAAC;YAEF,IAAI,EAAE,IAAI,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;YAED,OAAO,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAC,CAAC;QAClC,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YAExC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC9F,CAAC;YAED,OAAO,EAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAC,CAAC;QAC9C,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YAExC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;gBACxB,OAAO,EAAC,IAAI,EAAE,iDAAiD,EAAC,CAAC;YACrE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAEtE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,EAAC,IAAI,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAC,CAAC;YACtF,CAAC;YAED,OAAO;gBACH,IAAI,EAAE,CAAC,iCAAiC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACxF,OAAO,EAAE,IAAI;aAChB,CAAC;QACN,CAAC;QAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;YAEtD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,OAAO,EAAC,IAAI,EAAE,+DAA+D,EAAE,OAAO,EAAE,IAAI,EAAC,CAAC;YAClG,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACH,IAAI,EAAE,YAAY,WAAW,sEAAsE;oBACnG,OAAO,EAAE,IAAI;iBAChB,CAAC;YACN,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;YAElC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;gBAEjD,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAEtE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;wBAChB,OAAO;4BACH,IAAI,EAAE,CAAC,2HAA2H,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;4BAC/J,OAAO,EAAE,IAAI;yBAChB,CAAC;oBACN,CAAC;gBACL,CAAC;YACL,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC9D,OAAO,EAAC,IAAI,EAAE,YAAY,MAAM,CAAC,KAAK,CAAC,MAAM,iBAAiB,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAC,CAAC;QAClK,CAAC;QAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;YACxC,OAAO,EAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,EAAC,CAAC;QAC5D,CAAC;QAED;YACI,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;IACnD,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC1B,MAAM,MAAM,GAAG,IAAI,MAAM,CACrB,EAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAC,EACnC,EAAC,YAAY,EAAE,EAAC,KAAK,EAAE,EAAE,EAAC,EAAC,CAC9B,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAC,KAAK,EAAE,KAAK,EAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9D,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CACxB,OAAO,CAAC,MAAM,CAAC,IAAI,EACnB,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAC9D,CAAC;YAEF,OAAO;gBACH,OAAO,EAAE,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAC,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO;gBACH,OAAO,EAAE,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC;gBACvF,OAAO,EAAE,IAAI;aAChB,CAAC;QACN,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAC9B,MAAM,cAAc,EAAE,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC3D,wEAAwE;AAC5E,CAAC"}

