@remnic/core 9.54.8 → 9.56.0

package/dist/chunk-T3JQTCCO.js

@@ -0,0 +1,94 @@
+import {
+  coerceBool
+} from "./chunk-PQVCH2AE.js";
+import {
+  DEFAULT_UNTRUSTED_ORIGINS
+} from "./chunk-6Q3ZTEF6.js";
+import {
+  readEnvVar
+} from "./chunk-JUC24CTX.js";
+
+// src/config-security.ts
+function resolveSecurityBooleanConfig(value, rawOperatorConfig, flagName, envName, defaultValue) {
+  const rawAuthored = rawOperatorConfig !== void 0 && rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, flagName) && rawOperatorConfig[flagName] !== void 0 && rawOperatorConfig[flagName] !== null;
+  const schemaDefaultMaterialized = rawOperatorConfig !== void 0 && !rawAuthored && value === defaultValue;
+  if (!schemaDefaultMaterialized && value !== void 0 && value !== null) {
+    return resolveBooleanConfig(value, defaultValue, flagName);
+  }
+  if (rawAuthored) {
+    return resolveBooleanConfig(value ?? rawOperatorConfig?.[flagName], defaultValue, flagName);
+  }
+  const envValue = readEnvVar(envName);
+  return envValue === void 0 ? defaultValue : resolveBooleanConfig(envValue, defaultValue, flagName);
+}
+function resolveBooleanConfig(value, defaultValue, keyName) {
+  if (value === void 0 || value === null) return defaultValue;
+  const coerced = coerceBool(value);
+  if (coerced === void 0) {
+    throw new Error(
+      `${keyName} must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(value)}`
+    );
+  }
+  return coerced;
+}
+function resolveUntrustedOrigins(value, rawOperatorConfig) {
+  const rawAuthored = rawOperatorConfig !== void 0 && rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins") && rawOperatorConfig.untrustedOrigins !== void 0 && rawOperatorConfig.untrustedOrigins !== null;
+  const schemaDefaultMaterialized = rawOperatorConfig !== void 0 && !rawAuthored && Array.isArray(value) && value.length === DEFAULT_UNTRUSTED_ORIGINS.length && value.every((entry, index) => entry === DEFAULT_UNTRUSTED_ORIGINS[index]);
+  const configValue = schemaDefaultMaterialized ? void 0 : value;
+  const fromEnv = configValue === void 0 || configValue === null;
+  const envValue = fromEnv ? readEnvVar("REMNIC_UNTRUSTED_ORIGINS") : void 0;
+  const source = fromEnv ? envValue : configValue;
+  if (source === void 0 || source === null) return [...DEFAULT_UNTRUSTED_ORIGINS];
+  let entries;
+  if (Array.isArray(source)) {
+    entries = source;
+  } else if (fromEnv && typeof source === "string" && source.trim().length > 0) {
+    const trimmed = source.trim();
+    if (trimmed.startsWith("[")) {
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (!Array.isArray(parsed)) throw new Error("not an array");
+        entries = parsed;
+      } catch {
+        throw new Error("untrustedOrigins must be an array of strings");
+      }
+    } else {
+      entries = trimmed.split(",");
+    }
+  } else {
+    throw new Error("untrustedOrigins must be an array of strings");
+  }
+  const normalized = [];
+  for (const entry of entries) {
+    if (typeof entry !== "string") {
+      throw new Error("untrustedOrigins must be an array of strings");
+    }
+    const trimmed = entry.trim();
+    if (trimmed.length > 0) normalized.push(trimmed);
+  }
+  return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
+}
+function parseSecurityConfig(cfg, rawOperatorConfig) {
+  return {
+    originAuthorityEnabled: resolveSecurityBooleanConfig(
+      cfg.originAuthorityEnabled,
+      rawOperatorConfig,
+      "originAuthorityEnabled",
+      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+      false
+    ),
+    injectionScreenEnabled: resolveSecurityBooleanConfig(
+      cfg.injectionScreenEnabled,
+      rawOperatorConfig,
+      "injectionScreenEnabled",
+      "REMNIC_INJECTION_SCREEN_ENABLED",
+      true
+    ),
+    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig)
+  };
+}
+
+export {
+  parseSecurityConfig
+};
+//# sourceMappingURL=chunk-T3JQTCCO.js.map

