common-memory-core 0.2.0

package/dist/config/config.js

@@ -0,0 +1,193 @@
+import { SESSION_CACHE_DEFAULTS } from '../v2/session.js';
+import { randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fsyncFile, persistDirectory } from "../core/transaction/fsync.js";
+import { validateDisclosurePolicy } from "../memory-manager/contracts/disclosure.js";
+import { normalizeOpenAICompatibleBaseUrl } from "../memory-manager/openai/openai-responses-adapter.js";
+import { validateRemoteTuning } from "../memory-manager/openai/options.js";
+import { loadLegacyEnv, privateAssignment } from "./private-env.js";
+import { validateProxyConfig, validateCaEnv, PRIVATE_NETWORK_KEYS } from "../memory-manager/network/route.js";
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const PROVENANCE = new Set(["user_explicit", "agent_observation", "document_import", "conversation_context"]);
+export function configDirectory(env = process.env) {
+    return resolve(env.COMMON_MEMORY_HOME?.trim() || join(homedir(), ".common-memory"));
+}
+export function configFilePath(env = process.env) {
+    return join(configDirectory(env), "config.json");
+}
+export function envFilePath(env = process.env) {
+    return join(configDirectory(env), ".env");
+}
+export function defaultConfig(env = process.env) {
+    const directory = configDirectory(env);
+    return {
+        schemaVersion: 2,
+        dataRoot: join(directory, "data"),
+        remote: {
+            provider: "openai-compatible",
+            baseUrl: "https://api.openai.com/v1",
+            model: "",
+            proxy: { mode: "env" },
+            apiKeyEnv: "OPENAI_API_KEY",
+        },
+        sessionCache: { ...SESSION_CACHE_DEFAULTS },
+        writableScopes: ["global"],
+        scheduler: { turnThreshold: 6, byteThreshold: 16384, idleMs: 120000, maxWaitMs: 600000, leaseMs: 120000, maxAttempts: 5 },
+        disclosure: {
+            enabled: true,
+            allowedScopes: ["global"],
+            allowedProvenance: ["user_explicit"],
+            maxExcerptBytes: 131_072,
+            maxCandidateBytes: 131_072,
+            maxTotalBytes: 131_072,
+        },
+    };
+}
+export function loadConfig(path = configFilePath()) {
+    if (!existsSync(path))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        throw new TypeError(`Invalid Common Memory config: ${path}`);
+    }
+    return validateConfig(parsed);
+}
+export function saveConfig(config, path = configFilePath()) {
+    const validated = validateConfig(config);
+    writePrivateFile(path, `${JSON.stringify(validated, null, 2)}\n`);
+}
+export function saveApiKeyToEnvFile(apiKeyEnv, apiKey, path = envFilePath()) {
+    const name = apiKeyEnv.trim();
+    const value = apiKey.trim();
+    if (!ENV_NAME.test(name))
+        throw new TypeError("apiKeyEnv must be an environment variable name");
+    if (!value || /[\r\n\0]/u.test(value))
+        throw new TypeError("API key must be a non-empty single line");
+    const lines = existsSync(path) ? readFileSync(path, "utf8").split(/\r?\n/u) : [];
+    // dotenv is not JSON: JSON escaping changes backslashes and quoted credentials.
+    let assignment;
+    try {
+        assignment = privateAssignment(name, value);
+    }
+    catch {
+        throw new TypeError('API key cannot be represented safely in a private .env; use an external environment variable instead');
+    }
+    const matcher = new RegExp(`^\\s*(?:export\\s+)?${escapeRegExp(name)}\\s*=`, "u");
+    let replaced = false;
+    const next = lines.filter((line, index) => index < lines.length - 1 || line !== "").map((line) => { if (!matcher.test(line))
+        return line; if (replaced)
+        return null; replaced = true; return assignment; }).filter((line) => line !== null);
+    if (!replaced)
+        next.push(assignment);
+    writePrivateFile(path, `${next.join("\n")}\n`);
+}
+export function loadLocalEnv(path = envFilePath()) {
+    loadLegacyEnv(path);
+}
+export function resolveApiKey(config, env = process.env) {
+    const value = env[config.remote.apiKeyEnv]?.trim();
+    if (!value)
+        throw new TypeError(`API key environment variable ${config.remote.apiKeyEnv} is not set`);
+    return value;
+}
+export function validateConfig(value) {
+    if (!isRecord(value) || !hasRequiredAndOptionalKeys(value, ["schemaVersion", "dataRoot", "remote", "disclosure", "writableScopes", "scheduler"], ["sessionCache"]) || value.schemaVersion !== 2)
+        throw new TypeError("Unsupported Common Memory config");
+    if (typeof value.dataRoot !== "string" || !isAbsolute(value.dataRoot))
+        throw new TypeError("dataRoot must be an absolute path");
+    if (!isRecord(value.remote) || !hasRequiredAndOptionalKeys(value.remote, ["provider", "baseUrl", "model", "apiKeyEnv"], ["api", "maxOutputTokens", "reasoningEffort", "thinking", "enableThinking", "proxy", "caFileEnv"]) || value.remote.provider !== "openai-compatible")
+        throw new TypeError("Invalid remote provider config");
+    const api = value.remote.api === undefined ? "responses" : value.remote.api;
+    if (api !== "responses" && api !== "chat_completions")
+        throw new TypeError("remote.api must be responses or chat_completions");
