@hasna/mementos 0.14.80 → 0.14.82

package/dist/index.js

@@ -50488,6 +50488,98 @@ function getMementosPackageVersion() {
 // src/db/memory-project-link.ts
 init_schema();
 
+// src/project-registration/types.ts
+var MEMENTOS_PROJECT_REGISTRATION_ROUTE = "mementos.project-registration.v1";
+var MEMENTOS_PROJECT_REGISTRATION_CALLER_ROUTE = "projects.full-registration.v1";
+var MEMENTOS_PROJECT_REGISTRATION_SCHEMA_VERSION = 1;
+var MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE = "mementos.project-guarded-update.v1";
+var MEMENTOS_PROJECT_RESOURCE_ROUTE = "mementos.project-resources.v1";
+var MEMENTOS_PROJECT_RESOURCE_KINDS = [
+  "project",
+  "knowledge",
+  "memory",
+  "session"
+];
+
+class MementosProjectRegistrationError extends Error {
+  code;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "MementosProjectRegistrationError";
+  }
+}
+
+// src/project-registration/identity.ts
+var MEMENTOS_PROJECT_AUTHORITY_ENV = {
+  authorityId: "MEMENTOS_PROJECT_AUTHORITY_ID",
+  tenantId: "MEMENTOS_PROJECT_TENANT_ID",
+  corpusId: "MEMENTOS_PROJECT_CORPUS_ID"
+};
+function configuredValue(override, envKey) {
+  return override?.trim() || process.env[envKey]?.trim() || null;
+}
+
+class MementosProjectAuthorityIdentityError extends Error {
+  missing_env;
+  code = "MEMENTOS_PROJECT_AUTHORITY_UNCONFIGURED";
+  constructor(missing_env) {
+    super("Mementos project authority identity is not configured; set " + missing_env.join(", "));
+    this.missing_env = missing_env;
+    this.name = "MementosProjectAuthorityIdentityError";
+  }
+}
+function resolveMementosProjectAuthorityIdentity(options = {}) {
+  const authorityId = configuredValue(options.authorityId, MEMENTOS_PROJECT_AUTHORITY_ENV.authorityId);
+  const tenantId = configuredValue(options.tenantId, MEMENTOS_PROJECT_AUTHORITY_ENV.tenantId);
+  const corpusId = configuredValue(options.corpusId, MEMENTOS_PROJECT_AUTHORITY_ENV.corpusId);
+  if (!authorityId || !tenantId || !corpusId) {
+    const missingEnv = [];
+    if (!authorityId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.authorityId);
+    if (!tenantId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.tenantId);
+    if (!corpusId)
+      missingEnv.push(MEMENTOS_PROJECT_AUTHORITY_ENV.corpusId);
+    throw new MementosProjectAuthorityIdentityError(missingEnv);
+  }
+  return {
+    authority_id: authorityId,
+    tenant_id: tenantId,
+    corpus_id: corpusId
+  };
+}
+function buildMementosProjectRegistrationCapability(options = {}) {
+  const identity = resolveMementosProjectAuthorityIdentity(options);
+  return {
+    authority: "mementos",
+    route: MEMENTOS_PROJECT_REGISTRATION_ROUTE,
+    package_version: options.packageVersion ?? getMementosPackageVersion(),
+    ...identity,
+    supported_resources: ["project"],
+    conditional_create: true,
+    immutable_receipts: true,
+    exact_terminal_lookup: true,
+    exact_readback: true,
+    conditional_inverse: true,
+    ambiguous_outcome_reconciliation: true,
+    guarded_update: true,
+    guarded_update_route: MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
+    no_write_dry_run: true,
+    expected_revision_compare_and_swap: true,
+    caller_idempotency: true,
+    exact_inverse_rollback: true,
+    project_resource_enumeration: true,
+    project_resource_route: MEMENTOS_PROJECT_RESOURCE_ROUTE,
+    project_resource_kinds: ["project", "knowledge", "memory", "session"],
+    stable_keyset_pagination: true,
+    explicit_membership_only: true
+  };
+}
+
+// src/db/memory-project-link.ts
 class MemoryProjectLinkError extends Error {
   code;
   details;
@@ -50498,12 +50590,17 @@ class MemoryProjectLinkError extends Error {
     this.name = "MemoryProjectLinkError";
   }
 }
-var LINK_AUTHORITY = {
-  authority_id: "mementos",
-  tenant_id: "default",
-  corpus_id: "default"
-};
 var BOUNDED_IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
+function linkAuthority() {
+  try {
+    return resolveMementosProjectAuthorityIdentity();
+  } catch (error) {
+    if (error instanceof MementosProjectAuthorityIdentityError) {
+      throw new MemoryProjectLinkError("MEMORY_PROJECT_LINK_AUTHORITY_MISMATCH", error.message, { authority_code: error.code, missing_env: error.missing_env });
+    }
+    throw error;
+  }
+}
 function canonicalize(value) {
   if (Array.isArray(value))
     return value.map(canonicalize);
@@ -50611,7 +50708,8 @@ function receiptFromRow(row) {
   };
 }
 function assertIdentity(identity) {
-  if (identity.authority_id !== LINK_AUTHORITY.authority_id || identity.tenant_id !== LINK_AUTHORITY.tenant_id || identity.corpus_id !== LINK_AUTHORITY.corpus_id) {
+  const expectedIdentity = linkAuthority();
+  if (identity.authority_id !== expectedIdentity.authority_id || identity.tenant_id !== expectedIdentity.tenant_id || identity.corpus_id !== expectedIdentity.corpus_id) {
     throw new MemoryProjectLinkError("MEMORY_PROJECT_LINK_AUTHORITY_MISMATCH", "memory project link does not match this authority, tenant, and corpus");
   }
 }
@@ -51088,7 +51186,7 @@ function rollbackMemoryProjectLink(memoryId, request, db) {
     };
   });
 }
-function getMemoryProjectLinkReceipt(memoryId, receiptId, identity = LINK_AUTHORITY, db) {
+function getMemoryProjectLinkReceipt(memoryId, receiptId, identity = linkAuthority(), db) {
   assertIdentity(identity);
   assertBoundedIdentifier(memoryId, "memory_id");
   assertBoundedIdentifier(receiptId, "receipt_id");
@@ -51553,25 +51651,6 @@ function focusFilterSQL(agentId, projectId) {
 init_database();
 init_api_mode();
 import { createHash as createHash2 } from "crypto";
-
-// src/project-registration/types.ts
-var MEMENTOS_PROJECT_REGISTRATION_ROUTE = "mementos.project-registration.v1";
-var MEMENTOS_PROJECT_REGISTRATION_CALLER_ROUTE = "projects.full-registration.v1";
-var MEMENTOS_PROJECT_REGISTRATION_SCHEMA_VERSION = 1;
-var MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE = "mementos.project-guarded-update.v1";
-
-class MementosProjectRegistrationError extends Error {
-  code;
-  details;
-  constructor(code, message, details = {}) {
-    super(message);
-    this.code = code;
-    this.details = details;
-    this.name = "MementosProjectRegistrationError";