package/dist/packet.d.ts

@@ -0,0 +1,185 @@
+import { z } from "zod";
+/**
+ * Continuation Packet v1 (spec §5.3) — the portable execution-state snapshot.
+ * This zod schema is the single source of truth: runtime validation AND the
+ * published JSON Schema artifact (schemas/packet.v1.schema.json) derive from it.
+ */
+export declare const PlanStep: z.ZodObject<{
+    n: z.ZodNumber;
+    desc: z.ZodString;
+    status: z.ZodEnum<{
+        done: "done";
+        in_progress: "in_progress";
+        pending: "pending";
+    }>;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const Decision: z.ZodObject<{
+    what: z.ZodString;
+    why: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const DirtyFile: z.ZodObject<{
+    path: z.ZodString;
+    state: z.ZodString;
+}, z.core.$strip>;
+export declare const GitState: z.ZodObject<{
+    remote: z.ZodNullable<z.ZodString>;
+    branch: z.ZodNullable<z.ZodString>;
+    headSha: z.ZodNullable<z.ZodString>;
+    snapshotRef: z.ZodNullable<z.ZodString>;
+    dirtyDigest: z.ZodString;
+    dirty: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        state: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const ToolOutcome: z.ZodObject<{
+    tool: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    outcome: z.ZodString;
+}, z.core.$strip>;
+export declare const InFlightTool: z.ZodObject<{
+    tool: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    intent: z.ZodOptional<z.ZodString>;
+    disposition: z.ZodString;
+}, z.core.$strip>;
+export declare const Approvals: z.ZodObject<{
+    granted_session: z.ZodArray<z.ZodString>;
+    pending: z.ZodArray<z.ZodString>;
+    denied: z.ZodArray<z.ZodObject<{
+        tool: z.ZodString;
+        target: z.ZodOptional<z.ZodString>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const LastRun: z.ZodObject<{
+    cmd: z.ZodString;
+    result: z.ZodString;
+    at: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const PacketSchema: z.ZodObject<{
+    memento: z.ZodLiteral<"1.0">;
+    packet: z.ZodObject<{
+        id: z.ZodString;
+        taskId: z.ZodString;
+        workspaceId: z.ZodString;
+        scope: z.ZodEnum<{
+            personal: "personal";
+            workspace: "workspace";
+            team: "team";
+            org: "org";
+        }>;
+        createdAt: z.ZodString;
+        reason: z.ZodEnum<{
+            context_exhaustion: "context_exhaustion";
+            operator_switch: "operator_switch";
+            session_end: "session_end";
+            scheduled: "scheduled";
+            team_handoff: "team_handoff";
+        }>;
+        from: z.ZodObject<{
+            peer: z.ZodString;
+            agent: z.ZodString;
+            model: z.ZodOptional<z.ZodString>;
+            human: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        seq: z.ZodNumber;
+        parent: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    task: z.ZodObject<{
+        title: z.ZodString;
+        objective: z.ZodString;
+        constraints: z.ZodArray<z.ZodString>;
+        acceptance: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    plan: z.ZodObject<{
+        steps: z.ZodArray<z.ZodObject<{
+            n: z.ZodNumber;
+            desc: z.ZodString;
+            status: z.ZodEnum<{
+                done: "done";
+                in_progress: "in_progress";
+                pending: "pending";
+            }>;
+            note: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    decisions: z.ZodArray<z.ZodObject<{
+        what: z.ZodString;
+        why: z.ZodString;
+        ref: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    workspace: z.ZodObject<{
+        git: z.ZodOptional<z.ZodObject<{
+            remote: z.ZodNullable<z.ZodString>;
+            branch: z.ZodNullable<z.ZodString>;
+            headSha: z.ZodNullable<z.ZodString>;
+            snapshotRef: z.ZodNullable<z.ZodString>;
+            dirtyDigest: z.ZodString;
+            dirty: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                state: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        commands: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        lastRun: z.ZodOptional<z.ZodObject<{
+            cmd: z.ZodString;
+            result: z.ZodString;
+            at: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    toolState: z.ZodObject<{
+        completed: z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            target: z.ZodOptional<z.ZodString>;
+            outcome: z.ZodString;
+        }, z.core.$strip>>;
+        inFlight: z.ZodArray<z.ZodObject<{
+            tool: z.ZodString;
+            target: z.ZodOptional<z.ZodString>;
+            intent: z.ZodOptional<z.ZodString>;
+            disposition: z.ZodString;
+        }, z.core.$strip>>;
+        approvals: z.ZodObject<{
+            granted_session: z.ZodArray<z.ZodString>;
+            pending: z.ZodArray<z.ZodString>;
+            denied: z.ZodArray<z.ZodObject<{
+                tool: z.ZodString;
+                target: z.ZodOptional<z.ZodString>;
+                note: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    memory: z.ZodObject<{
+        inline: z.ZodArray<z.ZodString>;
+        query: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    next: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+    ledgerRef: z.ZodOptional<z.ZodString>;
+    fidelity: z.ZodEnum<{
+        narrative: "narrative";
+        structural: "structural";
+        native: "native";
+    }>;
+    redaction: z.ZodObject<{
+        applied: z.ZodBoolean;
+        rules: z.ZodArray<z.ZodString>;
+        count: z.ZodNumber;
+    }, z.core.$strip>;
+    seal: z.ZodOptional<z.ZodObject<{
+        alg: z.ZodLiteral<"sha256">;
+        digest: z.ZodString;
+        sig: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Packet = z.infer<typeof PacketSchema>;
+export type PacketGitState = z.infer<typeof GitState>;
+/** Stable stringify: objects serialized with sorted keys, recursively. */
+export declare function canonicalStringify(value: unknown): string;
+/** Seal = sha256 over the canonical JSON of everything except the seal itself. */
+export declare function sealPacket(packet: Packet): Packet;
+export declare function verifySeal(packet: Packet): boolean;
+export declare function packetJsonSchema(): unknown;

