@stratusagent/agents 0.11.4 → 0.11.6

package/dist/tools/delegate.js

@@ -0,0 +1,223 @@
+import { SENDER_TRUST_METADATA_KEY, sessionTrustOf, sessionWriteTrust, } from '@stratusagent/core';
+import { isDelegateAllowed, suggestedDelegatesEdit } from "../soul.js";
+export const DELEGATE_TOOL_NAME = 'agent.delegate';
+/**
+ * Metadata a delegated sub-session carries: which agent delegated, and the
+ * session at the root of the chain. Written by `agent.delegate` and read by
+ * the gateway's restart sweep, which is why the keys are named here rather
+ * than spelled twice — a sub-session's parent is a turn in some other
+ * process's memory, and after a restart nothing can consume its reply.
+ */
+export const DELEGATED_BY_METADATA_KEY = 'delegatedBy';
+export const ROOT_SESSION_ID_METADATA_KEY = 'rootSessionId';
+export const DELEGATION_DEPTH_METADATA_KEY = 'delegationDepth';
+/**
+ * The segment `agent.delegate` mints into every sub-session's id —
+ * `<parent>:delegate:<agent>:<depth>:<suffix>`. The second half of what
+ * identifies a sub-session, beside the metadata above: the gateway refuses
+ * the metadata keys at its public door, but rows written before it did
+ * cannot be told apart by their metadata alone, and a caller who wrote
+ * `delegatedBy` onto a session of its own would not also have minted an
+ * id in this shape.
+ */
+export const DELEGATED_SESSION_ID_MARKER = ':delegate:';
+/**
+ * Whether this session is a delegated sub-session — one whose reply is
+ * consumed by a parent turn's `agent.delegate` call and by nothing else.
+ * Both halves are required: the metadata `agent.delegate` writes, and the
+ * id shape it mints.
+ */
+export const isDelegatedSession = (session) => typeof session.metadata?.[DELEGATED_BY_METADATA_KEY] === 'string'
+    && session.id.includes(DELEGATED_SESSION_ID_MARKER);
+/**
+ * The id of the session whose `agent.delegate` call started this one, read
+ * off the id shape above — the text before the last marker, since a nested
+ * sub-session embeds its parent's id whole. Undefined for an id that was
+ * not minted that way.
+ */
+export const delegatingSessionIdOf = (sessionId) => {
+    const at = sessionId.lastIndexOf(DELEGATED_SESSION_ID_MARKER);
+    return at > 0 ? sessionId.slice(0, at) : undefined;
+};
+/**
+ * The id of the `agent.delegate` call in `parent` that is still awaiting
+ * `child`, or undefined when none is.
+ *
+ * The one thing about a delegation nothing outside the runner can forge:
+ * a caller can name a session in the sub-session id shape and write the
+ * metadata keys, but only the runner writes assistant tool calls, and only
+ * a delegation in flight leaves one with no result behind it. Matched to
+ * the child and not merely counted, because a parent can be inside one
+ * delegation while an earlier sub-session of its — continued from outside
+ * under a version that kept the markers — is parked on something of its
+ * own. The call names its target and its prompt, and `agent.delegate`
+ * made the prompt the child's first user message. Read against the
+ * transcript order so a re-used call id cannot make a later call look
+ * answered.
+ */
+export const outstandingDelegationFor = (parent, child) => {
+    const firstMessage = child.messages.find((message) => message.role === 'user')?.content;
+    if (firstMessage === undefined) {
+        return undefined;
+    }
+    const answered = new Map();
+    for (const message of parent.messages) {
+        if (message.role === 'tool' && message.toolResult) {
+            answered.set(message.toolResult.callId, (answered.get(message.toolResult.callId) ?? 0) + 1);
+        }
+    }
+    const seen = new Map();
+    for (const message of parent.messages) {
+        if (message.role !== 'assistant' || !message.toolCalls) {
+            continue;
+        }
+        for (const call of message.toolCalls) {
+            const occurrence = (seen.get(call.id) ?? 0) + 1;
+            seen.set(call.id, occurrence);
+            if (call.toolName !== DELEGATE_TOOL_NAME || occurrence <= (answered.get(call.id) ?? 0)) {
+                continue;
+            }
+            const target = typeof call.input.agent === 'string' ? call.input.agent : '';
+            const prompt = typeof call.input.prompt === 'string' ? call.input.prompt.trim() : '';
+            if ((target === child.agent.id || target === child.agent.name) && prompt === firstMessage) {
+                return call.id;
+            }
+        }
+    }
+    return undefined;
+};
+/**
+ * `metadata` with the delegation markers removed — what a sub-session
+ * carries once it has been addressed from outside. The delegation ended
+ * with the turn that awaited it; a conversation somebody continues on the
+ * same id afterwards is an ordinary one, and must not be closed as an
+ * orphan by a later restart.
