@remnic/core 9.54.4 → 9.54.6

package/dist/{chunk-3JLPGJ43.js → chunk-MIH3CJPN.js}

@@ -1,9 +1,9 @@
-import {
-  namespaceCollectionName
-} from "./chunk-VMMQDEN5.js";
 import {
   NamespaceStorageRouter
-} from "./chunk-WDBX6VER.js";
+} from "./chunk-UPLZNJKN.js";
+import {
+  namespaceCollectionName
+} from "./chunk-TO7ZTWJW.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -213,4 +213,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-3JLPGJ43.js.map
+//# sourceMappingURL=chunk-MIH3CJPN.js.map

package/dist/{chunk-QHFV6VNU.js → chunk-MK5VEWCR.js}

@@ -1,6 +1,6 @@
 import {
   isRecallDisclosure
-} from "./chunk-UU3G6GUP.js";
+} from "./chunk-76JJSXK7.js";
 import {
   normalizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -301,4 +301,4 @@ export {
   RecallXrayBuilder,
   summarizeDisclosureTokens
 };
-//# sourceMappingURL=chunk-QHFV6VNU.js.map
+//# sourceMappingURL=chunk-MK5VEWCR.js.map

package/dist/chunk-NISZQW72.js

@@ -0,0 +1,140 @@
+import {
+  SupportPassportError,
+  SupportPassportOwnerCreateGrantRequestSchema,
+  getOperation
+} from "./chunk-D3LBIUWV.js";
+
+// src/support-passport/access-http.ts
+var OWNER_ROOT = "/engram/v1/support-passport";
+var SUPPORT_PASSPORT_OWNER_HTTP_ROUTES = [
+  { method: "GET", pathname: `${OWNER_ROOT}/cards`, operation: "support_passport_cards_list" },
+  { method: "POST", pathname: `${OWNER_ROOT}/drafts`, operation: "support_passport_draft_create" },
+  { method: "POST", pathname: `${OWNER_ROOT}/drafts/generate`, operation: "support_passport_drafts_generate" },
+  { method: "GET", pathname: `${OWNER_ROOT}/grants`, operation: "support_passport_grants_list" },
+  { method: "POST", pathname: `${OWNER_ROOT}/grants`, operation: "support_passport_grant_create" },
+  { method: "GET", pathname: `${OWNER_ROOT}/memories/:id`, operation: "support_passport_memory_preview" },
+  { method: "PUT", pathname: `${OWNER_ROOT}/cards/:id`, operation: "support_passport_card_replace" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/approve`, operation: "support_passport_card_approve" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/reject`, operation: "support_passport_card_reject" },
+  { method: "POST", pathname: `${OWNER_ROOT}/cards/:id/withdraw`, operation: "support_passport_card_withdraw" },
+  { method: "POST", pathname: `${OWNER_ROOT}/grants/:id/revoke`, operation: "support_passport_grant_revoke" }
+];
+function decodeId(value, label) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    throw new SupportPassportError("invalid_input", `${label} is invalid.`, 400);
+  }
+}
+function closeUnreadRequestAfterResponse(req, res) {
+  const contentLength = req.headers["content-length"];
+  const declaresBody = req.headers["transfer-encoding"] !== void 0 || contentLength !== void 0 && contentLength !== "0";
+  if (!declaresBody || req.readableEnded || req.destroyed) return;
+  res.shouldKeepAlive = false;
+  res.setHeader("connection", "close");
+  res.once("finish", () => req.destroy());
+}
+async function runOperation(name, input, dependencies, recordWriteCommit) {
+  const operation = getOperation(name);
+  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);
+  const output = await operation.run(input, {
+    service: dependencies.service,
+    authenticatedPrincipal: dependencies.principal,
+    abortSignal: dependencies.abortSignal,
+    ...recordWriteCommit ? { hooks: { recordWriteCommit } } : {}
+  });
+  return output.result;
+}
+async function runWrite(name, input, dependencies) {
+  const writeQuota = dependencies.reserveWriteRateLimitSlot();
+  try {
