panoma 0.1.8 → 0.9.0

package/app/node_modules/@panoma/mcp/dist/index.js

@@ -3107,15 +3107,34 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/lib/utils.js"(exports, module) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-    var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+    var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3140,91 +3159,105 @@ var require_utils = __commonJS({
       }
       return acc;
     }
+    var isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+    var isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+    var isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
     var nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-    function consumeIsZone(buffer) {
-      buffer.length = 0;
-      return true;
-    }
-    function consumeHextets(buffer, address, output) {
-      if (buffer.length) {
-        const hex = stringArrayToHexStripped(buffer);
-        if (hex !== "") {
-          address.push(hex);
-        } else {
-          output.error = true;
-          return false;
+    function isZoneIdentifier(zone) {
+      if (zone.length === 0) return false;
+      for (let i = 0; i < zone.length; i++) {
+        if (isZoneCharacter(zone[i])) continue;
+        if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+          i += 2;
+          continue;
         }
-        buffer.length = 0;
+        return false;
       }
       return true;
     }
-    function getIPV6(input) {
-      let tokenCount = 0;
-      const output = { error: false, address: "", zone: "" };
-      const address = [];
-      const buffer = [];
-      let endipv6Encountered = false;
-      let endIpv6 = false;
-      let consume = consumeHextets;
-      for (let i = 0; i < input.length; i++) {
-        const cursor = input[i];
-        if (cursor === "[" || cursor === "]") {
-          continue;
-        }
-        if (cursor === ":") {
-          if (endipv6Encountered === true) {
-            endIpv6 = true;
-          }
-          if (!consume(buffer, address, output)) {
-            break;
-          }
-          if (++tokenCount > 7) {
-            output.error = true;
-            break;
-          }
-          if (i > 0 && input[i - 1] === ":") {
-            endipv6Encountered = true;
-          }
-          address.push(":");
-          continue;
-        } else if (cursor === "%") {
-          if (!consume(buffer, address, output)) {
-            break;
+    function compressIPv6ZeroRun(hextets) {
+      let bestStart = -1;
+      let bestLength = 0;
+      let runStart = -1;
+      let runLength = 0;
+      for (let i = 0; i < hextets.length; i++) {
+        if (hextets[i] === "0") {
+          if (runStart === -1) runStart = i;
+          runLength++;
+          if (runLength > bestLength) {
+            bestLength = runLength;
+            bestStart = runStart;
           }
-          consume = consumeIsZone;
         } else {
-          buffer.push(cursor);
+          runStart = -1;
+          runLength = 0;
+        }
+      }
+      if (bestLength < 2) return hextets.join(":");
+      const head = hextets.slice(0, bestStart).join(":");
+      const tail = hextets.slice(bestStart + bestLength).join(":");
+      return head + "::" + tail;
+    }
+    function normalizeIPv6Address(input) {
+      const compression = input.indexOf("::");
+      if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+      const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+      const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+      if (compression !== -1) {
+        if (left.length === 1 && left[0] === "") left.length = 0;
+        if (right.length === 1 && right[0] === "") right.length = 0;
+      }
+      const parts = left.concat(right);
+      let hextetCount = 0;
+      for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (part === "") return void 0;
+        if (part.indexOf(".") !== -1) {
+          if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+          hextetCount += 2;
           continue;
         }
+        if (!isHextet(part)) return void 0;
+        parts[i] = parseInt(part, 16).toString(16);
+        hextetCount++;
       }
-      if (buffer.length) {
-        if (consume === consumeIsZone) {
-          output.zone = buffer.join("");
-        } else if (endIpv6) {
-          address.push(buffer.join(""));
-        } else {
-          address.push(stringArrayToHexStripped(buffer));
-        }
+      if (compression === -1) {
+        if (hextetCount !== 8) return void 0;
+        return compressIPv6ZeroRun(parts);
       }
-      output.address = address.join("");
-      return output;
+      if (hextetCount >= 8) return void 0;
+      const expanded = parts.slice(0, left.length);
+      for (let i = hextetCount; i < 8; i++) expanded.push("0");
+      for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
+      return compressIPv6ZeroRun(expanded);
     }
     function normalizeIPv6(host) {
-      if (findToken(host, ":") < 2) {
-        return { host, isIPV6: false };
-      }
-      const ipv62 = getIPV6(host);
-      if (!ipv62.error) {
-        let newHost = ipv62.address;
-        let escapedHost = ipv62.address;
-        if (ipv62.zone) {
-          newHost += "%" + ipv62.zone;
-          escapedHost += "%25" + ipv62.zone;
-        }
-        return { host: newHost, isIPV6: true, escapedHost };
-      } else {
-        return { host, isIPV6: false };
-      }
+      const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+      const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+      if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+      let input = bracketed ? host.slice(1, -1) : host;