+    const proxy = value.remote.proxy === undefined ? undefined : validateProxyConfig(value.remote.proxy);
+    const caFileEnv = value.remote.caFileEnv === undefined ? undefined : validateCaEnv(value.remote.caFileEnv);
+    if (caFileEnv !== undefined && proxy === undefined)
+        throw new TypeError("CA configuration requires an explicit network mode");
+    const tuning = validateRemoteTuning(value.remote, api);
+    const baseUrl = typeof value.remote.baseUrl === "string" ? normalizeOpenAICompatibleBaseUrl(value.remote.baseUrl) : "";
+    const model = typeof value.remote.model === "string" ? value.remote.model.trim() : "";
+    const apiKeyEnv = typeof value.remote.apiKeyEnv === "string" ? value.remote.apiKeyEnv.trim() : "";
+    if (!model)
+        throw new TypeError("remote.model is required");
+    if (!ENV_NAME.test(apiKeyEnv))
+        throw new TypeError("remote.apiKeyEnv must be an environment variable name");
+    if (!isRecord(value.disclosure) || !hasExactKeys(value.disclosure, ["enabled", "allowedScopes", "allowedProvenance", "maxExcerptBytes", "maxCandidateBytes", "maxTotalBytes"]))
+        throw new TypeError("Invalid disclosure config");
+    const disclosure = value.disclosure;
+    validateDisclosurePolicy(disclosure);
+    if (disclosure.allowedScopes.length === 0 || disclosure.allowedScopes.some((scope) => typeof scope !== "string" || !scope.trim()))
+        throw new TypeError("At least one disclosure scope is required");
+    if (disclosure.allowedProvenance.length === 0 || disclosure.allowedProvenance.some((item) => !PROVENANCE.has(item)))
+        throw new TypeError("Invalid disclosure provenance");
+    if (!Array.isArray(value.writableScopes) || value.writableScopes.some((scope) => typeof scope !== "string" || !/^(global|project:[A-Za-z0-9_-]+)$/u.test(scope)))
+        throw new TypeError("Invalid writable scopes");
+    const schedulerKeys = ["turnThreshold", "byteThreshold", "idleMs", "maxWaitMs", "leaseMs", "maxAttempts"];
+    if (!isRecord(value.scheduler) || !hasExactKeys(value.scheduler, schedulerKeys) || Object.values(value.scheduler).some((cap) => !Number.isSafeInteger(cap) || Number(cap) <= 0))
+        throw new TypeError("Invalid scheduler limits");
+    if (value.sessionCache !== undefined && (!isRecord(value.sessionCache) || Object.entries(value.sessionCache).some(([key, n]) => !Object.hasOwn(SESSION_CACHE_DEFAULTS, key) || !Number.isSafeInteger(n) || Number(n) < (key === 'contextTailTurns' ? 0 : 1))))
+        throw new TypeError('Invalid session cache limits');
+    return {
+        ...(value.sessionCache === undefined ? {} : { sessionCache: { ...value.sessionCache } }),
+        schemaVersion: 2,
+        writableScopes: [...value.writableScopes],
+        scheduler: { ...value.scheduler },
+        dataRoot: resolve(value.dataRoot),
+        remote: { provider: "openai-compatible", baseUrl, model, apiKeyEnv, ...(value.remote.api === undefined ? {} : { api }), ...tuning, ...(proxy === undefined ? {} : { proxy }), ...(caFileEnv === undefined ? {} : { caFileEnv }) },
+        disclosure: {
+            enabled: true,
+            allowedScopes: [...disclosure.allowedScopes],
+            allowedProvenance: [...disclosure.allowedProvenance],
+            maxExcerptBytes: disclosure.maxExcerptBytes,
+            maxCandidateBytes: disclosure.maxCandidateBytes,
+            maxTotalBytes: disclosure.maxTotalBytes,
+        },
+    };
+}
+function writePrivateFile(path, content) {
+    const directory = dirname(path);
+    mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const temporary = join(directory, `.private.${process.pid}.${randomUUID()}.tmp`);
+    try {
+        writeFileSync(temporary, content, { encoding: "utf8", flag: "wx", mode: 0o600 });
+        fsyncFile(temporary);
+        renameSync(temporary, path);
+        persistDirectory(directory);
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch { /* Windows ACLs are managed by the OS. */ }
+    }
+    finally {
+        try {
+            rmSync(temporary, { force: true });
+        }
+        catch { /* best effort */ }
+    }
+}
+function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"); }
+function isRecord(value) { return typeof value === "object" && value !== null && !Array.isArray(value); }
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const wanted = [...expected].sort();
+    return actual.length === wanted.length && actual.every((key, index) => key === wanted[index]);
+}
+function hasRequiredAndOptionalKeys(value, required, optional) { return required.every(key => Object.hasOwn(value, key)) && Object.keys(value).every(key => required.includes(key) || optional.includes(key)); }
+/** New network secrets are reserved and local; even a legacy loader will never export them. */
+export function saveNetworkSecret(name, value, path = envFilePath()) {
+    if (!PRIVATE_NETWORK_KEYS.some(key => key === name))
+        throw new TypeError('Invalid private network key');
+    const assignment = privateAssignment(name, value);
+    const lines = existsSync(path) ? readFileSync(path, 'utf8').split(/\r?\n/u) : [];
+    const matcher = new RegExp(`^\\s*(?:export\\s+)?${name}\\s*=`, 'u');
+    const kept = lines.filter(line => !matcher.test(line));
+    while (kept.at(-1) === '')
+        kept.pop();