-  }
-}
-
-// src/db/projects.ts
 function parseProjectRow2(row) {
   return {
     id: row["id"],
@@ -51605,12 +51684,17 @@ class ProjectGuardedUpdateError extends Error {
     this.name = "ProjectGuardedUpdateError";
   }
 }
-var PROJECT_UPDATE_AUTHORITY = {
-  authority_id: "mementos",
-  tenant_id: "default",
-  corpus_id: "default"
-};
 var BOUNDED_IDENTIFIER2 = /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/;
+function projectUpdateAuthority() {
+  try {
+    return resolveMementosProjectAuthorityIdentity();
+  } catch (error) {
+    if (error instanceof MementosProjectAuthorityIdentityError) {
+      throw new ProjectGuardedUpdateError("PROJECT_UPDATE_AUTHORITY_MISMATCH", error.message, { authority_code: error.code, missing_env: error.missing_env });
+    }
+    throw error;
+  }
+}
 function canonicalizeProjectUpdateValue(value) {
   if (Array.isArray(value))
     return value.map(canonicalizeProjectUpdateValue);
@@ -51683,8 +51767,8 @@ function normalizeProjectUpdateInput(input) {
   }
   return normalized;
 }
-function assertProjectUpdateIdentity(identity) {
-  if (identity.authority_id !== PROJECT_UPDATE_AUTHORITY.authority_id || identity.tenant_id !== PROJECT_UPDATE_AUTHORITY.tenant_id || identity.corpus_id !== PROJECT_UPDATE_AUTHORITY.corpus_id) {
+function assertProjectUpdateIdentity(identity, expectedIdentity = projectUpdateAuthority()) {
+  if (identity.authority_id !== expectedIdentity.authority_id || identity.tenant_id !== expectedIdentity.tenant_id || identity.corpus_id !== expectedIdentity.corpus_id) {
     throw new ProjectGuardedUpdateError("PROJECT_UPDATE_AUTHORITY_MISMATCH", "guarded project update does not match this authority, tenant, and corpus");
   }
 }
@@ -51693,8 +51777,8 @@ function assertBoundedIdentifier2(value, field) {
     throw new ProjectGuardedUpdateError("PROJECT_UPDATE_INVALID_INPUT", `${field} must be an 8-128 character bounded identifier`);
   }
 }
-function assertProjectUpdateRequest(request) {
-  assertProjectUpdateIdentity(request);
+function assertProjectUpdateRequest(request, expectedIdentity = projectUpdateAuthority()) {
+  assertProjectUpdateIdentity(request, expectedIdentity);
   assertBoundedIdentifier2(request.operation_id, "operation_id");
   assertBoundedIdentifier2(request.step_id, "step_id");
   assertBoundedIdentifier2(request.idempotency_key, "idempotency_key");
@@ -51807,7 +51891,7 @@ function makeProjectUpdateReceipt(input) {
     target_id: input.target_id,
     expected_revision: input.request.expected_revision,
     result_revision: input.after_project.updated_at,
-    result_digest: digestProjectUpdateValue(input.after_project),
+    result_digest: input.result_digest ?? digestProjectUpdateValue(input.after_project),
     accepted_receipt_id: input.accepted_receipt_id ?? null,
     before_project: input.before_project,
     after_project: input.after_project,
@@ -51871,8 +51955,8 @@ function listProjects(db) {
   const rows = d.query("SELECT * FROM projects ORDER BY updated_at DESC").all();
   return rows.map(parseProjectRow2);
 }
-function previewProjectUpdate(id, request, db) {
-  assertProjectUpdateRequest(request);
+function previewProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority()) {
+  assertProjectUpdateRequest(request, expectedIdentity);
   const normalized = normalizeProjectUpdateInput(request.updates);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", `/projects/${encodeURIComponent(id)}/guarded-update`, { ...request, updates: normalized, dry_run: true });
@@ -51894,8 +51978,8 @@ function previewProjectUpdate(id, request, db) {
     receipt: null
   };
 }
-function applyProjectUpdate(id, request, db) {
-  assertProjectUpdateRequest(request);
+function applyProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority(), resultDigestForProject) {
+  assertProjectUpdateRequest(request, expectedIdentity);
   const normalized = normalizeProjectUpdateInput(request.updates);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", `/projects/${encodeURIComponent(id)}/guarded-update`, { ...request, updates: normalized, dry_run: false });
@@ -51956,14 +52040,15 @@ function applyProjectUpdate(id, request, db) {
       request_digest: requestDigest,
       target_id: id,
       before_project: before,
-      after_project: readback
+      after_project: readback,
+      result_digest: resultDigestForProject?.(readback)
     });
     insertProjectUpdateReceipt(d, receipt);
     return { dry_run: false, applied: true, project: readback, receipt };
   });
 }
-function rollbackProjectUpdate(id, request, db) {
-  assertProjectUpdateRequest(request);
+function rollbackProjectUpdate(id, request, db, expectedIdentity = projectUpdateAuthority(), resultDigestForProject) {
+  assertProjectUpdateRequest(request, expectedIdentity);
   assertBoundedIdentifier2(request.accepted_receipt_id, "accepted_receipt_id");
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", `/projects/${encodeURIComponent(id)}/guarded-rollback`, request);
@@ -52029,14 +52114,15 @@ function rollbackProjectUpdate(id, request, db) {
       target_id: id,
       before_project: current,
       after_project: readback,
+      result_digest: resultDigestForProject?.(readback),
       accepted_receipt_id: accepted.receipt_id
     });
     insertProjectUpdateReceipt(d, receipt);
     return { dry_run: false, applied: true, project: readback, receipt };
   });
 }
-function getProjectUpdateReceipt(id, receiptId, identity = PROJECT_UPDATE_AUTHORITY, db) {
-  assertProjectUpdateIdentity(identity);
+function getProjectUpdateReceipt(id, receiptId, identity = projectUpdateAuthority(), db, expectedIdentity = projectUpdateAuthority()) {
+  assertProjectUpdateIdentity(identity, expectedIdentity);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", `/projects/${encodeURIComponent(id)}/update-receipts/lookup`, { ...identity, receipt_id: receiptId });
     return data;
@@ -52178,9 +52264,9 @@ function assertWithinBounds(value, bounds, startedAt) {
   }
   return { response_bytes: bytes, elapsed_ms: elapsed };
 }
-function withResponseControl(receipt, bounds, startedAt) {
+function withBoundedResponseControl(payload, bounds, startedAt) {