+ */
+export const withoutDelegation = (metadata) => {
+    const { [DELEGATED_BY_METADATA_KEY]: _delegatedBy, [ROOT_SESSION_ID_METADATA_KEY]: _root, [DELEGATION_DEPTH_METADATA_KEY]: _depth, ...rest } = metadata;
+    return rest;
+};
+const DEFAULT_MAX_DELEGATION_DEPTH = 3;
+/**
+ * The orchestrator primitive: a tool that runs another agent in its own
+ * sub-session (with that agent's memory, tool allowlist, and credentials)
+ * and returns its final reply as the tool result.
+ */
+export const createDelegateTool = ({ registry, runner, dispatch, maxDepth = DEFAULT_MAX_DELEGATION_DEPTH, }) => {
+    const runDelegated = dispatch ?? ((input) => runner.run(input));
+    // Sub-session ids must be unique even when one orchestrator delegates to
+    // the same target repeatedly, and must stay unique across tool rebuilds
+    // sharing one SessionStore — so a counter alone is not enough.
+    let delegationCount = 0;
+    const uniqueSuffix = () => `${delegationCount}-${Math.random().toString(36).slice(2, 10)}`;
+    return {
+        name: DELEGATE_TOOL_NAME,
+        description: 'Delegate a task to another agent by name and get their reply back.',
+        // Safe, and the call is arguable enough to record why. Delegation spends
+        // provider tokens and starts work as another agent, which reads like
+        // `gated` — but the money argument proves too much: the turn that decides
+        // to delegate was itself an unapproved provider call, so gating on spend
+        // gates the conversation. What delegation does NOT do is act outside
+        // Stratus. It stays in the fleet, the delegate's own tool calls face the
+        // policy again under the delegate's allowlist, and maxDepth bounds the
+        // chain.
+        //
+        // The practical half: `gated` here means a headless daemon refuses every
+        // delegation, and headless is what every installed service runs. That
+        // would remove the orchestrator pattern from the product until remote
+        // approval exists — a feature removal wearing a safety hat, with no way
+        // for an operator to say yes. Revisit when a human can actually be asked.
+        risk: 'safe',
+        parameters: {
+            type: 'object',
+            properties: {
+                agent: { type: 'string', description: 'Name or id of the agent to delegate to.' },
+                prompt: { type: 'string', description: 'The task or question for that agent.' },
+            },
+            required: ['agent', 'prompt'],
+        },
+        async execute(input, session, context) {
+            const targetRef = typeof input.agent === 'string' ? input.agent : '';
+            const prompt = typeof input.prompt === 'string' ? input.prompt.trim() : '';
+            if (!targetRef || !prompt) {
+                throw new Error('agent.delegate requires "agent" and "prompt" strings.');
+            }
+            const depth = typeof session.metadata?.[DELEGATION_DEPTH_METADATA_KEY] === 'number'
+                ? session.metadata[DELEGATION_DEPTH_METADATA_KEY]
+                : 0;
+            if (depth >= maxDepth) {
+                throw new Error(`Delegation depth limit reached (${maxDepth}).`);
+            }
+            const target = registry.get(targetRef) ?? registry.getByName(targetRef);
+            if (!target) {
+                throw new Error(`Agent not found: ${targetRef}`);
+            }
+            if (target.id === session.agent.id) {
+                throw new Error('An agent cannot delegate to itself.');
+            }
+            // Judged on the session's frozen copy of the agent, as the tool
+            // allowlist is: the target is model-chosen input, and without this
+            // list any agent holding this tool could run a turn as any other —
+            // under the other's tools, credentials, and memory — which is the
+            // lateral move a prompt-injected agent would take.
+            if (!isDelegateAllowed(session.agent, target.id)) {
+                throw new Error(`Agent ${session.agent.id} may not delegate to ${target.id}. `
+                    + `Add ${suggestedDelegatesEdit(target.id)} to its soul, or delegates: ['*'] for any agent on the roster.`);
+            }
+            delegationCount += 1;
+            let result;
+            try {
+                result = await runDelegated({
+                    sessionId: `${session.id}${DELEGATED_SESSION_ID_MARKER}${target.id}:${depth + 1}:${uniqueSuffix()}`,
+                    agent: target,
+                    userMessage: prompt,
+                    metadata: {
+                        [DELEGATION_DEPTH_METADATA_KEY]: depth + 1,
+                        [DELEGATED_BY_METADATA_KEY]: session.agent.id,
+                        [ROOT_SESSION_ID_METADATA_KEY]: typeof session.metadata?.[ROOT_SESSION_ID_METADATA_KEY] === 'string'
+                            ? session.metadata[ROOT_SESSION_ID_METADATA_KEY]
+                            : session.id,
+                        // Outbound: the prompt is the parent's text, and the parent is its
+                        // "sender" — a tainted parent must not hand attacker text to a
+                        // teammate whose session has seen nothing. At most `agent`: the
+                        // prompt is something an agent wrote, whoever it was talking to.
