@remnic/core 9.54.4 → 9.54.5

package/dist/{chunk-PX2LSHYM.js → chunk-3SXLD5T3.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-D24OXEPB.js";
 import {
   validateRequest
-} from "./chunk-NIS256NW.js";
+} from "./chunk-JKW663ZN.js";
 import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_MIME_TYPE,
   REMNIC_CHATGPT_MEMORY_INSPECTOR_TOOL,
@@ -25,7 +25,7 @@ import {
 } from "./chunk-YYQAKIDJ.js";
 import {
   getOperation
-} from "./chunk-T2JHZWH6.js";
+} from "./chunk-3WGI7F4V.js";
 import {
   assertOperationAllowed,
   capabilityAllowsOp,
@@ -3761,4 +3761,4 @@ export {
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-PX2LSHYM.js.map
+//# sourceMappingURL=chunk-3SXLD5T3.js.map

package/dist/{chunk-T2JHZWH6.js → chunk-3WGI7F4V.js}

@@ -12,12 +12,6 @@ import {
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
-import {
-  trustResultFor
-} from "./chunk-GNVZQ5JN.js";
-import {
-  renderEpistemicHedge
-} from "./chunk-YN2UN7N3.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -27,6 +21,12 @@ import {
   seedTrustZoneDemoDataset,
   summarizeTrustZonePromotionReadiness
 } from "./chunk-KQS72GCR.js";
+import {
+  trustResultFor
+} from "./chunk-GNVZQ5JN.js";
+import {
+  renderEpistemicHedge
+} from "./chunk-YN2UN7N3.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
@@ -39,13 +39,13 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-QT2FRYI4.js";
+} from "./chunk-RG426DJO.js";
 import {
   estimateRecallTokens
-} from "./chunk-QHFV6VNU.js";
+} from "./chunk-QPAQSG3F.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-CGVHPCP2.js";
+} from "./chunk-7Q7JWLQ4.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -84,7 +84,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-RUMNY5DT.js";
+} from "./chunk-MRGJZ75M.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -95,14 +95,11 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-6LAPLZOS.js";
+} from "./chunk-2DD6ZHOM.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-APPFNGX6.js";
-import {
-  namespaceCollectionName
-} from "./chunk-VMMQDEN5.js";
+} from "./chunk-BSXGTDVJ.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
@@ -120,18 +117,21 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-JDZPNCMA.js";
+} from "./chunk-UYOXFFEY.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
+import {
+  namespaceCollectionName
+} from "./chunk-DN2IDKI5.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-UU3G6GUP.js";
+} from "./chunk-BIF4SHMD.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -159,7 +159,7 @@ import {
   isActivityDigestPath,
   isArtifactMemoryPath,
   isMeetingRecordPath
-} from "./chunk-ZMYDYNI4.js";
+} from "./chunk-N7CXQ5TA.js";
 import {
   ExtractionLivenessWarnThrottle,
   computeExtractionLivenessStatus
@@ -191,41 +191,35 @@ import {
   memorySearchThroughScope,
   mergeMemorySearchDefaultFallback,
   resolveMemorySearchDefaultFallback
-} from "./chunk-IXEBUYO4.js";
+} from "./chunk-KM55SMLG.js";
 import {
   PendingObserveExtractionTracker,
   pendingObserveScopeHint
 } from "./chunk-LNEWDF2A.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-G2LUMAUF.js";
+} from "./chunk-L7RTUEDG.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-GUKBW4HL.js";
+} from "./chunk-NQMSEB5D.js";
 import {
   resolveScopePlan,
   resolveScopedWritableNamespaceValue,
   resolveWritableNamespaceValue
-} from "./chunk-YN6ASZUG.js";
+} from "./chunk-6QPI2ITJ.js";
 import {
   writeFileAtomically
 } from "./chunk-AW4QUFQF.js";
-import {
-  namespaceIdentityFromToken
-} from "./chunk-EGGE52UU.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
 } from "./chunk-7RJUVTVF.js";
 import {
   getMemoryProjectionPath
-} from "./chunk-3CSX3ETE.js";
+} from "./chunk-2LWQSV6A.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
-import {
-  stripAttributesSuffix
-} from "./chunk-JDSVLVCG.js";
 import {
   serializeMutations
 } from "./chunk-FFAZ2XFU.js";
@@ -236,6 +230,16 @@ import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
 } from "./chunk-BGLY7EEM.js";
+import {
+  createSupportPassportPrivateFileExclusion,
+  isSupportPassportPrivateMemory
+} from "./chunk-HNDIND7P.js";
+import {
+  namespaceIdentityFromToken
+} from "./chunk-EGGE52UU.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-JDSVLVCG.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
@@ -253,8 +257,12 @@ import {
   compileOfflineSyncExcludeGlobs,
