@remnic/core 9.54.4 → 9.54.5

package/dist/{chunk-CYF6WVE7.js → chunk-7HG7MGAP.js}

@@ -7,22 +7,22 @@ import {
   syncWearableSource,
   wearableSourceLabel
 } from "./chunk-HOIRB77A.js";
+import {
+  runPeerProfileReasoner
+} from "./chunk-I74SUMNI.js";
 import {
   CompressionGuidelineCoordinator
 } from "./chunk-6LKEUCEM.js";
 import {
   ActivityStore,
   MaintenanceScheduler
-} from "./chunk-WOPA3SGI.js";
-import {
-  runPeerProfileReasoner
-} from "./chunk-I74SUMNI.js";
+} from "./chunk-3OTSVCPK.js";
 import {
   migrateFromEngram
 } from "./chunk-7HYPN2GC.js";
 import {
   LcmEngine
-} from "./chunk-MAXVH44E.js";
+} from "./chunk-6NNNURLK.js";
 import {
   chunkTranscriptEntries
 } from "./chunk-TECVW3JP.js";
@@ -32,7 +32,7 @@ import {
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-YGLY6QFV.js";
+} from "./chunk-F2Y6I74C.js";
 import {
   SharedContextManager
 } from "./chunk-M23RF3LJ.js";
@@ -41,6 +41,9 @@ import {
   applyUtilityRankingRuntimeDelta,
   loadUtilityRuntimeValues
 } from "./chunk-SEF4IOFE.js";
+import {
+  decideTierTransition
+} from "./chunk-6LEIWWAF.js";
 import {
   TmtBuilder
 } from "./chunk-ECZU5BJH.js";
@@ -56,9 +59,6 @@ import {
 import {
   TierMigrationExecutor
 } from "./chunk-YRFAYOFQ.js";
-import {
-  decideTierTransition
-} from "./chunk-S75M5ZRK.js";
 import {
   HourlySummarizer
 } from "./chunk-LLJMAULE.js";
@@ -69,18 +69,6 @@ import {
 import {
   SessionObserverState
 } from "./chunk-QFN4U7AG.js";
-import {
-  applyRuntimeRetrievalPolicy
-} from "./chunk-5IZL4DCV.js";
-import {
-  RerankCache,
-  reorderByRankedKeys,
-  rerankLocalOrNoop
-} from "./chunk-LUDXM7MD.js";
-import {
-  buildResponseGuidanceRecallSection,
-  shouldRecallResponseGuidance
-} from "./chunk-6TCXIRP5.js";
 import {
   mergeWithAgentResults,
   runDirectAgent,
@@ -103,11 +91,23 @@ import {
   resolvePromptTagPrefilterAsync
 } from "./chunk-ZOKZIR5K.js";
 import {
-  findUnresolvedEntityRefs
-} from "./chunk-X7XN6YU4.js";
+  applyRuntimeRetrievalPolicy
+} from "./chunk-5IZL4DCV.js";
 import {
   RelevanceStore
 } from "./chunk-KATEWTQJ.js";
+import {
+  RerankCache,
+  reorderByRankedKeys,
+  rerankLocalOrNoop
+} from "./chunk-LUDXM7MD.js";
+import {
+  buildResponseGuidanceRecallSection,
+  shouldRecallResponseGuidance
+} from "./chunk-6TCXIRP5.js";
+import {
+  findUnresolvedEntityRefs
+} from "./chunk-X7XN6YU4.js";
 import {
   dedupeResultsByNamespace,
   hasMemoryForResult,
@@ -163,7 +163,7 @@ import {
 } from "./chunk-OH7QLI6W.js";
 import {
   ExtractionEngine
-} from "./chunk-G4T7L557.js";
+} from "./chunk-XKAR4RF6.js";
 import {
   parseMemoryActionEligibilityContext
 } from "./chunk-WFLBP5GC.js";
@@ -190,7 +190,7 @@ import {
   buildEntityRecallSection,
   entityRecentTranscriptLookbackHours,
   readRecentEntityTranscriptEntries
-} from "./chunk-DZD576ZU.js";
+} from "./chunk-XSV2YDCJ.js";
 import {
   buildEventOrderRecallSection,
   shouldRecallEventOrderEvidence
@@ -207,7 +207,7 @@ import {
 } from "./chunk-YK6BDDHP.js";
 import {
   refreshConvergedNamespaces
-} from "./chunk-C4ZNGVK3.js";
+} from "./chunk-5JKUSBMX.js";
 import {
   formatDaySummaryMemories
 } from "./chunk-RPSYDM6C.js";
@@ -216,7 +216,7 @@ import {
   ensureBuiltInWearableConnectors,
   getWearableConnector,
   listWearableConnectors
-} from "./chunk-JV5YUBIZ.js";
+} from "./chunk-LC3FD4BV.js";
 import {
   normalizeReplaySessionKey
 } from "./chunk-AJVLDJU6.js";
@@ -226,34 +226,34 @@ import {
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-6HPHEFXT.js";
+} from "./chunk-YKZLOPTC.js";
 import {
   ThreadingManager
 } from "./chunk-OJP3N7UK.js";
 import {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
-} from "./chunk-LJS7KUPV.js";
+} from "./chunk-6PZGKGAO.js";
 import {
   searchWorkProductLedgerEntries
 } from "./chunk-WT6UL3UA.js";
 import {
   TranscriptManager
 } from "./chunk-HYQJQGD3.js";
-import {
-  PolicyRuntimeManager
-} from "./chunk-33JBK2XP.js";
 import {
   runNamespaceMaintenanceFanout,
   summarizeNamespaceMaintenanceHealth
-} from "./chunk-4IIFL7GC.js";
+} from "./chunk-CLKBV3Z3.js";
 import {
   NamespaceCatalog,
   planNamespaceMaintenance
-} from "./chunk-RZ4XGKOJ.js";
+} from "./chunk-VYQ4URQB.js";
+import {
+  PolicyRuntimeManager
+} from "./chunk-33JBK2XP.js";
 import {
   searchHarmonicRetrieval
-} from "./chunk-PDDTI7IC.js";
+} from "./chunk-B4T3FQMT.js";
 import {
   isAboveImportanceThreshold,
   scoreImportance
@@ -285,7 +285,7 @@ import {
   materializeAfterSemanticConsolidation,
   parseConsolidationResponse,
   parseOperatorAwareConsolidationResponse
-} from "./chunk-WM65LU67.js";
+} from "./chunk-QOQQMVR2.js";
 import {
   BootstrapEngine
 } from "./chunk-MYVPLJOO.js";
@@ -300,13 +300,13 @@ import {
 } from "./chunk-UQ7RN5HK.js";
 import {
   SmartBuffer
-} from "./chunk-HLYR2TQL.js";
+} from "./chunk-CUTFSLSD.js";
 import {
   isDisagreementPrompt
 } from "./chunk-H3FZVNRN.js";
 import {
   detectMeetings
-} from "./chunk-47P3RYZP.js";
+} from "./chunk-2INWPC6E.js";
 import {
   compileCorrectionRule,
   correctionsFilePath,
@@ -331,7 +331,7 @@ import {
 } from "./chunk-KD3QD3A5.js";
 import {
   MeetingsInputError
-} from "./chunk-QWGE2PUH.js";
+} from "./chunk-DDA55IVB.js";
 import {
   WearablesInputError,
   describeErrorForOperator
@@ -352,13 +352,17 @@ import {
   filterRecallCandidates,
   isGenericRecallExcludedPath,
   isTopLevelArchivePath
-} from "./chunk-T2JHZWH6.js";
+} from "./chunk-3WGI7F4V.js";
 import {
   importCapsule
 } from "./chunk-QYN5PXDZ.js";
 import {
   isCodingGraphInstalled
 } from "./chunk-VQ7B2Q6M.js";
+import {
+  listTrustZoneRecords,
+  searchTrustZoneRecords
+} from "./chunk-KQS72GCR.js";
 import {
   applyTrustScoreStage,
   buildTrustSignalsForRerank,
@@ -366,10 +370,6 @@ import {
   trustResultFor,
   trustResultKey
 } from "./chunk-GNVZQ5JN.js";
-import {
-  listTrustZoneRecords,
-  searchTrustZoneRecords
-} from "./chunk-KQS72GCR.js";
 import {
   boundRecallContextComposition,
   composeRecallContext,
@@ -379,7 +379,7 @@ import {
 } from "./chunk-AHVEHR6K.js";
 import {
   buildXraySnapshot
-} from "./chunk-QHFV6VNU.js";
+} from "./chunk-QPAQSG3F.js";
 import {
   objectiveStateStoreOverrideForNamespace,
   searchObjectiveStateSnapshots
@@ -396,25 +396,10 @@ import {
 } from "./chunk-QDW3E4RD.js";
 import {
   shouldSkipImplicitExtraction
-} from "./chunk-RUMNY5DT.js";
-import {
-  NamespaceSearchRouter,
-  namespaceCollectionName
-} from "./chunk-VMMQDEN5.js";
-import {
-  createConversationIndexRuntime,
-  createSearchBackend,
-  isSearchBackendEnabled
-} from "./chunk-AZM4CCAC.js";
-import {
-  NoopSearchBackend
-} from "./chunk-CYEPCZN5.js";
+} from "./chunk-MRGJZ75M.js";
 import {
   NamespaceStorageRouter
-} from "./chunk-WDBX6VER.js";
-import {
-  writeConversationChunks
-} from "./chunk-72A4L5JJ.js";
+} from "./chunk-VZRFGJCH.js";
 import {
   searchCausalTrajectories
 } from "./chunk-AHZOMHWN.js";
@@ -423,7 +408,7 @@ import {
 } from "./chunk-BIJAWZYW.js";
 import {
   buildChainFollowupGenerator
-} from "./chunk-JDZPNCMA.js";
+} from "./chunk-UYOXFFEY.js";
 import {
   QmdResultResolver,
   StorageManager,
@@ -442,7 +427,7 @@ import {
   reconstructFusionInputs,
   selfDeps,
   serializeFusionDay
-} from "./chunk-6R4G7N4S.js";
+} from "./chunk-QQXWFDRD.js";
 import {
   bodyIsEscaped,
   decodeTranscriptBody,
@@ -456,6 +441,21 @@ import {
 import {
   buildRetiredFactTombstoneInputs
 } from "./chunk-MLPTFODV.js";
+import {
+  NamespaceSearchRouter,
+  namespaceCollectionName
+} from "./chunk-DN2IDKI5.js";
+import {
+  createConversationIndexRuntime,
+  createSearchBackend,
+  isSearchBackendEnabled
+} from "./chunk-UWJNKGBA.js";
+import {
+  NoopSearchBackend
+} from "./chunk-CYEPCZN5.js";
+import {
+  writeConversationChunks
+} from "./chunk-72A4L5JJ.js";
 import {
   canRecallToolScopedMemory,
   shouldPromoteGlobalFactToShared,
@@ -463,7 +463,7 @@ import {
 } from "./chunk-S2V7RUCL.js";
 import {
   confidenceTier
-} from "./chunk-UU3G6GUP.js";
+} from "./chunk-BIF4SHMD.js";
 import {
   lintWorkspaceFiles,
   rotateMarkdownFileToArchive
@@ -554,7 +554,7 @@ import {
   throwIfRecallAborted,
   tokenizeRecallQuery,
   utcDateKeysForLocalDay
-} from "./chunk-ZMYDYNI4.js";
+} from "./chunk-N7CXQ5TA.js";
 import {
   inferIntentFromText,
   intentCompatibilityScore,
@@ -597,17 +597,12 @@ import {
   getConfiguredNamespaces,
   resolveNamespaceFromStorageDir,
   resolveScopePlan
-} from "./chunk-YN6ASZUG.js";
+} from "./chunk-6QPI2ITJ.js";
 import {
   attachCitation,
   hasCitationForTemplate,
   stripCitationForTemplate
 } from "./chunk-J6A3CX5N.js";
-import {
-  namespaceIdentityFromToken,
-  namespaceIdentityToken,
-  normalizeNamespaceIdentity
-} from "./chunk-EGGE52UU.js";
 import {
   assertPathInsideRoot
 } from "./chunk-GCASGYIO.js";
@@ -619,6 +614,34 @@ import {
 import {
   ContentHashIndex
 } from "./chunk-CX5SW2EW.js";
+import {
+  serializeMutations,
+  withHeldFileLock
+} from "./chunk-FFAZ2XFU.js";
+import {
+  SUPPORT_PASSPORT_ATTRIBUTE_KEYS,
+  SUPPORT_PASSPORT_CARD_TAG,
+  SupportPassportCardCategorySchema,
+  SupportPassportCardListSchema,
+  SupportPassportCardMutationInputSchema,
+  SupportPassportListCardsInputSchema,
+  SupportPassportManualDraftInputSchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportNamespaceSchema,
+  SupportPassportReplaceCardInputSchema,
+  computeSupportPassportCardRevision,
+  computeSupportPassportOwnerKey,
+  decodeSupportPassportNamespaceAttributes,
+  encodeSupportPassportNamespaceAttributes,
+  excludeSupportPassportPrivateMemories,
+  isSupportPassportPrivateMemory,
+  projectSupportPassportCard
+} from "./chunk-HNDIND7P.js";
+import {
+  namespaceIdentityFromToken,
+  namespaceIdentityToken,
+  normalizeNamespaceIdentity
+} from "./chunk-EGGE52UU.js";
 import {
   normalizeAttributePairs,
   stripAttributesSuffix
@@ -636,6 +659,9 @@ import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot
 } from "./chunk-GCGJW34D.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   canReadNamespace,
   defaultNamespaceForPrincipal,
@@ -811,23 +837,12 @@ var TierMigrationCoordinator = class {
     );
     this.inFlight = true;
     try {
-      const coldStorage = this.deps.createColdStorage(
-        path.join(storage.dir, "cold")
-      );
-      const [hotMemories, coldMemories] = await Promise.all([
-        storage.readAllMemories(),
-        coldStorage.readAllMemories()
-      ]);
+      const coldStorage = this.deps.createColdStorage(path.join(storage.dir, "cold"));
+      const [hotMemories, coldMemories] = await Promise.all([storage.readAllMemories(), coldStorage.readAllMemories()]);
       const now = /* @__PURE__ */ new Date();
       const scanLimit = Math.max(0, Math.floor(budget.scanLimit));
-      const hotScanLimit = Math.min(
-        hotMemories.length,
-        Math.ceil(scanLimit * 0.75)
-      );
-      const coldScanLimit = Math.min(
-        coldMemories.length,
-        Math.max(0, scanLimit - hotScanLimit)
-      );
+      const hotScanLimit = Math.min(hotMemories.length, Math.ceil(scanLimit * 0.75));
+      const coldScanLimit = Math.min(coldMemories.length, Math.max(0, scanLimit - hotScanLimit));
       const toTimestamp = (memory) => Date.parse(memory.frontmatter.updated ?? memory.frontmatter.created);
       const hotCandidates = hotMemories.map((memory) => ({ memory, tier: "hot" })).sort((a, b) => toTimestamp(a.memory) - toTimestamp(b.memory)).slice(0, hotScanLimit);
       const coldCandidates = coldMemories.map((memory) => ({ memory, tier: "cold" })).sort((a, b) => toTimestamp(b.memory) - toTimestamp(a.memory)).slice(0, coldScanLimit);
@@ -844,12 +859,7 @@ var TierMigrationCoordinator = class {
       let demoted = 0;
       for (const candidate of candidates) {
         if (migrated >= limit) break;
-        const decision = decideTierTransition(
-          candidate.memory,
-          candidate.tier,
-          policy,
-          now
-        );
+        const decision = decideTierTransition(candidate.memory, candidate.tier, policy, now);
         if (!decision.changed) continue;
         if (!dryRun) {
           const res = await migration.migrateMemory({
@@ -1067,7 +1077,7 @@ var SemanticConsolidationCoordinator = class {
       return result;
     }
     log.info("[semantic-consolidation] starting run");
-    const allMemories = await targetStorage.readAllMemories();
+    const allMemories = excludeSupportPassportPrivateMemories(await targetStorage.readAllMemories());
     if (allMemories.length < 10) {
       log.debug("[semantic-consolidation] too few memories, skipping");
       return result;
@@ -1415,7 +1425,7 @@ var LifecyclePolicyCoordinator = class {
       protectedCategories: this.config.lifecycleProtectedCategories
     };
     const actionPriors = await this.buildLifecycleActionPriors(storage);
-    for (const memory of allMemories) {
+    for (const memory of excludeSupportPassportPrivateMemories(allMemories)) {
       if (memory.frontmatter.status === "superseded" || memory.frontmatter.status === "forgotten") {
         continue;
       }
@@ -2226,7 +2236,7 @@ var RecallRerankCoordinator = class _RecallRerankCoordinator {
       namespaces,
       {
         readNamespaceMemories: async (ns) => (await this.getStorage(ns)).readAllMemories(),
-        readMemoryFrontmatter: async (path35, preferredNamespace) => {
+        readMemoryFrontmatter: async (path38, preferredNamespace) => {
           if (!fallbackReader) {
             for (const ns of namespaces) {
               try {
@@ -2238,7 +2248,7 @@ var RecallRerankCoordinator = class _RecallRerankCoordinator {
           }
           if (!fallbackReader) return null;
           const memory = await this.readQmdResultMemory(
-            path35,
+            path38,
             fallbackReader,
             namespaces,
             preferredNamespace
@@ -3107,6 +3117,7 @@ var ContradictionLinkingCoordinator = class {
         const resultStorage2 = await this.storageForNamespace(resultNamespace);
         const existingMemory = await resultStorage2.getMemoryById(memoryId);
         if (!existingMemory) continue;
+        if (isSupportPassportPrivateMemory(existingMemory)) continue;
         if (inferLocalizationMemoryStatus(existingMemory, resultStorage2.dir) !== "active") continue;
         const verification = await this.getExtraction().verifyContradiction(
           { content, category },
@@ -3156,6 +3167,9 @@ var ContradictionLinkingCoordinator = class {
       ]);
       anchorSnapshot = mergeMemorySnapshots(hot, cold, resultStorage.dir);
     }
+    anchorSnapshot = anchorSnapshot?.filter(
+      (memory) => !isSupportPassportPrivateMemory(memory)
+    );
     const anchorMemoryById = anchorSnapshot ? new Map(anchorSnapshot.map((memory) => [memory.frontmatter.id, memory])) : void 0;
     const candidates = await localizeUpdateCandidates(
       {
@@ -3182,7 +3196,7 @@ var ContradictionLinkingCoordinator = class {
             if (!memoryId) continue;
             if (this.namespaceFromPath(result.path) !== namespaceScope) continue;
             const existingMemory = anchorMemoryById?.get(memoryId) ?? await resultStorage.getMemoryById(memoryId);
-            if (!existingMemory || inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
+            if (!existingMemory || isSupportPassportPrivateMemory(existingMemory) || inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
             hits.push({
               id: memoryId,
               content: existingMemory.content,
@@ -3203,7 +3217,7 @@ var ContradictionLinkingCoordinator = class {
     );
     for (const candidate of candidates) {
       const existingMemory = anchorMemoryById?.get(candidate.id) ?? await resultStorage.getMemoryById(candidate.id);
-      if (!existingMemory || inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
+      if (!existingMemory || isSupportPassportPrivateMemory(existingMemory) || inferLocalizationMemoryStatus(existingMemory, resultStorage.dir) !== "active") continue;
       const verification = await this.getExtraction().verifyContradiction(
         { content, category },
         {
@@ -3949,7 +3963,7 @@ var ConsolidationRunCoordinator = class {
       await this.deps.flushAccessTracking();
     }
     await this.pruneHarmonicStores(storage);
-    let allMemories = await storage.readAllMemories();
+    let allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
     if (allMemories.length < 5) {
       return { memoriesProcessed: allMemories.length, merged, invalidated };
     }
@@ -4228,7 +4242,7 @@ var ConsolidationRunCoordinator = class {
       const deepSleepStartedAt = (/* @__PURE__ */ new Date()).toISOString();
       const tierMigration = await this.deps.tierMigrationCoordinator.runCycle(storage, "maintenance");
       if (tierMigration.migrated > 0) memoryItemMutated = true;
-      allMemories = await storage.readAllMemories();
+      allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
       if (resolveRecallEnhancementCapabilities(config).factArchival) {
         const archived = await this.deps.lifecyclePolicyCoordinator.runFactArchival(allMemories);
         if (archived > 0) {
@@ -4248,7 +4262,7 @@ var ConsolidationRunCoordinator = class {
     } catch (err) {
       log.warn(`deep-sleep maintenance pass failed (ignored): ${err}`);
       try {
-        allMemories = await storage.readAllMemories();
+        allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
       } catch (readErr) {
         log.warn(`deep-sleep maintenance recovery read failed: ${readErr}`);
         throw err;
@@ -4282,7 +4296,7 @@ var ConsolidationRunCoordinator = class {
           const semResult = await this.deps.semanticConsolidationCoordinator.runSemanticConsolidation();
           let remItemsProcessed = allMemories.length;
           try {
-            allMemories = await storage.readAllMemories();
+            allMemories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
             remItemsProcessed = allMemories.length;
           } catch (err) {
             log.warn(
@@ -13158,6 +13172,7 @@ var RecallSearchPipelineCoordinator = class {
     let forgottenFilteredCount = 0;
     let blockedPathFilteredCount = 0;
     let connectorPartitionFilteredCount = 0;
+    let supportPassportFilteredCount = 0;
     const filtered = [];
     for (const r of results) {
       if (options?.blockedPaths && resultHasKey(options.blockedPaths, r)) {
@@ -13177,6 +13192,10 @@ var RecallSearchPipelineCoordinator = class {
           forgottenFilteredCount += 1;
           continue;
         }
+        if (isSupportPassportPrivateMemory(memory)) {
+          supportPassportFilteredCount += 1;
+          continue;
+        }
         if (options?.allowLifecycleFiltered !== true && shouldFilterLifecycleRecallCandidate(memory.frontmatter, {
           lifecyclePolicyEnabled: lifecycleCaps.lifecyclePolicy,
           lifecycleFilterStaleEnabled: lifecycleCaps.lifecycleFilterStale
@@ -13228,6 +13247,11 @@ var RecallSearchPipelineCoordinator = class {
         `connector partition filter removed ${connectorPartitionFilteredCount} tool-scoped candidates from recall`
       );
     }
+    if (supportPassportFilteredCount > 0) {
+      log.debug(
+        `support passport filter removed ${supportPassportFilteredCount} owner-controlled records from generic recall`
+      );
+    }
     if (lifecycleFilteredCount > 0) {
       log.debug(
         `lifecycle retrieval filter removed ${lifecycleFilteredCount} stale/archived candidates`
@@ -15019,7 +15043,7 @@ var OrchestratorInitCoordinator = class {
     if (signal.aborted) return;
     if (lifecycleCaps.lifecyclePolicy && resolveQmdCapabilities(this.deps.config).qmdTierMigration) {
       try {
-        const { runFirstStartMigration } = await import("./first-start-migration-626C5554.js");
+        const { runFirstStartMigration } = await import("./first-start-migration-LMMZFLKK.js");
         const result = await runFirstStartMigration({
           storage: this.deps.storage,
           config: this.deps.config,
@@ -15560,7 +15584,7 @@ async function runPatternReinforcement(storage, options) {
   if (targetCategories.size === 0) {
     return emptyResult2();
   }
-  const memories = await storage.readAllMemories();
+  const memories = excludeSupportPassportPrivateMemories(await storage.readAllMemories());
   const eligible = memories.filter((m) => {
     if (!targetCategories.has(m.frontmatter.category)) return false;
     const status = m.frontmatter.status ?? ACTIVE_STATUS2;
@@ -15832,6 +15856,7 @@ Install it alongside Remnic:
             const memories = await storage.readAllMemories();
             const support = [];
             for (const memory of memories) {
+              if (isSupportPassportPrivateMemory(memory)) continue;
               const status = inferMemoryStatus(
                 memory.frontmatter,
                 memory.path
@@ -17600,36 +17625,13 @@ var WorkspaceOpsCoordinator = class {
             const fullPath = path17.join(dateDir, entry.name);
             try {
               assertPathInsideRoot(memoryRootReal, await realpath2(fullPath), fullPath);
-              const raw = await readFile6(fullPath, "utf-8");
-              const fmMatch = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-              if (!fmMatch) continue;
-              const fmBlock = fmMatch[1];
-              const content = fmMatch[2].trim();
-              const fm = {};
-              for (const line of fmBlock.split("\n")) {
-                const colonIdx = line.indexOf(":");
-                if (colonIdx === -1) continue;
-                fm[line.slice(0, colonIdx).trim()] = line.slice(colonIdx + 1).trim();
-              }
-              const created = fm.created || "unknown";
-              const createdAt = parseFiniteDate(created);
+              const memory = await storage.readMemoryByPath(fullPath);
+              if (!memory || isSupportPassportPrivateMemory(memory)) continue;
+              const createdAt = parseFiniteDate(memory.frontmatter.created);
               if (createdAt && formatDateInTimeZone(createdAt, timeZone) !== targetLocalDate) {
                 continue;
               }
-              facts.push({
-                path: fullPath,
-                frontmatter: {
-                  id: fm.id || path17.basename(entry.name, ".md"),
-                  category: fm.category || "fact",
-                  created,
-                  updated: fm.updated || created,
-                  source: fm.source || "unknown",
-                  confidence: parseFloat(fm.confidence || "0.8"),
-                  confidenceTier: fm.confidenceTier || "implied",
-                  tags: []
-                },
-                content
-              });
+              facts.push(memory);
             } catch {
             }
           }
@@ -19190,6 +19192,13 @@ var Orchestrator = class {
     const ns = typeof namespace === "string" && namespace.trim().length > 0 ? namespace.trim() : this.config.defaultNamespace;
     return this.storageRouter.storageFor(ns);
   }
+  filterPrivateSearchResults = (results, namespaces = [], preserveUnresolved = false, visibilityCache) => this.qmdResultResolver.filterPrivateSearchResults(
+    results,
+    this.storage,
+    namespaces,
+    preserveUnresolved,
+    visibilityCache
+  );
   configuredNamespaceList() {
     return getConfiguredNamespaces(this.config);
   }
@@ -20833,12 +20842,6 @@ ${doc.content}` : doc.content,
       return match ? match[1] : null;
     }).filter((id) => id !== null);
   }
-  // ---------------------------------------------------------------------------
-  // Contradiction Detection (Phase 2B)
-  // ---------------------------------------------------------------------------
-  // ---------------------------------------------------------------------------
-  // Feedback (v2.2)
-  // ---------------------------------------------------------------------------
   async recordMemoryFeedback(memoryId, vote, note) {
     await this.relevance.record(memoryId, vote, note);
   }
@@ -20967,127 +20970,2301 @@ ${doc.content}` : doc.content,
   }
 };
 