+    writePrivateFile(path, [...kept, assignment, ''].join('\n'));
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAA4B,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,gCAAgC,EAAE,MAAM,sDAAsD,CAAC;AAExG,OAAO,EAAE,oBAAoB,EAAqC,MAAM,qCAAqC,CAAC;AAE9G,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAoB,MAAM,oCAAoC,CAAC;AAEhI,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAiB,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAoB9H,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9D,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;QACjC,MAAM,EAAE;YACN,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,2BAA2B;YACpC,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAC,IAAI,EAAC,KAAK,EAAC;YACnB,SAAS,EAAE,gBAAgB;SAC5B;QACD,YAAY,EAAE,EAAC,GAAG,sBAAsB,EAAC;QACzC,cAAc,EAAE,CAAC,QAAQ,CAAC;QAC1B,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE;QACzH,UAAU,EAAE;YACV,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,CAAC,QAAQ,CAAC;YACzB,iBAAiB,EAAE,CAAC,eAAe,CAAC;YACpC,eAAe,EAAE,OAAO;YACxB,iBAAiB,EAAE,OAAO;YAC1B,aAAa,EAAE,OAAO;SACvB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAI,GAAG,cAAc,EAAE;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IACxD,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IACvE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA0B,EAAE,IAAI,GAAG,cAAc,EAAE;IAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc,EAAE,IAAI,GAAG,WAAW,EAAE;IACzF,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAAC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,gFAAgF;IAChF,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IACpD,MAAM,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC,sGAAsG,CAAC,CAAC;IAAC,CAAC;IACtI,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAClF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5P,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrC,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAI,GAAG,WAAW,EAAE;IAC/C,aAAa,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA0B,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC5F,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;IACtG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IACzP,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAChI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,mBAAmB;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACnU,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;IAC5E,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,kBAAkB;QAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC/H,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC3G,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAsB,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvH,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;IAC5G,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2BAA2B,CAAC,CAAC;IACjO,MAAM,UAAU,GAAG,KAAK,CAAC,UAA+C,CAAC;IACzE,wBAAwB,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,UAAU,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACpM,IAAI,UAAU,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAC;IAC1K,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAC;IACjN,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACjO,IAAG,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAC,CAAC,CAAC,EAAC,EAAE,CAAA,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAC,GAAG,CAAC,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC,CAAC,CAAC,GAAC,CAAC,GAAG,KAAG,kBAAkB,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClS,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,YAAY,EAAC,EAAC,GAAG,KAAK,CAAC,YAAmC,EAAC,EAAC,CAAC;QAC1G,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,CAAC,GAAG,KAAK,CAAC,cAAc,CAAa;QACrD,SAAS,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,EAAqC;QACpE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,GAAG,EAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC,EAAE;QAC3N,UAAU,EAAE;YACV,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC;YAC5C,iBAAiB,EAAE,CAAC,GAAG,UAAU,CAAC,iBAAiB,CAAC;YACpD,eAAe,EAAE,UAAU,CAAC,eAAe;YAC3C,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;YAC/C,aAAa,EAAE,UAAU,CAAC,aAAa;SACxC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,SAAS,CAAC,SAAS,CAAC,CAAC;QACrB,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC;YAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACrF,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAAC,CAAC;AACvF,CAAC;AACD,SAAS,YAAY,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACtG,SAAS,QAAQ,CAAC,KAAc,IAAsC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpJ,SAAS,YAAY,CAAC,KAA8B,EAAE,QAA2B;IAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,0BAA0B,CAAC,KAA8B,EAAE,QAAkB,EAAE,QAAkB,IAAa,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtQ,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,IAAyC,EAAE,KAAa,EAAE,IAAI,GAAG,WAAW,EAAE;IAC9G,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACxG,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAC,KAAK,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,uBAAuB,IAAI,OAAO,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,gBAAgB,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAC,UAAU,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/config/private-env.d.ts

