@remnic/core 9.65.7 → 9.66.0

package/dist/{chunk-RQE4TITU.js → chunk-IHGMRDEE.js}

@@ -8,20 +8,34 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-PMVPCZJZ.js";
+} from "./chunk-CTCGHNWN.js";
 import {
-  buildCodingGraphInstallHint,
-  tryLoadCodingGraphModule
-} from "./chunk-VQ7B2Q6M.js";
-import {
-  WriteQuarantineStore
-} from "./chunk-PJSK6OJM.js";
+  ACTIVE_DECISION_STATUSES,
+  CodegraphRuntimeError,
+  DEFAULT_DECISION_STATUS,
+  buildArchitectureCard,
+  codegraphSurfaceVisible,
+  createArchitectureCardSummariser,
+  createArchitectureVersioningHook,
+  deleteCodegraphProject,
+  getCodegraphStore,
+  handleCodingArchitecture,
+  isDecisionStatus,
+  listCodegraphProjects,
+  makeCodegraphRuntimeDelegates,
+  parseDecisionRecord,
+  resolveCodegraphProjectId,
+  serializeDecisionRecord
+} from "./chunk-QJCWK2A7.js";
 import {
   WHO_KNOWS_DEFAULT_LIMIT,
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-ZIJDI4CP.js";
+} from "./chunk-WKJFIMVN.js";
+import {
+  WriteQuarantineStore
+} from "./chunk-PJSK6OJM.js";
 import {
   trustResultFor
 } from "./chunk-GNVZQ5JN.js";
@@ -45,31 +59,34 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-YOXVZJFM.js";
+} from "./chunk-CFVTRUR3.js";
 import {
   estimateRecallTokens
-} from "./chunk-MFOSZUIT.js";
+} from "./chunk-NPIBN2VL.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-5S4LQOPE.js";
+} from "./chunk-ZW4VXELZ.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
-import {
-  recordMemoryOutcome
-} from "./chunk-UD7UNYRD.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-2HIJHXB3.js";
 import {
   objectiveStateStoreOverrideForNamespace
 } from "./chunk-HTP6XRUI.js";
+import {
+  recordMemoryOutcome
+} from "./chunk-UD7UNYRD.js";
 import {
   coerceIncludedMemories
 } from "./chunk-2YA5N2BY.js";
 import {
   buildGraphSnapshot
 } from "./chunk-PD66CVSD.js";
+import {
+  REDACTION_RULES_SUBDIR
+} from "./chunk-LTHVM4XN.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -85,14 +102,11 @@ import {
 import {
   LocalLlmClient
 } from "./chunk-IVKIODHO.js";
-import {
-  REDACTION_RULES_SUBDIR
-} from "./chunk-LTHVM4XN.js";
 import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-7BEPVIH3.js";
+} from "./chunk-X5YYSAZX.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -101,6 +115,10 @@ import {
   composeRecallContext,
   renderAuthorityBoundContent
 } from "./chunk-7ZNJN5WZ.js";
+import {
+  CorpusWatermarkCache,
+  computeServiceCorpusCensus
+} from "./chunk-4FHRZD5T.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
@@ -112,18 +130,14 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-SVVIASVX.js";
-import {
-  CorpusWatermarkCache,
-  computeServiceCorpusCensus
-} from "./chunk-VXVZ2GM3.js";
+} from "./chunk-EFQCDJZ2.js";
 import {
   ExtractionDeadlineError,
   isActivityDigestPath,
   isArtifactMemoryPath,
   isLocationDayPath,
   isMeetingRecordPath
-} from "./chunk-THG4GYIE.js";
+} from "./chunk-RDGKVH6T.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -133,42 +147,31 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-F6QHHRWP.js";
+} from "./chunk-FESUGFIL.js";
 import {
+  OKF_RESERVED_BASENAMES,
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-BJTHRFFC.js";
+} from "./chunk-GEJKYA7D.js";
 import {
   namespaceCollectionName
-} from "./chunk-JAQXUGLN.js";
+} from "./chunk-FYWLSFFS.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-LBFFNDFM.js";
+} from "./chunk-MINHJ55X.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
 } from "./chunk-SCU65EZI.js";
-import {
-  STRUCTURED_ATTRIBUTE_LIMITS,
-  buildAccessWriteRequestFingerprint,
-  buildObserveRequestFingerprint,
-  composeMemoryEnvelope,
-  isMemoryCategory
-} from "./chunk-RAIUTAZZ.js";
-import {
-  applyTagFilter,
-  normalizeTags,
-  parseTagMatch
-} from "./chunk-BT7NVCML.js";
 import {
   createVersion,
   getVersion,
   revertToVersion
-} from "./chunk-UFKPQBXH.js";
+} from "./chunk-U62OK7BB.js";
 import {
   MEMORY_CORPUS_VERSION_SENTINEL,
   bumpMemoryCorpusVersionForDir
@@ -177,13 +180,25 @@ import {
   HistoricalEntityCanonicalIdCache,
   canonicalizeEntityRefFrontmatter,
   repairContentAfterJournalMoveSync
-} from "./chunk-ZVPVTPGI.js";
+} from "./chunk-NNZFPYYX.js";
 import {
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
+import {
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  composeMemoryEnvelope,
+  isMemoryCategory
+} from "./chunk-WKAXBXVA.js";
+import {
+  applyTagFilter,
+  normalizeTags,
+  parseTagMatch
+} from "./chunk-BT7NVCML.js";
 import {
   FallbackLlmClient
-} from "./chunk-UW5NPZJ2.js";
+} from "./chunk-JALOAKSZ.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -208,10 +223,10 @@ import {
 } from "./chunk-GPFZFCRN.js";
 import {
   computePromotionCandidates
-} from "./chunk-RIAM7DND.js";
+} from "./chunk-ME35HVDJ.js";
 import {
   exportCapsule
-} from "./chunk-KQAFEZQX.js";
+} from "./chunk-7LCGFUMB.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -240,22 +255,22 @@ import {
 } from "./chunk-LNEWDF2A.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-I2HTKOOP.js";
+} from "./chunk-O7ERGZDA.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-HZNYJN77.js";
+} from "./chunk-TNXNECAN.js";
 import {
   resolveScopePlan,
   resolveScopedWritableNamespaceValue,
   resolveWritableNamespaceValue
-} from "./chunk-Q57GOHLF.js";
-import {
-  writeFileAtomically
-} from "./chunk-AW4QUFQF.js";
+} from "./chunk-EGALNSZ4.js";
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
-} from "./chunk-KCT36JAW.js";
+} from "./chunk-ESNFSSO4.js";
+import {
+  writeFileAtomically
+} from "./chunk-AW4QUFQF.js";
 import {
   inferMemoryStatus,
   isActiveMemoryStatus,
@@ -263,7 +278,7 @@ import {
 } from "./chunk-7RJUVTVF.js";
 import {
   getMemoryProjectionPath
-} from "./chunk-2LWQSV6A.js";
+} from "./chunk-AL3UYZ5N.js";
 import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
@@ -275,1576 +290,155 @@ import {
   SupportPassportCardListSchema,
   SupportPassportCardMutationInputSchema,
   SupportPassportCardTitleSchema,
-  SupportPassportListCardsInputSchema,
-  SupportPassportManualDraftInputSchema,
-  SupportPassportMemoryIdSchema,
-  SupportPassportNamespaceSchema,
-  SupportPassportReplaceCardInputSchema,
-  SupportPassportSourceMemoryIdSchema,
-  activeSupportPassportReplacementPredecessorIds,
-  computeSupportPassportCardRevision,
-  computeSupportPassportOwnerKey,
-  createSupportPassportPrivateFileExclusion,
-  decodeSupportPassportNamespaceAttributes,
-  encodeSupportPassportNamespaceAttributes,
-  isSupportPassportPrivateMemory,
-  projectSupportPassportCard
-} from "./chunk-XDL5CYZN.js";
-import {
-  computeContentHash
-} from "./chunk-5FVVY2EB.js";
-import {
-  serializeMutations,
-  withHeldFileLock
-} from "./chunk-FFAZ2XFU.js";
-import {
-  stripAttributesSuffix
-} from "./chunk-JDSVLVCG.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
-import {
-  buildHandleIndexForResults,
-  isHandleToken
-} from "./chunk-JAKIDQB2.js";
-import {
-  OFFLINE_SYNC_SNAPSHOT_FORMAT,
-  applyOfflineSyncChangeset,
-  applyOfflineSyncFileContentChunk,
-  buildOfflineSyncSnapshot,
-  buildOfflineSyncSnapshotForPaths,
-  buildOfflineSyncSnapshotFromBase,
-  compileOfflineSyncExcludeGlobs,
-  filterOfflineSyncDeletionRevisions,
-  iterateOfflineSyncSnapshotFileRecords,
-  normalizeOfflineSyncChangeset,
-  readOfflineSyncFileContentChunk
-} from "./chunk-FZEEWOI2.js";
-import {
-  validateArchiveRelativePath
-} from "./chunk-GCGJW34D.js";
-import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
-import {
-  assertOperationAuthorizationAllowed,
-  capabilityAllowsOp,
-  enforceNamespaceAllowList,
-  isNamespaceAllowed,
-  tokenCapabilityStore
-} from "./chunk-MZWSOLMT.js";
-import {
-  canReadNamespace,
-  canWriteNamespace,
-  citationAuthorizedNamespaces,
-  defaultNamespaceForPrincipal,
-  recallNamespacesForPrincipal,
-  resolvePrincipal
-} from "./chunk-MRV7VSQK.js";
-import {
-  namespaceIdentityFromToken
-} from "./chunk-VUFL7X3H.js";
-import {
-  resolveAccessSetupCapabilities,
-  resolveCompressionCapabilities,
-  resolveConsolidationCapabilities,
-  resolveGraphConstructionCapabilities,
-  resolveIdentityContinuityCapabilities,
-  resolveIndexingCapabilities,
-  resolveLocalLlmCapabilities,
-  resolveMemoryLifecycleCapabilities,
-  resolveNamespaceCapabilities,
-  resolveObjectiveStateCapabilities,
-  resolveQmdCapabilities,
-  resolveRecallAuxiliaryCapabilities,
-  resolveRecallEnhancementCapabilities,
-  resolveSecurityCapabilities
-} from "./chunk-JUOZ62Y7.js";
-import {
-  AccessIdempotencyStore,
-  hashAccessIdempotencyPayload
-} from "./chunk-VFUEZZBS.js";
-import {
-  resolveCodingContextFromOptions
-} from "./chunk-773TRRGT.js";
-import {
-  combineNamespaces,
-  defaultGitInvokerSync,
-  lcmSessionKeyForNamespace,
-  projectTagProjectId,
-  resolveCodingNamespaceOverlay,
-  resolveGitContext,
-  sanitizeFragment
-} from "./chunk-J2WC5LF4.js";
-import {
-  expandTildePath
-} from "./chunk-EYIEWJNI.js";
-import {
-  EngramAccessForbiddenError,
-  EngramAccessInputError,
-  NamespaceNotWritableError
-} from "./chunk-2Z24E5W2.js";
-import {
-  abortError,
-  isAbortError,
-  raceAbort,
-  throwIfAborted
-} from "./chunk-BTTPKDIL.js";
-import {
-  readJsonFile,
-  writeJsonFileAtomic
-} from "./chunk-P77QX3ID.js";
-import {
-  AccessAuditAdapter
-} from "./chunk-TVVEYCNW.js";
-import {
-  decodeCitationNamespace
-} from "./chunk-JIYDRBVZ.js";
-import {
-  isPathInsideStorageRoot
-} from "./chunk-FF4KLI5W.js";
-import {
-  SecureStoreLockedError
-} from "./chunk-XQ3HXAQH.js";
-import {
-  ALL_CATEGORY_DIRS,
-  getCategoryDir
-} from "./chunk-VS2IYZRU.js";
-import {
-  recordCitationUsage
-} from "./chunk-NINSR6LX.js";
-import {
-  log
-} from "./chunk-3WCASNQZ.js";
-
-// src/access-service.ts
-import { createHash as createHash13 } from "crypto";
-import { constants as fsConstants2 } from "fs";
-import { readdirSync, unlinkSync } from "fs";
-import { stat as stat3 } from "fs/promises";
-import * as nodeFs2 from "fs/promises";
-import { ZodError } from "zod";
-
-// src/coding/architecture-card.ts
-import { readFile, readdir, lstat } from "fs/promises";
-import path from "path";
-var ARCHITECTURE_CARD_MAX_BYTES = 4096;
-var ARCHITECTURE_CARD_TRUNCATION_MARKER = "\u2026 card truncated to fit size cap \u2026";
-var ARCHITECTURE_CARD_MAX_SUMMARY_BYTES = 1024;
-var KNOWN_MANIFEST_FILES = [
-  "package.json",
-  "Cargo.toml",
-  "go.mod",
-  "pyproject.toml",
-  "setup.py",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "Gemfile",
-  "composer.json",
-  "mix.exs",
-  "deno.json"
-];
-var SCAN_IGNORE_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  ".svn",
-  ".hg",
-  "vendor",
-  "__pycache__",
-  ".venv",
-  "venv",
-  "env",
-  "dist",
-  "build",
-  "target",
-  "out",
-  ".next",
-  ".nuxt",
-  "coverage",
-  ".cache",
-  ".turbo",
-  ".idea",
-  ".vscode"
-]);
-var ARCHITECTURE_CARD_SUMMARY_SYSTEM_PROMPT = `You write a concise overview for a repository architecture card.