+                        [SENDER_TRUST_METADATA_KEY]: sessionWriteTrust(session),
+                    },
+                    // A cancelled parent turn cancels the delegated run with it —
+                    // otherwise the parent cannot settle until the target gives up.
+                    ...(context?.signal ? { signal: context.signal } : {}),
+                });
+            }
+            catch (error) {
+                // A failed run has no session to read a label from here, and its
+                // error text is the target's — a provider quoting the request it
+                // refused, which is the target's prompt and injected memory, whatever
+                // label those carried. The parent sees that text as a tool error, so
+                // the call is marked at the label for provenance nobody can vouch
+                // for before it is rethrown. The parent's own cancellation is the
+                // exception: that error is this process's sentence, not the target's.
+                if (!context?.signal?.aborted) {
+                    context?.markTrust?.('unknown');
+                }
+                throw error;
+            }
+            // Inbound: the reply carries the target session's label, whatever it
+            // is — not only `external`. A target whose own injected memory was
+            // `unknown` replies from content the parent never saw and cannot
+            // assess; the parent takes the lower of its own label and this one,
+            // by the same ordering as everything else.
+            const targetTrust = sessionTrustOf(result);
+            context?.markTrust?.(targetTrust);
+            const reply = [...result.messages]
+                .reverse()
+                .find((message) => message.role === 'assistant' && message.content.length > 0);
+            return {
+                agent: target.name,
+                reply: reply?.content ?? '(no reply)',
+                sessionId: result.id,
+                trust: targetTrust,
+            };
+        },
+    };
+};
+//# sourceMappingURL=delegate.js.map

package/dist/tools/delegate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../src/tools/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,yBAAyB,EACzB,cAAc,EACd,iBAAiB,GAMlB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAEvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,iBAAiB,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAyC,EAAW,EAAE,CACvF,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,yBAAyB,CAAC,KAAK,QAAQ;OAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAsB,EAAE;IAC7E,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAC9D,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,MAAiC,EACjC,KAA0C,EACtB,EAAE;IACtB,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC;IACxF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAClD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,kBAAkB,IAAI,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;gBAC1F,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAoB,EAAc,EAAE;IACpE,MAAM,EACJ,CAAC,yBAAyB,CAAC,EAAE,YAAY,EACzC,CAAC,4BAA4B,CAAC,EAAE,KAAK,EACrC,CAAC,6BAA6B,CAAC,EAAE,MAAM,EACvC,GAAG,IAAI,EACR,GAAG,QAAQ,CAAC;IACb,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAuBF,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,EACjC,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,QAAQ,GAAG,4BAA4B,GACnB,EAAQ,EAAE;IAC9B,MAAM,YAAY,GAAqB,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,yEAAyE;IACzE,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,MAAM,YAAY,GAAG,GAAW,EAAE,CAChC,GAAG,eAAe,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAElE,OAAO;QACP,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,oEAAoE;QACjF,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,SAAS;QACT,EAAE;QACF,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,EAAE,MAAM;QACZ,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,yCAAyC,EAAE;gBACjF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,sCAAsC,EAAE;aAChF;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;SAC9B;QACD,KAAK,CAAC,OAAO,CAAC,KAAiB,EAAE,OAAgB,EAAE,OAAO;YACxD,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,6BAA6B,CAAC,KAAK,QAAQ;gBACjF,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,6BAA6B,CAAC;gBACjD,CAAC,CAAC,CAAC,CAAC;YACN,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,IAAI,CAAC,CAAC;YACnE,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,CAAC;YACD,gEAAgE;YAChE,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,mDAAmD;YACnD,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,CAAC,KAAK,CAAC,EAAE,wBAAwB,MAAM,CAAC,EAAE,IAAI;sBAC5D,OAAO,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,gEAAgE,CAC3G,CAAC;YACJ,CAAC;YAED,eAAe,IAAI,CAAC,CAAC;YACrB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,YAAY,CAAC;oBAC5B,SAAS,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,2BAA2B,GAAG,MAAM,CAAC,EAAE,IAAI,KAAK,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE;oBACnG,KAAK,EAAE,MAAM;oBACb,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE;wBACR,CAAC,6BAA6B,CAAC,EAAE,KAAK,GAAG,CAAC;wBAC1C,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;wBAC7C,CAAC,4BAA4B,CAAC,EAAE,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC,4BAA4B,CAAC,KAAK,QAAQ;4BAClG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;4BAChD,CAAC,CAAC,OAAO,CAAC,EAAE;wBACd,mEAAmE;wBACnE,+DAA+D;wBAC/D,gEAAgE;wBAChE,iEAAiE;wBACjE,CAAC,yBAAyB,CAAC,EAAE,iBAAiB,CAAC,OAAO,CAAC;qBACxD;oBACD,8DAA8D;oBAC9D,gEAAgE;oBAChE,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrD,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iEAAiE;gBACjE,iEAAiE;gBACjE,sEAAsE;gBACtE,qEAAqE;gBACrE,kEAAkE;gBAClE,kEAAkE;gBAClE,sEAAsE;gBACtE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;oBAC9B,OAAO,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAED,qEAAqE;YACrE,mEAAmE;YACnE,iEAAiE;YACjE,oEAAoE;YACpE,2CAA2C;YAC3C,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YAC3C,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YAElC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC;iBAC/B,OAAO,EAAE;iBACT,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAEjF,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,IAAI;gBAClB,KAAK,EAAE,KAAK,EAAE,OAAO,IAAI,YAAY;gBACrC,SAAS,EAAE,MAAM,CAAC,EAAE;gBACpB,KAAK,EAAE,WAAW;aACnB,CAAC;QACJ,CAAC;KACA,CAAC;AACJ,CAAC,CAAC"}

package/dist/tools/gateway-only.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The tools only a running gateway registers. Each needs the dispatcher,
+ * the store, or the channels, and nothing else in the tree has them — so a
+ * soul naming one is correct while a host without them cannot call it,
+ * which is a different thing from a name that does not exist. `stratus
+ * run` reads this to say which it is rather than reporting a daemon soul's
+ * `schedule.*` as a typo.
+ *
+ * It lives here, with the names, rather than in `@stratusagent/gateway`
+ * where the registrations are: the CLI imports the gateway only through
+ * `await import`, because `bin.ts` has to load the CLI to print the Node
+ * version message and the gateway pulls in `node:sqlite` at module scope.
+ * A static import for a list of strings would have made the floor guard
+ * fail with the exact builtin-module error it exists to replace. The
+ * gateway's own test pins this set against what it actually registers,
+ * which holds the two together better than proximity would.
+ */
+export declare const GATEWAY_ONLY_TOOL_NAMES: readonly string[];
+//# sourceMappingURL=gateway-only.d.ts.map

package/dist/tools/gateway-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-only.d.ts","sourceRoot":"","sources":["../../src/tools/gateway-only.ts"],"names":[],"mappings":"AASA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAOpD,CAAC"}

package/dist/tools/gateway-only.js

@@ -0,0 +1,29 @@
+import { DELEGATE_TOOL_NAME } from "./delegate.js";
+import { MESSAGE_SEND_TOOL_NAME } from "./message.js";
+import { SCHEDULE_EVERY_TOOL_NAME, SCHEDULE_AT_TOOL_NAME, SCHEDULE_LIST_TOOL_NAME, SCHEDULE_CANCEL_TOOL_NAME, } from "./schedule.js";
+/**
+ * The tools only a running gateway registers. Each needs the dispatcher,
+ * the store, or the channels, and nothing else in the tree has them — so a
+ * soul naming one is correct while a host without them cannot call it,
+ * which is a different thing from a name that does not exist. `stratus
+ * run` reads this to say which it is rather than reporting a daemon soul's
+ * `schedule.*` as a typo.
+ *
+ * It lives here, with the names, rather than in `@stratusagent/gateway`
+ * where the registrations are: the CLI imports the gateway only through
+ * `await import`, because `bin.ts` has to load the CLI to print the Node
+ * version message and the gateway pulls in `node:sqlite` at module scope.
+ * A static import for a list of strings would have made the floor guard
+ * fail with the exact builtin-module error it exists to replace. The
+ * gateway's own test pins this set against what it actually registers,
+ * which holds the two together better than proximity would.
