@remnic/core 10.0.30 → 10.0.31

package/dist/{chunk-BIE3ZH3N.js → chunk-2IXEKMBJ.js}

@@ -41,7 +41,7 @@ import {
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-UUYAW3JH.js";
+} from "./chunk-OIKLZCJD.js";
 import {
   trustResultFor
 } from "./chunk-GNVZQ5JN.js";
@@ -69,6 +69,9 @@ import {
 import {
   runRecallWhy
 } from "./chunk-O6S5FLZB.js";
+import {
+  renderNavigationResult
+} from "./chunk-KIW3OOZE.js";
 import {
   DEFAULT_TRAVERSE_LIMIT,
   selectTraverseNeighbors
@@ -77,11 +80,11 @@ import {
   assertIdInNavigationWindow
 } from "./chunk-5KVT6G5U.js";
 import {
-  renderNavigationResult
-} from "./chunk-KIW3OOZE.js";
+  takeNavigateBudget
+} from "./chunk-VYDGHJIN.js";
 import {
   planDisclosureStep
-} from "./chunk-MROA6OFU.js";
+} from "./chunk-DGBWPSM6.js";
 import {
   parseNavigateLinkType
 } from "./chunk-7O5EW7KX.js";
@@ -90,17 +93,14 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-RRJ462HP.js";
+} from "./chunk-O6YJI5VX.js";
 import {
   estimateRecallTokens,
   summarizeDisclosureTokens
-} from "./chunk-4QPW6JVI.js";
-import {
-  takeNavigateBudget
-} from "./chunk-VYDGHJIN.js";
+} from "./chunk-ID2PLENW.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-3CHHQXAR.js";
+} from "./chunk-JTACUJP3.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-E6UNM67F.js";
@@ -130,7 +130,7 @@ import {
 } from "./chunk-DMDWFQMR.js";
 import {
   readProjectedHarmonicGraph
-} from "./chunk-YGVZ4QOZ.js";
+} from "./chunk-3CRE3UZI.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -172,22 +172,25 @@ import {
 import {
   runBudgetedDeepRecall
 } from "./chunk-YRULQW5J.js";
+import {
+  buildProposedActions,
+  buildQualityScore,
+  groupActionsByStatus,
+  listMemoryGovernanceRuns,
+  readMemoryGovernanceRunArtifact,
+  runMemoryGovernance
+} from "./chunk-NKW27NU3.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-D4RV54HH.js";
+} from "./chunk-VAPVRDC4.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
 } from "./chunk-UFGFMWAD.js";
 import {
-  buildProposedActions,
-  buildQualityScore,
-  groupActionsByStatus,
-  listMemoryGovernanceRuns,
-  readMemoryGovernanceRunArtifact,
-  runMemoryGovernance
-} from "./chunk-DDLRKPR2.js";
+  LocalLlmClient
+} from "./chunk-3EJQXF3B.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -197,13 +200,15 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-GWB7ZD2A.js";
+} from "./chunk-K6YJGWJP.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-UTXYOWDR.js";
+} from "./chunk-LGR54NYT.js";
 import {
-  LocalLlmClient
-} from "./chunk-3EJQXF3B.js";
+  groupTurnsByExtractionScope,
+  hasPinnedCaptureScope,
+  scopeProfilePlanIdentity
+} from "./chunk-KZMRMKC7.js";
 import {
   meetingsBuild,
   meetingsGet,
@@ -256,10 +261,10 @@ import {
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-TTIEXXL3.js";
+} from "./chunk-ZGP2XB4S.js";
 import {
   namespaceCollectionName
-} from "./chunk-7HFTCBCZ.js";
+} from "./chunk-UBBZFODO.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -291,7 +296,7 @@ import {
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-LDXNKEYB.js";
+} from "./chunk-A6PKEU7T.js";
 import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
@@ -335,19 +340,19 @@ import {
 } from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-VARNSLUW.js";
+} from "./chunk-SGII36L6.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-4OE4UE2Y.js";
+} from "./chunk-D3EXT5KG.js";
 import {
   resolveScopePlan,
   resolveScopedWritableNamespaceValue,
   resolveWritableNamespaceValue
-} from "./chunk-ETZUIRCI.js";
+} from "./chunk-53GYS3GG.js";
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
-} from "./chunk-WC3V7HHP.js";
+} from "./chunk-KJZKO2M6.js";
 import {
   inferMemoryStatus,
   isActiveMemoryStatus,
@@ -7066,8 +7071,21 @@ var SessionContextCoordinator = class {
     const ownerPrincipal = typeof options.principalOverride === "string" && options.principalOverride.trim().length > 0 ? options.principalOverride.trim() : void 0;
     const resolvedSessionPrincipal = ownershipEnforced && ownerPrincipal !== void 0 && this.deps.config ? resolvePrincipal(sessionKey, this.deps.config) : void 0;
     const opaqueScopedSession = ownershipEnforced && ownerPrincipal !== void 0 && (resolvedSessionPrincipal === void 0 || resolvedSessionPrincipal === "default");
+    const flushNamespace = options.writeNamespaceOverride !== void 0 ? options.writeNamespaceOverride : namespacesEnabled && this.deps.config ? defaultNamespaceForPrincipal(resolvePrincipal(sessionKey, this.deps.config), this.deps.config) : void 0;
