@remnic/core 10.0.92 → 10.0.94

package/dist/calibration.js

@@ -1,24 +1,24 @@
-import {
-  OUTPUT_LANGUAGE_POLICY
-} from "./chunk-YN2DQ2D6.js";
-import "./chunk-QW27DOHG.js";
 import {
   LocalLlmClient
-} from "./chunk-IPT2OY4B.js";
-import "./chunk-T6OZW2WR.js";
+} from "./chunk-RQFXZYTF.js";
+import "./chunk-FA7SLQ5X.js";
 import "./chunk-MJFL75J6.js";
 import "./chunk-QEDLJDHP.js";
 import "./chunk-U4LUIE6Y.js";
 import "./chunk-5YQXWVCP.js";
+import {
+  OUTPUT_LANGUAGE_POLICY
+} from "./chunk-YN2DQ2D6.js";
 import "./chunk-TOTT6S2V.js";
 import {
   FallbackLlmClient
-} from "./chunk-ZU5JDLOH.js";
+} from "./chunk-MMRTPH3J.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
-import "./chunk-ZU3NJNO7.js";
+import "./chunk-QSF5SJAM.js";
 import "./chunk-E2AWJ7KQ.js";
+import "./chunk-QW27DOHG.js";
 import "./chunk-YBA52OKG.js";
 import {
   resolveLocalLlmCapabilities
@@ -27,8 +27,6 @@ import {
   writeFileAtomically
 } from "./chunk-BTNNL7ZW.js";
 import "./chunk-ZEFVK7XC.js";
-import "./chunk-6KH5NLQS.js";
-import "./chunk-P2QRMMVQ.js";
 import "./chunk-R2MBW2S4.js";
 import {
   listJsonFiles
@@ -36,6 +34,8 @@ import {
 import {
   isMacOsReplicationJunkBasename
 } from "./chunk-QUIRIG2P.js";
+import "./chunk-6KH5NLQS.js";
+import "./chunk-P2QRMMVQ.js";
 import "./chunk-KNA3BXXL.js";
 import {
   log

package/dist/{capsule-merge-2IIXFXN5.js → capsule-merge-6IDAYTKG.js}

@@ -3,11 +3,7 @@ import {
 } from "./chunk-QV2VZKD5.js";
 import {
   createVersion
-} from "./chunk-ER7XANP3.js";
-import {
-  bumpMemoryCorpusVersionForDir
-} from "./chunk-M5GVCJSJ.js";
-import "./chunk-RBOJCG4T.js";
+} from "./chunk-SQ3GEIEL.js";
 import {
   HistoricalEntityCanonicalIdCache,
   canonicalizeEntityRefFrontmatter,
@@ -18,6 +14,10 @@ import {
   withRawEntityPageMutation
 } from "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
+import {
+  bumpMemoryCorpusVersionForDir
+} from "./chunk-M5GVCJSJ.js";
+import "./chunk-RBOJCG4T.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
 import "./chunk-C64XATK7.js";
@@ -274,4 +274,4 @@ async function readLocalFile(absPath) {
 export {
   mergeCapsule
 };
-//# sourceMappingURL=capsule-merge-2IIXFXN5.js.map
+//# sourceMappingURL=capsule-merge-6IDAYTKG.js.map