+ */
+export const GATEWAY_ONLY_TOOL_NAMES = [
+    SCHEDULE_EVERY_TOOL_NAME,
+    SCHEDULE_AT_TOOL_NAME,
+    SCHEDULE_LIST_TOOL_NAME,
+    SCHEDULE_CANCEL_TOOL_NAME,
+    MESSAGE_SEND_TOOL_NAME,
+    DELEGATE_TOOL_NAME,
+];
+//# sourceMappingURL=gateway-only.js.map

package/dist/tools/gateway-only.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-only.js","sourceRoot":"","sources":["../../src/tools/gateway-only.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,wBAAwB;IACxB,qBAAqB;IACrB,uBAAuB;IACvB,yBAAyB;IACzB,sBAAsB;IACtB,kBAAkB;CACnB,CAAC"}

package/dist/tools/memory.d.ts

@@ -0,0 +1,51 @@
+import { type AgentMemoryStore, type Tool } from '@stratusagent/core';
+/** Test seam shared by every memory tool that has to decide what is true *now*. */
+export interface MemoryToolOptions {
+    now?: () => Date;
+}
+export declare const MEMORY_TOOL_NAME = "memory.remember";
+/**
+ * A tool that lets an agent write to its own long-term memory. Entries are
+ * keyed by the session's agent id, so what one agent learns stays exclusively
+ * that agent's knowledge — and follows it to every channel and thread.
+ *
+ * Everything past `fact` is optional, and the reason they are the model's to
+ * write rather than extracted afterwards is that the party writing the fact
+ * is the one that knows what it is about, when it stops being true, and
+ * which older belief it replaces. Extraction would be a knowledge graph
+ * arriving through a side door.
+ */
+export declare const createRememberTool: (store: AgentMemoryStore) => Tool;
+/** The kernel owns the name — the prompt's topic index points the agent at it. */
+export declare const RECALL_TOOL_NAME = "memory.recall";
+/**
+ * Searches the agent's own long-term memory. `safe` by the same rule as
+ * `memory.remember`: reading what this agent already knows. The query is
+ * literal text — the store does whatever escaping its backend needs, so no
+ * query a model writes is ever a syntax error; matching nothing is a normal
+ * result, because an agent that has learned nothing yet is the ordinary
+ * starting state, not a broken tool.
+ */
+export declare const createRecallTool: (store: AgentMemoryStore, options?: MemoryToolOptions) => Tool;
+export declare const FORGET_TOOL_NAME = "memory.forget";
+/**
+ * Retires one of the agent's own memories, by id. Tombstoned rather than
+ * deleted — which is what makes `safe` defensible for it: the entry stops
+ * being live but does not stop existing, so an operator can still see what
+ * an agent chose to drop.
+ */
+export declare const createForgetTool: (store: AgentMemoryStore) => Tool;
+export declare const PIN_TOOL_NAME = "memory.pin";
+/**
+ * Pins one of the agent's own facts into the core its prompt always
+ * carries. `safe` by the rule that already covers `remember` and `forget`:
+ * the agent's own notes, appended rather than destroyed, keyed to the
+ * agent — a pin is a record naming an entry, never a field written onto
+ * one, because a toggle on an append-only line is a rewrite.
+ *
+ * The cap refuses rather than evicts, and the refusal is a normal result
+ * rather than a thrown error: nothing went wrong, the budget is full, and
+ * the agent's next move is to unpin something.
+ */
+export declare const createPinTool: (store: AgentMemoryStore) => Tool;
+//# sourceMappingURL=memory.d.ts.map

package/dist/tools/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/tools/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAUL,KAAK,gBAAgB,EAKrB,KAAK,IAAI,EACV,MAAM,oBAAoB,CAAC;AAE5B,mFAAmF;AACnF,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAiFD,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,gBAAgB,KAAG,IA4E3D,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,kBAA0B,CAAC;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,gBAAgB,EAAE,UAAS,iBAAsB,KAAG,IAoD3F,CAAC;AAEF,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,gBAAgB,KAAG,IAsBzD,CAAC;AAEH,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,GAAI,OAAO,gBAAgB,KAAG,IAsCtD,CAAC"}

package/dist/tools/memory.js

@@ -0,0 +1,306 @@
+import { isMemoryEntryKind, isTaintedTrust, leastTrusted, MEMORY_ENTRY_KINDS, MEMORY_RECALL_TOOL_NAME, memoryEntryTrust, memoryValidityAt, sessionTaintedBy, sessionWriteTrust, } from '@stratusagent/core';
+const clockOf = (options) => options.now ?? (() => new Date());
+/** A trimmed string, or undefined — the shape every optional string parameter here reads as. */
+const optionalString = (value) => {
+    if (typeof value !== 'string') {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+};
+/**
+ * ISO-8601, and checked as ISO-8601 rather than as whatever `Date.parse`
+ * will take. `Date.parse` accepts `04/01/2026` and `1` and gives each an
+ * interpretation — one of them locale-shaped and one of them a year — so
+ * parsing alone would quietly store a different window than the model
+ * meant, and the fact would enter or leave the prompt on the wrong day.
