@tpsdev-ai/adk-flair 0.44.9 → 0.44.10

package/dist/index.d.ts

@@ -4,6 +4,6 @@
  * @packageDocumentation
  */
 export { FlairMemoryService } from "./memory_service.js";
-export { compoundTag, sanitizeTagSegment } from "./tag.js";
+export { compoundTag, sanitizeTagSegment, desanitizeTagSegment } from "./tag.js";
 export { loadEd25519Key, signRequest } from "./signing.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -4,6 +4,6 @@
  * @packageDocumentation
  */
 export { FlairMemoryService } from "./memory_service.js";
-export { compoundTag, sanitizeTagSegment } from "./tag.js";
+export { compoundTag, sanitizeTagSegment, desanitizeTagSegment } from "./tag.js";
 export { loadEd25519Key, signRequest } from "./signing.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/tag.d.ts

@@ -2,14 +2,32 @@
  * Compound tag helpers for adk-flair.
  *
  * Builds the `adk:<app_name>:<user_id>` compound tag used for per-user
- * scoping in Flair. Colons in segments are replaced with underscores to
- * prevent delimiter breakage.
+ * scoping in Flair. Reserved characters in segments are percent-encoded so
+ * distinct inputs never collide and the `:` delimiter stays unambiguous.
  */
 /**
- * Sanitize a tag segment by replacing colons with underscores.
- * A colon in a segment would break the compound tag delimiter.
+ * Percent-encode the reserved characters in a tag segment so distinct inputs
+ * never collide and the compound-tag delimiter ':' stays unambiguous.
+ *
+ * The old scheme replaced ':' -> '_', which COLLIDED: userId="alice:admin"
+ * and userId="alice_admin" both sanitized to "alice_admin" — one tag for two
+ * distinct identities. Because the compound tag is the per-user access-control
+ * boundary (ADK session distillation, #1205), that collision is a cross-user
+ * contamination bug. Mirrors the Python fix in
+ * packages/adk-flair/src/adk_flair/memory_service.py.
+ *
+ * This encoding is reversible and collision-free. '%' is escaped FIRST so it
+ * can introduce escapes, then ':' (the delimiter) and '_' (the old escape
+ * char). Because every escape starts with an already-escaped '%', no input can
+ * forge another input's encoding — see desanitizeTagSegment for the inverse.
  */
 export declare function sanitizeTagSegment(segment: string): string;
+/**
+ * Inverse of sanitizeTagSegment. '%25' is decoded LAST so a literal '%3A' in
+ * the original input (which encoded to '%253A') is not mistaken for an encoded
+ * ':'. Round-trips exactly: desanitizeTagSegment(sanitizeTagSegment(x)) === x.
+ */
+export declare function desanitizeTagSegment(segment: string): string;
 /**
  * Build the compound tag `adk:<app_name>:<user_id>`.
  * Both segments are sanitized to prevent delimiter breakage.

package/dist/tag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnE"}
+{"version":3,"file":"tag.d.ts","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnE"}

package/dist/tag.js

@@ -2,16 +2,42 @@
  * Compound tag helpers for adk-flair.
  *
  * Builds the `adk:<app_name>:<user_id>` compound tag used for per-user
- * scoping in Flair. Colons in segments are replaced with underscores to
- * prevent delimiter breakage.
+ * scoping in Flair. Reserved characters in segments are percent-encoded so
+ * distinct inputs never collide and the `:` delimiter stays unambiguous.
  */
 const TAG_PREFIX = "adk";
 /**
- * Sanitize a tag segment by replacing colons with underscores.
- * A colon in a segment would break the compound tag delimiter.
+ * Percent-encode the reserved characters in a tag segment so distinct inputs
+ * never collide and the compound-tag delimiter ':' stays unambiguous.
+ *
+ * The old scheme replaced ':' -> '_', which COLLIDED: userId="alice:admin"
+ * and userId="alice_admin" both sanitized to "alice_admin" — one tag for two
+ * distinct identities. Because the compound tag is the per-user access-control
+ * boundary (ADK session distillation, #1205), that collision is a cross-user
+ * contamination bug. Mirrors the Python fix in
+ * packages/adk-flair/src/adk_flair/memory_service.py.
+ *
+ * This encoding is reversible and collision-free. '%' is escaped FIRST so it
+ * can introduce escapes, then ':' (the delimiter) and '_' (the old escape
+ * char). Because every escape starts with an already-escaped '%', no input can
+ * forge another input's encoding — see desanitizeTagSegment for the inverse.
  */
 export function sanitizeTagSegment(segment) {
-    return segment.replace(/:/g, "_");
+    return segment
+        .replace(/%/g, "%25")
+        .replace(/:/g, "%3A")
+        .replace(/_/g, "%5F");
+}
+/**
+ * Inverse of sanitizeTagSegment. '%25' is decoded LAST so a literal '%3A' in
+ * the original input (which encoded to '%253A') is not mistaken for an encoded
+ * ':'. Round-trips exactly: desanitizeTagSegment(sanitizeTagSegment(x)) === x.
+ */
+export function desanitizeTagSegment(segment) {
+    return segment
+        .replace(/%3A/g, ":")
+        .replace(/%5F/g, "_")
+        .replace(/%25/g, "%");
 }
 /**
  * Build the compound tag `adk:<app_name>:<user_id>`.

package/dist/tag.js.map

@@ -1 +1 @@
-{"version":3,"file":"tag.js","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,OAAO,GAAG,UAAU,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"tag.js","sourceRoot":"","sources":["../src/tag.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,UAAU,GAAG,KAAK,CAAC;AAEzB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,OAAO;SACX,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,OAAO;SACX,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,OAAO,GAAG,UAAU,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;AACtF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/adk-flair",
-  "version": "0.44.9",
+  "version": "0.44.10",
   "description": "Flair memory backend for Google ADK — self-hosted, federated, portable agent memory",
   "type": "module",
   "main": "dist/index.js",