+    const result = await runOperation(name, input, dependencies, writeQuota.commit);
+    writeQuota.commit();
+    return result;
+  } catch (error) {
+    writeQuota.release();
+    throw error;
+  }
+}
+async function handleSupportPassportOwnerHttp(dependencies) {
+  const { req, pathname } = dependencies;
+  try {
+    let operation;
+    let input = {};
+    let quotaLimitedWrite = false;
+    if (req.method === "GET" && pathname === `${OWNER_ROOT}/cards`) {
+      operation = "support_passport_cards_list";
+    } else if (req.method === "POST" && pathname === `${OWNER_ROOT}/drafts`) {
+      operation = "support_passport_draft_create";
+      quotaLimitedWrite = true;
+    } else if (req.method === "POST" && pathname === `${OWNER_ROOT}/drafts/generate`) {
+      operation = "support_passport_drafts_generate";
+      quotaLimitedWrite = true;
+    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === "GET") {
+      operation = "support_passport_grants_list";
+    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === "POST") {
+      operation = "support_passport_grant_create";
+      quotaLimitedWrite = true;
+    } else {
+      const memoryMatch = new RegExp(`^${OWNER_ROOT}/memories/([^/]+)$`).exec(pathname);
+      const cardMatch = new RegExp(`^${OWNER_ROOT}/cards/([^/]+)(?:/(approve|reject|withdraw))?$`).exec(pathname);
+      const grantMatch = new RegExp(`^${OWNER_ROOT}/grants/([^/]+)/revoke$`).exec(pathname);
+      if (memoryMatch && req.method === "GET") {
+        operation = "support_passport_memory_preview";
+        input.memoryId = decodeId(memoryMatch[1] ?? "", "memoryId");
+      } else if (cardMatch && req.method === "PUT" && !cardMatch[2]) {
+        operation = "support_passport_card_replace";
+        input.cardId = decodeId(cardMatch[1] ?? "", "cardId");
+        quotaLimitedWrite = true;
+      } else if (cardMatch && req.method === "POST" && cardMatch[2]) {
+        operation = `support_passport_card_${cardMatch[2]}`;
+        input.cardId = decodeId(cardMatch[1] ?? "", "cardId");
+        quotaLimitedWrite = true;
+      } else if (grantMatch && req.method === "POST") {
+        operation = "support_passport_grant_revoke";
+        input.grantId = decodeId(grantMatch[1] ?? "", "grantId");
+        quotaLimitedWrite = true;
+      }
+    }
+    if (!operation) return false;
+    dependencies.res.setHeader("cache-control", "private, no-store");
+    dependencies.res.setHeader("vary", "Authorization");
+    if (dependencies.hasQuery) {
+      throw new SupportPassportError("invalid_input", "Support passport routes do not accept query values.", 400);
+    }
+    if (req.method !== "GET") {
+      const body = await dependencies.readJsonBody();
+      for (const pathField of Object.keys(input)) {
+        if (Object.hasOwn(body, pathField)) {
+          throw new SupportPassportError("invalid_input", `${pathField} belongs in the URL path.`, 400);
+        }
+      }
+      input = { ...input, ...body };
+    }
+    if (operation === "support_passport_drafts_generate" && !Object.hasOwn(input, "sourceMemoryRevisions")) {
+      throw new SupportPassportError("invalid_input", "Review the selected notes again before drafting.", 400);
+    }
+    if (operation === "support_passport_grant_create") {
+      const grant = SupportPassportOwnerCreateGrantRequestSchema.safeParse(input);
+      if (!grant.success) throw new SupportPassportError("invalid_input", "The share link request is invalid.", 400);
+      input = {
+        cardIds: grant.data.cardIds,
+        cardRevisions: grant.data.cardRevisions,