@@ -0,0 +1,8 @@
+import { type NetworkEnvironment } from '../memory-manager/network/route.js';
+export declare function readPrivateEnv(path: string): Record<string, string | undefined>;
+/** Legacy compatibility only. New clients never call this or mutate process.env. */
+export declare function loadLegacyEnv(path: string): void;
+export declare function localApiKey(name: string, env: NetworkEnvironment, privateEnv: NetworkEnvironment): string;
+/** Raw backslashes must survive Node dotenv parsing, notably for Windows CA paths. */
+export declare function privateAssignment(name: string, value: string): string;
+//# sourceMappingURL=private-env.d.ts.map

package/dist/config/private-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-env.d.ts","sourceRoot":"","sources":["../../src/config/private-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAEvH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAC,MAAM,GAAG,SAAS,CAAC,CAG9E;AACD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKhD;AACD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,GAAG,MAAM,CAIzG;AACD,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAOrE"}

package/dist/config/private-env.js

@@ -0,0 +1,38 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { parseEnv } from 'node:util';
+import { PRIVATE_NETWORK_KEYS, networkConfigError } from '../memory-manager/network/route.js';
+export function readPrivateEnv(path) {
+    try {
+        return existsSync(path) ? parseEnv(readFileSync(path, 'utf8')) : {};
+    }
+    catch {
+        throw networkConfigError();
+    }
+}
+/** Legacy compatibility only. New clients never call this or mutate process.env. */
+export function loadLegacyEnv(path) {
+    const values = readPrivateEnv(path);
+    for (const [key, value] of Object.entries(values)) {
+        if (!PRIVATE_NETWORK_KEYS.some(k => k === key.toUpperCase()) && process.env[key] === undefined)
+            process.env[key] = value;
+    }
+}
+export function localApiKey(name, env, privateEnv) {
+    const value = (env[name] !== undefined ? env[name] : privateEnv[name])?.trim();
+    if (!value)
+        throw new TypeError(`API key environment variable ${name} is not set`);
+    return value;
+}
+/** Raw backslashes must survive Node dotenv parsing, notably for Windows CA paths. */
+export function privateAssignment(name, value) {
+    if (!value || /[\r\n\0]/u.test(value))
+        throw networkConfigError();
+    const quote = !value.includes('"') ? '"' : !value.includes("'") ? "'" : null;
+    if (!quote)
+        throw networkConfigError();
+    const line = `${name}=${quote}${value}${quote}`;
+    if (parseEnv(line)[name] !== value)
+        throw networkConfigError();
+    return line;
+}
+//# sourceMappingURL=private-env.js.map

package/dist/config/private-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-env.js","sourceRoot":"","sources":["../../src/config/private-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAA2B,MAAM,oCAAoC,CAAC;AAEvH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QAAC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;IAC3E,MAAM,CAAC;QAAC,MAAM,kBAAkB,EAAE,CAAC;IAAC,CAAC;AACvC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,MAAM,CAAC,GAAG,EAAC,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC3H,CAAC;AACH,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAuB,EAAE,UAA8B;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC/E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,IAAI,aAAa,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,IAAI,CAAC,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,kBAAkB,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,KAAK,GAAG,KAAK,GAAG,KAAK,EAAE,CAAC;IAChD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK;QAAE,MAAM,kBAAkB,EAAE,CAAC;IAC/D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config/runtime.d.ts

@@ -0,0 +1,32 @@
+import { OpenAIResponsesMemoryModel } from "../memory-manager/openai/openai-responses-adapter.js";
+import { OpenAIChatMemoryModel } from "../memory-manager/openai/openai-chat-adapter.js";
+import type { RemoteHttpOptions } from "../memory-manager/openai/remote-http.js";
+import type { RemoteTuning } from "../memory-manager/openai/options.js";
+import { type RouteDescription } from "../memory-manager/network/route.js";
+import { type CommonMemoryConfig } from "./config.js";
+export type ConfiguredModelOverrides = Omit<RemoteHttpOptions, "apiKey" | "model" | "baseUrl" | "disclosurePolicy" | "network"> & RemoteTuning;
+export declare function createConfiguredMemoryModel(config: CommonMemoryConfig, env?: NodeJS.ProcessEnv, overrides?: ConfiguredModelOverrides): OpenAIResponsesMemoryModel | OpenAIChatMemoryModel;
+import { Writer, type WriterOptions } from "../v2/writer.js";
+/**
+ * The Writer itself is provenance-neutral: each batch is checked against `disclosure.allowedProvenance`
+ * before any network call, so an init-only or import-only configuration processes what it authorizes
+ * and quarantines the rest locally. Hosts that only capture user turns check `user_explicit` themselves.
+ */
+export declare function createConfiguredWriter(config: CommonMemoryConfig): ConfiguredWriter;
+/** Ownership belongs to the configured host composition, not to the borrowed MemoryModelPort. */
+declare class ConfiguredWriter extends Writer {
+    #private;
+    constructor(options: WriterOptions, model: OpenAIResponsesMemoryModel | OpenAIChatMemoryModel);
+    run(options?: {
+        force?: boolean;
+        signal?: AbortSignal;
+    }): Promise<{
+        outcome: string;
+        reason?: string;
+    }>;
+    close(): Promise<void>;
+}
+/** No sockets, database, environment mutation or directory creation. This describes configuration only. */
+export declare function describeConfiguredNetwork(config: CommonMemoryConfig, env?: NodeJS.ProcessEnv): RouteDescription;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/config/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AACjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAmD,KAAK,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAE5H,OAAO,EAA6C,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjG,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,kBAAkB,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC;AAE/I,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,EAC1B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,wBAA6B,GACvC,0BAA0B,GAAG,qBAAqB,CAmBpD;AAED,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC7D;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,gBAAgB,CAInF;AAED,iGAAiG;AACjG,cAAM,gBAAiB,SAAQ,MAAM;;gBAKvB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,0BAA0B,GAAG,qBAAqB;IACpF,GAAG,CAAC,OAAO,GAAE;QAAC,KAAK,CAAC,EAAC,OAAO,CAAC;QAAA,MAAM,CAAC,EAAC,WAAW,CAAA;KAAM,GAAG,OAAO,CAAC;QAAC,OAAO,EAAC,MAAM,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,CAAA;KAAC,CAAC;IAOjG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAOhC;AACD,2GAA2G;AAC3G,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAG5H"}