+      if (bracketed && isIPvFuture(input)) {
+        input = input.toLowerCase();
+        return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+      }
+      if (findToken(input, ":") < 2) {
+        return { host, isIPV6: false, error: bracketed };
+      }
+      let zoneIdentifier = "";
+      const zoneSeparator = input.indexOf("%");
+      if (zoneSeparator !== -1) {
+        const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+        zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+        if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+        input = input.slice(0, zoneSeparator);
+      }
+      const address = normalizeIPv6Address(input);
+      if (address === void 0) return { host, isIPV6: false, error: true };
+      return {
+        host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+        escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+        isIPV6: true
+      };
     }
     function findToken(str, token) {
       let ind = 0;
@@ -3343,7 +3376,8 @@ var require_utils = __commonJS({
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex = input.slice(i + 1, i + 3);
           if (isHexPair(hex)) {
             const normalizedHex = hex.toUpperCase();
@@ -3357,10 +3391,152 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function serializePathEncoding(input, pathNoScheme = false) {
+      let output = "";
+      let firstSegment = pathNoScheme && input[0] !== "/";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (ch === "/") {
+          firstSegment = false;
+        }
+        if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeComponent(input, isAllowed) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            output += "%" + hex.toUpperCase();
+            i += 2;
+            continue;
+          }
+        }
+        if (isAllowed(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function encodeUserinfo(input) {
+      return encodeComponent(input, isUserinfoCharacter);
+    }
+    function encodeQuery(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function encodeFragment(input) {
+      return encodeComponent(input, isQueryFragmentCharacter);
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex = input.slice(i + 1, i + 3);
+          if (isHexPair(hex)) {
+            const normalizedHex = hex.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -3383,14 +3559,18 @@ var require_utils = __commonJS({
     function recomposeAuthority(component) {
       const uriTokens = [];
       if (component.userinfo !== void 0) {
-        uriTokens.push(component.userinfo);
+        uriTokens.push(encodeUserinfo(component.userinfo));
         uriTokens.push("@");
       }
       if (component.host !== void 0) {
-        let host = unescape(component.host);
+        let host = component.host;
         if (!isIPv4(host)) {
-          const ipV6res = normalizeIPv6(host);
-          if (ipV6res.isIPV6 === true) {
+          let ipV6res = normalizeIPv6(host);
+          if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+            host = normalizePercentEncoding(host, true);
+            ipV6res = normalizeIPv6(host);
+          }
+          if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
             host = reescapeHostDelimiters(host, false);
@@ -3399,8 +3579,12 @@ var require_utils = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -3410,6 +3594,11 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      serializePathEncoding,
+      normalizeQueryFragmentEncoding,
+      encodeUserinfo,
+      encodeQuery,
+      encodeFragment,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -3420,12 +3609,12 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/lib/schemes.js"(exports, module) {
     "use strict";
     var { isUUID } = require_utils();
-    var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+    var URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
     var supportedSchemeNames = (
       /** @type {const} */
       [
@@ -3486,9 +3675,10 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path, query] = wsComponent.resourceName.split("?");
+        const queryIndex = wsComponent.resourceName.indexOf("?");
+        const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
         wsComponent.path = path && path !== "/" ? path : void 0;
-        wsComponent.query = query;
+        wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
       wsComponent.fragment = void 0;
@@ -3500,7 +3690,7 @@ var require_schemes = __commonJS({
         return urnComponent;
       }
       const matches = urnComponent.path.match(URN_REG);
-      if (matches) {
+      if (matches && matches[0] === urnComponent.path) {
         const scheme = options.scheme || urnComponent.scheme || "urn";
         urnComponent.nid = matches[1].toLowerCase();
         urnComponent.nss = matches[2];
@@ -3630,12 +3820,21 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js"(exports, module) {
+  "../../node_modules/.pnpm/fast-uri@3.1.7/node_modules/fast-uri/index.js"(exports, module) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
+    var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+    var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+    function decodeValidScheme(scheme) {
+      const decodedScheme = unescape(String(scheme));
+      if (!VALID_SCHEME.test(decodedScheme)) {
+        throw new TypeError(MALFORMED_SCHEME_ERROR);
+      }
+      return decodedScheme;
+    }
     function normalize(uri, options) {
       if (typeof uri === "string") {