     const belongsToSession = (turn) => {
       if (turn.sessionKey !== sessionKey) return false;
+      if (namespacesEnabled && turn.writeNamespaceOverride !== void 0 && turn.writeNamespaceOverride !== flushNamespace) {
+        return false;
+      }
+      const flushPlanIdentity = scopeProfilePlanIdentity(options.scopeProfileWritePlan);
+      if (flushPlanIdentity !== "" && hasPinnedCaptureScope(turn)) {
+        if (scopeProfilePlanIdentity(turn.scopeProfileWritePlan) !== flushPlanIdentity && !(turn.acceptedCapture === true && turn.scopeProfileWritePlan === void 0)) {
+          return false;
+        }
+        if (options.codingContext && turn.codingContext && (turn.codingContext.projectId !== options.codingContext.projectId || turn.codingContext.rootPath !== options.codingContext.rootPath || turn.codingContext.branch !== options.codingContext.branch || turn.codingContext.defaultBranch !== options.codingContext.defaultBranch)) {
+          return false;
+        }
+      }
       if (!ownershipEnforced || ownerPrincipal === void 0) return true;
       if (turn.sessionOwnerPrincipal === ownerPrincipal) return true;
       return turn.sessionOwnerPrincipal === void 0 && this.deps.config !== void 0 && resolvePrincipal(turn.sessionKey, this.deps.config) === ownerPrincipal;
@@ -7081,49 +7099,49 @@ var SessionContextCoordinator = class {
     }
     for (const bufferKey of bufferKeys) {
       const turns = this.deps.buffer.getTurns(bufferKey);
-      const turnsForSession = scopedRequest ? turns.filter(belongsToSession) : turns;
+      const turnsForSession = turns.filter(belongsToSession);
       if (turnsForSession.length === 0) continue;
-      const retainedTurnsForOtherSessions = scopedRequest && typeof this.deps.buffer.getRetainedDeferredTurns === "function" ? this.deps.buffer.getRetainedDeferredTurns(bufferKey).filter((turn) => !belongsToSession(turn)) : [];
-      try {
-        await new Promise((resolve4, reject) => {
-          void this.deps.queueBufferedExtraction(turnsForSession, "trigger_mode", {
-            bufferKey,
-            clearBufferAfterExtraction: true,
-            skipDedupeCheck: true,
-            skipCharThreshold: true,
-            skipUserTurnThreshold: true,
-            failOnExtractionFailure: options.failOnExtractionFailure === true,
-            forceExtractionAttempt: true,
-            abortSignal: options.abortSignal,
-            extractionDeadlineMs: options.extractionDeadlineMs,
-            writeNamespaceOverride: options.writeNamespaceOverride,
-            principalOverride: options.principalOverride,
-            scopeProfileWritePlan: options.scopeProfileWritePlan,
-            clearMatchingTurns: options.clearMatchingTurns ?? scopedRequest,
-            onDurableCommit: options.onCommitted,
-            onTaskSettled: (error) => error ? reject(error) : resolve4()
-          }).catch(reject);
-        });
-        if (options.reason === "session_end" && this.deps.config.sessionExperience?.enabled === true) {
-          await this.extractSessionEndExperience(turnsForSession, sessionKey, options);
+      const scopeGroups = groupTurnsByExtractionScope(turnsForSession);
+      const needsIdentityClear = turnsForSession.length < turns.length || scopeGroups.length > 1;
+      const namespacesOn = this.deps.config ? resolveNamespaceCapabilities(this.deps.config).namespaces === true : true;
+      for (const group of scopeGroups) {
+        const groupPinned = group.writeNamespaceOverride !== void 0 || group.principalOverride !== void 0 || group.scopeProfileWritePlan !== void 0;
+        if (group.scopeProfileWritePlan && options.scopeProfileWritePlan && (scopeProfilePlanIdentity(group.scopeProfileWritePlan) !== scopeProfilePlanIdentity(options.scopeProfileWritePlan) || options.codingContext && group.codingContext && (group.codingContext.projectId !== options.codingContext.projectId || group.codingContext.rootPath !== options.codingContext.rootPath || group.codingContext.branch !== options.codingContext.branch || group.codingContext.defaultBranch !== options.codingContext.defaultBranch))) {
+          continue;
         }
-      } finally {
-        if (retainedTurnsForOtherSessions.length > 0 && typeof this.deps.buffer.retainDeferredTurns === "function") {
-          const retainedAfterExtraction = this.deps.buffer.getRetainedDeferredTurns(bufferKey);