package/dist/config/runtime.js

@@ -0,0 +1,85 @@
+import { OpenAIResponsesMemoryModel } from "../memory-manager/openai/openai-responses-adapter.js";
+import { OpenAIChatMemoryModel } from "../memory-manager/openai/openai-chat-adapter.js";
+import { NetworkClient } from "../memory-manager/network/client.js";
+import { resolveRoute, networkSecret, networkConfigError } from "../memory-manager/network/route.js";
+import { readPrivateEnv, localApiKey } from "./private-env.js";
+import { loadLocalEnv, validateConfig, envFilePath } from "./config.js";
+export function createConfiguredMemoryModel(config, env = process.env, overrides = {}) {
+    config = validateConfig(config);
+    if (!config.remote.proxy && env === process.env)
+        loadLocalEnv();
+    const privateEnv = env === process.env || env.COMMON_MEMORY_HOME ? readPrivateEnv(envFilePath(env)) : {};
+    const apiKey = localApiKey(config.remote.apiKeyEnv, env, privateEnv);
+    const route = resolveRoute(config.remote.baseUrl, config.remote.proxy, env, privateEnv);
+    const caFile = config.remote.caFileEnv === undefined ? undefined : networkSecret(config.remote.caFileEnv, env, privateEnv);
+    if (config.remote.caFileEnv !== undefined && !caFile?.trim())
+        throw networkConfigError("ca_config_invalid");
+    const network = overrides.fetch ? undefined : new NetworkClient(config.remote.baseUrl, route, caFile);
+    const Model = config.remote.api === "chat_completions" ? OpenAIChatMemoryModel : OpenAIResponsesMemoryModel;
+    try {
+        return new Model({
+            ...config.remote,
+            ...overrides,
+            ...(network ? { network } : {}),
+            apiKey,
+            model: config.remote.model,
+            baseUrl: config.remote.baseUrl,
+            disclosurePolicy: config.disclosure,
+        });
+    }
+    catch (error) {
+        void network?.close().catch(() => { });
+        throw error;
+    }
+}
+import { Writer } from "../v2/writer.js";
+/**
+ * The Writer itself is provenance-neutral: each batch is checked against `disclosure.allowedProvenance`
+ * before any network call, so an init-only or import-only configuration processes what it authorizes
+ * and quarantines the rest locally. Hosts that only capture user turns check `user_explicit` themselves.
+ */
+export function createConfiguredWriter(config) {
+    const model = createConfiguredMemoryModel(config);
+    try {
+        return new ConfiguredWriter({ modelVersion: config.remote.model, maxRequestBytes: config.disclosure.maxTotalBytes, dataRoot: config.dataRoot, model, allowedScopes: config.disclosure.allowedScopes, writableScopes: config.writableScopes, allowedProvenance: config.disclosure.allowedProvenance, scheduler: config.scheduler, ...(config.sessionCache ? { sessionCache: config.sessionCache } : {}) }, model);
+    }
+    catch (error) {
+        void model.close().catch(() => { });
+        throw error;
+    }
+}
+/** Ownership belongs to the configured host composition, not to the borrowed MemoryModelPort. */
+class ConfiguredWriter extends Writer {
+    #model;
+    #abort = new AbortController();
+    #runs = new Set();
+    #closing;
+    constructor(options, model) { super(options); this.#model = model; }
+    run(options = {}) {
+        if (this.#abort.signal.aborted)
+            return Promise.reject(new Error('CANCELLED'));
+        const run = super.run({ ...options, signal: AbortSignal.any([this.#abort.signal, ...(options.signal ? [options.signal] : [])]) });
+        this.#runs.add(run);
+        void run.then(() => this.#runs.delete(run), () => this.#runs.delete(run));
+        return run;
+    }
+    close() {
+        if (this.#closing)
+            return this.#closing;
+        this.#abort.abort();
+        return this.#closing = Promise.allSettled([...this.#runs]).then(async () => {
+            try {
+                super.close();
+            }
+            finally {
+                await this.#model.close();
+            }
+        });
+    }
+}
+/** No sockets, database, environment mutation or directory creation. This describes configuration only. */
+export function describeConfiguredNetwork(config, env = process.env) {
+    const privateEnv = env === process.env || env.COMMON_MEMORY_HOME ? readPrivateEnv(envFilePath(env)) : {};
+    return resolveRoute(config.remote.baseUrl, config.remote.proxy, env, privateEnv).description;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/config/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/config/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sDAAsD,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,iDAAiD,CAAC;AAGxF,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAyB,MAAM,oCAAoC,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAA2B,MAAM,aAAa,CAAC;AAIjG,MAAM,UAAU,2BAA2B,CACzC,MAA0B,EAC1B,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAsC,EAAE;IAExC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,YAAY,EAAE,CAAC;IAChE,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAC,GAAG,EAAC,UAAU,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAC,GAAG,EAAC,UAAU,CAAC,CAAC;IACzH,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAC,KAAK,EAAC,MAAM,CAAC,CAAC;IACpG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAC5G,IAAI,CAAC;QAAC,OAAO,IAAI,KAAK,CAAC;YACrB,GAAG,MAAM,CAAC,MAAM;YAChB,GAAG,SAAS;YACZ,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM;YACN,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;YAC9B,gBAAgB,EAAE,MAAM,CAAC,UAAU;SACpC,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,KAAK,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AAC7E,CAAC;AAED,OAAO,EAAE,MAAM,EAAsB,MAAM,iBAAiB,CAAC;AAC7D;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,MAAM,KAAK,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC;QAAC,OAAO,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAC,YAAY,EAAC,MAAM,CAAC,YAAY,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IACtZ,OAAO,KAAK,EAAE,CAAC;QAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,iGAAiG;AACjG,MAAM,gBAAiB,SAAQ,MAAM;IAC1B,MAAM,CAAqD;IAC3D,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAC/B,KAAK,GAAG,IAAI,GAAG,EAA4C,CAAC;IACrE,QAAQ,CAA4B;IACpC,YAAY,OAAsB,EAAE,KAAyD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC;IAC9H,GAAG,CAAC,UAAgD,EAAE;QAC7D,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAC,GAAG,OAAO,EAAC,MAAM,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC;QAC7H,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,GAAG,CAAC;IACb,CAAC;IACQ,KAAK;QACZ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACzE,IAAI,CAAC;gBAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AACD,2GAA2G;AAC3G,MAAM,UAAU,yBAAyB,CAAC,MAA0B,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxG,MAAM,UAAU,GAAG,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzG,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAC,GAAG,EAAC,UAAU,CAAC,CAAC,WAAW,CAAC;AAC5F,CAAC"}