package/dist/causal-consolidation.js

@@ -4,14 +4,14 @@ import {
 } from "./chunk-4XINO77L.js";
 import {
   buildExtensionsBlockForConsolidation
-} from "./chunk-6F42QONS.js";
-import "./chunk-5JMAGU26.js";
-import "./chunk-B7RWBZXW.js";
+} from "./chunk-X5HGU2EM.js";
 import {
   runPostConsolidationMaterialize
-} from "./chunk-Z7JIZ42P.js";
+} from "./chunk-BN2EBCLB.js";
 import "./chunk-3UXOZBHV.js";
 import "./chunk-AL3TCNSJ.js";
+import "./chunk-5JMAGU26.js";
+import "./chunk-B7RWBZXW.js";
 import "./chunk-TOTT6S2V.js";
 import "./chunk-236PXYG7.js";
 import "./chunk-ZCUTSMR2.js";
@@ -19,14 +19,14 @@ import "./chunk-QDW3E4RD.js";
 import {
   resolveCausalTrajectoryStoreDir
 } from "./chunk-GKL6QYZO.js";
-import "./chunk-FSO3G4JJ.js";
+import "./chunk-FWRXW7CZ.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-IGOW4TJE.js";
-import "./chunk-NT7F7WJQ.js";
+import "./chunk-RFUL2ZIQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-UE6RRXMF.js";
-import "./chunk-65AUYLU3.js";
+import "./chunk-A4F7OIC5.js";
+import "./chunk-XPXHQI6N.js";
 import "./chunk-DOJBV6WR.js";
 import "./chunk-PFUXPTBT.js";
 import "./chunk-CYEPCZN5.js";
@@ -47,9 +47,8 @@ import "./chunk-S2HLHAZ4.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-FF6N7BXC.js";
-import "./chunk-QFEDITXM.js";
+import "./chunk-JNDMIAJ4.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-FHGWKODN.js";
 import "./chunk-ZIKENA2C.js";
 import "./chunk-YXZG5TVN.js";
 import "./chunk-3OUGSOJP.js";
@@ -59,34 +58,34 @@ import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-ER7XANP3.js";
-import "./chunk-M5GVCJSJ.js";
-import "./chunk-RBOJCG4T.js";
+import "./chunk-SQ3GEIEL.js";
 import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
+import "./chunk-M5GVCJSJ.js";
+import "./chunk-RBOJCG4T.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-7VLBZKNB.js";
 import "./chunk-Y33KJ556.js";
-import "./chunk-5IYOKDM4.js";
+import "./chunk-R23JWJD3.js";
 import "./chunk-NWA6IXR3.js";
 import "./chunk-OR42ZI54.js";
 import "./chunk-IUM3VSHI.js";
-import "./chunk-VILPVT4S.js";
+import "./chunk-EZ47HOJ6.js";
 import "./chunk-AF2XMJKD.js";
 import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
 import {
   FallbackLlmClient
-} from "./chunk-ZU5JDLOH.js";
+} from "./chunk-MMRTPH3J.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import {
   fallbackLlmRuntimeContextFromConfig
-} from "./chunk-ZU3NJNO7.js";
+} from "./chunk-QSF5SJAM.js";
 import "./chunk-E2AWJ7KQ.js";
 import "./chunk-UXXK523X.js";
 import "./chunk-YCVB7X56.js";
@@ -104,17 +103,18 @@ import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
 import "./chunk-43AA5FVD.js";
 import "./chunk-YBA52OKG.js";
-import "./chunk-YCNIGRRF.js";
+import "./chunk-NS7U4ZYU.js";
+import "./chunk-AHA5VQGP.js";
 import "./chunk-PCXDUHQH.js";
 import "./chunk-VUFL7X3H.js";
 import "./chunk-C5LWPYS3.js";
-import "./chunk-QEYTRFR3.js";
+import "./chunk-X26YOFGS.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-R6HMAIKM.js";
+import "./chunk-TOSPNM4T.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
-import "./chunk-UDKWFDV2.js";
+import "./chunk-HLUHEMN4.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-BTNNL7ZW.js";
 import "./chunk-EBV6VXKF.js";
@@ -124,8 +124,6 @@ import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-X4OZMANG.js";
 import "./chunk-ZEFVK7XC.js";
-import "./chunk-6KH5NLQS.js";
-import "./chunk-P2QRMMVQ.js";
 import "./chunk-R2MBW2S4.js";
 import {
   isRecord
@@ -135,6 +133,8 @@ import {
   readJsonFile
 } from "./chunk-2Z5DIDQD.js";
 import "./chunk-QUIRIG2P.js";
+import "./chunk-6KH5NLQS.js";
+import "./chunk-P2QRMMVQ.js";
 import "./chunk-LDPPTPO5.js";
 import "./chunk-EYGOM6AI.js";
 import "./chunk-A6XUJE5D.js";