+        ...grant.data.expiresAt !== void 0 ? { expiresAt: grant.data.expiresAt } : { durationMs: grant.data.durationMs }
+      };
+    }
+    const result = quotaLimitedWrite ? await runWrite(operation, input, dependencies) : await runOperation(operation, input, dependencies);
+    dependencies.respondJson(200, result);
+  } catch (error) {
+    if (!(error instanceof SupportPassportError)) throw error;
+    closeUnreadRequestAfterResponse(req, dependencies.res);
+    dependencies.respondJson(error.status, { error: error.message, code: error.code });
+  }
+  return true;
+}
+
+export {
+  SUPPORT_PASSPORT_OWNER_HTTP_ROUTES,
+  handleSupportPassportOwnerHttp
+};
+//# sourceMappingURL=chunk-NISZQW72.js.map

package/dist/chunk-NISZQW72.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/support-passport/access-http.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\n\nimport { type OperationName, getOperation } from \"../access-boundary.js\";\nimport type { EngramAccessService } from \"../access-service.js\";\nimport { SupportPassportError } from \"./errors.js\";\nimport { SupportPassportOwnerCreateGrantRequestSchema } from \"./grant-contracts.js\";\n\nexport interface SupportPassportOwnerHttpDependencies {\n  req: IncomingMessage;\n  res: ServerResponse;\n  pathname: string;\n  hasQuery: boolean;\n  service: EngramAccessService;\n  principal?: string;\n  abortSignal: AbortSignal;\n  readJsonBody(): Promise<Record<string, unknown>>;\n  respondJson(status: number, payload: unknown): void;\n  reserveWriteRateLimitSlot(): { commit(): void; release(): void };\n}\n\nconst OWNER_ROOT = \"/engram/v1/support-passport\";\n\nexport const SUPPORT_PASSPORT_OWNER_HTTP_ROUTES = [\n  { method: \"GET\", pathname: `${OWNER_ROOT}/cards`, operation: \"support_passport_cards_list\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/drafts`, operation: \"support_passport_draft_create\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/drafts/generate`, operation: \"support_passport_drafts_generate\" },\n  { method: \"GET\", pathname: `${OWNER_ROOT}/grants`, operation: \"support_passport_grants_list\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/grants`, operation: \"support_passport_grant_create\" },\n  { method: \"GET\", pathname: `${OWNER_ROOT}/memories/:id`, operation: \"support_passport_memory_preview\" },\n  { method: \"PUT\", pathname: `${OWNER_ROOT}/cards/:id`, operation: \"support_passport_card_replace\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/cards/:id/approve`, operation: \"support_passport_card_approve\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/cards/:id/reject`, operation: \"support_passport_card_reject\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/cards/:id/withdraw`, operation: \"support_passport_card_withdraw\" },\n  { method: \"POST\", pathname: `${OWNER_ROOT}/grants/:id/revoke`, operation: \"support_passport_grant_revoke\" },\n] as const satisfies ReadonlyArray<{ method: string; pathname: string; operation: OperationName }>;\n\nfunction decodeId(value: string, label: string): string {\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    throw new SupportPassportError(\"invalid_input\", `${label} is invalid.`, 400);\n  }\n}\n\nfunction closeUnreadRequestAfterResponse(req: IncomingMessage, res: ServerResponse): void {\n  const contentLength = req.headers[\"content-length\"];\n  const declaresBody =\n    req.headers[\"transfer-encoding\"] !== undefined ||\n    (contentLength !== undefined && contentLength !