-Given the deterministic card (languages, manifests, entry points), produce a 3-5 sentence plain-text overview naming the dominant language, the primary entry point, and the project's shape.
-Rules:
-- Never invent facts absent from the input.
-- No headings, no markdown \u2014 just sentences.
-- Keep it under 600 characters.`;
-function createArchitectureCardSummariser(client) {
-  if (!client) return void 0;
-  return async (deterministicCard, repoRoot) => {
-    const response = await client.chatCompletion(
-      [
-        { role: "system", content: ARCHITECTURE_CARD_SUMMARY_SYSTEM_PROMPT },
-        { role: "user", content: `Repository: ${path.basename(repoRoot) || repoRoot}
-
-${deterministicCard}` }
-      ],
-      {
-        temperature: 0.2,
-        maxTokens: 512,
-        operation: "architecture-card-summary",
-        priority: "background"
-      }
-    );
-    return response?.content ?? null;
-  };
-}
-async function buildArchitectureCard(repoRoot, options = {}) {
-  if (typeof repoRoot !== "string" || repoRoot.length === 0) {
-    return { ok: false, code: "invalid_root", detail: "repoRoot must be a non-empty string" };
-  }
-  const absoluteRoot = path.resolve(expandTildePath(repoRoot));
-  try {
-    const rootStat = await lstat(absoluteRoot);
-    if (!rootStat.isDirectory()) {
-      return { ok: false, code: "invalid_root", detail: `not a directory: ${absoluteRoot}` };
-    }
-  } catch (err) {
-    return {
-      ok: false,
-      code: "invalid_root",
-      detail: `repoRoot not accessible: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  try {
-    await readdir(absoluteRoot);
-  } catch (err) {
-    return {
-      ok: false,
-      code: "scan_failed",
-      detail: `repoRoot not readable: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  try {
-    const scan = await scanRepository(absoluteRoot);
-    const deterministic = renderCard(scan, options.now ?? /* @__PURE__ */ new Date());
-    const maxBytes = options.maxBytes ?? ARCHITECTURE_CARD_MAX_BYTES;
-    let content = deterministic;
-    if (options.llmSummary === true && options.summariser) {
-      try {
-        const summary = await options.summariser(deterministic, absoluteRoot);
-        if (typeof summary === "string" && summary.trim().length > 0) {
-          const separator = "\n\n---\n\n";
-          const detBytes = Buffer.byteLength(deterministic, "utf-8");
-          const sepBytes = Buffer.byteLength(separator, "utf-8");
-          const summaryBudget = Math.min(
-            ARCHITECTURE_CARD_MAX_SUMMARY_BYTES,
-            maxBytes - detBytes - sepBytes
-          );
-          if (summaryBudget > 0) {
-            const clampedSummary = clampSummaryToBytes(summary.trim(), summaryBudget);
-            if (clampedSummary.length > 0) {
-              content = `${clampedSummary}${separator}${deterministic}`;
-            }
-          }
-        }
-      } catch (err) {
-        void err;
-      }
-    }
-    const { text: truncatedContent, truncated } = capToBytes(content, maxBytes);
-    return {
-      ok: true,
-      card: {
-        content: truncatedContent,
-        generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
-        byteSize: Buffer.byteLength(truncatedContent, "utf-8"),
-        truncated
-      }
-    };
-  } catch (err) {
-    return {
-      ok: false,
-      code: "scan_failed",
-      detail: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-async function scanRepository(root) {
-  const topEntries = await readSortedDirEntries(root);
-  const topDirs = topEntries.filter((e) => e.isDirectory && !SCAN_IGNORE_DIRS.has(e.name)).map((e) => e.name);
-  const manifestFiles = topEntries.filter((e) => e.isFile && KNOWN_MANIFEST_FILES.includes(e.name)).map((e) => e.name);
-  const manifests = [];
-  for (const mf of sortStrings(manifestFiles)) {
-    const parsed = await parseManifest(path.join(root, mf));
-    manifests.push({ filename: mf, name: parsed.name, entryPoints: sortStrings(parsed.entryPoints) });
-  }
-  const languageHistogram = await computeLanguageHistogram(root, topEntries);
-  return {
-    root: path.basename(root) || root,
-    topDirs: sortStrings(topDirs),
-    manifests,
-    languageHistogram: sortLanguageHistogram(languageHistogram)
-  };
-}
-async function readSortedDirEntries(dir) {
-  let names;
-  try {
-    names = await readdir(dir);
-  } catch {
-    return [];
-  }
-  const entries = [];
-  for (const name of sortStrings(names)) {
-    try {
-      const s = await lstat(path.join(dir, name));
-      if (s.isSymbolicLink()) continue;
-      entries.push({ name, isDirectory: s.isDirectory(), isFile: s.isFile() });
-    } catch {
-    }
-  }
-  return entries;
-}
-async function computeLanguageHistogram(root, topEntries) {
-  const counts = /* @__PURE__ */ new Map();
-  const dirsToScan = topEntries.filter((e) => e.isDirectory && !SCAN_IGNORE_DIRS.has(e.name)).map((e) => path.join(root, e.name));
-  const rootFiles = topEntries.filter((e) => e.isFile);
-  const visitDir = async (dir, depth) => {
-    if (depth > 2) return;
-    let entries;
-    try {
-      entries = await readSortedDirEntries(dir);
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory) {
-        if (!SCAN_IGNORE_DIRS.has(entry.name)) {
-          await visitDir(path.join(dir, entry.name), depth + 1);
-        }
-      } else if (entry.isFile) {
-        const ext = path.extname(entry.name).toLowerCase();
-        if (ext.length > 0) {
-          counts.set(ext, (counts.get(ext) ?? 0) + 1);
-        }
-      }
-    }
-  };
-  for (const f of rootFiles) {
-    const ext = path.extname(f.name).toLowerCase();
-    if (ext.length > 0) counts.set(ext, (counts.get(ext) ?? 0) + 1);
-  }
-  for (const dir of dirsToScan) {
-    await visitDir(dir, 0);
-  }
-  return Array.from(counts.entries()).map(([ext, count]) => ({ ext, count }));
-}
-async function parseManifest(filePath) {
-  const filename = path.basename(filePath);
-  try {
-    const raw = await readFile(filePath, "utf-8");
-    switch (filename) {
-      case "package.json":
-        return parsePackageJson(raw);
-      case "pyproject.toml":
-      case "setup.py":
-        return parsePythonProject(raw, filename);
-      case "go.mod":
-        return parseGoMod(raw);
-      case "Cargo.toml":
-        return parseCargoToml(raw);
-      default:
-        return { name: null, entryPoints: [] };
-    }
-  } catch {
-    return { name: null, entryPoints: [] };
-  }
-}
-function parsePackageJson(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return { name: null, entryPoints: [] };
-  }
-  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    return { name: null, entryPoints: [] };
-  }
-  const obj = parsed;
-  const name = typeof obj["name"] === "string" ? obj["name"] : null;
-  const entryPoints = [];
-  const bin = obj["bin"];
-  if (typeof bin === "string") {
-    entryPoints.push(bin);
-  } else if (typeof bin === "object" && bin !== null && !Array.isArray(bin)) {
-    for (const [key, value] of Object.entries(bin)) {
-      entryPoints.push(typeof value === "string" ? value : `bin/${key}`);
-    }
-  }
-  const main = typeof obj["main"] === "string" ? obj["main"] : null;
-  if (main) entryPoints.push(main);
-  const module = typeof obj["module"] === "string" ? obj["module"] : null;
-  if (module) entryPoints.push(module);
-  const scripts = obj["scripts"];
-  if (typeof scripts === "object" && scripts !== null && !Array.isArray(scripts)) {
-    const scriptKeys = Object.keys(scripts);
-    for (const key of ["start", "dev", "serve"]) {
-      if (scriptKeys.includes(key)) entryPoints.push(`scripts.${key}`);
-    }
-  }
-  return { name, entryPoints };
-}
-function parsePythonProject(raw, _filename) {
-  const entryPoints = [];
-  let name = null;
-  const nameMatch = raw.match(/^name\s*=\s*["']([^"']+)["']/m);
-  if (nameMatch) name = nameMatch[1] ?? null;
-  const scriptsMatch = raw.match(/\[project\.scripts\]([\s\S]*?)(?:\n\[|$)/);
-  if (scriptsMatch && scriptsMatch[1]) {
-    for (const line of scriptsMatch[1].split("\n")) {
-      const m = line.match(/^([a-zA-Z0-9_-]+)\s*=/);
-      if (m && m[1]) entryPoints.push(`scripts.${m[1]}`);
-    }
-  }
-  return { name, entryPoints };
-}
-function parseGoMod(raw) {
-  const moduleMatch = raw.match(/^module\s+(\S+)/m);
-  const name = moduleMatch && moduleMatch[1] ? moduleMatch[1] : null;
-  return { name, entryPoints: name ? ["main.go"] : [] };
-}
-function parseCargoToml(raw) {
-  const nameMatch = raw.match(/^name\s*=\s*"([^"]+)"/m);
-  const name = nameMatch && nameMatch[1] ? nameMatch[1] : null;
-  const entryPoints = [];
-  if (/\[\[bin\]\]/.test(raw)) entryPoints.push("src/bin/");
-  if (name) entryPoints.push("src/main.rs");
-  return { name, entryPoints };
-}
-function renderCard(scan, now) {
-  const lines = [];
-  lines.push(`# Architecture Card \u2014 ${scan.root}`);
-  lines.push("");
-  lines.push(`_Generated ${now.toISOString()}_`);
-  lines.push("");
-  const namedManifest = scan.manifests.find((m) => m.name !== null);
-  if (namedManifest && namedManifest.name) {
-    lines.push(`**Project:** ${namedManifest.name}`);
-    lines.push("");
-  }
-  if (scan.manifests.length > 0) {
-    lines.push("## Manifests");
-    for (const m of scan.manifests) {
-      const label = m.name ? `${m.filename} (${m.name})` : m.filename;
-      lines.push(`- ${label}`);
-    }
-    lines.push("");
-  }
-  if (scan.topDirs.length > 0) {
-    lines.push("## Top-level directories");
-    const cols = 4;
-    for (let i = 0; i < scan.topDirs.length; i += cols) {
-      const row = scan.topDirs.slice(i, i + cols).join(" \xB7 ");
-      lines.push(`- ${row}`);
-    }
-    lines.push("");
-  }
-  if (scan.languageHistogram.length > 0) {
-    lines.push("## Languages (by file count)");
-    const top = scan.languageHistogram.slice(0, 10);
-    for (const entry of top) {
-      lines.push(`- ${entry.ext}: ${entry.count}`);
-    }
-    lines.push("");
-  }
-  const allEntryPoints = sortStrings(scan.manifests.flatMap((m) => m.entryPoints));
-  if (allEntryPoints.length > 0) {
-    lines.push("## Entry points");
-    for (const ep of allEntryPoints) {
-      lines.push(`- ${ep}`);
-    }
-    lines.push("");
-  }
-  return lines.join("\n").trimEnd() + "\n";
-}
-function sortStrings(values) {
-  return [...values].sort((a, b) => a.localeCompare(b));
-}
-function sortLanguageHistogram(entries) {
-  return [...entries].sort((a, b) => {
-    if (b.count !== a.count) return b.count - a.count;
-    return a.ext.localeCompare(b.ext);
-  });
-}
-function capToBytes(text, maxBytes) {
-  const byteLen = Buffer.byteLength(text, "utf-8");
-  if (byteLen <= maxBytes) {
-    return { text, truncated: false };
-  }
-  const marker = `
-