package/dist/{chunk-RGUUBAT5.js → chunk-2WCLTWV2.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-5HFVWYHL.js";
 import {
   isGenericRecallExcludedPath
-} from "./chunk-EFYN5I7Z.js";
+} from "./chunk-F4QFU5IZ.js";
 import {
   planRecallMode
 } from "./chunk-CSAKJVXW.js";
@@ -14,7 +14,7 @@ import {
 import {
   RecallWhyInputError,
   explainRecallMiss
-} from "./chunk-CD4BCCNP.js";
+} from "./chunk-DJ7WVEWX.js";
 import {
   canReadNamespace,
   recallNamespacesForPrincipal,
@@ -132,4 +132,4 @@ async function findExpectedMemory(orchestrator, namespaces, expect) {
 export {
   runRecallWhy
 };
-//# sourceMappingURL=chunk-RGUUBAT5.js.map
+//# sourceMappingURL=chunk-2WCLTWV2.js.map

package/dist/{chunk-BQZEGOZ4.js → chunk-2YODOG2O.js}

@@ -1,6 +1,6 @@
 import {
   defineOperation
-} from "./chunk-ZTTCDQ4I.js";
+} from "./chunk-JTSSSR4L.js";
 import {
   EngramAccessInputError,
   rejectReservedArgumentKey
@@ -94,4 +94,4 @@ defineOperation({
     };
   }
 });
-//# sourceMappingURL=chunk-BQZEGOZ4.js.map
+//# sourceMappingURL=chunk-2YODOG2O.js.map

package/dist/{chunk-WYG5UNDY.js → chunk-3AUDELZL.js}

@@ -5,7 +5,7 @@ import {
 import {
   PROMOTION_CANDIDATES_DEFAULT_MIN_ACCESS,
   isSubjectGuardMode
-} from "./chunk-R6HMAIKM.js";
+} from "./chunk-TOSPNM4T.js";
 
 // src/subject-config.ts
 function assertObjectBlock(value, key, shape) {
@@ -52,4 +52,4 @@ function parseSubjectRuntimeConfig(cfg) {
 export {
   parseSubjectRuntimeConfig
 };
-//# sourceMappingURL=chunk-WYG5UNDY.js.map
+//# sourceMappingURL=chunk-3AUDELZL.js.map

package/dist/{chunk-MB6ZJDN6.js → chunk-3FBAEPCU.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7T4TOGMS.js";
 import {
   defineOperation
-} from "./chunk-ZTTCDQ4I.js";
+} from "./chunk-JTSSSR4L.js";
 
 // src/external-wiki-access.ts
 import { z } from "zod";
@@ -26,4 +26,4 @@ var externalWikiSearchOperation = defineOperation({
 export {
   externalWikiSearchOperation
 };
-//# sourceMappingURL=chunk-MB6ZJDN6.js.map
+//# sourceMappingURL=chunk-3FBAEPCU.js.map

package/dist/{chunk-PIITB2YZ.js → chunk-3ZS3NUEI.js}

@@ -1,3 +1,6 @@
+import {
+  resolveEvalStoreDir
+} from "./chunk-JKMIGCK6.js";
 import {
   DEFAULT_EVAL_TRAJECTORY_REPORT_MAX_AGE_MS,
   DESTRUCTIVE_ACTION_TYPES,
@@ -14,9 +17,6 @@ import {
   serializeEvalTrajectoryReport,
   sha256Hex
 } from "./chunk-ULM7JCDH.js";
-import {
-  resolveEvalStoreDir
-} from "./chunk-JKMIGCK6.js";
 