== \"0\");\n  if (!declaresBody || req.readableEnded || req.destroyed) return;\n  res.shouldKeepAlive = false;\n  res.setHeader(\"connection\", \"close\");\n  res.once(\"finish\", () => req.destroy());\n}\n\nasync function runOperation(\n  name: OperationName,\n  input: Record<string, unknown>,\n  dependencies: SupportPassportOwnerHttpDependencies,\n  recordWriteCommit?: () => void\n): Promise<unknown> {\n  const operation = getOperation(name);\n  if (!operation) throw new Error(`access-boundary: operation not registered: ${name}`);\n  const output = (await operation.run(input, {\n    service: dependencies.service,\n    authenticatedPrincipal: dependencies.principal,\n    abortSignal: dependencies.abortSignal,\n    ...(recordWriteCommit ? { hooks: { recordWriteCommit } } : {}),\n  })) as { result: unknown };\n  return output.result;\n}\n\nasync function runWrite(\n  name: OperationName,\n  input: Record<string, unknown>,\n  dependencies: SupportPassportOwnerHttpDependencies\n): Promise<unknown> {\n  const writeQuota = dependencies.reserveWriteRateLimitSlot();\n  try {\n    const result = await runOperation(name, input, dependencies, writeQuota.commit);\n    writeQuota.commit();\n    return result;\n  } catch (error) {\n    writeQuota.release();\n    throw error;\n  }\n}\n\nexport async function handleSupportPassportOwnerHttp(\n  dependencies: SupportPassportOwnerHttpDependencies\n): Promise<boolean> {\n  const { req, pathname } = dependencies;\n  try {\n    let operation: OperationName | undefined;\n    let input: Record<string, unknown> = {};\n    let quotaLimitedWrite = false;\n\n    if (req.method === \"GET\" && pathname === `${OWNER_ROOT}/cards`) {\n      operation = \"support_passport_cards_list\";\n    } else if (req.method === \"POST\" && pathname === `${OWNER_ROOT}/drafts`) {\n      operation = \"support_passport_draft_create\";\n      quotaLimitedWrite = true;\n    } else if (req.method === \"POST\" && pathname === `${OWNER_ROOT}/drafts/generate`) {\n      operation = \"support_passport_drafts_generate\";\n      quotaLimitedWrite = true;\n    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === \"GET\") {\n      operation = \"support_passport_grants_list\";\n    } else if (pathname === `${OWNER_ROOT}/grants` && req.method === \"POST\") {\n      operation = \"support_passport_grant_create\";\n      quotaLimitedWrite = true;\n    } else {\n      const memoryMatch = new RegExp(`^${OWNER_ROOT}/memories/([^/]+)$`).exec(pathname);\n      const cardMatch = new RegExp(`^${OWNER_ROOT}/cards/([^/]+)(?:/(approve|reject|withdraw))?$`).exec(pathname);\n      const grantMatch = new RegExp(`^${OWNER_ROOT}/grants/([^/]+)/revoke$`).exec(pathname);\n      if (memoryMatch && req.method === \"GET\") {\n        operation = \"support_passport_memory_preview\";\n        input.memoryId = decodeId(memoryMatch[1] ?? \"\", \"memoryId\");\n      } else if (cardMatch && req.method === \"PUT\" && !cardMatch[2]) {\n        operation = \"support_passport_card_replace\";\n        input.cardId = decodeId(cardMatch[1] ?? \"\", \"cardId\");\n        quotaLimitedWrite = true;\n      } else if (cardMatch && req.method === \"POST\" && cardMatch[2]) {\n        operation = `support_passport_card_${cardMatch[2]}` as OperationName;\n        input.cardId = decodeId(cardMatch[1] ?? \"\", \"cardId\");\n        quotaLimitedWrite = true;\n      } else if (grantMatch && req.method === \"POST\") {\n        operation = \"support_passport_grant_revoke\";\n        input.grantId = decodeId(grantMatch[1] ?? \"\", \"grantId\");\n        quotaLimitedWrite = true;\n      }\n    }\n\n    if (!operation) return false;\n    dependencies.res.setHeader(\"cache-control\", \"private, no-store\");\n    dependencies.res.setHeader(\"vary\", \"Authorization\");\n    if (dependencies.hasQuery) {\n      throw new SupportPassportError(\"invalid_input\", \"Support passport routes do not accept query values.