package/dist/chunk-T3JQTCCO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config-security.ts"],"sourcesContent":["import { coerceBool } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport { DEFAULT_UNTRUSTED_ORIGINS } from \"./security/origin-authority.js\";\n\n// Memory-poisoning hardening (#1955): preserve explicit config, but let env\n// values replace schema-materialized defaults from the host config loader.\nfunction resolveSecurityBooleanConfig(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n  flagName: string,\n  envName: string,\n  defaultValue: boolean,\n): boolean {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, flagName) &&\n    rawOperatorConfig[flagName] !== undefined &&\n    rawOperatorConfig[flagName] !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    value === defaultValue;\n  if (!schemaDefaultMaterialized && value !== undefined && value !== null) {\n    return resolveBooleanConfig(value, defaultValue, flagName);\n  }\n  if (rawAuthored) {\n    return resolveBooleanConfig(value ?? rawOperatorConfig?.[flagName], defaultValue, flagName);\n  }\n  const envValue = readEnvVar(envName);\n  return envValue === undefined\n    ? defaultValue\n    : resolveBooleanConfig(envValue, defaultValue, flagName);\n}\n\nfunction resolveBooleanConfig(\n  value: unknown,\n  defaultValue: boolean,\n  keyName: string,\n): boolean {\n  if (value === undefined || value === null) return defaultValue;\n  const coerced = coerceBool(value);\n  if (coerced === undefined) {\n    throw new Error(\n      `${keyName} must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(value)}`,\n    );\n  }\n  return coerced;\n}\n\n// Memory-poisoning hardening (#1955): keep origin allow-list parsing in the\n// parser module so config-contract extraction covers this delegated surface.\nfunction resolveUntrustedOrigins(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): string[] {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, \"untrustedOrigins\") &&\n    rawOperatorConfig.untrustedOrigins !== undefined &&\n    rawOperatorConfig.untrustedOrigins !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    Array.isArray(value) &&\n    value.length === DEFAULT_UNTRUSTED_ORIGINS.length &&\n    value.every((entry, index) => entry === DEFAULT_UNTRUSTED_ORIGINS[index]);\n  const configValue = schemaDefaultMaterialized ? undefined : value;\n  const fromEnv = configValue === undefined || configValue === null;\n  const envValue = fromEnv ? readEnvVar(\"REMNIC_UNTRUSTED_ORIGINS\") : undefined;\n  const source = fromEnv ? envValue : configValue;\n  if (source === undefined || source === null) return [...DEFAULT_UNTRUSTED_ORIGINS];\n\n  let entries: unknown[];\n  if (Array.isArray(source)) {\n    entries = source;\n  } else if (fromEnv && typeof source === \"string\" && source.trim().length > 0) {\n    const trimmed = source.trim();\n    if (trimmed.startsWith(\"[\")) {\n      try {\n        const parsed: unknown = JSON.parse(trimmed);\n        if (!Array.isArray(parsed)) throw new Error(\"not an array\");\n        entries = parsed;\n      } catch {\n        throw new Error(\"untrustedOrigins must be an array of strings\");\n      }\n    } else {\n      entries = trimmed.split(\",\");\n    }\n  } else {\n    throw new Error(\"untrustedOrigins must be an array of strings\");\n  }\n\n  const normalized: string[] = [];\n  for (const entry of entries) {\n    if (typeof entry !