 // src/eval-trajectory-store.ts
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
@@ -237,4 +237,4 @@ export {
   writeEvalTrajectoryReport,
   readEvalTrajectoryReport
 };
-//# sourceMappingURL=chunk-PIITB2YZ.js.map
+//# sourceMappingURL=chunk-3ZS3NUEI.js.map

package/dist/{chunk-ATPWZ4F7.js → chunk-4EZWSDFL.js}

@@ -2,17 +2,17 @@ import {
   SharedFeedbackEntrySchema,
   migrateLegacyFeedbackInbox,
   resolveFeedbackInboxPath
-} from "./chunk-5KBIOI4G.js";
+} from "./chunk-JVBAPAWZ.js";
 import {
   composeSalvagedEnvelope
-} from "./chunk-45VUHDV2.js";
+} from "./chunk-5CO5G4MN.js";
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-E3A7ELSG.js";
+} from "./chunk-QHARXWTC.js";
 import {
   StorageManager,
   readRawMemoryDocument
-} from "./chunk-FSO3G4JJ.js";
+} from "./chunk-FWRXW7CZ.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1869,4 +1869,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-ATPWZ4F7.js.map
+//# sourceMappingURL=chunk-4EZWSDFL.js.map

package/dist/{chunk-ANZZLRUX.js → chunk-4IVRQMZW.js}

@@ -5,7 +5,7 @@ import {
 import {
   STRUCTURED_ATTRIBUTE_LIMITS,
   TAG_LIMITS
-} from "./chunk-QEYTRFR3.js";
+} from "./chunk-X26YOFGS.js";
 import {
   writeFileAtomically
 } from "./chunk-BTNNL7ZW.js";
@@ -885,4 +885,4 @@ export {
   buildWithBriefingLocation,
   daySummaryAutoOptions
 };
-//# sourceMappingURL=chunk-ANZZLRUX.js.map
+//# sourceMappingURL=chunk-4IVRQMZW.js.map

package/dist/{chunk-63E37JCN.js → chunk-4RAJT5L2.js}

@@ -2,12 +2,12 @@ import {
   launchProcess,
   launchProcessSync
 } from "./chunk-ZEFVK7XC.js";
-import {
-  expandTildePath
-} from "./chunk-6KH5NLQS.js";
 import {
   abortError
 } from "./chunk-R2MBW2S4.js";
+import {
+  expandTildePath
+} from "./chunk-6KH5NLQS.js";
 
 // src/coding/git-context.ts
 import path from "path";
@@ -393,4 +393,4 @@ export {
   lcmSessionKeyForNamespace,
   lcmReadSessionIdsForNamespaces
 };
-//# sourceMappingURL=chunk-63E37JCN.js.map
+//# sourceMappingURL=chunk-4RAJT5L2.js.map

package/dist/{chunk-45VUHDV2.js → chunk-5CO5G4MN.js}

@@ -1,6 +1,6 @@
 import {
   composeMemoryEnvelope
-} from "./chunk-QEYTRFR3.js";
+} from "./chunk-X26YOFGS.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -17,4 +17,4 @@ function composeSalvagedEnvelope(label, input, ctx) {
 export {
   composeSalvagedEnvelope
 };
-//# sourceMappingURL=chunk-45VUHDV2.js.map
+//# sourceMappingURL=chunk-5CO5G4MN.js.map

package/dist/{chunk-LUJCQQ3L.js → chunk-65HWAQ4F.js}

@@ -1,6 +1,6 @@
 import {
   RecallWhyInputError
-} from "./chunk-CD4BCCNP.js";
+} from "./chunk-DJ7WVEWX.js";
 import {
   isRecallDisclosure
 } from "./chunk-43AA5FVD.js";
@@ -165,4 +165,4 @@ export {
   handleRecallWhyHttpQuery,
   handleRecallXrayHttpQuery
 };
-//# sourceMappingURL=chunk-LUJCQQ3L.js.map
+//# sourceMappingURL=chunk-65HWAQ4F.js.map

package/dist/{chunk-T67LUYCR.js → chunk-77NTFICT.js}

@@ -5,14 +5,14 @@ import {
 import {
   unifiedDedupeAndRank
 } from "./chunk-LUPVCGYK.js";
-import {
-  buildEvidencePack,
-  insertAfterEvidenceHeading
-} from "./chunk-DGFU5MSX.js";
 import {
   isSameLcmRow,
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
+import {
+  buildEvidencePack,
+  insertAfterEvidenceHeading
+} from "./chunk-DGFU5MSX.js";
 