-_${ARCHITECTURE_CARD_TRUNCATION_MARKER}_`;
-  const markerBytes = Buffer.byteLength(marker, "utf-8");
-  const budget = maxBytes - markerBytes;
-  if (budget <= 0) {
-    return { text: marker.trimStart(), truncated: true };
-  }
-  let cut = 0;
-  let running = 0;
-  const chars = [...text];
-  for (let i = 0; i < chars.length; i++) {
-    const charBytes = Buffer.byteLength(chars[i], "utf-8");
-    if (running + charBytes > budget) break;
-    running += charBytes;
-    cut = i + 1;
-  }
-  return { text: chars.slice(0, cut).join("") + marker, truncated: true };
-}
-function clampSummaryToBytes(text, maxBytes) {
-  if (maxBytes <= 0) return "";
-  if (Buffer.byteLength(text, "utf-8") <= maxBytes) return text;
-  const ellipsis = " \u2026";
-  const budget = maxBytes - Buffer.byteLength(ellipsis, "utf-8");
-  if (budget <= 0) return "";
-  let cut = 0;
-  let running = 0;
-  const chars = [...text];
-  for (let i = 0; i < chars.length; i++) {
-    const charBytes = Buffer.byteLength(chars[i], "utf-8");
-    if (running + charBytes > budget) break;
-    running += charBytes;
-    cut = i + 1;
-  }
-  return chars.slice(0, cut).join("") + ellipsis;
-}
-
-// src/coding/architecture-surfaces.ts
-var ARCHITECTURE_CARD_TAG = "architecture-card";
-var ARCHITECTURE_CARD_KIND = "architecture";
-async function handleCodingArchitecture(request, ctx) {
-  const codingContext = request.sessionKey ? ctx.getCodingContext(request.sessionKey) : null;
-  if (codingContext === null || !isCodingKnowledgeFeatureEnabled(ctx.codingKnowledge, "architectureCard", codingContext)) {
-    ctx.throwInputError(
-      "coding_architecture requires codingKnowledge.enabled, codingKnowledge.architectureCard, and an attached coding context"
-    );
-  }
-  switch (request.subcommand) {
-    case "get":
-      return architectureGet(request, ctx);
-    case "refresh":
-      return architectureRefresh(request, ctx, codingContext);
-  }
-}
-async function architectureGet(request, ctx) {
-  const storage = await ctx.resolveStorage(request);
-  const existing = await findArchitectureCardMemory(storage);
-  if (!existing) {
-    return { subcommand: "get", found: false };
-  }
-  const content = stripAttributesSuffix(existing.content);
-  return {
-    subcommand: "get",
-    found: true,
-    card: {
-      content,
-      generatedAt: existing.frontmatter.updated ?? existing.frontmatter.created,
-      byteSize: Buffer.byteLength(content, "utf-8"),
-      // Derive truncation from the CONTENT marker, not a frontmatter tag —
-      // the refresh update path changes content without rewriting tags, so
-      // a tag-based check goes stale (cursor review: stale truncated tag).
-      truncated: content.includes(ARCHITECTURE_CARD_TRUNCATION_MARKER)
-    }
-  };
-}
-async function architectureRefresh(request, ctx, codingContext) {
-  const repoRoot = codingContext.rootPath ?? codingContext.projectId;
-  const storage = await ctx.resolveStorage(request);
-  const buildResult = await ctx.buildCard(repoRoot);
-  if (!buildResult.ok) {
-    log.warn(
-      `coding_architecture/refresh: card build failed (code=${buildResult.code}): ${buildResult.detail}`
-    );
-    ctx.throwInputError(
-      `coding_architecture refresh failed: card build returned ${buildResult.code}`
-    );
-  }
-  const cardContent = buildResult.card.content;
-  const tags = [ARCHITECTURE_CARD_TAG];
-  if (buildResult.card.truncated) tags.push("truncated");
-  const existing = await findArchitectureCardMemory(storage);
-  if (existing) {
-    await ctx.versioning.snapshotIfExists(existing);
-    const updated = await storage.updateMemory(existing.frontmatter.id, cardContent, {
-      actor: "coding-architecture-refresh",
-      ...ctx.sourceConnector ? { sourceConnector: ctx.sourceConnector } : {}
-    });
-    if (!updated) {
-      log.warn(
-        `coding_architecture/refresh: updateMemory returned false for id=${existing.frontmatter.id} \u2014 falling back to writeMemory`
-      );
-      const fallbackWrite = await storage.writeSealedMemory(
-        composeMemoryEnvelope(
-          {
-            content: cardContent,
-            category: "fact",
-            confidence: 1,
-            tags,
-            structuredAttributes: { cardKind: ARCHITECTURE_CARD_KIND },
-            ...ctx.sourceConnector ? { sourceConnector: ctx.sourceConnector } : {}
-          },
-          { source: "coding-architecture" }
-        ),
-        {}
-      );
-      log.info(
-        `access-write op=coding_architecture/refresh memoryId=${fallbackWrite.id} (fallback write) byteSize=${buildResult.card.byteSize}`
-      );
-      return refreshResponse(fallbackWrite, buildResult.card);
-    }
-    log.info(
-      `access-write op=coding_architecture/refresh memoryId=${existing.frontmatter.id} (updated) byteSize=${buildResult.card.byteSize}`
-    );
-    return {
-      subcommand: "refresh",
-      refreshed: true,
-      memoryId: existing.frontmatter.id,
-      byteSize: buildResult.card.byteSize,
-      truncated: buildResult.card.truncated
-    };
-  }
-  const newWrite = await storage.writeSealedMemory(
-    composeMemoryEnvelope(
-      {
-        content: cardContent,
-        category: "fact",
-        confidence: 1,
-        tags,
-        structuredAttributes: { cardKind: ARCHITECTURE_CARD_KIND },
-        ...ctx.sourceConnector ? { sourceConnector: ctx.sourceConnector } : {}
-      },
-      { source: "coding-architecture" }
-    ),
-    {}
-  );
-  log.info(
-    `access-write op=coding_architecture/refresh memoryId=${newWrite.id} (new) byteSize=${buildResult.card.byteSize}`
-  );
-  return refreshResponse(newWrite, buildResult.card);
-}
-function refreshResponse(writeResult, card) {
-  if (writeResult.tombstoneBlocked) {
-    return {
-      subcommand: "refresh",
-      refreshed: false,
-      memoryId: writeResult.id,
-      byteSize: card.byteSize,
-      truncated: card.truncated,
-      blockedReason: "tombstone-blocked",
-      ...writeResult.blockedBy !== void 0 ? { blockedBy: writeResult.blockedBy } : {}
-    };
-  }
-  return {
-    subcommand: "refresh",
-    refreshed: true,
-    memoryId: writeResult.id,
-    byteSize: card.byteSize,
-    truncated: card.truncated
-  };
-}
-async function findArchitectureCardMemory(storage) {
-  const memories = await storage.readAllMemories();
-  const cards = memories.filter((m) => {
-    if (m.frontmatter.category !== "fact") return false;
-    const tags = m.frontmatter.tags ?? [];
-    if (!tags.includes(ARCHITECTURE_CARD_TAG)) return false;
-    if (m.frontmatter.structuredAttributes?.cardKind !== ARCHITECTURE_CARD_KIND) return false;
-    const outer = m.frontmatter.status;
-    if (outer !== void 0 && outer !== "active") return false;
-    if (m.frontmatter.archivedAt !== void 0 && m.frontmatter.archivedAt !== null) return false;
-    return true;
-  });
-  if (cards.length === 0) return null;
-  cards.sort((a, b) => {
-    const aUpdated = a.frontmatter.updated ?? a.frontmatter.created;
-    const bUpdated = b.frontmatter.updated ?? b.frontmatter.created;
-    if (aUpdated !== bUpdated) return bUpdated.localeCompare(aUpdated);
-    return b.frontmatter.id.localeCompare(a.frontmatter.id);
-  });
-  return cards[0] ?? null;
-}
-function createArchitectureVersioningHook(enabled, maxVersionsPerPage, sidecarDir, memoryDir, readFile7, writeVersion) {
-  return {
-    async snapshotIfExists(memory) {
-      if (!enabled) return;
-      try {
-        const fullContent = await readFile7(memory.path);
-        await writeVersion(
-          memory.path,
-          fullContent,
-          "manual",
-          { enabled: true, maxVersionsPerPage, sidecarDir },
-          void 0,
-          "architecture-card-refresh",
-          memoryDir
-        );
-      } catch {
-      }
-    }
-  };
-}
-
-// src/coding/codegraph-runtime.ts
-import path2 from "path";
-import { readFile as readFile2, realpath } from "fs/promises";
-import { readFileSync, realpathSync } from "fs";
-import { pathToFileURL } from "url";
-import { createHash } from "crypto";
-function codegraphSurfaceVisible(config) {
-  const ck = config.codingKnowledge;
-  if (ck === void 0 || ck === null) return false;
-  return ck.enabled === true && ck.codegraphTools === true;
-}
-function resolveCodegraphRoot(config, memoryDir) {
-  const rawDir = config.codingKnowledge.codegraphDbDir.trim();
-  const root = rawDir.length > 0 ? expandTildePath(rawDir) : path2.join(memoryDir, "codegraph");
-  if (!path2.isAbsolute(root)) {
-    throw new CodegraphRuntimeError(
-      "store_error",
-      "codegraph DB root must be an absolute path; set codingKnowledge.codegraphDbDir (or memoryDir) to an absolute path"
-    );
-  }
-  return root;
-}
-function resolveCodegraphDbPath(params) {
-  const { config, memoryDir, principal, projectId } = params;
-  const root = resolveCodegraphRoot(config, memoryDir);
-  const principalSafe = sanitizePathSegment(principal);
-  const projectSafe = sanitizePathSegment(projectId);
-  return path2.join(root, principalSafe, `${projectSafe}.sqlite`);
-}
-function sanitizePathSegment(input) {
-  const trimmed = (input ?? "").trim();
-  if (trimmed.length === 0) return "_";
-  const sanitized = trimmed.replace(/[^A-Za-z0-9._:-]+/g, "_");
-  return sanitized.replace(/^\.+/, "").replace(/[/\\]+/g, "_") || "_";
-}
-var storeCache = /* @__PURE__ */ new Map();
-function storeCacheKey(principalSafe, projectSafe, dbPath) {
-  return `${principalSafe}::${projectSafe}::${dbPath}`;
-}
-function isCodegraphModule(value) {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  const graphStore = candidate.GraphStore;
-  return graphStore !== void 0 && typeof graphStore.open === "function";
-}
-async function resolveCodegraphModule() {
-  const mod = await tryLoadCodingGraphModule();
-  if (mod === null || !isCodegraphModule(mod)) return null;
-  return mod;
-}
-async function getCodegraphStore(params) {
-  const { config, memoryDir, principal, projectId, repoRoot } = params;
-  if (!codegraphSurfaceVisible(config)) {
-    throw new CodegraphRuntimeError(
-      "disabled",
-      "codegraph tools are disabled (codingKnowledge.enabled or codingKnowledge.codegraphTools is false)"
-    );
-  }
-  const mod = await resolveCodegraphModule();
-  if (mod === null) {
-    throw new CodegraphRuntimeError("package_missing", buildCodingGraphInstallHint());
-  }
-  const principalSafe = sanitizePathSegment(principal);
-  const projectSafe = sanitizePathSegment(projectId);
-  const dbPath = resolveCodegraphDbPath({ config, memoryDir, principal, projectId });
-  const key = storeCacheKey(principalSafe, projectSafe, dbPath);
-  const cached = storeCache.get(key);
-  if (cached !== void 0) {
-    if (repoRoot !== void 0 && cached.repoRoot === void 0) {