-          await this.deps.buffer.retainDeferredTurns(
-            bufferKey,
-            [
-              ...retainedAfterExtraction.filter((turn) => belongsToSession(turn)),
-              ...retainedTurnsForOtherSessions
-            ],
-            10
-          ).catch((error) => {
-            log.warn(
-              `session flush could not restore retained turns for other sessions in ${bufferKey}`,
-              error
+        if (groupPinned && !namespacesOn && group.writeNamespaceOverride !== void 0 && group.writeNamespaceOverride !== this.deps.config?.defaultNamespace) {
+          if (options.failOnExtractionFailure === true) {
+            throw new Error(
+              `accepted capture preserved: pinned_namespace_unavailable (${group.writeNamespaceOverride})`
             );
-          });
+          }
+          log.warn(
+            `flushSession: pinned namespace ${group.writeNamespaceOverride} unavailable while namespaces are disabled; capture stays pending`
+          );
+          continue;
         }
+        const { promise, resolve: resolve4, reject } = Promise.withResolvers();
+        void this.deps.queueBufferedExtraction(group.turns, "trigger_mode", {
+          bufferKey,
+          clearBufferAfterExtraction: true,
+          skipDedupeCheck: true,
+          skipCharThreshold: true,
+          skipUserTurnThreshold: true,
+          failOnExtractionFailure: options.failOnExtractionFailure === true,
+          forceExtractionAttempt: true,
+          abortSignal: options.abortSignal,
+          extractionDeadlineMs: options.extractionDeadlineMs,
+          writeNamespaceOverride: group.writeNamespaceOverride ?? options.writeNamespaceOverride,
+          principalOverride: group.principalOverride ?? options.principalOverride,
+          scopeProfileWritePlan: group.turns.some((turn) => turn.acceptedCapture === true) ? group.scopeProfileWritePlan ?? null : group.scopeProfileWritePlan ?? options.scopeProfileWritePlan,
+          clearMatchingTurns: options.clearMatchingTurns === true || scopedRequest || groupPinned || needsIdentityClear,
+          onDurableCommit: options.onCommitted,
+          onTaskSettled: (error) => error ? reject(error) : resolve4()
+        }).catch(reject);
+        await promise;
+      }
+      if (options.reason === "session_end" && this.deps.config.sessionExperience?.enabled === true) {
+        await this.extractSessionEndExperience(turnsForSession, sessionKey, options);
       }
     }
   }
@@ -7272,26 +7290,6 @@ async function extractionForceFlush(deps, request, waitForPendingObserveExtracti
     }
     abortHandler = cancelScopedPendingObserveExtractions;
     request.abortSignal?.addEventListener("abort", abortHandler, { once: true });
-    await awaitSessionFlushPhase(
-      () => deps.orchestrator.flushSession(request.sessionKey, {
-        reason: "access_force_flush",
-        abortSignal: request.abortSignal,
-        failOnExtractionFailure: true,
-        extractionDeadlineMs: deadlineAt,
-        writeNamespaceOverride: scope.writeNamespace,
-        principalOverride: typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0,
-        scopeProfileWritePlan: scope.scopeProfilePlan,
-        onCommitted: markCommitted
-      }),
-      {
-        abortSignal: request.abortSignal,
-        extractionDeadlineMs: deadlineAt,
-        reason: "access_force_flush",
-        deadlineStage: "buffer_drain",
-        onDeadline: cancelScopedPendingObserveExtractions
-      }
-    );
-    markCommitted();
     if (waitForPendingObserveExtraction) {
       let cancelPendingObserveExtraction;
       await awaitSessionFlushPhase(
@@ -7317,13 +7315,41 @@ async function extractionForceFlush(deps, request, waitForPendingObserveExtracti
         }
       );
     }
+    await awaitSessionFlushPhase(
+      () => deps.orchestrator.flushSession(request.sessionKey, {
+        reason: "access_force_flush",
+        abortSignal: request.abortSignal,
+        failOnExtractionFailure: true,
+        extractionDeadlineMs: deadlineAt,
+        writeNamespaceOverride: scope.writeNamespace,
+        principalOverride: scope.principal !== void 0 && scope.principal.length > 0 ? scope.principal : void 0,
+        scopeProfileWritePlan: scope.scopeProfilePlan,
+        // #3251: the session's original coding binding — plan-pinned flushes
+        // drain only captures bound to the same project identity.