   filterOfflineSyncDeletionRevisions,
   iterateOfflineSyncSnapshotFileRecords,
+  normalizeOfflineSyncChangeset,
   readOfflineSyncFileContentChunk
-} from "./chunk-GYPQL6XN.js";
+} from "./chunk-Z4N7SVVF.js";
+import {
+  validateArchiveRelativePath
+} from "./chunk-GCGJW34D.js";
 import {
   assertOperationAuthorizationAllowed,
   capabilityAllowsOp,
@@ -4012,7 +4020,7 @@ async function resolveTargetMemories(wiring, targetIds, namespaces) {
     for (const ns of namespaces) {
       const storage = await wiring.orchestrator.getStorage(ns);
       const m = await storage.getMemoryById(id);
-      if (m) {
+      if (m && isEligibleCorrectionCandidate(m)) {
         found = toCandidate(m, ns, 1);
         break;
       }
@@ -4034,7 +4042,7 @@ async function expandEntityNeighbors(wiring, seedIds, namespaces, limit) {
     const storage = await wiring.orchestrator.getStorage(ns);
     const all = await storage.readAllMemories();
     for (const m of all) {
-      if (seedIds.includes(m.frontmatter.id) && m.frontmatter.entityRef) {
+      if (seedIds.includes(m.frontmatter.id) && m.frontmatter.entityRef && isEligibleCorrectionCandidate(m)) {
         seedRefs.add(m.frontmatter.entityRef);
       }
     }
@@ -4380,6 +4388,7 @@ function toCandidate(m, namespace, score) {
   };
 }
 function isEligibleCorrectionCandidate(m) {
+  if (isSupportPassportPrivateMemory(m)) return false;
   if (m.frontmatter.status && m.frontmatter.status !== "active") return false;
   if (typeof m.frontmatter.archivedAt === "string" && m.frontmatter.archivedAt.length > 0) return false;
   return true;
@@ -4902,10 +4911,167 @@ function filterRecallCandidates(candidates, options) {
   return scopedByNamespace.filter((r) => !isGenericRecallExcludedPath(r.path, pathPolicy, "qmd")).slice(0, Math.max(0, options.limit));
 }
 
+// src/support-passport/offline-sync-guard.ts
+import path7 from "path";
+var MAX_SUPPORT_PASSPORT_FRONTMATTER_BYTES = 1048576;
+var SUPPORT_PASSPORT_MARKER = "support-passport-";
+var FRONTMATTER_PREFIXES = ["---\n", "---\r\n"];
+function frontmatterPrefixState(raw) {
+  const prefix = raw.subarray(0, Math.min(raw.length, 5)).toString("utf8");
+  if (FRONTMATTER_PREFIXES.some((candidate) => prefix.startsWith(candidate))) return "present";
+  if (FRONTMATTER_PREFIXES.some((candidate) => candidate.startsWith(prefix))) return "pending";
+  return "absent";
+}
+function completeFrontmatter(raw) {
+  const text = raw.toString("utf8");
+  return /^---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/.exec(text)?.[0] ?? null;
+}
+function assertFrontmatterAllowed(frontmatter, relativePath) {
+  if (frontmatter.includes(SUPPORT_PASSPORT_MARKER)) {
+    throw new Error(`offline sync cannot modify private support-passport record: ${relativePath}`);
+  }
+}
+function inspectBufferedFrontmatter(raw, relativePath, endOfFile) {
+  const prefixState = frontmatterPrefixState(raw);
+  if (prefixState === "absent") return "allow";
+  if (prefixState === "pending" && !endOfFile) return "wait";
+  const frontmatter = completeFrontmatter(raw);
+  if (frontmatter !== null) {
+    assertFrontmatterAllowed(frontmatter, relativePath);
+    return "allow";
+  }
+  if (raw.length > MAX_SUPPORT_PASSPORT_FRONTMATTER_BYTES) {
+    throw new Error(`offline sync frontmatter is too large: ${relativePath}`);
+  }
+  if (endOfFile) {
+    assertFrontmatterAllowed(raw.toString("utf8"), relativePath);
+    return "allow";
+  }
+  return "wait";
+}
+async function* guardSupportPassportChunks(chunks, relativePath) {
+  const buffered = [];
+  let bufferedBytes = 0;
+  let passThrough = false;
+  for await (const chunk of chunks) {
+    if (passThrough) {
+      yield chunk;
+      continue;
+    }
+    buffered.push(chunk);
+    bufferedBytes += chunk.length;
+    const raw = Buffer.concat(buffered, bufferedBytes);
+    if (inspectBufferedFrontmatter(raw, relativePath, false) === "wait") continue;
+    for (const bufferedChunk of buffered) yield bufferedChunk;
+    passThrough = true;
+  }
+  if (!passThrough && bufferedBytes > 0) {
+    const raw = Buffer.concat(buffered, bufferedBytes);
+    inspectBufferedFrontmatter(raw, relativePath, true);
+    for (const bufferedChunk of buffered) yield bufferedChunk;
+  }
+}
+function createSupportPassportOfflineSyncGuard(storage) {
+  const excludePrivateFile = createSupportPassportPrivateFileExclusion(storage);