 // src/targeted-fact-recall.ts
 var DEFAULT_MAX_SEARCH_RESULTS = 48;
@@ -2165,4 +2165,4 @@ export {
   shouldRecallTargetedFactEvidence,
   buildTargetedFactRecallSection
 };
-//# sourceMappingURL=chunk-T67LUYCR.js.map
+//# sourceMappingURL=chunk-77NTFICT.js.map

package/dist/chunk-A2WFUMUN.js

@@ -0,0 +1,86 @@
+import {
+  getOperation
+} from "./chunk-JTSSSR4L.js";
+import {
+  capabilityAllowsOp,
+  isNamespaceAllowed
+} from "./chunk-OGBQMY46.js";
+import {
+  EngramAccessForbiddenError,
+  EngramAccessInputError,
+  NamespaceNotWritableError
+} from "./chunk-CJCTKL6Y.js";
+
+// src/access-namespace-preflight.ts
+function namespaceWritableRequest(params, authenticatedPrincipal) {
+  const namespace = params.get("namespace") || void 0;
+  return {
+    namespace,
+    sessionKey: params.get("session") || void 0,
+    authenticatedPrincipal,
+    cwd: params.get("cwd") || void 0,
+    projectTag: params.get("projectTag") || void 0
+  };
+}
+function parseNamespacePreflightWriteOp(value) {
+  if (value === void 0 || value === "observe") return "observe";
+  if (value === "memory_store") return "memory_store";
+  throw new EngramAccessInputError(`unsupported namespace preflight operation: ${value}`);
+}
+function assertNamespacePreflightPermitted(caps) {
+  const allowedOps = getOperation("namespace_writable")?.spec.allowedByOps ?? [];
+  if (!allowedOps.some((op) => capabilityAllowsOp(caps, op))) {
+    throw new EngramAccessForbiddenError("token is not permitted to run the namespace preflight");
+  }
+}
+async function resolveNamespaceWritablePreflight(request, resolveWritable) {
+  try {
+    return { ok: true, namespace: await resolveWritable(request) };
+  } catch (error) {
+    if (error instanceof NamespaceNotWritableError) {
+      return { ok: false, reason: "not_writable", namespace: error.attemptedNamespace };
+    }
+    if (error instanceof EngramAccessInputError) {
+      return {
+        ok: false,
+        reason: "unsupported",
+        namespace: request.namespace?.trim() ?? ""
+      };
+    }
+    throw error;
+  }
+}
+async function resolveAuthorizedNamespaceWritablePreflight(caps, request, defaultNamespace, writeOp, resolvePreflight) {
+  if (!capabilityAllowsOp(caps, writeOp)) {
+    return {
+      ok: false,
+      reason: "not_writable",
+      namespace: request.namespace?.trim() || defaultNamespace
+    };
+  }
+  const result = await resolvePreflight(request);
+  if (!isNamespaceAllowed(caps, result.namespace, defaultNamespace)) {
+    return { ok: false, reason: "not_writable", namespace: result.namespace };
+  }
+  return result;
+}
+function resolveQueryNamespaceWritablePreflight(caps, params, authenticatedPrincipal, defaultNamespace, resolvePreflight) {
+  assertNamespacePreflightPermitted(caps);
+  return resolveAuthorizedNamespaceWritablePreflight(
+    caps,
+    namespaceWritableRequest(params, authenticatedPrincipal),
+    defaultNamespace,
+    parseNamespacePreflightWriteOp(params.get("op") ?? void 0),
+    resolvePreflight
+  );
+}
+
+export {
+  namespaceWritableRequest,
+  parseNamespacePreflightWriteOp,
+  assertNamespacePreflightPermitted,
+  resolveNamespaceWritablePreflight,
+  resolveAuthorizedNamespaceWritablePreflight,
+  resolveQueryNamespaceWritablePreflight
+};
+//# sourceMappingURL=chunk-A2WFUMUN.js.map