-      storeCache.delete(key);
-      try {
-        await cached.store.close();
-      } catch {
-      }
-      const store2 = await mod.GraphStore.open({ dbPath, repoRoot });
-      storeCache.set(key, { store: store2, repoRoot, openedAt: Date.now() });
-      return store2;
-    }
-    if (repoRoot !== void 0 && cached.repoRoot !== void 0 && cached.repoRoot !== repoRoot) {
-      throw new CodegraphRuntimeError(
-        "repo_root_conflict",
-        `codegraph store for project ${projectId} is already bound to repo root ${cached.repoRoot}; refusing to rebind to ${repoRoot}`
-      );
-    }
-    return cached.store;
-  }
-  const store = await mod.GraphStore.open({ dbPath, repoRoot });
-  storeCache.set(key, { store, repoRoot, openedAt: Date.now() });
-  return store;
-}
-function listCodegraphProjects(params) {
-  const { config, memoryDir, principal, listDir } = params;
-  if (!codegraphSurfaceVisible(config)) return [];
-  let root;
-  try {
-    root = resolveCodegraphRoot(config, memoryDir);
-  } catch {
-    return [];
-  }
-  const principalSafe = sanitizePathSegment(principal);
-  const principalDir = path2.join(root, principalSafe);
-  let entries;
-  try {
-    entries = listDir(principalDir);
-  } catch {
-    return [];
-  }
-  const projects = [];
-  for (const entry of entries) {
-    if (entry.endsWith(".sqlite")) {
-      projects.push(entry.slice(0, -".sqlite".length));
-    }
-  }
-  return projects;
-}
-async function deleteCodegraphProject(params) {
-  const { config, memoryDir, principal, projectId, confirm, removeFile } = params;
-  if (!confirm) {
-    throw new CodegraphRuntimeError(
-      "confirm_required",
-      "codegraph_delete_project requires confirm: true; destructive operations are never defaulted to proceed (rule 48)"
-    );
-  }
-  if (!codegraphSurfaceVisible(config)) {
-    throw new CodegraphRuntimeError("disabled", "codegraph tools are disabled");
-  }
-  const principalSafe = sanitizePathSegment(principal);
-  const projectSafe = sanitizePathSegment(projectId);
-  const dbPath = resolveCodegraphDbPath({ config, memoryDir, principal, projectId });
-  const key = storeCacheKey(principalSafe, projectSafe, dbPath);
-  const cached = storeCache.get(key);
-  if (cached !== void 0) {
-    storeCache.delete(key);
-    try {
-      await cached.store.close();
-    } catch {
-    }
-  }
-  let deleted = false;
-  try {
-    removeFile(dbPath);
-    deleted = true;
-  } catch (err) {
-    const code = err?.code;
-    if (code === "ENOENT") {
-      deleted = true;
-    } else {
-      deleted = false;
-    }
-  }
-  return { deleted, projectId };
-}
-function makeCodegraphRuntimeDelegates() {
-  return {
-    runReindex: (store, repoRoot, mode) => runCodegraphReindex({ store, repoRoot, mode }),
-    reportIndexStatus: (store, repoRoot) => reportCodegraphIndexStatus({ store, repoRoot }),
-    detectChanges: (store, repoRoot, head) => detectCodegraphChanges({ store, repoRoot, head }),
-    ingestTraces: (store, traces) => ingestCodegraphTraces({ store, traces }),
-    runLspResolution: (store, repoRoot, lspConfig) => runCodegraphLspResolution({ store, repoRoot, lspConfig })
-  };
-}
-async function runCodegraphReindex(params) {
-  const mod = await resolveCodegraphModule();
-  if (mod === null) {
-    return { ok: false, code: "package_missing", message: "The @remnic/coding-graph package is not installed." };
-  }
-  if (typeof mod.executeReindex !== "function" || typeof mod.defaultCodingGitInvoker !== "function") {
-    return { ok: false, code: "runtime_unavailable", message: "executeReindex is not available in the installed @remnic/coding-graph." };
-  }
-  const git = mod.defaultCodingGitInvoker();
-  let engine;
-  try {
-    if (typeof mod.createCodingGraphEngine !== "function") {
-      return { ok: false, code: "engine_unavailable", message: "createCodingGraphEngine is not exported by @remnic/coding-graph." };
-    }
-    engine = mod.createCodingGraphEngine();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "engine_unavailable", message: `The coding-graph engine is not ready: ${msg}` };
-  }
-  let candidatePaths = [];
-  try {
-    const tracked = git.listTrackedFiles(params.repoRoot);
-    if (tracked.ok) {
-      candidatePaths = tracked.paths;
-    }
-  } catch {
-  }
-  try {
-    const result = await mod.executeReindex({
-      store: params.store,
-      git,
-      repoRoot: params.repoRoot,
-      parseFile: (input) => engine.parseFile(input),
-      candidatePaths
-    });
-    if (result && result.ok === true) {
-      return { ok: true, mode: result.mode ?? "auto", filesIngested: result.filesIngested ?? 0, head: result.head ?? null };
-    }
-    return {
-      ok: false,
-      code: result?.code ?? "store_error",
-      message: result?.message ?? "executeReindex reported a failure."
-    };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "store_error", message: msg };
-  }
-}
-async function lspPathEscapesRoot(repoRoot, absPath) {
-  try {
-    const [realRoot, realAbs] = await Promise.all([realpath(repoRoot), realpath(absPath)]);
-    const rel = path2.relative(realRoot, realAbs);
-    return rel === ".." || rel.startsWith(".." + path2.sep) || path2.isAbsolute(rel);
-  } catch {
-    return false;
-  }
-}
-function lspPathEscapesRootSync(repoRoot, absPath) {
-  try {
-    const realRoot = realpathSync(repoRoot);
-    const realAbs = realpathSync(absPath);
-    const rel = path2.relative(realRoot, realAbs);
-    return rel === ".." || rel.startsWith(".." + path2.sep) || path2.isAbsolute(rel);
-  } catch {
-    return false;
-  }
-}
-var DEFAULT_LSP_SERVERS = {
-  typescript: { command: "typescript-language-server", args: ["--stdio"] },
-  tsx: { command: "typescript-language-server", args: ["--stdio"] },
-  javascript: { command: "typescript-language-server", args: ["--stdio"] },
-  python: { command: "pyright-langserver", args: ["--stdio"] },
-  go: { command: "gopls", args: [] },
-  rust: { command: "rust-analyzer", args: [] }
-};
-async function runCodegraphLspResolution(params) {
-  const mod = await resolveCodegraphModule();
-  if (mod === null) {
-    return { ok: false, code: "package_missing", message: "@remnic/coding-graph is not installed." };
-  }
-  if (typeof mod.executeLspResolution !== "function" || typeof mod.planLspUpgrades !== "function" || typeof mod.LspClient?.connect !== "function") {
-    return { ok: false, code: "runtime_unavailable", message: "LSP resolution is not available in the installed @remnic/coding-graph." };
-  }
-  const engine = mod.createCodingGraphEngine?.() ?? null;
-  if (engine === null) {
-    return { ok: false, code: "engine_unavailable", message: "createCodingGraphEngine is not available." };
-  }
-  const repoRoot = path2.resolve(params.repoRoot);
-  const gitFactory = mod.defaultCodingGitInvoker;
-  if (typeof gitFactory !== "function") {
-    return { ok: true, upgraded: 0, unresolved: 0, budgetExhausted: 0 };
-  }
-  const tracked = gitFactory().listTrackedFiles(repoRoot);
-  if (!("paths" in tracked)) {
-    return { ok: true, upgraded: 0, unresolved: 0, budgetExhausted: 0 };
-  }
-  const resolvedCalleesBySrc = /* @__PURE__ */ new Map();
-  const alreadyResolved = (filePath, srcQualifiedName, calleeName) => {
-    const key = `${filePath}\0${srcQualifiedName}`;
-    let names = resolvedCalleesBySrc.get(key);
-    if (names === void 0) {
-      names = /* @__PURE__ */ new Set();
-      if (typeof params.store.resolvedCalleeNames === "function") {
-        for (const name of params.store.resolvedCalleeNames(srcQualifiedName, "heuristic", filePath)) {
-          names.add(name);
-        }
-      }
-      resolvedCalleesBySrc.set(key, names);
-    }
-    return names.has(calleeName);
-  };
-  const sites = [];
-  const gatheredCountByFile = /* @__PURE__ */ new Map();
-  const filteredCountByFile = /* @__PURE__ */ new Map();
-  const filteredSrcByFile = /* @__PURE__ */ new Map();
-  const parsedFiles = /* @__PURE__ */ new Set();
-  for (const rel of tracked.paths) {
-    const absPath = path2.join(repoRoot, rel);
-    if (await lspPathEscapesRoot(repoRoot, absPath)) continue;
-    let content;
-    try {
-      content = await readFile2(absPath, "utf-8");
-    } catch {
-      continue;
-    }
-    let parsed;
-    try {
-      parsed = await engine.parseFile({ path: rel, content });
-    } catch {
-      continue;
-    }
-    if (!parsed || typeof parsed !== "object" || !("ok" in parsed) || parsed.ok !== true || !("ir" in parsed)) continue;
-    const ir = parsed.ir;
-    if (!ir || typeof ir !== "object" || !("callSites" in ir) || !Array.isArray(ir.callSites)) continue;
-    parsedFiles.add(rel);
-    const language = "language" in ir && typeof ir.language === "string" ? ir.language : "";
-    const symbols = "symbols" in ir && Array.isArray(ir.symbols) ? ir.symbols : [];
-    const contentBytes = Buffer.from(content, "utf-8");
-    for (const site of ir.callSites) {
-      if (!site || typeof site !== "object" || !("span" in site)) continue;
-      const span = site.span;
-      if (!span || typeof span !== "object" || !("startByte" in span) || typeof span.startByte !== "number") continue;
-      const calleeName = "calleeNameCandidates" in site && Array.isArray(site.calleeNameCandidates) && typeof site.calleeNameCandidates[0] === "string" ? site.calleeNameCandidates[0] : "";
-      if (calleeName.length === 0) continue;
-      let srcQualifiedName = "";
-      let bestSpanSize = Number.POSITIVE_INFINITY;
-      for (const sym of symbols) {
-        if (!sym || typeof sym !== "object" || !("span" in sym) || !("qualifiedName" in sym)) continue;
-        const ss = sym.span;
-        if (!ss || typeof ss !== "object" || !("startByte" in ss) || !("endByte" in ss)) continue;
-        if (typeof ss.startByte !== "number" || typeof ss.endByte !== "number") continue;
-        if (ss.startByte <= span.startByte && span.startByte < ss.endByte) {
-          const size = ss.endByte - ss.startByte;
-          if (size < bestSpanSize) {
-            bestSpanSize = size;
-            srcQualifiedName = typeof sym.qualifiedName === "string" ? sym.qualifiedName : "";
-          }
-        }
-      }
-      if (srcQualifiedName.length === 0) continue;
-      const memberAccess = "memberAccess" in site && site.memberAccess === true;
-      if (!memberAccess && alreadyResolved(rel, srcQualifiedName, calleeName)) {
-        filteredCountByFile.set(rel, (filteredCountByFile.get(rel) ?? 0) + 1);
-        let srcs = filteredSrcByFile.get(rel);
-        if (srcs === void 0) {
-          srcs = /* @__PURE__ */ new Map();
-          filteredSrcByFile.set(rel, srcs);
-        }
-        const callees = srcs.get(srcQualifiedName);