+ * A bound that silently failed to parse is the same hazard running the
+ * other way: the fact reads as unbounded and outlives the thing it was
+ * about. So the shape is asserted first, then the value.
+ */
+// A date alone is UTC midnight by specification, so it is unambiguous
+// wherever the daemon runs. A *time* without an offset is not: it reads as
+// the host's local zone, so the same requested bound would become a
+// different instant in Los Angeles than in UTC, and a fact would activate
+// or expire at a deployment-dependent hour. So the offset is required
+// whenever a time is given.
+const ISO_8601_INSTANT = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2}))?$/;
+/**
+ * Whether the `YYYY-MM-DD` a bound opens with is a day that exists.
+ *
+ * `Date.parse` normalizes rather than refusing: `2026-02-30` parses fine and
+ * becomes March 2nd, and `2026-02-29` becomes March 1st in a non-leap year.
+ * The regex cannot see it either — both are ISO-*shaped*. A validity window
+ * is the field where that matters most and shows least: the fact starts or
+ * stops being true days from where the writer asked, and the record says
+ * only what it was normalized to.
+ *
+ * Checked on the calendar components as written, never by comparing the
+ * normalized instant back to the string — that was the first attempt at
+ * this and it rejected `2026-04-01T23:00:00-05:00`, whose UTC date is
+ * legitimately the 2nd. An offset is allowed to move the day; February 30th
+ * is not a day.
+ *
+ * `setUTCFullYear` rather than `Date.UTC`, which maps a two-digit year into
+ * the 1900s — the regex admits `0026-02-28`, and that is a real date.
+ */
+const isRealCalendarDate = (raw) => {
+    const [year, month, day] = raw.slice(0, 10).split('-').map(Number);
+    const probe = new Date(0);
+    probe.setUTCFullYear(year, month - 1, day);
+    return probe.getUTCFullYear() === year && probe.getUTCMonth() === month - 1 && probe.getUTCDate() === day;
+};
+const validityBound = (value, field) => {
+    const raw = optionalString(value);
+    if (raw === undefined) {
+        return undefined;
+    }
+    const parsed = Date.parse(raw);
+    if (!ISO_8601_INSTANT.test(raw) || Number.isNaN(parsed) || !isRealCalendarDate(raw)) {
+        throw new Error(`${field} must be an ISO-8601 instant such as 2026-04-01 or 2026-04-01T00:00:00Z — a time needs Z or an offset, `
+            + `or it means something different on every machine. ${raw} is not one, and nothing was stored.`);
+    }
+    return new Date(parsed).toISOString();
+};
+const aboutKeys = (value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value) || value.some((key) => typeof key !== 'string')) {
+        throw new Error('"about" must be an array of entity names, as plain strings. Nothing was stored.');
+    }
+    const keys = value.map((key) => key.trim()).filter((key) => key.length > 0);
+    return keys.length > 0 ? keys : undefined;
+};
+export const MEMORY_TOOL_NAME = 'memory.remember';
+/**
+ * A tool that lets an agent write to its own long-term memory. Entries are
+ * keyed by the session's agent id, so what one agent learns stays exclusively
+ * that agent's knowledge — and follows it to every channel and thread.
+ *
+ * Everything past `fact` is optional, and the reason they are the model's to
+ * write rather than extracted afterwards is that the party writing the fact
+ * is the one that knows what it is about, when it stops being true, and
+ * which older belief it replaces. Extraction would be a knowledge graph
+ * arriving through a side door.
+ */
+export const createRememberTool = (store) => ({
+    name: MEMORY_TOOL_NAME,
+    description: 'Save a fact to your long-term memory so you can recall it in future conversations on any channel.',
+    // The agent's own memory, keyed to the agent and read by nobody else.
