dotmem 0.0.7 → 0.0.8

package/SECURITY.md

@@ -8,7 +8,7 @@ This document covers dotmem's optional encryption layer, client-side multitenanc
 
 This applies to every layer: `state`, `store`, `session`, `idb`, `memory`, `sqlite`. Treat browser storage as client-controlled unless you explicitly opt in.
 
-Core has zero production dependencies. No `eval`, no dynamic code execution, no bundled telemetry, sanitized keys, validated inputs, bounded journal entries, UUID-based session identifiers. Independently checkable via Socket.dev / Snyk. (The optional MCP stdio entrypoint is the one declared-dependency surface: `zod` and `@modelcontextprotocol/server`.)
+Core declares no production dependencies in package.json. `memorio` is listed under devDependencies, but the built ESM/CJS output imports it as an external runtime module; a published install therefore needs `memorio` available unless packaging changes. No `eval`, no dynamic code execution, no bundled telemetry, sanitized keys, validated inputs, bounded journal entries, UUID-based session identifiers. Independently checkable via Socket.dev / Snyk. (The optional MCP stdio entrypoint is the one declared-dependency surface: `zod` and `@modelcontextprotocol/server`.)
 
 ---
 
@@ -191,9 +191,12 @@ machine.
 
 - `dotmem_acquire` is registered only when the server environment sets
  `DOTMEM_MCP_WRITE=1`.
-- Without the flag, the server exposes `dotmem_context` and
- `dotmem_rules` only. The write tool is not in `tools/list`, and calling
- it by name answers `Tool dotmem_acquire not found`.
+- `dotmem_continuity` write actions (`checkpoint`, `add-open-loop`,
+ `resolve-open-loop`) require `DOTMEM_MCP_WRITE=1`. Read actions
+ (`status`, `summaries`, `open-loops`, `evaluate`) are always available.
+- Without the flag, the server exposes `dotmem_context`, `dotmem_rules`,
+ and `dotmem_continuity` (read actions only). The write tools are not in
+ `tools/list`, and calling them by name answers `Tool <name> not found`.
 - The flag is read once, when the server starts. Changing it requires
  restarting the server.
 - The library API (`memory.acquire()`) and the CLI (`npx dotmem acquire`)
@@ -289,7 +292,7 @@ relaxation *attributable*, not undetectable-by-absence.
 
 ## Supply chain
 
-- Zero production dependencies in core - nothing to audit transitively for the parts you actually ship.
+- Declared production dependencies: none in the root package.json; `memorio` is a devDependency. The built output imports `memorio` as an external runtime module, so it must be available to a published install unless packaging changes. Do not infer zero runtime dependencies from package.json alone.
 - Dev dependencies are audited periodically (`npm audit` and equivalent).
 - Package integrity is checkable independently via Socket.dev / Snyk before you adopt a given version.
 
@@ -469,10 +472,10 @@ npx dotmem handshake --bind-hi "<user name>" --scope "<scope>"
 ### Identity fusion protection
 
 dotmem detects attempts to fuse an identity with implementation metadata into
-pseudo-identities (e.g. `Joy`, `HI`, `Jo-profile`). The
-canonical identity is preserved; fused forms are never accepted as an identity.
-Host, provider, runtime, and model names are implementation metadata and never
-become the conversational identity or authority.
+pseudo-identities (e.g. `Joy-profile`, `HI`, `Jo-profile`). The
+canonical identity (`Joy`/`Jo` from the canonical profile) is preserved; fused forms
+are never accepted as an identity. Host, provider, runtime, and model names are
+implementation metadata and never become the conversational identity or authority.
 
 ### JHF remediation principles
 

package/agent.cjs

@@ -1,6 +1,5 @@
 'use strict';
 
-require('memorio/global');
 var memorio = require('memorio');
 
 var __defProp = Object.defineProperty;
@@ -19,15 +18,27 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// core/idb.ts
+var idb;
+var init_idb = __esm({
+  "core/idb.ts"() {
+    idb = {
+      db: {},
+      table: {},
+      data: {},
+      _disabled: true,
+      _warning: "IndexedDB is not available in this environment. Use dotmem store or session for persistence."
+    };
+  }
+});
+
 // core/global.ts
 var global_exports = {};
 __export(global_exports, {
-  DEV: () => memorio.DEV,
-  PROD: () => memorio.PROD,
   dispatch: () => memorio.dispatch,
   getPlatform: () => getPlatform,
   hlc: () => memorio.hlc,
-  idb: () => memorio.idb,
+  idb: () => idb,
   session: () => memorio.session,
   state: () => memorio.state,
   store: () => memorio.store
@@ -35,6 +46,7 @@ __export(global_exports, {
 var getPlatform;
 var init_global = __esm({
   "core/global.ts"() {
+    init_idb();
     getPlatform = /* @__PURE__ */ __name(() => {
       const proc = globalThis.process;
       if (proc) {

package/agent.js

@@ -1,5 +1,4 @@
-import 'memorio/global';
-import { store, state, session, idb, hlc, dispatch, PROD, DEV } from 'memorio';
+import { store, state, session, hlc, dispatch } from 'memorio';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -17,11 +16,23 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// core/idb.ts
+var idb;
+var init_idb = __esm({
+  "core/idb.ts"() {
+    idb = {
+      db: {},
+      table: {},
+      data: {},
+      _disabled: true,
+      _warning: "IndexedDB is not available in this environment. Use dotmem store or session for persistence."
+    };
+  }
+});
+
 // core/global.ts
 var global_exports = {};
 __export(global_exports, {
-  DEV: () => DEV,
-  PROD: () => PROD,
   dispatch: () => dispatch,
   getPlatform: () => getPlatform,
   hlc: () => hlc,
@@ -33,6 +44,7 @@ __export(global_exports, {
 var getPlatform;
 var init_global = __esm({
   "core/global.ts"() {
+    init_idb();
     getPlatform = /* @__PURE__ */ __name(() => {
       const proc = globalThis.process;
       if (proc) {