-        if (callees === void 0) srcs.set(srcQualifiedName, /* @__PURE__ */ new Set([calleeName]));
-        else callees.add(calleeName);
-        continue;
-      }
-      const nameIdx = contentBytes.indexOf(Buffer.from(calleeName, "utf-8"), span.startByte);
-      const endByte = "endByte" in span && typeof span.endByte === "number" ? span.endByte : span.startByte + calleeName.length;
-      const calleeByteOffset = nameIdx >= 0 && nameIdx < endByte ? nameIdx : span.startByte;
-      sites.push({ filePath: rel, language, content, calleeByteOffset, calleeName, srcQualifiedName });
-      gatheredCountByFile.set(rel, (gatheredCountByFile.get(rel) ?? 0) + 1);
-    }
-  }
-  const canPreserve = typeof params.store.callEdgesForCaller === "function";
-  const preservedEdgesForFile = (rel) => {
-    const srcs = filteredSrcByFile.get(rel);
-    if (srcs === void 0 || !canPreserve) return [];
-    const preserved = [];
-    for (const [src] of srcs) {
-      const heuristicDsts = new Set(
-        params.store.callEdgesForCaller(src, rel, "heuristic").map((e) => e.dstQualifiedName)
-      );
-      for (const edge of params.store.callEdgesForCaller(src, rel, "lsp")) {
-        if (!heuristicDsts.has(edge.dstQualifiedName)) continue;
-        preserved.push({
-          srcQualifiedName: edge.srcQualifiedName,
-          dstQualifiedName: edge.dstQualifiedName,
-          type: edge.type
-        });
-      }
-    }
-    return preserved;
-  };
-  if (typeof params.store.reconcileLspEdges === "function") {
-    for (const rel of parsedFiles) {
-      if ((gatheredCountByFile.get(rel) ?? 0) !== 0) continue;
-      const filteredCount = filteredCountByFile.get(rel) ?? 0;
-      if (filteredCount > 0 && !canPreserve) continue;
-      params.store.reconcileLspEdges(rel, preservedEdgesForFile(rel));
-    }
-  }
-  if (sites.length === 0) {
-    return { ok: true, upgraded: 0, unresolved: 0, budgetExhausted: 0 };
-  }
-  const byLanguage = /* @__PURE__ */ new Map();
-  const srcToFiles = /* @__PURE__ */ new Map();
-  for (const site of sites) {
-    const group = byLanguage.get(site.language);
-    if (group === void 0) byLanguage.set(site.language, [site]);
-    else group.push(site);
-    const files = srcToFiles.get(site.srcQualifiedName);
-    if (files === void 0) srcToFiles.set(site.srcQualifiedName, /* @__PURE__ */ new Set([site.filePath]));
-    else files.add(site.filePath);
-  }
-  const configServers = params.lspConfig.servers ?? {};
-  const timeoutMs = params.lspConfig.timeoutMs ?? 3e3;
-  let remainingBudget = Math.max(1, Math.floor(params.lspConfig.maxRequestsPerRun ?? 500));
-  const rootUri = pathToFileURL(repoRoot).href;
-  const resolveContent = (filePath) => {
-    const absPath = path2.join(repoRoot, filePath);
-    if (lspPathEscapesRootSync(repoRoot, absPath)) return null;
-    try {
-      return readFileSync(absPath, "utf-8");
-    } catch {
-      return null;
-    }
-  };
-  let upgraded = 0;
-  let unresolved = 0;
-  let budgetExhausted = 0;
-  const degradations = [];
-  for (const [language, group] of byLanguage) {
-    if (remainingBudget <= 0) {
-      budgetExhausted += group.length;
-      continue;
-    }
-    const rawSpec = configServers[language] ?? DEFAULT_LSP_SERVERS[language];
-    if (rawSpec === void 0) {
-      degradations.push({
-        language,
-        code: "no_launch_spec",
-        message: `No LSP server configured for ${language} (${group.length} candidate call site(s)); set codingKnowledge.lsp.servers.${language}.`
-      });
-      unresolved += group.length;
-      continue;
-    }
-    const launchSpec = { command: rawSpec.command, args: rawSpec.args ?? [] };
-    const plan = mod.planLspUpgrades(group, { maxRequests: remainingBudget });
-    budgetExhausted += plan.budgetExhausted;
-    remainingBudget -= plan.requests.length;
-    if (plan.requests.length === 0) continue;
-    const plannedCountByFile = /* @__PURE__ */ new Map();
-    for (const req of plan.requests) {
-      if (req && typeof req === "object" && "filePath" in req && typeof req.filePath === "string") {
-        plannedCountByFile.set(req.filePath, (plannedCountByFile.get(req.filePath) ?? 0) + 1);
-      }
-    }
-    const connected = await mod.LspClient.connect({ launchSpec, rootUri, timeoutMs });
-    if (!connected.ok) {
-      const deg = connected.degradation;
-      const code = deg && typeof deg === "object" && "code" in deg && typeof deg.code === "string" ? deg.code : "connect_failed";
-      const message = deg && typeof deg === "object" && "detail" in deg && typeof deg.detail === "string" ? deg.detail : `LSP server for ${language} failed to connect.`;
-      degradations.push({ language, code, message });
-      unresolved += plan.requests.length;
-      remainingBudget += plan.requests.length;
-      continue;
-    }
-    const client = connected.client;
-    let skippedEdgesTotal = 0;
-    const skippedFiles = /* @__PURE__ */ new Set();
-    try {
-      const result = await mod.executeLspResolution(plan.requests, {
-        client,
-        workspaceRoot: repoRoot,
-        resolveContent,
-        nodeLocator: (filePath, byteOffset) => typeof params.store.findNodeBySpan === "function" ? params.store.findNodeBySpan(filePath, byteOffset) : null,
-        applyUpgrades: async (upgrades) => {
-          if (typeof params.store.upsertEdges !== "function") {
-            throw new Error("store.upsertEdges is not available");
-          }
-          const result2 = await params.store.upsertEdges(upgrades);
-          if (!result2.ok) {
-            degradations.push({
-              language,
-              code: "edge_write_failed",
-              message: `upsertEdges failed for ${language}: ${result2.code}.`
-            });
-            throw new Error(`upsertEdges failed: ${result2.code}`);
-          }
-          if (result2.skipped > 0) {
-            skippedEdgesTotal += result2.skipped;
-            for (const upgrade of upgrades) {
-              for (const file of srcToFiles.get(upgrade.srcQualifiedName) ?? []) {
-                skippedFiles.add(file);
-              }
-            }
-            degradations.push({
-              language,
-              code: "edges_skipped",
-              message: `upsertEdges persisted ${result2.persisted} and skipped ${result2.skipped} edge(s) for ${language} (unresolvable endpoints).`
-            });
-          }
-        },
-        reconcileLspEdges: (filePath, assertedEdges) => {
-          if (typeof params.store.reconcileLspEdges !== "function") return;
-          if (plannedCountByFile.get(filePath) !== gatheredCountByFile.get(filePath)) return;
-          if (skippedFiles.has(filePath)) return;
-          if ((filteredCountByFile.get(filePath) ?? 0) > 0 && !canPreserve) return;
-          params.store.reconcileLspEdges(filePath, [...assertedEdges, ...preservedEdgesForFile(filePath)]);
-        }
-      });
-      if (result && typeof result === "object" && "upgraded" in result && typeof result.upgraded === "number") {
-        upgraded += Math.max(0, result.upgraded - skippedEdgesTotal);
-        unresolved += "unresolved" in result && typeof result.unresolved === "number" ? result.unresolved : 0;
-        budgetExhausted += "budgetExhausted" in result && typeof result.budgetExhausted === "number" ? result.budgetExhausted : 0;
-        if ("degradation" in result && result.degradation && typeof result.degradation === "object") {
-          const rd = result.degradation;
-          degradations.push({
-            language,
-            code: "code" in rd && typeof rd.code === "string" ? rd.code : "lsp_degraded",
-            message: "detail" in rd && typeof rd.detail === "string" ? rd.detail : `LSP pass for ${language} degraded mid-run.`
-          });
-        }
-      } else {
-        unresolved += plan.requests.length;
-      }
-    } catch (err) {
-      const detail = displayErrorDetail(err);
-      return {
-        ok: false,
-        code: "lsp_resolution_error",
-        message: detail.length > 0 ? `LSP resolution failed: ${detail}.` : "LSP resolution failed."
-      };
-    } finally {
-      const disposable = client;
-      if (typeof disposable.dispose === "function") {
-        try {
-          await disposable.dispose();
-        } catch {
-        }
-      }
-    }
-  }
-  return {
-    ok: true,
-    upgraded,
-    unresolved,
-    budgetExhausted,
-    ...degradations.length > 0 ? { degradations } : {}
-  };
-}
-async function reportCodegraphIndexStatus(params) {
-  const mod = await resolveCodegraphModule();
-  if (mod === null) {
-    return { ok: false, code: "package_missing", message: "The @remnic/coding-graph package is not installed." };
-  }
-  if (typeof mod.getIndexStatus !== "function" || typeof mod.defaultCodingGitInvoker !== "function") {
-    return { ok: false, code: "runtime_unavailable", message: "getIndexStatus is not available in the installed @remnic/coding-graph." };
-  }
-  const git = mod.defaultCodingGitInvoker();
-  try {
-    const status = mod.getIndexStatus(params.store, git, params.repoRoot);
-    return { ok: true, status };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "store_error", message: msg };
-  }
-}
-async function detectCodegraphChanges(params) {
-  const mod = await resolveCodegraphModule();
-  if (mod === null) {
-    return { ok: false, code: "package_missing", message: "The @remnic/coding-graph package is not installed." };
-  }
-  if (typeof mod.computeBlastRadius !== "function") {
-    return { ok: false, code: "runtime_unavailable", message: "computeBlastRadius is not available in the installed @remnic/coding-graph." };
-  }
-  let engine;
-  try {
-    if (typeof mod.createCodingGraphEngine !== "function") {
-      return { ok: false, code: "engine_unavailable", message: "createCodingGraphEngine is not exported by @remnic/coding-graph." };
-    }
-    engine = mod.createCodingGraphEngine();
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "engine_unavailable", message: `The coding-graph engine is not ready: ${msg}` };
-  }
-  void engine;
-  void params;
-  try {
-    const result = mod.computeBlastRadius(params.store, /* @__PURE__ */ new Set());
-    if (result && result.ok === true) {
-      return { ok: true, affected: result.affected ?? [] };
-    }
-    return { ok: false, code: result?.code ?? "store_error", message: "computeBlastRadius reported a failure." };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "store_error", message: msg };
-  }
-}
-async function ingestCodegraphTraces(params) {
-  if (typeof params.store.upsertEdges !== "function") {
-    return {
-      ok: false,
-      code: "runtime_unavailable",
-      message: "The installed @remnic/coding-graph does not expose upsertEdges; traces cannot be persisted."