   const result = {
-    receipt,
+    ...payload,
     response_control: {
       response_byte_limit: bounds.response_byte_limit,
       time_budget_ms: bounds.time_budget_ms,
@@ -52203,6 +52289,9 @@ function withResponseControl(receipt, bounds, startedAt) {
   result.response_control.elapsed_ms = measured.elapsed_ms;
   return result;
 }
+function withResponseControl(receipt, bounds, startedAt) {
+  return withBoundedResponseControl({ receipt }, bounds, startedAt);
+}
 function requireString(value, field, options = {}) {
   const min = options.min ?? 1;
   const max = options.max ?? 512;
@@ -52229,6 +52318,80 @@ function ownedPath(target) {
   }
   return path;
 }
+function guardedAuthorityIdentity(capability) {
+  return {
+    authority_id: capability.authority_id,
+    tenant_id: capability.tenant_id,
+    corpus_id: capability.corpus_id
+  };
+}
+function assertGuardedAuthorityRequest(targetId, request, capability) {
+  assertBounds(request);
+  requireString(targetId, "target_id", { min: 8, max: 128, pattern: OPERATION_PATTERN });
+  if (request.authority !== "mementos" || request.authority_route !== MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE || request.package_version !== capability.package_version || request.authority_id !== capability.authority_id || request.tenant_id !== capability.tenant_id || request.corpus_id !== capability.corpus_id) {
+    throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "guarded project request does not match this authority capability identity");
+  }
+  return guardedAuthorityIdentity(capability);
+}
+function assertGuardedOperationFields(request) {
+  requireString(request.operation_id, "operation_id", {
+    min: 8,
+    max: 128,
+    pattern: OPERATION_PATTERN
+  });
+  requireString(request.step_id, "step_id", {
+    min: 8,
+    max: 128,
+    pattern: OPERATION_PATTERN
+  });
+  requireString(request.idempotency_key, "idempotency_key", {
+    min: 8,
+    max: 128,
+    pattern: OPERATION_PATTERN
+  });
+  requireString(request.expected_revision, "expected_revision", { max: 128 });
+}
+function assertGuardedUpdateRequest(targetId, request, capability) {
+  const identity = assertGuardedAuthorityRequest(targetId, request, capability);
+  assertGuardedOperationFields(request);
+  if (!request.updates || typeof request.updates !== "object") {
+    throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "guarded project updates must contain exactly one private path handle");
+  }
+  exactKeys(request.updates, ["path"], "updates");
+  return { identity, path: ownedPath(request.updates.path) };
+}
+function publicGuardedUpdateReceipt(receipt, capability) {
+  return {
+    receipt_id: receipt.receipt_id,
+    authority: "mementos",
+    route: MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
+    package_version: capability.package_version,
+    authority_id: capability.authority_id,
+    tenant_id: capability.tenant_id,
+    corpus_id: capability.corpus_id,
+    operation_id: receipt.operation_id,
+    step_id: receipt.step_id,
+    direction: receipt.direction,
+    idempotency_key: receipt.idempotency_key,
+    request_digest: receipt.request_digest,
+    outcome: "accepted",
+    target_id: receipt.target_id,
+    expected_revision: receipt.expected_revision,
+    result_revision: receipt.result_revision,
+    result_digest: receipt.result_digest,
+    accepted_receipt_id: receipt.accepted_receipt_id,
+    created_at: receipt.created_at
+  };
+}
+function guardedProjectError(cause) {
+  if (cause instanceof MementosProjectRegistrationError)
+    throw cause;
+  if (cause instanceof ProjectGuardedUpdateError) {
+    const code = cause.code === "PROJECT_UPDATE_INVALID_INPUT" ? "MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT" : cause.code === "PROJECT_UPDATE_AUTHORITY_MISMATCH" ? "MEMENTOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH" : cause.code === "PROJECT_UPDATE_NOT_FOUND" ? "MEMENTOS_PROJECT_REGISTRATION_RECORD_NOT_FOUND" : cause.code === "PROJECT_UPDATE_RECEIPT_NOT_FOUND" ? "MEMENTOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND" : "MEMENTOS_PROJECT_REGISTRATION_CONFLICT";
+    throw new MementosProjectRegistrationError(code, "guarded project operation was rejected without exposing private project data", { project_update_code: cause.code });
+  }
+  throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", "guarded project operation failed before a bounded public result was available");
+}
 function normalizedCallDigest(request) {
   return digestMementosProjectRegistrationValue({
     authority_route: request.authority_route,
@@ -52600,26 +52763,7 @@ class PackageOwnedMementosProjectRegistrationAuthority {
     this.db = db;
     this.now = options.now ?? (() => new Date().toISOString());
     this.faultInjector = options.faultInjector;
-    this.capabilityValue = {
-      authority: "mementos",
-      route: MEMENTOS_PROJECT_REGISTRATION_ROUTE,
-      package_version: options.packageVersion ?? getMementosPackageVersion(),
-      authority_id: options.authorityId ?? "mementos",
-      tenant_id: options.tenantId ?? "default",
-      corpus_id: options.corpusId ?? "default",
-      supported_resources: ["project"],
-      conditional_create: true,
-      immutable_receipts: true,
-      exact_terminal_lookup: true,
-      exact_readback: true,
-      conditional_inverse: true,
-      ambiguous_outcome_reconciliation: true,
-      guarded_update: true,
-      no_write_dry_run: true,
-      expected_revision_compare_and_swap: true,
-      caller_idempotency: true,
-      exact_inverse_rollback: true
-    };
+    this.capabilityValue = buildMementosProjectRegistrationCapability(options);
   }
   fault(point, request) {
     this.faultInjector?.(point, {
@@ -52676,6 +52820,90 @@ class PackageOwnedMementosProjectRegistrationAuthority {
       supported_resources: ["project"]
     };
   }
+  boundedGuardedUpdateResult(targetId2, project, receipt, bounds, startedAt) {
+    if (!receipt || project.id !== targetId2 || receipt.target_id !== targetId2) {
+      throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", "guarded project operation did not return its exact immutable receipt");
+    }
