@remnic/core 10.0.91 → 10.0.93

package/dist/{chunk-YCNIGRRF.js → chunk-NS7U4ZYU.js}

@@ -1,106 +1,18 @@
 import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
+  SupportPassportCardCategorySchema,
+  SupportPassportCardSchema,
+  SupportPassportCardStatusSchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportNamespaceSchema,
+  SupportPassportSourceMemoryIdSchema,
+  computeSupportPassportCardRevision
+} from "./chunk-AHA5VQGP.js";
 import {
   stripAttributesSuffix
 } from "./chunk-JDSVLVCG.js";
-import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
-
-// src/support-passport/contracts.ts
-import { createHash } from "crypto";
-import { z } from "zod";
-var SUPPORT_PASSPORT_CARD_CATEGORIES = [
-  "communication",
-  "environment",
-  "transitions",
-  "sensory",
-  "regulation",
-  "interests",
-  "other"
-];
-var SUPPORT_PASSPORT_CARD_STATUSES = [
-  "pending_review",
-  "active",
-  "rejected",
-  "superseded",
-  "archived"
-];
-var SupportPassportCardCategorySchema = z.enum(SUPPORT_PASSPORT_CARD_CATEGORIES);
-var SupportPassportCardStatusSchema = z.enum(SUPPORT_PASSPORT_CARD_STATUSES);
-var SupportPassportCardTitleSchema = z.string().trim().min(1).max(80).refine((title) => !title.includes("]") && !title.includes("\n") && !title.includes("\r"), {
-  message: "card titles cannot contain closing brackets or line breaks"
-});
-var IsoTimestampSchema = z.string().datetime({ offset: true }).refine((value) => parseIsoOffsetTimestamp(value) !== null, {
-  message: "timestamps must be valid ISO 8601 values"
-});
-var SupportPassportNamespaceSchema = z.string().min(1).refine((namespace) => namespace === normalizeNamespaceIdentity(namespace), {
-  message: "namespaces must be canonical"
-});
-var SupportPassportMemoryIdSchema = z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/);
-var SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH = 512;
-var SupportPassportSourceMemoryIdSchema = z.string().trim().min(1).max(SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH);
-var SupportPassportCardSchema = z.object({
-  cardId: SupportPassportMemoryIdSchema,
-  title: SupportPassportCardTitleSchema,
-  statement: z.string().trim().min(1).max(500),
-  category: SupportPassportCardCategorySchema,
-  status: SupportPassportCardStatusSchema,
-  updatedAt: IsoTimestampSchema,
-  reviewBy: IsoTimestampSchema,
-  revision: z.string().regex(/^[a-f0-9]{64}$/)
-}).strict();
-var SupportPassportCardListSchema = z.array(SupportPassportCardSchema).max(100).superRefine((cards, ctx) => {
-  const seen = /* @__PURE__ */ new Set();
-  for (const [index, card] of cards.entries()) {
-    if (seen.has(card.cardId)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: "card IDs must be unique",
-        path: [index, "cardId"]
-      });
-    }
-    seen.add(card.cardId);
-  }
-});
-var SupportPassportListCardsInputSchema = z.object({
-  principal: z.string().trim().min(1).max(512)
-}).strict();
-var SupportPassportManualDraftInputSchema = z.object({
-  principal: z.string().trim().min(1).max(512),
-  title: SupportPassportCardTitleSchema,
-  statement: z.string().trim().min(1).max(500),
-  category: SupportPassportCardCategorySchema,
-  reviewBy: IsoTimestampSchema
-}).strict();
-var SupportPassportCardMutationInputSchema = z.object({
-  principal: z.string().trim().min(1).max(512),
-  cardId: SupportPassportMemoryIdSchema,
-  expectedRevision: z.string().regex(/^[a-f0-9]{64}$/),
-  reasonCode: z.string().trim().min(1).max(64).regex(/^[a-z0-9-]+$/).optional()
-}).strict();
-var SupportPassportReplaceCardInputSchema = SupportPassportCardMutationInputSchema.extend({
-  title: SupportPassportCardTitleSchema,
-  statement: z.string().trim().min(1).max(500),
-  category: SupportPassportCardCategorySchema,
-  reviewBy: IsoTimestampSchema
-}).strict();
-function computeSupportPassportCardRevision(fields) {
-  const canonicalFields = {
-    cardId: fields.cardId,
-    category: fields.category,
-    reviewBy: fields.reviewBy,
-    statement: fields.statement,
-    status: fields.status,
-    title: fields.title,
-    updatedAt: fields.updatedAt
-  };
-  return createHash("sha256").update(JSON.stringify(canonicalFields)).digest("hex");
-}
 
 // src/support-passport/card-projection.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash } from "crypto";
 import { lstat } from "fs/promises";
 var SUPPORT_PASSPORT_CARD_TAG = "support-passport-card";
 var SUPPORT_PASSPORT_AUDIT_TAG = "support-passport-audit";
@@ -199,7 +111,7 @@ function encodeSupportPassportNamespaceAttributes(namespace) {
   const canonical = SupportPassportNamespaceSchema.parse(namespace);
   const encoded = Buffer.from(canonical, "utf8").toString("base64url");
   const chunks = encoded.match(new RegExp(`.{1,${SUPPORT_PASSPORT_NAMESPACE_CHUNK_SIZE}}`, "g")) ?? [];
-  const digest = createHash2("sha256").update(encoded).digest("hex");
+  const digest = createHash("sha256").update(encoded).digest("hex");
   return Object.fromEntries([
     [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.namespace, chunks[0] ?? ""],
     [
@@ -233,14 +145,14 @@ function decodeSupportPassportNamespaceAttributes(attributes) {
     chunks.push(chunk);
   }
   const encoded = chunks.join("");
-  if (createHash2("sha256").update(encoded).digest("hex") !== match[2]) return null;
+  if (createHash("sha256").update(encoded).digest("hex") !== match[2]) return null;
   const decoded = Buffer.from(encoded, "base64url").toString("utf8");
   if (Buffer.from(decoded, "utf8").toString("base64url") !== encoded) return null;
   const namespace = SupportPassportNamespaceSchema.safeParse(decoded);
   return namespace.success ? namespace.data : null;
 }
 function computeSupportPassportOwnerKey(principal) {
-  return createHash2("sha256").update(principal).digest("hex");
+  return createHash("sha256").update(principal).digest("hex");
 }
 function activeSupportPassportReplacementPredecessorIds(cards) {
   return new Set(
@@ -369,22 +281,6 @@ function projectSupportPassportCard(memory) {
 }
 
 export {
-  SUPPORT_PASSPORT_CARD_CATEGORIES,
-  SUPPORT_PASSPORT_CARD_STATUSES,
-  SupportPassportCardCategorySchema,
-  SupportPassportCardStatusSchema,
-  SupportPassportCardTitleSchema,
-  SupportPassportNamespaceSchema,
-  SupportPassportMemoryIdSchema,
-  SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH,
-  SupportPassportSourceMemoryIdSchema,
-  SupportPassportCardSchema,
-  SupportPassportCardListSchema,
-  SupportPassportListCardsInputSchema,
-  SupportPassportManualDraftInputSchema,
-  SupportPassportCardMutationInputSchema,
-  SupportPassportReplaceCardInputSchema,
-  computeSupportPassportCardRevision,
   SUPPORT_PASSPORT_CARD_TAG,
   SUPPORT_PASSPORT_AUDIT_TAG,
   isSupportPassportPrivateMemory,
@@ -400,4 +296,4 @@ export {
   hasLiveSupportPassportCard,
   projectSupportPassportCard
 };
-//# sourceMappingURL=chunk-YCNIGRRF.js.map
+//# sourceMappingURL=chunk-NS7U4ZYU.js.map