package/dist/core/contracts/errors.d.ts

@@ -0,0 +1,10 @@
+export declare const ERROR_CODES: readonly ["PERMISSION_DENIED", "VALIDATION_FAILED", "CONFLICT_DETECTED", "STALE_REVISION", "SENSITIVE_CONTENT_REJECTED", "INDEX_OUTDATED", "STORE_LOCKED", "STORE_UNAVAILABLE", "PROTOCOL_ERROR"];
+export type ErrorCode = typeof ERROR_CODES[number];
+export declare class CoreError extends Error {
+    readonly code: ErrorCode;
+    readonly details: Readonly<Record<string, unknown>>;
+    constructor(code: ErrorCode, message: string, details?: Readonly<Record<string, unknown>>, options?: ErrorOptions);
+}
+export declare function fail(code: ErrorCode, message: string, details?: Readonly<Record<string, unknown>>): never;
+export declare function toCoreError(error: unknown): CoreError;
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/contracts/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/core/contracts/errors.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,WAAW,mMAGd,CAAC;AACX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAEnD,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;gBACxC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAMtH;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM,GAAG,KAAK,CAE7G;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAGrD"}

package/dist/core/contracts/errors.js

@@ -0,0 +1,23 @@
+export const ERROR_CODES = [
+    "PERMISSION_DENIED", "VALIDATION_FAILED", "CONFLICT_DETECTED", "STALE_REVISION",
+    "SENSITIVE_CONTENT_REJECTED", "INDEX_OUTDATED", "STORE_LOCKED", "STORE_UNAVAILABLE", "PROTOCOL_ERROR"
+];
+export class CoreError extends Error {
+    code;
+    details;
+    constructor(code, message, details = {}, options) {
+        super(message, options);
+        this.name = "CoreError";
+        this.code = code;
+        this.details = details;
+    }
+}
+export function fail(code, message, details = {}) {
+    throw new CoreError(code, message, details);
+}
+export function toCoreError(error) {
+    if (error instanceof CoreError)
+        return error;
+    return new CoreError("STORE_UNAVAILABLE", "The memory store is unavailable", {}, { cause: error });
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/contracts/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/core/contracts/errors.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,mBAAmB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,gBAAgB;IAC/E,4BAA4B,EAAE,gBAAgB,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB;CAC7F,CAAC;AAGX,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAY;IAChB,OAAO,CAAoC;IACpD,YAAY,IAAe,EAAE,OAAe,EAAE,UAA6C,EAAE,EAAE,OAAsB;QACnH,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,MAAM,UAAU,IAAI,CAAC,IAAe,EAAE,OAAe,EAAE,UAA6C,EAAE;IACpG,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,SAAS,CAAC,mBAAmB,EAAE,iCAAiC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AACrG,CAAC"}