+    if (project.updated_at !== receipt.result_revision) {
+      throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_ATOMICITY_UNAVAILABLE", "guarded project result revision did not match its immutable receipt");
+    }
+    const record = {
+      target_id: targetId2,
+      revision: receipt.result_revision,
+      digest: receipt.result_digest
+    };
+    return withBoundedResponseControl({
+      dry_run: false,
+      applied: true,
+      record,
+      receipt: publicGuardedUpdateReceipt(receipt, this.capabilityValue)
+    }, bounds, startedAt);
+  }
+  async guardedUpdateProject(targetId2, request) {
+    const startedAt = Date.now();
+    const { identity, path } = assertGuardedUpdateRequest(targetId2, request, this.capabilityValue);
+    try {
+      const result = applyProjectUpdate(targetId2, {
+        ...identity,
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        idempotency_key: request.idempotency_key,
+        expected_revision: request.expected_revision,
+        updates: { path }
+      }, this.db, identity, (project) => projectRecord(this.db, project).digest);
+      return this.boundedGuardedUpdateResult(targetId2, result.project, result.receipt, request, startedAt);
+    } catch (cause) {
+      return guardedProjectError(cause);
+    }
+  }
+  async getGuardedProjectUpdateReceipt(targetId2, receiptId2, request) {
+    const startedAt = Date.now();
+    const identity = assertGuardedAuthorityRequest(targetId2, request, this.capabilityValue);
+    requireString(receiptId2, "receipt_id", {
+      min: 8,
+      max: 128,
+      pattern: OPERATION_PATTERN
+    });
+    try {
+      const receipt = getProjectUpdateReceipt(targetId2, receiptId2, identity, this.db, identity);
+      return withBoundedResponseControl({
+        receipt: publicGuardedUpdateReceipt(receipt, this.capabilityValue)
+      }, request, startedAt);
+    } catch (cause) {
+      return guardedProjectError(cause);
+    }
+  }
+  async rollbackGuardedProjectUpdate(targetId2, request) {
+    const startedAt = Date.now();
+    const identity = assertGuardedAuthorityRequest(targetId2, request, this.capabilityValue);
+    assertGuardedOperationFields(request);
+    if (!request.accepted_receipt || typeof request.accepted_receipt !== "object") {
+      throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "conditional rollback requires the exact sanitized accepted receipt");
+    }
+    requireString(request.accepted_receipt.receipt_id, "accepted_receipt.receipt_id", {
+      min: 8,
+      max: 128,
+      pattern: OPERATION_PATTERN
+    });
+    try {
+      const internalAccepted = getProjectUpdateReceipt(targetId2, request.accepted_receipt.receipt_id, identity, this.db, identity);
+      const accepted = publicGuardedUpdateReceipt(internalAccepted, this.capabilityValue);
+      if (accepted.direction !== "forward" || accepted.target_id !== targetId2 || request.expected_revision !== accepted.result_revision || canonicalMementosProjectRegistrationJson(request.accepted_receipt) !== canonicalMementosProjectRegistrationJson(accepted)) {
+        throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "conditional rollback receipt does not exactly match the accepted forward update");
+      }
+      const result = rollbackProjectUpdate(targetId2, {
+        ...identity,
+        operation_id: request.operation_id,
+        step_id: request.step_id,
+        idempotency_key: request.idempotency_key,
+        expected_revision: request.expected_revision,
+        accepted_receipt_id: accepted.receipt_id
+      }, this.db, identity, (project) => projectRecord(this.db, project).digest);
+      return this.boundedGuardedUpdateResult(targetId2, result.project, result.receipt, request, startedAt);
+    } catch (cause) {
+      return guardedProjectError(cause);
+    }
+  }
   async create(request) {
     const startedAt = Date.now();
     const path = assertForwardRequest2(request, this.capabilityValue);
@@ -52772,9 +53000,9 @@ class PackageOwnedMementosProjectRegistrationAuthority {
       throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "resource_kind must be project");
     }
     requireString(request.target_id, "target_id", {
-      min: 51,
-      max: 51,
-      pattern: PROJECT_ID_PATTERN
+      min: 8,
+      max: 128,
+      pattern: OPERATION_PATTERN
     });
     const path = ownedPath(request.target);
     const project = getProjectByExactId3(this.db, request.target_id);
@@ -53033,6 +53261,31 @@ function fromWireReadRequest(body) {
     target: new WirePathHandle(canonicalPath)
   };
 }
+function fromWireGuardedUpdateRequest(body) {
+  const { target_id: targetId2, updates, ...request } = body;
+  if (typeof targetId2 !== "string") {
+    throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "target_id is required on the private guarded-update transport");
+  }
+  if (!updates || typeof updates !== "object" || Array.isArray(updates) || typeof updates["path"] !== "string") {
+    throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", "updates.path is required on the private guarded-update transport");
+  }
+  return {
+    targetId: targetId2,
+    request: {
+      ...request,
+      updates: {
+        path: new WirePathHandle(String(updates["path"]))
+      }
+    }
+  };
+}
+function exactWireIdentifier(body, field) {
+  const value = body[field];
+  if (typeof value !== "string") {
+    throw new MementosProjectRegistrationError("MEMENTOS_PROJECT_REGISTRATION_INVALID_INPUT", `${field} is required on the guarded-update transport`);
+  }
+  return value;
+}
 async function handleMementosProjectRegistrationHttpRequest(request, url, authority, basePath = "/v1/project-registration") {
   const path = url.pathname;
   if (path !== basePath && !path.startsWith(`${basePath}/`))
@@ -53067,6 +53320,21 @@ async function handleMementosProjectRegistrationHttpRequest(request, url, author
     if (action === "verify-inverse") {
       return json({ verification: await authority.verifyInverse(fromWireRequest(body)) });
     }
+    if (action === "projects/guarded-update") {
+      const guarded = fromWireGuardedUpdateRequest(body);