-// src/relay/mission-fixture.ts
-var RELAY_DEMO_MISSION_ID = "checkout-token-recovery";
-var RELAY_DEMO_NAMESPACE = "relay-build-week";
-var sourceEvidence = {
-  kind: "source",
-  id: "source-checkout-contract",
-  label: "Checkout token contract",
-  locator: "fixture://checkout-service/src/token-policy.ts",
-  capture: "fixture"
-};
-var testEvidence = {
-  kind: "test",
-  id: "test-checkout-contract",
-  label: "Checkout integration contract",
-  locator: "fixture://checkout-service/test/token-policy.test.ts",
-  capture: "fixture"
-};
-var approvalEvidence = {
-  kind: "approval",
-  id: "approval-build-week-operator",
-  label: "Human approval receipt",
-  locator: "fixture://relay/approvals/correction-token-refresh.json",
-  capture: "fixture"
-};
-var correctionEvidence = {
-  kind: "correction",
-  id: "correction-token-refresh",
-  label: "Applied Remnic correction",
-  locator: "fixture://remnic/corrections/correction-token-refresh.json",
-  capture: "fixture"
+// src/support-passport/errors.ts
+var SupportPassportError = class extends Error {
+  code;
+  status;
+  constructor(code, message, status) {
+    super(message);
+    this.name = "SupportPassportError";
+    this.code = code;
+    this.status = status;
+  }
 };
-function at(second) {
-  return `2026-07-17T18:00:${String(second).padStart(2, "0")}.000Z`;
+
+// src/support-passport/owner-lock.ts
+import { createHash as createHash9 } from "crypto";
+import path21 from "path";
+var CARD_MUTATION_LOCK_STALE_MS = 6e4;
+var CARD_MUTATION_LOCK_MAX_WAIT_MS = 3e4;
+function computeSupportPassportOwnerLockKey(namespace, principal) {
+  return createHash9("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
+}
+function supportPassportOwnerLockPath(storage, scope) {
+  const ownerLockKey = scope.ownerKey ?? computeSupportPassportOwnerLockKey(scope.namespace, scope.principal);
+  if (!/^[a-f0-9]{64}$/.test(ownerLockKey)) {
+    throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
+  }
+  return path21.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
+}
+async function withSupportPassportOwnerLock(storage, scope, task) {
+  const lockPath = supportPassportOwnerLockPath(storage, scope);
+  return await serializeMutations(
+    lockPath,
+    () => withHeldFileLock(
+      lockPath,
+      { staleMs: CARD_MUTATION_LOCK_STALE_MS, maxWaitMs: CARD_MUTATION_LOCK_MAX_WAIT_MS },
+      async (acquired, lock) => {
+        if (!acquired) {
+          throw new SupportPassportError("storage_conflict", "The support passport is busy. Try again.", 409);
+        }
+        return await task(lock);
+      }
+    )
+  );
 }
-function createRelayMissionFixture() {
-  return [
-    {
-      occurredAt: at(0),
-      idempotencyKey: "fixture-001",
-      payload: {
-        kind: "mission_started",
-        title: "The checkout token split",
-        objective: "Resolve a conflicting token refresh policy and prove a cold agent acts on it.",
-        runMode: "fixture",
-        evidence: [sourceEvidence]
+async function requireSupportPassportOwnerLock(lock) {
+  if (await lock.refresh()) return;
+  throw new SupportPassportError("storage_conflict", "The support passport changed during the request.", 409);
+}
+
+// src/support-passport/card-service.ts
+var OWNER_VISIBLE_STATUSES = /* @__PURE__ */ new Set(["pending_review", "active"]);
+var MAX_OWNER_VISIBLE_CARDS = 100;
+function invalidInput() {
+  return new SupportPassportError("invalid_input", "The support card request is invalid.", 400);
+}
+function isStorageConflict(error) {
+  return error instanceof SupportPassportError && error.code === "storage_conflict";
+}
+var SupportPassportCardService = class {
+  resolveOwner;
+  now;
+  constructor(dependencies) {
+    this.resolveOwner = dependencies.resolveOwner;
+    this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async listCards(input) {
+    const parsed = SupportPassportListCardsInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput();
+    const { principal, namespace, storage } = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
+      const stored = await this.readStoredCards(storage, lock, principal, namespace);
+      const cards = this.ownerVisibleCards(stored).sort((a, b) => a.order - b.order || a.card.cardId.localeCompare(b.card.cardId)).map((item) => item.card);
+      const output = SupportPassportCardListSchema.safeParse(cards);
+      if (!output.success) {
+        throw new SupportPassportError("card_data_invalid", "The support card data is invalid.", 500);
+      }
+      return output.data;
+    });
+  }
+  async createManualDraft(input) {
+    const parsed = SupportPassportManualDraftInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput();
+    const { principal, namespace, storage } = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(
+      storage,
+      { namespace, principal },
+      (lock) => this.createDraft(
+        storage,
+        {
+          title: parsed.data.title,
+          statement: parsed.data.statement,
+          category: parsed.data.category,
+          reviewBy: parsed.data.reviewBy,
+          sourceMemoryIds: []
+        },
+        lock,
+        principal,
+        namespace
+      )
+    );
+  }
+  async replaceCard(input) {
+    const parsed = SupportPassportReplaceCardInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput();
+    const { principal, namespace, storage } = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
+      const loadedPrior = await this.requireCard(storage, parsed.data.cardId, namespace, principal);
+      const storedCards = await this.readProjectedCards(storage, namespace, principal);
+      const interruptedReplacements = storedCards.filter(
+        (item) => item.card.status === "pending_review" && (item.replacesDraftId === loadedPrior.card.cardId || item.memory.frontmatter.supersedes === loadedPrior.card.cardId)
+      );
+      if (interruptedReplacements.length > 1) {
+        throw new SupportPassportError(
+          "storage_conflict",
+          "Multiple support card edits already completed. Reload the support passport.",
+          409
+        );
       }
-    },
-    {
-      occurredAt: at(2),
-      idempotencyKey: "fixture-002",
-      payload: {
-        kind: "agent_status",
-        agentId: "agent-atlas",
-        sessionId: "session-atlas",
-        label: "Atlas",
-        role: "Checkout implementation",
-        status: "working",
-        evidence: [sourceEvidence]
+      const [interruptedReplacement] = interruptedReplacements;
+      if (interruptedReplacement) {
+        if (interruptedReplacement.replacedRevision !== parsed.data.expectedRevision) {
+          throw new SupportPassportError("revision_conflict", "The support card changed after it was loaded.", 409);
+        }
+        const matchesRetry = interruptedReplacement.card.title === parsed.data.title && interruptedReplacement.card.statement === parsed.data.statement && interruptedReplacement.card.category === parsed.data.category && interruptedReplacement.card.reviewBy === parsed.data.reviewBy;
+        if (!matchesRetry) {
+          throw new SupportPassportError(
+            "storage_conflict",
+            "A different support card edit already completed. Reload the support passport.",
+            409
+          );
+        }
+        if (!interruptedReplacement.draftReplacementPrepared) return interruptedReplacement.card;
+        const recovered = await this.recoverReplacementTransition(
+          storage,
+          interruptedReplacement.memory,
+          lock,
+          principal,
+          namespace
+        );
+        return this.projectRequiredCard(recovered, namespace, principal).card;
       }
-    },
-    {
-      occurredAt: at(3),
-      idempotencyKey: "fixture-003",
-      payload: {
-        kind: "agent_status",
-        agentId: "agent-nova",
-        sessionId: "session-nova",
-        label: "Nova",
-        role: "Integration verification",
-        status: "working",
-        evidence: [testEvidence]
+      this.requireRevision(loadedPrior, parsed.data.expectedRevision);
+      await this.readStoredCards(storage, lock, principal, namespace);
+      const refreshedPrior = await this.requireCard(storage, parsed.data.cardId, namespace, principal);
+      this.requireRevision(refreshedPrior, parsed.data.expectedRevision);
+      const recoveredMemory = await this.recoverReplacementTransition(
+        storage,
+        refreshedPrior.memory,
+        lock,
+        principal,
+        namespace
+      );
+      const prior = this.projectRequiredCard(recoveredMemory, namespace, principal);
+      if (prior.card.status !== "active" && prior.card.status !== "pending_review") {
+        throw new SupportPassportError(
+          "invalid_card_status",
+          "Only a draft or approved support card can be edited.",
+          409
+        );
       }
-    },
-    {
-      occurredAt: at(6),
-      idempotencyKey: "fixture-004",
-      payload: {
-        kind: "agent_output",
-        agentId: "agent-atlas",
-        sessionId: "session-atlas",
-        outputId: "output-atlas-policy",
-        summary: "Implemented a new token for every checkout retry.",
-        evidence: [
-          {
-            kind: "agent_output",
-            id: "output-atlas-policy",
-            label: "Atlas one-shot output",
-            locator: "fixture://codex/atlas/final-output.txt",
-            capture: "fixture"
-          }
-        ]
+      const replacement = await this.createDraft(
+        storage,
+        {
+          title: parsed.data.title,
+          statement: parsed.data.statement,
+          category: parsed.data.category,
+          reviewBy: parsed.data.reviewBy,
+          sourceMemoryIds: prior.sourceMemoryIds,
+          supersedes: prior.card.status === "active" ? prior.card.cardId : prior.memory.frontmatter.supersedes,
+          replacesDraftId: prior.card.status === "pending_review" ? prior.card.cardId : void 0,
+          replacedRevision: prior.card.revision,
+          order: prior.order,
+          draftReplacementPrepared: prior.card.status === "pending_review"
+        },
+        lock,
+        principal,
+        namespace
+      );
+      if (prior.card.status === "active") return replacement;
+      const replacedAt = this.now().toISOString();
+      await this.requireOwnerLock(lock);
+      const rejected = await storage.writeMemoryFrontmatterIfUnchanged(
+        prior.memory,
+        { status: "rejected", updated: replacedAt },
+        { actor: principal, reasonCode: "owner-replaced-draft" }
+      );
+      if (rejected) {
+        return await this.finishPreparedDraftReplacement(storage, replacement.cardId, lock, principal, namespace);
       }
-    },
-    {
-      occurredAt: at(7),
-      idempotencyKey: "fixture-005",
-      payload: {
-        kind: "belief_observed",
-        agentId: "agent-atlas",
-        sessionId: "session-atlas",
-        beliefId: "belief-new-token-every-request",
-        decisionId: "decision-new-token-every-request",
-        statement: "Mint a new checkout token for every request and retry.",
-        confidence: 0.91,
-        evidence: [
-          {
-            kind: "memory",
-            id: "memory-stale-token-policy",
-            label: "Stale project decision",
-            locator: "fixture://remnic/memories/memory-stale-token-policy.md",
-            capture: "fixture"
-          }
-        ]
+      const currentPrior = await storage.getMemoryById(prior.card.cardId);
+      const currentPriorCard = currentPrior ? this.projectOwnedCard(currentPrior, namespace, principal) : null;
+      if (currentPriorCard?.card.status === "rejected") {
+        return await this.finishPreparedDraftReplacement(storage, replacement.cardId, lock, principal, namespace);
       }
-    },
-    {
-      occurredAt: at(9),
-      idempotencyKey: "fixture-006",
-      payload: {
-        kind: "agent_output",
-        agentId: "agent-nova",
+      await this.rejectCreatedDraft(
+        storage,
+        replacement.cardId,
+        "draft-replacement-failed",
+        lock,
+        principal,
+        namespace
+      );
+      throw new SupportPassportError("storage_conflict", "The support card changed before it was edited.", 409);
+    });
+  }
+  async approveCard(input) {
+    const parsed = SupportPassportCardMutationInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput();
+    const { principal, namespace, storage } = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
+      const loadedCard = await this.requireCard(storage, parsed.data.cardId, namespace, principal);
+      this.requireRevision(loadedCard, parsed.data.expectedRevision);
+      this.requireStatus(loadedCard, "pending_review");
+      const recoveredMemory = await this.recoverReplacementTransition(
+        storage,
+        loadedCard.memory,
+        lock,
+        principal,
+        namespace
+      );
+      const card = this.projectRequiredCard(recoveredMemory, namespace, principal);
+      if (card.card.status === "active") return card.card;
+      if (card.card.status === "rejected") {
+        throw new SupportPassportError(
+          "storage_conflict",
+          "The support card was rejected while its replacement state was recovered.",
+          409
+        );
+      }
+      this.requireStatus(card, "pending_review");
+      await this.validatePriorForReplacement(storage, card, namespace, principal);
+      const updatedAt = this.now().toISOString();
+      await this.requireOwnerLock(lock);
+      let approved;
+      try {
+        approved = await storage.writeMemoryFrontmatterIfUnchanged(
+          card.memory,
+          { status: "active", updated: updatedAt },
+          { actor: principal, reasonCode: "owner-approved" }
+        );
+      } catch (error) {
+        const current = await storage.getMemoryById(card.card.cardId);
+        const currentCard = current ? this.projectOwnedCard(current, namespace, principal) : null;
+        if (currentCard?.card.status === "active") {
+          return await this.finishCommittedApproval(storage, currentCard, lock, principal, namespace);
+        }
+        throw error;
+      }
+      if (!approved) {
+        const current = await storage.getMemoryById(card.card.cardId);
+        const currentCard = current ? this.projectOwnedCard(current, namespace, principal) : null;
+        if (currentCard?.card.status === "active") {
+          return await this.finishCommittedApproval(storage, currentCard, lock, principal, namespace);
+        }
+        throw new SupportPassportError("storage_conflict", "The support card changed before approval.", 409);
+      }
+      const committedCard = {
+        ...card.card,
+        status: "active",
+        updatedAt,
+        revision: this.revisionFor(card.card, "active", updatedAt)
+      };
+      try {
+        const current = await this.requireCard(storage, card.card.cardId, namespace, principal);
+        return await this.finishCommittedApproval(storage, current, lock, principal, namespace);
+      } catch (error) {
+        if (isStorageConflict(error)) throw error;
+        log.warn(
+          `support passport could not finish replacement approval side effects: ${error instanceof Error ? error.message : String(error)}`
+        );
+        return committedCard;
+      }
+    });
+  }
+  async rejectCard(input) {
+    return await this.changeStatus(input, "pending_review", "rejected");
+  }
+  async withdrawCard(input) {
+    return await this.changeStatus(input, "active", "archived");
+  }
+  async createDraft(storage, input, lock, principal, namespace) {
+    const now = this.now();
+    const reviewBy = input.reviewBy ?? now.toISOString();
+    const storedCards = await this.readStoredCards(storage, lock, principal, namespace);
+    const visibleCards = this.ownerVisibleCards(storedCards);
+    const replacesVisibleCard = visibleCards.some(
+      (item) => input.replacesDraftId === item.card.cardId && item.card.status === "pending_review" || input.supersedes === item.card.cardId && item.card.status === "active"
+    );
+    if (visibleCards.length - (replacesVisibleCard ? 1 : 0) >= MAX_OWNER_VISIBLE_CARDS) {
+      throw new SupportPassportError("invalid_input", "A support passport can contain at most 100 visible cards.", 400);
+    }
+    const maximumOrder = storedCards.reduce((maximum, card) => Math.max(maximum, card.order), -1);
+    const order = input.order ?? maximumOrder + 1;
+    if (!Number.isSafeInteger(order)) {
+      throw new SupportPassportError("storage_conflict", "The support card order range is exhausted.", 409);
+    }
+    const envelope = composeMemoryEnvelope(
+      {
+        content: input.statement,
+        category: "preference",
+        tags: [SUPPORT_PASSPORT_CARD_TAG],
+        structuredAttributes: {
+          ...encodeSupportPassportNamespaceAttributes(namespace),
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner]: computeSupportPassportOwnerKey(principal),
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.title]: input.title,
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.category]: input.category,
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.order]: String(order),
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.reviewBy]: reviewBy,
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.sourceMemoryIds]: input.sourceMemoryIds.join(","),
+          ...input.replacesDraftId ? { [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacesDraftId]: input.replacesDraftId } : {},
+          ...input.replacedRevision ? { [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacedRevision]: input.replacedRevision } : {},
+          ...input.draftReplacementPrepared ? { [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.draftReplacementPrepared]: "true" } : {}
+        },
+        sourceReason: "support-passport"
+      },
+      { source: "support-passport", now: this.now }
+    );
+    if (envelope.sanitizeViolations.length > 0) throw invalidInput();
+    await this.requireOwnerLock(lock);
+    const written = await storage.writeSealedMemory(envelope, {
+      actor: principal,
+      status: "pending_review",
+      lineage: input.sourceMemoryIds.length > 0 ? input.sourceMemoryIds : void 0,
+      supersedes: input.supersedes
+    });
+    if (written.tombstoneBlocked) {
+      throw new SupportPassportError("storage_conflict", "The support card needs memory review before use.", 409);
+    }
+    return this.projectRequiredCard(written.memory, namespace, principal).card;
+  }
+  async changeStatus(input, expectedStatus, nextStatus) {
+    const parsed = SupportPassportCardMutationInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput();
+    const { principal, namespace, storage } = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(storage, { namespace, principal }, async (lock) => {
+      let card = await this.requireCard(storage, parsed.data.cardId, namespace, principal);
+      this.requireRevision(card, parsed.data.expectedRevision);
+      this.requireStatus(card, expectedStatus);
+      if (expectedStatus === "pending_review" && nextStatus === "rejected") {
+        await this.rejectPendingReplacementForPredecessor(storage, card, lock, principal, namespace);
+        card = await this.requireCard(storage, card.card.cardId, namespace, principal);
+        this.requireRevision(card, parsed.data.expectedRevision);
+        this.requireStatus(card, expectedStatus);
+      }
+      if (expectedStatus === "pending_review" || expectedStatus === "active" && (card.replacesDraftId || card.memory.frontmatter.supersedes)) {
+        card = this.projectRequiredCard(
+          await this.recoverReplacementTransition(storage, card.memory, lock, principal, namespace, {
+            rollbackConflictedApproval: expectedStatus !== "active"
+          }),
+          namespace,
+          principal
+        );
+      }
+      if (card.card.status === nextStatus) return card.card;
+      this.requireStatus(card, expectedStatus);
+      if (expectedStatus === "active" && nextStatus === "archived") {
+        await this.rejectPendingReplacementForPredecessor(storage, card, lock, principal, namespace);
+        card = await this.requireCard(storage, card.card.cardId, namespace, principal);
+        this.requireRevision(card, parsed.data.expectedRevision);
+        this.requireStatus(card, expectedStatus);
+      }
+      const updatedAt = this.now().toISOString();
+      await this.requireOwnerLock(lock);
+      const changed = await storage.writeMemoryFrontmatterIfUnchanged(
+        card.memory,
+        {
+          status: nextStatus,
+          updated: updatedAt,
+          ...nextStatus === "archived" ? { archivedAt: updatedAt } : {}
+        },
+        { actor: principal, reasonCode: nextStatus === "archived" ? "owner-withdrew" : "owner-rejected" }
+      );
+      if (!changed)
+        throw new SupportPassportError(
+          "storage_conflict",
+          "The support card changed before the request completed.",
+          409
+        );
+      return {
+        ...card.card,
+        status: nextStatus,
+        updatedAt,
+        revision: this.revisionFor(card.card, nextStatus, updatedAt)
+      };
+    });
+  }
+  revisionFor(card, status, updatedAt) {
+    return computeSupportPassportCardRevision({
+      cardId: card.cardId,
+      title: card.title,
+      statement: card.statement,
+      category: card.category,
+      status,
+      updatedAt,
+      reviewBy: card.reviewBy
+    });
+  }
+  async resolveOwnerScope(principal) {
+    const requestedPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal });
+    const owner = await this.resolveOwner(principal);
+    const namespace = SupportPassportNamespaceSchema.safeParse(owner.namespace);
+    const ownerPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal: owner.principal });
+    if (!requestedPrincipal.success || !namespace.success || !ownerPrincipal.success || ownerPrincipal.data.principal !== requestedPrincipal.data.principal) {
+      throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
+    }
+    return { ...owner, principal: ownerPrincipal.data.principal, namespace: namespace.data };
+  }
+  async rejectCreatedDraft(storage, cardId, reasonCode, lock, principal, namespace) {
+    try {
+      const current = await this.requireCard(storage, cardId, namespace, principal);
+      await this.requireOwnerLock(lock);
+      const rejected = await storage.writeMemoryFrontmatterIfUnchanged(
+        current.memory,
+        { status: "rejected", updated: this.now().toISOString() },
+        { actor: principal, reasonCode }
+      );
+      if (!rejected) log.warn("support passport could not roll back a replacement draft");
+    } catch (error) {
+      log.warn(
+        `support passport could not roll back a replacement draft: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  async requireCard(storage, cardId, namespace, principal) {
+    const stored = await storage.getMemoryById(cardId);
+    const card = stored ? this.projectOwnedCard(stored, namespace, principal) : null;
+    if (!card) throw new SupportPassportError("card_not_found", "The support card was not found.", 404);
+    return card;
+  }
+  projectRequiredCard(memory, namespace, principal) {
+    const card = projectSupportPassportCard(memory);
+    if (!card) throw new SupportPassportError("card_data_invalid", "The support card data is invalid.", 500);
+    if (card.namespace !== namespace || card.owner !== computeSupportPassportOwnerKey(principal)) {
+      throw new SupportPassportError("card_not_found", "The support card was not found.", 404);
+    }
+    return card;
+  }
+  projectOwnedCard(memory, namespace, principal) {
+    const card = projectSupportPassportCard(memory);
+    return card?.namespace === namespace && card.owner === computeSupportPassportOwnerKey(principal) ? card : null;
+  }
+  ownsMemory(memory, namespace, principal) {
+    const attributes = memory.frontmatter.structuredAttributes;
+    return attributes !== void 0 && decodeSupportPassportNamespaceAttributes(attributes) === namespace && attributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner] === computeSupportPassportOwnerKey(principal);
+  }
+  async readProjectedCards(storage, namespace, principal) {
+    const owner = computeSupportPassportOwnerKey(principal);
+    const projected = (await storage.readAllMemories()).map(projectSupportPassportCard).filter((card) => card?.namespace === namespace && card.owner === owner);
+    const ids = /* @__PURE__ */ new Set();
+    for (const item of projected) {
+      if (ids.has(item.card.cardId)) {
+        throw new SupportPassportError("card_data_invalid", "Support card IDs must be unique.", 500);
+      }
+      ids.add(item.card.cardId);
+    }
+    return projected;
+  }
+  requireRevision(card, expectedRevision) {
+    if (card.card.revision !== expectedRevision) {
+      throw new SupportPassportError("revision_conflict", "The support card changed after it was loaded.", 409);
+    }
+  }
+  requireStatus(card, status) {
+    if (card.card.status !== status) {
+      throw new SupportPassportError("invalid_card_status", `The support card must have status ${status}.`, 409);
+    }
+  }
+  async readStoredCards(storage, lock, principal, namespace) {
+    const initialVersion = storage.getCorpusScanVersion();
+    const initial = await storage.readAllMemories();
+    for (const memory of initial) {
+      const card = this.projectOwnedCard(memory, namespace, principal);
+      if (card) await this.recoverReplacementTransition(storage, memory, lock, principal, namespace);
+    }
+    const memories = storage.getCorpusScanVersion() === initialVersion ? initial : await storage.readAllMemories();
+    const owner = computeSupportPassportOwnerKey(principal);
+    const projected = memories.map(projectSupportPassportCard).filter((card) => card?.namespace === namespace && card.owner === owner);
+    const ids = /* @__PURE__ */ new Set();
+    for (const item of projected) {
+      if (ids.has(item.card.cardId)) {
+        throw new SupportPassportError("card_data_invalid", "Support card IDs must be unique.", 500);
+      }
+      ids.add(item.card.cardId);
+    }
+    return projected;
+  }
+  ownerVisibleCards(storedCards) {
+    const visibleCards = storedCards.filter(
+      (item) => OWNER_VISIBLE_STATUSES.has(item.card.status) && !item.draftReplacementPrepared
+    );
+    if (visibleCards.length <= MAX_OWNER_VISIBLE_CARDS) return visibleCards;
+    const activeCardsWithPendingReplacements = new Set(
+      visibleCards.filter((item) => item.card.status === "pending_review").map((item) => item.memory.frontmatter.supersedes).filter((cardId) => typeof cardId === "string")
+    );
+    return visibleCards.filter(
+      (item) => item.card.status !== "active" || !activeCardsWithPendingReplacements.has(item.card.cardId)
+    );
+  }
+  async preparePriorForReplacement(storage, replacement, lock, principal, namespace) {
+    const priorId = replacement.memory.frontmatter.supersedes;
+    if (!priorId) return null;
+    const priorMemory = await storage.getMemoryById(priorId);
+    const priorIsOwned = priorMemory ? this.ownsMemory(priorMemory, namespace, principal) : false;
+    const alreadyRetired = priorIsOwned && priorMemory?.frontmatter.status === "superseded" && priorMemory.frontmatter.supersededBy === replacement.card.cardId;
+    const prior = priorMemory && priorIsOwned && !alreadyRetired ? projectSupportPassportCard(priorMemory) : null;
+    if (prior?.card.status === "rejected") return null;
+    if (!priorMemory || !alreadyRetired && prior?.card.status !== "active") {
+      throw new SupportPassportError("storage_conflict", "The prior support card changed before replacement.", 409);
+    }
+    if (alreadyRetired) return priorId;
+    const retiredAt = this.now().toISOString();
+    await this.requireOwnerLock(lock);
+    const retired = await storage.writeMemoryFrontmatterIfUnchanged(
+      priorMemory,
+      {
+        status: "superseded",
+        supersededBy: replacement.card.cardId,
+        supersededAt: retiredAt,
+        supersessionCause: "direct",
+        updated: retiredAt
+      },
+      {
+        actor: principal,
+        reasonCode: "support-passport-replacement-pending",
+        relatedMemoryIds: [replacement.card.cardId]
+      }
+    );
+    if (!retired) {
+      throw new SupportPassportError("storage_conflict", "The prior support card changed before replacement.", 409);
+    }
+    return priorId;
+  }
+  async rejectPendingReplacementForPredecessor(storage, predecessor, lock, principal, namespace) {
+    const storedCards = predecessor.card.status === "active" ? await this.readStoredCards(storage, lock, principal, namespace) : await this.readProjectedCards(storage, namespace, principal);
+    const replacements = storedCards.filter((item) => {
+      if (item.card.status !== "pending_review") return false;
+      return predecessor.card.status === "pending_review" ? item.replacesDraftId === predecessor.card.cardId : item.memory.frontmatter.supersedes === predecessor.card.cardId;
+    });
+    if (replacements.length > 1) {
+      throw new SupportPassportError(
+        "storage_conflict",
+        "Multiple support card edits target the card being withdrawn.",
+        409
+      );
+    }
+    const [replacement] = replacements;
+    if (!replacement) return;
+    await this.requireOwnerLock(lock);
+    const rejected = await storage.writeMemoryFrontmatterIfUnchanged(
+      replacement.memory,
+      { status: "rejected", updated: this.now().toISOString() },
+      {
+        actor: principal,
+        reasonCode: predecessor.card.status === "pending_review" ? "source-draft-rejected" : "predecessor-withdrawn"
+      }
+    );
+    if (rejected) return;
+    const current = await storage.getMemoryById(replacement.card.cardId);
+    const currentCard = current ? this.projectOwnedCard(current, namespace, principal) : null;
+    if (currentCard?.card.status !== "rejected") {
+      throw new SupportPassportError("storage_conflict", "The pending support card edit could not be cancelled.", 409);
+    }
+  }
+  async validatePriorForReplacement(storage, replacement, namespace, principal) {
+    const priorId = replacement.memory.frontmatter.supersedes;
+    if (!priorId) return;
+    const priorMemory = await storage.getMemoryById(priorId);
+    const priorIsOwned = priorMemory ? this.ownsMemory(priorMemory, namespace, principal) : false;
+    const alreadyRetired = priorIsOwned && priorMemory?.frontmatter.status === "superseded" && priorMemory.frontmatter.supersededBy === replacement.card.cardId;
+    const prior = priorMemory && priorIsOwned && !alreadyRetired ? projectSupportPassportCard(priorMemory) : null;
+    if (prior?.card.status === "rejected" || alreadyRetired) return;
+    if (!priorMemory || prior?.card.status !== "active") {
+      throw new SupportPassportError("storage_conflict", "The prior support card changed before replacement.", 409);
+    }
+  }
+  async recoverReplacementTransition(storage, memory, lock, principal, namespace, options = {}) {
+    const replacement = this.projectOwnedCard(memory, namespace, principal);
+    if (replacement?.card.status !== "pending_review" && replacement?.card.status !== "active") return memory;
+    if (!replacement.replacesDraftId && !memory.frontmatter.supersedes) return memory;
+    if (replacement.card.status === "active" && memory.frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacementComplete] === "true") {
+      return memory;
+    }
+    await this.recoverReplacedDraft(storage, replacement, lock, principal, namespace);
+    const currentMemory = await storage.getMemoryById(replacement.card.cardId) ?? memory;
+    const currentCard = this.projectOwnedCard(currentMemory, namespace, principal);
+    if (currentCard?.card.status !== "pending_review" && currentCard?.card.status !== "active") {
+      return currentMemory;
+    }
+    if (currentCard.card.status === "pending_review") {
+      const priorId = currentMemory.frontmatter.supersedes;
+      if (!priorId) return currentMemory;
+      const prior = await storage.getMemoryById(priorId);
+      if (prior && this.ownsMemory(prior, namespace, principal) && prior.frontmatter.status === "superseded" && prior.frontmatter.supersededBy === replacement.card.cardId) {
+        await this.restorePriorAfterApprovalFailure(
+          storage,
+          priorId,
+          replacement.card.cardId,
+          lock,
+          principal,
+          namespace
+        );
+      }
+      return await storage.getMemoryById(replacement.card.cardId) ?? currentMemory;
+    }
+    try {
+      await this.completeReplacementAfterActivation(storage, currentCard, lock, principal, namespace);
+    } catch (error) {
+      if (!isStorageConflict(error)) throw error;
+      if (options.rollbackConflictedApproval === false) throw error;
+      await this.rollbackConflictedApproval(storage, currentCard.card.cardId, lock, principal, namespace);
+    }
+    return await storage.getMemoryById(replacement.card.cardId) ?? currentMemory;
+  }
+  async completeReplacementAfterActivation(storage, replacement, lock, principal, namespace) {
+    const priorId = await this.preparePriorForReplacement(storage, replacement, lock, principal, namespace);
+    if (priorId && !await this.completePriorRetirement(storage, priorId, replacement, lock, principal, namespace)) {
+      throw new SupportPassportError("storage_conflict", "The prior support card changed before replacement.", 409);
+    }
+    await this.markReplacementComplete(storage, replacement.card.cardId, lock, principal, namespace);
+  }
+  async finishCommittedApproval(storage, replacement, lock, principal, namespace) {
+    try {
+      if (replacement.replacesDraftId || replacement.memory.frontmatter.supersedes) {
+        await this.completeReplacementAfterActivation(storage, replacement, lock, principal, namespace);
+      }
+    } catch (error) {
+      if (isStorageConflict(error)) {
+        await this.rollbackConflictedApproval(storage, replacement.card.cardId, lock, principal, namespace);
+        throw error;
+      }
+      log.warn(
+        `support passport could not finish replacement approval side effects: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+    return replacement.card;
+  }
+  async rollbackConflictedApproval(storage, replacementId, lock, principal, namespace) {
+    const replacement = await this.requireCard(storage, replacementId, namespace, principal);
+    if (replacement.card.status !== "active") return;
+    await this.requireOwnerLock(lock);
+    const rolledBack = await storage.writeMemoryFrontmatterIfUnchanged(
+      replacement.memory,
+      { status: "pending_review", updated: this.now().toISOString() },
+      { actor: principal, reasonCode: "replacement-predecessor-conflict" }
+    );
+    if (!rolledBack) {
+      throw new SupportPassportError(
+        "storage_conflict",
+        "The replacement changed while its approval was rolled back.",
+        409
+      );
+    }
+    const priorId = replacement.memory.frontmatter.supersedes;
+    if (priorId) {
+      await this.restorePriorAfterApprovalFailure(storage, priorId, replacementId, lock, principal, namespace);
+    }
+  }
+  async completePriorRetirement(storage, priorId, replacement, lock, principal, namespace) {
+    const replacementId = replacement.card.cardId;
+    const prior = await storage.getMemoryById(priorId);
+    if (!prior || !this.ownsMemory(prior, namespace, principal) || prior.frontmatter.status !== "superseded" || prior.frontmatter.supersededBy !== replacementId) {
+      return false;
+    }
+    await this.requireOwnerLock(lock);
+    const completed = await storage.supersedeMemory(
+      priorId,
+      replacementId,
+      "support-passport-replacement",
+      { supersessionCause: "direct" },
+      {
+        actor: principal,
+        requireActive: true,
+        acceptExactReplay: true,
+        expectedSnapshot: prior,
+        audit: {
+          content: stripAttributesSuffix(prior.content),
+          tags: ["supersession", "auto-resolved", "support-passport-audit"],
+          structuredAttributes: {
+            ...encodeSupportPassportNamespaceAttributes(namespace),
+            [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.owner]: computeSupportPassportOwnerKey(principal)
+          },
+          source: "support-passport"
+        }
+      }
+    );
+    if (!completed) log.warn("support passport could not complete replacement retirement side effects");
+    return completed;
+  }
+  async recoverReplacedDraft(storage, replacement, lock, principal, namespace) {
+    if (!replacement.replacesDraftId) return;
+    const replacedDraft = await storage.getMemoryById(replacement.replacesDraftId);
+    const projectedDraft = replacedDraft ? this.projectOwnedCard(replacedDraft, namespace, principal) : null;
+    if (replacedDraft && projectedDraft?.card.status === "pending_review" && projectedDraft.card.revision === replacement.replacedRevision) {
+      await this.requireOwnerLock(lock);
+      const rejected = await storage.writeMemoryFrontmatterIfUnchanged(
+        replacedDraft,
+        { status: "rejected", updated: this.now().toISOString() },
+        { actor: principal, reasonCode: "complete-draft-replacement" }
+      );
+      if (rejected) {
+        await this.finishPreparedDraftReplacement(storage, replacement.card.cardId, lock, principal, namespace);
+        return;
+      }
+    }
+    const currentDraft = await storage.getMemoryById(replacement.replacesDraftId);
+    if (currentDraft && this.ownsMemory(currentDraft, namespace, principal) && currentDraft.frontmatter.status === "rejected") {
+      await this.finishPreparedDraftReplacement(storage, replacement.card.cardId, lock, principal, namespace);
+      return;
+    }
+    if (currentDraft && this.ownsMemory(currentDraft, namespace, principal) && currentDraft.frontmatter.status === "pending_review") {
+      throw new SupportPassportError("storage_conflict", "The replaced draft changed during recovery.", 409);
+    }
+    await this.rejectOrphanedReplacement(storage, replacement.card.cardId, lock, principal, namespace);
+  }
+  async finishPreparedDraftReplacement(storage, replacementId, lock, principal, namespace) {
+    const replacement = await this.requireCard(storage, replacementId, namespace, principal);
+    if (!replacement.draftReplacementPrepared) return replacement.card;
+    const structuredAttributes = { ...replacement.memory.frontmatter.structuredAttributes };
+    delete structuredAttributes[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.draftReplacementPrepared];
+    await this.requireOwnerLock(lock);
+    const finished = await storage.writeMemoryFrontmatterIfUnchanged(
+      replacement.memory,
+      { structuredAttributes },
+      { actor: principal, reasonCode: "draft-replacement-complete" }
+    );
+    if (finished) {
+      return this.projectRequiredCard(
+        { ...replacement.memory, frontmatter: { ...replacement.memory.frontmatter, structuredAttributes } },
+        namespace,
+        principal
+      ).card;
+    }
+    const current = await this.requireCard(storage, replacementId, namespace, principal);
+    if (!current.draftReplacementPrepared) return current.card;
+    throw new SupportPassportError("storage_conflict", "The support card edit could not be completed.", 409);
+  }
+  async rejectOrphanedReplacement(storage, replacementId, lock, principal, namespace) {
+    const currentReplacement = await this.requireCard(storage, replacementId, namespace, principal);
+    if (currentReplacement.card.status === "rejected") return;
+    this.requireStatus(currentReplacement, "pending_review");
+    await this.requireOwnerLock(lock);
+    const rejected = await storage.writeMemoryFrontmatterIfUnchanged(
+      currentReplacement.memory,
+      { status: "rejected", updated: this.now().toISOString() },
+      { actor: principal, reasonCode: "replaced-draft-approved" }
+    );
+    if (rejected) return;
+    const latest = await storage.getMemoryById(replacementId);
+    if (latest?.frontmatter.status !== "rejected") {
+      throw new SupportPassportError("storage_conflict", "The orphaned replacement could not be rejected.", 409);
+    }
+  }
+  async restorePriorAfterApprovalFailure(storage, priorId, replacementId, lock, principal, namespace) {
+    const replacement = await storage.getMemoryById(replacementId);
+    if (replacement && !this.ownsMemory(replacement, namespace, principal)) {
+      throw new SupportPassportError("storage_conflict", "The replacement support card changed ownership.", 409);
+    }
+    if (replacement?.frontmatter.status === "active") return;
+    const prior = await storage.getMemoryById(priorId);
+    if (prior && !this.ownsMemory(prior, namespace, principal)) {
+      throw new SupportPassportError("storage_conflict", "The prior support card changed ownership.", 409);
+    }
+    if (prior?.frontmatter.status === "active" && prior.frontmatter.supersededBy === void 0) return;
+    if (prior?.frontmatter.status !== "superseded" || prior.frontmatter.supersededBy !== replacementId) {
+      throw new SupportPassportError("storage_conflict", "The prior support card could not be restored.", 409);
+    }
+    await this.requireOwnerLock(lock);
+    const restored = await storage.writeMemoryFrontmatterIfUnchanged(
+      prior,
+      {
+        status: "active",
+        supersededBy: void 0,
+        supersededAt: void 0,
+        supersessionCause: void 0,
+        invalidatedBy: void 0,
+        updated: this.now().toISOString()
+      },
+      { actor: principal, reasonCode: "replacement-activation-failed" }
+    );
+    if (restored) return;
+    const currentPrior = await storage.getMemoryById(priorId);
+    if (currentPrior?.frontmatter.status === "active" && currentPrior.frontmatter.supersededBy === void 0) return;
+    throw new SupportPassportError("storage_conflict", "The prior support card could not be restored.", 409);
+  }
+  async markReplacementComplete(storage, replacementId, lock, principal, namespace) {
+    const replacement = await this.requireCard(storage, replacementId, namespace, principal);
+    if (replacement.memory.frontmatter.structuredAttributes?.[SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacementComplete] === "true") {
+      return;
+    }
+    await this.requireOwnerLock(lock);
+    const marked = await storage.writeMemoryFrontmatterIfUnchanged(
+      replacement.memory,
+      {
+        structuredAttributes: {
+          ...replacement.memory.frontmatter.structuredAttributes,
+          [SUPPORT_PASSPORT_ATTRIBUTE_KEYS.replacementComplete]: "true"
+        }
+      },
+      { actor: principal, reasonCode: "replacement-side-effects-complete" }
+    );
+    if (!marked) log.warn("support passport could not mark replacement side effects complete");
+  }
+  async requireOwnerLock(lock) {
+    if (await lock.refresh()) return;
+    throw new SupportPassportError("storage_conflict", "The support passport lock changed. Try again.", 409);
+  }
+};
+
+// src/support-passport/grant-contracts.ts
+import { z } from "zod";
+var IsoTimestampSchema = z.string().datetime({ offset: true }).refine((value) => parseIsoOffsetTimestamp(value) !== null, "timestamp must be a real date");
+var RevisionSchema = z.string().regex(/^[a-f0-9]{64}$/);
+var GrantIdSchema = z.string().uuid().transform((value) => value.toLowerCase());
+var SupportPassportGrantCardRefSchema = z.object({
+  cardId: SupportPassportMemoryIdSchema,
+  revision: RevisionSchema
+}).strict();
+var SupportPassportGrantStateSchema = z.object({
+  schemaVersion: z.literal(1),
+  stateVersion: z.number().int().positive(),
+  grantId: GrantIdSchema,
+  namespace: SupportPassportNamespaceSchema,
+  principalHash: RevisionSchema,
+  ownerLockKey: RevisionSchema,
+  secretHash: RevisionSchema,
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  createdAt: IsoTimestampSchema,
+  expiresAt: IsoTimestampSchema,
+  revokedAt: IsoTimestampSchema.optional()
+}).strict().superRefine((grant, ctx) => {
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, card] of grant.cards.entries()) {
+    if (ids.has(card.cardId)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card IDs must be unique",
+        path: ["cards", index, "cardId"]
+      });
+    }
+    ids.add(card.cardId);
+  }
+  if (Date.parse(grant.expiresAt) <= Date.parse(grant.createdAt)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "expiresAt must follow createdAt", path: ["expiresAt"] });
+  }
+});
+var SupportPassportCreateGrantInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  expiresAt: IsoTimestampSchema
+}).strict().superRefine((input, ctx) => {
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, card] of input.cards.entries()) {
+    if (ids.has(card.cardId)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "card IDs must be unique",
+        path: ["cards", index, "cardId"]
+      });
+    }
+    ids.add(card.cardId);
+  }
+});
+var SupportPassportOwnerGrantSchema = z.object({
+  grantId: GrantIdSchema,
+  stateVersion: z.number().int().positive(),
+  cards: z.array(SupportPassportGrantCardRefSchema).min(1).max(8),
+  createdAt: IsoTimestampSchema,
+  expiresAt: IsoTimestampSchema,
+  revokedAt: IsoTimestampSchema.optional(),
+  status: z.enum(["active", "expired", "revoked"])
+}).strict();
+var SupportPassportCreatedGrantSchema = z.object({
+  grant: SupportPassportOwnerGrantSchema,
+  secret: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+}).strict();
+var SupportPassportPublicCardSchema = z.object({
+  cardId: SupportPassportMemoryIdSchema,
+  title: z.string().trim().min(1).max(80),
+  statement: z.string().trim().min(1).max(500),
+  category: SupportPassportCardCategorySchema,
+  updatedAt: IsoTimestampSchema
+}).strict();
+var SupportPassportPublicGuideSchema = z.object({
+  schemaVersion: z.literal(1),
+  grantId: GrantIdSchema,
+  expiresAt: IsoTimestampSchema,
+  updatedAt: IsoTimestampSchema,
+  cards: z.array(SupportPassportPublicCardSchema).min(1).max(8)
+}).strict();
+var SupportPassportRevokeGrantInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512),
+  grantId: GrantIdSchema,
+  expectedStateVersion: z.number().int().positive().optional()
+}).strict();
+var SupportPassportListGrantsInputSchema = z.object({
+  principal: z.string().trim().min(1).max(512)
+}).strict();
+
+// src/support-passport/grant-store.ts
+import { createHash as createHash10, randomBytes as randomBytes3, randomUUID as randomUUID3, timingSafeEqual } from "crypto";
+import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
+import path23 from "path";
+
+// src/support-passport/private-file.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { constants as fsConstants } from "fs";
+import { lstat as lstat3, mkdir as mkdir7, open, rename, rm, stat as stat4 } from "fs/promises";
+import path22 from "path";
+var UNSUPPORTED_DIRECTORY_SYNC_ERRORS = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
+var NON_WRITABLE_ANCESTOR_SYNC_ERRORS = /* @__PURE__ */ new Set(["EROFS", "EPERM", "EACCES"]);
+function assertStableDirectory(before, opened, after, errorMessage) {
+  if (before.isSymbolicLink() || !before.isDirectory() || after.isSymbolicLink() || !after.isDirectory() || before.dev !== opened.dev || before.ino !== opened.ino || after.dev !== opened.dev || after.ino !== opened.ino) {
+    throw new Error(errorMessage);
+  }
+}
+function assertStableRegularFile(before, opened, after, errorMessage) {
+  if (before.isSymbolicLink() || !before.isFile() || after.isSymbolicLink() || !after.isFile() || before.dev !== opened.dev || before.ino !== opened.ino || after.dev !== opened.dev || after.ino !== opened.ino || opened.nlink !== 1) {
+    throw new Error(errorMessage);
+  }
+}
+function openFlags(...flags) {
+  let combined = 0;
+  for (const flag of flags) combined |= typeof flag === "number" ? flag : 0;
+  return combined;
+}
+function assertContainedPath(trustedRoot, directory, errorMessage) {
+  const relative = path22.relative(path22.resolve(trustedRoot), path22.resolve(directory));
+  if (relative === ".." || relative.startsWith(`..${path22.sep}`) || path22.isAbsolute(relative)) {
+    throw new Error(errorMessage);
+  }
+}
+async function openDirectoryNoFollow(directory, errorMessage) {
+  const before = await lstat3(directory);
+  if (before.isSymbolicLink() || !before.isDirectory()) throw new Error(errorMessage);
+  const handle = await open(
+    directory,
+    openFlags(fsConstants.O_RDONLY, fsConstants.O_DIRECTORY, fsConstants.O_NOFOLLOW)
+  );
+  try {
+    const opened = await handle.stat();
+    assertStableDirectory(before, opened, await lstat3(directory), errorMessage);
+    return { before, opened, handle };
+  } catch (error) {
+    await handle.close().catch(() => void 0);
+    throw error;
+  }
+}
+async function closeDirectoryHandles(handles) {
+  for (const handle of handles.reverse()) await handle.close().catch(() => void 0);
+}
+async function syncDirectoryHandle(handle) {
+  try {
+    await handle.sync();
+  } catch (error) {
+    const code = error.code;
+    if (!UNSUPPORTED_DIRECTORY_SYNC_ERRORS.has(code ?? "")) throw error;
+  }
+}
+async function resolvePrivateDirectoryPath(directory, handle, opened, errorMessage, platform = process.platform) {
+  const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
+  const pinnedPath = path22.join(descriptorRoot, String(handle.fd));
+  const metadata = await stat4(pinnedPath);
+  if (!metadata.isDirectory() || metadata.dev !== opened.dev || metadata.ino !== opened.ino) {
+    throw new Error(errorMessage);
+  }
+  return pinnedPath;
+}
+function requirePrivateFileDescriptorRoot(platform, errorMessage) {
+  if (platform === "linux") return "/proc/self/fd";
+  if (platform === "darwin" || platform === "freebsd" || platform === "openbsd") return "/dev/fd";
+  throw new Error(errorMessage);
+}
+async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform = process.platform) {
+  const root = path22.resolve(trustedRoot);
+  const target = path22.resolve(directory);
+  assertContainedPath(root, target, errorMessage);
+  requirePrivateFileDescriptorRoot(platform, errorMessage);
+  const relative = path22.relative(root, target);
+  const components = relative === "" ? [] : relative.split(path22.sep);
+  const handles = [];
+  let currentPath = root;
+  try {
+    let current = await openDirectoryNoFollow(root, errorMessage);
+    handles.push(current.handle);
+    for (const component of components) {
+      const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
+      const child = await openDirectoryNoFollow(path22.join(pinnedParent, component), errorMessage);
+      handles.push(child.handle);
+      assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
+      currentPath = path22.join(currentPath, component);
+      current = child;
+    }
+    assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
+    return {
+      ...current,
+      handles,
+      pinnedDirectory: await resolvePrivateDirectoryPath(
+        target,
+        current.handle,
+        current.opened,
+        errorMessage,
+        platform
+      )
+    };
+  } catch (error) {
+    await closeDirectoryHandles(handles);
+    throw error;
+  }
+}
+async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, hardenExistingChildren = true, platform = process.platform) {
+  const root = path22.resolve(trustedRoot);
+  const target = path22.resolve(directory);
+  assertContainedPath(root, target, errorMessage);
+  const relative = path22.relative(root, target);
+  requirePrivateFileDescriptorRoot(platform, errorMessage);
+  const components = relative === "" ? [] : relative.split(path22.sep);
+  const handles = [];
+  let currentPath = root;
+  try {
+    let current = await openDirectoryNoFollow(root, errorMessage);
+    handles.push(current.handle);
+    for (const component of components) {
+      const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
+      const childPath = path22.join(pinnedParent, component);
+      let created = false;
+      try {
+        await mkdir7(childPath, { mode: 448 });
+        created = true;