\", 400);\n    }\n    if (req.method !== \"GET\") {\n      const body = await dependencies.readJsonBody();\n      for (const pathField of Object.keys(input)) {\n        if (Object.hasOwn(body, pathField)) {\n          throw new SupportPassportError(\"invalid_input\", `${pathField} belongs in the URL path.`, 400);\n        }\n      }\n      input = { ...input, ...body };\n    }\n    if (operation === \"support_passport_drafts_generate\" && !Object.hasOwn(input, \"sourceMemoryRevisions\")) {\n      throw new SupportPassportError(\"invalid_input\", \"Review the selected notes again before drafting.\", 400);\n    }\n    if (operation === \"support_passport_grant_create\") {\n      const grant = SupportPassportOwnerCreateGrantRequestSchema.safeParse(input);\n      if (!grant.success) throw new SupportPassportError(\"invalid_input\", \"The share link request is invalid.\", 400);\n      input = {\n        cardIds: grant.data.cardIds,\n        cardRevisions: grant.data.cardRevisions,\n        ...(grant.data.expiresAt !== undefined\n          ? { expiresAt: grant.data.expiresAt }\n          : { durationMs: grant.data.durationMs }),\n      };\n    }\n    const result = quotaLimitedWrite\n      ? await runWrite(operation, input, dependencies)\n      : await runOperation(operation, input, dependencies);\n    dependencies.respondJson(200, result);\n  } catch (error) {\n    if (!(error instanceof SupportPassportError)) throw error;\n    closeUnreadRequestAfterResponse(req, dependencies.res);\n    dependencies.respondJson(error.status, { error: error.message, code: error.code });\n  }\n  return true;\n}\n"],"mappings":";;;;;;;AAoBA,IAAM,aAAa;AAEZ,IAAM,qCAAqC;AAAA,EAChD,EAAE,QAAQ,OAAO,UAAU,GAAG,UAAU,UAAU,WAAW,8BAA8B;AAAA,EAC3F,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,WAAW,WAAW,gCAAgC;AAAA,EAC/F,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,oBAAoB,WAAW,mCAAmC;AAAA,EAC3G,EAAE,QAAQ,OAAO,UAAU,GAAG,UAAU,WAAW,WAAW,+BAA+B;AAAA,EAC7F,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,WAAW,WAAW,gCAAgC;AAAA,EAC/F,EAAE,QAAQ,OAAO,UAAU,GAAG,UAAU,iBAAiB,WAAW,kCAAkC;AAAA,EACtG,EAAE,QAAQ,OAAO,UAAU,GAAG,UAAU,cAAc,WAAW,gCAAgC;AAAA,EACjG,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,sBAAsB,WAAW,gCAAgC;AAAA,EAC1G,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,qBAAqB,WAAW,+BAA+B;AAAA,EACxG,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,uBAAuB,WAAW,iCAAiC;AAAA,EAC5G,EAAE,QAAQ,QAAQ,UAAU,GAAG,UAAU,sBAAsB,WAAW,gCAAgC;AAC5G;AAEA,SAAS,SAAS,OAAe,OAAuB;AACtD,MAAI;AACF,WAAO,mBAAmB,KAAK;AAAA,EACjC,QAAQ;AACN,UAAM,IAAI,qBAAqB,iBAAiB,GAAG,KAAK,gBAAgB,GAAG;AAAA,EAC7E;AACF;AAEA,SAAS,gCAAgC,KAAsB,KAA2B;AACxF,QAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAClD,QAAM,eACJ,IAAI,QAAQ,mBAAmB,MAAM,UACpC,kBAAkB,UAAa,kBAAkB;AACpD,MAAI,CAAC,gBAAgB,IAAI,iBAAiB,IAAI,UAAW;AACzD,MAAI,kBAAkB;AACtB,MAAI,UAAU,cAAc,OAAO;AACnC,MAAI,KAAK,UAAU,MAAM,IAAI,QAAQ,CAAC;AACxC;AAEA,eAAe,aACb,MACA,OACA,cACA,mBACkB;AAClB,QAAM,YAAY,aAAa,IAAI;AACnC,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AACpF,QAAM,SAAU,MAAM,UAAU,IAAI,OAAO;AAAA,IACzC,SAAS,aAAa;AAAA,IACtB,wBAAwB,aAAa;AAAA,IACrC,aAAa,aAAa;AAAA,IAC1B,GAAI,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,CAAC;AAAA,EAC9D,CAAC;AACD,SAAO,OAAO;AAChB;AAEA,eAAe,SACb,MACA,OACA,cACkB;AAClB,QAAM,aAAa,aAAa,0BAA0B;AAC1D,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM,OAAO,cAAc,WAAW,MAAM;AAC9E,eAAW,OAAO;AAClB,WAAO;AAAA,EACT,SAAS,OAAO;AACd,eAAW