package/dist/packet.js

@@ -0,0 +1,154 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+/**
+ * Continuation Packet v1 (spec §5.3) — the portable execution-state snapshot.
+ * This zod schema is the single source of truth: runtime validation AND the
+ * published JSON Schema artifact (schemas/packet.v1.schema.json) derive from it.
+ */
+export const PlanStep = z.object({
+    n: z.number().int().positive(),
+    desc: z.string(),
+    status: z.enum(["done", "in_progress", "pending"]),
+    note: z.string().optional(),
+});
+export const Decision = z.object({
+    what: z.string(),
+    why: z.string(),
+    ref: z.string().optional(),
+});
+export const DirtyFile = z.object({
+    path: z.string(),
+    state: z.string(),
+});
+export const GitState = z.object({
+    remote: z.string().nullable(),
+    branch: z.string().nullable(),
+    headSha: z.string().nullable(),
+    /** Shadow ref holding a snapshot of the FULL tree incl. uncommitted work. */
+    snapshotRef: z.string().nullable(),
+    /** sha256 of porcelain status + diff at capture time; drift detector input. */
+    dirtyDigest: z.string(),
+    dirty: z.array(DirtyFile),
+});
+export const ToolOutcome = z.object({
+    tool: z.string(),
+    target: z.string().optional(),
+    outcome: z.string(),
+});
+export const InFlightTool = z.object({
+    tool: z.string(),
+    target: z.string().optional(),
+    intent: z.string().optional(),
+    /** Always present: tells the receiver an in-flight call was NOT applied. */
+    disposition: z.string(),
+});
+export const Approvals = z.object({
+    granted_session: z.array(z.string()),
+    pending: z.array(z.string()),
+    denied: z.array(z.object({
+        tool: z.string(),
+        target: z.string().optional(),
+        note: z.string().optional(),
+    })),
+});
+export const LastRun = z.object({
+    cmd: z.string(),
+    result: z.string(),
+    at: z.string().optional(),
+});
+export const PacketSchema = z.object({
+    memento: z.literal("1.0"),
+    packet: z.object({
+        id: z.string(),
+        taskId: z.string(),
+        workspaceId: z.string(),
+        scope: z.enum(["personal", "workspace", "team", "org"]),
+        createdAt: z.string(),
+        reason: z.enum([
+            "context_exhaustion",
+            "operator_switch",
+            "session_end",
+            "scheduled",
+            "team_handoff",
+        ]),
+        from: z.object({
+            peer: z.string(),
+            agent: z.string(),
+            model: z.string().optional(),
+            human: z.string().optional(),
+        }),
+        seq: z.number().int().nonnegative(),
+        parent: z.string().nullable(),
+    }),
+    task: z.object({
+        title: z.string(),
+        objective: z.string(),
+        constraints: z.array(z.string()),
+        acceptance: z.array(z.string()),
+    }),
+    plan: z.object({ steps: z.array(PlanStep) }),
+    decisions: z.array(Decision),
+    workspace: z.object({
+        git: GitState.optional(),
+        commands: z.record(z.string(), z.string()).optional(),
+        lastRun: LastRun.optional(),
+    }),
+    toolState: z.object({
+        completed: z.array(ToolOutcome),
+        inFlight: z.array(InFlightTool),
+        approvals: Approvals,
+    }),
+    memory: z.object({
+        inline: z.array(z.string()),
+        query: z.string().optional(),
+    }),
+    next: z.array(z.string()),
+    warnings: z.array(z.string()),
+    ledgerRef: z.string().optional(),
+    fidelity: z.enum(["narrative", "structural", "native"]),
+    redaction: z.object({
+        applied: z.boolean(),
+        rules: z.array(z.string()),
+        count: z.number().int().nonnegative(),
+    }),
+    seal: z.object({
+        alg: z.literal("sha256"),
+        digest: z.string(),
+        sig: z.string().nullable(),
+    }).optional(),
+});
+/** Stable stringify: objects serialized with sorted keys, recursively. */
+export function canonicalStringify(value) {
+    return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(sortValue);
+    }
+    if (value !== null && typeof value === "object") {
+        const sorted = {};
+        for (const key of Object.keys(value).sort()) {
+            sorted[key] = sortValue(value[key]);
+        }
+        return sorted;
+    }
+    return value;
+}
+/** Seal = sha256 over the canonical JSON of everything except the seal itself. */
+export function sealPacket(packet) {
+    const { seal: _ignored, ...rest } = packet;
+    const digest = createHash("sha256").update(canonicalStringify(rest)).digest("hex");
+    return { ...packet, seal: { alg: "sha256", digest, sig: null } };
+}
+export function verifySeal(packet) {
+    if (!packet.seal) {
+        return false;
+    }
+    const { seal, ...rest } = packet;
+    const digest = createHash("sha256").update(canonicalStringify(rest)).digest("hex");
+    return digest === seal.digest;
+}
+export function packetJsonSchema() {
+    return z.toJSONSchema(PacketSchema);
+}
+//# sourceMappingURL=packet.js.map