package/dist/chunk-NS7U4ZYU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/support-passport/card-projection.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { lstat } from \"node:fs/promises\";\n\nimport type { OfflineSyncExcludeFile } from \"../offline-sync-file-io.js\";\nimport { stripAttributesSuffix } from \"../structured-attributes.js\";\nimport type { MemoryFile } from \"../types.js\";\nimport {\n  type SupportPassportCard,\n  SupportPassportCardCategorySchema,\n  SupportPassportCardSchema,\n  SupportPassportCardStatusSchema,\n  SupportPassportMemoryIdSchema,\n  SupportPassportNamespaceSchema,\n  SupportPassportSourceMemoryIdSchema,\n  computeSupportPassportCardRevision,\n} from \"./contracts.js\";\n\nexport const SUPPORT_PASSPORT_CARD_TAG = \"support-passport-card\";\nexport const SUPPORT_PASSPORT_AUDIT_TAG = \"support-passport-audit\";\n\nexport function isSupportPassportPrivateMemory(memory: {\n  frontmatter: {\n    tags?: readonly string[];\n    structuredAttributes?: Readonly<Record<string, string>>;\n  };\n}): boolean {\n  const tags = memory.frontmatter.tags;\n  if (tags?.includes(SUPPORT_PASSPORT_CARD_TAG) === true || tags?.includes(SUPPORT_PASSPORT_AUDIT_TAG) === true) {\n    return true;\n  }\n  return Object.keys(memory.frontmatter.structuredAttributes ?? {}).some((key) => key.startsWith(\"support-passport-\"));\n}\n\nexport function excludeSupportPassportPrivateMemories<T extends Pick<MemoryFile, \"frontmatter\">>(\n  memories: readonly T[]\n): T[] {\n  return memories.filter((memory) => !isSupportPassportPrivateMemory(memory));\n}\n\n/**\n * Stat identity a persisted exclusion classification is keyed on. Any content\n * change rewrites the file, which moves ctime, so a matching identity implies\n * the same bytes and therefore the same classification.\n */\nexport function supportPassportStatIdentity(file: {\n  dev: number;\n  ino: number;\n  size: number;\n  mtimeMs: number;\n  ctimeMs: number;\n}): string {\n  return `${file.dev}:${file.ino}:${file.size}:${file.mtimeMs}:${file.ctimeMs}`;\n}\n\nexport interface PersistedSupportPassportClassification {\n  statIdentity: string;\n  excluded: boolean;\n}\n\n/**\n * `createSupportPassportPrivateFileExclusion` variant that consults a\n * PERSISTED classification before touching the file. The plain factory\n * classifies by reading and parsing every candidate (readMemoryByPath), which\n * is fine once per process but defeats any persisted-parse optimization: a\n * warm reconcile plan that should skip per-file reads would still read every\n * file just to decide exclusion. When the persisted stat identity matches, the\n * classification is reused and the file is not opened; on mismatch it is\n * recomputed once and recorded into `updates` so the caller can persist it.\n */\nexport function createPersistedSupportPassportPrivateFileExclusion(\n  storage: {\n    readMemoryByPath(filePath: string): Promise<MemoryFile | null>;\n  },\n  persisted: ReadonlyMap<string, { statIdentity?: string; excluded?: boolean }>,\n  updates: Map<string, PersistedSupportPassportClassification>\n): OfflineSyncExcludeFile {\n  const inFlight = new Map<string, { identity: string; excluded: Promise<boolean> }>();\n  return async ({ filePath, path: relPath }) => {\n    let file: Awaited<ReturnType<typeof lstat>>;\n    try {\n      file = await lstat(filePath);\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        inFlight.delete(filePath);\n        return false;\n      }\n      throw error;\n    }\n    const identity = supportPassportStatIdentity(file);\n    const known = persisted.get(relPath);\n    if (known?.statIdentity === identity && known.excluded !== undefined) {\n      updates.set(relPath, { statIdentity: identity, excluded: known.excluded });\n      return known.excluded;\n    }\n    const cached = inFlight.get(filePath);\n    if (cached?.identity === identity) return await cached.excluded;\n    const excluded = storage\n      .readMemoryByPath(filePath)\n      .then((memory) => (memory ? isSupportPassportPrivateMemory(memory) : false))\n      .finally(() => {\n        if (inFlight.get(filePath)?.identity === identity) inFlight.delete(filePath);\n      });\n    inFlight.set(filePath, { identity, excluded });\n    const result = await excluded;\n    updates.set(relPath, { statIdentity: identity, excluded: result });\n    return result;\n  };\n}\n\nexport function createSupportPassportPrivateFileExclusion(storage: {\n  readMemoryByPath(filePath: string): Promise<MemoryFile | null>;\n}): OfflineSyncExcludeFile {\n  const classifications = new Map<string, { identity: string; excluded: Promise<boolean> }>();\n  return async ({ filePath }) => {\n    let file: Awaited<ReturnType<typeof lstat>>;\n    try {\n      file = await lstat(filePath);\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") {\n        classifications.delete(filePath);\n        return false;\n      }\n      throw error;\n    }\n    const identity = `${file.dev}:${file.ino}:${file.size}:${file.mtimeMs}:${file.ctimeMs}`;\n    const cached = classifications.get(filePath);\n    if (cached?.identity === identity) return await cached.excluded;\n    const excluded = storage\n      .readMemoryByPath(filePath)\n      .then((memory) => (memory ? isSupportPassportPrivateMemory(memory) : false));\n    classifications.set(filePath, { identity, excluded });\n    try {\n      return await excluded;\n    } catch (error) {\n      if (classifications.get(filePath)?.excluded === excluded) classifications.delete(filePath);\n      throw error;\n    }\n  };\n}\n\nexport const SUPPORT_PASSPORT_ATTRIBUTE_KEYS = Object.freeze({\n  namespace: \"support-passport-namespace\",\n  namespaceEncoding: \"support-passport-namespace-encoding\",\n  owner: \"support-passport-owner\",\n  title: \"support-passport-title\",\n  category: \"support-passport-category\",\n  order: \"support-passport-order\",\n  reviewBy: \"support-passport-review-by\",\n  sourceMemoryIds: \"support-passport-source-ids\",\n  replacesDraftId: \"support-passport-replaces-draft-id\",\n  replacedRevision: \"support-passport-replaced-revision\",\n  draftReplacementPrepared: \"support-passport-draft-replacement-prepared\",\n  replacementComplete: \"support-passport-replacement-complete\",\n  generatedBatchId: \"support-passport-generated-batch-id\",\n  generatedBatchSize: \"support-passport-generated-batch-size\",\n});\n\nconst SUPPORT_PASSPORT_NAMESPACE_ENCODING = \"base64url-v1\";\nconst SUPPORT_PASSPORT_NAMESPACE_CHUNK_PREFIX = \"support-passport-namespace-\";\nconst SUPPORT_PASSPORT_NAMESPACE_CHUNK_SIZE = 1_024;\nconst LegacySupportPassportNamespaceSchema = SupportPassportNamespaceSchema.refine(\n  (namespace) =>\n    !namespace.includes(\"/\") &&\n    !namespace.includes(\"\\\\\") &&\n    !namespace.includes(\"..\") &&\n    !namespace.includes(\"]\") &&\n    !namespace.includes(\"\\0\") &&\n    !namespace.includes(\"\\n\") &&\n    !namespace.includes(\"\\r\")\n);\n\nexport function encodeSupportPassportNamespaceAttributes(namespace: string): Record<string, string> {\n  const canonical = SupportPassportNamespaceSchema.parse(namespace);\n  const encoded = Buffer.from(canonical, \"utf8\").toString(\"base64url\");\n  const chunks = encoded.match(new RegExp(`.{1,${SUPPORT_PASSPORT_NAMESPACE_CHUNK_SIZE}}`, \"g\")) ?? [];\n  const digest = createHash(\"sha256\").update(encoded).digest(\"hex\");\n  return Object.fromEntries([\n    [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.namespace, chunks[0] ?? \"\"],\n    [\n      SUPPORT_PASSPORT_ATTRIBUTE_KEYS.namespaceEncoding,\n      `${SUPPORT_PASSPORT_NAMESPACE_ENCODING}:${chunks.length}:${digest}`,\n    ],\n    ...chunks.slice(1).map((chunk, index) => [`${SUPPORT_PASSPORT_NAMESPACE_CHUNK_PREFIX}${index + 1}`, chunk]),\n  ]);\n}\n\nexport function decodeSupportPassportNamespaceAttributes(attributes: Readonly<Record<string, string>>): string | null {\n  const firstChunk = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.namespace];\n  const encoding = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.namespaceEncoding];\n  if (encoding === undefined) {\n    const legacy = LegacySupportPassportNamespaceSchema.safeParse(firstChunk);\n    return legacy.success ? legacy.data : null;\n  }\n  const match = /^base64url-v1:([1-9]\\d*):([a-f0-9]{64})$/.exec(encoding);\n  if (!match || typeof firstChunk !== \"string\") return null;\n  const chunkCount = Number(match[1]);\n  if (!Number.isSafeInteger(chunkCount)) return null;\n  const chunkIndexes = Object.keys(attributes).flatMap((key) => {\n    const chunkMatch = /^support-passport-namespace-(\\d+)$/.exec(key);\n    return chunkMatch ? [Number(chunkMatch[1])] : [];\n  });\n  if (\n    chunkIndexes.length !== chunkCount - 1 ||\n    chunkIndexes.some((index) => !Number.isSafeInteger(index) || index < 1 || index >= chunkCount)\n  )\n    return null;\n  const chunks = [firstChunk];\n  for (let index = 1; index < chunkCount; index += 1) {\n    const chunk = attributes[`${SUPPORT_PASSPORT_NAMESPACE_CHUNK_PREFIX}${index}`];\n    if (typeof chunk !== \"string\" || chunk.length === 0) return null;\n    chunks.push(chunk);\n  }\n  const encoded = chunks.join(\"\");\n  if (createHash(\"sha256\").update(encoded).digest(\"hex\") !== match[2]) return null;\n  const decoded = Buffer.from(encoded, \"base64url\").toString(\"utf8\");\n  if (Buffer.from(decoded, \"utf8\").toString(\"base64url\") !== encoded) return null;\n  const namespace = SupportPassportNamespaceSchema.safeParse(decoded);\n  return namespace.success ? namespace.data : null;\n}\n\nexport interface StoredSupportPassportCard {\n  card: SupportPassportCard;\n  memory: MemoryFile;\n  order: number;\n  sourceMemoryIds: string[];\n  namespace: string;\n  owner: string;\n  replacesDraftId?: string;\n  replacedRevision?: string;\n  draftReplacementPrepared: boolean;\n  generatedBatchId?: string;\n  generatedBatchSize?: number;\n}\n\nexport function computeSupportPassportOwnerKey(principal: string): string {\n  return createHash(\"sha256\").update(principal).digest(\"hex\");\n}\n\nexport function activeSupportPassportReplacementPredecessorIds(\n  cards: readonly StoredSupportPassportCard[]\n): Set<string> {\n  return new Set(\n    cards\n      .filter((item) => item.card.status === \"active\")\n      .map((item) => item.memory.frontmatter.supersedes)\n      .filter((cardId): cardId is string => typeof cardId === \"string\")\n  );\n}\n\nfunction parseSourceMemoryIds(frontmatter: MemoryFile[\"frontmatter\"]): string[] | null {\n  const lineage = frontmatter.lineage;\n  const legacyValue = frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.sourceMemoryIds];\n  const rawIds = lineage ?? (legacyValue === undefined || legacyValue === \"\" ? [] : legacyValue.split(\",\"));\n  if (rawIds.length > 5) return null;\n  const normalized: string[] = [];\n  for (const rawId of rawIds) {\n    const parsed = SupportPassportSourceMemoryIdSchema.safeParse(rawId);\n    if (!parsed.success) return null;\n    normalized.push(parsed.data);\n  }\n  if (new Set(normalized).size !== normalized.length) return null;\n  return normalized;\n}\n\ninterface SupportPassportCardMetadata {\n  fields: Omit<SupportPassportCard, \"revision\" | \"statement\">;\n  order: number;\n  sourceMemoryIds: string[];\n  namespace: string;\n  owner: string;\n  replacesDraftId?: string;\n  replacedRevision?: string;\n  draftReplacementPrepared: boolean;\n  generatedBatchId?: string;\n  generatedBatchSize?: number;\n}\n\nfunction parseSupportPassportCardMetadata(memory: Pick<MemoryFile, \"frontmatter\">): SupportPassportCardMetadata | null {\n  const frontmatter = memory.frontmatter;\n  const attributes = frontmatter.structuredAttributes;\n  if (frontmatter.category !== \"preference\") return null;\n  if (!frontmatter.tags?.includes(SUPPORT_PASSPORT_CARD_TAG)) return null;\n  if (!attributes || frontmatter.blockedBy || frontmatter.archivedAt || frontmatter.supersededBy) return null;\n\n  const category = SupportPassportCardCategorySchema.safeParse(attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.category]);\n  const status = SupportPassportCardStatusSchema.safeParse(frontmatter.status);\n  const rawOrder = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.order];\n  const order = Number(rawOrder);\n  const sourceMemoryIds = parseSourceMemoryIds(frontmatter);\n  const namespace = decodeSupportPassportNamespaceAttributes(attributes);\n  const owner = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner];\n  let replacesDraftId: string | undefined;\n  const rawReplacesDraftId = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacesDraftId];\n  if (rawReplacesDraftId !