,QAAQ;AACnB,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,+BACpB,cACkB;AAClB,QAAM,EAAE,KAAK,SAAS,IAAI;AAC1B,MAAI;AACF,QAAI;AACJ,QAAI,QAAiC,CAAC;AACtC,QAAI,oBAAoB;AAExB,QAAI,IAAI,WAAW,SAAS,aAAa,GAAG,UAAU,UAAU;AAC9D,kBAAY;AAAA,IACd,WAAW,IAAI,WAAW,UAAU,aAAa,GAAG,UAAU,WAAW;AACvE,kBAAY;AACZ,0BAAoB;AAAA,IACtB,WAAW,IAAI,WAAW,UAAU,aAAa,GAAG,UAAU,oBAAoB;AAChF,kBAAY;AACZ,0BAAoB;AAAA,IACtB,WAAW,aAAa,GAAG,UAAU,aAAa,IAAI,WAAW,OAAO;AACtE,kBAAY;AAAA,IACd,WAAW,aAAa,GAAG,UAAU,aAAa,IAAI,WAAW,QAAQ;AACvE,kBAAY;AACZ,0BAAoB;AAAA,IACtB,OAAO;AACL,YAAM,cAAc,IAAI,OAAO,IAAI,UAAU,oBAAoB,EAAE,KAAK,QAAQ;AAChF,YAAM,YAAY,IAAI,OAAO,IAAI,UAAU,gDAAgD,EAAE,KAAK,QAAQ;AAC1G,YAAM,aAAa,IAAI,OAAO,IAAI,UAAU,yBAAyB,EAAE,KAAK,QAAQ;AACpF,UAAI,eAAe,IAAI,WAAW,OAAO;AACvC,oBAAY;AACZ,cAAM,WAAW,SAAS,YAAY,CAAC,KAAK,IAAI,UAAU;AAAA,MAC5D,WAAW,aAAa,IAAI,WAAW,SAAS,CAAC,UAAU,CAAC,GAAG;AAC7D,oBAAY;AACZ,cAAM,SAAS,SAAS,UAAU,CAAC,KAAK,IAAI,QAAQ;AACpD,4BAAoB;AAAA,MACtB,WAAW,aAAa,IAAI,WAAW,UAAU,UAAU,CAAC,GAAG;AAC7D,oBAAY,yBAAyB,UAAU,CAAC,CAAC;AACjD,cAAM,SAAS,SAAS,UAAU,CAAC,KAAK,IAAI,QAAQ;AACpD,4BAAoB;AAAA,MACtB,WAAW,cAAc,IAAI,WAAW,QAAQ;AAC9C,oBAAY;AACZ,cAAM,UAAU,SAAS,WAAW,CAAC,KAAK,IAAI,SAAS;AACvD,4BAAoB;AAAA,MACtB;AAAA,IACF;AAEA,QAAI,CAAC,UAAW,QAAO;AACvB,iBAAa,IAAI,UAAU,iBAAiB,mBAAmB;AAC/D,iBAAa,IAAI,UAAU,QAAQ,eAAe;AAClD,QAAI,aAAa,UAAU;AACzB,YAAM,IAAI,qBAAqB,iBAAiB,uDAAuD,GAAG;AAAA,IAC5G;AACA,QAAI,IAAI,WAAW,OAAO;AACxB,YAAM,OAAO,MAAM,aAAa,aAAa;AAC7C,iBAAW,aAAa,OAAO,KAAK,KAAK,GAAG;AAC1C,YAAI,OAAO,OAAO,MAAM,SAAS,GAAG;AAClC,gBAAM,IAAI,qBAAqB,iBAAiB,GAAG,SAAS,6BAA6B,GAAG;AAAA,QAC9F;AAAA,MACF;AACA,cAAQ,EAAE,GAAG,OAAO,GAAG,KAAK;AAAA,IAC9B;AACA,QAAI,cAAc,sCAAsC,CAAC,OAAO,OAAO,OAAO,uBAAuB,GAAG;AACtG,YAAM,IAAI,qBAAqB,iBAAiB,oDAAoD,GAAG;AAAA,IACzG;AACA,QAAI,cAAc,iCAAiC;AACjD,YAAM,QAAQ,6CAA6C,UAAU,KAAK;AAC1E,UAAI,CAAC,MAAM,QAAS,OAAM,IAAI,qBAAqB,iBAAiB,sCAAsC,GAAG;AAC7G,cAAQ;AAAA,QACN,SAAS,MAAM,KAAK;AAAA,QACpB,eAAe,MAAM,KAAK;AAAA,QAC1B,GAAI,MAAM,KAAK,cAAc,SACzB,EAAE,WAAW,MAAM,KAAK,UAAU,IAClC,EAAE,YAAY,MAAM,KAAK,WAAW;AAAA,MAC1C;AAAA,IACF;AACA,UAAM,SAAS,oBACX,MAAM,SAAS,WAAW,OAAO,YAAY,IAC7C,MAAM,aAAa,WAAW,OAAO,YAAY;AACrD,iBAAa,YAAY,KAAK,MAAM;AAAA,EACtC,SAAS,OAAO;AACd,QAAI,EAAE,iBAAiB,sBAAuB,OAAM;AACpD,oCAAgC,KAAK,aAAa,GAAG;AACrD,iBAAa,YAAY,MAAM,QAAQ,EAAE,OAAO,MAAM,SAAS,MAAM,MAAM,KAAK,CAAC;AAAA,EACnF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-GUKBW4HL.js → chunk-NQMSEB5D.js}

@@ -1,16 +1,13 @@
 import {
   getConfiguredNamespaces
-} from "./chunk-YN6ASZUG.js";
+} from "./chunk-6QPI2ITJ.js";
 import {
   writeFileAtomically
 } from "./chunk-AW4QUFQF.js";
 import {
   drainPendingLifecycleForSyncOrThrow,
   drainPendingLifecycleLedgerForSync
-} from "./chunk-7FGL6CGA.js";
-import {
-  namespaceIdentityFromToken
-} from "./chunk-EGGE52UU.js";
+} from "./chunk-DVYRD4HY.js";
 import {
   assertPathInsideRoot,
   pathIsInside
@@ -18,6 +15,9 @@ import {
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
+import {
+  namespaceIdentityFromToken
+} from "./chunk-EGGE52UU.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -181,4 +181,4 @@ export {
   offlineSyncStorageForSnapshot,
   drainPendingLifecycleForOfflineSync
 };
-//# sourceMappingURL=chunk-GUKBW4HL.js.map
+//# sourceMappingURL=chunk-NQMSEB5D.js.map

package/dist/{chunk-G2LUMAUF.js → chunk-OCIP6YMD.js}

@@ -2,13 +2,16 @@ import {
   RECONCILE_MANIFEST_FORMAT,
   RECONCILE_MANIFEST_SCHEMA_VERSION,
   buildReconcileManifestFile
-} from "./chunk-THPPCISA.js";
+} from "./chunk-RBII7637.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-GUKBW4HL.js";
+} from "./chunk-NQMSEB5D.js";
+import {
+  isSupportPassportPrivateMemory
+} from "./chunk-XX4HPFFM.js";