-    };
-  }
-  const edges = [];
-  let accepted = 0;
-  for (const trace of params.traces) {
-    const t = trace;
-    if (typeof t?.caller !== "string" || typeof t?.callee !== "string") {
-      continue;
-    }
-    accepted += 1;
-    edges.push({
-      srcQualifiedName: t.caller,
-      dstQualifiedName: t.callee,
-      type: "HTTP_CALLS",
-      confidence: typeof t.confidence === "number" && t.confidence >= 0 && t.confidence <= 1 ? t.confidence : 0.5,
-      provenance: "trace"
-    });
-  }
-  try {
-    const result = await params.store.upsertEdges(edges);
-    if (result.ok === true) {
-      return { ok: true, accepted, persisted: result.persisted, skipped: result.skipped };
-    }
-    return { ok: false, code: result.code, message: "store.upsertEdges reported a failure." };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { ok: false, code: "store_error", message: msg };
-  }
-}
-function deriveCodegraphProjectId(repoRoot) {
-  return `root:${createHash("sha256").update(repoRoot).digest("hex").slice(0, 16)}`;
-}
-function resolveCodegraphProjectId(params) {
-  const { request, getCodingContext } = params;
-  const explicit = typeof request.project === "string" ? request.project.trim() : "";
-  if (explicit.length > 0) return explicit;
-  const sessionKey = typeof request.sessionKey === "string" ? request.sessionKey.trim() : "";
-  if (sessionKey.length > 0) {
-    const cc = getCodingContext(sessionKey);
-    if (cc !== null) return cc.projectId;
-  }
-  const repoRoot = typeof request.repoRoot === "string" ? request.repoRoot.trim() : "";
-  if (repoRoot.length > 0) return deriveCodegraphProjectId(repoRoot);
-  throw new CodegraphRuntimeError(
-    "project_required",
-    "codegraph: project must be supplied explicitly, via a session coding context, or alongside a repoRoot"
-  );
-}
-var CodegraphRuntimeError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "CodegraphRuntimeError";
-    this.code = code;
-  }
-};
+  SupportPassportListCardsInputSchema,
+  SupportPassportManualDraftInputSchema,
+  SupportPassportMemoryIdSchema,
+  SupportPassportNamespaceSchema,
+  SupportPassportReplaceCardInputSchema,
+  SupportPassportSourceMemoryIdSchema,
+  activeSupportPassportReplacementPredecessorIds,
+  computeSupportPassportCardRevision,
+  computeSupportPassportOwnerKey,
+  createSupportPassportPrivateFileExclusion,
+  decodeSupportPassportNamespaceAttributes,
+  encodeSupportPassportNamespaceAttributes,
+  isSupportPassportPrivateMemory,
+  projectSupportPassportCard
+} from "./chunk-EEOUMG3J.js";
+import {
+  serializeMutations,
+  withHeldFileLock
+} from "./chunk-FFAZ2XFU.js";
+import {
+  computeContentHash
+} from "./chunk-5FVVY2EB.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-JDSVLVCG.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
+import {
+  buildHandleIndexForResults,
+  isHandleToken
+} from "./chunk-JAKIDQB2.js";
+import {
+  OFFLINE_SYNC_SNAPSHOT_FORMAT,
+  applyOfflineSyncChangeset,
+  applyOfflineSyncFileContentChunk,
+  buildOfflineSyncSnapshot,
+  buildOfflineSyncSnapshotForPaths,
+  buildOfflineSyncSnapshotFromBase,
+  compileOfflineSyncExcludeGlobs,
+  filterOfflineSyncDeletionRevisions,
+  iterateOfflineSyncSnapshotFileRecords,
+  normalizeOfflineSyncChangeset,
+  readOfflineSyncFileContentChunk
+} from "./chunk-XJJYSX6F.js";
+import {
+  validateArchiveRelativePath
+} from "./chunk-GCGJW34D.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
+import {
+  assertOperationAuthorizationAllowed,
+  capabilityAllowsOp,
+  enforceNamespaceAllowList,
+  isNamespaceAllowed,
+  tokenCapabilityStore
+} from "./chunk-MZWSOLMT.js";
+import {
+  canReadNamespace,
+  canWriteNamespace,
+  citationAuthorizedNamespaces,
+  defaultNamespaceForPrincipal,
+  recallNamespacesForPrincipal,
+  resolvePrincipal
+} from "./chunk-MRV7VSQK.js";
+import {
+  namespaceIdentityFromToken
+} from "./chunk-VUFL7X3H.js";
+import {
+  resolveAccessSetupCapabilities,
+  resolveCompressionCapabilities,
+  resolveConsolidationCapabilities,
+  resolveGraphConstructionCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveIndexingCapabilities,
+  resolveLocalLlmCapabilities,
+  resolveMemoryLifecycleCapabilities,
+  resolveNamespaceCapabilities,
+  resolveObjectiveStateCapabilities,
+  resolveQmdCapabilities,
+  resolveRecallAuxiliaryCapabilities,
+  resolveRecallEnhancementCapabilities,
+  resolveSecurityCapabilities
+} from "./chunk-JUOZ62Y7.js";
+import {
+  AccessIdempotencyStore,
+  hashAccessIdempotencyPayload
+} from "./chunk-VFUEZZBS.js";
+import {
+  resolveCodingContextFromOptions
+} from "./chunk-MJUCDM3C.js";
+import {
+  combineNamespaces,
+  defaultGitInvokerSync,
+  lcmSessionKeyForNamespace,
+  projectTagProjectId,
+  resolveCodingNamespaceOverlay,
+  resolveGitContext,
+  sanitizeFragment
+} from "./chunk-QBC33MPY.js";
+import {
+  expandTildePath
+} from "./chunk-EYIEWJNI.js";
+import {
+  EngramAccessForbiddenError,
+  EngramAccessInputError,
+  NamespaceNotWritableError
+} from "./chunk-2Z24E5W2.js";
+import {
+  abortError,
+  isAbortError,
+  raceAbort,
+  throwIfAborted
+} from "./chunk-BTTPKDIL.js";
+import {
+  readJsonFile,
+  writeJsonFileAtomic
+} from "./chunk-P77QX3ID.js";
+import {
+  AccessAuditAdapter
+} from "./chunk-TVVEYCNW.js";
+import {
+  decodeCitationNamespace
+} from "./chunk-DJORULH3.js";
+import {
+  isPathInsideStorageRoot
+} from "./chunk-FF4KLI5W.js";
+import {
+  SecureStoreLockedError
+} from "./chunk-ET2CNMLD.js";
+import {
+  ALL_CATEGORY_DIRS,
+  getCategoryDir
+} from "./chunk-VS2IYZRU.js";
+import {
+  recordCitationUsage
+} from "./chunk-NINSR6LX.js";
+import {
+  log
+} from "./chunk-3WCASNQZ.js";
 
-// src/coding/decision-records.ts
-var DECISION_STATUSES = [
-  "proposed",
-  "accepted",
-  "superseded",
-  "rejected"
-];
-var ACTIVE_DECISION_STATUSES = /* @__PURE__ */ new Set([
-  "proposed",
-  "accepted"
-]);
-var DEFAULT_DECISION_STATUS = "proposed";
-var DECISION_STATUS_BY_VALUE = Object.freeze({
-  proposed: "proposed",
-  accepted: "accepted",
-  superseded: "superseded",
-  rejected: "rejected"
-});
-function isDecisionStatus(value) {
-  return typeof value === "string" && Object.prototype.hasOwnProperty.call(DECISION_STATUS_BY_VALUE, value);
-}
-var FRONTMATTER_KEYS = Object.freeze([
-  "id",
-  "title",
-  "status",
-  "context",
-  "decision",
-  "consequences",
-  "entityRefs",
-  "supersedes"
-]);
-function serializeDecisionRecord(record) {
-  const lines = ["---"];
-  for (const key of FRONTMATTER_KEYS) {
-    const present = key === "supersedes" ? record.supersedes !== void 0 : key === "consequences" ? record.consequences !== void 0 : true;
-    if (!present) continue;
-    lines.push(`${key}: ${encodeFrontmatterValue(key, record)}`);
-  }
-  lines.push("---", "");
-  if (record.context) lines.push(record.context);
-  lines.push("");
-  lines.push("# Decision");
-  lines.push("");
-  if (record.decision) lines.push(record.decision);
-  if (record.consequences !== void 0 && record.consequences.length > 0) {
-    lines.push("");
-    lines.push("# Consequences");
-    lines.push("");
-    lines.push(record.consequences);
-  }
-  if (record.entityRefs.length > 0) {
-    lines.push("");
-    lines.push("# Entity references");
-    for (const ref of record.entityRefs) lines.push(`- ${ref}`);
-  }
-  lines.push("");
-  return lines.join("\n");
-}
-function encodeFrontmatterValue(key, record) {
-  if (key === "entityRefs") {
-    const refs = record.entityRefs;
-    if (refs.length === 0) return "[]";
-    const inner = refs.map((ref) => `"${escapeYamlString(ref)}"`).join(", ");
-    return `[${inner}]`;
-  }
-  if (key === "status") return `"${record.status}"`;
-  if (key === "supersedes") return `"${record.supersedes ?? ""}"`;
-  if (key === "consequences") return `"${escapeYamlString(record.consequences ?? "")}"`;
-  const value = record[key];
-  return `"${escapeYamlString(typeof value === "string" ? value : String(value))}"`;
-}
-function escapeYamlString(value) {
-  return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
-}
-function parseDecisionRecord(raw) {
-  const { fields, body } = extractFrontmatter(raw);
-  for (const fieldKey of Object.keys(fields)) {
-    if (!FRONTMATTER_KEYS.includes(fieldKey)) {
-      throw new Error(
-        `decision record frontmatter contains unknown key '${fieldKey}'; valid keys are ${FRONTMATTER_KEYS.join(", ")}.`
-      );
-    }
-  }
-  const id = requireString(fields.id, "id");
-  const title = requireString(fields.title, "title");
-  const context = requireString(fields.context, "context");
-  const decision = requireString(fields.decision, "decision");
-  const consequences = fields.consequences === void 0 ? void 0 : requireString(fields.consequences, "consequences");
-  let status = DEFAULT_DECISION_STATUS;
-  if (fields.status !== void 0 && fields.status !== null) {
-    if (!isDecisionStatus(fields.status)) {
-      throw new Error(
-        `decision '${id}' has invalid status '${JSON.stringify(fields.status)}'; valid statuses are ${DECISION_STATUSES.join(", ")}.`
-      );
-    }
-    status = fields.status;
-  }
-  const entityRefs = parseEntityRefs(fields.entityRefs);
-  const supersedes = fields.supersedes === void 0 ? void 0 : requireString(fields.supersedes, "supersedes");
-  const record = {
-    id,
-    title,
-    status,
-    context,
-    decision,
-    consequences,
-    entityRefs,
-    ...supersedes !== void 0 ? { supersedes } : {}
-  };
-  void body;
-  return record;
-}
-function requireString(field, key) {
-  if (field === void 0 || field === null) {
-    throw new Error(`decision record frontmatter is missing required field '${key}'.`);
-  }
-  if (typeof field !== "string") {
-    throw new Error(
-      `decision record frontmatter field '${key}' must be a string; got ${JSON.stringify(field)}.`
-    );
-  }
-  return field;
-}
-function parseEntityRefs(field) {
-  if (field === void 0) return [];
-  if (!Array.isArray(field)) {
-    throw new Error(
-      `decision record frontmatter field 'entityRefs' must be an array of strings; got ${JSON.stringify(field)}.`
-    );
-  }
-  for (const entry of field) {
-    if (typeof entry !== "string") {
-      throw new Error(
-        `decision record frontmatter 'entityRefs' entries must be strings; got ${JSON.stringify(entry)}.`
-      );
-    }
-  }
-  return [...field];
-}
-function extractFrontmatter(raw) {
-  const text = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
-  if (!text.startsWith("---\n")) {
-    throw new Error(
-      "decision record must start with a YAML frontmatter fence (`---\\n`); got a document with no leading fence."