+        codingContext: deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? void 0,
+        onCommitted: markCommitted
+      }),
+      {
+        abortSignal: request.abortSignal,
+        extractionDeadlineMs: deadlineAt,
+        reason: "access_force_flush",
+        deadlineStage: "buffer_drain",
+        onDeadline: cancelScopedPendingObserveExtractions
+      }
+    );
+    markCommitted();
     const buffer = deps.orchestrator.buffer;
     if (buffer && typeof buffer.clearRetainedTurnsForSession === "function") {
       try {
         await awaitSessionFlushPhase(
           () => buffer.clearRetainedTurnsForSession(request.sessionKey, namespacesEnabled ? scope.principal : void 0, {
             abortSignal: request.abortSignal,
-            deadlineMs: deadlineAt
+            deadlineMs: deadlineAt,
+            // #3251: only clear retained turns accepted under THIS scope —
+            // namespace, plan identity, and original project binding.
+            writeNamespaceOverride: namespacesEnabled ? scope.writeNamespace : void 0,
+            scopeProfileWritePlan: namespacesEnabled ? scope.scopeProfilePlan : void 0,
+            codingContext: namespacesEnabled ? deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? void 0 : void 0
           }),
           {
             abortSignal: request.abortSignal,
@@ -7864,32 +7890,37 @@ var AccessObserveWriteSurface = class {
           timestamp: (/* @__PURE__ */ new Date()).toISOString(),
           ...request.sourceConnector ? { sourceConnector: request.sourceConnector } : {}
         }));
-        const writeNamespaceOverride = resolveNamespaceCapabilities(this.deps.orchestrator.config).namespaces === true ? writeNamespace : void 0;
+        const writeNamespaceOverride = writeNamespace;
         const principalOverride = typeof scope.principal === "string" && scope.principal.length > 0 ? scope.principal : void 0;
-        if (!observePreparation.isCancelled()) {
-          try {
-            const observeAbortController = new AbortController();
-            const extractionPromise = this.deps.orchestrator.ingestReplayBatch(turns, {
-              archiveLcm: false,
-              writeNamespaceOverride,
-              principalOverride,
-              scopeProfileWritePlan: scope.scopeProfilePlan,
-              abortSignal: observeAbortController.signal,
-              ...typeof request.authenticatedPrincipal === "string" && request.authenticatedPrincipal.trim().length > 0 ? { sessionOwnerPrincipal: request.authenticatedPrincipal.trim() } : {}
-            });
-            extractionPromise.catch((err) => {
+        const observeAbortController = new AbortController();
+        const preparationCancelled = observePreparation.isCancelled();
+        if (preparationCancelled) {
+          observeAbortController.abort(abortError("observe preparation cancelled"));
+        }
+        const trackedExtractionKey = this.pendingObserveExtractions.key(request.sessionKey, scope.principal, writeNamespace);
+        const ingestOptions = {
+          archiveLcm: false,
+          extractionMode: "buffered",
+          writeNamespaceOverride,
+          principalOverride,
+          scopeProfileWritePlan: scope.scopeProfilePlan,
+          // Re-authorize current policy against the original project binding.
+          codingContext: this.deps.orchestrator.getCodingContextForSession(request.sessionKey) ?? void 0,
+          abortSignal: observeAbortController.signal
+        };
+        if (request.authenticatedPrincipal !== void 0 && request.authenticatedPrincipal.trim().length > 0) {
+          ingestOptions.sessionOwnerPrincipal = request.authenticatedPrincipal.trim();
+        }
+        if (!preparationCancelled) {
+          ingestOptions.onExtractionQueued = (extraction) => {
+            extraction.catch((err) => {
               log.error(`access-observe background extraction failed: ${err}`);
             });
-            this.pendingObserveExtractions.track(
-              this.pendingObserveExtractions.key(request.sessionKey, scope.principal, writeNamespace),
-              extractionPromise,
-              observeAbortController
-            );
+            this.pendingObserveExtractions.track(trackedExtractionKey, extraction, observeAbortController);
             extractionQueued = true;
-          } catch (err) {
-            log.error(`access-observe extraction enqueue failed: ${err}`);
-          }
+          };
         }
+        await this.deps.orchestrator.ingestReplayBatch(turns, ingestOptions);
       }
       log.info(
         `access-observe namespace=${namespace} effectiveNamespace=${writeNamespace} sessionKey=${request.sessionKey} messages=${request.messages.length} lcm=${lcmArchived} extraction=${extractionQueued} transcript=${transcriptPersisted}`
@@ -18737,4 +18768,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-BIE3ZH3N.js.map
+//# sourceMappingURL=chunk-2IXEKMBJ.js.map