== \"string\") {\n      throw new Error(\"untrustedOrigins must be an array of strings\");\n    }\n    const trimmed = entry.trim();\n    if (trimmed.length > 0) normalized.push(trimmed);\n  }\n  return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];\n}\n\nexport function parseSecurityConfig(\n  cfg: Record<string, unknown>,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): {\n  originAuthorityEnabled: boolean;\n  injectionScreenEnabled: boolean;\n  untrustedOrigins: string[];\n} {\n  return {\n    originAuthorityEnabled: resolveSecurityBooleanConfig(\n      cfg.originAuthorityEnabled,\n      rawOperatorConfig,\n      \"originAuthorityEnabled\",\n      \"REMNIC_ORIGIN_AUTHORITY_ENABLED\",\n      false,\n    ),\n    injectionScreenEnabled: resolveSecurityBooleanConfig(\n      cfg.injectionScreenEnabled,\n      rawOperatorConfig,\n      \"injectionScreenEnabled\",\n      \"REMNIC_INJECTION_SCREEN_ENABLED\",\n      true,\n    ),\n    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig),\n  };\n}\n"],"mappings":";;;;;;;;;;;AAMA,SAAS,6BACP,OACA,mBACA,UACA,SACA,cACS;AACT,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,QAAQ,KAChE,kBAAkB,QAAQ,MAAM,UAChC,kBAAkB,QAAQ,MAAM;AAClC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,UAAU;AACZ,MAAI,CAAC,6BAA6B,UAAU,UAAa,UAAU,MAAM;AACvE,WAAO,qBAAqB,OAAO,cAAc,QAAQ;AAAA,EAC3D;AACA,MAAI,aAAa;AACf,WAAO,qBAAqB,SAAS,oBAAoB,QAAQ,GAAG,cAAc,QAAQ;AAAA,EAC5F;AACA,QAAM,WAAW,WAAW,OAAO;AACnC,SAAO,aAAa,SAChB,eACA,qBAAqB,UAAU,cAAc,QAAQ;AAC3D;AAEA,SAAS,qBACP,OACA,cACA,SACS;AACT,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,GAAG,OAAO,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,IACtG;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,wBACP,OACA,mBACU;AACV,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,kBAAkB,KAC1E,kBAAkB,qBAAqB,UACvC,kBAAkB,qBAAqB;AACzC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,0BAA0B,UAC3C,MAAM,MAAM,CAAC,OAAO,UAAU,UAAU,0BAA0B,KAAK,CAAC;AAC1E,QAAM,cAAc,4BAA4B,SAAY;AAC5D,QAAM,UAAU,gBAAgB,UAAa,gBAAgB;AAC7D,QAAM,WAAW,UAAU,WAAW,0BAA0B,IAAI;AACpE,QAAM,SAAS,UAAU,WAAW;AACpC,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO,CAAC,GAAG,yBAAyB;AAEjF,MAAI;AACJ,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,cAAU;AAAA,EACZ,WAAW,WAAW,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,GAAG;AAC5E,UAAM,UAAU,OAAO,KAAK;AAC5B,QAAI,QAAQ,WAAW,GAAG,GAAG;AAC3B,UAAI;AACF,cAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,YAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,cAAc;AAC1D,kBAAU;AAAA,MACZ,QAAQ;AACN,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF,OAAO;AACL,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAEA,QAAM,aAAuB,CAAC;AAC9B,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAQ,SAAS,EAAG,YAAW,KAAK,OAAO;AAAA,EACjD;AACA,SAAO,WAAW,SAAS,IAAI,aAAa,CAAC,GAAG,yBAAyB;AAC3E;AAEO,SAAS,oBACd,KACA,mBAKA;AACA,SAAO;AAAA,IACL,wBAAwB;AAAA,MACtB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,kBAAkB,wBAAwB,IAAI,kBAAkB,iBAAiB;AAAA,EACnF;AACF;","names":[]}