+      } catch (error) {
+        if (error.code !== "EEXIST") throw error;
+      }
+      await syncVerifiedParent(current.handle);
+      const child = await openDirectoryNoFollow(childPath, errorMessage);
+      handles.push(child.handle);
+      if (created || hardenExistingChildren && (child.opened.mode & 511) !== 448) {
+        await child.handle.chmod(448);
+      }
+      assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
+      currentPath = path22.join(currentPath, component);
+      current = child;
+    }
+    assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
+  } finally {
+    await closeDirectoryHandles(handles);
+  }
+}
+async function ensurePrivateDirectoryTreeNoFollow(directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, platform = process.platform) {
+  const target = path22.resolve(directory);
+  const filesystemRoot = path22.parse(target).root;
+  const rootMetadata = await stat4(filesystemRoot);
+  await ensurePrivateDirectoryNoFollow(
+    filesystemRoot,
+    target,
+    errorMessage,
+    async (handle) => {
+      try {
+        await syncVerifiedParent(handle);
+      } catch (error) {
+        const code = error.code;
+        const metadata = await handle.stat();
+        if (metadata.ino === rootMetadata.ino && metadata.dev === rootMetadata.dev && NON_WRITABLE_ANCESTOR_SYNC_ERRORS.has(code ?? "")) {
+          return;
+        }
+        throw error;
+      }
+    },
+    false,
+    platform
+  );
+}
+async function withPrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, task, platform = process.platform) {
+  let directoryHandles = [];
+  try {
+    const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
+    directoryHandles = stableDirectory.handles;
+    const result = await task(stableDirectory.pinnedDirectory);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    return result;
+  } finally {
+    await closeDirectoryHandles(directoryHandles);
+  }
+}
+async function readPrivateFileNoFollow(directory, filePath, errorMessage, trustedRoot = directory, platform = process.platform) {
+  if (path22.dirname(filePath) !== path22.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path22.basename(filePath);
+  let directoryHandles = [];
+  let fileHandle;
+  try {
+    const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
+    directoryHandles = stableDirectory.handles;
+    const pinnedDirectory = stableDirectory.pinnedDirectory;
+    const targetPath = path22.join(pinnedDirectory, targetName);
+    const before = await lstat3(targetPath);
+    if (before.isSymbolicLink() || !before.isFile()) throw new Error(errorMessage);
+    try {
+      fileHandle = await open(targetPath, openFlags(fsConstants.O_RDONLY, fsConstants.O_NOFOLLOW));
+    } catch (error) {
+      if (error.code === "ELOOP") throw new Error(errorMessage);
+      throw error;
+    }
+    const fileMetadata = await fileHandle.stat();
+    assertStableRegularFile(before, fileMetadata, await lstat3(targetPath), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    return await fileHandle.readFile("utf8");
+  } finally {
+    await fileHandle?.close().catch(() => void 0);
+    await closeDirectoryHandles(directoryHandles);
+  }
+}
+async function writePrivateFileAtomicallyNoFollow(directory, filePath, content, errorMessage, trustedRoot = directory, platform = process.platform) {
+  if (path22.dirname(filePath) !== path22.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path22.basename(filePath);
+  const tempName = `.${targetName}.${randomUUID2()}.tmp`;
+  let tempPath;
+  let directoryHandles = [];
+  let fileHandle;
+  try {
+    const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
+    directoryHandles = stableDirectory.handles;
+    const pinnedDirectory = stableDirectory.pinnedDirectory;
+    tempPath = path22.join(pinnedDirectory, tempName);
+    const targetPath = path22.join(pinnedDirectory, targetName);
+    try {
+      fileHandle = await open(
+        tempPath,
+        openFlags(fsConstants.O_WRONLY, fsConstants.O_CREAT, fsConstants.O_EXCL, fsConstants.O_NOFOLLOW),
+        384
+      );
+    } catch (error) {
+      if (error.code === "ELOOP") throw new Error(errorMessage);
+      throw error;
+    }
+    const fileMetadata = await fileHandle.stat();
+    const tempMetadata = await lstat3(tempPath);
+    assertStableRegularFile(tempMetadata, fileMetadata, await lstat3(tempPath), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    await fileHandle.chmod(384);
+    await fileHandle.writeFile(content, "utf8");
+    await fileHandle.sync();
+    await fileHandle.close();
+    fileHandle = void 0;
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    await rename(tempPath, targetPath);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
+  } finally {
+    await fileHandle?.close().catch(() => void 0);
+    if (tempPath) await rm(tempPath, { force: true }).catch(() => void 0);
+    await closeDirectoryHandles(directoryHandles);
+  }
+}
+async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, trustedRoot = directory, platform = process.platform) {
+  if (fileNames.some(
+    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path22.basename(fileName) !== fileName
+  )) {
+    throw new Error(errorMessage);
+  }
+  let directoryHandles = [];
+  try {
+    const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
+    directoryHandles = stableDirectory.handles;
+    const pinnedDirectory = stableDirectory.pinnedDirectory;
+    for (const fileName of fileNames) {
+      await rm(path22.join(pinnedDirectory, fileName), { force: true });
+    }
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
+  } finally {
+    await closeDirectoryHandles(directoryHandles);
+  }
+}
+
+// src/support-passport/grant-store.ts
+var GRANT_LOCK_STALE_MS = 3e4;
+var GRANT_LOCK_WAIT_MS = 5e3;
+var GRANT_LOCK_HEARTBEAT_MS = 1e4;
+var SAFE_GRANT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var UUID_INPUT = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var SAFE_OWNER_INDEX_HASH = /^[0-9a-f]{64}$/;
+var UNSUPPORTED_DIRECTORY_SYNC_ERRORS2 = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
+var MAX_OWNER_GRANT_HISTORY = 100;
+var MAX_OWNER_INDEX_RECOVERY_ATTEMPTS = 3;
+var OwnerIndexLockLostError = class extends Error {
+  constructor(cause) {
+    super("support passport owner index lock was lost", { cause });
+    this.name = "OwnerIndexLockLostError";
+  }
+};
+var MalformedGrantStateError = class extends Error {
+  constructor(message = "support passport grant state is invalid", cause) {
+    super(message, { cause });
+    this.name = "MalformedGrantStateError";
+  }
+};
+function sha256(domain, value) {
+  return createHash10("sha256").update(domain).update("\0").update(value).digest("hex");
+}
+function hashesMatch(left, right) {
+  const leftBytes = Buffer.from(left, "hex");
+  const rightBytes = Buffer.from(right, "hex");
+  return leftBytes.length === 32 && rightBytes.length === 32 && timingSafeEqual(leftBytes, rightBytes);
+}
+function sameGrantState(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function newestGrantFirst(left, right) {
+  return Date.parse(right.createdAt) - Date.parse(left.createdAt) || left.grantId.localeCompare(right.grantId);
+}
+function grantNotFound() {
+  return new SupportPassportError("grant_not_found", "The share link was not found.", 404);
+}
+function warnCommitNotificationFailure(error) {
+  log.warn(`support passport commit notification failed: ${error instanceof Error ? error.message : String(error)}`);
+}
+function notifySupportPassportCommitted(callback) {
+  try {
+    const completion = callback?.();
+    if (completion) void Promise.resolve(completion).catch(warnCommitNotificationFailure);
+  } catch (error) {
+    warnCommitNotificationFailure(error);
+  }
+}
+function normalizeGrantId(grantId) {
+  if (typeof grantId !== "string" || !UUID_INPUT.test(grantId)) throw grantNotFound();
+  return grantId.toLowerCase();
+}
+function normalizeNamespace(namespace) {
+  const parsed = SupportPassportNamespaceSchema.safeParse(namespace);
+  if (!parsed.success) {
+    throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+  }
+  return parsed.data;
+}
+function normalizePrincipal(principal) {
+  const normalized = typeof principal === "string" ? principal.trim() : "";
+  if (normalized.length < 1 || normalized.length > 512) {
+    throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+  }
+  return normalized;
+}
+async function syncDirectoryForDurability(directory, openDirectory = async (target) => await open2(target, "r")) {
+  let handle;
+  try {
+    handle = await openDirectory(directory);
+    await handle.sync();
+  } catch (error) {
+    const code = error.code;
+    if (!UNSUPPORTED_DIRECTORY_SYNC_ERRORS2.has(code ?? "")) throw error;
+  } finally {
+    await handle?.close().catch(() => void 0);
+  }
+}
+var SupportPassportGrantStore = class {
+  memoryDir;
+  grantsDir;
+  ownerIndexesDir;
+  memoryRootReady;
+  safeDirectoriesReady;
+  now;
+  makeSecret;
+  makeGrantId;
+  runWithHeldFileLock;
+  syncDirectory;
+  constructor(options) {
+    this.memoryDir = path23.resolve(expandTildePath(options.memoryDir));
+    this.grantsDir = path23.join(this.memoryDir, "state", "support-passport", "grants");
+    this.ownerIndexesDir = path23.join(this.grantsDir, "owners");
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.makeSecret = options.makeSecret ?? (() => randomBytes3(32));
+    this.makeGrantId = options.makeGrantId ?? randomUUID3;
+    this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
+    this.syncDirectory = options.syncDirectory ?? syncDirectoryForDurability;
+  }
+  async create(input, hooks = {}) {
+    const mutationHooks = typeof hooks === "function" ? { beforeCommit: hooks } : hooks;
+    const namespace = normalizeNamespace(input.namespace);
+    const parsed = SupportPassportCreateGrantInputSchema.safeParse({
+      principal: input.principal,
+      cards: input.cards,
+      expiresAt: input.expiresAt
+    });
+    if (!parsed.success) {
+      throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+    }
+    const requestedAt = input.requestedAt ?? this.now();
+    const durationMs = Date.parse(parsed.data.expiresAt) - requestedAt.getTime();
+    if (!Number.isFinite(requestedAt.getTime()) || !Number.isFinite(durationMs) || durationMs < 3e5 || durationMs > 6048e5) {
+      throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+    }
+    const principalHash = computeSupportPassportOwnerKey(parsed.data.principal);
+    const ownerHash = this.ownerHash(namespace, principalHash);
+    let committed;
+    try {
+      let finalized;
+      try {
+        finalized = await this.withOwnerIndexLock(ownerHash, async (lock) => {
+          await this.requireAvailableOwnerGrantSlot(namespace, principalHash);
+          committed = await this.withMutationLock(async (mutationLock) => {
+            const secretBytes = this.makeSecret();
+            if (!Buffer.isBuffer(secretBytes) || secretBytes.length !== 32) {
+              throw new Error("SupportPassportGrantStore.makeSecret must return 32 bytes");
+            }
+            const rawGrantId = this.makeGrantId();
+            if (!UUID_INPUT.test(rawGrantId)) {
+              throw new Error("SupportPassportGrantStore.makeGrantId must return a UUID");
+            }
+            const grantId = rawGrantId.toLowerCase();
+            const secret = secretBytes.toString("base64url");
+            const createdAt = this.now();
+            const createdAtMs = createdAt.getTime();
+            const expiresAtMs = Date.parse(parsed.data.expiresAt);
+            if (!Number.isFinite(createdAtMs) || requestedAt.getTime() > createdAtMs || expiresAtMs <= createdAtMs || expiresAtMs - createdAtMs > 6048e5) {
+              throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+            }
+            const state = SupportPassportGrantStateSchema.parse({
+              schemaVersion: 1,
+              stateVersion: 1,
+              grantId,
+              namespace,
+              principalHash,
+              ownerLockKey: computeSupportPassportOwnerLockKey(namespace, parsed.data.principal),
+              secretHash: sha256("support-passport-secret:v1", secret),
+              cards: parsed.data.cards,
+              createdAt: createdAt.toISOString(),
+              expiresAt: parsed.data.expiresAt
+            });
+            await this.requireMutationLock(mutationLock);
+            await mutationHooks.beforeCommit?.();
+            await this.requireMutationLock(mutationLock);
+            try {
+              await this.writeState(state, true);
+            } catch (error) {
+              const persisted2 = await this.readState(state.grantId).catch(() => void 0);
+              if (!persisted2 || !sameGrantState(persisted2, state)) throw error;
+              try {
+                await this.syncDirectory(this.grantsDir);
+              } catch {
+                await this.removeGrantStates([state.grantId]).catch(() => void 0);
+                throw error;
+              }
+            }
+            try {
+              await this.writeOwnerMembership(state);
+            } catch (error) {
+              await this.removeStoredGrant(state).catch(() => void 0);
+              throw error;
+            }
+            const persisted = { state, secret };
+            committed = persisted;
+            return persisted;
+          });
+          try {
+            await this.addToOwnerIndex(committed.state, lock);
+          } catch (error) {
+            if (error instanceof OwnerIndexLockLostError) throw error;
+            const indexed = await this.readOwnerIndexByHash(ownerHash).catch(() => void 0);
+            if (!indexed?.includes(committed.state.grantId)) throw error;
+            try {
+              await this.syncDirectory(this.ownerIndexesDir);
+            } catch {
+              throw error;
+            }
+            await this.requireOwnerIndexLock(lock);
+          }
+          return committed;
+        });
+      } catch (error) {
+        if (!(error instanceof OwnerIndexLockLostError) || !committed) throw error;
+        finalized = await this.reconcileCreateAfterOwnerIndexLockLoss(committed);
+      }
+      notifySupportPassportCommitted(mutationHooks.onCommitted);
+      return finalized;
+    } catch (error) {
+      if (committed) {
+        await this.withGrantLock(committed.state.grantId, async (lock) => {
+          await this.requireMutationLock(lock);
+          await this.removeStoredGrant(committed.state);
+        }).catch(() => void 0);
+      }
+      throw error;
+    }
+  }
+  async authenticate(grantId, secret) {
+    const normalizedGrantId = normalizeGrantId(grantId);
+    if (typeof secret !== "string" || secret.length > 512) throw grantNotFound();
+    let state;
+    try {
+      state = await this.readState(normalizedGrantId);
+    } catch (error) {
+      if (error.code === "ENOENT") throw grantNotFound();
+      throw error;
+    }
+    const candidate = sha256("support-passport-secret:v1", secret);
+    if (!hashesMatch(candidate, state.secretHash)) throw grantNotFound();
+    if (state.revokedAt) {
+      throw new SupportPassportError("grant_gone", "The share link is no longer active.", 410);
+    }
+    if (Date.parse(state.expiresAt) <= this.now().getTime()) {
+      throw new SupportPassportError("grant_expired", "The share link has expired.", 410);
+    }
+    return state;
+  }
+  async withAuthenticatedGrant(grantId, secret, task, beforeReturn) {
+    return await this.withGrantLock(grantId, async (lock) => {
+      const state = await this.authenticate(grantId, secret);
+      const result = await task(state);
+      await this.requireMutationLock(lock);
+      const finalState = await this.authenticate(grantId, secret);
+      await this.requireMutationLock(lock);
+      if (finalState.stateVersion !== state.stateVersion) {
+        throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+      }
+      this.requireActiveState(finalState);
+      await beforeReturn?.(finalState);
+      await this.requireMutationLock(lock);
+      this.requireActiveState(finalState);
+      return result;
+    });
+  }
+  async listForOwner(namespace, principal) {
+    const normalizedNamespace = normalizeNamespace(namespace);
+    const principalHash = computeSupportPassportOwnerKey(normalizePrincipal(principal));
+    const activeCutoff = this.now().getTime();
+    const states = this.listedOwnerStates(
+      await this.readOwnerMembershipStates(normalizedNamespace, principalHash),
+      activeCutoff
+    );
+    return states.sort((a, b) => {
+      const aActive = !a.revokedAt && Date.parse(a.expiresAt) > activeCutoff;
+      const bActive = !b.revokedAt && Date.parse(b.expiresAt) > activeCutoff;
+      if (aActive !== bActive) return aActive ? -1 : 1;
+      return newestGrantFirst(a, b);
+    });
+  }
+  async revoke(input, hooks = {}) {
+    const mutationHooks = typeof hooks === "function" ? { beforeCommit: hooks } : hooks;
+    const normalizedInput = { ...input, grantId: normalizeGrantId(input.grantId) };
+    const namespace = normalizeNamespace(input.namespace);
+    return await this.withGrantLock(normalizedInput.grantId, async (lock) => {
+      let state;
+      try {
+        state = await this.readState(normalizedInput.grantId);
+      } catch (error) {
+        if (error.code === "ENOENT") throw grantNotFound();
+        throw error;
+      }
+      const principalHash = computeSupportPassportOwnerKey(normalizePrincipal(input.principal));
+      if (state.namespace !== namespace || !hashesMatch(state.principalHash, principalHash)) throw grantNotFound();
+      if (state.revokedAt) {
+        return state;
+      }
+      if (normalizedInput.expectedStateVersion !== void 0 && normalizedInput.expectedStateVersion !== state.stateVersion) {
+        throw new SupportPassportError("state_conflict", "The share link changed after it was loaded.", 409);
+      }
+      const revoked = SupportPassportGrantStateSchema.parse({
+        ...state,
+        stateVersion: state.stateVersion + 1,
+        revokedAt: this.now().toISOString()
+      });
+      await this.requireMutationLock(lock);
+      await mutationHooks.beforeCommit?.();
+      await this.requireMutationLock(lock);
+      try {
+        await this.writeState(revoked);
+      } catch (error) {
+        const persisted = await this.readState(revoked.grantId).catch(() => void 0);
+        if (!persisted || !sameGrantState(persisted, revoked)) throw error;
+        await this.syncDirectory(this.grantsDir);
+      }
+      notifySupportPassportCommitted(mutationHooks.onCommitted);
+      return revoked;
+    });
+  }
+  filePath(grantId) {
+    const normalizedGrantId = normalizeGrantId(grantId);
+    return path23.join(this.grantsDir, `${normalizedGrantId}.json`);
+  }
+  ownerIndexPath(ownerHash) {
+    if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
+    return path23.join(this.ownerIndexesDir, `${ownerHash}.json`);
+  }
+  ownerHash(namespace, principalHash) {
+    return sha256("support-passport-owner-index:v1", `${namespace}\0${principalHash}`);
+  }
+  async addToOwnerIndex(state, lock) {
+    const ownerHash = this.ownerHash(state.namespace, state.principalHash);
+    const ownerStates = (await this.readOwnerMembershipStates(state.namespace, state.principalHash)).filter((item) => item.grantId !== state.grantId).sort(newestGrantFirst);
+    const current = ownerStates.map((item) => item.grantId);
+    let retained = current;
+    const indexedStates = [...ownerStates];
+    if (current.length >= MAX_OWNER_GRANT_HISTORY) {
+      const expiryCutoff = this.now().getTime();
+      const active = indexedStates.filter((item) => !item.revokedAt && Date.parse(item.expiresAt) > expiryCutoff);
+      if (active.length >= MAX_OWNER_GRANT_HISTORY) {
+        throw new SupportPassportError(
+          "invalid_input",
+          "A support passport can contain at most 100 active share links.",
+          400
+        );
+      }
+      const inactive = indexedStates.filter((item) => item.revokedAt || Date.parse(item.expiresAt) <= expiryCutoff).sort(newestGrantFirst);
+      retained = [
+        ...active.map((item) => item.grantId),
+        ...inactive.slice(0, MAX_OWNER_GRANT_HISTORY - active.length - 1).map((item) => item.grantId)
+      ];
+    }
+    const grantIds = [...retained, state.grantId];
+    const retainedIds = new Set(grantIds);
+    const indexedStateById = new Map(indexedStates.map((indexedState) => [indexedState.grantId, indexedState]));
+    const evictedGrantIds = current.filter((grantId) => !retainedIds.has(grantId));
+    await this.writeOwnerIndexWhileLocked(ownerHash, grantIds, lock);
+    try {
+      for (const grantId of evictedGrantIds) {
+        await this.withGrantLock(grantId, async (grantLock) => {
+          await this.requireMutationLock(grantLock);
+          const evictedState = indexedStateById.get(grantId);
+          if (evictedState) await this.removeStoredGrant(evictedState);
+          else await this.removeGrantStates([grantId]);
+        });
+      }
+    } catch (error) {
+      log.warn(
+        `support passport could not remove inactive grant state: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  async removeGrantStates(grantIds) {
+    if (grantIds.length === 0) return;
+    for (const grantId of grantIds) {
+      if (!SAFE_GRANT_ID.test(grantId)) throw grantNotFound();
+    }
+    await removePrivateFilesNoFollow(
+      this.grantsDir,
+      grantIds.map((grantId) => `${grantId}.json`),
+      "support passport grant files must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+  }
+  ownerMembershipDirectory(ownerHash) {
+    if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
+    return path23.join(this.ownerIndexesDir, ownerHash);
+  }
+  async ensureOwnerMembershipDirectory(ownerHash) {
+    const directory = this.ownerMembershipDirectory(ownerHash);
+    await ensurePrivateDirectoryTreeNoFollow(
+      directory,
+      "support passport owner membership must remain inside the memory directory"
+    );
+    return directory;
+  }
+  async writeOwnerMembership(state) {
+    const ownerHash = this.ownerHash(state.namespace, state.principalHash);
+    const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
+    await writePrivateFileAtomicallyNoFollow(
+      directory,
+      path23.join(directory, `${state.grantId}.json`),
+      `${JSON.stringify({ schemaVersion: 1, grantId: state.grantId })}
+`,
+      "support passport owner membership must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+  }
+  async removeOwnerMembership(state) {
+    const ownerHash = this.ownerHash(state.namespace, state.principalHash);
+    const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
+    await removePrivateFilesNoFollow(
+      directory,
+      [`${state.grantId}.json`],
+      "support passport owner membership must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+  }
+  async removeStoredGrant(state) {
+    await this.removeGrantStates([state.grantId]);
+    await this.removeOwnerMembership(state);
+  }
+  async writeOwnerIndexWhileLocked(ownerHash, grantIds, lock) {
+    await this.requireOwnerIndexLock(lock);
+    await this.writeOwnerIndex(ownerHash, grantIds);
+    await this.requireOwnerIndexLock(lock);
+  }
+  async reconcileCreateAfterOwnerIndexLockLoss(committed) {
+    const ownerHash = this.ownerHash(committed.state.namespace, committed.state.principalHash);
+    for (let attempt = 1; attempt <= MAX_OWNER_INDEX_RECOVERY_ATTEMPTS; attempt += 1) {
+      try {
+        return await this.withOwnerIndexLock(
+          ownerHash,
+          async (lock) => await this.reconcileCommittedGrant(committed, ownerHash, lock)
+        );
+      } catch (error) {
+        if (!(error instanceof OwnerIndexLockLostError)) throw error;
+      }
+    }
+    throw new SupportPassportError("storage_conflict", "The share link store changed during the request.", 409);
+  }
+  async reconcileCommittedGrant(committed, ownerHash, lock) {
+    const persisted = await this.readState(committed.state.grantId).catch(() => void 0);
+    if (!persisted || !sameGrantState(persisted, committed.state)) {
+      throw new SupportPassportError("storage_conflict", "The share link store changed during the request.", 409);
+    }
+    const ownerStates = await this.readOwnerMembershipStates(committed.state.namespace, committed.state.principalHash);
+    const committedIndex = ownerStates.findIndex((state) => state.grantId === committed.state.grantId);
+    if (committedIndex === -1) ownerStates.push(committed.state);
+    else ownerStates[committedIndex] = committed.state;
+    const activeCutoff = this.now().getTime();
+    const active = ownerStates.filter((state) => !state.revokedAt && Date.parse(state.expiresAt) > activeCutoff);
+    if (active.length > MAX_OWNER_GRANT_HISTORY) {
+      await this.withGrantLock(committed.state.grantId, async (grantLock) => {
+        await this.requireMutationLock(grantLock);
+        await this.removeStoredGrant(committed.state);
+      });
+      const committedIndex2 = ownerStates.findIndex((state) => state.grantId === committed.state.grantId);
+      if (committedIndex2 !== -1) ownerStates.splice(committedIndex2, 1);
+    }
+    const retained = this.retainedOwnerStates(ownerStates, activeCutoff);
+    await this.writeOwnerIndexWhileLocked(
+      ownerHash,
+      retained.map((state) => state.grantId),
+      lock
+    );
+    const retainedIds = new Set(retained.map((state) => state.grantId));
+    for (const state of ownerStates) {
+      if (retainedIds.has(state.grantId)) continue;
+      try {
+        await this.withGrantLock(state.grantId, async (grantLock) => {
+          await this.requireMutationLock(grantLock);
+          await this.removeStoredGrant(state);
+        });
+      } catch (error) {
+        log.warn(
+          `support passport could not remove inactive grant state: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    if (active.length > MAX_OWNER_GRANT_HISTORY) {
+      throw new SupportPassportError("storage_conflict", "The share link store changed during the request.", 409);
+    }
+    return committed;
+  }
+  retainedOwnerStates(states, activeCutoff) {
+    const active = states.filter((state) => !state.revokedAt && Date.parse(state.expiresAt) > activeCutoff);
+    if (active.length > MAX_OWNER_GRANT_HISTORY) {
+      throw new SupportPassportError("storage_conflict", "The share link store contains too many active links.", 409);
+    }
+    const inactive = states.filter((state) => state.revokedAt || Date.parse(state.expiresAt) <= activeCutoff).sort(newestGrantFirst);
+    return [...active, ...inactive.slice(0, MAX_OWNER_GRANT_HISTORY - active.length)];
+  }
+  listedOwnerStates(states, activeCutoff) {
+    const active = states.filter((state) => !state.revokedAt && Date.parse(state.expiresAt) > activeCutoff);
+    const inactive = states.filter((state) => state.revokedAt || Date.parse(state.expiresAt) <= activeCutoff).sort(newestGrantFirst);
+    return [...active, ...inactive.slice(0, Math.max(0, MAX_OWNER_GRANT_HISTORY - active.length))];
+  }
+  async requireAvailableOwnerGrantSlot(namespace, principalHash) {
+    const activeCutoff = this.now().getTime();
+    const active = (await this.readOwnerMembershipStates(namespace, principalHash)).filter(
+      (state) => !state.revokedAt && Date.parse(state.expiresAt) > activeCutoff
+    );
+    if (active.length >= MAX_OWNER_GRANT_HISTORY) {
+      throw new SupportPassportError(
+        "invalid_input",
+        "A support passport can contain at most 100 active share links.",
+        400
+      );
+    }
+  }
+  async readOwnerMembershipStates(namespace, principalHash) {
+    await this.ensureSafeDirectories();
+    const ownerHash = this.ownerHash(namespace, principalHash);
+    const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
+    const grantIds = await withPrivateDirectoryNoFollow(
+      path23.parse(this.memoryDir).root,
+      directory,
+      "support passport owner membership must be regular files in a stable directory",
+      async (pinnedDirectory) => {
+        const entries = await readdir4(pinnedDirectory, { withFileTypes: true });
+        return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -5)).filter((grantId) => SAFE_GRANT_ID.test(grantId));
+      }
+    );
+    const ownerStates = [];
+    for (const grantId of grantIds) {
+      try {
+        const state = await this.readState(grantId);
+        if (state.namespace === namespace && hashesMatch(state.principalHash, principalHash)) {
+          ownerStates.push(state);
+        }
+      } catch (error) {
+        if (error.code === "ENOENT" || error instanceof MalformedGrantStateError) continue;
+        throw error;
+      }
+    }
+    return ownerStates;
+  }
+  async readOwnerIndexByHash(ownerHash) {
+    await this.ensureSafeDirectories();
+    const filePath = this.ownerIndexPath(ownerHash);
+    let content;
+    try {
+      content = await readPrivateFileNoFollow(
+        this.ownerIndexesDir,
+        filePath,
+        "support passport owner indexes must be regular files in a stable directory",
+        path23.parse(this.memoryDir).root
+      );
+    } catch (error) {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    }
+    const parsed = JSON.parse(content);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("support passport owner index is invalid");
+    }
+    const record = parsed;
+    const grantIds = record.grantIds;
+    if (record.schemaVersion !== 1 || record.ownerHash !== ownerHash || !Array.isArray(grantIds)) {
+      throw new Error("support passport owner index is invalid");
+    }
+    if (grantIds.some((grantId) => typeof grantId !== "string" || !SAFE_GRANT_ID.test(grantId))) {
+      throw new Error("support passport owner index is invalid");
+    }
+    const uniqueGrantIds = new Set(grantIds);
+    if (uniqueGrantIds.size !== grantIds.length || uniqueGrantIds.size > MAX_OWNER_GRANT_HISTORY) {
+      throw new Error("support passport owner index is invalid");
+    }
+    return [...uniqueGrantIds];
+  }
+  async writeOwnerIndex(ownerHash, grantIds) {
+    const filePath = this.ownerIndexPath(ownerHash);
+    try {
+      const metadata = await lstat4(filePath);
+      if (metadata.isSymbolicLink() || !metadata.isFile()) {
+        throw new Error("support passport owner indexes must be regular files");
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await writePrivateFileAtomicallyNoFollow(
+      this.ownerIndexesDir,
+      filePath,
+      `${JSON.stringify({ schemaVersion: 1, ownerHash, grantIds }, null, 2)}
+`,
+      "support passport owner indexes must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+  }
+  async readState(grantId) {
+    await this.ensureSafeDirectories();
+    const filePath = this.filePath(grantId);
+    const content = await readPrivateFileNoFollow(
+      this.grantsDir,
+      filePath,
+      "support passport grant files must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+    try {
+      const state = SupportPassportGrantStateSchema.parse(JSON.parse(content));
+      if (state.grantId !== grantId) {
+        throw new MalformedGrantStateError("support passport grant ID must match its file name");
+      }
+      return state;
+    } catch (error) {
+      if (error instanceof MalformedGrantStateError) throw error;
+      if (error instanceof SyntaxError || error.name === "ZodError") {
+        throw new MalformedGrantStateError(void 0, error);
+      }
+      throw error;
+    }
+  }
+  async writeState(state, requireAbsent = false) {
+    const filePath = this.filePath(state.grantId);
+    try {
+      const metadata = await lstat4(filePath);
+      if (metadata.isSymbolicLink() || !metadata.isFile())
+        throw new Error("support passport grant files must be regular files");
+      if (requireAbsent) {
+        throw new SupportPassportError("storage_conflict", "A new share link could not be allocated.", 409);
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    await writePrivateFileAtomicallyNoFollow(
+      this.grantsDir,
+      filePath,
+      `${JSON.stringify(state, null, 2)}
+`,
+      "support passport grant files must be regular files in a stable directory",
+      path23.parse(this.memoryDir).root
+    );
+  }
+  async ensureSafeDirectories() {
+    if (!this.safeDirectoriesReady) {
+      this.safeDirectoriesReady = (async () => {
+        await this.ensureMemoryRoot();
+        await ensurePrivateDirectoryNoFollow(
+          this.memoryDir,
+          this.ownerIndexesDir,
+          "support passport grant directories must remain inside the memory directory",
+          void 0,
+          true
+        );
+      })();
+    }
+    const currentAttempt = this.safeDirectoriesReady;
+    try {
+      await currentAttempt;
+    } catch (error) {
+      if (this.safeDirectoriesReady === currentAttempt) this.safeDirectoriesReady = void 0;
+      throw error;
+    }
+  }
+  async ensureMemoryRoot() {
+    const configuredMemoryDir = this.memoryDir;
+    if (!this.memoryRootReady) {
+      this.memoryRootReady = (async () => {
+        await ensurePrivateDirectoryTreeNoFollow(
+          configuredMemoryDir,
+          "support passport memory directory must be a stable directory",
+          void 0
+        );
+        this.memoryDir = configuredMemoryDir;
+        this.grantsDir = path23.join(configuredMemoryDir, "state", "support-passport", "grants");
+        this.ownerIndexesDir = path23.join(this.grantsDir, "owners");
+      })();
+    }
+    const currentAttempt = this.memoryRootReady;
+    try {
+      await currentAttempt;
+    } catch (error) {
+      if (this.memoryRootReady === currentAttempt) this.memoryRootReady = void 0;
+      throw error;
+    }
+  }
+  async withMutationLock(task) {
+    await this.ensureSafeDirectories();
+    return await withPrivateDirectoryNoFollow(
+      path23.parse(this.memoryDir).root,
+      this.grantsDir,
+      "support passport grant lock directory must remain inside the memory directory",
+      async (pinnedDirectory) => await this.withExclusiveLock(
+        `support-passport-grants:${this.grantsDir}`,
+        path23.join(pinnedDirectory, ".grants.lock"),
+        task
+      )
+    );
+  }
+  async withGrantLock(grantId, task) {
+    const normalizedGrantId = normalizeGrantId(grantId);
+    await this.ensureSafeDirectories();
+    return await withPrivateDirectoryNoFollow(
+      path23.parse(this.memoryDir).root,
+      this.grantsDir,
+      "support passport grant lock directory must remain inside the memory directory",
+      async (pinnedDirectory) => await this.withExclusiveLock(
+        `support-passport-grant:${this.grantsDir}:${normalizedGrantId}`,
+        path23.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
+        task
+      )
+    );
+  }
+  async withOwnerIndexLock(ownerHash, task) {
+    await this.ensureSafeDirectories();
+    return await withPrivateDirectoryNoFollow(
+      path23.parse(this.memoryDir).root,
+      this.ownerIndexesDir,
+      "support passport owner lock directory must remain inside the memory directory",
+      async (pinnedDirectory) => await this.withExclusiveLock(
+        `support-passport-owner:${this.ownerIndexesDir}:${ownerHash}`,
+        path23.join(pinnedDirectory, `.${ownerHash}.lock`),
+        task
+      )
+    );
+  }
+  async withExclusiveLock(serializationKey, lockPath, task) {
+    return await serializeMutations(
+      serializationKey,
+      () => this.runWithHeldFileLock(
+        lockPath,
+        {
+          staleMs: GRANT_LOCK_STALE_MS,
+          maxWaitMs: GRANT_LOCK_WAIT_MS,
+          heartbeatMs: GRANT_LOCK_HEARTBEAT_MS
+        },
+        async (acquired, lock) => {
+          if (!acquired) {
+            throw new SupportPassportError("storage_conflict", "The share link store is busy. Try again.", 409);
+          }
+          return await task(lock);
+        }
+      )
+    );
+  }
+  async requireMutationLock(lock) {
+    if (await lock.refresh()) return;
+    throw new SupportPassportError("storage_conflict", "The share link store changed during the request.", 409);
+  }
+  async requireOwnerIndexLock(lock) {
+    try {
+      await this.requireMutationLock(lock);
+    } catch (error) {
+      throw new OwnerIndexLockLostError(error);
+    }
+  }
+  requireActiveState(state) {
+    if (state.revokedAt) {
+      throw new SupportPassportError("grant_gone", "The share link is no longer active.", 410);
+    }
+    if (Date.parse(state.expiresAt) <= this.now().getTime()) {
+      throw new SupportPassportError("grant_expired", "The share link has expired.", 410);
+    }
+  }
+};
+
+// src/support-passport/grant-service.ts
+function invalidInput2() {
+  return new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+}
+var SupportPassportGrantService = class {
+  grantStore;
+  resolveOwner;
+  resolveNamespace;
+  now;
+  constructor(dependencies) {
+    this.grantStore = dependencies.grantStore;
+    this.resolveOwner = dependencies.resolveOwner;
+    this.resolveNamespace = dependencies.resolveNamespace;
+    this.now = dependencies.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async createGrant(input, options = {}) {
+    const requestedAt = this.now();
+    const parsed = SupportPassportCreateGrantInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput2();
+    const owner = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(
+      owner.storage,
+      { namespace: owner.namespace, principal: owner.principal },
+      async (ownerLock) => {
+        options.signal?.throwIfAborted();
+        const ownerHash = computeSupportPassportOwnerKey(owner.principal);
+        const cardsById = new Map(
+          this.projectOwnedCards(
+            await owner.storage.readAllMemories(),
+            owner.namespace,
+            ownerHash
+          ).map((card) => [card.card.cardId, card])
+        );
+        for (const cardRef of parsed.data.cards) {
+          const stored = cardsById.get(cardRef.cardId);
+          if (!stored || stored.namespace !== owner.namespace || stored.owner !== ownerHash || stored.card.status !== "active") {
+            throw new SupportPassportError("invalid_card_status", "Only approved support cards can be shared.", 409);
+          }
+          if (stored.card.revision !== cardRef.revision) {
+            throw new SupportPassportError("revision_conflict", "A support card changed after it was selected.", 409);
+          }
+          if (!this.publicCard(stored.card).success) {
+            throw new SupportPassportError("card_data_invalid", "The support card data is invalid.", 500);
+          }
+        }
+        const created = await this.grantStore.create(
+          {
+            namespace: owner.namespace,
+            principal: owner.principal,
+            cards: parsed.data.cards,
+            expiresAt: parsed.data.expiresAt,
+            requestedAt
+          },
+          {
+            beforeCommit: async () => {
+              options.signal?.throwIfAborted();
+              await requireSupportPassportOwnerLock(ownerLock);
+            }
+          }
+        );
+        try {
+          await requireSupportPassportOwnerLock(ownerLock);
+        } catch (error) {
+          await this.revokeCommittedGrant(created, owner);
+          throw error;
+        }
+        if (options.signal?.aborted) {
+          await this.revokeCommittedGrant(created, owner);
+          options.signal.throwIfAborted();
+        }
+        const output = SupportPassportCreatedGrantSchema.parse({
+          grant: this.ownerGrant(created.state),
+          secret: created.secret
+        });
+        notifySupportPassportCommitted(options.onCommitted);
+        return output;
+      }
+    );
+  }
+  async listGrants(input) {
+    const parsed = SupportPassportListGrantsInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput2();
+    const owner = await this.resolveOwnerScope(parsed.data.principal);
+    return (await this.grantStore.listForOwner(owner.namespace, owner.principal)).map(
+      (state) => this.ownerGrant(state)
+    );
+  }
+  async revokeGrant(input, options = {}) {
+    const parsed = SupportPassportRevokeGrantInputSchema.safeParse(input);
+    if (!parsed.success) throw invalidInput2();
+    const owner = await this.resolveOwnerScope(parsed.data.principal);
+    return await withSupportPassportOwnerLock(
+      owner.storage,
+      { namespace: owner.namespace, principal: owner.principal },
+      async (ownerLock) => {
+        options.signal?.throwIfAborted();
+        const state = await this.grantStore.revoke(
+          {
+            grantId: parsed.data.grantId,
+            namespace: owner.namespace,
+            principal: owner.principal,
+            expectedStateVersion: parsed.data.expectedStateVersion
+          },
+          {
+            beforeCommit: async () => {
+              options.signal?.throwIfAborted();
+              await requireSupportPassportOwnerLock(ownerLock);
+            }
+          }
+        );
+        const output = this.ownerGrant(state);
+        notifySupportPassportCommitted(options.onCommitted);
+        return output;
+      }
+    );
+  }
+  async readGrant(input) {
+    if (!input || typeof input.grantId !== "string" || typeof input.secret !== "string") {
+      throw new SupportPassportError("grant_not_found", "The share link was not found.", 404);
+    }
+    return await this.readGrantAttempt(input);
+  }
+  async readGrantAttempt(input) {
+    const initialState = await this.grantStore.authenticate(input.grantId, input.secret);
+    const storage = await this.resolveNamespace(initialState.namespace);
+    const initialSnapshot = await this.readStoredCardSnapshot(
+      storage,
+      initialState.namespace,
+      initialState.principalHash
+    );
+    const cards = this.readGrantCards(initialSnapshot, initialState);
+    const firstCard = cards[0];
+    if (!firstCard) throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+    const updatedAt = cards.reduce((latest, card) => {
+      return Date.parse(card.updatedAt) > Date.parse(latest) ? card.updatedAt : latest;
+    }, firstCard.updatedAt);
+    return await withSupportPassportOwnerLock(
+      storage,
+      { namespace: initialState.namespace, ownerKey: initialState.ownerLockKey },
+      async (ownerLock) => {
+        return await this.grantStore.withAuthenticatedGrant(
+          input.grantId,
+          input.secret,
+          async (finalState) => {
+            if (finalState.namespace !== initialState.namespace) {
+              throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+            }
+            await requireSupportPassportOwnerLock(ownerLock);
+            const currentSnapshot = await this.readStoredCardSnapshot(
+              storage,
+              finalState.namespace,
+              finalState.principalHash
+            );
+            const currentCards = this.readGrantCards(currentSnapshot, finalState);
+            await requireSupportPassportOwnerLock(ownerLock);
+            if (JSON.stringify(currentCards) !== JSON.stringify(cards)) {
+              throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+            }
+            return SupportPassportPublicGuideSchema.parse({
+              schemaVersion: 1,
+              grantId: finalState.grantId,
+              expiresAt: finalState.expiresAt,
+              updatedAt,
+              cards
+            });
+          },
+          async () => await requireSupportPassportOwnerLock(ownerLock)
+        );
+      }
+    );
+  }
+  readGrantCards(snapshot, state) {
+    return state.cards.map((cardRef) => {
+      const stored = snapshot.cardsById.get(cardRef.cardId);
+      if (!stored || stored.namespace !== state.namespace || stored.owner !== state.principalHash || stored.card.status !== "active" || stored.card.revision !== cardRef.revision) {
+        throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+      }
+      const publicCard = this.publicCard(stored.card);
+      if (!publicCard.success) {
+        throw new SupportPassportError("grant_stale", "The shared support guide has changed.", 410);
+      }
+      return publicCard.data;
+    });
+  }
+  async readStoredCardSnapshot(storage, namespace, owner) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      const before = this.cardSnapshotVersion(storage);
+      const memories = await storage.readAllMemories();
+      const after = this.cardSnapshotVersion(storage);
+      if (before !== after) continue;
+      const cards = this.projectOwnedCards(memories, namespace, owner);
+      const snapshot = {
+        version: after,
+        cardsById: new Map(cards.map((card) => [card.card.cardId, card]))
+      };
+      return snapshot;
+    }
+    throw new SupportPassportError("storage_conflict", "The support card list changed during review.", 409);
+  }
+  projectOwnedCards(memories, namespace, owner) {
+    const cards = memories.map((memory) => projectSupportPassportCard(memory)).filter(
+      (card) => card !== null && card.namespace === namespace && card.owner === owner
+    );
+    const cardIds = /* @__PURE__ */ new Set();
+    for (const card of cards) {
+      if (cardIds.has(card.card.cardId)) {
+        throw new SupportPassportError("card_data_invalid", "Support card IDs must be unique.", 500);
+      }
+      cardIds.add(card.card.cardId);
+    }
+    return cards;
+  }
+  cardSnapshotVersion(storage) {
+    return `${storage.getCorpusScanVersion()}:${storage.hotCacheKeyId()}`;
+  }
+  async revokeCommittedGrant(created, owner) {
+    try {
+      await this.grantStore.revoke({
+        grantId: created.state.grantId,
+        namespace: owner.namespace,
+        principal: owner.principal,
+        expectedStateVersion: created.state.stateVersion
+      });
+    } catch {
+      throw new SupportPassportError(
+        "storage_conflict",
+        "A share link could not be stopped after owner access changed. Review the active share list.",
+        500
+      );
+    }
+  }
+  publicCard(card) {
+    return SupportPassportPublicCardSchema.safeParse({
+      cardId: card.cardId,
+      title: card.title,
+      statement: card.statement,
+      category: card.category,
+      updatedAt: card.updatedAt
+    });
+  }
+  async resolveOwnerScope(principal) {
+    const requestedPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal });
+    const owner = await this.resolveOwner(principal);
+    const namespace = SupportPassportNamespaceSchema.safeParse(owner.namespace);
+    const ownerPrincipal = SupportPassportListCardsInputSchema.safeParse({ principal: owner.principal });
+    if (!requestedPrincipal.success || !namespace.success || !ownerPrincipal.success || ownerPrincipal.data.principal !== requestedPrincipal.data.principal) {
+      throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
+    }
+    return { ...owner, principal: ownerPrincipal.data.principal, namespace: namespace.data };
+  }
+  ownerGrant(state) {
+    const status = state.revokedAt ? "revoked" : Date.parse(state.expiresAt) <= this.now().getTime() ? "expired" : "active";
+    return SupportPassportOwnerGrantSchema.parse({
+      grantId: state.grantId,
+      stateVersion: state.stateVersion,
+      cards: state.cards,
+      createdAt: state.createdAt,
+      expiresAt: state.expiresAt,
+      revokedAt: state.revokedAt,
+      status
+    });
+  }
+};
+
+// src/relay/mission-fixture.ts
+var RELAY_DEMO_MISSION_ID = "checkout-token-recovery";
+var RELAY_DEMO_NAMESPACE = "relay-build-week";
+var sourceEvidence = {
+  kind: "source",
+  id: "source-checkout-contract",
+  label: "Checkout token contract",
+  locator: "fixture://checkout-service/src/token-policy.ts",
+  capture: "fixture"
+};
+var testEvidence = {
+  kind: "test",
+  id: "test-checkout-contract",
+  label: "Checkout integration contract",
+  locator: "fixture://checkout-service/test/token-policy.test.ts",
+  capture: "fixture"
+};
+var approvalEvidence = {
+  kind: "approval",
+  id: "approval-build-week-operator",
+  label: "Human approval receipt",
+  locator: "fixture://relay/approvals/correction-token-refresh.json",
+  capture: "fixture"
+};
+var correctionEvidence = {
+  kind: "correction",
+  id: "correction-token-refresh",
+  label: "Applied Remnic correction",
+  locator: "fixture://remnic/corrections/correction-token-refresh.json",
+  capture: "fixture"
+};
+function at(second) {
+  return `2026-07-17T18:00:${String(second).padStart(2, "0")}.000Z`;
+}
+function createRelayMissionFixture() {
+  return [
+    {
+      occurredAt: at(0),
+      idempotencyKey: "fixture-001",
+      payload: {
+        kind: "mission_started",
+        title: "The checkout token split",
+        objective: "Resolve a conflicting token refresh policy and prove a cold agent acts on it.",
+        runMode: "fixture",
+        evidence: [sourceEvidence]
+      }
+    },
+    {
+      occurredAt: at(2),
+      idempotencyKey: "fixture-002",
+      payload: {
+        kind: "agent_status",
+        agentId: "agent-atlas",
+        sessionId: "session-atlas",
+        label: "Atlas",
+        role: "Checkout implementation",
+        status: "working",
+        evidence: [sourceEvidence]
+      }
+    },
+    {
+      occurredAt: at(3),
+      idempotencyKey: "fixture-003",
+      payload: {
+        kind: "agent_status",
+        agentId: "agent-nova",
+        sessionId: "session-nova",
+        label: "Nova",
+        role: "Integration verification",
+        status: "working",
+        evidence: [testEvidence]
+      }
+    },
+    {
+      occurredAt: at(6),
+      idempotencyKey: "fixture-004",
+      payload: {
+        kind: "agent_output",
+        agentId: "agent-atlas",
+        sessionId: "session-atlas",
+        outputId: "output-atlas-policy",
+        summary: "Implemented a new token for every checkout retry.",
+        evidence: [
+          {
+            kind: "agent_output",
+            id: "output-atlas-policy",
+            label: "Atlas one-shot output",
+            locator: "fixture://codex/atlas/final-output.txt",
+            capture: "fixture"
+          }
+        ]
+      }
+    },
+    {
+      occurredAt: at(7),
+      idempotencyKey: "fixture-005",
+      payload: {
+        kind: "belief_observed",
+        agentId: "agent-atlas",
+        sessionId: "session-atlas",
+        beliefId: "belief-new-token-every-request",
+        decisionId: "decision-new-token-every-request",
+        statement: "Mint a new checkout token for every request and retry.",
+        confidence: 0.91,
+        evidence: [
+          {
+            kind: "memory",
+            id: "memory-stale-token-policy",
+            label: "Stale project decision",
+            locator: "fixture://remnic/memories/memory-stale-token-policy.md",
+            capture: "fixture"
+          }
+        ]
+      }
+    },
+    {
+      occurredAt: at(9),
+      idempotencyKey: "fixture-006",
+      payload: {
+        kind: "agent_output",
+        agentId: "agent-nova",
         sessionId: "session-nova",
         outputId: "output-nova-policy",
         summary: "The contract requires one token per checkout session, refreshed only after expiry.",
@@ -21712,9 +23889,9 @@ function readStructuralSymbol(entry) {
   const rec = entry;
   const symbol = typeof rec.symbol === "string" ? rec.symbol.trim() : "";
   if (!symbol) return null;
-  const path35 = typeof rec.path === "string" && rec.path.length > 0 ? rec.path : void 0;
+  const path38 = typeof rec.path === "string" && rec.path.length > 0 ? rec.path : void 0;
   const kind = typeof rec.kind === "string" && rec.kind.length > 0 ? rec.kind : void 0;
-  const item = path35 !== void 0 && kind !== void 0 ? { symbol, path: path35, kind } : path35 !== void 0 ? { symbol, path: path35 } : kind !== void 0 ? { symbol, kind } : { symbol };
+  const item = path38 !== void 0 && kind !== void 0 ? { symbol, path: path38, kind } : path38 !== void 0 ? { symbol, path: path38 } : kind !== void 0 ? { symbol, kind } : { symbol };
   return item;
 }
 function classifySpawnError(err) {
@@ -21788,7 +23965,7 @@ var DEFAULT_GRACE_PERIOD_DAYS = 7;
 