 import {
   iterateOfflineSyncSnapshotFileRecords
-} from "./chunk-GYPQL6XN.js";
+} from "./chunk-Z4N7SVVF.js";
 
 // src/access-offline-manifest.ts
 import * as nodePath from "path";
@@ -20,7 +23,11 @@ async function createOfflineSyncManifestStream(orchestrator, namespace, userExcl
     includeTranscripts: options.includeTranscripts !== false,
     readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),
     signal: options.signal,
-    userExcludeRegexps
+    userExcludeRegexps,
+    excludeFile: async ({ filePath }) => {
+      const memory = await storage.readMemoryByPath(filePath);
+      return memory ? isSupportPassportPrivateMemory(memory) : false;
+    }
   });
   return {
     namespace,
@@ -42,4 +49,4 @@ async function createOfflineSyncManifestStream(orchestrator, namespace, userExcl
 export {
   createOfflineSyncManifestStream
 };
-//# sourceMappingURL=chunk-G2LUMAUF.js.map
+//# sourceMappingURL=chunk-OCIP6YMD.js.map

package/dist/chunk-OCIP6YMD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-offline-manifest.ts"],"sourcesContent":["import * as nodePath from \"node:path\";\nimport type { Orchestrator } from \"./orchestrator.js\";\nimport { iterateOfflineSyncSnapshotFileRecords } from \"./offline-sync.js\";\nimport { offlineSyncStorageForSnapshot } from \"./offline-sync-impression-drain.js\";\nimport {\n  buildReconcileManifestFile,\n  RECONCILE_MANIFEST_FORMAT,\n  RECONCILE_MANIFEST_SCHEMA_VERSION,\n  type ReconcileManifest,\n  type ReconcileManifestFile,\n  type ReconcileMemoryParser,\n} from \"./reconcile/manifest.js\";\nimport { isSupportPassportPrivateMemory } from \"./support-passport/card-projection.js\";\n\nexport interface OfflineSyncManifestRequest {\n  includeTranscripts?: boolean;\n  signal?: AbortSignal;\n}\n\nexport interface OfflineSyncManifestStreamResponse extends Omit<ReconcileManifest, \"files\"> {\n  namespace: string;\n  files: AsyncIterable<ReconcileManifestFile>;\n}\n\nexport async function createOfflineSyncManifestStream(\n  orchestrator: Orchestrator,\n  namespace: string,\n  userExcludeRegexps: RegExp[],\n  options: OfflineSyncManifestRequest,\n  parseMemory: ReconcileMemoryParser,\n): Promise<OfflineSyncManifestStreamResponse> {\n  const storage = await offlineSyncStorageForSnapshot(orchestrator, namespace);\n  const snapshotFiles = iterateOfflineSyncSnapshotFileRecords({\n    root: storage.dir,\n    includeContent: false,\n    includeTranscripts: options.includeTranscripts !== false,\n    readFileDigest: async ({ filePath }) => storage.digestOfflineSyncFile(filePath),\n    signal: options.signal,\n    userExcludeRegexps,\n    excludeFile: async ({ filePath }) => {\n      const memory = await storage.readMemoryByPath(filePath);\n      return memory ? isSupportPassportPrivateMemory(memory) : false;\n    },\n  });\n  return {\n    namespace,\n    format: RECONCILE_MANIFEST_FORMAT,\n    schemaVersion: RECONCILE_MANIFEST_SCHEMA_VERSION,\n    files: (async function* () {\n      for await (const file of snapshotFiles) {\n        yield await buildReconcileManifestFile(\n          file,\n          async ({ path }) => storage.readOfflineSyncFile(nodePath.join(storage.dir, path)),\n          parseMemory,\n          orchestrator.config.inlineSourceAttributionFormat,\n        );\n      }\n    })(),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,YAAY,cAAc;AAwB1B,eAAsB,gCACpB,cACA,WACA,oBACA,SACA,aAC4C;AAC5C,QAAM,UAAU,MAAM,8BAA8B,cAAc,SAAS;AAC3E,QAAM,gBAAgB,sCAAsC;AAAA,IAC1D,MAAM,QAAQ;AAAA,IACd,gBAAgB;AAAA,IAChB,oBAAoB,QAAQ,uBAAuB;AAAA,IACnD,gBAAgB,OAAO,EAAE,SAAS,MAAM,QAAQ,sBAAsB,QAAQ;AAAA,IAC9E,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA,aAAa,OAAO,EAAE,SAAS,MAAM;AACnC,YAAM,SAAS,MAAM,QAAQ,iBAAiB,QAAQ;AACtD,aAAO,SAAS,+BAA+B,MAAM,IAAI;AAAA,IAC3D;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,eAAe;AAAA,IACf,QAAQ,mBAAmB;AACzB,uBAAiB,QAAQ,eAAe;AACtC,cAAM,MAAM;AAAA,UACV;AAAA,UACA,OAAO,EAAE,KAAK,MAAM,QAAQ,oBAA6B,cAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,UAChF;AAAA,UACA,aAAa,OAAO;AAAA,QACtB;AAAA,MACF;AAAA,IACF,GAAG;AAAA,EACL;AACF;","names":[]}