package/dist/{chunk-6PCND4O2.js → chunk-T6EQPZ6E.js}

@@ -1,10 +1,10 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-FYZKFLKY.js";
+} from "./chunk-JFPZEWY3.js";
 import {
   getConfiguredNamespaces
-} from "./chunk-6QPI2ITJ.js";
+} from "./chunk-TVKWT2CY.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
@@ -23,7 +23,7 @@ import {
 import {
   resolveConversationContextCapabilities,
   resolveNamespaceCapabilities
-} from "./chunk-2XRE6FLM.js";
+} from "./chunk-JUOZ62Y7.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -2204,4 +2204,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-6PCND4O2.js.map
+//# sourceMappingURL=chunk-T6EQPZ6E.js.map

package/dist/{chunk-G7YUH4WT.js → chunk-TAMY4NKO.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-XXRRHING.js";
+} from "./chunk-BWJMBJCY.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-G7YUH4WT.js.map
+//# sourceMappingURL=chunk-TAMY4NKO.js.map

package/dist/{chunk-XDBFSUHX.js → chunk-TAPFJ3ET.js}

@@ -1,7 +1,7 @@
 import {
   SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS,
   SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES
-} from "./chunk-MTF5EFFF.js";
+} from "./chunk-FK7T55BA.js";
 import {
   SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH
 } from "./chunk-XX4HPFFM.js";
@@ -343,4 +343,4 @@ export {
   parseSupportPassportModelJob,
   SupportPassportModelBridge
 };
-//# sourceMappingURL=chunk-XDBFSUHX.js.map
+//# sourceMappingURL=chunk-TAPFJ3ET.js.map

package/dist/{chunk-MANCJV6J.js → chunk-TF3LMM5E.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-XXRRHING.js";
+} from "./chunk-BWJMBJCY.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -956,4 +956,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-MANCJV6J.js.map
+//# sourceMappingURL=chunk-TF3LMM5E.js.map

package/dist/{chunk-2GD6MLXD.js → chunk-TFXYQNBH.js}

@@ -3,7 +3,7 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-6PCND4O2.js";
+} from "./chunk-T6EQPZ6E.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -14,7 +14,7 @@ import {
 } from "./chunk-CMTINOFS.js";
 import {
   summarizeCorpusAndReplica
-} from "./chunk-K44N3CFW.js";
+} from "./chunk-T3HC7RJ7.js";
 import {
   readJudgeVerdictStats
 } from "./chunk-OZKOPQCM.js";
@@ -38,23 +38,23 @@ import {
 } from "./chunk-YBPYIAA5.js";
 import {
   parseConfig
-} from "./chunk-PG4QBPVG.js";
+} from "./chunk-3VFVQDZO.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-7SF5BAWF.js";
+} from "./chunk-S6AH7WSF.js";
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-P2FA65P2.js";
+} from "./chunk-7NSC4IVA.js";
 import {
   listNamespaces
-} from "./chunk-TPWBUKS3.js";
+} from "./chunk-PSH3VFZ7.js";
 import {
   analyzeGraphHealth
-} from "./chunk-OLT3YTDH.js";
+} from "./chunk-YMOPYG3K.js";
 import {
   StorageManager
-} from "./chunk-XXRRHING.js";
+} from "./chunk-BWJMBJCY.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -74,7 +74,7 @@ import {
   resolveNamespaceCapabilities,
   resolvePresentationCapabilities,
   resolveQmdCapabilities
-} from "./chunk-2XRE6FLM.js";
+} from "./chunk-JUOZ62Y7.js";
 import {
   readEnvVar,
   resolveHomeDir
@@ -1069,7 +1069,7 @@ async function summarizeBufferSurpriseDistribution(storage, config) {
   }
 }
 async function summarizeGraphEdgeDecayStatus(config) {
-  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-JI2XDCTY.js");
+  const { readGraphEdgeDecayStatus } = await import("./graph-edge-decay-ZXGBXNPW.js");
   const { graphEdgeDecayEnabled } = config;
   const enabled = graphEdgeDecayEnabled === true;
   if (!enabled) {
@@ -1109,7 +1109,7 @@ async function summarizeGraphEdgeDecayStatus(config) {
 }
 async function summarizeTierDistribution(storage) {
   try {
-    const { summarizeTiers } = await import("./tier-stats-EXYSKSVN.js");
+    const { summarizeTiers } = await import("./tier-stats-7E6OBUSD.js");
     const summary = await summarizeTiers(storage);
     const storageDir = storage.dir ?? "";
     const journalPath = storageDir.length > 0 ? path.join(storageDir, "state", "tier-migration-journal.jsonl") : null;
@@ -1683,4 +1683,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-2GD6MLXD.js.map
+//# sourceMappingURL=chunk-TFXYQNBH.js.map