package/dist/chunk-A2WFUMUN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-namespace-preflight.ts"],"sourcesContent":["import { getOperation } from \"./access-boundary.js\";\nimport { capabilityAllowsOp, isNamespaceAllowed, type TokenCapabilities } from \"./access-token-capabilities.js\";\nimport { EngramAccessForbiddenError, EngramAccessInputError, NamespaceNotWritableError } from \"./access-errors.js\";\nimport type { WritableNamespaceResult } from \"./scopes/scope-plan.js\";\n\nexport interface EngramAccessNamespaceWritableRequest {\n  namespace?: string;\n  sessionKey?: string;\n  authenticatedPrincipal?: string;\n  cwd?: string;\n  projectTag?: string;\n}\n\nexport function namespaceWritableRequest(\n  params: URLSearchParams,\n  authenticatedPrincipal?: string,\n): EngramAccessNamespaceWritableRequest {\n  const namespace = params.get(\"namespace\") || undefined;\n  return {\n    namespace,\n    sessionKey: params.get(\"session\") || undefined,\n    authenticatedPrincipal,\n    cwd: params.get(\"cwd\") || undefined,\n    projectTag: params.get(\"projectTag\") || undefined,\n  };\n}\n\nexport function parseNamespacePreflightWriteOp(\n  value: string | undefined,\n): \"observe\" | \"memory_store\" {\n  if (value === undefined || value === \"observe\") return \"observe\";\n  if (value === \"memory_store\") return \"memory_store\";\n  throw new EngramAccessInputError(`unsupported namespace preflight operation: ${value}`);\n}\n\nexport function assertNamespacePreflightPermitted(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  const allowedOps = getOperation(\"namespace_writable\")?.spec.allowedByOps ?? [];\n  if (!allowedOps.some((op) => capabilityAllowsOp(caps, op))) {\n    throw new EngramAccessForbiddenError(\"token is not permitted to run the namespace preflight\");\n  }\n}\n\nexport type NamespaceWritableResolver = (\n  request: EngramAccessNamespaceWritableRequest,\n) => Promise<string>;\nexport type NamespaceWritablePreflightResolver = (\n  request: EngramAccessNamespaceWritableRequest,\n) => Promise<WritableNamespaceResult>;\n\nexport async function resolveNamespaceWritablePreflight(\n  request: EngramAccessNamespaceWritableRequest,\n  resolveWritable: NamespaceWritableResolver,\n): Promise<WritableNamespaceResult> {\n  try {\n    return { ok: true, namespace: await resolveWritable(request) };\n  } catch (error) {\n    if (error instanceof NamespaceNotWritableError) {\n      return { ok: false, reason: \"not_writable\", namespace: error.attemptedNamespace };\n    }\n    if (error instanceof EngramAccessInputError) {\n      return {\n        ok: false,\n        reason: \"unsupported\",\n        namespace: request.namespace?.trim() ?? \"\",\n      };\n    }\n    throw error;\n  }\n}\n\nexport async function resolveAuthorizedNamespaceWritablePreflight(\n  caps: TokenCapabilities | undefined | null,\n  request: EngramAccessNamespaceWritableRequest,\n  defaultNamespace: string,\n  writeOp: \"observe\" | \"memory_store\",\n  resolvePreflight: NamespaceWritablePreflightResolver,\n): Promise<WritableNamespaceResult> {\n  