+  const targetForPath = (relativePath) => {
+    const normalizedPath = validateArchiveRelativePath(relativePath, "path");
+    return {
+      root: storage.dir,
+      path: normalizedPath,
+      filePath: path7.resolve(storage.dir, ...normalizedPath.split("/"))
+    };
+  };
+  const assertTargetAllowed = async (target) => {
+    if (await excludePrivateFile(target)) {
+      throw new Error(`offline sync cannot modify private support-passport record: ${target.path}`);
+    }
+  };
+  return {
+    async assertPathAllowed(relativePath) {
+      await assertTargetAllowed(targetForPath(relativePath));
+    },
+    assertContentAllowed(relativePath, content) {
+      inspectBufferedFrontmatter(content, relativePath, true);
+    },
+    assertTargetAllowed,
+    guardChunks(relativePath, chunks) {
+      return guardSupportPassportChunks(chunks, relativePath);
+    },
+    excludePrivateFile
+  };
+}
+async function applySupportPassportOfflineSyncFileContent(storage, options) {
+  const guard = createSupportPassportOfflineSyncGuard(storage);
+  await guard.assertPathAllowed(options.path);
+  return applyOfflineSyncFileContentChunk({
+    root: storage.dir,
+    sourceId: options.sourceId,
+    path: options.path,
+    sha256: options.sha256,
+    bytes: options.bytes,
+    mtimeMs: options.mtimeMs,
+    offset: options.offset,
+    baseSha256: options.baseSha256,
+    content: options.content,
+    includeTranscripts: options.includeTranscripts !== false,
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
+    writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
+    writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
+    writeFileChunks: async (target) => {
+      await guard.assertTargetAllowed(target);
+      await storage.writeOfflineSyncFileChunks(
+        target.filePath,
+        guard.guardChunks(target.path, target.chunks)
+      );
+    }
+  });
+}
+async function applySupportPassportOfflineSyncChangeset(storage, options) {
+  const guard = createSupportPassportOfflineSyncGuard(storage);
+  const changeset = normalizeOfflineSyncChangeset(options.changeset);
+  for (const change of changeset.changes) {
+    await guard.assertPathAllowed(change.path);
+    if (change.type === "upsert") {
+      guard.assertContentAllowed(change.path, Buffer.from(change.file.contentBase64, "base64"));
+    }
+  }
+  const result = await applyOfflineSyncChangeset({
+    root: storage.dir,
+    changeset,
+    returnCurrentFiles: false,
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
+    writeFile: async (target) => {
+      await guard.assertTargetAllowed(target);
+      guard.assertContentAllowed(target.path, target.content);
+      await storage.writeOfflineSyncFile(target.filePath, target.content);
+    },
+    deleteFile: async (target) => {
+      await guard.assertTargetAllowed(target);
+      await storage.deleteOfflineSyncFile(target.filePath, target.mtimeMs ?? null);
+    },
+    recordDeletionRevision: async ({ filePath, mtimeMs }) => storage.recordReplicatedDeletionRevision(filePath, mtimeMs)
+  });
+  if (options.returnCurrentFiles === false) return result;
+  const current = await buildOfflineSyncSnapshot({
+    root: storage.dir,
+    sourceId: "local",
+    includeContent: false,
+    includeTranscripts: changeset.includeTranscripts,
+    excludeNodeLocalState: false,
+    readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
+    readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
+    excludeFile: guard.excludePrivateFile
+  });
+  const { currentFiles: _partialFiles, currentFilesComplete: _incomplete, ...counts } = result;
+  return { ...counts, currentFiles: current.files };
+}
+
 // src/procedural/procedure-miner.ts
 import { createHash as createHash3 } from "crypto";
 import { mkdir as mkdir2, rm, stat } from "fs/promises";
-import path7 from "path";
+import path8 from "path";
 
 // src/procedural/reinforcement-core.ts
 function clusterByKey(items, keyFn) {
@@ -4958,8 +5124,8 @@ function sleep(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
-  const lockRoot = path7.join(path7.resolve(memoryDir), "state", "procedure-miner-locks");
-  const lockDir = path7.join(lockRoot, `${clusterHash}.lock`);
+  const lockRoot = path8.join(path8.resolve(memoryDir), "state", "procedure-miner-locks");
+  const lockDir = path8.join(lockRoot, `${clusterHash}.lock`);