-    );
-  }
-  const closeAt = text.indexOf("\n---", 4);
-  if (closeAt === -1) {
-    throw new Error(
-      "decision record frontmatter is missing its closing fence (`\\n---`); the document is truncated."
-    );
-  }
-  const yamlBody = text.slice(4, closeAt);
-  const after = text.slice(closeAt + 4);
-  const body = after.startsWith("\n") ? after.slice(1) : after;
-  return { fields: parseYamlMapping(yamlBody), body };
-}
-function parseYamlMapping(input) {
-  const fields = {};
-  for (const rawLine of input.split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.length === 0 || line.startsWith("#")) continue;
-    const colonAt = line.indexOf(":");
-    if (colonAt === -1) {
-      throw new Error(`decision record frontmatter line is not a key:value pair: "${line}".`);
-    }
-    const key = line.slice(0, colonAt).trim();
-    const valueText = line.slice(colonAt + 1).trim();
-    if (key.length === 0) {
-      throw new Error(`decision record frontmatter has an empty key in line: "${line}".`);
-    }
-    fields[key] = decodeScalar(valueText);
-  }
-  return fields;
-}
-function decodeScalar(valueText) {
-  if (valueText.length === 0) return "";
-  const lower = valueText.toLowerCase();
-  if (lower === "true") return true;
-  if (lower === "false") return false;
-  if (lower === "null" || lower === "~") return null;
-  if (/^-?\d+$/.test(valueText)) return Number(valueText);
-  if (/^".*"$/.test(valueText)) {
-    return valueText.slice(1, -1).replace(/\\\\/g, "\0").replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\u0000/g, "\\");
-  }
-  if (/^\[.*\]$/.test(valueText)) return parseFlowList(valueText);
-  return valueText;
-}
-function parseFlowList(valueText) {
-  const inner = valueText.slice(1, -1).trim();
-  if (inner.length === 0) return [];
-  const out = [];
-  let buf = "";
-  let inQuotes = false;
-  let escaped = false;
-  for (let i = 0; i < inner.length; i += 1) {
-    const c = inner[i];
-    if (escaped) {
-      buf += c;
-      escaped = false;
-      continue;
-    }
-    if (c === "\\") {
-      buf += c;
-      escaped = true;
-      continue;
-    }
-    if (c === '"') {
-      inQuotes = !inQuotes;
-      buf += c;
-      continue;
-    }
-    if (c === "," && !inQuotes) {
-      out.push(stripFlowStringQuotes(buf.trim()));
-      buf = "";
-      continue;
-    }
-    buf += c;
-  }
-  if (buf.length > 0) out.push(stripFlowStringQuotes(buf.trim()));
-  return out;
-}
-function stripFlowStringQuotes(value) {
-  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
-    return value.slice(1, -1).replace(/\\\\/g, "\0").replace(/\\n/g, "\n").replace(/\\"/g, '"').replace(/\u0000/g, "\\");
-  }
-  return value;
-}
+// src/access-service.ts
+import { createHash as createHash12 } from "crypto";
+import { constants as fsConstants2 } from "fs";
+import { readdirSync, unlinkSync } from "fs";
+import { stat as stat3 } from "fs/promises";
+import * as nodeFs2 from "fs/promises";
+import { ZodError } from "zod";
 
 // src/coding/decision-surfaces.ts
 var DECISION_SUBCOMMANDS = [
@@ -2167,7 +761,7 @@ async function handleGetSchema(store, tool) {
   return { tool, ok: true, result: stats };
 }
 async function handleSearchGraph(store, request, ctx) {
-  const query = requireString2(request.query, "query", ctx);
+  const query = requireString(request.query, "query", ctx);
   const limit = clampPositiveInteger(request.limit, 50, "limit", ctx);
   const result = store.searchGraph({ namePattern: query, limit });
   if (!result.ok) {
@@ -2177,7 +771,7 @@ async function handleSearchGraph(store, request, ctx) {
 }
 var SEARCH_CODE_KINDS = ["function", "class", "method"];
 async function handleSearchCode(store, request, ctx) {
-  const query = requireString2(request.query, "query", ctx);
+  const query = requireString(request.query, "query", ctx);
   const limit = clampPositiveInteger(request.limit, 50, "limit", ctx);
   const seen = /* @__PURE__ */ new Set();
   const merged = [];
@@ -2198,7 +792,7 @@ async function handleSearchCode(store, request, ctx) {
   return { tool: request.tool, ok: true, result: { hits: merged } };
 }
 async function handleTracePath(store, request, ctx) {
-  const start = requireString2(request.start, "start", ctx);
+  const start = requireString(request.start, "start", ctx);
   const direction = request.direction ?? "outbound";
   if (!TRACE_DIRECTION_SET.has(direction)) {
     ctx.throwInputError(
@@ -2214,7 +808,7 @@ async function handleTracePath(store, request, ctx) {
   return { tool: request.tool, ok: true, result };
 }
 async function handleGetSnippet(store, request, ctx) {
-  const qualifiedName = requireString2(request.qualifiedName, "qualifiedName", ctx);
+  const qualifiedName = requireString(request.qualifiedName, "qualifiedName", ctx);
   const result = await store.snippetFor({ qualifiedName });
   if (!result.ok) {
     return { tool: request.tool, ok: false, code: result.code, message: "snippetFor failed" };
@@ -2254,7 +848,7 @@ async function handleIndexStatus(store, request, ctx) {
   return { tool: request.tool, ok: true, result: outcome.status };
 }
 async function handleDetectChanges(store, request, ctx) {
-  const head = requireString2(request.head, "head", ctx);
+  const head = requireString(request.head, "head", ctx);
   if (!ctx.detectChanges) {
     return {
       tool: request.tool,
@@ -2272,7 +866,7 @@ async function handleDetectChanges(store, request, ctx) {
   return { tool: request.tool, ok: true, result: { head, affected: outcome.affected } };
 }
 async function handleIndex(request, ctx) {
-  const repoRoot = requireString2(request.repoRoot, "repoRoot", ctx);
+  const repoRoot = requireString(request.repoRoot, "repoRoot", ctx);
   const modeRaw = request.mode ?? "auto";
   if (!INDEX_MODE_SET.has(modeRaw)) {
     ctx.throwInputError(`mode must be one of ${INDEX_MODES.join(", ")}; got ${JSON.stringify(modeRaw)}`);
@@ -2426,7 +1020,7 @@ async function handleIngestTraces(store, request, ctx) {
     }
   };
 }
-function requireString2(value, field, ctx) {
+function requireString(value, field, ctx) {
   if (typeof value !== "string" || value.trim().length === 0) {
     ctx.throwInputError(`codegraph: ${field} is required and must be a non-empty string`);
   }
@@ -2468,8 +1062,8 @@ function isLikelyCypher(input) {
 }
 
 // src/coding/session-delta.ts
-import { readFile as readFile3, writeFile, mkdir, rename } from "fs/promises";
-import path3 from "path";
+import { readFile, writeFile, mkdir, rename } from "fs/promises";
+import path from "path";
 var MAX_DELTA_COMMITS = 20;
 var MAX_DELTA_FILES = 50;
 function computeSessionDelta(lastSeen, current) {
@@ -2527,14 +1121,14 @@ function formatSinceDate(iso) {
   const match = /^(\d{4}-\d{2}-\d{2})/.exec(iso);
   return match ? match[1] : iso;
 }
-var CODING_KNOWLEDGE_STATE_DIR = path3.join("state", "coding-knowledge");
+var CODING_KNOWLEDGE_STATE_DIR = path.join("state", "coding-knowledge");
 function sessionDeltaStatePath(memoryDir, namespace) {
   const safe = sanitizeFragment(namespace) || "default";
-  return path3.join(memoryDir, CODING_KNOWLEDGE_STATE_DIR, `${safe}.json`);
+  return path.join(memoryDir, CODING_KNOWLEDGE_STATE_DIR, `${safe}.json`);
 }
 async function readLastSeenState(statePath) {
   try {
-    const raw = await readFile3(statePath, "utf8");
+    const raw = await readFile(statePath, "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null) return null;
     const obj = parsed;
@@ -2552,7 +1146,7 @@ async function writeLastSeenState(statePath, state) {
       `writeLastSeenState: invalid state (head=${JSON.stringify(state.head)}, at=${JSON.stringify(state.at)})`
     );
   }
-  const dir = path3.dirname(statePath);
+  const dir = path.dirname(statePath);
   await mkdir(dir, { recursive: true });
   const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}`;
   await writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
@@ -2945,8 +1539,8 @@ var CorrectionContractError = class extends Error {
 };
 
 // src/correction/correction-planner.ts
-import { readFile as readFile4, readdir as readdir2, unlink } from "fs/promises";
-import path4 from "path";
+import { readFile as readFile2, readdir, unlink } from "fs/promises";
+import path2 from "path";
 var REDACTED_REQUEST_TEXT = "[redacted \u2014 never-store/redaction correction text withheld from the pending-plan file]";
 var CorrectionPlanner = class _CorrectionPlanner {
   constructor(deps) {
@@ -3137,13 +1731,13 @@ var CorrectionPlanner = class _CorrectionPlanner {
   // -------------------------------------------------------------------------
   /** Directory holding pending plans for one namespace. */
   async pendingDir(namespace) {
-    return path4.join(await this.deps.storageDir(namespace), "state", "corrections", "pending");
+    return path2.join(await this.deps.storageDir(namespace), "state", "corrections", "pending");
   }
   async persist(plan, abortSignal) {
     throwIfAborted(abortSignal, "correction planning aborted");
     const dir = await this.pendingDir(plan.namespace);
     throwIfAborted(abortSignal, "correction planning aborted");
-    const target = path4.join(dir, `${plan.planId}.json`);
+    const target = path2.join(dir, `${plan.planId}.json`);
     const sensitive = plan.classification === "never_store" || plan.actions.some((a) => a.kind === "redaction_rule");
     const persistedPlan = sensitive ? { ...plan, request: { ...plan.request, text: REDACTED_REQUEST_TEXT } } : plan;
     await serializeMutations(`correction-plan:${target}`, async () => {
@@ -3157,11 +1751,11 @@ var CorrectionPlanner = class _CorrectionPlanner {
   /** Load a pending plan by id (used by the service / executor). */
   async loadPlan(namespace, planId) {
     assertSafePlanId(planId);
-    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    const file = path2.join(await this.pendingDir(namespace), `${planId}.json`);
     return serializeMutations(`correction-plan:${file}`, async () => {
       let raw;
       try {
-        raw = await readFile4(file, "utf-8");
+        raw = await readFile2(file, "utf-8");
       } catch (err) {
         const code = err?.code;
         if (code === "ENOENT") return null;
@@ -3175,7 +1769,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
     const dir = await this.pendingDir(namespace);
     let files;
     try {
-      files = await readdir2(dir);
+      files = await readdir(dir);
     } catch (err) {
       const code = err?.code;
       if (code === "ENOENT") return [];
@@ -3197,11 +1791,11 @@ var CorrectionPlanner = class _CorrectionPlanner {
   }
   async markConsumed(namespace, planId, status) {
     assertSafePlanId(planId);