         uri = /** @type {T} */
@@ -3648,12 +3847,34 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
-      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
-      if (baseMalformed || relativeMalformed) {
+      const {
+        parsed: baseParsed,
+        malformedAuthorityOrPort: baseMalformed,
+        malformedPercentEncoding: baseMalformedPercentEncoding,
+        malformedSchemeSpecific: baseMalformedSchemeSpecific,
+        malformedHost: baseMalformedHost,
+        malformedScheme: baseMalformedScheme
+      } = parseWithStatus(baseURI, schemelessOptions);
+      const {
+        parsed: relativeParsed,
+        malformedAuthorityOrPort: relativeMalformed,
+        malformedPercentEncoding: relativeMalformedPercentEncoding,
+        malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+        malformedHost: relativeMalformedHost,
+        malformedScheme: relativeMalformedScheme
+      } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
         throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
       }
       const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+      const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+      const resolvedHost = resolved.host;
+      const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+      canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+      const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
+      if (resolved.error && !encodedASCIIHost) {
+        throw new Error(resolved.error);
+      }
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3713,7 +3934,7 @@ var require_fast_uri = __commonJS({
     function equal(uriA, uriB, options) {
       const normalizedA = normalizeComparableURI(uriA, options);
       const normalizedB = normalizeComparableURI(uriB, options);
-      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+      return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
     }
     function serialize(cmpts, opts) {
       const component = {
@@ -3734,19 +3955,22 @@ var require_fast_uri = __commonJS({
       };
       const options = Object.assign({}, opts);
       const uriTokens = [];
+      if (component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
+      }
       const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
       if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
+      const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+      const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
       if (component.path !== void 0) {
         if (!options.skipEscape) {
-          component.path = escapePreservingEscapes(component.path);
-          if (component.scheme !== void 0) {
-            component.path = component.path.split("%3A").join(":");
-          }
+          component.path = serializePathEncoding(component.path, pathNoScheme);
         } else {
           component.path = normalizePercentEncoding(component.path);
         }
       }
       if (options.reference !== "suffix" && component.scheme) {
+        component.scheme = decodeValidScheme(component.scheme);
         uriTokens.push(component.scheme, ":");
       }
       const authority = recomposeAuthority(component);
@@ -3764,16 +3988,19 @@ var require_fast_uri = __commonJS({
         if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
           s = removeDotSegments(s);
         }
+        if (pathNoScheme) {
+          s = serializePathEncoding(s, true);
+        }
         if (authority === void 0 && s[0] === "/" && s[1] === "/") {
           s = "/%2F" + s.slice(2);
         }
         uriTokens.push(s);
       }
       if (component.query !== void 0) {
-        uriTokens.push("?", component.query);
+        uriTokens.push("?", encodeQuery(component.query));
       }
       if (component.fragment !== void 0) {
-        uriTokens.push("#", component.fragment);
+        uriTokens.push("#", encodeFragment(component.fragment));
       }
       return uriTokens.join("");
     }
@@ -3789,6 +4016,35 @@ var require_fast_uri = __commonJS({
       }
       return void 0;
     }
+    function hasMalformedPercentEncoding(component) {
+      if (component === void 0) return false;
+      let percent = component.indexOf("%");
+      while (percent !== -1) {
+        if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+          return true;
+        }
+        percent = component.indexOf("%", percent + 3);
+      }
+      return false;
+    }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
+    function hasMalformedComponentPercentEncoding(matches) {
+      const host = matches[4];
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+    }
+    function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+        try {
+          parsed.host = new URL("http://" + parsed.host).hostname;
+        } catch (e) {
+          parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+          return true;
+        }
+      }
+      return false;
+    }
     function parseWithStatus(uri, opts) {
       const options = Object.assign({}, opts);
       const parsed = {
@@ -3801,6 +4057,11 @@ var require_fast_uri = __commonJS({
         fragment: void 0
       };
       let malformedAuthorityOrPort = false;
+      let malformedPercentEncoding = false;
+      let malformedSchemeSpecific = false;
+      let malformedHost = false;
+      let malformedIPLiteral = false;
+      let malformedScheme = false;
       let isIP = false;
       if (options.reference === "suffix") {
         if (options.scheme) {
@@ -3837,6 +4098,19 @@ var require_fast_uri = __commonJS({
         parsed.path = matches[6] || "";