package/dist/{chunk-7DISPKXT.js → chunk-THACANBI.js}

@@ -1,16 +1,16 @@
 import {
   externalWikiSearchOperation
-} from "./chunk-E2GZSFR5.js";
+} from "./chunk-2YREVL4T.js";
 import {
   memoryStoreRequestSchema
-} from "./chunk-JKW663ZN.js";
+} from "./chunk-BVRREV3N.js";
 import {
   CorrectionContractError,
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-MTF5EFFF.js";
+} from "./chunk-FK7T55BA.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1818,4 +1818,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-7DISPKXT.js.map
+//# sourceMappingURL=chunk-THACANBI.js.map

package/dist/{chunk-6G4D222J.js → chunk-TLVLJSWS.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportError,
   getOperation
-} from "./chunk-MTF5EFFF.js";
+} from "./chunk-FK7T55BA.js";
 import {
   abortError,
   isAbortError
@@ -499,4 +499,4 @@ export {
   buildSupportPassportPublicRequestHandler,
   composeSupportPassportExternalRequestHandlers
 };
-//# sourceMappingURL=chunk-6G4D222J.js.map
+//# sourceMappingURL=chunk-TLVLJSWS.js.map

package/dist/{chunk-6QPI2ITJ.js → chunk-TVKWT2CY.js}

@@ -1,7 +1,7 @@
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
-} from "./chunk-BGLY7EEM.js";
+} from "./chunk-CMRUIKVA.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -12,10 +12,10 @@ import {
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal,
   resolvePrincipal
-} from "./chunk-3GD2HFR6.js";
+} from "./chunk-IGWVMA4Y.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-2XRE6FLM.js";
+} from "./chunk-JUOZ62Y7.js";
 import {
   combineNamespaces,
   lcmReadSessionIdsForNamespaces,
@@ -202,4 +202,4 @@ export {
   resolveWritableNamespaceValue,
   resolveScopedWritableNamespaceValue
 };
-//# sourceMappingURL=chunk-6QPI2ITJ.js.map
+//# sourceMappingURL=chunk-TVKWT2CY.js.map

package/dist/{chunk-H7NAZ3UB.js → chunk-U7BMN33M.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SOBJ6NEY.js";
 import {
   summarizeDisclosureTokens
-} from "./chunk-MK5VEWCR.js";
+} from "./chunk-QKPDN325.js";
 import {
   summarizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -606,4 +606,4 @@ export {
   renderRecallExplain,
   parseRecallExplainFormat
 };
-//# sourceMappingURL=chunk-H7NAZ3UB.js.map
+//# sourceMappingURL=chunk-U7BMN33M.js.map

package/dist/{chunk-BXIMH7MC.js → chunk-UTDMY476.js}

@@ -8,23 +8,26 @@ import {
 import {
   parseQmdExplain
 } from "./chunk-RVO6TCTU.js";
+import {
+  classifyOrigin
+} from "./chunk-6Q3ZTEF6.js";
 import {
   resolveLifecycleState
 } from "./chunk-TBBDFYXW.js";
 import {
   resolveScopeProfilePlan
-} from "./chunk-BGLY7EEM.js";
+} from "./chunk-CMRUIKVA.js";
 import {
   parseFlexibleIsoTimestamp
 } from "./chunk-P7FMDTKL.js";
 import {
   defaultNamespaceForPrincipal,
   resolvePrincipal
-} from "./chunk-3GD2HFR6.js";
+} from "./chunk-IGWVMA4Y.js";
 import {
   resolveMemoryLifecycleCapabilities,
   resolvePresentationCapabilities
-} from "./chunk-2XRE6FLM.js";
+} from "./chunk-JUOZ62Y7.js";
 import {
   resolveCodingNamespaceOverlay
 } from "./chunk-J2WC5LF4.js";
@@ -819,6 +822,45 @@ async function commitEmptySuccessExtraction(args) {
 