 // src/binary-lifecycle/backend.ts
 import fsp from "fs/promises";
-import path21 from "path";
+import path24 from "path";
 var FilesystemBackend = class {
   type = "filesystem";
   basePath;
@@ -21796,27 +23973,27 @@ var FilesystemBackend = class {
     if (!basePath || basePath.trim().length === 0) {
       throw new Error("FilesystemBackend requires a non-empty basePath");
     }
-    this.basePath = path21.resolve(basePath);
+    this.basePath = path24.resolve(basePath);
   }
   resolveRemotePath(remotePath) {
-    const resolved = path21.isAbsolute(remotePath) ? path21.resolve(remotePath) : path21.resolve(this.basePath, remotePath);
-    const relative = path21.relative(this.basePath, resolved);
-    if (relative === ".." || relative.startsWith(`..${path21.sep}`) || path21.isAbsolute(relative)) {
+    const resolved = path24.isAbsolute(remotePath) ? path24.resolve(remotePath) : path24.resolve(this.basePath, remotePath);
+    const relative = path24.relative(this.basePath, resolved);
+    if (relative === ".." || relative.startsWith(`..${path24.sep}`) || path24.isAbsolute(relative)) {
       throw new Error(`FilesystemBackend remotePath escapes basePath: ${JSON.stringify(remotePath)}`);
     }
     return resolved;
   }
   isInsideBase(candidate, realBase) {
-    const relative = path21.relative(realBase, candidate);
-    return relative === "" || relative !== ".." && !relative.startsWith(`..${path21.sep}`) && !path21.isAbsolute(relative);
+    const relative = path24.relative(realBase, candidate);
+    return relative === "" || relative !== ".." && !relative.startsWith(`..${path24.sep}`) && !path24.isAbsolute(relative);
   }
   async realBasePathIfExists() {
     try {
-      const stat5 = await fsp.lstat(this.basePath);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = await fsp.lstat(this.basePath);
+      if (stat6.isSymbolicLink()) {
         throw new Error(`FilesystemBackend basePath must not be a symlink: ${this.basePath}`);
       }
-      if (!stat5.isDirectory()) {
+      if (!stat6.isDirectory()) {
         throw new Error(`FilesystemBackend basePath must be a directory: ${this.basePath}`);
       }
       return await fsp.realpath(this.basePath);
@@ -21837,19 +24014,19 @@ var FilesystemBackend = class {
   }
   async ensureSafeParentDirectory(dest) {
     const realBase = await this.ensureBaseDirectory();
-    const destDir = path21.dirname(dest);
-    const relativeDir = path21.relative(this.basePath, destDir);
-    const segments = relativeDir === "" ? [] : relativeDir.split(path21.sep);
+    const destDir = path24.dirname(dest);
+    const relativeDir = path24.relative(this.basePath, destDir);
+    const segments = relativeDir === "" ? [] : relativeDir.split(path24.sep);
     let current = this.basePath;
     for (const segment of segments) {
       if (segment === "." || segment === "") continue;
-      current = path21.join(current, segment);
+      current = path24.join(current, segment);
       try {
-        const stat5 = await fsp.lstat(current);
-        if (stat5.isSymbolicLink()) {
+        const stat6 = await fsp.lstat(current);
+        if (stat6.isSymbolicLink()) {
           throw new Error(`FilesystemBackend remotePath traverses symlink: ${current}`);
         }
-        if (!stat5.isDirectory()) {
+        if (!stat6.isDirectory()) {
           throw new Error(`FilesystemBackend remotePath parent is not a directory: ${current}`);
         }
       } catch (err) {
@@ -21871,26 +24048,26 @@ var FilesystemBackend = class {
     if (realBase === null) {
       return null;
     }
-    const destDir = path21.dirname(dest);
-    const relativeDir = path21.relative(this.basePath, destDir);
-    const segments = relativeDir === "" ? [] : relativeDir.split(path21.sep);
+    const destDir = path24.dirname(dest);
+    const relativeDir = path24.relative(this.basePath, destDir);
+    const segments = relativeDir === "" ? [] : relativeDir.split(path24.sep);
     let current = this.basePath;
     for (const segment of segments) {
       if (segment === "." || segment === "") continue;
-      current = path21.join(current, segment);
-      let stat5;
+      current = path24.join(current, segment);
+      let stat6;
       try {
-        stat5 = await fsp.lstat(current);
+        stat6 = await fsp.lstat(current);
       } catch (err) {
         if (err.code === "ENOENT") {
           return null;
         }
         throw err;
       }
-      if (stat5.isSymbolicLink()) {
+      if (stat6.isSymbolicLink()) {
         throw new Error(`FilesystemBackend remotePath traverses symlink: ${current}`);
       }
-      if (!stat5.isDirectory()) {
+      if (!stat6.isDirectory()) {
         return null;
       }
     }
@@ -21905,11 +24082,11 @@ var FilesystemBackend = class {
       throw new Error(`FilesystemBackend remotePath parent escapes basePath: ${JSON.stringify(remotePath)}`);
     }
     try {
-      const stat5 = await fsp.lstat(dest);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = await fsp.lstat(dest);
+      if (stat6.isSymbolicLink()) {
         throw new Error(`FilesystemBackend remotePath points to symlink: ${dest}`);
       }
-      if (!stat5.isFile()) {
+      if (!stat6.isFile()) {
         return null;
       }
     } catch (err) {
@@ -21925,14 +24102,14 @@ var FilesystemBackend = class {
     return dest;
   }
   async upload(localPath, remotePath) {
-    if (path21.isAbsolute(remotePath)) {
+    if (path24.isAbsolute(remotePath)) {
       throw new Error(`FilesystemBackend upload remotePath must be relative: ${JSON.stringify(remotePath)}`);
     }
     const dest = this.resolveRemotePath(remotePath);
     const realBase = await this.ensureSafeParentDirectory(dest);
     try {
-      const stat5 = await fsp.lstat(dest);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = await fsp.lstat(dest);
+      if (stat6.isSymbolicLink()) {
         throw new Error(`FilesystemBackend remotePath points to symlink: ${dest}`);
       }
     } catch (err) {
@@ -21998,7 +24175,7 @@ function createBackend(cfg) {
 