== undefined) {\n    const parsedReplacesDraftId = SupportPassportMemoryIdSchema.safeParse(rawReplacesDraftId);\n    if (!parsedReplacesDraftId.success) return null;\n    replacesDraftId = parsedReplacesDraftId.data;\n  }\n  let replacedRevision: string | undefined;\n  const rawReplacedRevision = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacedRevision];\n  if (rawReplacedRevision !== undefined) {\n    if (!/^[a-f0-9]{64}$/.test(rawReplacedRevision)) return null;\n    replacedRevision = rawReplacedRevision;\n  }\n  const generatedBatchId = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.generatedBatchId];\n  const rawGeneratedBatchSize = attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.generatedBatchSize];\n  let generatedBatchSize: number | undefined;\n  if (generatedBatchId !== undefined) {\n    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(generatedBatchId)) {\n      return null;\n    }\n    if (typeof rawGeneratedBatchSize !== \"string\" || !/^[1-8]$/.test(rawGeneratedBatchSize)) {\n      return null;\n    }\n    generatedBatchSize = Number(rawGeneratedBatchSize);\n  } else if (rawGeneratedBatchSize !== undefined) {\n    return null;\n  }\n  if (\n    !category.success ||\n    !status.success ||\n    status.data === \"superseded\" ||\n    typeof rawOrder !== \"string\" ||\n    !/^(?:0|[1-9]\\d*)$/.test(rawOrder) ||\n    !Number.isSafeInteger(order) ||\n    namespace === null ||\n    typeof owner !== \"string\" ||\n    !/^[a-f0-9]{64}$/.test(owner) ||\n    !sourceMemoryIds\n  )\n    return null;\n  const fields = SupportPassportCardSchema.omit({\n    revision: true,\n    statement: true,\n  }).safeParse({\n    cardId: frontmatter.id,\n    title: attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.title],\n    category: category.data,\n    status: status.data,\n    updatedAt: frontmatter.updated,\n    reviewBy: attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.reviewBy],\n  });\n  if (!fields.success) return null;\n  return {\n    fields: fields.data,\n    order,\n    sourceMemoryIds,\n    namespace,\n    owner,\n    replacesDraftId,\n    replacedRevision,\n    draftReplacementPrepared: attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.draftReplacementPrepared] === \"true\",\n    generatedBatchId,\n    generatedBatchSize,\n  };\n}\n\nexport function hasLiveSupportPassportCard(memory: Pick<MemoryFile, \"frontmatter\" | \"content\">): boolean {\n  const metadata = parseSupportPassportCardMetadata(memory);\n  if (metadata?.fields.status !== \"active\" && metadata?.fields.status !== \"pending_review\") return false;\n  if (metadata.sourceMemoryIds.length === 0) return false;\n  return SupportPassportCardSchema.omit({ revision: true }).safeParse({\n    ...metadata.fields,\n    statement: stripAttributesSuffix(memory.content),\n  }).success;\n}\n\nexport function projectSupportPassportCard(memory: MemoryFile): StoredSupportPassportCard | null {\n  const metadata = parseSupportPassportCardMetadata(memory);\n  if (!metadata) return null;\n\n  const fields = {\n    ...metadata.fields,\n    statement: stripAttributesSuffix(memory.content),\n  };\n  const normalized = SupportPassportCardSchema.omit({\n    revision: true,\n  }).safeParse(fields);\n  if (!normalized.success) return null;\n  const parsed = SupportPassportCardSchema.safeParse({\n    ...normalized.data,\n    revision: computeSupportPassportCardRevision(normalized.data),\n  });\n  if (!parsed.success) return null;\n  return {\n    card: parsed.data,\n    memory,\n    order: metadata.order,\n    sourceMemoryIds: metadata.sourceMemoryIds,\n    namespace: metadata.namespace,\n    owner: metadata.owner,\n    replacesDraftId: metadata.replacesDraftId,\n    replacedRevision: metadata.replacedRevision,\n    draftReplacementPrepared: metadata.draftReplacementPrepared,\n    generatedBatchId: metadata.generatedBatchId,\n    generatedBatchSize: metadata.generatedBatchSize,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAgBf,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AAEnC,SAAS,+BAA+B,QAKnC;AACV,QAAM,OAAO,OAAO,YAAY;AAChC,MAAI,MAAM,SAAS,yBAAyB,MAAM,QAAQ,MAAM,SAAS,0BAA0B,MAAM,MAAM;AAC7G,WAAO;AAAA,EACT;AACA,SAAO,OAAO,KAAK,OAAO,YAAY,wBAAwB,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,IAAI,WAAW,mBAAmB,CAAC;AACrH;AAEO,SAAS,sCACd,UACK;AACL,SAAO,SAAS,OAAO,CAAC,WAAW,CAAC,+BAA+B,MAAM,CAAC;AAC5E;AAOO,SAAS,4BAA4B,MAMjC;AACT,SAAO,GAAG,KAAK,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO;AAC7E;AAiBO,SAAS,mDACd,SAGA,WACA,SACwB;AACxB,QAAM,WAAW,oBAAI,IAA8D;AACnF,SAAO,OAAO,EAAE,UAAU,MAAM,QAAQ,MAAM;AAC5C,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ;AAAA,IAC7B,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,UAAU;AACtD,iBAAS,OAAO,QAAQ;AACxB,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AACA,UAAM,WAAW,4BAA4B,IAAI;AACjD,UAAM,QAAQ,UAAU,IAAI,OAAO;AACnC,QAAI,OAAO,iBAAiB,YAAY,MAAM,aAAa,QAAW;AACpE,cAAQ,IAAI,SAAS,EAAE,cAAc,UAAU,UAAU,MAAM,SAAS,CAAC;AACzE,aAAO,MAAM;AAAA,IACf;AACA,UAAM,SAAS,SAAS,IAAI,QAAQ;AACpC,QAAI,QAAQ,aAAa,SAAU,QAAO,MAAM,OAAO;AACvD,UAAM,WAAW,QACd,iBAAiB,QAAQ,EACzB,KAAK,CAAC,WAAY,SAAS,+BAA+B,MAAM,IAAI,KAAM,EAC1E,QAAQ,MAAM;AACb,UAAI,SAAS,IAAI,QAAQ,GAAG,aAAa,SAAU,UAAS,OAAO,QAAQ;AAAA,IAC7E,CAAC;AACH,aAAS,IAAI,UAAU,EAAE,UAAU,SAAS,CAAC;AAC7C,UAAM,SAAS,MAAM;AACrB,YAAQ,IAAI,SAAS,EAAE,cAAc,UAAU,UAAU,OAAO,CAAC;AACjE,WAAO;AAAA,EACT;AACF;AAEO,SAAS,0CAA0C,SAE/B;AACzB,QAAM,kBAAkB,oBAAI,IAA8D;AAC1F,SAAO,OAAO,EAAE,SAAS,MAAM;AAC7B,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,MAAM,QAAQ;AAAA,IAC7B,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,UAAU;AACtD,wBAAgB,OAAO,QAAQ;AAC/B,eAAO;AAAA,MACT;AACA,YAAM;AAAA,IACR;AACA,UAAM,WAAW,GAAG,KAAK,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO;AACrF,UAAM,SAAS,gBAAgB,IAAI,QAAQ;AAC3C,QAAI,QAAQ,aAAa,SAAU,QAAO,MAAM,OAAO;AACvD,UAAM,WAAW,QACd,iBAAiB,QAAQ,EACzB,KAAK,CAAC,WAAY,SAAS,+BAA+B,MAAM,IAAI,KAAM;AAC7E,oBAAgB,IAAI,UAAU,EAAE,UAAU,SAAS,CAAC;AACpD,QAAI;AACF,aAAO,MAAM;AAAA,IACf,SAAS,OAAO;AACd,UAAI,gBAAgB,IAAI,QAAQ,GAAG,aAAa,SAAU,iBAAgB,OAAO,QAAQ;AACzF,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEO,IAAM,kCAAkC,OAAO,OAAO;AAAA,EAC3D,WAAW;AAAA,EACX,mBAAmB;AAAA,EACnB,OAAO;AAAA,EACP,OAAO;AAAA,EACP,UAAU;AAAA,EACV,OAAO;AAAA,EACP,UAAU;AAAA,EACV,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,kBAAkB;AAAA,EAClB,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,oBAAoB;AACtB,CAAC;AAED,IAAM,sCAAsC;AAC5C,IAAM,0CAA0C;AAChD,IAAM,wCAAwC;AAC9C,IAAM,uCAAuC,+BAA+B;AAAA,EAC1E,CAAC,cACC,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,IAAI,KACxB,CAAC,UAAU,SAAS,IAAI,KACxB,CAAC,UAAU,SAAS,GAAG,KACvB,CAAC,UAAU,SAAS,IAAI,KACxB,CAAC,UAAU,SAAS,IAAI,KACxB,CAAC,UAAU,SAAS,IAAI;AAC5B;AAEO,SAAS,yCAAyC,WAA2C;AAClG,QAAM,YAAY,+BAA+B,MAAM,SAAS;AAChE,QAAM,UAAU,OAAO,KAAK,WAAW,MAAM,EAAE,SAAS,WAAW;AACnE,QAAM,SAAS,QAAQ,MAAM,IAAI,OAAO,OAAO,qCAAqC,KAAK,GAAG,CAAC,KAAK,CAAC;AACnG,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAChE,SAAO,OAAO,YAAY;AAAA,IACxB,CAAC,gCAAgC,WAAW,OAAO,CAAC,KAAK,EAAE;AAAA,IAC3D;AAAA,MACE,gCAAgC;AAAA,MAChC,GAAG,mCAAmC,IAAI,OAAO,MAAM,IAAI,MAAM;AAAA,IACnE;AAAA,IACA,GAAG,OAAO,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,UAAU,CAAC,GAAG,uCAAuC,GAAG,QAAQ,CAAC,IAAI,KAAK,CAAC;AAAA,EAC5G,CAAC;AACH;AAEO,SAAS,yCAAyC,YAA6D;AACpH,QAAM,aAAa,WAAW,gCAAgC,SAAS;AACvE,QAAM,WAAW,WAAW,gCAAgC,iBAAiB;AAC7E,MAAI,aAAa,QAAW;AAC1B,UAAM,SAAS,qCAAqC,UAAU,UAAU;AACxE,WAAO,OAAO,UAAU,OAAO,OAAO;AAAA,EACxC;AACA,QAAM,QAAQ,2CAA2C,KAAK,QAAQ;AACtE,MAAI,CAAC,SAAS,OAAO,eAAe,SAAU,QAAO;AACrD,QAAM,aAAa,OAAO,MAAM,CAAC,CAAC;AAClC,MAAI,CAAC,OAAO,cAAc,UAAU,EAAG,QAAO;AAC9C,QAAM,eAAe,OAAO,KAAK,UAAU,EAAE,QAAQ,CAAC,QAAQ;AAC5D,UAAM,aAAa,qCAAqC,KAAK,GAAG;AAChE,WAAO,aAAa,CAAC,OAAO,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAAA,EACjD,CAAC;AACD,MACE,aAAa,WAAW,aAAa,KACrC,aAAa,KAAK,CAAC,UAAU,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,SAAS,UAAU;AAE7F,WAAO;AACT,QAAM,SAAS,CAAC,UAAU;AAC1B,WAAS,QAAQ,GAAG,QAAQ,YAAY,SAAS,GAAG;AAClD,UAAM,QAAQ,WAAW,GAAG,uCAAuC,GAAG,KAAK,EAAE;AAC7E,QAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO;AAC5D,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAM,UAAU,OAAO,KAAK,EAAE;AAC9B,MAAI,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,MAAM,MAAM,CAAC,EAAG,QAAO;AAC5E,QAAM,UAAU,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,MAAM;AACjE,MAAI,OAAO,KAAK,SAAS,MAAM,EAAE,SAAS,WAAW,MAAM,QAAS,QAAO;AAC3E,QAAM,YAAY,+BAA+B,UAAU,OAAO;AAClE,SAAO,UAAU,UAAU,UAAU,OAAO;AAC9C;AAgBO,SAAS,+BAA+B,WAA2B;AACxE,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC5D;AAEO,SAAS,+CACd,OACa;AACb,SAAO,IAAI;AAAA,IACT,MACG,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,QAAQ,EAC9C,IAAI,CAAC,SAAS,KAAK,OAAO,YAAY,UAAU,EAChD,OAAO,CAAC,WAA6B,OAAO,WAAW,QAAQ;AAAA,EACpE;AACF;AAEA,SAAS,qBAAqB,aAAyD;AACrF,QAAM,UAAU,YAAY;AAC5B,QAAM,cAAc,YAAY,uBAAuB,gCAAgC,eAAe;AACtG,QAAM,SAAS,YAAY,gBAAgB,UAAa,gBAAgB,KAAK,CAAC,IAAI,YAAY,MAAM,GAAG;AACvG,MAAI,OAAO,SAAS,EAAG,QAAO;AAC9B,QAAM,aAAuB,CAAC;AAC9B,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,oCAAoC,UAAU,KAAK;AAClE,QAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,eAAW,KAAK,OAAO,IAAI;AAAA,EAC7B;AACA,MAAI,IAAI,IAAI,UAAU,EAAE,SAAS,WAAW,OAAQ,QAAO;AAC3D,SAAO;AACT;AAeA,SAAS,iCAAiC,QAA6E;AACrH,QAAM,cAAc,OAAO;AAC3B,QAAM,aAAa,YAAY;AAC/B,MAAI,YAAY,aAAa,aAAc,QAAO;AAClD,MAAI,CAAC,YAAY,MAAM,SAAS,yBAAyB,EAAG,QAAO;AACnE,MAAI,CAAC,cAAc,YAAY,aAAa,YAAY,cAAc,YAAY,aAAc,QAAO;AAEvG,QAAM,WAAW,kCAAkC,UAAU,WAAW,gCAAgC,QAAQ,CAAC;AACjH,QAAM,SAAS,gCAAgC,UAAU,YAAY,MAAM;AAC3E,QAAM,WAAW,WAAW,gCAAgC,KAAK;AACjE,QAAM,QAAQ,OAAO,QAAQ;AAC7B,QAAM,kBAAkB,qBAAqB,WAAW;AACxD,QAAM,YAAY,yCAAyC,UAAU;AACrE,QAAM,QAAQ,WAAW,gCAAgC,KAAK;AAC9D,MAAI;AACJ,QAAM,qBAAqB,WAAW,gCAAgC,eAAe;AACrF,MAAI,uBAAuB,QAAW;AACpC,UAAM,wBAAwB,8BAA8B,UAAU,kBAAkB;AACxF,QAAI,CAAC,sBAAsB,QAAS,QAAO;AAC3C,sBAAkB,sBAAsB;AAAA,EAC1C;AACA,MAAI;AACJ,QAAM,sBAAsB,WAAW,gCAAgC,gBAAgB;AACvF,MAAI,wBAAwB,QAAW;AACrC,QAAI,CAAC,iBAAiB,KAAK,mBAAmB,EAAG,QAAO;AACxD,uBAAmB;AAAA,EACrB;AACA,QAAM,mBAAmB,WAAW,gCAAgC,gBAAgB;AACpF,QAAM,wBAAwB,WAAW,gCAAgC,kBAAkB;AAC3F,MAAI;AACJ,MAAI,qBAAqB,QAAW;AAClC,QAAI,CAAC,wEAAwE,KAAK,gBAAgB,GAAG;AACnG,aAAO;AAAA,IACT;AACA,QAAI,OAAO,0BAA0B,YAAY,CAAC,UAAU,KAAK,qBAAqB,GAAG;AACvF,aAAO;AAAA,IACT;AACA,yBAAqB,OAAO,qBAAqB;AAAA,EACnD,WAAW,0BAA0B,QAAW;AAC9C,WAAO;AAAA,EACT;AACA,MACE,CAAC,SAAS,WACV,CAAC,OAAO,WACR,OAAO,SAAS,gBAChB,OAAO,aAAa,YACpB,CAAC,mBAAmB,KAAK,QAAQ,KACjC,CAAC,OAAO,cAAc,KAAK,KAC3B,cAAc,QACd,OAAO,UAAU,YACjB,CAAC,iBAAiB,KAAK,KAAK,KAC5B,CAAC;AAED,WAAO;AACT,QAAM,SAAS,0BAA0B,KAAK;AAAA,IAC5C,UAAU;AAAA,IACV,WAAW;AAAA,EACb,CAAC,EAAE,UAAU;AAAA,IACX,QAAQ,YAAY;AAAA,IACpB,OAAO,WAAW,gCAAgC,KAAK;AAAA,IACvD,UAAU,SAAS;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,WAAW,YAAY;AAAA,IACvB,UAAU,WAAW,gCAAgC,QAAQ;AAAA,EAC/D,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,WAAW,gCAAgC,wBAAwB,MAAM;AAAA,IACnG;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,2BAA2B,QAA8D;AACvG,QAAM,WAAW,iCAAiC,MAAM;AACxD,MAAI,UAAU,OAAO,WAAW,YAAY,UAAU,OAAO,WAAW,iBAAkB,QAAO;AACjG,MAAI,SAAS,gBAAgB,WAAW,EAAG,QAAO;AAClD,SAAO,0BAA0B,KAAK,EAAE,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAClE,GAAG,SAAS;AAAA,IACZ,WAAW,sBAAsB,OAAO,OAAO;AAAA,EACjD,CAAC,EAAE;AACL;AAEO,SAAS,2BAA2B,QAAsD;AAC/F,QAAM,WAAW,iCAAiC,MAAM;AACxD,MAAI,CAAC,SAAU,QAAO;AAEtB,QAAM,SAAS;AAAA,IACb,GAAG,SAAS;AAAA,IACZ,WAAW,sBAAsB,OAAO,OAAO;AAAA,EACjD;AACA,QAAM,aAAa,0BAA0B,KAAK;AAAA,IAChD,UAAU;AAAA,EACZ,CAAC,EAAE,UAAU,MAAM;AACnB,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,QAAM,SAAS,0BAA0B,UAAU;AAAA,IACjD,GAAG,WAAW;AAAA,IACd,UAAU,mCAAmC,WAAW,IAAI;AAAA,EAC9D,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb;AAAA,IACA,OAAO,SAAS;AAAA,IAChB,iBAAiB,SAAS;AAAA,IAC1B,WAAW,SAAS;AAAA,IACpB,OAAO,SAAS;AAAA,IAChB,iBAAiB,SAAS;AAAA,IAC1B,kBAAkB,SAAS;AAAA,IAC3B,0BAA0B,SAAS;AAAA,IACnC,kBAAkB,SAAS;AAAA,IAC3B,oBAAoB,SAAS;AAAA,EAC/B;AACF;","names":[]}