if (!capabilityAllowsOp(caps, writeOp)) {\n    return {\n      ok: false,\n      reason: \"not_writable\",\n      namespace: request.namespace?.trim() || defaultNamespace,\n    };\n  }\n\n  const result = await resolvePreflight(request);\n  if (!isNamespaceAllowed(caps, result.namespace, defaultNamespace)) {\n\n    return { ok: false, reason: \"not_writable\", namespace: result.namespace };\n  }\n  return result;\n}\n\nexport function resolveQueryNamespaceWritablePreflight(\n  caps: TokenCapabilities | undefined | null,\n  params: URLSearchParams,\n  authenticatedPrincipal: string | undefined,\n  defaultNamespace: string,\n  resolvePreflight: NamespaceWritablePreflightResolver,\n): Promise<WritableNamespaceResult> {\n  assertNamespacePreflightPermitted(caps);\n  return resolveAuthorizedNamespaceWritablePreflight(\n    caps,\n    namespaceWritableRequest(params, authenticatedPrincipal),\n    defaultNamespace,\n    parseNamespacePreflightWriteOp(params.get(\"op\") ?? undefined),\n    resolvePreflight,\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAaO,SAAS,yBACd,QACA,wBACsC;AACtC,QAAM,YAAY,OAAO,IAAI,WAAW,KAAK;AAC7C,SAAO;AAAA,IACL;AAAA,IACA,YAAY,OAAO,IAAI,SAAS,KAAK;AAAA,IACrC;AAAA,IACA,KAAK,OAAO,IAAI,KAAK,KAAK;AAAA,IAC1B,YAAY,OAAO,IAAI,YAAY,KAAK;AAAA,EAC1C;AACF;AAEO,SAAS,+BACd,OAC4B;AAC5B,MAAI,UAAU,UAAa,UAAU,UAAW,QAAO;AACvD,MAAI,UAAU,eAAgB,QAAO;AACrC,QAAM,IAAI,uBAAuB,8CAA8C,KAAK,EAAE;AACxF;AAEO,SAAS,kCACd,MACM;AACN,QAAM,aAAa,aAAa,oBAAoB,GAAG,KAAK,gBAAgB,CAAC;AAC7E,MAAI,CAAC,WAAW,KAAK,CAAC,OAAO,mBAAmB,MAAM,EAAE,CAAC,GAAG;AAC1D,UAAM,IAAI,2BAA2B,uDAAuD;AAAA,EAC9F;AACF;AASA,eAAsB,kCACpB,SACA,iBACkC;AAClC,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,WAAW,MAAM,gBAAgB,OAAO,EAAE;AAAA,EAC/D,SAAS,OAAO;AACd,QAAI,iBAAiB,2BAA2B;AAC9C,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,WAAW,MAAM,mBAAmB;AAAA,IAClF;AACA,QAAI,iBAAiB,wBAAwB;AAC3C,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ;AAAA,QACR,WAAW,QAAQ,WAAW,KAAK,KAAK;AAAA,MAC1C;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,4CACpB,MACA,SACA,kBACA,SACA,kBACkC;AAClC,MAAI,CAAC,mBAAmB,MAAM,OAAO,GAAG;AACtC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,WAAW,QAAQ,WAAW,KAAK,KAAK;AAAA,IAC1C;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,iBAAiB,OAAO;AAC7C,MAAI,CAAC,mBAAmB,MAAM,OAAO,WAAW,gBAAgB,GAAG;AAEjE,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,WAAW,OAAO,UAAU;AAAA,EAC1E;AACA,SAAO;AACT;AAEO,SAAS,uCACd,MACA,QACA,wBACA,kBACA,kBACkC;AAClC,oCAAkC,IAAI;AACtC,SAAO;AAAA,IACL;AAAA,IACA,yBAAyB,QAAQ,sBAAsB;AAAA,IACvD;AAAA,IACA,+BAA+B,OAAO,IAAI,IAAI,KAAK,MAAS;AAAA,IAC5D;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-UE6RRXMF.js → chunk-A4F7OIC5.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-65AUYLU3.js";
+} from "./chunk-XPXHQI6N.js";
 import {
   reportSearchDegradation
 } from "./chunk-NWA6IXR3.js";
@@ -568,4 +568,4 @@ export {
   normalizeQmdResultPath,
   resolveNamespaceResultPath
 };
-//# sourceMappingURL=chunk-UE6RRXMF.js.map
+//# sourceMappingURL=chunk-A4F7OIC5.js.map