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            fact: { type: 'string', description: 'The fact to remember, phrased so it makes sense later without context.' },
+            kind: {
+                type: 'string',
+                enum: [...MEMORY_ENTRY_KINDS],
+                description: 'What sort of fact this is: semantic (about the world), episodic (something that happened), procedural (how something is done), or preference.',
+            },
+            about: {
+                type: 'array',
+                items: { type: 'string' },
+                description: 'The people, systems, or projects this fact concerns. These are how you will find it later, so include the names you would search for — aliases included.',
+            },
+            validFrom: { type: 'string', description: 'ISO-8601 instant this becomes true, if it is not true yet. Optional.' },
+            validUntil: { type: 'string', description: 'ISO-8601 instant this stops being true, if you know one. Optional.' },
+            supersedes: {
+                type: 'string',
+                description: 'The id of a fact of yours this one replaces (from memory.recall). The old fact stops informing you once this one is in force, and stays visible to your operator.',
+            },
+        },
+        required: ['fact'],
+    },
+    async execute(input, session) {
+        const fact = typeof input.fact === 'string' ? input.fact.trim() : '';
+        if (!fact) {
+            throw new Error('memory.remember requires a non-empty "fact" string.');
+        }
+        if (input.kind !== undefined && !isMemoryEntryKind(input.kind)) {
+            throw new Error(`"kind" must be one of ${MEMORY_ENTRY_KINDS.join(', ')}. Nothing was stored.`);
+        }
+        // Per session, not per fact: the runner knows this session has seen
+        // untrusted content and cannot know which words of the fact came from
+        // it, so the write carries the least trusted label the session holds.
+        // Coarse and over-marking — the safe direction.
+        const taintedBy = sessionTaintedBy(session);
+        const origin = { sessionId: session.id, ...(taintedBy !== undefined ? { taintedBy } : {}) };
+        const about = aboutKeys(input.about);
+        const validFrom = validityBound(input.validFrom, 'validFrom');
+        const validUntil = validityBound(input.validUntil, 'validUntil');
+        // A window that closes before it opens describes nothing: the entry is
+        // not-yet-valid before `validFrom` and expired after it, so it could
+        // never be true and would never reach a prompt — stored, findable, and
+        // silently inert. The record tolerates whatever a hand edit or an
+        // import puts there; what a model writes is checked here.
+        if (validFrom !== undefined && validUntil !== undefined && Date.parse(validFrom) >= Date.parse(validUntil)) {
+            throw new Error(`validUntil (${validUntil}) must be after validFrom (${validFrom}); a fact whose window closes before it opens is never true. Nothing was stored.`);
+        }
+        const supersedes = optionalString(input.supersedes);
+        const options = {
+            metadata: { sessionId: session.id },
+            provenance: { trust: sessionWriteTrust(session), origin },
+            ...(input.kind !== undefined ? { kind: input.kind } : {}),
+            ...(about !== undefined ? { about } : {}),
+            ...(validFrom !== undefined ? { validFrom } : {}),
+            ...(validUntil !== undefined ? { validUntil } : {}),
+            ...(supersedes !== undefined ? { supersedes } : {}),
+        };
+        // The store resolves `supersedes` against this agent's own live entries
+        // and throws before appending anything, so naming a stranger's id is a
+        // failed call rather than a retirement.
+        const entry = await store.append(session.agent.id, fact, options);
+        return {
+            remembered: true,
+            id: entry.id,
+            trust: memoryEntryTrust(entry),
+            ...(supersedes !== undefined ? { supersedes } : {}),
+        };
+    },
+});
+/** The kernel owns the name — the prompt's topic index points the agent at it. */
+export const RECALL_TOOL_NAME = MEMORY_RECALL_TOOL_NAME;
+/**
+ * Searches the agent's own long-term memory. `safe` by the same rule as
+ * `memory.remember`: reading what this agent already knows. The query is
+ * literal text — the store does whatever escaping its backend needs, so no
+ * query a model writes is ever a syntax error; matching nothing is a normal
+ * result, because an agent that has learned nothing yet is the ordinary
+ * starting state, not a broken tool.
+ */
+export const createRecallTool = (store, options = {}) => {
+    const now = clockOf(options);
+    return {
+        name: RECALL_TOOL_NAME,
+        description: 'Search your long-term memory for facts you have remembered. Your prompt carries only the pinned facts and a short recent tail — use this to find everything else, including facts that have expired.',
+        risk: 'safe',
+        parameters: {
+            type: 'object',
+            properties: {
+                query: { type: 'string', description: 'What to look for, as plain words. Every word must appear in a fact — or in what the fact is about — for it to match.' },
+                limit: { type: 'number', description: 'Maximum facts to return. Optional; the store bounds it either way.' },
+            },
+            required: ['query'],
+        },
+        async execute(input, session, context) {
+            if (typeof input.query !== 'string') {
+                throw new Error('memory.recall requires a "query" string.');
+            }
+            const limit = typeof input.limit === 'number' ? input.limit : undefined;
+            const result = await store.search(session.agent.id, input.query, { ...(limit !== undefined ? { limit } : {}) });
+            // What enters the context taints the session, recalled as much as
+            // injected: an `external` entry surfacing here is a stranger's text
+            // in the prompt, and marking the call is what stops the store from
+            // laundering its own contents through a fresh session.