package/dist/{chunk-NGHDW6UU.js → chunk-NUQEREIP.js}

@@ -1,7 +1,7 @@
 import {
   projectTagProjectId,
   resolveGitContext
-} from "./chunk-63E37JCN.js";
+} from "./chunk-4RAJT5L2.js";
 
 // src/access-coding-context-resolution.ts
 async function resolveCodingContextFromOptions(options) {
@@ -33,4 +33,4 @@ async function resolveCodingContextFromOptions(options) {
 export {
   resolveCodingContextFromOptions
 };
-//# sourceMappingURL=chunk-NGHDW6UU.js.map
+//# sourceMappingURL=chunk-NUQEREIP.js.map

package/dist/{chunk-5IIQU4JZ.js → chunk-OB72KNMF.js}

@@ -1,9 +1,9 @@
-import {
-  isDirectAnswerEligible
-} from "./chunk-PYIR4SSB.js";
 import {
   cjkBigrams
 } from "./chunk-CIO7GCWE.js";
+import {
+  isDirectAnswerEligible
+} from "./chunk-PYIR4SSB.js";
 import {
   normalizeRecallTokens
 } from "./chunk-YCVB7X56.js";
@@ -179,4 +179,4 @@ export {
   resolveCategory,
   tryDirectAnswer
 };
-//# sourceMappingURL=chunk-5IIQU4JZ.js.map
+//# sourceMappingURL=chunk-OB72KNMF.js.map

package/dist/{chunk-7L3TODI7.js → chunk-OJXJWNFY.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-WWK6J6SE.js";
+} from "./chunk-WQURALGV.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-7L3TODI7.js.map
+//# sourceMappingURL=chunk-OJXJWNFY.js.map

package/dist/{chunk-66L5ZRJC.js → chunk-P3WRNWWM.js}

@@ -1,11 +1,152 @@
 import {
-  SupportPassportError,
-  getOperation
-} from "./chunk-STSLB4HT.js";
+  SupportPassportCardCategorySchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportNamespaceSchema
+} from "./chunk-AHA5VQGP.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   abortError,
   isAbortError
 } from "./chunk-R2MBW2S4.js";
+import {
+  getOperation
+} from "./chunk-JTSSSR4L.js";
+
+// src/support-passport/grant-contracts.ts
+import { z } from "zod";
+var IsoTimestampSchema = z.string().datetime({ offset: true }).refine((value) => parseIsoOffsetTimestamp(value) !== null, "timestamp must be a real date");
+var RevisionSchema = z.string().regex(/^[a-f0-9]{64}$/);
+var GrantIdSchema = z.string().uuid().transform((value) => value.toLowerCase());
+var SupportPassportGrantCardRefSchema = z.object({
+  cardId: SupportPassportMemoryIdSchema,
+  revision: RevisionSchema
+}).strict();
+var SupportPassportGrantStateSchema = z.object({
+  schemaVersion: z.literal(1),
+  stateVersion: z.number().int().positive(),
+  grantId: GrantIdSchema,
+  namespace: SupportPassportNamespaceSchema,
+  principalHash: RevisionSchema,
+  ownerLockKey: RevisionSchema,
+  secretHash: RevisionSchema,
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  createdAt: IsoTimestampSchema,
+  expiresAt: IsoTimestampSchema,
+  revokedAt: IsoTimestampSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, card] of grant.cards.entries()) {
+    if (ids.has(card.cardId)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card IDs must be unique",
+        path: ["cards", index, "cardId"]
+      });
+    }
+    ids.add(card.cardId);
+  }
+  if (Date.parse(grant.expiresAt) <= Date.parse(grant.createdAt)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "expiresAt must follow createdAt", path: ["expiresAt"] });
+  }
+});
+var SupportPassportCreateGrantInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  expiresAt: IsoTimestampSchema.optional(),
+  durationMs: z.number().int().min(3e5).max(6048e5).optional()
+}).strict().superRefine((input, ctx) => {
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, card] of input.cards.entries()) {
+    if (ids.has(card.cardId)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card IDs must be unique",
+        path: ["cards", index, "cardId"]
+      });
+    }
+    ids.add(card.cardId);
+  }
+  if (input.expiresAt === void 0 === (input.durationMs === void 0)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "one expiry value is required",
+      path: ["expiresAt"]
+    });
+  }
+});
+var SupportPassportCreateGrantRequestSchema = z.object({
+  cardIds: z.array(SupportPassportMemoryIdSchema).min(1).max(8),
+  cardRevisions: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  expiresAt: IsoTimestampSchema.optional(),
+  durationMs: z.number().int().min(3e5).max(6048e5).optional()
+}).strict().superRefine((input, ctx) => {
+  const cardIds = new Set(input.cardIds);
+  const revisionIds = new Set(input.cardRevisions.map((card) => card.cardId));
+  if (cardIds.size !== input.cardIds.length || revisionIds.size !== input.cardRevisions.length || cardIds.size !== revisionIds.size || input.cardIds.some((cardId) => !revisionIds.has(cardId))) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "card revisions must match the selected card IDs",
+      path: ["cardRevisions"]
+    });
+  }
+  if (input.expiresAt === void 0 === (input.durationMs === void 0)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "one expiry value is required",
+      path: ["expiresAt"]
+    });
+  }
+});
+var SupportPassportOwnerCreateGrantRequestSchema = SupportPassportCreateGrantRequestSchema;
+var SupportPassportOwnerGrantSchema = z.object({
+  grantId: GrantIdSchema,
+  stateVersion: z.number().int().positive(),
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  createdAt: IsoTimestampSchema,
+  expiresAt: IsoTimestampSchema,
+  revokedAt: IsoTimestampSchema.optional(),
+  status: z.enum(["active", "expired", "revoked"])
+}).strict();
+var SupportPassportCreatedGrantSchema = z.object({
+  grant: SupportPassportOwnerGrantSchema,
+  secret: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+}).strict();
+var SupportPassportPublicCardSchema = z.object({
+  cardId: SupportPassportMemoryIdSchema,
+  title: z.string().trim().min(1).max(80),
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  updatedAt: IsoTimestampSchema
+}).strict();
+var SupportPassportPublicGuideSchema = z.object({
+  schemaVersion: z.literal(1),
+  grantId: GrantIdSchema,
+  expiresAt: IsoTimestampSchema,
+  updatedAt: IsoTimestampSchema,
+  cards: z.array(SupportPassportPublicCardSchema).min(1).max(8)
+}).strict();
+var SupportPassportRevokeGrantInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  grantId: GrantIdSchema,
+  expectedStateVersion: z.number().int().positive().optional()
+}).strict();
+var SupportPassportListGrantsInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512)
+}).strict();
+
+// src/support-passport/errors.ts
+var SupportPassportError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "SupportPassportError";
+    this.code = code;
+    this.status = status;
+  }
+};
 
 // src/support-passport/public-http.ts
 import { createHash } from "crypto";
@@ -494,9 +635,21 @@ function composeSupportPassportExternalRequestHandlers(...handlers) {
 }
 
 export {
+  SupportPassportGrantCardRefSchema,
+  SupportPassportGrantStateSchema,
+  SupportPassportCreateGrantInputSchema,
+  SupportPassportCreateGrantRequestSchema,
+  SupportPassportOwnerCreateGrantRequestSchema,
+  SupportPassportOwnerGrantSchema,
+  SupportPassportCreatedGrantSchema,
+  SupportPassportPublicCardSchema,
+  SupportPassportPublicGuideSchema,
+  SupportPassportRevokeGrantInputSchema,
+  SupportPassportListGrantsInputSchema,
+  SupportPassportError,
   SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES,
   normalizeSupportPassportNetworkAddress,
   buildSupportPassportPublicRequestHandler,
   composeSupportPassportExternalRequestHandlers
 };
-//# sourceMappingURL=chunk-66L5ZRJC.js.map
+//# sourceMappingURL=chunk-P3WRNWWM.js.map