package/dist/{chunk-47P3RYZP.js → chunk-PG4QBPVG.js}

@@ -2,6 +2,9 @@ import {
   compileCorrectionRules,
   compileRedactionPatterns
 } from "./chunk-HVP33QVW.js";
+import {
+  parseSupportPassportConfig
+} from "./chunk-62OKGIJA.js";
 import {
   parseActivityConfig
 } from "./chunk-7RAJ3GXO.js";
@@ -72,7 +75,7 @@ import {
 } from "./chunk-HBVPYRDW.js";
 import {
   parseOfflineSyncExcludes
-} from "./chunk-GYPQL6XN.js";
+} from "./chunk-Z4N7SVVF.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
@@ -1459,21 +1462,24 @@ function resolveEnvVars(value) {
   return resolved;
 }
 function normalizeOpenaiBaseUrl(value, source) {
-  if (!value) return void 0;
+  if (value === void 0) return void 0;
   const trimmed = value.trim();
-  if (trimmed.length === 0) return void 0;
+  if (trimmed.length === 0) {
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must be an absolute HTTP or HTTPS URL`);
+  }
   let parsed;
   try {
     parsed = new URL(trimmed);
   } catch {
-    log.warn(`ignoring invalid openaiBaseUrl from ${source}: not a valid URL`);
-    return void 0;
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must be an absolute HTTP or HTTPS URL`);
   }
   if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    log.warn(
-      `ignoring openaiBaseUrl from ${source}: unsupported URL scheme (${parsed.protocol.replace(":", "")})`
+    throw new Error(`${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must use HTTP or HTTPS`);
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    throw new Error(
+      `${source === "env" ? "OPENAI_BASE_URL" : "openaiBaseUrl"} must not include credentials, query parameters, or fragments`
     );
-    return void 0;
   }
   if (parsed.protocol === "http:") {
     log.warn(`openaiBaseUrl from ${source} is using insecure http; prefer https`);
@@ -1952,9 +1958,12 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     )
   };
   let baseUrl;
-  if (typeof cfg.openaiBaseUrl === "string" && cfg.openaiBaseUrl.length > 0) {
+  if (cfg.openaiBaseUrl !== void 0 && typeof cfg.openaiBaseUrl !== "string") {
+    throw new Error("openaiBaseUrl must be a string");
+  }
+  if (cfg.openaiBaseUrl !== void 0) {
     baseUrl = normalizeOpenaiBaseUrl(resolveEnvVars(cfg.openaiBaseUrl), "config");
-  } else {
+  } else if (apiKey !== void 0) {
     baseUrl = normalizeOpenaiBaseUrl(readEnvVar("OPENAI_BASE_URL"), "env");
   }
   const sharedCrossSignalSemanticEnabled = cfg.sharedCrossSignalSemanticEnabled === true || cfg.crossSignalsSemanticEnabled === true;
@@ -2625,6 +2634,7 @@ function parseConfig(raw, rawOperatorConfig, runtimeSet) {
     codexCompat,
     codingKnowledge: parseCodingKnowledgeConfig(cfg.codingKnowledge),
     chat: parseChatConfig(cfg.chat),
+    supportPassport: parseSupportPassportConfig(cfg.supportPassport),
     hourlySummariesEnabled: cfg.hourlySummariesEnabled !== false,
     // default: true
     daySummaryEnabled: cfg.daySummaryEnabled !== false,
@@ -4027,4 +4037,4 @@ export {
   VALID_MEMORY_CATEGORIES,
   parseConfig
 };
-//# sourceMappingURL=chunk-47P3RYZP.js.map
+//# sourceMappingURL=chunk-PG4QBPVG.js.map