+      return json(await authority.guardedUpdateProject(guarded.targetId, guarded.request));
+    }
+    if (action === "projects/update-receipts/lookup") {
+      const targetId2 = exactWireIdentifier(body, "target_id");
+      const receiptId2 = exactWireIdentifier(body, "receipt_id");
+      const { target_id: _targetId, receipt_id: _receiptId, ...lookup } = body;
+      return json(await authority.getGuardedProjectUpdateReceipt(targetId2, receiptId2, lookup));
+    }
+    if (action === "projects/guarded-rollback") {
+      const targetId2 = exactWireIdentifier(body, "target_id");
+      const { target_id: _targetId, ...rollback } = body;
+      return json(await authority.rollbackGuardedProjectUpdate(targetId2, rollback));
+    }
     return json({
       error: "unknown Mementos project-registration route",
       code: "MEMENTOS_PROJECT_REGISTRATION_RECEIPT_NOT_FOUND"
@@ -53099,6 +53367,15 @@ function toWireRequest(request) {
     canonical_path: extractPath(target)
   };
 }
+function toWireGuardedUpdateRequest(targetId2, request) {
+  return {
+    ...request,
+    target_id: targetId2,
+    updates: {
+      path: extractPath(request.updates.path)
+    }
+  };
+}
 
 class MementosProjectRegistrationHttpClient {
   authority = "mementos";
@@ -53160,10 +53437,333 @@ class MementosProjectRegistrationHttpClient {
     });
     return body.verification;
   }
+  async guardedUpdateProject(targetId2, request) {
+    return this.request("/projects/guarded-update", {
+      method: "POST",
+      body: JSON.stringify(toWireGuardedUpdateRequest(targetId2, request))
+    });
+  }
+  async getGuardedProjectUpdateReceipt(targetId2, receiptId2, request) {
+    return this.request("/projects/update-receipts/lookup", {
+      method: "POST",
+      body: JSON.stringify({ ...request, target_id: targetId2, receipt_id: receiptId2 })
+    });
+  }
+  async rollbackGuardedProjectUpdate(targetId2, request) {
+    return this.request("/projects/guarded-rollback", {
+      method: "POST",
+      body: JSON.stringify({ ...request, target_id: targetId2 })
+    });
+  }
 }
 function createMementosProjectRegistrationHttpClient(options) {
   return new MementosProjectRegistrationHttpClient(options);
 }
+// src/project-registration/project-resources.ts
+init_api_mode();
+init_database();
+var DEFAULT_PAGE_LIMIT = 100;
+var MAX_PAGE_LIMIT = 1000;
+var CURSOR_SCHEMA = "mementos.project-resources.cursor.v1";
+
+class MementosProjectResourceError extends Error {
+  code;
+  details;
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "MementosProjectResourceError";
+  }
+}
+function timestamp(value) {
+  return value instanceof Date ? value.toISOString() : String(value);
+}
+function normalizeSqlValue(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map(normalizeSqlValue);
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, normalizeSqlValue(item)]));
+}
+function exactProject(db, projectId) {
+  const row = db.get("SELECT id, name, path, description, memory_prefix, created_at, updated_at FROM projects WHERE id = ? LIMIT 1", projectId);
+  if (!row) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_PROJECT_NOT_FOUND", `Mementos project not found: ${projectId}`, { project_id: projectId });
+  }
+  return row;
+}
+function resourceKey(resource) {
+  const rank = MEMENTOS_PROJECT_RESOURCE_KINDS.indexOf(resource.resource_kind);
+  return `${String(rank).padStart(2, "0")}:${resource.stable_id}`;
+}
+function projectResource(project) {
+  const normalized = normalizeSqlValue(project);
+  return {
+    authority: "mementos",
+    source_package: "@hasna/mementos",
+    project_id: project.id,
+    resource_kind: "project",
+    stable_id: project.id,
+    revision: timestamp(project.updated_at),
+    digest: digestMementosProjectRegistrationValue(normalized),
+    membership: "project_aggregate"
+  };
+}
+function memoryResources(db, projectId) {
+  const rows = db.all("SELECT * FROM memories WHERE project_id = ? ORDER BY id ASC", projectId);
+  return rows.map((row) => {
+    const memory = normalizeSqlValue(parseMemoryRow(row));
+    return {
+      authority: "mementos",
+      source_package: "@hasna/mementos",
+      project_id: projectId,
+      resource_kind: row["category"] === "knowledge" ? "knowledge" : "memory",
+      stable_id: String(row["id"]),
+      revision: timestamp(row["updated_at"]),
+      digest: digestMementosProjectRegistrationValue(memory),
+      membership: "explicit_project_id_or_focus"
+    };
+  });
+}
+function sessionResources(db, projectId) {
+  const rows = db.all("SELECT * FROM session_memory_jobs WHERE project_id = ? ORDER BY id ASC", projectId);
+  return rows.map((row) => {
+    const normalized = {
+      id: String(row["id"]),
+      session_id: String(row["session_id"]),
+      agent_id: row["agent_id"] === null ? null : String(row["agent_id"] ?? "") || null,
+      project_id: row["project_id"] === null ? null : String(row["project_id"] ?? "") || null,
+      source: String(row["source"]),
+      status: String(row["status"]),
+      transcript: String(row["transcript"]),
+      chunk_count: Number(row["chunk_count"]),
+      memories_extracted: Number(row["memories_extracted"]),
+      error: row["error"] === null ? null : String(row["error"] ?? "") || null,
+      metadata: typeof row["metadata"] === "string" ? JSON.parse(row["metadata"] || "{}") : normalizeSqlValue(row["metadata"] ?? {}),
+      created_at: timestamp(row["created_at"]),
+      started_at: row["started_at"] === null ? null : timestamp(row["started_at"]),
+      completed_at: row["completed_at"] === null ? null : timestamp(row["completed_at"])
+    };
+    return {
+      authority: "mementos",
+      source_package: "@hasna/mementos",
+      project_id: projectId,
+      resource_kind: "session",
+      stable_id: String(row["id"]),
+      revision: timestamp(row["completed_at"] ?? row["started_at"] ?? row["created_at"]),
+      digest: digestMementosProjectRegistrationValue(normalized),
+      membership: "explicit_project_id_or_focus"
+    };
+  });
+}
+function normalizeResourceKinds(value) {
+  if (!value)
+    return [...MEMENTOS_PROJECT_RESOURCE_KINDS];