 // src/binary-lifecycle/scanner.ts
 import fsp2 from "fs/promises";
-import path22 from "path";
+import path25 from "path";
 import crypto from "crypto";
 function matchesPatterns(filename, patterns) {
   const lower = filename.toLowerCase();
@@ -22023,8 +24200,8 @@ async function scanForBinaries(memoryDir, config, manifest) {
       return;
     }
     for (const entry of entries) {
-      const fullPath = path22.join(dir, entry.name);
-      const relativePath = path22.relative(memoryDir, fullPath).split(path22.sep).join("/");
+      const fullPath = path25.join(dir, entry.name);
+      const relativePath = path25.relative(memoryDir, fullPath).split(path25.sep).join("/");
       if (entry.isDirectory()) {
         if (entry.name === ".binary-lifecycle") continue;
         await walk(fullPath);
@@ -22033,12 +24210,12 @@ async function scanForBinaries(memoryDir, config, manifest) {
       if (!entry.isFile()) continue;
       if (!matchesPatterns(entry.name, config.scanPatterns)) continue;
       try {
-        const stat5 = await fsp2.stat(fullPath);
-        if (stat5.size > config.maxBinarySizeBytes) continue;
-        if (stat5.size === 0) continue;
+        const stat6 = await fsp2.stat(fullPath);
+        if (stat6.size > config.maxBinarySizeBytes) continue;
+        if (stat6.size === 0) continue;
         const existing = tracked.get(relativePath);
         if (existing) {
-          if (existing.sizeBytes !== stat5.size) {
+          if (existing.sizeBytes !== stat6.size) {
             results.push(relativePath);
             continue;
           }
@@ -22064,15 +24241,15 @@ async function hashFile(filePath) {
 