         parsed.query = matches[7];
         parsed.fragment = matches[8];
+        if (parsed.scheme !== void 0) {
+          const decodedScheme = unescape(parsed.scheme);
+          if (VALID_SCHEME.test(decodedScheme)) {
+            parsed.scheme = decodedScheme.toLowerCase();
+          } else {
+            parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+            malformedScheme = true;
+          }
+        }
+        malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+        if (malformedPercentEncoding) {
+          parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+        }
         if (isNaN(parsed.port)) {
           parsed.port = matches[5];
         }
@@ -3848,9 +4122,16 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv4(parsed.host);
           if (ipv4result === false) {
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
-            parsed.host = ipv6result.host.toLowerCase();
-            isIP = ipv6result.isIPV6;
+            isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+            parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+            if (malformedIPLiteral) {
+              parsed.error = parsed.error || "URI host is malformed.";
+              malformedAuthorityOrPort = true;
+            }
           } else {
             isIP = true;
           }
@@ -3868,42 +4149,36 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-          if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-            try {
-              parsed.host = new URL("http://" + parsed.host).hostname;
-            } catch (e) {
-              parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-            }
-          }
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
         }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
-            if (parsed.scheme !== void 0) {
-              parsed.scheme = unescape(parsed.scheme);
-            }
-            if (parsed.host !== void 0) {
-              parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+            if (parsed.host !== void 0 && !malformedIPLiteral) {
+              const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+              parsed.host = reescapeHostDelimiters(host, isIP);
             }
           }
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
           schemeHandler.parse(parsed, options);
+          if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
+            malformedSchemeSpecific = true;
+          }
         }
       } else {
         parsed.error = parsed.error || "URI can not be parsed.";
       }
-      return { parsed, malformedAuthorityOrPort };
+      return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
     }
     function parse4(uri, opts) {
       return parseWithStatus(uri, opts).parsed;
@@ -3912,20 +4187,28 @@ var require_fast_uri = __commonJS({
       return normalizeStringWithStatus(uri, opts).normalized;
     }
     function normalizeStringWithStatus(uri, opts) {
-      const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+      const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
       return {
-        normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
-        malformedAuthorityOrPort
+        normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+        malformedAuthorityOrPort,
+        malformedPercentEncoding,
+        malformedSchemeSpecific,
+        malformedHost,
+        malformedScheme
       };
     }
     function normalizeComparableURI(uri, opts) {
-      if (typeof uri === "string") {
-        const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
-        return malformedAuthorityOrPort ? void 0 : normalized;
+      if (typeof uri !== "string" && typeof uri !== "object") {
+        return void 0;
       }
-      if (typeof uri === "object") {
-        return serialize(uri, opts);
+      let value;
+      try {
+        value = typeof uri === "string" ? uri : serialize(uri, opts);
+      } catch {
+        return void 0;
       }
+      const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+      return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
     }
     var fastUri = {
       SCHEMES,
@@ -30095,6 +30378,17 @@ var LIBRARIES = [
   }
 ];
 var PNG_MAGIC = Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]);
+var CRC_TABLE = (() => {
+  const table = new Int32Array(256);
+  for (let byte = 0; byte < 256; byte += 1) {
+    let value = byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
+    }
+    table[byte] = value;
+  }
+  return table;
+})();
 var SHOTS_DIR = join12(".panoma", "shots");
 var IGNORE = [
   "# Screenshots your agents leave here for panoma to review.",
@@ -30104,6 +30398,7 @@ var IGNORE = [
   ""
 ].join("\n");
 var MAX_LINE_CHARS = 512 * 1024;
+var MAX_LINE_CHARS2 = 512 * 1024;
 var NEGATED = "(?<!\\b(?:no|nunca|tampoco|ni) )";
 var PATTERNS = [
   {
@@ -30166,7 +30461,6 @@ var PATTERNS = [
     ]
   }
 ];
-var MAX_LINE_CHARS2 = 512 * 1024;
 var run4 = promisify4(execFile4);
 var CANDIDATES2 = [
   { name: "node_modules", tool: "npm", regenerate: "npm install", unambiguous: true },
@@ -30402,7 +30696,7 @@ var MAX = {
   gitAgents: 6,
   proposals: 8,
   proposalSummary: 220,
-  /** Top of the entire document, in characters. Last network, not the first one. */
+  /** Document size, including omission notices. Oversized memory gets an explicit refusal. */
   document: 24e3
 };
 var REASON_WINDOW = {
@@ -30413,6 +30707,7 @@ var REASON_WINDOW = {
 };
 function formatContext(context) {
   const { project } = context;
+  const background = [];