package/dist/chunk-P3WRNWWM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/support-passport/grant-contracts.ts","../src/support-passport/errors.ts","../src/support-passport/public-http.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { parseIsoOffsetTimestamp } from \"../utils/iso-timestamp.js\";\nimport {\n  SupportPassportCardCategorySchema,\n  SupportPassportMemoryIdSchema,\n  SupportPassportNamespaceSchema,\n} from \"./contracts.js\";\n\nconst IsoTimestampSchema = z\n  .string()\n  .datetime({ offset: true })\n  .refine((value) => parseIsoOffsetTimestamp(value) !== null, \"timestamp must be a real date\");\nconst RevisionSchema = z.string().regex(/^[a-f0-9]{64}$/);\nconst GrantIdSchema = z\n  .string()\n  .uuid()\n  .transform((value) => value.toLowerCase());\n\nexport const SupportPassportGrantCardRefSchema = z\n  .object({\n    cardId: SupportPassportMemoryIdSchema,\n    revision: RevisionSchema,\n  })\n  .strict();\n\nexport const SupportPassportGrantStateSchema = z\n  .object({\n    schemaVersion: z.literal(1),\n    stateVersion: z.number().int().positive(),\n    grantId: GrantIdSchema,\n    namespace: SupportPassportNamespaceSchema,\n    principalHash: RevisionSchema,\n    ownerLockKey: RevisionSchema,\n    secretHash: RevisionSchema,\n    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),\n    createdAt: IsoTimestampSchema,\n    expiresAt: IsoTimestampSchema,\n    revokedAt: IsoTimestampSchema.optional(),\n  })\n  .strict()\n  .superRefine((grant, ctx) => {\n    const ids = new Set<string>();\n    for (const [index, card] of grant.cards.entries()) {\n      if (ids.has(card.cardId)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: \"card IDs must be unique\",\n          path: [\"cards\", index, \"cardId\"],\n        });\n      }\n      ids.add(card.cardId);\n    }\n    if (Date.parse(grant.expiresAt) <= Date.parse(grant.createdAt)) {\n      ctx.addIssue({ code: z.ZodIssueCode.custom, message: \"expiresAt must follow createdAt\", path: [\"expiresAt\"] });\n    }\n  });\n\nexport const SupportPassportCreateGrantInputSchema = z\n  .object({\n    principal: z.string().trim().min(1).max(512),\n    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),\n    expiresAt: IsoTimestampSchema.optional(),\n    durationMs: z.number().int().min(300_000).max(604_800_000).optional(),\n  })\n  .strict()\n  .superRefine((input, ctx) => {\n    const ids = new Set<string>();\n    for (const [index, card] of input.cards.entries()) {\n      if (ids.has(card.cardId)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: \"card IDs must be unique\",\n          path: [\"cards\", index, \"cardId\"],\n        });\n      }\n      ids.add(card.cardId);\n    }\n    if ((input.expiresAt === undefined) === (input.durationMs === undefined)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"one expiry value is required\",\n        path: [\"expiresAt\"],\n      });\n    }\n  });\n\nexport const SupportPassportCreateGrantRequestSchema = z\n  .object({\n    cardIds: z.array(SupportPassportMemoryIdSchema).min(1).max(8),\n    cardRevisions: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),\n    expiresAt: IsoTimestampSchema.optional(),\n    durationMs: z.number().int().min(300_000).max(604_800_000).optional(),\n  })\n  .strict()\n  .superRefine((input, ctx) => {\n    const cardIds = new Set(input.cardIds);\n    const revisionIds = new Set(input.cardRevisions.map((card) => card.cardId));\n    if (\n      cardIds.size !== input.cardIds.length ||\n      revisionIds.size !== input.cardRevisions.length ||\n      cardIds.size !== revisionIds.size ||\n      input.cardIds.some((cardId) => !revisionIds.has(cardId))\n    ) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"card revisions must match the selected card IDs\",\n        path: [\"cardRevisions\"],\n      });\n    }\n    if ((input.expiresAt === undefined) === (input.durationMs === undefined)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: \"one expiry value is required\",\n        path: [\"expiresAt\"],\n      });\n    }\n  });\n\nexport const SupportPassportOwnerCreateGrantRequestSchema = SupportPassportCreateGrantRequestSchema;\n\nexport const SupportPassportOwnerGrantSchema = z\n  .object({\n    grantId: GrantIdSchema,\n    stateVersion: z.number().int().positive(),\n    cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),\n    createdAt: IsoTimestampSchema,\n    expiresAt: IsoTimestampSchema,\n    revokedAt: IsoTimestampSchema.optional(),\n    status: z.enum([\"active\", \"expired\", \"revoked\"]),\n  })\n  .strict();\n\nexport const SupportPassportCreatedGrantSchema = z\n  .object({\n    grant: SupportPassportOwnerGrantSchema,\n    secret: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n  })\n  .strict();\n\nexport const SupportPassportPublicCardSchema = z\n  .object({\n    cardId: SupportPassportMemoryIdSchema,\n    title: z.string().trim().min(1).max(80),\n    statement: z.string().trim().min(1).max(500),\n    category: SupportPassportCardCategorySchema,\n    updatedAt: IsoTimestampSchema,\n  })\n  .strict();\n\nexport const SupportPassportPublicGuideSchema = z\n  .object({\n    schemaVersion: z.literal(1),\n    grantId: GrantIdSchema,\n    expiresAt: IsoTimestampSchema,\n    updatedAt: IsoTimestampSchema,\n    cards: z.array(SupportPassportPublicCardSchema).min(1).max(8),\n  })\n  .strict();\n\nexport const SupportPassportRevokeGrantInputSchema = z\n  .object({\n    principal: z.string().trim().min(1).max(512),\n    grantId: GrantIdSchema,\n    expectedStateVersion: z.number().int().positive().optional(),\n  })\n  .strict();\n\nexport const SupportPassportListGrantsInputSchema = z\n  .object({\n    principal: z.string().trim().min(1).max(512),\n  })\n  .strict();\n\nexport type SupportPassportGrantCardRef = z.infer<typeof SupportPassportGrantCardRefSchema>;\nexport type SupportPassportGrantState = z.infer<typeof SupportPassportGrantStateSchema>;\nexport type SupportPassportCreateGrantInput = z.input<typeof SupportPassportCreateGrantInputSchema>;\nexport type SupportPassportCreateGrantRequest = z.input<typeof SupportPassportCreateGrantRequestSchema>;\nexport type SupportPassportOwnerCreateGrantRequest = z.input<typeof SupportPassportOwnerCreateGrantRequestSchema>;\nexport type SupportPassportOwnerGrant = z.infer<typeof SupportPassportOwnerGrantSchema>;\nexport type SupportPassportCreatedGrant = z.infer<typeof SupportPassportCreatedGrantSchema>;\nexport type SupportPassportPublicGuide = z.infer<typeof SupportPassportPublicGuideSchema>;\nexport type SupportPassportRevokeGrantInput = z.input<typeof SupportPassportRevokeGrantInputSchema>;\n","export type SupportPassportErrorCode =\n  | \"card_data_invalid\"\n  | \"card_not_found\"\n  | \"consent_required\"\n  | \"feature_disabled\"\n  | \"forbidden\"\n  | \"grant_expired\"\n  | \"grant_gone\"\n  | \"grant_not_found\"\n  | \"grant_stale\"\n  | \"invalid_card_status\"\n  | \"invalid_input\"\n  | \"model_output_invalid\"\n  | \"provider_unavailable\"\n  | \"rate_limited\"\n  | \"revision_conflict\"\n  | \"state_conflict\"\n  | \"storage_conflict\";\n\nexport class SupportPassportError extends Error {\n  readonly code: SupportPassportErrorCode;\n  readonly status: number;\n\n  constructor(code: SupportPassportErrorCode, message: string, status: number) {\n    super(message);\n    this.name = \"SupportPassportError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n","import { createHash } from \"node:crypto\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { isIP } from \"node:net\";\n\nimport { abortError, isAbortError } from \"../abort-error.js\";\nimport { type OperationName, getOperation } from \"../access-boundary.js\";\nimport type { EngramAccessService } from \"../access-service.js\";\nimport { SupportPassportError } from \"./errors.js\";\n\nconst PUBLIC_RATE_LIMIT_MAX_KEYS = 20_000;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL = 256;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK = 8;\nconst PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL = 256;\n\nexport const SUPPORT_PASSPORT_PUBLIC_HTTP_ROUTES = [\n  {\n    method: \"GET\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id\",\n    operation: \"support_passport_grant_read\",\n  },\n  {\n    method: \"POST\",\n    pathname: \"/engram/v1/support-passport/public/grants/:id/ask\",\n    operation: \"support_passport_grant_ask\",\n  },\n] as const satisfies ReadonlyArray<{ method: string; pathname: string; operation: OperationName }>;\n\nexport type SupportPassportExternalRequestHandler = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  ctx: {\n    authorized: boolean;\n    tokenAuthorized: boolean;\n  }\n) => Promise<boolean>;\n\ninterface WindowEntry {\n  count: number;\n  resetAt: number;\n}\n\ninterface WindowReservation {\n  commit(): void;\n  release(): void;\n}\n\nclass UnreadSupportPassportRequestError extends Error {\n  constructor(readonly response: SupportPassportError) {\n    super(response.message);\n    this.name = \"UnreadSupportPassportRequestError\";\n  }\n}\n\nclass FixedWindowLimiter {\n  private readonly entries = new Map<string, WindowEntry>();\n\n  constructor(\n    private readonly limit: number,\n    private readonly windowMs: number,\n    private readonly now: () => number\n  ) {}\n\n  consume(key: string): boolean {\n    const reservation = this.reserve(key);\n    if (!reservation) return false;\n    reservation.commit();\n    return true;\n  }\n\n  reserve(key: string): WindowReservation | undefined {\n    const now = this.now();\n    let entry = this.entries.get(key);\n    if (!entry || entry.resetAt <= now) {\n      if (!entry && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n        this.prune(now);\n        if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return undefined;\n      }\n      entry = { count: 0, resetAt: now + this.windowMs };\n      this.entries.set(key, entry);\n    }\n    if (entry.count >= this.limit) return undefined;\n    entry.count += 1;\n    let active = true;\n    return {\n      commit: () => {\n        active = false;\n      },\n      release: () => {\n        if (!active) return;\n        active = false;\n        if (this.entries.get(key) !== entry) return;\n        entry.count -= 1;\n        if (entry.count === 0) this.entries.delete(key);\n      },\n    };\n  }\n\n  allows(key: string): boolean {\n    const now = this.now();\n    const current = this.entries.get(key);\n    if (current && current.resetAt > now) return current.count < this.limit;\n    if (!current && this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) {\n      this.prune(now);\n      if (this.entries.size >= PUBLIC_RATE_LIMIT_MAX_KEYS) return false;\n    }\n    return true;\n  }\n\n  private prune(now: number): void {\n    for (const [key, entry] of this.entries) {\n      if (entry.resetAt <= now) this.entries.delete(key);\n    }\n  }\n}\n\nclass InFlightLimiter {\n  private readonly counts = new Map<string, number>();\n  private total = 0;\n\n  constructor(\n    private readonly perKeyLimit: number,\n    private readonly totalLimit: number\n  ) {}\n\n  reserve(key: string): (() => void) | undefined {\n    const current = this.counts.get(key) ?? 0;\n    if (current >= this.perKeyLimit || this.total >= this.totalLimit) return undefined;\n    this.counts.set(key, current + 1);\n    this.total += 1;\n    let active = true;\n    return () => {\n      if (!active) return;\n      active = false;\n      const count = this.counts.get(key) ?? 