   await mkdir2(lockRoot, { recursive: true });
   const startedAt = Date.now();
   let attempts = 0;
@@ -4990,7 +5156,7 @@ async function acquireClusterWriteLock(memoryDir, clusterHash) {
   }
 }
 async function withClusterWriteLock(memoryDir, clusterHash, fn) {
-  const inProcessKey = `${path7.resolve(memoryDir)}:${clusterHash}`;
+  const inProcessKey = `${path8.resolve(memoryDir)}:${clusterHash}`;
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
@@ -5447,10 +5613,10 @@ function formatZodIssues(error) {
   const parts = [];
   for (const issue of error.issues) {
     const hasNumeric = issue.path.some((p) => typeof p === "number");
-    const path10 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const path11 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
     const options = enumOptionsFromIssue(issue);
     const suffix = options ? `. Valid: ${options.join(", ")}` : "";
-    parts.push(`${path10}: ${issue.message}${suffix}`);
+    parts.push(`${path11}: ${issue.message}${suffix}`);
   }
   return parts.length > 0 ? `request validation failed: ${parts.join("; ")}` : "request validation failed";
 }
@@ -5589,7 +5755,7 @@ function resolveQueryNamespaceWritablePreflight(caps, params, authenticatedPrinc
 }
 
 // src/admin/admin-surfaces.ts
-import path8 from "path";
+import path9 from "path";
 var REDACTED = "<redacted>";
 var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
 var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
@@ -5872,7 +6038,7 @@ async function auditTranscripts(memoryDir) {
     movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
     unmovableLines: file.unmovableLines
   }));
-  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path8.sep).includes("other"));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path9.sep).includes("other"));
   const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
   return {
     generatedAt: plan.generatedAt,
@@ -8238,7 +8404,7 @@ import { createHash as createHash5 } from "crypto";
 import * as nodePath2 from "path";
 
 // src/orchestration/recall-result-formatter.ts
-import path9 from "path";
+import path10 from "path";
 function renderConnectorLabel(connector) {
   if (!isValidConnectorId(connector)) return null;
   return connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : `${connector.slice(0, CONNECTOR_LABEL_MAX_LENGTH - 1)}\u2026`;
@@ -8260,15 +8426,15 @@ function resolveEffectiveIdentityInjectionMode(options) {
   return { mode: options.configuredMode, shouldInject: true };
 }
 function displayResultPath(resultPath, memoryDir, namespace) {
-  if (!path9.isAbsolute(resultPath)) return resultPath;
-  const root = path9.resolve(memoryDir);
-  const nsRoot = path9.join(root, "namespaces");
-  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path9.sep))) {
-    const afterNs = path9.relative(nsRoot, resultPath).split(path9.sep).slice(1).join("/");
+  if (!path10.isAbsolute(resultPath)) return resultPath;
+  const root = path10.resolve(memoryDir);
+  const nsRoot = path10.join(root, "namespaces");
+  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path10.sep))) {
+    const afterNs = path10.relative(nsRoot, resultPath).split(path10.sep).slice(1).join("/");
     if (afterNs) return `${namespace}/${afterNs}`;
   }
-  const rel = path9.relative(root, resultPath);
-  return rel && !rel.startsWith("..") && !path9.isAbsolute(rel) ? rel.split(path9.sep).join("/") : resultPath;
+  const rel = path10.relative(root, resultPath);
+  return rel && !rel.startsWith("..") && !path10.isAbsolute(rel) ? rel.split(path10.sep).join("/") : resultPath;
 }
 function displaySafeBudgetsApplied(budgetsApplied, memoryDir) {
   if (!budgetsApplied?.includedMemoryPaths) return budgetsApplied;
@@ -11035,9 +11201,7 @@ var EngramAccessService = class {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const memory = await storage.getMemoryById(resolvedId);
-    if (!memory) {
-      return { found: false, namespace: resolvedNamespace };
-    }
+    if (!memory || isSupportPassportPrivateMemory(memory)) return { found: false, namespace: resolvedNamespace };
     return {
       found: true,
       namespace: resolvedNamespace,
@@ -11337,6 +11501,7 @@ var EngramAccessService = class {
       query,
       status: statusFilter,
       category: categoryFilter,
+      excludePrivateRecords: true,
       sort,