   const lines = [
     `# ${neutralizeInline(project.name)}`,
     "",
@@ -30437,17 +30732,25 @@ function formatContext(context) {
     )} (${project.health.score}/100)`,
     ""
   ];
-  if (context.enrolled) lines.push(...renderEnrolled(context.enrolled), "");
+  const header = lines.join("\n").trimEnd();
+  if (context.enrolled) background.push(renderEnrolled(context.enrolled));
   const description = wrapUntrusted(project.description ?? "", {
     origin: "manifest",
     limit: MAX.description,
     includeNote: false
   });
-  if (description) lines.push("## What it is", description, "");
-  if (context.delta) lines.push(...renderDelta(context.delta, context.recentWork), "");
+  if (description) background.push(["## What it is", description]);
+  if (context.delta) background.push(renderDelta(context.delta, context.recentWork));
   if (context.pending && context.pending.length > 0) {
-    lines.push(...renderPending(context.pending), "");
-  }
+    background.push(renderPending(context.pending));
+  }
+  const patrolNotice = sentinelNotice(context.sentinels);
+  let patrolTold = false;
+  const tellPatrol = () => {
+    if (!patrolNotice || patrolTold) return;
+    lines.push(patrolNotice, "");
+    patrolTold = true;
+  };
   if (context.notes && context.notes.length > 0) {
     const usage = context.noteUsage ? ` [${Math.round(context.noteUsage.used / Math.max(context.noteUsage.budget, 1) * 100)}% \u2014 ${context.noteUsage.used}/${context.noteUsage.budget} chars]` : "";
     const body = context.notes.map((note) => `- ${neutralizeInline(note.body, 500)} \u2014 ${neutralizeInline(note.createdBy, 60)}`).join("\n");
@@ -30467,16 +30770,72 @@ function formatContext(context) {
     }
     if (context.noteUsage?.sleeping) {
       lines.push(
-        `(${context.noteUsage.sleeping} more sleep on path triggers and fire when their files are touched.)`
+        `(${context.noteUsage.sleeping} more sleep on path triggers. Retrieve them before editing with panoma_context and files, or with task.)`
       );
     }
+    tellPatrol();
     lines.push("");
   } else if (context.noteUsage && (context.noteUsage.pending > 0 || context.noteUsage.sleeping)) {
     const bits = [];
     if (context.noteUsage.pending > 0) bits.push(`${context.noteUsage.pending} proposed and awaiting review`);
     if (context.noteUsage.sleeping) bits.push(`${context.noteUsage.sleeping} asleep on path triggers`);
-    lines.push(`No always-on project memory (${bits.join("; ")}).`, "");
+    lines.push(`No always-on project memory (${bits.join("; ")}).`);
+    tellPatrol();
+    lines.push("");
   }
+  if (context.pathNotes && context.pathNotes.length > 0) {
+    tellPatrol();
+    const body = context.pathNotes.map((note) => {
+      const [first, ...rest] = note.files;
+      const reason = first === void 0 || first === note.trigger ? "" : ` \u2014 matches ${neutralizeInline(first, 120)}${rest.length > 0 ? ` (+${rest.length} more)` : ""}`;
+      return `- ${neutralizeInline(note.trigger, 120)}${reason}
+${note.body}`;
+    }).join("\n\n");
+    lines.push(
+      "## Project memory for the requested files",
+      wrapUntrusted(body, { origin: "notes", limit: body.length, includeNote: false }),
+      "Owner-approved rules whose path triggers match the files you supplied. Read each complete rule before editing.",
+      ""
+    );
+  } else if (context.memoryFiles && context.memoryFiles.length > 0) {
+    lines.push("No approved path-specific rules match the requested files.", "");
+  }
+  if (context.taskNotes !== void 0 || context.taskDecisions !== void 0) {
+    tellPatrol();
+    const taskNotes = context.taskNotes ?? [];
+    const taskDecisions = context.taskDecisions ?? [];
+    lines.push("## Project memory for your task");
+    if (taskNotes.length === 0 && taskDecisions.length === 0) {
+      lines.push("Nothing approved matches the words of your task.");
+    } else {
+      const body = [
+        ...taskNotes.map(
+          (note) => `- ${neutralizeInline(note.body, 500)} \u2014 ${matchedIn(note)}; sleeps on ${neutralizeInline(note.trigger, 120)}`
+        ),
+        ...taskDecisions.map((one) => `${renderDecision(one)} \u2014 matched ${quoted(one.matched)} in decision`)
+      ].join("\n");
+      lines.push(
+        wrapUntrusted(body, { origin: "notes", limit: Math.max(4e3, body.length), includeNote: false }),
+        "",
+        "Owner-approved rules and decisions whose words overlap your task. The matched words are the reason they are here, not proof they apply; read each one against what you are doing."
+      );
+    }
+    const left = omittedSentence(context.taskOmitted);
+    if (left) lines.push(left);
+    lines.push("");
+  }
+  if (context.decisions && context.decisions.length > 0) {
+    const body = context.decisions.map(renderDecision).join("\n");
+    lines.push(
+      "## Owner decisions",
+      wrapUntrusted(body, { origin: "notes", limit: Math.max(4e3, body.length), includeNote: false }),
+      "",
+      "Decisions the owner recorded in their own words, with their reasons. Follow them where their conditions hold; where an exception applies or a condition is not met, say so and ask before deviating.",
+      ""
+    );
+  }
+  const memoryEnd = lines.length;
+  const finishBackgroundSection = () => background.push(lines.splice(memoryEnd));
   const byKind = /* @__PURE__ */ new Map();
   const stack = [...context.stack].sort((a, b) => a.kind.localeCompare(b.kind, "en") || a.name.localeCompare(b.name, "en")).slice(0, MAX.stack);
   for (const tech of stack) {
@@ -30492,6 +30851,7 @@ function formatContext(context) {