 // src/orchestration/extraction-run.ts
 import { createHash as createHash2 } from "crypto";
+
+// src/orchestration/extraction-origin-context.ts
+function deriveExtractionOriginContext(targetTurns, fallbackConnector) {
+  const originRoles = new Set(targetTurns.map((turn) => turn.role));
+  const turnRole = originRoles.size === 1 ? [...originRoles][0] : void 0;
+  const originConnectors = new Set(
+    targetTurns.map((turn) => turn.sourceConnector).filter((connector2) => typeof connector2 === "string" && connector2.length > 0)
+  );
+  const connector = targetTurns.length > 0 && targetTurns.every(
+    (turn) => typeof turn.sourceConnector === "string" && turn.sourceConnector.length > 0
+  ) && originConnectors.size === 1 ? [...originConnectors][0] : void 0;
+  const originAdapters = new Set(
+    targetTurns.map((turn) => turn.importProvenance?.sourceLabel).filter((adapter) => typeof adapter === "string" && adapter.length > 0)
+  );
+  const everyTurnHasConnector = targetTurns.length > 0 && targetTurns.every((turn) => typeof turn.sourceConnector === "string" && turn.sourceConnector.length > 0);
+  const everyTurnHasAdapter = targetTurns.length > 0 && targetTurns.every(
+    (turn) => typeof turn.importProvenance?.sourceLabel === "string" && turn.importProvenance.sourceLabel.length > 0
+  );
+  const originConflict = originConnectors.size > 1 || originAdapters.size > 1 || originConnectors.size > 0 && originAdapters.size > 0 || originConnectors.size > 0 && !everyTurnHasConnector || originAdapters.size > 0 && !everyTurnHasAdapter;
+  const importAdapter = targetTurns.length > 0 && targetTurns.every(
+    (turn) => typeof turn.importProvenance?.sourceLabel === "string" && turn.importProvenance.sourceLabel.length > 0
+  ) && originAdapters.size === 1 ? [...originAdapters][0] : void 0;
+  return {
+    ...turnRole ? { turnRole } : {},
+    ...importAdapter ? { importAdapter } : {},
+    ...originConflict ? { originConflict: true } : {},
+    sourceConnector: fallbackConnector ?? connector
+  };
+}
+function classifyExtractionOrigin(sourceContext) {
+  if (sourceContext?.originConflict === true) return "unknown";
+  return classifyOrigin({
+    turnRole: sourceContext?.turnRole,
+    connectorId: sourceContext?.sourceConnector,
+    importAdapter: sourceContext?.importAdapter
+  });
+}
+
+// src/orchestration/extraction-run.ts
 var ExtractionDeadlineError = class extends Error {
   stage;
   constructor(stage) {
@@ -1498,13 +1540,14 @@ ${normalized}`).digest("hex");
           log.warn("[threading] processTurn failed before persistence (non-fatal)", err);
         }
       }
+      const originContext = deriveExtractionOriginContext(targetTurns, result.sourceConnector);
       throwIfDeadlineExceeded("before_persist");
       throwIfAborted2("before_persist");
       const { persistedIds } = await this.deps.persistExtraction(
         result,
         storage,
         threadIdForExtraction,
-        { sessionKey, principal, validAt: sourceValidAt, sourceConnector: result.sourceConnector },
+        { sessionKey, principal, validAt: sourceValidAt, ...originContext },
         // Pass the KNOWN base namespace (NHIdx) so the catalog write touch records the
         // real namespace rather than a guess decoded from the storage dir.
         selfNamespace,
@@ -1649,9 +1692,10 @@ export {
   buildMemoryPathById,
   appendMemoryToGraphContext,
   resolvePersistedMemoryRelativePath,
+  classifyExtractionOrigin,
   deriveTopicsFromExtraction,
   deriveSourceConnector,
   ExtractionDeadlineError,
   ExtractionRunCoordinator
 };
-//# sourceMappingURL=chunk-BXIMH7MC.js.map
+//# sourceMappingURL=chunk-UTDMY476.js.map