package/dist/core/safety/external-preflight.d.ts

@@ -0,0 +1,7 @@
+export interface ExternalSizeCaps {
+    maxExcerptBytes: number;
+    maxCandidateBytes: number;
+    maxTotalBytes: number;
+}
+export declare function externalPreflight(projection: Readonly<Record<string, unknown>>, caps: ExternalSizeCaps, exactSerializedBytes?: number): void;
+//# sourceMappingURL=external-preflight.d.ts.map

package/dist/core/safety/external-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-preflight.d.ts","sourceRoot":"","sources":["../../../src/core/safety/external-preflight.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAAG,eAAe,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE;AAC/G,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAI5I"}

package/dist/core/safety/external-preflight.js

@@ -0,0 +1,47 @@
+import { CoreError } from "../contracts/errors.js";
+import { scanFields } from "./scanner.js";
+export function externalPreflight(projection, caps, exactSerializedBytes) {
+    const fields = [];
+    collect(projection, "", fields);
+    scanFields(fields, true);
+    const bytes = exactSerializedBytes ?? Buffer.byteLength(JSON.stringify(projection), "utf8");
+    if (bytes > caps.maxTotalBytes)
+        reject("external.total_bytes", "/");
+    checkNamedArrays(projection, "", caps);
+}
+function collect(value, path, out) {
+    if (typeof value === "string") {
+        out.push({ path: path || "/", value });
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((child, index) => collect(child, `${path}/${index}`, out));
+        return;
+    }
+    if (value && typeof value === "object")
+        for (const [key, child] of Object.entries(value)) {
+            const childPath = `${path}/${escapePointer(key)}`;
+            out.push({ path: `${childPath}/@key`, value: key });
+            collect(child, childPath, out);
+        }
+}
+function checkNamedArrays(value, path, caps) {
+    if (Array.isArray(value)) {
+        value.forEach((child, index) => checkNamedArrays(child, `${path}/${index}`, caps));
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        const childPath = `${path}/${escapePointer(key)}`;
+        if ((key === "excerpts" || key === "candidates") && Array.isArray(child)) {
+            const max = key === "excerpts" ? caps.maxExcerptBytes : caps.maxCandidateBytes;
+            child.forEach((item, index) => { if (Buffer.byteLength(JSON.stringify(item), "utf8") > max)
+                reject(key === "excerpts" ? "external.excerpt_bytes" : "external.candidate_bytes", `${childPath}/${index}`); });
+        }
+        checkNamedArrays(child, childPath, caps);
+    }
+}
+function reject(rule_id, field_path) { throw new CoreError("SENSITIVE_CONTENT_REJECTED", "Outbound projection exceeds disclosure limits", { violations: [{ rule_id, field_path }] }); }
+function escapePointer(value) { return value.replaceAll("~", "~0").replaceAll("/", "~1"); }
+//# sourceMappingURL=external-preflight.js.map

package/dist/core/safety/external-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-preflight.js","sourceRoot":"","sources":["../../../src/core/safety/external-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAoB,MAAM,cAAc,CAAC;AAE5D,MAAM,UAAU,iBAAiB,CAAC,UAA6C,EAAE,IAAsB,EAAE,oBAA6B;IACpI,MAAM,MAAM,GAAkB,EAAE,CAAC;IAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,oBAAoB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,KAAK,GAAG,IAAI,CAAC,aAAa;QAAE,MAAM,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACjK,gBAAgB,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC;AACD,SAAS,OAAO,CAAC,KAAc,EAAE,IAAY,EAAE,GAAkB;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAClF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/G,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,SAAS,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;AACvO,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAsB;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzH,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,YAAY,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG;gBAAE,MAAM,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,0BAA0B,EAAE,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC1W,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AACD,SAAS,MAAM,CAAC,OAAe,EAAE,UAAkB,IAAW,MAAM,IAAI,SAAS,CAAC,4BAA4B,EAAE,+CAA+C,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9M,SAAS,aAAa,CAAC,KAAa,IAAY,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/safety/redaction.d.ts

@@ -0,0 +1,2 @@
+export declare function irreversibleFingerprint(value: string): string;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/core/safety/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/core/safety/redaction.ts"],"names":[],"mappings":"AAEA,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAuF"}

package/dist/core/safety/redaction.js

@@ -0,0 +1,4 @@
+import { createHmac, randomBytes } from "node:crypto";
+const key = randomBytes(32);
+export function irreversibleFingerprint(value) { return createHmac("sha256", key).update(value, "utf8").digest("hex").slice(0, 16); }
+//# sourceMappingURL=redaction.js.map

package/dist/core/safety/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/core/safety/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;AAC5B,MAAM,UAAU,uBAAuB,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/safety/rules.d.ts