       limit,
       offset
@@ -11354,6 +11519,7 @@ var EngramAccessService = class {
     }
     let memories = [...await storage.readAllMemories(), ...await storage.readArchivedMemories()];
     memories = memories.filter((memory) => {
+      if (isSupportPassportPrivateMemory(memory)) return false;
       const status = inferMemoryStatus(memory.frontmatter, toMemoryPathRel(storage.dir, memory.path)).toLowerCase();
       if (statusFilter && status !== statusFilter) return false;
       if (categoryFilter && memory.frontmatter.category.toLowerCase() !== categoryFilter) return false;
@@ -11382,6 +11548,8 @@ var EngramAccessService = class {
   async memoryTimeline(memoryId, namespace, limit = 200, principal) {
     const resolvedNamespace = this.resolveReadableNamespace(namespace, principal);
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
+    const memory = await storage.getMemoryByIdIncludingArchived(memoryId);
+    if (!memory || isSupportPassportPrivateMemory(memory)) return { found: false, namespace: resolvedNamespace, count: 0, timeline: [] };
     const timeline = await storage.getMemoryTimeline(memoryId, limit);
     return {
       found: timeline.length > 0,
@@ -11744,7 +11912,7 @@ var EngramAccessService = class {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const memory = await storage.getMemoryById(memoryId);
-    if (!memory) {
+    if (!memory || isSupportPassportPrivateMemory(memory)) {
       throw new EngramAccessInputError(`memory not found: ${memoryId}`);
     }
     const previousStatus = memory.frontmatter.status ?? "active";
@@ -12141,7 +12309,6 @@ var EngramAccessService = class {
       request
     );
   }
-  // ── Shared Context / Compounding ────────────────────────────────────────
   async sharedContextWriteOutput(request) {
     if (!this.orchestrator.sharedContext) {
       return { enabled: false, reason: "Shared context is disabled. Enable `sharedContextEnabled: true`." };
@@ -12234,7 +12401,6 @@ var EngramAccessService = class {
       dryRun: request.dryRun
     });
   }
-  // ── Compression Guidelines ────────────────────────────────────────────
   async compressionGuidelinesOptimize(request) {
     if (!resolveCompressionCapabilities(this.orchestrator.config).compressionGuidelineLearning) {
       return { enabled: false, reason: "Compression guideline learning is disabled. Enable `compressionGuidelineLearningEnabled: true`." };
@@ -12253,12 +12419,12 @@ var EngramAccessService = class {
       expectedGuidelineVersion: request.expectedGuidelineVersion
     });
   }
-  // ── Memory search & debug ─────────────────────────────────────────────
   async memorySearch(request) {
     const { qmd, config } = this.orchestrator;
     return memorySearchThroughScope(
       {
         namespacesEnabled: resolveNamespaceCapabilities(config).namespaces,
+        memoryCollections: [config.qmdCollection, config.qmdColdCollection ?? "openclaw-engram-cold"],
         // `0` is preserved, never coerced: a zero limit is a runtime
         // compatibility guarantee (AGENTS.md guardrail 4), and it means the
         // same thing here as an explicit `maxResults: 0` from the caller - an
@@ -12275,9 +12441,8 @@ var EngramAccessService = class {
           { ...config, requestedCollection: request.collection?.trim() || void 0 },
           "qmd"
         ),
-        authorizeFlatCorpus: (namespace, principal) => {
-          this.resolveReadableNamespace(namespace, principal);
-        },
+        filterPrivate: this.orchestrator.filterPrivateSearchResults,
+        authorizeFlatCorpus: (namespace, principal) => void this.resolveReadableNamespace(namespace, principal),
         authorizeNamespaces: async (namespace, principal, collection) => this.resolveMemorySearchNamespacesForCollection(
           collection,
           await this.resolveReadableNamespacesForSearch(namespace, principal),
@@ -12810,7 +12975,7 @@ var EngramAccessService = class {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
     const storageHash = createHash6("sha256").update(storage.dir).digest("hex").slice(0, 16);
-    const deletions = [...await storage.readDeletionRevisions()].map(([path10, mtimeMs]) => ({ path: path10, mtimeMs }));
+    const deletions = [...await storage.readDeletionRevisions()].map(([path11, mtimeMs]) => ({ path: path11, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -12822,7 +12987,8 @@ var EngramAccessService = class {
       readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
       signal: options.signal,
       userExcludeRegexps: this.offlineSyncUserExcludes,
-      deletions
+      deletions,
+      excludeFile: createSupportPassportPrivateFileExclusion(storage)
     });
     return {
       namespace: resolvedNamespace,
@@ -12835,7 +13001,7 @@ var EngramAccessService = class {
     const storageHash = createHash6("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const deletions = await filterOfflineSyncDeletionRevisions({
       root: storage.dir,
-      deletions: [...await storage.readDeletionRevisions()].map(([path10, mtimeMs]) => ({ path: path10, mtimeMs })),
+      deletions: [...await storage.readDeletionRevisions()].map(([path11, mtimeMs]) => ({ path: path11, mtimeMs })),
       includeTranscripts: options.includeTranscripts !== false,
       userExcludeRegexps: this.offlineSyncUserExcludes
     });
@@ -12854,7 +13020,8 @@ var EngramAccessService = class {
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
         readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
         signal: options.signal,
-        userExcludeRegexps: this.offlineSyncUserExcludes
+        userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage)
       })
     };
   }
@@ -12880,7 +13047,8 @@ var EngramAccessService = class {
         includeContent: true,
         includeTranscripts: options.includeTranscripts !== false,
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        userExcludeRegexps: this.offlineSyncUserExcludes
+        userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage)
       });
       return {
         namespace: resolvedNamespace,
@@ -12905,7 +13073,8 @@ var EngramAccessService = class {
         length: options.length,
         includeTranscripts: options.includeTranscripts !== false,
         readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        userExcludeRegexps: this.offlineSyncUserExcludes
+        userExcludeRegexps: this.offlineSyncUserExcludes,
+        excludeFile: createSupportPassportPrivateFileExclusion(storage)
       });
       return {
         namespace: resolvedNamespace,
@@ -12927,23 +13096,7 @@ var EngramAccessService = class {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applyOfflineSyncFileContentChunk({
-        root: storage.dir,
-        sourceId: options.sourceId,
-        path: options.path,
-        sha256: options.sha256,
-        bytes: options.bytes,
-        mtimeMs: options.mtimeMs,
-        offset: options.offset,
-        baseSha256: options.baseSha256,
-        content: options.content,
-        includeTranscripts: options.includeTranscripts !== false,
-        readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
-        writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-        writeStagingFile: async ({ filePath, content }) => storage.writeOfflineSyncStagingFile(filePath, content),
-        writeFileChunks: async ({ filePath, chunks }) => storage.writeOfflineSyncFileChunks(filePath, chunks)
-      });
+      const result = await applySupportPassportOfflineSyncFileContent(storage, options);
       return {
         namespace: resolvedNamespace,
         ...result
@@ -12982,16 +13135,7 @@ var EngramAccessService = class {
     );
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     try {
-      const result = await applyOfflineSyncChangeset({
-        root: storage.dir,
-        changeset: options.changeset,
-        returnCurrentFiles: options.returnCurrentFiles,
-        readFile: async ({ filePath }) => storage.readOfflineSyncFile(filePath),
-        readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
-        writeFile: async ({ filePath, content }) => storage.writeOfflineSyncFile(filePath, content),
-        deleteFile: async ({ filePath, mtimeMs }) => storage.deleteOfflineSyncFile(filePath, mtimeMs ?? null),
-        recordDeletionRevision: async ({ filePath, mtimeMs }) => storage.recordReplicatedDeletionRevision(filePath, mtimeMs)
-      });
+      const result = await applySupportPassportOfflineSyncChangeset(storage, options);
       return {
         namespace: resolvedNamespace,
         ...result
@@ -13523,4 +13667,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-T2JHZWH6.js.map
+//# sourceMappingURL=chunk-3WGI7F4V.js.map