 // src/binary-lifecycle/manifest.ts
 import fsp3 from "fs/promises";
-import path23 from "path";
+import path26 from "path";
 import crypto2 from "crypto";
 var MANIFEST_DIR = ".binary-lifecycle";
 var MANIFEST_FILE = "manifest.json";
 function manifestDir(memoryDir) {
-  return path23.join(memoryDir, MANIFEST_DIR);
+  return path26.join(memoryDir, MANIFEST_DIR);
 }
 function manifestPath(memoryDir) {
-  return path23.join(memoryDir, MANIFEST_DIR, MANIFEST_FILE);
+  return path26.join(memoryDir, MANIFEST_DIR, MANIFEST_FILE);
 }
 async function readManifest(memoryDir) {
   const filePath = manifestPath(memoryDir);
@@ -22124,13 +24301,13 @@ function emptyManifest() {
 
 // src/binary-lifecycle/pipeline.ts
 import fsp4 from "fs/promises";
-import path24 from "path";
+import path27 from "path";
 import crypto3 from "crypto";
 var historicalIdCache = new HistoricalEntityCanonicalIdCache();
 function isRecallCorpusMarkdown(mdPath, memoryDir) {
-  const rel = path24.relative(memoryDir, mdPath);
-  if (rel.startsWith("..") || path24.isAbsolute(rel)) return false;
-  const top = rel.split(path24.sep)[0];
+  const rel = path27.relative(memoryDir, mdPath);
+  if (rel.startsWith("..") || path27.isAbsolute(rel)) return false;
+  const top = rel.split(path27.sep)[0];
   return RECALL_FALLBACK_DIRS.includes(top);
 }
 async function hashFile2(filePath) {
@@ -22154,13 +24331,13 @@ function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function resolveManifestAssetPath(memoryDir, originalPath) {
-  if (originalPath.length === 0 || originalPath.includes("\0") || originalPath.includes("\\") || path24.isAbsolute(originalPath) || path24.win32.isAbsolute(originalPath)) {
+  if (originalPath.length === 0 || originalPath.includes("\0") || originalPath.includes("\\") || path27.isAbsolute(originalPath) || path27.win32.isAbsolute(originalPath)) {
     return null;
   }
-  const memoryRoot = path24.resolve(memoryDir);
-  const fullPath = path24.resolve(memoryRoot, originalPath);
-  const relative = path24.relative(memoryRoot, fullPath);
-  if (relative === "" || relative === ".." || relative.startsWith(`..${path24.sep}`) || path24.isAbsolute(relative)) {
+  const memoryRoot = path27.resolve(memoryDir);
+  const fullPath = path27.resolve(memoryRoot, originalPath);
+  const relative = path27.relative(memoryRoot, fullPath);
+  if (relative === "" || relative === ".." || relative.startsWith(`..${path27.sep}`) || path27.isAbsolute(relative)) {
     return null;
   }
   return fullPath;
@@ -22171,7 +24348,7 @@ function validateBinaryLifecycleConfig(config) {
   }
 }
 function remotePathForAsset(backend, relPath) {
-  const normalized = relPath.split(path24.sep).join("/");
+  const normalized = relPath.split(path27.sep).join("/");
   if (backend.type === "filesystem") {
     return `.binary-lifecycle/mirrors/${normalized}`;
   }
@@ -22184,11 +24361,11 @@ async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
   let mirrored = 0;
   const errors = [];
   for (const relPath of newPaths) {
-    const fullPath = path24.join(memoryDir, relPath);
+    const fullPath = path27.join(memoryDir, relPath);
     try {
-      const stat5 = await fsp4.stat(fullPath);
+      const stat6 = await fsp4.stat(fullPath);
       const contentHash = await hashFile2(fullPath);
-      const ext = path24.extname(relPath);
+      const ext = path27.extname(relPath);
       const mimeType = guessMimeType(ext);
       const remotePath = remotePathForAsset(backend, relPath);
       let backendLocation = remotePath;
@@ -22201,7 +24378,7 @@ async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
         mirroredPath: backendLocation,
         ...redirectPath ? { redirectPath } : {},
         contentHash,
-        sizeBytes: stat5.size,
+        sizeBytes: stat6.size,
         mimeType,
         mirroredAt: (/* @__PURE__ */ new Date()).toISOString(),
         status: "mirrored"
@@ -22214,7 +24391,7 @@ async function stageMirror(memoryDir, newPaths, backend, assets, log2, dryRun) {
         assets.push(record);
       }
       mirrored++;
-      log2.info(`[binary-lifecycle] mirrored: ${relPath} (${stat5.size} bytes)${dryRun ? " [dry-run]" : ""}`);
+      log2.info(`[binary-lifecycle] mirrored: ${relPath} (${stat6.size} bytes)${dryRun ? " [dry-run]" : ""}`);
     } catch (err) {
       const msg = `mirror failed for ${relPath}: ${err instanceof Error ? err.message : String(err)}`;
       log2.error(`[binary-lifecycle] ${msg}`);
@@ -22248,8 +24425,8 @@ async function stageRedirect(memoryDir, assets, log2, dryRun, readMarkdownFile,
         const pattern = markdownReferencePattern(asset, assetAbsolute, mdPath);
         if (!pattern.test(content)) continue;
         pattern.lastIndex = 0;
-        const updated = content.replace(pattern, (_match, open, _target, close) => {
-          return `${open}${markdownTargetForAsset(asset)}${close}`;
+        const updated = content.replace(pattern, (_match, open3, _target, close) => {
+          return `${open3}${markdownTargetForAsset(asset)}${close}`;
         });
         updates.push({ mdPath, content: updated });
       } catch (err) {
@@ -22326,7 +24503,7 @@ async function stageRedirect(memoryDir, assets, log2, dryRun, readMarkdownFile,
     for (const update of updates) {
       try {
         await withRawEntityPageMutation(memoryDir, update.mdPath, async () => {
-          const stateDir = path24.join(memoryDir, "state");
+          const stateDir = path27.join(memoryDir, "state");
           const kind = classifyEntityRefWritePath(memoryDir, update.mdPath);
           if (kind === "memory") {
             const idsAtWrite = historicalIdCache.get(stateDir);
@@ -22420,10 +24597,10 @@ async function countRemainingLocalReferences(memoryDir, asset, assetAbsolute, md
   return { remaining, errors };
 }
 function markdownReferencePattern(asset, assetAbsolute, mdPath) {
-  const mdDir = path24.dirname(mdPath);
+  const mdDir = path27.dirname(mdPath);
   const candidates = /* @__PURE__ */ new Set();
   const addCandidate = (candidate) => {
-    const normalized = candidate.split(path24.sep).join("/");
+    const normalized = candidate.split(path27.sep).join("/");
     if (normalized.length === 0) return;
     candidates.add(normalized);
     const isParentTraversal = normalized === ".." || normalized.startsWith("../");
@@ -22431,10 +24608,10 @@ function markdownReferencePattern(asset, assetAbsolute, mdPath) {
       candidates.add(`./${normalized}`);
     }
   };
-  addCandidate(path24.relative(mdDir, assetAbsolute));
-  const originalPath = asset.originalPath.split(path24.sep).join("/");
-  const originalAsFileRelative = path24.resolve(mdDir, ...originalPath.split("/"));
-  if (path24.resolve(originalAsFileRelative) === path24.resolve(assetAbsolute)) {
+  addCandidate(path27.relative(mdDir, assetAbsolute));
+  const originalPath = asset.originalPath.split(path27.sep).join("/");
+  const originalAsFileRelative = path27.resolve(mdDir, ...originalPath.split("/"));
+  if (path27.resolve(originalAsFileRelative) === path27.resolve(assetAbsolute)) {
     addCandidate(originalPath);
   }
   addCandidate(`/${originalPath}`);
@@ -22530,7 +24707,7 @@ async function findMarkdownFiles(dir) {
       return;
     }
     for (const entry of entries) {
-      const full = path24.join(current, entry.name);
+      const full = path27.join(current, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === ".binary-lifecycle") continue;
         await walk(full);
@@ -22605,7 +24782,7 @@ async function runBinaryLifecyclePipeline(memoryDir, config, backend, log2, opts
 
 // src/projection/index.ts
 import fs from "fs";
-import path25 from "path";
+import path28 from "path";
 var VALID_PROJECTION_CATEGORIES = new Set(ALL_CATEGORY_KEYS);
 async function generateContextTree(options) {
   const startTime = Date.now();
@@ -22620,8 +24797,8 @@ async function generateContextTree(options) {
   let nodesGenerated = 0;
   let nodesSkipped = 0;
   const categoryCounts = {};
-  const resolvedMemoryDir = path25.resolve(memoryDir);
-  const resolvedOutputDir = path25.resolve(outputDir);
+  const resolvedMemoryDir = path28.resolve(memoryDir);
+  const resolvedOutputDir = path28.resolve(outputDir);
   const requestedCategories = validateProjectionCategories(filterCategories);
   const realMemoryDir = assertSafeMemoryRoot(resolvedMemoryDir);
   assertNotSymlink(resolvedOutputDir, "context tree outputDir");
@@ -22659,7 +24836,7 @@ async function generateContextTree(options) {
     }
   }
   if (includeEntities) {
-    const entitiesDir = path25.join(memoryDir, "entities");
+    const entitiesDir = path28.join(memoryDir, "entities");
     if (fs.existsSync(entitiesDir)) {
       assertSafeInputRoot(realMemoryDir, entitiesDir, "entities root");
       categoryCounts["entity"] = 0;
@@ -22671,7 +24848,7 @@ async function generateContextTree(options) {
           continue;
         }
         const content = fs.readFileSync(filePath, "utf8");
-        const fileName = path25.basename(filePath, ".md");
+        const fileName = path28.basename(filePath, ".md");
         const node = projectEntityNode(fileName, content);
         const outputPath = resolveContainedOutputPath(realOutputDir, "entities", `${fileName}.md`);
         writeProjectedContent(realOutputDir, outputPath, node.content);
@@ -22683,7 +24860,7 @@ async function generateContextTree(options) {
   }
   const shouldIncludeQuestions = includeQuestions && (requestedCategories === void 0 || requestedCategories.includes("question"));
   if (shouldIncludeQuestions) {
-    const questionsDir = path25.join(memoryDir, "questions");
+    const questionsDir = path28.join(memoryDir, "questions");
     if (fs.existsSync(questionsDir)) {
       assertSafeInputRoot(realMemoryDir, questionsDir, "questions root");
       categoryCounts["question"] = 0;
@@ -22724,8 +24901,8 @@ async function generateContextTree(options) {
   };
 }
 function isPathInside(root, candidate) {
-  const relative = path25.relative(root, candidate);
-  return relative === "" || !relative.startsWith("..") && !path25.isAbsolute(relative);
+  const relative = path28.relative(root, candidate);
+  return relative === "" || !relative.startsWith("..") && !path28.isAbsolute(relative);
 }
 function assertNotSymlink(targetPath, label) {
   try {
@@ -22738,21 +24915,21 @@ function assertNotSymlink(targetPath, label) {
   }
 }
 function assertSafeMemoryRoot(targetPath) {
-  const stat5 = fs.lstatSync(targetPath);
-  if (stat5.isSymbolicLink()) {
+  const stat6 = fs.lstatSync(targetPath);
+  if (stat6.isSymbolicLink()) {
     throw new Error(`memoryDir must not be a symlink: ${targetPath}`);
   }
-  if (!stat5.isDirectory()) {
+  if (!stat6.isDirectory()) {
     throw new Error(`memoryDir must be a directory: ${targetPath}`);
   }
   return fs.realpathSync(targetPath);
 }
 function assertSafeInputRoot(realMemoryDir, targetPath, label) {
-  const stat5 = fs.lstatSync(targetPath);
-  if (stat5.isSymbolicLink()) {
+  const stat6 = fs.lstatSync(targetPath);
+  if (stat6.isSymbolicLink()) {
     throw new Error(`${label} must not be a symlink: ${targetPath}`);
   }
-  if (!stat5.isDirectory()) {
+  if (!stat6.isDirectory()) {
     throw new Error(`${label} must be a directory: ${targetPath}`);
   }
   const realTarget = fs.realpathSync(targetPath);
@@ -22762,15 +24939,15 @@ function assertSafeInputRoot(realMemoryDir, targetPath, label) {
 }
 function assertSafeOutputTarget(realOutputDir, outputPath) {
   let current = realOutputDir;
-  const relative = path25.relative(realOutputDir, outputPath);
-  if (relative.startsWith("..") || path25.isAbsolute(relative)) {
+  const relative = path28.relative(realOutputDir, outputPath);
+  if (relative.startsWith("..") || path28.isAbsolute(relative)) {
     throw new Error(`context tree output path escapes outputDir: ${outputPath}`);
   }
-  for (const segment of relative.split(path25.sep).filter(Boolean)) {
-    current = path25.join(current, segment);
+  for (const segment of relative.split(path28.sep).filter(Boolean)) {
+    current = path28.join(current, segment);
     try {
-      const stat5 = fs.lstatSync(current);
-      if (stat5.isSymbolicLink()) {
+      const stat6 = fs.lstatSync(current);
+      if (stat6.isSymbolicLink()) {
         throw new Error(`context tree output path contains symlink: ${current}`);
       }
     } catch (err) {
@@ -22797,17 +24974,17 @@ function validateProjectionCategories(categories) {
   return validated;
 }
 function resolveContainedOutputPath(outputRoot, ...segments) {
-  const resolved = path25.resolve(outputRoot, ...segments);
-  const relative = path25.relative(outputRoot, resolved);
-  if (relative === "" || !relative.startsWith("..") && !path25.isAbsolute(relative)) {
+  const resolved = path28.resolve(outputRoot, ...segments);
+  const relative = path28.relative(outputRoot, resolved);
+  if (relative === "" || !relative.startsWith("..") && !path28.isAbsolute(relative)) {
     return resolved;
   }
   throw new Error(`context tree output path escapes outputDir: ${segments.join("/")}`);
 }
 function writeProjectedContent(realOutputDir, outputPath, generatedContent) {
   assertSafeOutputTarget(realOutputDir, outputPath);
-  fs.mkdirSync(path25.dirname(outputPath), { recursive: true });
-  const realParent = fs.realpathSync(path25.dirname(outputPath));
+  fs.mkdirSync(path28.dirname(outputPath), { recursive: true });
+  const realParent = fs.realpathSync(path28.dirname(outputPath));
   if (!isPathInside(realOutputDir, realParent)) {
     throw new Error(`context tree output path escapes outputDir: ${outputPath}`);
   }
@@ -22846,7 +25023,7 @@ function walkR(dir, realMemoryDir) {
   const results = [];
   function walk(directory) {
     for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
-      const fullPath = path25.join(directory, entry.name);
+      const fullPath = path28.join(directory, entry.name);
       if (entry.isSymbolicLink()) {
         throw new Error(`context tree input path contains symlink: ${fullPath}`);
       }
@@ -22899,13 +25076,13 @@ function extractBody(content) {
 }
 function projectNode(filePath, category, fm, rawContent) {
   const body = extractBody(rawContent);
-  const fileName = path25.basename(filePath, ".md");
-  const dateDir = path25.basename(path25.dirname(filePath));
+  const fileName = path28.basename(filePath, ".md");
+  const dateDir = path28.basename(path28.dirname(filePath));
   let relPath;
   if (/^\d{4}-\d{2}-\d{2}$/.test(dateDir)) {
-    relPath = path25.join(category, dateDir, `${fileName}.md`);
+    relPath = path28.join(category, dateDir, `${fileName}.md`);
   } else {
-    relPath = path25.join(category, `${fileName}.md`);
+    relPath = path28.join(category, `${fileName}.md`);
   }
   const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
   const md = `# ${fm.id}
@@ -22951,7 +25128,7 @@ function projectEntityNode(fileName, content) {
 ${content}
 `;
   return {
-    path: path25.join("entities", `${fileName}.md`),
+    path: path28.join("entities", `${fileName}.md`),
     category: "entity",
     title: fileName,
     content: md,
@@ -23004,7 +25181,7 @@ function generateIndex(categoryCounts, outputDir) {
 