0;\n      if (count <= 1) this.counts.delete(key);\n      else this.counts.set(key, count - 1);\n      this.total -= 1;\n    };\n  }\n}\n\ninterface PublicRateLimits {\n  authentications: InFlightLimiter;\n  modelCalls: InFlightLimiter;\n  grantReads: FixedWindowLimiter;\n  networkReads: FixedWindowLimiter;\n  networkReadFailures: FixedWindowLimiter;\n  grantQuestions: FixedWindowLimiter;\n  networkQuestions: FixedWindowLimiter;\n  networkQuestionFailures: FixedWindowLimiter;\n}\n\nexport interface SupportPassportPublicHandlerOptions {\n  now?: () => number;\n  trustedProxyAddresses?: readonly string[];\n}\n\nfunction createRateLimits(now: () => number): PublicRateLimits {\n  return {\n    authentications: new InFlightLimiter(PUBLIC_AUTH_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_AUTH_MAX_IN_FLIGHT_TOTAL),\n    modelCalls: new InFlightLimiter(PUBLIC_MODEL_MAX_IN_FLIGHT_PER_NETWORK, PUBLIC_MODEL_MAX_IN_FLIGHT_TOTAL),\n    grantReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReads: new FixedWindowLimiter(60, 60_000, now),\n    networkReadFailures: new FixedWindowLimiter(60, 60_000, now),\n    grantQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestions: new FixedWindowLimiter(20, 10 * 60_000, now),\n    networkQuestionFailures: new FixedWindowLimiter(20, 10 * 60_000, now),\n  };\n}\n\nfunction rateLimited(): SupportPassportError {\n  return new SupportPassportError(\"rate_limited\", \"Too many helper requests.\", 429);\n}\n\nasync function runPublicOperation(\n  service: EngramAccessService,\n  name: \"support_passport_grant_read\" | \"support_passport_grant_ask\",\n  input: Record<string, unknown>,\n  signal?: AbortSignal\n): Promise<unknown> {\n  const operation = getOperation(name);\n  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);\n  const output = (await operation.run(input, {\n    service,\n    ...(signal ? { abortSignal: signal } : {}),\n  })) as { result: unknown };\n  return output.result;\n}\n\nfunction reserveAuthenticatedLimits(\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  networkKey: string,\n  grantId: string\n): WindowReservation {\n  const network = networkLimiter.reserve(networkKey);\n  if (!network) throw rateLimited();\n  const grant = grantLimiter.reserve(grantId);\n  if (!grant) {\n    network.release();\n    throw rateLimited();\n  }\n  let active = true;\n  return {\n    commit: () => {\n      if (!active) return;\n      active = false;\n      network.commit();\n      grant.commit();\n    },\n    release: () => {\n      if (!active) return;\n      active = false;\n      grant.release();\n      network.release();\n    },\n  };\n}\n\nasync function readGrantUnderAuthenticationReservation(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter\n) {\n  if (!failureLimiter.allows(networkKey)) throw rateLimited();\n  const limits = reserveAuthenticatedLimits(networkLimiter, grantLimiter, networkKey, grantId);\n  let guide: Awaited<ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>>;\n  try {\n    guide = (await runPublicOperation(service, \"support_passport_grant_read\", { grantId, secret })) as Awaited<\n      ReturnType<EngramAccessService[\"supportPassportReadGrant\"]>\n    >;\n  } catch (error) {\n    if (error instanceof SupportPassportError) {\n      if (error.code === \"grant_not_found\") {\n        limits.release();\n        if (!failureLimiter.consume(networkKey)) throw rateLimited();\n      } else {\n        limits.commit();\n      }\n    } else {\n      limits.release();\n    }\n    throw error;\n  }\n  limits.commit();\n  return guide;\n}\n\nasync function readGrantWithRateLimits(\n  service: EngramAccessService,\n  grantId: string,\n  secret: string,\n  networkKey: string,\n  networkLimiter: FixedWindowLimiter,\n  grantLimiter: FixedWindowLimiter,\n  failureLimiter: FixedWindowLimiter,\n  authenticationLimiter: InFlightLimiter\n) {\n  const releaseAuthentication = authenticationLimiter.reserve(networkKey);\n  if (!releaseAuthentication) throw rateLimited();\n  try {\n    return await readGrantUnderAuthenticationReservation(\n      service,\n      grantId,\n      secret,\n      networkKey,\n      networkLimiter,\n      grantLimiter,\n      failureLimiter\n    );\n  } finally {\n    releaseAuthentication();\n  }\n}\n\nexport function normalizeSupportPassportNetworkAddress(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  const address = value.trim().toLowerCase();\n  const family = isIP(address);\n  if (family === 0) return undefined;\n  if (family === 4) return address;\n  const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1);\n  const mapped = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(canonical);\n  if (!mapped) return canonical;\n  const high = Number.parseInt(mapped[1] ?? \"\", 16);\n  const low = Number.parseInt(mapped[2] ?? \"\", 16);\n  return `${high >>> 8}.${high & 0xff}.${low >>> 8}.${low & 0xff}`;\n}\n\nfunction requestNetworkAddress(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  const directAddress = normalizeSupportPassportNetworkAddress(req.socket.remoteAddress) ?? \"unknown\";\n  if (!trustedProxyAddresses.has(directAddress)) return directAddress;\n  const forwarded = req.headers[\"x-forwarded-for\"];\n  if (typeof forwarded !== \"string\") return directAddress;\n  const rawAddresses = forwarded.split(\",\");\n  if (rawAddresses.length < 1 || rawAddresses.length > 32) return directAddress;\n  const addresses = rawAddresses.map((address) => normalizeSupportPassportNetworkAddress(address));\n  if (addresses.some((address) => address === undefined)) return directAddress;\n  for (let index = addresses.length - 1; index >= 0; index -= 1) {\n    const address = addresses[index];\n    if (address && !trustedProxyAddresses.has(address)) return address;\n  }\n  return addresses[0] ?? directAddress;\n}\n\nfunction networkDigest(req: IncomingMessage, trustedProxyAddresses: ReadonlySet<string>): string {\n  return createHash(\"sha256\")\n    .update(requestNetworkAddress(req, trustedProxyAddresses))\n    .digest(\"hex\");\n}\n\nfunction parseSecret(req: IncomingMessage): string | undefined {\n  const raw = req.headers.authorization;\n  if (typeof raw !== \"string\") return undefined;\n  const match = /^(\\S+)[ \\t]+(\\S+)$/.exec(raw);\n  if (!match || match[1]?.toLowerCase() !== \"supportpassport\") return undefined;\n  const secret = match[2] ?? \"\";\n  if (!/^[A-Za-z0-9_-]{32,256}$/.test(secret)) return undefined;\n  return secret;\n}\n\nfunction requestDeclaresBody(req: IncomingMessage): boolean {\n  const contentLength = req.headers[\"content-length\"];\n  const transferEncoding = req.headers[\"transfer-encoding\"];\n  return transferEncoding !== undefined || (contentLength !== undefined && contentLength !== \"0\");\n}\n\nfunction respondJson(res: ServerResponse, status: number, payload: unknown): void {\n  const body = JSON.stringify(payload);\n  res.statusCode = status;\n  res.setHeader(\"cache-control\", \"private, no-store\");\n  res.setHeader(\"vary\", \"Authorization\");\n  res.setHeader(\"content-type\", \"application/json; charset=utf-8\");\n  res.setHeader(\"content-length\", String(Buffer.byteLength(body)));\n  res.end(body);\n}\n\nfunction respondJsonAndCloseUnreadRequest(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  res.shouldKeepAlive = false;\n  res.setHeader(\"connection\", \"close\");\n  res.once(\"finish\", () => req.destroy());\n  respondJson(res, status, payload);\n}\n\nfunction respondBeforeReadingBody(\n  req: IncomingMessage,\n  res: ServerResponse,\n  status: number,\n  payload: unknown\n): void {\n  if (requestDeclaresBody(req)) {\n    respondJsonAndCloseUnreadRequest(req, res, status, payload);\n    return;\n  }\n  respondJson(res, status, payload);\n}\n\nasync function readQuestionBody(req: IncomingMessage, signal: AbortSignal): Promise<string> {\n  const content = await new Promise<Buffer>((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let bytes = 0;\n    let settled = false;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      req.off(\"aborted\", onAborted);\n      signal.removeEventListener(\"abort\", onSignalAbort);\n    };\n    const fail = (error: unknown) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      reject(error);\n    };\n    const helperLeft = () =>\n      isAbortError(signal.reason) ? signal.reason : abortError(\"The helper left.\");\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);\n      bytes += buffer.length;\n      if (bytes > 4_096) {\n        req.pause();\n        fail(\n          new UnreadSupportPassportRequestError(\n            new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400)\n          )\n        );\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      resolve(Buffer.concat(chunks, bytes));\n    };\n    const onError = (error: Error) => fail(signal.aborted || req.aborted ? helperLeft() : error);\n    const onAborted = () => fail(helperLeft());\n    const onSignalAbort = () => fail(helperLeft());\n    req.on(\"data\", onData);\n    req.once(\"end\", onEnd);\n    req.once(\"error\", onError);\n    req.once(\"aborted\", onAborted);\n    signal.addEventListener(\"abort\", onSignalAbort, { once: true });\n    if (signal.aborted) onSignalAbort();\n  });\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(content.toString(\"utf8\"));\n  } catch {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const body = parsed as Record<string, unknown>;\n  if (Object.keys(body).length !== 1 || typeof body.question !== \"string\") {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  const question = body.question.trim();\n  if (question.length < 1 || question.length > 500) {\n    throw new SupportPassportError(\"invalid_input\", \"The helper question is invalid.\", 400);\n  }\n  return question;\n}\n\nfunction requestSignal(req: IncomingMessage, res: ServerResponse): { signal: AbortSignal; cleanup(): void } {\n  const controller = new AbortController();\n  const abort = () => {\n    if (!res.writableFinished && !controller.signal.aborted) controller.abort(abortError(\"The helper left.\"));\n  };\n  req.once(\"aborted\", abort);\n  res.once(\"close\", abort);\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      req.off(\"aborted\", abort);\n      res.off(\"close\", abort);\n    },\n  };\n}\n\nfunction decodeGrantId(raw: string): string | undefined {\n  try {\n    const value = decodeURIComponent(raw);\n    return /^[A-Za-z0-9_-]{1,128}$/.test(value) ? value.toLowerCase() : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nexport function buildSupportPassportPublicRequestHandler(\n  service: EngramAccessService,\n  options: SupportPassportPublicHandlerOptions = {}\n): SupportPassportExternalRequestHandler {\n  const rateLimits = createRateLimits(options.now ?? Date.now);\n  const trustedProxyAddresses = new Set(\n    (options.trustedProxyAddresses ?? [])\n      .map((address) => normalizeSupportPassportNetworkAddress(address))\n      .filter((address): address is string => address !== undefined)\n  );\n  return async (req, res) => {\n    let parsed: URL;\n    try {\n      parsed = new URL(req.url ?? \"/\", \"http://placeholder\");\n    } catch {\n      return false;\n    }\n    const readMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)$/.exec(parsed.pathname);\n    const askMatch = /^\\/engram\\/v1\\/support-passport\\/public\\/grants\\/([^/]+)\\/ask$/.exec(parsed.pathname);\n    const ownedRead = req.method === \"GET\" && readMatch;\n    const ownedQuestion = req.method === \"POST\" && askMatch;\n    if (!ownedRead && !ownedQuestion) return false;\n\n    res.setHeader(\"cache-control\", \"private, no-store\");\n    res.setHeader(\"vary\", \"Authorization\");\n    const grantId = decodeGrantId((ownedRead ? readMatch?.