package/dist/chunk-AHA5VQGP.js

@@ -0,0 +1,117 @@
+import {
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
+
+// src/support-passport/contracts.ts
+import { createHash } from "crypto";
+import { z } from "zod";
+var SUPPORT_PASSPORT_CARD_CATEGORIES = [
+  "communication",
+  "environment",
+  "transitions",
+  "sensory",
+  "regulation",
+  "interests",
+  "other"
+];
+var SUPPORT_PASSPORT_CARD_STATUSES = [
+  "pending_review",
+  "active",
+  "rejected",
+  "superseded",
+  "archived"
+];
+var SupportPassportCardCategorySchema = z.enum(SUPPORT_PASSPORT_CARD_CATEGORIES);
+var SupportPassportCardStatusSchema = z.enum(SUPPORT_PASSPORT_CARD_STATUSES);
+var SupportPassportCardTitleSchema = z.string().trim().min(1).max(80).refine((title) => !title.includes("]") && !title.includes("\n") && !title.includes("\r"), {
+  message: "card titles cannot contain closing brackets or line breaks"
+});
+var IsoTimestampSchema = z.string().datetime({ offset: true }).refine((value) => parseIsoOffsetTimestamp(value) !== null, {
+  message: "timestamps must be valid ISO 8601 values"
+});
+var SupportPassportNamespaceSchema = z.string().min(1).refine((namespace) => namespace === normalizeNamespaceIdentity(namespace), {
+  message: "namespaces must be canonical"
+});
+var SupportPassportMemoryIdSchema = z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/);
+var SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH = 512;
+var SupportPassportSourceMemoryIdSchema = z.string().trim().min(1).max(SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH);
+var SupportPassportCardSchema = z.object({
+  cardId: SupportPassportMemoryIdSchema,
+  title: SupportPassportCardTitleSchema,
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  status: SupportPassportCardStatusSchema,
+  updatedAt: IsoTimestampSchema,
+  reviewBy: IsoTimestampSchema,
+  revision: z.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var SupportPassportCardListSchema = z.array(SupportPassportCardSchema).max(100).superRefine((cards, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, card] of cards.entries()) {
+    if (seen.has(card.cardId)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card IDs must be unique",
+        path: [index, "cardId"]
+      });
+    }
+    seen.add(card.cardId);
+  }
+});
+var SupportPassportListCardsInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512)
+}).strict();
+var SupportPassportManualDraftInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  title: SupportPassportCardTitleSchema,
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  reviewBy: IsoTimestampSchema
+}).strict();
+var SupportPassportCardMutationInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  cardId: SupportPassportMemoryIdSchema,
+  expectedRevision: z.string().regex(/^[a-f0-9]{64}$/),
+  reasonCode: z.string().trim().min(1).max(64).regex(/^[a-z0-9-]+$/).optional()
+}).strict();
+var SupportPassportReplaceCardInputSchema = SupportPassportCardMutationInputSchema.extend({
+  title: SupportPassportCardTitleSchema,
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  reviewBy: IsoTimestampSchema
+}).strict();
+function computeSupportPassportCardRevision(fields) {
+  const canonicalFields = {
+    cardId: fields.cardId,
+    category: fields.category,
+    reviewBy: fields.reviewBy,
+    statement: fields.statement,
+    status: fields.status,
+    title: fields.title,
+    updatedAt: fields.updatedAt
+  };
+  return createHash("sha256").update(JSON.stringify(canonicalFields)).digest("hex");
+}
+
+export {
+  SUPPORT_PASSPORT_CARD_CATEGORIES,
+  SUPPORT_PASSPORT_CARD_STATUSES,
+  SupportPassportCardCategorySchema,
+  SupportPassportCardStatusSchema,
+  SupportPassportCardTitleSchema,
+  SupportPassportNamespaceSchema,
+  SupportPassportMemoryIdSchema,
+  SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH,
+  SupportPassportSourceMemoryIdSchema,
+  SupportPassportCardSchema,
+  SupportPassportCardListSchema,
+  SupportPassportListCardsInputSchema,
+  SupportPassportManualDraftInputSchema,
+  SupportPassportCardMutationInputSchema,
+  SupportPassportReplaceCardInputSchema,
+  computeSupportPassportCardRevision
+};
+//# sourceMappingURL=chunk-AHA5VQGP.js.map