package/dist/packet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packet.js","sourceRoot":"","sources":["../src/packet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;GAIG;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,6EAA6E;IAC7E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,+EAA+E;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,4EAA4E;IAC5E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC,CAAC;CACN,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACvD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACX,oBAAoB;YACpB,iBAAiB;YACjB,aAAa;YACb,WAAW;YACX,cAAc;SACjB,CAAC;QACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC/B,CAAC;QACF,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAC,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrD,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC/B,SAAS,EAAE,SAAS;KACvB,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACX,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC,CAAC,QAAQ,EAAE;CAChB,CAAC,CAAC;AAKH,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,MAAM,EAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAC,GAAG,MAAM,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnF,OAAO,EAAC,GAAG,MAAM,EAAE,IAAI,EAAE,EAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAC,EAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAc;IACrC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,EAAC,IAAI,EAAE,GAAG,IAAI,EAAC,GAAG,MAAM,CAAC;IAC/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnF,OAAO,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC5B,OAAO,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;AACxC,CAAC"}

package/dist/redact.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Secret redaction (spec §9.2). Runs over every narrative/outcome string
+ * before a packet is sealed. Secrets never travel: transcripts routinely
+ * contain pasted tokens and tool-echoed env values.
+ */
+export interface RedactionResult {
+    text: string;
+    count: number;
+    rulesHit: string[];
+}
+export declare function redactText(text: string): RedactionResult;
+export interface DeepRedactionResult<T> {
+    value: T;
+    count: number;
+    rulesHit: string[];
+}
+/** Walk any JSON-ish value and redact every string in place (copy-on-write). */
+export declare function redactDeep<T>(value: T): DeepRedactionResult<T>;
+export declare const REDACTION_RULE_IDS: string[];

package/dist/redact.js

@@ -0,0 +1,86 @@
+/**
+ * Secret redaction (spec §9.2). Runs over every narrative/outcome string
+ * before a packet is sealed. Secrets never travel: transcripts routinely
+ * contain pasted tokens and tool-echoed env values.
+ */
+const RULES = [
+    {
+        id: "pem",
+        pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+        replace: () => "[REDACTED:pem]",
+    },
+    {
+        id: "aws-key",
+        pattern: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g,
+        replace: () => "[REDACTED:aws-key]",
+    },
+    {
+        id: "github-token",
+        pattern: /\bgh[pousr]_[A-Za-z0-9]{20,255}\b/g,
+        replace: () => "[REDACTED:github-token]",
+    },
+    {
+        id: "slack-token",
+        pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g,
+        replace: () => "[REDACTED:slack-token]",
+    },
+    {
+        id: "jwt",
+        pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\b/g,
+        replace: () => "[REDACTED:jwt]",
+    },
+    {
+        id: "bearer",
+        pattern: /\b[Bb]earer\s+[A-Za-z0-9._~+/=-]{20,}/g,
+        replace: () => "Bearer [REDACTED:bearer]",
+    },
+    {
+        id: "assignment",
+        // KEY=value / SECRET: "value" style assignments; keeps the name,
+        // redacts the value. Requires a secret-ish name to avoid false hits.
+        pattern: /\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL)[A-Za-z0-9_]*)\s*[=:]\s*['"]?([^\s'"]{8,})['"]?/g,
+        replace: (match) => `${match[1]}=[REDACTED:assignment]`,
+    },
+];
+export function redactText(text) {
+    let out = text;
+    let count = 0;
+    const rulesHit = new Set();
+    for (const rule of RULES) {
+        out = out.replace(rule.pattern, (...args) => {
+            count += 1;
+            rulesHit.add(rule.id);
+            // Rebuild an exec-style array for the replace callback.
+            const match = args.slice(0, -2);
+            return rule.replace(match);
+        });
+    }
+    return { text: out, count, rulesHit: [...rulesHit] };
+}
+/** Walk any JSON-ish value and redact every string in place (copy-on-write). */
+export function redactDeep(value) {
+    let count = 0;
+    const rulesHit = new Set();
+    const walk = (node) => {
+        if (typeof node === "string") {
+            const result = redactText(node);
+            count += result.count;
+            result.rulesHit.forEach((rule) => rulesHit.add(rule));
+            return result.text;
+        }
+        if (Array.isArray(node)) {
+            return node.map(walk);
+        }
+        if (node !== null && typeof node === "object") {
+            const out = {};
+            for (const [key, val] of Object.entries(node)) {
+                out[key] = walk(val);
+            }
+            return out;
+        }
+        return node;
+    };
+    return { value: walk(value), count, rulesHit: [...rulesHit] };
+}
+export const REDACTION_RULE_IDS = RULES.map((rule) => rule.id);
+//# sourceMappingURL=redact.js.map