       lines.push(`- \u2026and ${context.stack.length - MAX.stack} more`);
     }
     lines.push("");
+    finishBackgroundSection();
   }
   if (context.security.length > 0) {
     const sorted = [...context.security].sort(
@@ -30510,6 +30870,7 @@ function formatContext(context) {
       lines.push(`\u2026and ${sorted.length - MAX.vulnerabilities} more advisories`);
     }
     lines.push("");
+    finishBackgroundSection();
   }
   const { outdated, total, unpinned } = context.dependencies;
   lines.push(`## Dependencies`);
@@ -30529,6 +30890,7 @@ function formatContext(context) {
   }
   if (deps.length > MAX.dependencies) lines.push(`- \u2026and ${deps.length - MAX.dependencies} more`);
   lines.push("");
+  finishBackgroundSection();
   if (context.openTasks.length > 0) {
     const tasks = [...context.openTasks].sort(
       (a, b) => a.status.localeCompare(b.status, "en") || a.id.localeCompare(b.id)
@@ -30550,6 +30912,7 @@ function formatContext(context) {
     const totalTasks = context.openTaskTotal ?? tasks.length;
     if (totalTasks > MAX.tasks) lines.push(`\u2026and ${totalTasks - MAX.tasks} more open tasks`);
     lines.push("");
+    finishBackgroundSection();
   }
   if (context.recentWork.length > 0) {
     const work = [...context.recentWork].sort(
@@ -30569,11 +30932,65 @@ function formatContext(context) {
   } else {
     lines.push("No agent has logged any work in this project yet.");
   }
-  const text = lines.filter((line, index, all) => line !== "" || all[index - 1] !== "").join("\n");
-  if (text.length <= MAX.document) return text;
-  return `${text.slice(0, MAX.document)}
+  finishBackgroundSection();
+  const required2 = lines.join("\n").trimEnd();
+  const sections = background.map((section) => section.join("\n").trim()).filter(Boolean);
+  const complete = [required2, ...sections].join("\n\n");
+  if (complete.length <= MAX.document) return complete;
+  const omitted = "[Panoma omitted background sections to keep this briefing bounded. Project memory is complete, including the rules pinned to the files you named and the matches for your task; request panoma_context without files or task, panoma_tasks or panoma_recall for more.]";
+  if (required2.length + omitted.length + 2 > MAX.document) {
+    return `${header}
 
-[Panoma cut here: this project's context runs past ${MAX.document} characters. What is missing are the sections below; ask for them with the specific tools (panoma_tasks) if you need them.]`;
+[Project memory could not be delivered within the ${MAX.document}-character briefing limit. No memory rules, task matches, owner decision previews or background sections are included. This is not an absence of memory. Request fewer files or a narrower task, or ask the owner to consolidate the project's notes before relying on this briefing.]`;
+  }
+  const kept = [required2];
+  let used = required2.length + omitted.length + 2;
+  for (const section of sections) {
+    if (used + section.length + 2 > MAX.document) continue;
+    kept.push(section);
+    used += section.length + 2;
+  }
+  return [...kept, omitted].join("\n\n");
+}
+function renderDecision(one) {
+  const parts = [`- ${neutralizeInline(one.decision, 300)}`];
+  if (one.rationale) parts.push(`because ${neutralizeInline(one.rationale, 300)}`);
+  if (one.conditions) parts.push(`when ${neutralizeInline(one.conditions, 300)}`);
+  if (one.exceptions) parts.push(`except ${neutralizeInline(one.exceptions, 300)}`);
+  const incomplete = one.incomplete ? " [Incomplete record: do not apply until the owner supplies the full decision and its conditions.]" : "";
+  const source = one.source ? ` Source: ${neutralizeInline(one.source, 500)}` : "";
+  return `${parts.join(" \u2014 ")} (${one.scope === "project" ? "this project" : "every project"}, ${one.recordedAt})${incomplete}${source}`;
+}
+function quoted(words2) {
+  return words2.map((word) => `\u201C${neutralizeInline(word, 60)}\u201D`).join(", ");
+}
+function matchedIn(note) {
+  const body = words(note.body);
+  const trigger = words(note.trigger);
+  const inBody = note.matched.filter((word) => body.has(word));
+  const inTrigger = note.matched.filter((word) => !body.has(word) && trigger.has(word));
+  const elsewhere = note.matched.filter((word) => !body.has(word) && !trigger.has(word));
+  const parts = [];
+  if (inBody.length > 0) parts.push(`${quoted(inBody)} in body`);
+  if (inTrigger.length > 0) parts.push(`${quoted(inTrigger)} in trigger`);
+  if (elsewhere.length > 0) parts.push(quoted(elsewhere));
+  return `matched ${parts.join(" and ")}`;
+}
+function words(text) {
+  return new Set(text.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().match(/[\p{L}\p{N}]+/gu) ?? []);
+}
+function omittedSentence(omitted) {
+  if (!omitted || omitted.notes <= 0 && omitted.decisions <= 0) return void 0;
+  const parts = [];
+  if (omitted.notes > 0) parts.push(`${omitted.notes} more ${omitted.notes === 1 ? "note" : "notes"}`);
+  if (omitted.decisions > 0) parts.push(`${omitted.decisions} more ${omitted.decisions === 1 ? "decision" : "decisions"}`);
+  return `${parts.join(" and ")} matched but did not fit; narrow the task or ask the owner to consolidate.`;
+}
+function sentinelNotice(sentinels) {
+  if (!sentinels) return void 0;
+  if (!sentinels.skipped && sentinels.unverified <= 0) return void 0;
+  const reason = sentinels.skipped === "remote" ? "the catalog is remote." : sentinels.skipped === "root-missing" ? "the project root is not on this disk." : sentinels.unverified === 1 ? "one of their anchors could not be read." : `${sentinels.unverified} of their anchors could not be read.`;