+  if (value.length === 0) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "resource_kinds must contain at least one supported resource kind");
+  }
+  const requested = new Set(value);
+  for (const kind of requested) {
+    if (!MEMENTOS_PROJECT_RESOURCE_KINDS.includes(kind)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `Unsupported Mementos project resource kind: ${kind}`);
+    }
+  }
+  return MEMENTOS_PROJECT_RESOURCE_KINDS.filter((kind) => requested.has(kind));
+}
+function normalizeLimit(value) {
+  const limit = value ?? DEFAULT_PAGE_LIMIT;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > MAX_PAGE_LIMIT) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `limit must be an integer between 1 and ${MAX_PAGE_LIMIT}`);
+  }
+  return limit;
+}
+function encodeCursor(cursor) {
+  return Buffer.from(JSON.stringify(cursor), "utf8").toString("base64url");
+}
+function decodeCursor(raw) {
+  try {
+    const parsed = JSON.parse(Buffer.from(raw, "base64url").toString("utf8"));
+    if (parsed.schema !== CURSOR_SCHEMA || typeof parsed.project_id !== "string" || typeof parsed.collection_revision !== "string" || !Array.isArray(parsed.resource_kinds) || typeof parsed.after_key !== "string") {
+      throw new Error("invalid cursor shape");
+    }
+    return parsed;
+  } catch {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "cursor is not a valid Mementos project-resource cursor");
+  }
+}
+function localPopulation(projectId, db, resourceKinds) {
+  const project = exactProject(db, projectId);
+  const selected = new Set(resourceKinds);
+  const resources = [
+    ...selected.has("project") ? [projectResource(project)] : [],
+    ...memoryResources(db, projectId).filter((resource) => selected.has(resource.resource_kind)),
+    ...selected.has("session") ? sessionResources(db, projectId) : []
+  ].sort((left, right) => resourceKey(left).localeCompare(resourceKey(right)));
+  const collectionRevision = digestMementosProjectRegistrationValue({
+    schema: MEMENTOS_PROJECT_RESOURCE_ROUTE,
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    resource_kinds: resourceKinds,
+    resources: resources.map((resource) => ({
+      resource_kind: resource.resource_kind,
+      stable_id: resource.stable_id,
+      revision: resource.revision,
+      digest: resource.digest
+    }))
+  });
+  return { project, resources, collectionRevision };
+}
+function readMementosProjectResourcePage(projectId, options = {}, db, authorityOptions = {}) {
+  const resourceKinds = normalizeResourceKinds(options.resource_kinds);
+  const limit = normalizeLimit(options.limit);
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/projects/${encodeURIComponent(projectId)}/resources${toQuery({
+      limit,
+      cursor: options.cursor ?? undefined,
+      resource_kinds: resourceKinds.join(",")
+    })}`);
+    return data;
+  }
+  const d = db ?? getDatabase();
+  const { project, resources, collectionRevision } = localPopulation(projectId, d, resourceKinds);
+  let start = 0;
+  if (options.cursor) {
+    const cursor = decodeCursor(options.cursor);
+    if (cursor.project_id !== projectId || JSON.stringify(cursor.resource_kinds) !== JSON.stringify(resourceKinds)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", "cursor does not belong to this project and resource-kind selection");
+    }
+    if (cursor.collection_revision !== collectionRevision) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource collection changed; restart from the first page", {
+        cursor_collection_revision: cursor.collection_revision,
+        current_collection_revision: collectionRevision
+      });
+    }
+    const afterIndex = resources.findIndex((resource) => resourceKey(resource) === cursor.after_key);
+    if (afterIndex < 0) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource cursor no longer names a member; restart from the first page");
+    }
+    start = afterIndex + 1;
+  }
+  const pageResources = resources.slice(start, start + limit);
+  const hasMore = start + pageResources.length < resources.length;
+  const nextCursor = hasMore && pageResources.length > 0 ? encodeCursor({
+    schema: CURSOR_SCHEMA,
+    project_id: projectId,
+    collection_revision: collectionRevision,
+    resource_kinds: resourceKinds,
+    after_key: resourceKey(pageResources[pageResources.length - 1])
+  }) : null;
+  const capability = buildMementosProjectRegistrationCapability(authorityOptions);
+  return {
+    schema: "mementos.project-resources.v1",
+    authority: {
+      authority: capability.authority,
+      authority_id: capability.authority_id,
+      tenant_id: capability.tenant_id,
+      corpus_id: capability.corpus_id,
+      package_version: capability.package_version
+    },
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    collection_revision: collectionRevision,
+    resource_kinds: resourceKinds,
+    resources: pageResources,
+    count: pageResources.length,
+    total: resources.length,
+    limit,
+    cursor: options.cursor ?? null,
+    next_cursor: nextCursor,
+    has_more: hasMore,
+    complete: true,
+    truncated: false
+  };
+}
+function readAllMementosProjectResources(projectId, options = {}, db, authorityOptions = {}) {
+  const pageSize = normalizeLimit(options.page_size);
+  let cursor = null;
+  let first = null;
+  const resources = [];
+  const seen = new Set;
+  do {
+    const page = readMementosProjectResourcePage(projectId, {
+      limit: pageSize,
+      cursor,
+      resource_kinds: options.resource_kinds
+    }, db, authorityOptions);
+    if (!first)
+      first = page;
+    if (page.collection_revision !== first.collection_revision || page.total !== first.total || JSON.stringify(page.resource_kinds) !== JSON.stringify(first.resource_kinds)) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_COLLECTION_CHANGED", "Mementos project resource collection changed during complete traversal");
+    }
+    for (const resource of page.resources) {
+      const key = resourceKey(resource);
+      if (seen.has(key)) {
+        throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", `Mementos project resource traversal returned duplicate stable ID: ${key}`);
+      }
+      seen.add(key);
+      resources.push(resource);
+    }