@@ -0,0 +1,6 @@
+export interface SafetyRule {
+    id: string;
+    pattern: RegExp;
+}
+export declare const ALWAYS_REJECT_RULES: readonly SafetyRule[];
+//# sourceMappingURL=rules.d.ts.map

package/dist/core/safety/rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../src/core/safety/rules.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAC3D,eAAO,MAAM,mBAAmB,EAAE,SAAS,UAAU,EAYpD,CAAC"}

package/dist/core/safety/rules.js

@@ -0,0 +1,14 @@
+export const ALWAYS_REJECT_RULES = [
+    { id: "secret.private_key", pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/iu },
+    { id: "secret.credential", pattern: /(?<![\p{L}\p{N}])(?:api[_ -]?key|access[_ -]?token|refresh[_ -]?token|password|passwd|cookie|session[_ -]?secret|recovery code|助记词|密码|私钥)\s*[:=：]\s*\S+/iu },
+    { id: "secret.authorization_header", pattern: /\bAuthorization\s*:\s*(?:Bearer\s+[A-Za-z0-9._~+\/-]{12,}|Basic\s+[A-Za-z0-9+/]{12,}={0,2})/iu },
+    { id: "secret.credential_url", pattern: /https?:\/\/[^\s/:@]+:[^\s/@]+@[^\s/]+/iu },
+    { id: "secret.token_prefix", pattern: /\b(?:ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-(?:(?:proj|svcacct)-)?[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16})\b/u },
+    { id: "identity.government_id", pattern: /\b\d{17}[0-9Xx]\b|\b身份证(?:号)?\s*[:：]?\s*[0-9Xx]{8,}/u },
+    { id: "identity.email", pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/iu },
+    { id: "identity.phone", pattern: /(?:电话|手机号|mobile|phone)\s*[:：]?\s*\+?[0-9][0-9 ()-]{6,18}/iu },
+    { id: "payment.card", pattern: /\b(?:\d[ -]*?){13,19}\b/u },
+    { id: "address.full", pattern: /(?:完整住址|家庭地址|home address)\s*[:：]/iu },
+    { id: "content.private_conversation", pattern: /(?:完整私聊|完整私人对话|full private (?:chat|conversation))/iu },
+];
+//# sourceMappingURL=rules.js.map

package/dist/core/safety/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../src/core/safety/rules.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,mBAAmB,GAA0B;IACxD,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,qDAAqD,EAAE;IAC5F,EAAE,EAAE,EAAE,mBAAmB,EAAE,OAAO,EAAE,2JAA2J,EAAE;IACjM,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,+FAA+F,EAAE;IAC/I,EAAE,EAAE,EAAE,uBAAuB,EAAE,OAAO,EAAE,yCAAyC,EAAE;IACnF,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,yHAAyH,EAAE;IACjK,EAAE,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE,sDAAsD,EAAE;IACjG,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,6CAA6C,EAAE;IAChF,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,6DAA6D,EAAE;IAChG,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,0BAA0B,EAAE;IAC3D,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,qCAAqC,EAAE;IACtE,EAAE,EAAE,EAAE,8BAA8B,EAAE,OAAO,EAAE,sDAAsD,EAAE;CACxG,CAAC"}

package/dist/core/safety/scanner.d.ts

@@ -0,0 +1,11 @@
+export interface SafetyField {
+    path: string;
+    value: string;
+}
+export interface SafetyViolation {
+    rule_id: string;
+    field_path: string;
+    fingerprint: string;
+}
+export declare function scanFields(fields: readonly SafetyField[], _agentInference?: boolean): void;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/core/safety/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/core/safety/scanner.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC5D,MAAM,WAAW,eAAe;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAC7F,wBAAgB,UAAU,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,EAAE,eAAe,UAAQ,GAAG,IAAI,CAUxF"}

package/dist/core/safety/scanner.js

@@ -0,0 +1,18 @@
+import { CoreError } from "../contracts/errors.js";
+import { ALWAYS_REJECT_RULES } from "./rules.js";
+import { irreversibleFingerprint } from "./redaction.js";
+export function scanFields(fields, _agentInference = false) {
+    const violations = [];
+    for (const field of fields) {
+        // A complete UUID is not a payment card. Exclude only its complete token
+        // for this one numeric rule; credential/identity rules still see all input.
+        for (const rule of ALWAYS_REJECT_RULES)
+            if (rule.pattern.test(rule.id === 'payment.card'
+                ? field.value.replace(/(?<![A-Za-z0-9_])[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}(?![A-Za-z0-9_])/giu, '[uuid]')
+                : field.value))
+                violations.push({ rule_id: rule.id, field_path: field.path, fingerprint: irreversibleFingerprint(field.value) });
+    }
+    if (violations.length)
+        throw new CoreError("SENSITIVE_CONTENT_REJECTED", "Content policy rejected the candidate", { violations });
+}
+//# sourceMappingURL=scanner.js.map

package/dist/core/safety/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/core/safety/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAIzD,MAAM,UAAU,UAAU,CAAC,MAA8B,EAAE,eAAe,GAAG,KAAK;IAChF,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,4EAA4E;QAC5E,KAAK,MAAM,IAAI,IAAI,mBAAmB;YAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc;gBACtF,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,iFAAiF,EAAE,QAAQ,CAAC;gBAClH,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,UAAU,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,EAAE,uCAAuC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;AACpI,CAAC"}