+  return `(Anchored notes were not re-checked against the disk before this delivery: ${reason} Treat their file claims as unverified.)`;
 }
 function renderDelta(delta, recentWork) {
   const since = Date.parse(delta.since);
@@ -30719,19 +31136,41 @@ ${indentBody(`How it ended: ${task.result}`, MAX.taskResult)}` : "";
 \u2026and ${sorted.length - 50} more tasks` : "";
   return `${wrapUntrusted(body, { origin: "tasks", limit: 12e3 })}${extra}`;
 }
-function formatRecall(query, matches) {
+function formatRecall(query, matches, nextCursor) {
   if (matches.length === 0) {
     return `Nothing in this project's journal matches \u201C${neutralizeInline(query, 120)}\u201D. The journal only knows what agents logged with panoma_log \u2014 silence here does not mean it never happened.`;
   }
   const body = matches.map((hit) => {
     const day = hit.at.slice(0, 10);
-    const detail = hit.details ? `
-${indentBody(hit.details, 600)}` : "";
-    return `- ${day} \xB7 ${neutralizeInline(hit.agent, 60)} [${neutralizeInline(hit.kind, 20)}] ${neutralizeInline(hit.summary, 300)}${detail}`;
+    const evidence = hit.excerpt ?? (hit.details ? legacyRecallExcerpt(hit.details, query) : null);
+    const detail = evidence ? `
+${indentBody(evidence, evidence.length)}` : "";
+    const id = hit.id ? `
+  Original: panoma_recall entryId="${neutralizeInline(hit.id, 128)}"` : "";
+    return `- ${day} \xB7 ${neutralizeInline(hit.agent, 60)} [${neutralizeInline(hit.kind, 20)}] ${neutralizeInline(hit.summary, 300)}${detail}${id}`;
   }).join("\n");
   return [
     `Journal matches for \u201C${neutralizeInline(query, 120)}\u201D (newest first):`,
-    wrapUntrusted(body, { origin: "journal", limit: 1e4, includeNote: false })
+    wrapUntrusted(body, { origin: "journal", limit: body.length, includeNote: false }),
+    ...nextCursor ? [`More results: call panoma_recall with the same query and cursor="${neutralizeInline(nextCursor, 4096)}".`] : []
+  ].join("\n");
+}
+function legacyRecallExcerpt(details, query) {
+  if (details.length <= 1200) return details;
+  const terms = query.replace(/(?:^|\s)-(?:"[^"]*"|\S+)/g, " ").match(/[\p{L}\p{N}_-]+/gu) ?? [];
+  const positions = terms.filter((term) => term.toLowerCase() !== "or").map(
+    (term) => new RegExp(term.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "iu").exec(details)?.index ?? -1
+  ).filter((position) => position >= 0);
+  const start = positions.length ? Math.max(0, Math.min(...positions) - 100) : 0;
+  const end = Math.min(details.length, start + 1200);
+  return `${start > 0 ? "\u2026" : ""}${details.slice(start, end)}${end < details.length ? "\u2026" : ""}`;
+}
+function formatJournalEntry(entry) {
+  return [
+    `Journal original ${neutralizeInline(entry.id, 128)} \xB7 ${neutralizeInline(entry.agent, 60)} [${neutralizeInline(entry.kind, 20)}] ${neutralizeInline(entry.at, 40)}`,
+    `Characters ${entry.offset}\u2013${entry.offset + entry.text.length} of ${entry.totalChars}.`,
+    wrapUntrusted(entry.text, { origin: "journal", limit: entry.text.length, includeNote: false }),
+    entry.nextOffset === null ? "End of entry." : `Continue with panoma_recall entryId="${neutralizeInline(entry.id, 128)}" offset=${entry.nextOffset}.`
   ].join("\n");
 }
 
@@ -30758,14 +31197,20 @@ server.registerTool(
   "panoma_context",
   {
     title: "Project brief",
-    description: "The brief for this project: what changed since yesterday and which agent changed it, which proposals are parked waiting on a human decision, which tasks are yours to pick up, and what it is built with \u2014 stack, outdated dependencies, known vulnerabilities, and what other AI agents did here before you. Call it when you start working, before you go exploring files, and again every day you come back: half of what it carries changes from one night to the next. If the project is not in the catalog, it analyses it and enrols it on the spot, so it works the first time too.",
-    inputSchema: location
+    description: "The brief for this project: what changed since yesterday and which agent changed it, which proposals are parked waiting on a human decision, which tasks are yours to pick up, the decisions the owner recorded here with their reasons and exceptions, and what it is built with \u2014 stack, outdated dependencies, known vulnerabilities, and what other AI agents did here before you. Call it when you start working, before you go exploring files, and again every day you come back: half of what it carries changes from one night to the next. If the project is not in the catalog, it analyses it and enrols it on the spot, so it works the first time too. Before editing, pass files with the project-relative paths you plan to touch: this also returns their approved local rules in every connected client. Before starting a job, or when you are stuck on an error, pass task \u2014 one sentence saying what you are about to do or what you are looking at \u2014 and the rules and owner decisions whose words overlap it come back with the matched words as the reason.",
+    inputSchema: {
+      ...location,
+      files: external_exports.array(external_exports.string().min(1).max(2048)).max(30).optional().describe("Files to check for applicable project memory, relative to the project root. At most 30."),
+      task: external_exports.string().min(1).max(1e3).optional().describe(
+        "What you are about to do, or the error you are looking at, in one sentence. Returns the approved rules and owner decisions whose words overlap it, with the matched words as the reason. Pair it with files."