+    if (page.has_more && !page.next_cursor) {
+      throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", "Mementos project resource page claimed more results without a continuation cursor");
+    }
+    cursor = page.next_cursor;
+  } while (cursor);
+  if (!first) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", "Mementos project resource traversal returned no first page");
+  }
+  if (resources.length !== first.total) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INCOMPLETE", `Mementos project resource traversal returned ${resources.length} of ${first.total} resources`);
+  }
+  return {
+    ...first,
+    resources,
+    count: resources.length,
+    total: resources.length,
+    limit: pageSize,
+    cursor: null,
+    next_cursor: null,
+    has_more: false,
+    complete: true,
+    truncated: false
+  };
+}
+function getMementosProjectResourceExact(projectId, resourceKind, stableId, db, authorityOptions = {}) {
+  if (!MEMENTOS_PROJECT_RESOURCE_KINDS.includes(resourceKind)) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_INVALID_INPUT", `Unsupported Mementos project resource kind: ${resourceKind}`);
+  }
+  if (!db && isApiMode()) {
+    const { data } = apiJson("GET", `/projects/${encodeURIComponent(projectId)}/resources/${encodeURIComponent(resourceKind)}/${encodeURIComponent(stableId)}`);
+    return data;
+  }
+  const d = db ?? getDatabase();
+  const { project, resources, collectionRevision } = localPopulation(projectId, d, [
+    resourceKind
+  ]);
+  const resource = resources.find((candidate) => candidate.stable_id === stableId);
+  if (!resource) {
+    throw new MementosProjectResourceError("MEMENTOS_PROJECT_RESOURCE_NOT_FOUND", `Mementos ${resourceKind} resource not found in project ${projectId}: ${stableId}`, { project_id: projectId, resource_kind: resourceKind, stable_id: stableId });
+  }
+  const capability = buildMementosProjectRegistrationCapability(authorityOptions);
+  return {
+    schema: "mementos.project-resource.v1",
+    authority: {
+      authority: capability.authority,
+      authority_id: capability.authority_id,
+      tenant_id: capability.tenant_id,
+      corpus_id: capability.corpus_id,
+      package_version: capability.package_version
+    },
+    project_id: projectId,
+    project_revision: timestamp(project.updated_at),
+    collection_revision: collectionRevision,
+    resource,
+    complete: true,
+    truncated: false
+  };
+}
 // src/db/machines.ts
 init_database();
 import { hostname, platform } from "os";
@@ -53288,13 +53888,13 @@ function createEntity(input, db) {
     return data;
   }
   const d = db || getDatabase();
-  const timestamp = now();
+  const timestamp2 = now();
   const metadataJson = JSON.stringify(input.metadata || {});
   const existing = d.query(`SELECT * FROM entities
        WHERE name = ? AND type = ? AND COALESCE(project_id, '') = ?`).get(input.name, input.type, input.project_id || "");
   if (existing) {
     const sets = ["updated_at = ?"];
-    const params = [timestamp];
+    const params = [timestamp2];
     if (input.description !== undefined) {
       sets.push("description = ?");
       params.push(input.description);
@@ -53317,8 +53917,8 @@ function createEntity(input, db) {
     input.description || null,
     metadataJson,
     input.project_id || null,
-    timestamp,
-    timestamp
+    timestamp2,
+    timestamp2
   ]);
   hookRegistry.runHooks("PostEntityCreate", {
     entityId: id,
@@ -54146,7 +54746,7 @@ function memoryResource(memory) {
     tags: memory.tags
   };
 }
-function projectResource(projectId, name, externalId) {
+function projectResource2(projectId, name, externalId) {
   return {
     kind: "project",
     id: projectId,
@@ -54252,7 +54852,7 @@ function createMementosProjectPanel(projectRef, options = {}) {
       actionResource("mementos:save", "Save project memory")
     ],
     resourceRefs: [
-      projectResource(projectId, project?.name ?? projectRef, project?.id ?? projectRef),
+      projectResource2(projectId, project?.name ?? projectRef, project?.id ?? projectRef),
       ...memories.slice(0, limit).map(memoryResource)
     ],
     renderFragment: {
@@ -54854,29 +55454,29 @@ function enforceQuotas(config, db) {
 }
 function archiveStale(staleDays, db) {
   const d = db || getDatabase();
-  const timestamp = now();
+  const timestamp2 = now();
   const cutoff = new Date(Date.now() - staleDays * 24 * 60 * 60 * 1000).toISOString();
   const archiveWhere = `status = 'active' AND pinned = 0 AND COALESCE(accessed_at, created_at) < ?`;
   const count = d.query(`SELECT COUNT(*) as c FROM memories WHERE ${archiveWhere}`).get(cutoff).c;
   if (count > 0) {
-    d.run(`UPDATE memories SET status = 'archived', updated_at = ? WHERE ${archiveWhere}`, [timestamp, cutoff]);
+    d.run(`UPDATE memories SET status = 'archived', updated_at = ? WHERE ${archiveWhere}`, [timestamp2, cutoff]);
   }
   return count;
 }
 function archiveUnused(days, db) {
   const d = db || getDatabase();
-  const timestamp = now();
+  const timestamp2 = now();
   const cutoff = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
   const unusedWhere = `status = 'active' AND pinned = 0 AND access_count = 0 AND created_at < ?`;
   const count = d.query(`SELECT COUNT(*) as c FROM memories WHERE ${unusedWhere}`).get(cutoff).c;
   if (count > 0) {
-    d.run(`UPDATE memories SET status = 'archived', updated_at = ? WHERE ${unusedWhere}`, [timestamp, cutoff]);
+    d.run(`UPDATE memories SET status = 'archived', updated_at = ? WHERE ${unusedWhere}`, [timestamp2, cutoff]);
   }
   return count;
 }
 function deprioritizeStale(days, db) {
   const d = db || getDatabase();
-  const timestamp = now();
+  const timestamp2 = now();
   const cutoff = new Date(Date.now() - days * 24 * 60 * 60 * 1000).toISOString();
   const deprioWhere = `status = 'active' AND pinned = 0 AND importance > 1 AND COALESCE(accessed_at, updated_at) < ?`;
   const count = d.query(`SELECT COUNT(*) as c FROM memories WHERE ${deprioWhere}`).get(cutoff).c;
@@ -54885,7 +55485,7 @@ function deprioritizeStale(days, db) {
        SET importance = importance - 1,
            version = version + 1,
            updated_at = ?