[1] : askMatch?.[1]) ?? \"\");\n    const secret = parseSecret(req);\n    if (parsed.search.length > 0) {\n      respondBeforeReadingBody(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (ownedRead && requestDeclaresBody(req)) {\n      respondJsonAndCloseUnreadRequest(req, res, 400, {\n        error: \"The share link request is invalid.\",\n        code: \"invalid_input\",\n      });\n      return true;\n    }\n    if (!grantId || !secret) {\n      respondBeforeReadingBody(req, res, 404, {\n        error: \"The share link was not found.\",\n        code: \"grant_not_found\",\n      });\n      return true;\n    }\n\n    const lifecycle = requestSignal(req, res);\n    try {\n      const digest = networkDigest(req, trustedProxyAddresses);\n      if (ownedRead) {\n        const guide = await readGrantWithRateLimits(\n          service,\n          grantId,\n          secret,\n          digest,\n          rateLimits.networkReads,\n          rateLimits.grantReads,\n          rateLimits.networkReadFailures,\n          rateLimits.authentications\n        );\n        respondJson(res, 200, guide);\n      } else {\n        let releaseAuthentication = rateLimits.authentications.reserve(digest);\n        if (!releaseAuthentication) throw new UnreadSupportPassportRequestError(rateLimited());\n        try {\n          let question: string;\n          const bodyFailure = rateLimits.networkQuestionFailures.reserve(digest);\n          if (!bodyFailure) throw new UnreadSupportPassportRequestError(rateLimited());\n          try {\n            question = await readQuestionBody(req, lifecycle.signal);\n            bodyFailure.release();\n          } catch (error) {\n            const supportError =\n              error instanceof UnreadSupportPassportRequestError ? error.response : error;\n            if (supportError instanceof SupportPassportError && supportError.code === \"invalid_input\") {\n              bodyFailure.commit();\n            } else {\n              bodyFailure.release();\n            }\n            throw error;\n          }\n          const releaseModelCall = rateLimits.modelCalls.reserve(digest);\n          if (!releaseModelCall) throw rateLimited();\n          try {\n            await readGrantUnderAuthenticationReservation(\n              service,\n              grantId,\n              secret,\n              digest,\n              rateLimits.networkQuestions,\n              rateLimits.grantQuestions,\n              rateLimits.networkQuestionFailures\n            );\n            releaseAuthentication();\n            releaseAuthentication = undefined;\n            const answer = await runPublicOperation(\n              service,\n              \"support_passport_grant_ask\",\n              { grantId, secret, question },\n              lifecycle.signal\n            );\n            respondJson(res, 200, answer);\n          } finally {\n            releaseModelCall();\n          }\n        } finally {\n          releaseAuthentication?.();\n        }\n      }\n    } catch (error) {\n      if (error instanceof UnreadSupportPassportRequestError) {\n        respondJsonAndCloseUnreadRequest(req, res, error.response.status, {\n          error: error.response.message,\n          code: error.response.code,\n        });\n        return true;\n      }\n      if (!(error instanceof SupportPassportError)) throw error;\n      respondJson(res, error.status, { error: error.message, code: error.code });\n    } finally {\n      lifecycle.cleanup();\n    }\n    return true;\n  };\n}\n\nexport function composeSupportPassportExternalRequestHandlers(\n  ...handlers: Array<SupportPassportExternalRequestHandler | undefined>\n): SupportPassportExternalRequestHandler {\n  return async (req, res, ctx) => {\n    for (const handler of handlers) {\n      if (handler && (await handler(req, res, ctx))) return true;\n    }\n    return false;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AASlB,IAAM,qBAAqB,EACxB,OAAO,EACP,SAAS,EAAE,QAAQ,KAAK,CAAC,EACzB,OAAO,CAAC,UAAU,wBAAwB,KAAK,MAAM,MAAM,+BAA+B;AAC7F,IAAM,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AACxD,IAAM,gBAAgB,EACnB,OAAO,EACP,KAAK,EACL,UAAU,CAAC,UAAU,MAAM,YAAY,CAAC;AAEpC,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,UAAU;AACZ,CAAC,EACA,OAAO;AAEH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxC,SAAS;AAAA,EACT,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,OAAO,EAAE,MAAM,iCAAiC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9D,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW,mBAAmB,SAAS;AACzC,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,OAAO,IAAI,KAAK,MAAM,MAAM,QAAQ,GAAG;AACjD,QAAI,IAAI,IAAI,KAAK,MAAM,GAAG;AACxB,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,QACT,MAAM,CAAC,SAAS,OAAO,QAAQ;AAAA,MACjC,CAAC;AAAA,IACH;AACA,QAAI,IAAI,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,KAAK,MAAM,MAAM,SAAS,KAAK,KAAK,MAAM,MAAM,SAAS,GAAG;AAC9D,QAAI,SAAS,EAAE,MAAM,EAAE,aAAa,QAAQ,SAAS,mCAAmC,MAAM,CAAC,WAAW,EAAE,CAAC;AAAA,EAC/G;AACF,CAAC;AAEI,IAAM,wCAAwC,EAClD,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,OAAO,EAAE,MAAM,iCAAiC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9D,WAAW,mBAAmB,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAO,EAAE,IAAI,MAAW,EAAE,SAAS;AACtE,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,OAAO,IAAI,KAAK,MAAM,MAAM,QAAQ,GAAG;AACjD,QAAI,IAAI,IAAI,KAAK,MAAM,GAAG;AACxB,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,QACT,MAAM,CAAC,SAAS,OAAO,QAAQ;AAAA,MACjC,CAAC;AAAA,IACH;AACA,QAAI,IAAI,KAAK,MAAM;AAAA,EACrB;AACA,MAAK,MAAM,cAAc,YAAgB,MAAM,eAAe,SAAY;AACxE,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,WAAW;AAAA,IACpB,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,EACpD,OAAO;AAAA,EACN,SAAS,EAAE,MAAM,6BAA6B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5D,eAAe,EAAE,MAAM,iCAAiC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACtE,WAAW,mBAAmB,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAO,EAAE,IAAI,MAAW,EAAE,SAAS;AACtE,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,UAAU,IAAI,IAAI,MAAM,OAAO;AACrC,QAAM,cAAc,IAAI,IAAI,MAAM,cAAc,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC;AAC1E,MACE,QAAQ,SAAS,MAAM,QAAQ,UAC/B,YAAY,SAAS,MAAM,cAAc,UACzC,QAAQ,SAAS,YAAY,QAC7B,MAAM,QAAQ,KAAK,CAAC,WAAW,CAAC,YAAY,IAAI,MAAM,CAAC,GACvD;AACA,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,eAAe;AAAA,IACxB,CAAC;AAAA,EACH;AACA,MAAK,MAAM,cAAc,YAAgB,MAAM,eAAe,SAAY;AACxE,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,WAAW;AAAA,IACpB,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,+CAA+C;AAErD,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,SAAS;AAAA,EACT,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,iCAAiC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9D,WAAW;AAAA,EACX,WAAW;AAAA,EACX,WAAW,mBAAmB,SAAS;AAAA,EACvC,QAAQ,EAAE,KAAK,CAAC,UAAU,WAAW,SAAS,CAAC;AACjD,CAAC,EACA,OAAO;AAEH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO;AAAA,EACP,QAAQ,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAChD,CAAC,EACA,OAAO;AAEH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,UAAU;AAAA,EACV,WAAW;AACb,CAAC,EACA,OAAO;AAEH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,SAAS;AAAA,EACT,WAAW;AAAA,EACX,WAAW;AAAA,EACX,OAAO,EAAE,MAAM,+BAA+B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAC9D,CAAC,EACA,OAAO;AAEH,IAAM,wCAAwC,EAClD,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,SAAS;AAAA,EACT,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAC7D,CAAC,EACA,OAAO;AAEH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC7C,CAAC,EACA,OAAO;;;ACzJH,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC;AAAA,EACA;AAAA,EAET,YAAY,MAAgC,SAAiB,QAAgB;AAC3E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;;;AC7BA,SAAS,kBAAkB;AAE3B,SAAS,YAAY;AAOrB,IAAM,6BAA6B;AACnC,IAAM,wCAAwC;AAC9C,IAAM,kCAAkC;AACxC,IAAM,yCAAyC;AAC/C,IAAM,mCAAmC;AAElC,IAAM,sCAAsC;AAAA,EACjD;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AAAA,EACA;AAAA,IACE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACF;AAqBA,IAAM,oCAAN,cAAgD,MAAM;AAAA,EACpD,YAAqB,UAAgC;AACnD,UAAM,SAAS,OAAO;AADH;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAEA,IAAM,qBAAN,MAAyB;AAAA,EAGvB,YACmB,OACA,UACA,KACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAHgB;AAAA,EACA;AAAA,EACA;AAAA,EALF,UAAU,oBAAI,IAAyB;AAAA,EAQxD,QAAQ,KAAsB;AAC5B,UAAM,cAAc,KAAK,QAAQ,GAAG;AACpC,QAAI,CAAC,YAAa,QAAO;AACzB,gBAAY,OAAO;AACnB,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,KAA4C;AAClD,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG;AAChC,QAAI,CAAC,SAAS,MAAM,WAAW,KAAK;AAClC,UAAI,CAAC,SAAS,KAAK,QAAQ,QAAQ,4BAA4B;AAC7D,aAAK,MAAM,GAAG;AACd,YAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,MAC9D;AACA,cAAQ,EAAE,OAAO,GAAG,SAAS,MAAM,KAAK,SAAS;AACjD,WAAK,QAAQ,IAAI,KAAK,KAAK;AAAA,IAC7B;AACA,QAAI,MAAM,SAAS,KAAK,MAAO,QAAO;AACtC,UAAM,SAAS;AACf,QAAI,SAAS;AACb,WAAO;AAAA,MACL,QAAQ,MAAM;AACZ,iBAAS;AAAA,MACX;AAAA,MACA,SAAS,MAAM;AACb,YAAI,CAAC,OAAQ;AACb,iBAAS;AACT,YAAI,KAAK,QAAQ,IAAI,GAAG,MAAM,MAAO;AACrC,cAAM,SAAS;AACf,YAAI,MAAM,UAAU,EAAG,MAAK,QAAQ,OAAO,GAAG;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAO,KAAsB;AAC3B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAAU,KAAK,QAAQ,IAAI,GAAG;AACpC,QAAI,WAAW,QAAQ,UAAU,IAAK,QAAO,QAAQ,QAAQ,KAAK;AAClE,QAAI,CAAC,WAAW,KAAK,QAAQ,QAAQ,4BAA4B;AAC/D,WAAK,MAAM,GAAG;AACd,UAAI,KAAK,QAAQ,QAAQ,2BAA4B,QAAO;AAAA,IAC9D;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,MAAM,KAAmB;AAC/B,eAAW,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS;AACvC,UAAI,MAAM,WAAW,IAAK,MAAK,QAAQ,OAAO,GAAG;AAAA,IACnD;AAAA,EACF;AACF;AAEA,IAAM,kBAAN,MAAsB;AAAA,EAIpB,YACmB,aACA,YACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAFgB;AAAA,EACA;AAAA,EALF,SAAS,oBAAI,IAAoB;AAAA,EAC1C,QAAQ;AAAA,EAOhB,QAAQ,KAAuC;AAC7C,UAAM,UAAU,KAAK,OAAO,IAAI,GAAG,KAAK;AACxC,QAAI,WAAW,KAAK,eAAe,KAAK,SAAS,KAAK,WAAY,QAAO;AACzE,SAAK,OAAO,IAAI,KAAK,UAAU,CAAC;AAChC,SAAK,SAAS;AACd,QAAI,SAAS;AACb,WAAO,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ,KAAK,OAAO,IAAI,GAAG,KAAK;AACtC,UAAI,SAAS,EAAG,MAAK,OAAO,OAAO,GAAG;AAAA,UACjC,MAAK,OAAO,IAAI,KAAK,QAAQ,CAAC;AACnC,WAAK,SAAS;AAAA,IAChB;AAAA,EACF;AACF;AAkBA,SAAS,iBAAiB,KAAqC;AAC7D,SAAO;AAAA,IACL,iBAAiB,IAAI,gBAAgB,uCAAuC,+BAA+B;AAAA,IAC3G,YAAY,IAAI,gBAAgB,wCAAwC,gCAAgC;AAAA,IACxG,YAAY,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAClD,cAAc,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IACpD,qBAAqB,IAAI,mBAAmB,IAAI,KAAQ,GAAG;AAAA,IAC3D,gBAAgB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC3D,kBAAkB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,IAC7D,yBAAyB,IAAI,mBAAmB,IAAI,KAAK,KAAQ,GAAG;AAAA,EACtE;AACF;AAEA,SAAS,cAAoC;AAC3C,SAAO,IAAI,qBAAqB,gBAAgB,6BAA6B,GAAG;AAClF;AAEA,eAAe,mBACb,SACA,MACA,OACA,QACkB;AAClB,QAAM,YAAY,aAAa,IAAI;AACnC,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AACpF,QAAM,SAAU,MAAM,UAAU,IAAI,OAAO;AAAA,IACzC;AAAA,IACA,GAAI,SAAS,EAAE,aAAa,OAAO,IAAI,CAAC;AAAA,EAC1C,CAAC;AACD,SAAO,OAAO;AAChB;AAEA,SAAS,2BACP,gBACA,cACA,YACA,SACmB;AACnB,QAAM,UAAU,eAAe,QAAQ,UAAU;AACjD,MAAI,CAAC,QAAS,OAAM,YAAY;AAChC,QAAM,QAAQ,aAAa,QAAQ,OAAO;AAC1C,MAAI,CAAC,OAAO;AACV,YAAQ,QAAQ;AAChB,UAAM,YAAY;AAAA,EACpB;AACA,MAAI,SAAS;AACb,SAAO;AAAA,IACL,QAAQ,MAAM;AACZ,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,cAAQ,OAAO;AACf,YAAM,OAAO;AAAA,IACf;AAAA,IACA,SAAS,MAAM;AACb,UAAI,CAAC,OAAQ;AACb,eAAS;AACT,YAAM,QAAQ;AACd,cAAQ,QAAQ;AAAA,IAClB;AAAA,EACF;AACF;AAEA,eAAe,wCACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA;AACA,MAAI,CAAC,eAAe,OAAO,UAAU,EAAG,OAAM,YAAY;AAC1D,QAAM,SAAS,2BAA2B,gBAAgB,cAAc,YAAY,OAAO;AAC3F,MAAI;AACJ,MAAI;AACF,YAAS,MAAM,mBAAmB,SAAS,+BAA+B,EAAE,SAAS,OAAO,CAAC;AAAA,EAG/F,SAAS,OAAO;AACd,QAAI,iBAAiB,sBAAsB;AACzC,UAAI,MAAM,SAAS,mBAAmB;AACpC,eAAO,QAAQ;AACf,YAAI,CAAC,eAAe,QAAQ,UAAU,EAAG,OAAM,YAAY;AAAA,MAC7D,OAAO;AACL,eAAO,OAAO;AAAA,MAChB;AAAA,IACF,OAAO;AACL,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM;AAAA,EACR;AACA,SAAO,OAAO;AACd,SAAO;AACT;AAEA,eAAe,wBACb,SACA,SACA,QACA,YACA,gBACA,cACA,gBACA,uBACA;AACA,QAAM,wBAAwB,sBAAsB,QAAQ,UAAU;AACtE,MAAI,CAAC,sBAAuB,OAAM,YAAY;AAC9C,MAAI;AACF,WAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,0BAAsB;AAAA,EACxB;AACF;AAEO,SAAS,uCAAuC,OAA+C;AACpG,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,QAAM,SAAS,KAAK,OAAO;AAC3B,MAAI,WAAW,EAAG,QAAO;AACzB,MAAI,WAAW,EAAG,QAAO;AACzB,QAAM,YAAY,IAAI,IAAI,WAAW,OAAO,IAAI,EAAE,SAAS,MAAM,GAAG,EAAE;AACtE,QAAM,SAAS,2CAA2C,KAAK,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAChD,QAAM,MAAM,OAAO,SAAS,OAAO,CAAC,KAAK,IAAI,EAAE;AAC/C,SAAO,GAAG,SAAS,CAAC,IAAI,OAAO,GAAI,IAAI,QAAQ,CAAC,IAAI,MAAM,GAAI;AAChE;AAEA,SAAS,sBAAsB,KAAsB,uBAAoD;AACvG,QAAM,gBAAgB,uCAAuC,IAAI,OAAO,aAAa,KAAK;AAC1F,MAAI,CAAC,sBAAsB,IAAI,aAAa,EAAG,QAAO;AACtD,QAAM,YAAY,IAAI,QAAQ,iBAAiB;AAC/C,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,QAAM,eAAe,UAAU,MAAM,GAAG;AACxC,MAAI,aAAa,SAAS,KAAK,aAAa,SAAS,GAAI,QAAO;AAChE,QAAM,YAAY,aAAa,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC;AAC/F,MAAI,UAAU,KAAK,CAAC,YAAY,YAAY,MAAS,EAAG,QAAO;AAC/D,WAAS,QAAQ,UAAU,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG;AAC7D,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,WAAW,CAAC,sBAAsB,IAAI,OAAO,EAAG,QAAO;AAAA,EAC7D;AACA,SAAO,UAAU,CAAC,KAAK;AACzB;AAEA,SAAS,cAAc,KAAsB,uBAAoD;AAC/F,SAAO,WAAW,QAAQ,EACvB,OAAO,sBAAsB,KAAK,qBAAqB,CAAC,EACxD,OAAO,KAAK;AACjB;AAEA,SAAS,YAAY,KAA0C;AAC7D,QAAM,MAAM,IAAI,QAAQ;AACxB,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,qBAAqB,KAAK,GAAG;AAC3C,MAAI,CAAC,SAAS,MAAM,CAAC,GAAG,YAAY,MAAM,kBAAmB,QAAO;AACpE,QAAM,SAAS,MAAM,CAAC,KAAK;AAC3B,MAAI,CAAC,0BAA0B,KAAK,MAAM,EAAG,QAAO;AACpD,SAAO;AACT;AAEA,SAAS,oBAAoB,KAA+B;AAC1D,QAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAClD,QAAM,mBAAmB,IAAI,QAAQ,mBAAmB;AACxD,SAAO,qBAAqB,UAAc,kBAAkB,UAAa,kBAAkB;AAC7F;AAEA,SAAS,YAAY,KAAqB,QAAgB,SAAwB;AAChF,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,MAAI,aAAa;AACjB,MAAI,UAAU,iBAAiB,mBAAmB;AAClD,MAAI,UAAU,QAAQ,eAAe;AACrC,MAAI,UAAU,gBAAgB,iCAAiC;AAC/D,MAAI,UAAU,kBAAkB,OAAO,OAAO,WAAW,IAAI,CAAC,CAAC;AAC/D,MAAI,IAAI,IAAI;AACd;AAEA,SAAS,iCACP,KACA,KACA,QACA,SACM;AACN,MAAI,kBAAkB;AACtB,MAAI,UAAU,cAAc,OAAO;AACnC,MAAI,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC;AACtC,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,SAAS,yBACP,KACA,KACA,QACA,SACM;AACN,MAAI,oBAAoB,GAAG,GAAG;AAC5B,qCAAiC,KAAK,KAAK,QAAQ,OAAO;AAC1D;AAAA,EACF;AACA,cAAY,KAAK,QAAQ,OAAO;AAClC;AAEA,eAAe,iBAAiB,KAAsB,QAAsC;AAC1F,QAAM,UAAU,MAAM,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC7D,UAAM,SAAmB,CAAC;AAC1B,QAAI,QAAQ;AACZ,QAAI,UAAU;AACd,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,UAAI,IAAI,WAAW,SAAS;AAC5B,aAAO,oBAAoB,SAAS,aAAa;AAAA,IACnD;AACA,UAAM,OAAO,CAAC,UAAmB;AAC/B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,aAAO,KAAK;AAAA,IACd;AACA,UAAM,aAAa,MACjB,aAAa,OAAO,MAAM,IAAI,OAAO,SAAS,WAAW,kBAAkB;AAC7E,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;AACjE,eAAS,OAAO;AAChB,UAAI,QAAQ,MAAO;AACjB,YAAI,MAAM;AACV;AAAA,UACE,IAAI;AAAA,YACF,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,UAClF;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM;AAClB,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ;AACR,cAAQ,OAAO,OAAO,QAAQ,KAAK,CAAC;AAAA,IACtC;AACA,UAAM,UAAU,CAAC,UAAiB,KAAK,OAAO,WAAW,IAAI,UAAU,WAAW,IAAI,KAAK;AAC3F,UAAM,YAAY,MAAM,KAAK,WAAW,CAAC;AACzC,UAAM,gBAAgB,MAAM,KAAK,WAAW,CAAC;AAC7C,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,KAAK,OAAO,KAAK;AACrB,QAAI,KAAK,SAAS,OAAO;AACzB,QAAI,KAAK,WAAW,SAAS;AAC7B,WAAO,iBAAiB,SAAS,eAAe,EAAE,MAAM,KAAK,CAAC;AAC9D,QAAI,OAAO,QAAS,eAAc;AAAA,EACpC,CAAC;AACD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,QAAQ,SAAS,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,OAAO;AACb,MAAI,OAAO,KAAK,IAAI,EAAE,WAAW,KAAK,OAAO,KAAK,aAAa,UAAU;AACvE,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,QAAM,WAAW,KAAK,SAAS,KAAK;AACpC,MAAI,SAAS,SAAS,KAAK,SAAS,SAAS,KAAK;AAChD,UAAM,IAAI,qBAAqB,iBAAiB,mCAAmC,GAAG;AAAA,EACxF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,KAAsB,KAA+D;AAC1G,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,IAAI,oBAAoB,CAAC,WAAW,OAAO,QAAS,YAAW,MAAM,WAAW,kBAAkB,CAAC;AAAA,EAC1G;AACA,MAAI,KAAK,WAAW,KAAK;AACzB,MAAI,KAAK,SAAS,KAAK;AACvB,SAAO;AAAA,IACL,QAAQ,WAAW;AAAA,IACnB,SAAS,MAAM;AACb,UAAI,IAAI,WAAW,KAAK;AACxB,UAAI,IAAI,SAAS,KAAK;AAAA,IACxB;AAAA,EACF;AACF;AAEA,SAAS,cAAc,KAAiC;AACtD,MAAI;AACF,UAAM,QAAQ,mBAAmB,GAAG;AACpC,WAAO,yBAAyB,KAAK,KAAK,IAAI,MAAM,YAAY,IAAI;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,yCACd,SACA,UAA+C,CAAC,GACT;AACvC,QAAM,aAAa,iBAAiB,QAAQ,OAAO,KAAK,GAAG;AAC3D,QAAM,wBAAwB,IAAI;AAAA,KAC/B,QAAQ,yBAAyB,CAAC,GAChC,IAAI,CAAC,YAAY,uCAAuC,OAAO,CAAC,EAChE,OAAO,CAAC,YAA+B,YAAY,MAAS;AAAA,EACjE;AACA,SAAO,OAAO,KAAK,QAAQ;AACzB,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,IAAI,OAAO,KAAK,oBAAoB;AAAA,IACvD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,UAAM,YAAY,4DAA4D,KAAK,OAAO,QAAQ;AAClG,UAAM,WAAW,iEAAiE,KAAK,OAAO,QAAQ;AACtG,UAAM,YAAY,IAAI,WAAW,SAAS;AAC1C,UAAM,gBAAgB,IAAI,WAAW,UAAU;AAC/C,QAAI,CAAC,aAAa,CAAC,cAAe,QAAO;AAEzC,QAAI,UAAU,iBAAiB,mBAAmB;AAClD,QAAI,UAAU,QAAQ,eAAe;AACrC,UAAM,UAAU,eAAe,YAAY,YAAY,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE;AAChF,UAAM,SAAS,YAAY,GAAG;AAC9B,QAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,aAAa,oBAAoB,GAAG,GAAG;AACzC,uCAAiC,KAAK,KAAK,KAAK;AAAA,QAC9C,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AACA,QAAI,CAAC,WAAW,CAAC,QAAQ;AACvB,+BAAyB,KAAK,KAAK,KAAK;AAAA,QACtC,OAAO;AAAA,QACP,MAAM;AAAA,MACR,CAAC;AACD,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,cAAc,KAAK,GAAG;AACxC,QAAI;AACF,YAAM,SAAS,cAAc,KAAK,qBAAqB;AACvD,UAAI,WAAW;AACb,cAAM,QAAQ,MAAM;AAAA,UAClB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,UACX,WAAW;AAAA,QACb;AACA,oBAAY,KAAK,KAAK,KAAK;AAAA,MAC7B,OAAO;AACL,YAAI,wBAAwB,WAAW,gBAAgB,QAAQ,MAAM;AACrE,YAAI,CAAC,sBAAuB,OAAM,IAAI,kCAAkC,YAAY,CAAC;AACrF,YAAI;AACF,cAAI;AACJ,gBAAM,cAAc,WAAW,wBAAwB,QAAQ,MAAM;AACrE,cAAI,CAAC,YAAa,OAAM,IAAI,kCAAkC,YAAY,CAAC;AAC3E,cAAI;AACF,uBAAW,MAAM,iBAAiB,KAAK,UAAU,MAAM;AACvD,wBAAY,QAAQ;AAAA,UACtB,SAAS,OAAO;AACd,kBAAM,eACJ,iBAAiB,oCAAoC,MAAM,WAAW;AACxE,gBAAI,wBAAwB,wBAAwB,aAAa,SAAS,iBAAiB;AACzF,0BAAY,OAAO;AAAA,YACrB,OAAO;AACL,0BAAY,QAAQ;AAAA,YACtB;AACA,kBAAM;AAAA,UACR;AACA,gBAAM,mBAAmB,WAAW,WAAW,QAAQ,MAAM;AAC7D,cAAI,CAAC,iBAAkB,OAAM,YAAY;AACzC,cAAI;AACF,kBAAM;AAAA,cACJ;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,WAAW;AAAA,cACX,WAAW;AAAA,cACX,WAAW;AAAA,YACb;AACA,kCAAsB;AACtB,oCAAwB;AACxB,kBAAM,SAAS,MAAM;AAAA,cACnB;AAAA,cACA;AAAA,cACA,EAAE,SAAS,QAAQ,SAAS;AAAA,cAC5B,UAAU;AAAA,YACZ;AACA,wBAAY,KAAK,KAAK,MAAM;AAAA,UAC9B,UAAE;AACA,6BAAiB;AAAA,UACnB;AAAA,QACF,UAAE;AACA,kCAAwB;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,UAAI,iBAAiB,mCAAmC;AACtD,yCAAiC,KAAK,KAAK,MAAM,SAAS,QAAQ;AAAA,UAChE,OAAO,MAAM,SAAS;AAAA,UACtB,MAAM,MAAM,SAAS;AAAA,QACvB,CAAC;AACD,eAAO;AAAA,MACT;AACA,UAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,kBAAY,KAAK,MAAM,QAAQ,EAAE,OAAO,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;AAAA,IAC3E,UAAE;AACA,gBAAU,QAAQ;AAAA,IACpB;AACA,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iDACX,UACoC;AACvC,SAAO,OAAO,KAAK,KAAK,QAAQ;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,WAAY,MAAM,QAAQ,KAAK,KAAK,GAAG,EAAI,QAAO;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/{chunk-E6M225BJ.js → chunk-PC5DRBGD.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-QNUNAXBE.js";
 import {
   LocalLlmClient
-} from "./chunk-IPT2OY4B.js";
+} from "./chunk-RQFXZYTF.js";
 import {
   completeBackgroundGeneration,
   parseBackgroundGenerationJson
@@ -19,10 +19,10 @@ import {
 import {
   FallbackLlmClient,
   gatewayTaskChainOptions
-} from "./chunk-ZU5JDLOH.js";
+} from "./chunk-MMRTPH3J.js";
 import {
   fallbackLlmRuntimeContextFromConfig
-} from "./chunk-ZU3NJNO7.js";
+} from "./chunk-QSF5SJAM.js";
 import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
@@ -91,12 +91,16 @@ var HourlySummarizer = class {
   fallbackLlm;
   modelRegistry;
   transcript;
-  constructor(config, gatewayConfig, modelRegistry, transcript) {
+  /** Orchestrator-owned stop signal: refuses new summaries and aborts the
+   *  in-flight local LLM call once teardown begins. */
+  shutdownSignal;
+  constructor(config, gatewayConfig, modelRegistry, transcript, shutdownSignal) {
     this.config = config;
     this.summariesDir = path.join(config.memoryDir, "summaries", "hourly");
     this.modelRegistry = modelRegistry ?? new ModelRegistry(config.memoryDir);
     this.transcript = transcript;
-    this.localLlm = new LocalLlmClient(config, this.modelRegistry);
+    this.shutdownSignal = shutdownSignal;
+    this.localLlm = new LocalLlmClient(config, this.modelRegistry, shutdownSignal);
     this.fallbackLlm = new FallbackLlmClient(gatewayConfig, fallbackLlmRuntimeContextFromConfig(config));
     if (!gatewayConfig?.agents?.defaults?.model?.primary && !resolveLocalLlmCapabilities(config).localLlm && config.modelSource !== "gateway") {
       log.warn("no gateway default AI and local LLM disabled \u2014 hourly summarization disabled");
@@ -137,6 +141,7 @@ var HourlySummarizer = class {
   // Generate summary for a specific hour and session
   async generateSummary(sessionKey, hourStart, entries) {
     if (entries.length === 0) return null;
+    this.shutdownSignal?.throwIfAborted();
     const conversation = entries.map((e) => `[${e.role}] ${e.content}`).join("\n\n");
     if (resolvePipelineProcessingCapabilities(this.config).hourlySummariesExtended) {
       const extended = await this.generateExtended(sessionKey, hourStart, conversation, entries);
@@ -213,6 +218,7 @@ ${conversation}` }
         log.info("summary generation: local LLM error, falling back to gateway default AI:", err);
       }
     }
+    if (this.shutdownSignal?.aborted) return null;
     log.info("summary generation: falling back to gateway default AI");
     try {
       const messages = [
@@ -335,7 +341,8 @@ ${conversation}
             temperature: 0.2,
             maxTokens: contextSizes.maxOutputTokens,
             operation: "hourly_summary_extended",
-            priority: "background"
+            priority: "background",
+            signal: this.shutdownSignal
           }
         );
         if (response?.content) {
@@ -357,6 +364,7 @@ ${conversation}
         log.info("extended summary: local failed, falling back:", err);
       }
     }
+    if (this.shutdownSignal?.aborted) return null;
     try {
       const result = await this.fallbackLlm.parseWithSchema(
         [
@@ -417,7 +425,8 @@ ${truncatedConversation}`;
         temperature: 0.3,
         maxTokens: contextSizes.maxOutputTokens,
         operation: "hourly_summary",
-        priority: "background"
+        priority: "background",
+        signal: this.shutdownSignal
       }
     );
     if (!response?.content) {
@@ -641,6 +650,7 @@ ${truncatedConversation}`;
   }
   // Main entry point for cron job
   async runHourly() {
+    this.shutdownSignal?.throwIfAborted();
     log.debug("running hourly summary generation");
     const scan = await this.getActiveSessions();
     const sessions = scan.sessionKeys;
@@ -798,4 +808,4 @@ export {
   summarizeHourlyStatus,
   HourlySummarizer
 };
-//# sourceMappingURL=chunk-E6M225BJ.js.map
+//# sourceMappingURL=chunk-PC5DRBGD.js.map