+      )
+    }
   },
-  async ({ path }) => tool(async () => {
+  async ({ path, files, task }) => tool(async () => {
     const where = await describeLocation(path);
     const context = await client.post(
       "/api/agent/context",
-      where
+      { ...where, ...files !== void 0 ? { files } : {}, ...task !== void 0 ? { task } : {} }
     );
     return formatContext(context);
   })()
@@ -30804,7 +31249,7 @@ server.registerTool(
       doesn’t go to anyone until the person approves it, and a model to which immediate
       persistence is promised would consider it done.
      */
-    description: "Propose a durable fact about this project for its curated memory: something that will still be true next month and that every agent should know before acting \u2014 \u201Ctests need a build first on a cold tree\u201D, \u201Cthe server on 4173 is a production build\u201D. One or two sentences, 500 characters at most. The owner reviews it before it reaches anyone: panoma_context serves only approved notes, under a shared budget. For what you *did*, use panoma_log instead \u2014 the journal records events; memory keeps rules. If the fact belongs to one PLACE \u2014 a file or directory \u2014 add `where`: the note then sleeps outside the budget and fires exactly when an agent is about to touch that path.",
+    description: "Propose a durable fact about this project for its curated memory: something that will still be true next month and that every agent should know before acting \u2014 \u201Ctests need a build first on a cold tree\u201D, \u201Cthe server on 4173 is a production build\u201D. One or two sentences, 500 characters at most. The owner reviews it before it reaches anyone: panoma_context serves only approved notes, under a shared budget. For what you *did*, use panoma_log instead \u2014 the journal records events; memory keeps rules. If the fact belongs to one PLACE \u2014 a file or directory \u2014 add `where`: the note then sleeps outside the budget. Retrieve its rule before editing with panoma_context and the files input.",
     inputSchema: {
       ...location,
       note: external_exports.string().describe("The durable fact, in one or two sentences."),
@@ -30831,16 +31276,19 @@ server.registerTool(
       report (window), the memory (rules), and the archive (history)— because a model with three
       sources and no map asks the one that is not.
      */
-    description: `Search this project's full journal \u2014 everything any agent ever logged here, not just the recent window panoma_context shows. Use it for history: \u201Chow was the broken catalog fixed\u201D, \u201Cdid anyone already try upgrading X\u201D. Words or a "quoted phrase"; matches only what was logged, in the language it was logged in. For durable rules, the memory block in panoma_context already has them.`,
+    description: `Search this project's full journal \u2014 everything any agent ever logged here, not just the recent window panoma_context shows. Use it for history: \u201Chow was the broken catalog fixed\u201D, \u201Cdid anyone already try upgrading X\u201D. Words or a "quoted phrase"; matches only what was logged, in the language it was logged in. Results include matched excerpts and entry IDs. Pass entryId to read a complete original in bounded segments; continue with its nextOffset. Continue a search with its nextCursor and the same query. For durable rules use panoma_context, with files for rules attached to specific paths.`,
     inputSchema: {
       ...location,
-      query: external_exports.string().describe('What to look for \u2014 words, or a "quoted phrase".')
+      query: external_exports.string().min(1).max(1e3).optional().describe("Search words or a quoted phrase. Omit when opening an entryId."),
+      cursor: external_exports.string().max(4096).optional().describe("The nextCursor of a search, copied verbatim with the same query."),
+      entryId: external_exports.string().max(128).optional().describe("An ID returned by this project's journal search. Opens the original."),
+      offset: external_exports.number().int().nonnegative().optional().describe("The nextOffset returned by an original entry read.")
     }
   },
-  async ({ path, query }) => tool(async () => {
+  async ({ path, query, cursor, entryId, offset }) => tool(async () => {
     const where = await describeLocation(path);
-    const result = await client.post("/api/agent/journal", { ...where, query });
-    return formatRecall(result.query, result.matches);
+    const result = await client.post("/api/agent/journal", { ...where, query, cursor, entryId, offset });
+    return result.entry ? formatJournalEntry(result.entry) : formatRecall(result.query, result.matches, result.nextCursor);
   })()
 );
 server.registerTool(