-       WHERE ${deprioWhere}`, [timestamp, cutoff]);
+       WHERE ${deprioWhere}`, [timestamp2, cutoff]);
   }
   return count;
 }
@@ -54909,9 +55509,9 @@ function getAgentSyncDir(agentName) {
   }
   return dir;
 }
-function setHighWaterMark(agentDir, timestamp) {
+function setHighWaterMark(agentDir, timestamp2) {
   const markFile = join6(agentDir, ".highwatermark");
-  writeFileSync4(markFile, timestamp, "utf-8");
+  writeFileSync4(markFile, timestamp2, "utf-8");
 }
 function resolveConflict(local, remote, resolution) {
   switch (resolution) {
@@ -55231,13 +55831,13 @@ function buildConflictKey(key, sourceMachine, updatedAt) {
   return `${key}__conflict__${machineSegment}__${timestampSegment || "0"}`;
 }
 function buildConflictClone(loser, sourceMachine, winnerId) {
-  const timestamp = new Date().toISOString();
+  const timestamp2 = new Date().toISOString();
   const tags = new Set(ensureArrayValue(loser["tags"]));
   tags.add("sync-conflict");
   tags.add(`source_machine:${sourceMachine}`);
   const metadata = ensureObjectValue(loser["metadata"]);
   metadata["sync_conflict"] = true;
-  metadata["conflict_detected_at"] = timestamp;
+  metadata["conflict_detected_at"] = timestamp2;
   metadata["conflict_original_id"] = loser["id"];
   metadata["conflict_winner_id"] = winnerId;
   metadata["conflict_source_machine"] = sourceMachine;
@@ -55249,10 +55849,10 @@ function buildConflictClone(loser, sourceMachine, winnerId) {
     metadata: JSON.stringify(metadata),
     access_count: 0,
     version: 1,
-    created_at: timestamp,
-    updated_at: timestamp,
+    created_at: timestamp2,
+    updated_at: timestamp2,
     ..."accessed_at" in loser ? { accessed_at: null } : {},
-    ..."ingested_at" in loser ? { ingested_at: timestamp } : {}
+    ..."ingested_at" in loser ? { ingested_at: timestamp2 } : {}
   }, sourceMachine);
 }
 function insertConflictCloneIfMissing(db, clone) {
@@ -55502,13 +56102,13 @@ function createRelation(input, db) {
   }
   const d = db || getDatabase();
   const id = shortUuid();
-  const timestamp = now();
+  const timestamp2 = now();
   const weight = input.weight ?? 1;
   const metadata = JSON.stringify(input.metadata ?? {});
   d.run(`INSERT INTO relations (id, source_entity_id, target_entity_id, relation_type, weight, metadata, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?)
      ON CONFLICT(source_entity_id, target_entity_id, relation_type)
-     DO UPDATE SET weight = excluded.weight, metadata = excluded.metadata`, [id, input.source_entity_id, input.target_entity_id, input.relation_type, weight, metadata, timestamp]);
+     DO UPDATE SET weight = excluded.weight, metadata = excluded.metadata`, [id, input.source_entity_id, input.target_entity_id, input.relation_type, weight, metadata, timestamp2]);
   const row = d.query(`SELECT * FROM relations
        WHERE source_entity_id = ? AND target_entity_id = ? AND relation_type = ?`).get(input.source_entity_id, input.target_entity_id, input.relation_type);
   const relation = parseRelationRow(row);
@@ -55685,7 +56285,7 @@ function parseMemoryLink(row) {
 function createMemoryLink(input, db) {
   const d = db || getDatabase();
   const id = shortUuid();
-  const timestamp = now();
+  const timestamp2 = now();
   d.run(`INSERT OR IGNORE INTO memory_links (id, source_memory_id, target_memory_id, relation_type, run_id, metadata, created_at)
      VALUES (?, ?, ?, ?, ?, ?, ?)`, [
     id,
@@ -55694,7 +56294,7 @@ function createMemoryLink(input, db) {
     input.relation_type,
     input.run_id ?? null,
     JSON.stringify(input.metadata ?? {}),
-    timestamp
+    timestamp2
   ]);
   const row = d.query(`SELECT * FROM memory_links
        WHERE source_memory_id = ? AND target_memory_id = ? AND relation_type = ? AND COALESCE(run_id, '') = ?
@@ -57983,6 +58583,7 @@ export {
   rollbackMemoryProjectLink,
   resolveProjectId,
   resolvePartialId,
+  resolveMementosProjectAuthorityIdentity,
   resetDatabase,
   renameMachine,
   releaseResourceLocks,
@@ -57995,6 +58596,8 @@ export {
   registerAgent,
   reflectOnTrajectory,
   redactSecrets,
+  readMementosProjectResourcePage,
+  readAllMementosProjectResources,
   pushStorageChanges,
   pullStorageChanges,
   providerRegistry,
@@ -58055,6 +58658,7 @@ export {
   getMemoriesForEntity,
   getMemoriesByKey,
   getMementosStorageStatus,
+  getMementosProjectResourceExact,
   getMachine,
   getFocus,
   getFallbackSyncTargetMachine,
@@ -58109,6 +58713,7 @@ export {
   canonicalMementosProjectRegistrationJson,
   bulkLinkEntities,
   bulkDeleteMemories,
+  buildMementosProjectRegistrationCapability,
   buildFocusFilter,
   archiveUnused,
   archiveStale,
@@ -58131,17 +58736,22 @@ export {
   MemoryLockConflictError,
   MemoryInjector,
   MemoryExpiredError,
+  MementosProjectResourceError,
   MementosProjectRegistrationHttpClient,
   MementosProjectRegistrationError,
+  MementosProjectAuthorityIdentityError,
   MEMORY_PROJECT_LINK_RECEIPT_COLUMNS,
   MEMENTOS_STORAGE_TABLES,
   MEMENTOS_STORAGE_FALLBACK_ENV,
   MEMENTOS_STORAGE_ENV,
+  MEMENTOS_PROJECT_RESOURCE_ROUTE,
+  MEMENTOS_PROJECT_RESOURCE_KINDS,
   MEMENTOS_PROJECT_REGISTRATION_SCHEMA_VERSION,
   MEMENTOS_PROJECT_REGISTRATION_ROUTE,
   MEMENTOS_PROJECT_REGISTRATION_CALLER_ROUTE,
   MEMENTOS_PROJECT_REFERENCE_SURFACES,
   MEMENTOS_PROJECT_GUARDED_UPDATE_ROUTE,
+  MEMENTOS_PROJECT_AUTHORITY_ENV,
   MEMENTOS_MEMORY_PROJECT_LINK_ROUTE,
   InvalidScopeError,
   EntityNotFoundError,