+            const lowest = leastTrusted(...result.entries.map(memoryEntryTrust));
+            if (isTaintedTrust(lowest)) {
+                context?.markTrust?.(lowest);
+            }
+            const at = now();
+            return {
+                results: result.entries.map((entry) => ({
+                    id: entry.id,
+                    content: entry.content,
+                    createdAt: entry.createdAt,
+                    trust: memoryEntryTrust(entry),
+                    // Search keeps an out-of-window entry findable, which is right —
+                    // returning it *unmarked* is not: an expired fact that reads
+                    // exactly like a current one is the confusion `validFrom` and
+                    // `validUntil` exist to prevent, arriving through the other door.
+                    validity: memoryValidityAt(entry, at),
+                    ...(entry.about ? { about: entry.about } : {}),
+                    ...(entry.kind ? { kind: entry.kind } : {}),
+                    ...(entry.validFrom ? { validFrom: entry.validFrom } : {}),
+                    ...(entry.validUntil ? { validUntil: entry.validUntil } : {}),
+                })),
+                truncated: result.truncated,
+                // The ordering the store actually applied, which is not always the
+                // one asked for — see `MemoryRankingStrategy`.
+                ...(result.strategy !== undefined ? { strategy: result.strategy } : {}),
+            };
+        },
+    };
+};
+export const FORGET_TOOL_NAME = 'memory.forget';
+/**
+ * Retires one of the agent's own memories, by id. Tombstoned rather than
+ * deleted — which is what makes `safe` defensible for it: the entry stops
+ * being live but does not stop existing, so an operator can still see what
+ * an agent chose to drop.
+ */
+export const createForgetTool = (store) => ({
+    name: FORGET_TOOL_NAME,
+    description: 'Forget one of your remembered facts by its id (from memory.recall or memory.remember). It stops informing future conversations.',
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            id: { type: 'string', description: 'The id of the memory entry to forget.' },
+        },
+        required: ['id'],
+    },
+    async execute(input, session) {
+        const id = typeof input.id === 'string' ? input.id.trim() : '';
+        if (!id) {
+            throw new Error('memory.forget requires a non-empty "id" string.');
+        }
+        const forgotten = await store.forget(session.agent.id, id);
+        if (!forgotten) {
+            throw new Error(`No live memory entry with id ${id} belongs to this agent — nothing was forgotten.`);
+        }
+        return { forgotten: true, id };
+    },
+});
+export const PIN_TOOL_NAME = 'memory.pin';
+/**
+ * Pins one of the agent's own facts into the core its prompt always
+ * carries. `safe` by the rule that already covers `remember` and `forget`:
+ * the agent's own notes, appended rather than destroyed, keyed to the
+ * agent — a pin is a record naming an entry, never a field written onto
+ * one, because a toggle on an append-only line is a rewrite.
+ *
+ * The cap refuses rather than evicts, and the refusal is a normal result
+ * rather than a thrown error: nothing went wrong, the budget is full, and
+ * the agent's next move is to unpin something.
+ */
+export const createPinTool = (store) => ({
+    name: PIN_TOOL_NAME,
+    description: 'Keep one of your remembered facts in front of you every turn. The pinned set is small and capped — pin only what you always need.',
+    risk: 'safe',
+    parameters: {
+        type: 'object',
+        properties: {
+            id: { type: 'string', description: 'The id of the memory entry to pin.' },
+            unpin: { type: 'boolean', description: 'Pass true to remove an existing pin instead of adding one.' },
+        },
+        required: ['id'],
+    },
+    async execute(input, session) {
+        const id = typeof input.id === 'string' ? input.id.trim() : '';
+        if (!id) {
+            throw new Error('memory.pin requires a non-empty "id" string.');
+        }
+        if (input.unpin === true) {
+            if (!store.unpin) {
+                throw new Error('This memory store does not support pinning, so there was nothing to unpin.');
+            }
+            const unpinned = await store.unpin(session.agent.id, id);
+            if (!unpinned) {
+                throw new Error(`No pin of yours names id ${id} — nothing was unpinned.`);
+            }
+            return { pinned: false, id };
+        }
+        if (!store.pin) {
+            throw new Error('This memory store does not support pinning.');
+        }
+        const outcome = await store.pin(session.agent.id, id);
+        return {
+            pinned: outcome.pinned,
+            id,
+            bytes: outcome.bytes,
+            ...(outcome.reason !== undefined ? { reason: outcome.reason } : {}),
+        };
+    },
+});
+//# sourceMappingURL=memory.js.map