 // src/onboarding/index.ts
 import fs2 from "fs";
-import path26 from "path";
+import path29 from "path";
 var LANGUAGE_RULES = [
   {
     language: "TypeScript",
@@ -23106,7 +25283,7 @@ function onboard(options) {
     maxDepth = 6,
     excludeDirs = []
   } = options;
-  const directory = path26.resolve(options.directory ?? process.cwd());
+  const directory = path29.resolve(options.directory ?? process.cwd());
   let rootStat;
   try {
     rootStat = fs2.statSync(directory);
@@ -23148,7 +25325,7 @@ function walkDir(root, exclude, maxDepth) {
     }
     for (const entry of entries) {
       if (exclude.has(entry.name)) continue;
-      const fullPath = path26.join(dir, entry.name);
+      const fullPath = path29.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath, depth + 1);
       } else if (entry.isFile()) {
@@ -23163,11 +25340,11 @@ function detectLanguages(files, root) {
   const results = [];
   const extCounts = /* @__PURE__ */ new Map();
   for (const f of files) {
-    const ext = path26.extname(f).toLowerCase();
+    const ext = path29.extname(f).toLowerCase();
     if (ext) extCounts.set(ext, (extCounts.get(ext) ?? 0) + 1);
   }
   const rootFiles = new Set(
-    files.filter((f) => path26.dirname(f) === root).map((f) => path26.basename(f))
+    files.filter((f) => path29.dirname(f) === root).map((f) => path29.basename(f))
   );
   for (const rule of LANGUAGE_RULES) {
     const evidence = [];
@@ -23211,7 +25388,7 @@ function detectLanguages(files, root) {
 }
 function detectShape(files, root) {
   const rootFiles = new Set(
-    files.filter((f) => path26.dirname(f) === root).map((f) => path26.basename(f))
+    files.filter((f) => path29.dirname(f) === root).map((f) => path29.basename(f))
   );
   const rootDirs = /* @__PURE__ */ new Set();
   try {
@@ -23222,7 +25399,7 @@ function detectShape(files, root) {
   }
   const evidence = [];
   if (rootFiles.has("package.json")) {
-    const pkg = readJsonSafe(path26.join(root, "package.json"));
+    const pkg = readJsonSafe(path29.join(root, "package.json"));
     if (pkg?.workspaces) {
       evidence.push("package.json has workspaces");
       return { shape: "monorepo", evidence };
@@ -23236,13 +25413,13 @@ function detectShape(files, root) {
     evidence.push("workspace manifest found");
     return { shape: "workspace", evidence };
   }
-  const cargoToml = readTomlWorkspace(path26.join(root, "Cargo.toml"));
+  const cargoToml = readTomlWorkspace(path29.join(root, "Cargo.toml"));
   if (cargoToml) {
     evidence.push("Cargo.toml has workspace");
     return { shape: "workspace", evidence };
   }
   if (rootFiles.has("package.json")) {
-    const pkg = readJsonSafe(path26.join(root, "package.json"));
+    const pkg = readJsonSafe(path29.join(root, "package.json"));
     if (pkg?.exports || pkg?.main) {
       if (pkg?.bin) {
         evidence.push("package.json has bin");
@@ -23276,8 +25453,8 @@ function discoverDocs(files, root) {
     { pattern: /^\.editorconfig$/i, kind: "config" }
   ];
   for (const filePath of files) {
-    const basename = path26.basename(filePath).toLowerCase();
-    const relPath = path26.relative(root, filePath);
+    const basename = path29.basename(filePath).toLowerCase();
+    const relPath = path29.relative(root, filePath);
     let kind;
     for (const { pattern, kind: k } of docPatterns) {
       if (pattern.test(basename)) {
@@ -23289,7 +25466,7 @@ function discoverDocs(files, root) {
       kind = "docs";
     }
     if (!kind && (basename.endsWith(".md") || basename.endsWith(".mdx"))) {
-      if (path26.dirname(relPath) === "." || isUnderDocsDir(relPath)) {
+      if (path29.dirname(relPath) === "." || isUnderDocsDir(relPath)) {
         kind = "docs";
       }
     }
@@ -23310,7 +25487,7 @@ function discoverDocs(files, root) {
   return docs;
 }
 function isUnderDocsDir(relPath) {
-  const parts = relPath.split(path26.sep);
+  const parts = relPath.split(path29.sep);
   return parts[0] === "docs" || parts[0] === "doc" || parts[0] === "documentation";
 }
 function buildPlan(languages, shape, docs, _root) {
@@ -23354,7 +25531,7 @@ function readTomlWorkspace(filePath) {
 
 // src/curation/index.ts
 import fs3 from "fs";
-import path27 from "path";
+import path30 from "path";
 import crypto4 from "crypto";
 async function curate(options) {
   const startTime = Date.now();
@@ -23439,18 +25616,18 @@ async function curate(options) {
   };
 }
 function resolveTargets(targetPath) {
-  const stat5 = fs3.statSync(targetPath);
-  if (stat5.isFile()) return [targetPath];
+  const stat6 = fs3.statSync(targetPath);
+  if (stat6.isFile()) return [targetPath];
   const results = [];
   const extensions = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
   function walk(dir) {
     for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-      const fullPath = path27.join(dir, entry.name);
+      const fullPath = path30.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name !== "node_modules" && entry.name !== ".git") {
           walk(fullPath);
         }
-      } else if (extensions.has(path27.extname(entry.name).toLowerCase())) {
+      } else if (extensions.has(path30.extname(entry.name).toLowerCase())) {
         results.push(fullPath);
       }
     }
@@ -23459,12 +25636,12 @@ function resolveTargets(targetPath) {
   return results;
 }
 function resolveProvenanceRoot(targetPath) {
-  const resolvedTarget = path27.resolve(targetPath);
-  const stat5 = fs3.statSync(resolvedTarget);
-  return stat5.isFile() ? path27.dirname(resolvedTarget) : resolvedTarget;
+  const resolvedTarget = path30.resolve(targetPath);
+  const stat6 = fs3.statSync(resolvedTarget);
+  return stat6.isFile() ? path30.dirname(resolvedTarget) : resolvedTarget;
 }
 function extractStatements(content, filePath, projectRoot, source, sourceFileHash, categoryOverride, confidence, entityRef, tags) {
-  const relativePath = path27.relative(projectRoot, path27.resolve(filePath)) || path27.basename(filePath);
+  const relativePath = path30.relative(projectRoot, path30.resolve(filePath)) || path30.basename(filePath);
   const statements = [];
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const paragraphs = content.split(/\n{2,}/).map((p) => p.trim()).filter((p) => p.length > 20 && p.length < 2e3);
@@ -23558,7 +25735,7 @@ function loadExistingMemories(memoryDir) {
   if (!fs3.existsSync(memoryDir)) return result;
   const dirs = ALL_CATEGORY_DIRS;
   for (const dir of dirs) {
-    const fullDir = path27.join(memoryDir, dir);
+    const fullDir = path30.join(memoryDir, dir);
     if (!fs3.existsSync(fullDir)) continue;
     walkFiles(fullDir, (filePath) => {
       const content = readFileSafe(filePath);
@@ -23581,11 +25758,11 @@ function writeStatement(stmt, memoryDir) {
   const now = /* @__PURE__ */ new Date();
   const dateDir = now.toISOString().split("T")[0];
   const categoryDir = getCategoryDir(memoryDir, stmt.category);
-  const dir = path27.join(categoryDir, dateDir);
+  const dir = path30.join(categoryDir, dateDir);
   fs3.mkdirSync(dir, { recursive: true });
   const fileName = `${stmt.category}-${Date.now()}-${stmt.id.slice(0, 8)}.md`;
-  const filePath = path27.join(dir, fileName);
-  const historicalIds = historicalIdCache2.get(path27.join(memoryDir, "state"));
+  const filePath = path30.join(dir, fileName);
+  const historicalIds = historicalIdCache2.get(path30.join(memoryDir, "state"));
   const rawBody = `${[
     "---",
     `id: ${stmt.id}`,
@@ -23608,7 +25785,7 @@ ${stmt.content}
   fs3.writeFileSync(filePath, body);
   try {
     repairContentAfterJournalMoveSync({
-      stateDir: path27.join(memoryDir, "state"),
+      stateDir: path30.join(memoryDir, "state"),
       cache: historicalIdCache2,
       idsAtWrite: historicalIds,
       rawContent: rawBody,
@@ -23669,7 +25846,7 @@ function extractBody2(content) {
 }
 function walkFiles(dir, callback) {
   for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path27.join(dir, entry.name);
+    const fullPath = path30.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkFiles(fullPath, callback);
     } else if (entry.name.endsWith(".md")) {
@@ -23681,7 +25858,7 @@ function walkFiles(dir, callback) {
 // src/dedup/index.ts
 import crypto5 from "crypto";
 import fs4 from "fs";
-import path28 from "path";
+import path31 from "path";
 var DEFAULT_DEDUP_THRESHOLD = 0.85;
 var DEFAULT_MAX_LOAD = 1e4;
 function normalizeThreshold(value, defaultValue) {
@@ -23875,7 +26052,7 @@ function loadMemories(memoryDir, categories, maxLoad = 1e4) {
   const memoryRootReal = fs4.realpathSync(memoryDir);
   for (const category of allCategories) {
     if (result.length >= maxLoad) break;
-    const dir = path28.join(memoryDir, category);
+    const dir = path31.join(memoryDir, category);
     if (!fs4.existsSync(dir)) continue;
     const categoryStat = fs4.lstatSync(dir);
     if (categoryStat.isSymbolicLink()) {
@@ -23936,15 +26113,15 @@ function extractBody3(content) {
   return match ? match[1].trim() : content.trim();
 }
 function assertPathInsideRoot2(rootReal, targetReal, sourcePath) {
-  const rel = path28.relative(rootReal, targetReal);
-  if (rel === "" || !rel.startsWith("..") && !path28.isAbsolute(rel)) {
+  const rel = path31.relative(rootReal, targetReal);
+  if (rel === "" || !rel.startsWith("..") && !path31.isAbsolute(rel)) {
     return;
   }
   throw new Error(`Refusing to scan memory path outside root: ${sourcePath}`);
 }
 function walkMdFiles(dir, memoryRootReal, categoryRootReal, callback) {
   for (const entry of fs4.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path28.join(dir, entry.name);
+    const fullPath = path31.join(dir, entry.name);
     const entryStat = fs4.lstatSync(fullPath);
     if (entryStat.isSymbolicLink()) {
       throw new Error(`Refusing to scan symlinked memory path: ${fullPath}`);
@@ -23962,10 +26139,10 @@ function walkMdFiles(dir, memoryRootReal, categoryRootReal, callback) {
 
 // src/review/index.ts
 import fs5 from "fs";
-import path29 from "path";
+import path32 from "path";
 var historicalIdCache3 = new HistoricalEntityCanonicalIdCache();
 function writeReviewFileCanonicalized(memoryDir, filePath, content) {
-  const stateDir = path29.join(memoryDir, "state");
+  const stateDir = path32.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache3.get(stateDir);
   let originalBytes = null;
   try {
@@ -23999,21 +26176,21 @@ function writeReviewFileCanonicalized(memoryDir, filePath, content) {
 var DEFAULT_CONFIDENCE_THRESHOLD = 0.7;
 function realMemoryRoot(memoryDir) {
   try {
-    const stat5 = fs5.lstatSync(memoryDir);
-    if (!stat5.isDirectory() || stat5.isSymbolicLink()) return null;
+    const stat6 = fs5.lstatSync(memoryDir);
+    if (!stat6.isDirectory() || stat6.isSymbolicLink()) return null;
     return fs5.realpathSync(memoryDir);
   } catch {
     return null;
   }
 }
 function isPathInside2(rootReal, candidateReal) {
-  const relative = path29.relative(rootReal, candidateReal);
-  return relative === "" || !!relative && !relative.startsWith("..") && !path29.isAbsolute(relative);
+  const relative = path32.relative(rootReal, candidateReal);
+  return relative === "" || !!relative && !relative.startsWith("..") && !path32.isAbsolute(relative);
 }
 function isSafeDirectory(rootReal, dir) {
   try {
-    const stat5 = fs5.lstatSync(dir);
-    if (!stat5.isDirectory() || stat5.isSymbolicLink()) return false;
+    const stat6 = fs5.lstatSync(dir);
+    if (!stat6.isDirectory() || stat6.isSymbolicLink()) return false;
     return isPathInside2(rootReal, fs5.realpathSync(dir));
   } catch {
     return false;
@@ -24051,7 +26228,7 @@ function listReviewItems(options) {
     if (filterReason && item.reviewReason !== filterReason) return;
     items.push(item);
   };
-  const suggestionsDir = path29.join(memoryDir, "suggestions");
+  const suggestionsDir = path32.join(memoryDir, "suggestions");
   if (!isLimitReached() && fs5.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
     walkMd(rootReal, suggestionsDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -24072,7 +26249,7 @@ function listReviewItems(options) {
       return isLimitReached();
     });
   }
-  const reviewDir = path29.join(memoryDir, "review");
+  const reviewDir = path32.join(memoryDir, "review");
   if (!isLimitReached() && fs5.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
     walkMd(rootReal, reviewDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -24097,7 +26274,7 @@ function listReviewItems(options) {
   const categories = ALL_CATEGORY_DIRS;
   for (const category of categories) {
     if (isLimitReached()) break;
-    const dir = path29.join(memoryDir, category);
+    const dir = path32.join(memoryDir, category);
     if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     walkMd(rootReal, dir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -24179,9 +26356,9 @@ function approveItem(memoryDir, itemId, options) {
   const targetDir = getCategoryDir(memoryDir, category);
   const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   ensureSafeDirectory(rootReal, targetDir);
-  const outputPath = path29.join(targetDir, dateDir, path29.basename(found.filePath));
-  ensureSafeDirectory(rootReal, path29.dirname(outputPath));
-  const reviewStateDir = path29.join(memoryDir, "state");
+  const outputPath = path32.join(targetDir, dateDir, path32.basename(found.filePath));
+  ensureSafeDirectory(rootReal, path32.dirname(outputPath));
+  const reviewStateDir = path32.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache3.get(reviewStateDir);
   const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
   const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
@@ -24258,13 +26435,13 @@ function findReviewFileById(memoryDir, id, options = {}) {
   const rootReal = realMemoryRoot(memoryDir);
   if (!rootReal) return null;
   for (const loc of ["suggestions", "review"]) {
-    const dir = path29.join(memoryDir, loc);
+    const dir = path32.join(memoryDir, loc);
     if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id);
     if (found) return { filePath: found, location: "queue" };
   }
   for (const category of ALL_CATEGORY_DIRS) {
-    const dir = path29.join(memoryDir, category);
+    const dir = path32.join(memoryDir, category);
     if (!fs5.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
     if (found) return { filePath: found, location: "category" };
@@ -24340,10 +26517,10 @@ function readFileSafe3(filePath) {
   }
 }
 function writeFileWithoutClobber(basePath, content, discriminator) {
-  const parsed = path29.parse(basePath);
+  const parsed = path32.parse(basePath);
   const safeDiscriminator = sanitizeFilePart(discriminator);
   for (let attempt = 0; attempt < 1e3; attempt++) {
-    const candidate = attempt === 0 ? basePath : path29.join(
+    const candidate = attempt === 0 ? basePath : path32.join(
       parsed.dir,
       `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
     );
@@ -24399,7 +26576,7 @@ function extractBody4(content) {
 function walkMd(rootReal, dir, callback) {
   if (!isSafeDirectory(rootReal, dir)) return false;
   for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path29.join(dir, entry.name);
+    const fullPath = path32.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       if (walkMd(rootReal, fullPath, callback)) return true;
@@ -24414,7 +26591,7 @@ function walkMdPaths(rootReal, dir) {
   const results = [];
   if (!isSafeDirectory(rootReal, dir)) return results;
   for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path29.join(dir, entry.name);
+    const fullPath = path32.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       results.push(...walkMdPaths(rootReal, fullPath));
@@ -24427,7 +26604,7 @@ function walkMdPaths(rootReal, dir) {
 
 // src/sync/index.ts
 import fs6 from "fs";
-import path30 from "path";
+import path33 from "path";
 import crypto6 from "crypto";
 var DEFAULT_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".txt", ".mdx", ".rst"]);
 var DEFAULT_EXCLUDE2 = /* @__PURE__ */ new Set([
@@ -24449,7 +26626,7 @@ function syncChanges(options) {
   } = options;
   const extSet = new Set(extensions);
   const excludeSet = /* @__PURE__ */ new Set([...DEFAULT_EXCLUDE2, ...excludeDirs]);
-  const stateFilePath = options.stateFile ?? path30.join(memoryDir, ".sync-state.json");
+  const stateFilePath = options.stateFile ?? path33.join(memoryDir, ".sync-state.json");
   const prevState = loadState(stateFilePath);
   const currentFiles = scanFiles(sourceDir, extSet, excludeSet);
   const changes = computeDiff(currentFiles, prevState.fileHashes, sourceDir);
@@ -24465,7 +26642,7 @@ function syncChanges(options) {
     for (const [relPath, hash] of Object.entries(currentFiles)) {
       newState.fileHashes[relPath] = hash;
     }
-    fs6.mkdirSync(path30.dirname(stateFilePath), { recursive: true });
+    fs6.mkdirSync(path33.dirname(stateFilePath), { recursive: true });
     fs6.writeFileSync(stateFilePath, JSON.stringify(newState, null, 2));
   }
   return {
@@ -24531,13 +26708,13 @@ function scanFiles(root, extensions, exclude) {
     }
     for (const entry of entries) {
       if (exclude.has(entry.name)) continue;
-      const fullPath = path30.join(dir, entry.name);
+      const fullPath = path33.join(dir, entry.name);
       if (entry.isDirectory()) {
         walk(fullPath);
       } else if (entry.isFile()) {
-        const ext = path30.extname(entry.name).toLowerCase();
+        const ext = path33.extname(entry.name).toLowerCase();
         if (!extensions.has(ext)) continue;
-        const relPath = path30.relative(root, fullPath);
+        const relPath = path33.relative(root, fullPath);
         try {
           const content = fs6.readFileSync(fullPath, "utf8");
           result[relPath] = hashContent3(content);
@@ -24552,7 +26729,7 @@ function scanFiles(root, extensions, exclude) {
 function computeDiff(current, previous, sourceDir) {
   const changes = [];
   for (const [relPath, hash] of Object.entries(current)) {
-    const fullPath = path30.join(sourceDir, relPath);
+    const fullPath = path33.join(sourceDir, relPath);
     if (!(relPath in previous)) {
       let size = 0;
       try {
@@ -24585,7 +26762,7 @@ function computeDiff(current, previous, sourceDir) {
   for (const relPath of Object.keys(previous)) {
     if (!(relPath in current)) {
       changes.push({
-        filePath: path30.join(sourceDir, relPath),
+        filePath: path33.join(sourceDir, relPath),
         relativePath: relPath,
         type: "deleted",
         currentHash: "",
@@ -24615,21 +26792,21 @@ function hashContent3(content) {
 import { spawnSync } from "child_process";
 import crypto7 from "crypto";
 import fs7 from "fs";
-import path31 from "path";
+import path34 from "path";
 var historicalIdCache4 = new HistoricalEntityCanonicalIdCache();
 var MANIFEST_VERSION = 1;
 var MANIFEST_LOCK_STALE_MS = 3e4;
 var MANIFEST_LOCK_TIMEOUT_MS = MANIFEST_LOCK_STALE_MS + 1e4;
 var MANIFEST_LOCK_SLEEP_MS = 20;
 function normalizeSpaceMemoryDir(memoryDir) {
-  return path31.resolve(memoryDir);
+  return path34.resolve(memoryDir);
 }
 function getSpacesDir(baseDir) {
   const homeDir = baseDir ?? resolveHomeDir();
-  return path31.join(homeDir, ".config", "engram", "spaces");
+  return path34.join(homeDir, ".config", "engram", "spaces");
 }
 function getManifestPath(baseDir) {
-  return path31.join(getSpacesDir(baseDir), "manifest.json");
+  return path34.join(getSpacesDir(baseDir), "manifest.json");
 }
 function loadManifest(baseDir, memoryDirOverride) {
   if (fs7.existsSync(getManifestPath(baseDir))) {
@@ -24676,9 +26853,9 @@ function readManifestUnlocked(baseDir, memoryDirOverride, options = {}) {
 }
 function saveManifestUnlocked(manifest, baseDir) {
   const manifestPath2 = getManifestPath(baseDir);
-  const manifestDir2 = path31.dirname(manifestPath2);
+  const manifestDir2 = path34.dirname(manifestPath2);
   fs7.mkdirSync(manifestDir2, { recursive: true });
-  const tempPath = path31.join(manifestDir2, `.manifest.${process.pid}.${Date.now()}.${crypto7.randomUUID()}.tmp`);
+  const tempPath = path34.join(manifestDir2, `.manifest.${process.pid}.${Date.now()}.${crypto7.randomUUID()}.tmp`);
   try {
     fs7.writeFileSync(tempPath, `${JSON.stringify(manifest, null, 2)}
 `, { flag: "wx" });
@@ -24693,7 +26870,7 @@ function saveManifestUnlocked(manifest, baseDir) {
 }
 function withManifestLock(baseDir, operation) {
   const lockDir = `${getManifestPath(baseDir)}.lock`;
-  fs7.mkdirSync(path31.dirname(lockDir), { recursive: true });
+  fs7.mkdirSync(path34.dirname(lockDir), { recursive: true });
   const lockOwner = acquireManifestLock(lockDir);
   try {
     return operation();
@@ -24719,7 +26896,7 @@ function acquireManifestLock(lockDir) {
     try {
       fs7.mkdirSync(lockDir, { recursive: false });
       try {
-        fs7.writeFileSync(path31.join(lockDir, "owner"), `${owner}
+        fs7.writeFileSync(path34.join(lockDir, "owner"), `${owner}
 `, { flag: "wx" });
       } catch (error) {
         fs7.rmSync(lockDir, { recursive: true, force: true });
@@ -24749,7 +26926,7 @@ function acquireManifestLock(lockDir) {
 }
 function releaseManifestLock(lockDir, owner) {
   try {
-    const ownerPath = path31.join(lockDir, "owner");
+    const ownerPath = path34.join(lockDir, "owner");
     if (fs7.readFileSync(ownerPath, "utf8").trim() === owner) {
       fs7.rmSync(lockDir, { recursive: true, force: true });
     }
@@ -24765,7 +26942,7 @@ function removeStaleManifestLock(lockDir) {
   try {
     fs7.mkdirSync(reclaimDir, { recursive: false });
     try {
-      fs7.writeFileSync(path31.join(reclaimDir, "owner"), `${reclaimOwner}
+      fs7.writeFileSync(path34.join(reclaimDir, "owner"), `${reclaimOwner}
 `, { flag: "wx" });
     } catch (error) {
       fs7.rmSync(reclaimDir, { recursive: true, force: true });
@@ -24830,9 +27007,9 @@ function removeStaleManifestReclaimLock(reclaimDir) {
   fs7.rmSync(tombstoneDir, { recursive: true, force: true });
 }
 function readManifestLockSnapshot(lockDir) {
-  let stat5;
+  let stat6;
   try {
-    stat5 = fs7.statSync(lockDir);
+    stat6 = fs7.statSync(lockDir);
   } catch (error) {
     if (error.code === "ENOENT") {
       return void 0;
@@ -24840,11 +27017,11 @@ function readManifestLockSnapshot(lockDir) {
     throw error;
   }
   try {
-    const owner = fs7.readFileSync(path31.join(lockDir, "owner"), "utf8").trim();
-    return { mtimeMs: stat5.mtimeMs, owner };
+    const owner = fs7.readFileSync(path34.join(lockDir, "owner"), "utf8").trim();
+    return { mtimeMs: stat6.mtimeMs, owner };
   } catch (error) {
     if (error.code === "ENOENT") {
-      return { mtimeMs: stat5.mtimeMs };
+      return { mtimeMs: stat6.mtimeMs };
     }
     throw error;
   }
@@ -24912,8 +27089,8 @@ function sleepSync(ms) {
 }
 function createPersonalSpace(baseDir, memoryDirOverride) {
   const homeDir = baseDir ?? resolveHomeDir();
-  const standalonePath = path31.join(homeDir, ".engram", "memory");
-  const openclawPath = path31.join(homeDir, ".openclaw", "workspace", "memory", "local");
+  const standalonePath = path34.join(homeDir, ".engram", "memory");
+  const openclawPath = path34.join(homeDir, ".openclaw", "workspace", "memory", "local");
   const memoryDir = memoryDirOverride ?? readEnvVar("REMNIC_MEMORY_DIR") ?? readEnvVar("ENGRAM_MEMORY_DIR") ?? (fs7.existsSync(standalonePath) ? standalonePath : fs7.existsSync(openclawPath) ? openclawPath : standalonePath);
   const normalizedMemoryDir = normalizeSpaceMemoryDir(memoryDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -24942,7 +27119,7 @@ function createSpace(options) {
   const id = options.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-");
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const memoryDir = normalizeSpaceMemoryDir(
-    options.memoryDir ?? path31.join(getSpacesDir(options.baseDir), id, "memory")
+    options.memoryDir ?? path34.join(getSpacesDir(options.baseDir), id, "memory")
   );
   const space = updateManifest(options.baseDir, (manifest) => {
     if (manifest.spaces.some((s) => s.id === id)) {
@@ -25163,14 +27340,14 @@ async function mergeSpaces(sourceSpaceId, targetSpaceId, options) {
   };
 }
 function getAuditLog(baseDir) {
-  const auditPath = path31.join(getSpacesDir(baseDir), "audit.jsonl");
+  const auditPath = path34.join(getSpacesDir(baseDir), "audit.jsonl");
   if (!fs7.existsSync(auditPath)) return [];
   const lines = fs7.readFileSync(auditPath, "utf8").trim().split("\n");
   return lines.filter((l) => l.trim()).map((l) => JSON.parse(l));
 }
 function appendAudit(entry, baseDir) {
-  const auditPath = path31.join(getSpacesDir(baseDir), "audit.jsonl");
-  fs7.mkdirSync(path31.dirname(auditPath), { recursive: true });
+  const auditPath = path34.join(getSpacesDir(baseDir), "audit.jsonl");
+  fs7.mkdirSync(path34.dirname(auditPath), { recursive: true });
   const full = {
     id: crypto7.randomUUID(),
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -25191,11 +27368,11 @@ async function copyMemories(sourceDir, targetDir, options) {
     sourceFiles.filter((p) => {
       const rp = safeRealpath(p);
       if (!rp || !isPathInsideRoot(rp, sourceRoot)) return false;
-      const rel = path31.relative(sourceRoot, rp);
-      const mapped = path31.resolve(targetRoot, rel);
+      const rel = path34.relative(sourceRoot, rp);
+      const mapped = path34.resolve(targetRoot, rel);
       if (!isPathInsideRoot(mapped, targetRoot)) return false;
       return classifyEntityRefWritePath(targetRoot, mapped) === "entity";
-    }).map((p) => path31.basename(p, ".md"))
+    }).map((p) => path34.basename(p, ".md"))
   );
   const firstEntityId = sourceEntityIds.values().next().value;
   if (firstEntityId === void 0) {
@@ -25203,7 +27380,7 @@ async function copyMemories(sourceDir, targetDir, options) {
   }
   return withRawEntityPageMutation(
     targetRoot,
-    path31.join(targetRoot, "entities", `${firstEntityId}.md`),
+    path34.join(targetRoot, "entities", `${firstEntityId}.md`),
     async () => copyPreparedMemories(
       sourceFiles,
       sourceRoot,
@@ -25230,14 +27407,14 @@ function copyPreparedMemories(sourceFiles, sourceRoot, targetRoot, sourceEntityI
       continue;
     }
     const content = fs7.readFileSync(sourcePath, "utf8");
-    const relativePath = path31.relative(sourceRoot, sourceRealPath);
-    const targetPath = path31.resolve(targetRoot, relativePath);
+    const relativePath = path34.relative(sourceRoot, sourceRealPath);
+    const targetPath = path34.resolve(targetRoot, relativePath);
     if (!isPathInsideRoot(targetPath, targetRoot)) {
       skipped++;
       continue;
     }
     const targetKind = classifyEntityRefWritePath(targetRoot, targetPath);
-    const idsAtCompare = historicalIdCache4.get(path31.join(targetRoot, "state"));
+    const idsAtCompare = historicalIdCache4.get(path34.join(targetRoot, "state"));
     const sourceRef = targetKind === "memory" ? readEntityRefFromFrontmatter(content) : null;
     const refHasSourceClaimant = sourceRef !== null && sourceEntityIds.has(sourceRef);
     const canonicalContent = targetKind === "memory" && !refHasSourceClaimant ? canonicalizeEntityRefFrontmatter(content, idsAtCompare) : content;
@@ -25264,7 +27441,7 @@ function copyPreparedMemories(sourceFiles, sourceRoot, targetRoot, sourceEntityI
     if (fs7.existsSync(targetPath) && !options?.force) {
       const targetContent = fs7.readFileSync(targetPath, "utf8");
       const targetHash = hashContent4(targetContent);
-      if (hashContent4(canonicalContent) === targetHash && historicalIdCache4.get(path31.join(targetRoot, "state")) === idsAtCompare) {
+      if (hashContent4(canonicalContent) === targetHash && historicalIdCache4.get(path34.join(targetRoot, "state")) === idsAtCompare) {
         skipped++;
         continue;
       }
@@ -25280,13 +27457,13 @@ function copyPreparedMemories(sourceFiles, sourceRoot, targetRoot, sourceEntityI
         continue;
       }
     }
-    fs7.mkdirSync(path31.dirname(targetPath), { recursive: true });
-    const targetParentRealPath = safeRealpath(path31.dirname(targetPath));
+    fs7.mkdirSync(path34.dirname(targetPath), { recursive: true });
+    const targetParentRealPath = safeRealpath(path34.dirname(targetPath));
     if (!targetParentRealPath || !isPathInsideRoot(targetParentRealPath, targetRoot)) {
       skipped++;
       continue;
     }
-    const stateDir = path31.join(targetRoot, "state");
+    const stateDir = path34.join(targetRoot, "state");
     if (targetKind === "memory" && !refHasSourceClaimant) {
       const idsAtWrite = historicalIdCache4.get(stateDir);
       const written = canonicalizeEntityRefFrontmatter(content, idsAtWrite);
@@ -25330,7 +27507,7 @@ function copyPreparedMemories(sourceFiles, sourceRoot, targetRoot, sourceEntityI
     bumpMemoryCorpusVersionForDir(targetRoot);
   }
   if (reconcileNeeded) {
-    requestEntityCanonicalIdReconcileSync(path31.join(targetRoot, "state"));
+    requestEntityCanonicalIdReconcileSync(path34.join(targetRoot, "state"));
   }
   return { merged, conflicts, skipped };
 }
@@ -25341,7 +27518,7 @@ function walkMd2(dir) {
   const results = [];
   function walk(d) {
     for (const entry of fs7.readdirSync(d, { withFileTypes: true })) {
-      const fullPath = path31.join(d, entry.name);
+      const fullPath = path34.join(d, entry.name);
       if (entry.isSymbolicLink()) {
         continue;
       }
@@ -25370,8 +27547,8 @@ function safeRealpath(filePath) {
   }
 }
 function isPathInsideRoot(candidatePath, rootPath) {
-  const relative = path31.relative(rootPath, candidatePath);
-  return relative === "" || !relative.startsWith("..") && !path31.isAbsolute(relative);
+  const relative = path34.relative(rootPath, candidatePath);
+  return relative === "" || !relative.startsWith("..") && !path34.isAbsolute(relative);
 }
 function parseSimpleFrontmatter(content) {
   const match = content.match(/^---\n([\s\S]*?)\n---/);
@@ -25492,7 +27669,7 @@ var REMNIC_RECALL_DECISION_RULES = `## When to Use Recall vs Direct Read
 // src/memory-extension/codex-publisher.ts
 import fs8 from "fs";
 import os from "os";
-import path32 from "path";
+import path35 from "path";
 var REMNIC_EXTENSION_DIR_NAME = "remnic";
 function resolveEnvHome(env) {
   if (env === void 0) return resolveHomeDir();
@@ -25501,12 +27678,12 @@ function resolveEnvHome(env) {
 function expandTildeWithHome(input, homeDir) {
   if (input === "~") return homeDir;
   if (input.startsWith("~/") || input.startsWith("~\\")) {
-    return path32.join(homeDir, input.slice(2));
+    return path35.join(homeDir, input.slice(2));
   }
   return input;
 }
 function normalizeHostRoot(input, homeDir) {
-  return path32.resolve(expandTildeWithHome(input.trim(), homeDir));
+  return path35.resolve(expandTildeWithHome(input.trim(), homeDir));
 }
 var CodexMemoryExtensionPublisher = class {
   hostId = "codex";
@@ -25520,12 +27697,12 @@ var CodexMemoryExtensionPublisher = class {
   async resolveExtensionRoot(env) {
     const homeDir = resolveEnvHome(env);
     const codexHomeInput = env === void 0 ? readEnvVar("CODEX_HOME")?.trim() : env.CODEX_HOME?.trim();
-    const codexHome = codexHomeInput ? normalizeHostRoot(codexHomeInput, homeDir) : path32.resolve(homeDir, ".codex");
-    return path32.join(codexHome, "memories_extensions", REMNIC_EXTENSION_DIR_NAME);
+    const codexHome = codexHomeInput ? normalizeHostRoot(codexHomeInput, homeDir) : path35.resolve(homeDir, ".codex");
+    return path35.join(codexHome, "memories_extensions", REMNIC_EXTENSION_DIR_NAME);
   }
   async isHostAvailable() {
     try {
-      const home = readEnvVar("CODEX_HOME")?.trim() || path32.join(resolveHomeDir(), ".codex");
+      const home = readEnvVar("CODEX_HOME")?.trim() || path35.join(resolveHomeDir(), ".codex");
       return fs8.existsSync(home);
     } catch {
       return false;
@@ -25576,7 +27753,7 @@ When running inside the Codex phase-2 consolidation sandbox:
   }
   async publish(ctx) {
     const extensionRoot = await this.resolveExtensionRoot();
-    const instructionsPath = path32.join(extensionRoot, "instructions.md");
+    const instructionsPath = path35.join(extensionRoot, "instructions.md");
     const filesWritten = [];
     const skipped = [];
     ctx.log.info(`Publishing Codex memory extension to ${extensionRoot}`);
@@ -25950,9 +28127,9 @@ async function generateActivityMemories(date, digestBody, config, deps) {
 }
 
 // src/session-summaries/index.ts
-import { createHash as createHash9 } from "crypto";
-import { lstat as lstat3, mkdir as mkdir7, readFile as readFile7, readdir as readdir4, rename, rm, stat as stat4, writeFile as writeFile7 } from "fs/promises";
-import path33 from "path";
+import { createHash as createHash11 } from "crypto";
+import { lstat as lstat5, mkdir as mkdir8, readFile as readFile7, readdir as readdir5, rename as rename2, rm as rm2, stat as stat5, writeFile as writeFile7 } from "fs/promises";
+import path36 from "path";
 
 // src/session-summaries/adapters.ts
 var VALID_ROLES = /* @__PURE__ */ new Set(["user", "assistant", "tool", "system", "other"]);
@@ -26452,28 +28629,28 @@ var DEFAULT_MAX_FILES = 5e3;
 var DEFAULT_MAX_SESSIONS = 500;
 var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".jsonl"]);
 function shortHash(value, length = 16) {
-  return createHash9("sha256").update(value).digest("hex").slice(0, length);
+  return createHash11("sha256").update(value).digest("hex").slice(0, length);
 }
 async function listTranscriptFiles(root, maxFiles) {
   const out = [];
   let truncated = false;
-  const entrySortKey = (entryName, isDirectory) => isDirectory ? `${entryName}${path33.sep}` : entryName;
+  const entrySortKey = (entryName, isDirectory) => isDirectory ? `${entryName}${path36.sep}` : entryName;
   async function visit(dir) {
     if (truncated) return;
-    const entries = (await readdir4(dir, { withFileTypes: true })).sort(
+    const entries = (await readdir5(dir, { withFileTypes: true })).sort(
       (a, b) => entrySortKey(a.name, a.isDirectory()).localeCompare(entrySortKey(b.name, b.isDirectory()))
     );
     for (const entry of entries) {
       if (truncated) return;
       if (entry.name.startsWith(".")) continue;
       if (entry.isSymbolicLink()) continue;
-      const fullPath = path33.join(dir, entry.name);
+      const fullPath = path36.join(dir, entry.name);
       if (entry.isDirectory()) {
         await visit(fullPath);
         continue;
       }
       if (!entry.isFile()) continue;
-      const ext = path33.extname(entry.name).toLowerCase();
+      const ext = path36.extname(entry.name).toLowerCase();
       if (!SUPPORTED_EXTENSIONS.has(ext)) continue;
       out.push(fullPath);
       if (out.length > maxFiles) {
@@ -26500,7 +28677,7 @@ function normalizeInputDir(inputDir) {
   if (typeof inputDir !== "string" || inputDir.trim().length === 0) {
     throw new Error("inputDir must be a non-empty string");
   }
-  return path33.resolve(expandTildePath(inputDir.trim()));
+  return path36.resolve(expandTildePath(inputDir.trim()));
 }
 function initRoleCounts() {
   return {
@@ -26595,11 +28772,11 @@ function buildDraft(options) {
 }
 async function collectLocalSessionSummaries(options) {
   const inputDir = normalizeInputDir(options.inputDir);
-  const inputLstat = await lstat3(inputDir);
+  const inputLstat = await lstat5(inputDir);
   if (inputLstat.isSymbolicLink()) {
     throw new Error(`inputDir must not be a symbolic link: ${options.inputDir}`);
   }
-  const inputStat = await stat4(inputDir);
+  const inputStat = await stat5(inputDir);
   if (!inputStat.isDirectory()) {
     throw new Error(`inputDir must be a directory: ${options.inputDir}`);
   }
@@ -26657,11 +28834,11 @@ async function collectLocalSessionSummaries(options) {
       continue;
     }
     seenFileHashes.add(fileHash);
-    const fileExtension = path33.extname(filePath).toLowerCase();
+    const fileExtension = path36.extname(filePath).toLowerCase();
     const parsed = await adapter.parseFile(
       {
         content,
-        fileName: path33.basename(filePath),
+        fileName: path36.basename(filePath),
         fileExtension,
         fileRef: fileHash
       },
@@ -26717,7 +28894,7 @@ async function collectLocalSessionSummaries(options) {
 }
 async function readRedactionConfig(pathLike) {
   if (!pathLike) return void 0;
-  const raw = await readFile7(path33.resolve(expandTildePath(pathLike)), "utf-8");
+  const raw = await readFile7(path36.resolve(expandTildePath(pathLike)), "utf-8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error("redaction config must be a JSON object");
@@ -26730,21 +28907,21 @@ function toJsonl(drafts) {
 }
 function defaultDraftOutputPath(memoryDir, generatedAt) {
   const stamp = generatedAt.replace(/[:.]/g, "-");
-  return path33.join(
-    path33.resolve(expandTildePath(memoryDir)),
+  return path36.join(
+    path36.resolve(expandTildePath(memoryDir)),
     "state",
     "session-summary-drafts",
     `session-summaries-${stamp}.jsonl`
   );
 }
 async function writeDrafts(filePath, drafts) {
-  await mkdir7(path33.dirname(filePath), { recursive: true });
+  await mkdir8(path36.dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
     await writeFile7(tempPath, toJsonl(drafts), "utf-8");
-    await rename(tempPath, filePath);
+    await rename2(tempPath, filePath);
   } catch (error) {
-    await rm(tempPath, { force: true });
+    await rm2(tempPath, { force: true });
     throw error;
   }
 }
@@ -26756,7 +28933,7 @@ async function runLocalSessionSummaryCliCommand(options) {
   });
   const wroteFiles = [];
   if (options.output) {
-    const outputPath = path33.resolve(expandTildePath(options.output));
+    const outputPath = path36.resolve(expandTildePath(options.output));
     await writeDrafts(outputPath, report.drafts);
     wroteFiles.push(outputPath);
   }
@@ -26790,20 +28967,20 @@ async function runLocalSessionSummaryCliCommand(options) {
 }
 
 // src/transfer/capsule-fork.ts
-import { lstat as lstat4, mkdir as mkdir8, readFile as readFile8, realpath as realpath3, writeFile as writeFile8 } from "fs/promises";
-import path34 from "path";
+import { lstat as lstat6, mkdir as mkdir9, readFile as readFile8, realpath as realpath3, writeFile as writeFile8 } from "fs/promises";
+import path37 from "path";
 async function forkCapsule(opts) {
   validateForkId(opts.forkId);
-  const rootAbs = path34.resolve(opts.targetRoot);
+  const rootAbs = path37.resolve(opts.targetRoot);
   await assertIsDirectoryNotSymlink(rootAbs, "forkCapsule", "targetRoot");
-  const forkDirAbs = path34.join(rootAbs, "forks", opts.forkId);
+  const forkDirAbs = path37.join(rootAbs, "forks", opts.forkId);
   const forkEntryExists = await pathEntryExists(forkDirAbs);
   if (forkEntryExists) {
     throw new Error(
       `forkCapsule: fork path already exists \u2014 forkId "${opts.forkId}" is already in use at: ${forkDirAbs}`
     );
   }
-  const archiveAbs = path34.resolve(opts.sourceArchive);
+  const archiveAbs = path37.resolve(opts.sourceArchive);
   const importResult = await importCapsule({
     archivePath: archiveAbs,
     root: rootAbs,
@@ -26825,10 +29002,10 @@ async function forkCapsule(opts) {
     importedRecords: importResult.imported.length,
     skippedRecords: importResult.skipped.length
   };
-  const lineagePath = path34.join(forkDirAbs, "lineage.json");
+  const lineagePath = path37.join(forkDirAbs, "lineage.json");
   const rootReal = await realpath3(rootAbs);
   await assertRealpathInsideRoot(rootReal, lineagePath, `forks/${opts.forkId}/lineage.json`, "forkCapsule");
-  await mkdir8(path34.dirname(lineagePath), { recursive: true });
+  await mkdir9(path37.dirname(lineagePath), { recursive: true });
   await writeFile8(lineagePath, JSON.stringify(lineage, null, 2) + "\n", "utf-8");
   return {
     archivePath: archiveAbs,
@@ -26842,11 +29019,11 @@ async function readForkLineage(targetRoot, forkId) {
   if (typeof forkId !== "string" || forkId.length === 0 || forkId.length > 64 || !CAPSULE_ID_PATTERN.test(forkId)) {
     return null;
   }
-  const rootAbs = path34.resolve(targetRoot);
+  const rootAbs = path37.resolve(targetRoot);
   const rootReal = await realpath3(rootAbs).catch(() => rootAbs);
-  const lineagePath = path34.join(rootReal, "forks", forkId, "lineage.json");
-  const rel = path34.relative(rootReal, lineagePath);
-  if (rel.startsWith("..") || path34.isAbsolute(rel)) {
+  const lineagePath = path37.join(rootReal, "forks", forkId, "lineage.json");
+  const rel = path37.relative(rootReal, lineagePath);
+  if (rel.startsWith("..") || path37.isAbsolute(rel)) {
     return null;
   }
   if (!await isLineagePathContained(rootReal, lineagePath)) {
@@ -26881,30 +29058,45 @@ function validateForkId(forkId) {
   }
 }
 async function pathEntryExists(absPath) {
-  const st = await lstat4(absPath).catch(() => null);
+  const st = await lstat6(absPath).catch(() => null);
   return st !== null;
 }
 async function isLineagePathContained(rootReal, lineagePath) {
   let existing = lineagePath;
   const suffix = [];
-  while (existing !== path34.dirname(existing)) {
-    const st = await lstat4(existing).catch(() => null);
+  while (existing !== path37.dirname(existing)) {
+    const st = await lstat6(existing).catch(() => null);
     if (st !== null) break;
-    suffix.unshift(path34.basename(existing));
-    existing = path34.dirname(existing);
+    suffix.unshift(path37.basename(existing));
+    existing = path37.dirname(existing);
   }
   const existingReal = await realpath3(existing).catch(() => existing);
-  const targetReal = suffix.length > 0 ? path34.join(existingReal, ...suffix) : existingReal;
-  const rel = path34.relative(rootReal, targetReal);
+  const targetReal = suffix.length > 0 ? path37.join(existingReal, ...suffix) : existingReal;
+  const rel = path37.relative(rootReal, targetReal);
   if (rel === "") return true;
   if (rel === "..") return false;
-  if (rel.startsWith(`..${path34.sep}`)) return false;
-  if (path34.isAbsolute(rel)) return false;
+  if (rel.startsWith(`..${path37.sep}`)) return false;
+  if (path37.isAbsolute(rel)) return false;
   return true;
 }
 
 export {
   buildProcedureRecallSection,
+  SupportPassportError,
+  SupportPassportCardService,
+  SupportPassportGrantCardRefSchema,
+  SupportPassportGrantStateSchema,
+  SupportPassportCreateGrantInputSchema,
+  SupportPassportOwnerGrantSchema,
+  SupportPassportCreatedGrantSchema,
+  SupportPassportPublicCardSchema,
+  SupportPassportPublicGuideSchema,
+  SupportPassportRevokeGrantInputSchema,
+  SupportPassportListGrantsInputSchema,
+  notifySupportPassportCommitted,
+  syncDirectoryForDurability,
+  SupportPassportGrantStore,
+  SupportPassportGrantService,
   RELAY_DEMO_MISSION_ID,
   RELAY_DEMO_NAMESPACE,
   createRelayMissionFixture,
@@ -27018,4 +29210,4 @@ export {
   blendGraphExpandedRecallScore,
   Orchestrator
 };
-//# sourceMappingURL=chunk-CYF6WVE7.js.map
+//# sourceMappingURL=chunk-7HG7MGAP.js.map