-    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    const file = path2.join(await this.pendingDir(namespace), `${planId}.json`);
     await serializeMutations(`correction-plan:${file}`, async () => {
       let raw;
       try {
-        raw = await readFile4(file, "utf-8");
+        raw = await readFile2(file, "utf-8");
       } catch (err) {
         const code = err?.code;
         if (code === "ENOENT") return;
@@ -3230,11 +1824,11 @@ var CorrectionPlanner = class _CorrectionPlanner {
    */
   async resetApplying(namespace, planId) {
     assertSafePlanId(planId);
-    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    const file = path2.join(await this.pendingDir(namespace), `${planId}.json`);
     await serializeMutations(`correction-plan:${file}`, async () => {
       let raw;
       try {
-        raw = await readFile4(file, "utf-8");
+        raw = await readFile2(file, "utf-8");
       } catch (err) {
         const code = err?.code;
         if (code === "ENOENT") return;
@@ -3250,7 +1844,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
   }
   async deletePlan(namespace, planId) {
     assertSafePlanId(planId);
-    const file = path4.join(await this.pendingDir(namespace), `${planId}.json`);
+    const file = path2.join(await this.pendingDir(namespace), `${planId}.json`);
     await serializeMutations(`correction-plan:${file}`, async () => {
       try {
         await unlink(file);
@@ -3286,7 +1880,7 @@ var CorrectionPlanner = class _CorrectionPlanner {
     const dir = await this.pendingDir(namespace);
     let files;
     try {
-      files = await readdir2(dir);
+      files = await readdir(dir);
     } catch (err) {
       const code = err?.code;
       if (code === "ENOENT") return [];
@@ -3912,8 +2506,8 @@ var CorrectionService = class {
 };
 
 // src/correction/correction-access-wiring.ts
-import path5 from "path";
-import { createHash as createHash2 } from "crypto";
+import path3 from "path";
+import { createHash } from "crypto";
 function createCorrectionService(wiring) {
   const cfg = wiring.orchestrator.config;
   const correctionEnabled = isCorrectionFeatureEnabled(cfg);
@@ -4357,14 +2951,14 @@ async function registerRedactionRuleFn(wiring, namespace, pattern, abortSignal,
   throwIfAborted(abortSignal, "correction apply aborted");
   const storage = await wiring.orchestrator.getStorage(namespace);
   throwIfAborted(abortSignal, "correction apply aborted");
-  const dir = path5.join(storage.dir, REDACTION_RULES_SUBDIR);
+  const dir = path3.join(storage.dir, REDACTION_RULES_SUBDIR);
   throwIfAborted(abortSignal, "correction apply aborted");
   const slugBase = pattern.replace(/[^a-zA-Z0-9]+/g, "-").slice(0, 48) || "rule";
-  const patternHash = createHash2("sha256").update(pattern).digest("hex").slice(0, 16);
+  const patternHash = createHash("sha256").update(pattern).digest("hex").slice(0, 16);
   const slug = `${slugBase}-${patternHash}`;
   throwIfAborted(abortSignal, "correction apply aborted");
   await writeRule(
-    path5.join(dir, `${slug}.json`),
+    path3.join(dir, `${slug}.json`),
     `${JSON.stringify({ pattern, namespace, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `
   );
@@ -4860,7 +3454,7 @@ function buildNotificationSummary(plan) {
 }
 
 // src/orchestration/generic-recall-paths.ts
-import path6 from "path";
+import path4 from "path";
 var CATEGORY_MEMORY_ROOTS = Object.fromEntries(
   ALL_CATEGORY_DIRS.map((directory) => [directory, true])
 );
@@ -4885,7 +3479,7 @@ function normalizeQmdUriPath(relativePath, source) {
   }
 }
 function stripQmdCollectionPrefix(relativePath, policy, source) {
-  const normalized = path6.posix.normalize(normalizeQmdUriPath(relativePath, source).replace(/\\/g, "/"));
+  const normalized = path4.posix.normalize(normalizeQmdUriPath(relativePath, source).replace(/\\/g, "/"));
   const slashIndex = normalized.indexOf("/");
   if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return normalized;
   const prefix = normalized.slice(0, slashIndex);
@@ -4894,8 +3488,8 @@ function stripQmdCollectionPrefix(relativePath, policy, source) {
   return matchesHotCollection || matchesColdCollection ? normalized.slice(slashIndex + 1) : normalized;
 }
 function isTopLevelArchivePath(filePath, policy = {}, source = "filesystem") {
-  const isAbsolutePath = path6.isAbsolute(filePath);
-  const relative2 = policy.memoryDir && isAbsolutePath ? path6.relative(policy.memoryDir, path6.resolve(filePath)) : filePath;
+  const isAbsolutePath = path4.isAbsolute(filePath);
+  const relative2 = policy.memoryDir && isAbsolutePath ? path4.relative(policy.memoryDir, path4.resolve(filePath)) : filePath;
   const normalized = !isAbsolutePath ? stripQmdCollectionPrefix(relative2, policy, source) : relative2;
   return /^(?:archive|namespaces[\\/][^\\/]+[\\/]archive)(?:[\\/]|$)/i.test(normalized);
 }
@@ -4918,7 +3512,7 @@ function isSearchExcludedPath(filePath, policy = {}, source = "filesystem") {
 function isNamespacedActivityDigestPath(candidate, memoryDir) {
   if (isActivityDigestPath(candidate, memoryDir)) return true;
   if (memoryDir === void 0 || memoryDir.length === 0) return false;
-  const relative2 = path6.relative(memoryDir, path6.resolve(memoryDir, candidate));
+  const relative2 = path4.relative(memoryDir, path4.resolve(memoryDir, candidate));
   const namespaced = /^namespaces[\\/]([^\\/]+)[\\/](.*)$/.exec(relative2);
   if (namespaced === null) return false;
   return isActivityDigestPath(namespaced[2] ?? "", memoryDir);
@@ -4926,19 +3520,19 @@ function isNamespacedActivityDigestPath(candidate, memoryDir) {
 function isNamespacedLocationDayPath(candidate, memoryDir) {
   if (isLocationDayPath(candidate, memoryDir)) return true;
   if (memoryDir === void 0 || memoryDir.length === 0) return false;
-  const relative2 = path6.relative(memoryDir, path6.resolve(memoryDir, candidate));
+  const relative2 = path4.relative(memoryDir, path4.resolve(memoryDir, candidate));
   const namespaced = /^namespaces[\\/]([^\\/]+)[\\/](.*)$/.exec(relative2);
   if (namespaced === null) return false;
   return isLocationDayPath(namespaced[2] ?? "", memoryDir);
 }
 function collectionSpellings(filePath, policy, source) {
-  if (path6.isAbsolute(filePath)) return [filePath];
+  if (path4.isAbsolute(filePath)) return [filePath];
   if (source === "qmd" && filePath.startsWith("qmd://")) {
-    const normalized2 = path6.posix.normalize(normalizeQmdUriPath(filePath, source).replace(/\\/g, "/"));
+    const normalized2 = path4.posix.normalize(normalizeQmdUriPath(filePath, source).replace(/\\/g, "/"));
     const slashIndex2 = normalized2.indexOf("/");
     return slashIndex2 <= 0 || slashIndex2 >= normalized2.length - 1 ? [normalized2] : [normalized2, normalized2.slice(slashIndex2 + 1)];
   }
-  const normalized = path6.posix.normalize(
+  const normalized = path4.posix.normalize(
     normalizeQmdUriPath(filePath, source).replace(/\\/g, "/")
   );
   const stripped = stripQmdCollectionPrefix(filePath, policy, source);
@@ -4955,9 +3549,7 @@ function collectionSpellings(filePath, policy, source) {
   return spellings;
 }
 function isGenericRecallExcludedPath(filePath, policy = {}, source = "filesystem") {
-  return isSearchExcludedPath(filePath, policy, source) || // Recall-only: archived memories are cold, but an explicit search is one
-  // of the surfaces they remain reachable through.
-  isTopLevelArchivePath(filePath, policy, source);
+  return isSearchExcludedPath(filePath, policy, source) || isTopLevelArchivePath(filePath, policy, source) || OKF_RESERVED_BASENAMES[path4.basename(filePath)] === true;
 }
 function filterRecallCandidates(candidates, options) {
   const pathPolicy = options.pathPolicy ?? (options.memoryRoot === void 0 ? void 0 : { memoryDir: options.memoryRoot });
@@ -4968,9 +3560,9 @@ function filterRecallCandidates(candidates, options) {
 }
 
 // src/procedural/procedure-miner.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { mkdir as mkdir2, rm, stat } from "fs/promises";
-import path7 from "path";
+import path5 from "path";
 
 // src/procedural/reinforcement-core.ts
 function clusterByKey(items, keyFn) {
@@ -5014,7 +3606,7 @@ function clusterKey(record) {
   return `${goal}|${refs.join(",")}`;
 }
 function clusterKeyHash(cluster) {
-  return createHash3("sha256").update(cluster).digest("hex");
+  return createHash2("sha256").update(cluster).digest("hex");
 }
 function isErrnoCode(error, code) {
   return typeof error === "object" && error !== null && "code" in error && error.code === code;
@@ -5023,8 +3615,8 @@ function sleep(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
-  const lockRoot = path7.join(path7.resolve(memoryDir), "state", "procedure-miner-locks");
-  const lockDir = path7.join(lockRoot, `${clusterHash}.lock`);
+  const lockRoot = path5.join(path5.resolve(memoryDir), "state", "procedure-miner-locks");
+  const lockDir = path5.join(lockRoot, `${clusterHash}.lock`);
   await mkdir2(lockRoot, { recursive: true });
   const startedAt = Date.now();
   let attempts = 0;
@@ -5055,7 +3647,7 @@ async function acquireClusterWriteLock(memoryDir, clusterHash) {
   }
 }
 async function withClusterWriteLock(memoryDir, clusterHash, fn) {
-  const inProcessKey = `${path7.resolve(memoryDir)}:${clusterHash}`;
+  const inProcessKey = `${path5.resolve(memoryDir)}:${clusterHash}`;
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
@@ -5193,7 +3785,7 @@ async function runProcedureMining(options) {
 }
 
 // src/support-passport/offline-sync-guard.ts
-import path8 from "path";
+import path6 from "path";
 var MAX_SUPPORT_PASSPORT_FRONTMATTER_BYTES = 1048576;
 var SUPPORT_PASSPORT_MARKER = "support-passport-";
 var FRONTMATTER_PREFIXES = ["---\n", "---\r\n"];
@@ -5211,6 +3803,10 @@ function assertFrontmatterAllowed(frontmatter, relativePath) {
   if (frontmatter.includes(SUPPORT_PASSPORT_MARKER)) {
     throw new Error(`offline sync cannot modify private support-passport record: ${relativePath}`);
   }
+  const parsed = parseFrontmatter(frontmatter);
+  if (parsed && isSupportPassportPrivateMemory({ frontmatter: parsed.frontmatter })) {
+    throw new Error(`offline sync cannot modify private support-passport record: ${relativePath}`);
+  }
 }
 function inspectBufferedFrontmatter(raw, relativePath, endOfFile) {
   const prefixState = frontmatterPrefixState(raw);
@@ -5259,7 +3855,7 @@ function createSupportPassportOfflineSyncGuard(storage) {
     return {
       root: storage.dir,
       path: normalizedPath,
-      filePath: path8.resolve(storage.dir, ...normalizedPath.split("/"))
+      filePath: path6.resolve(storage.dir, ...normalizedPath.split("/"))
     };
   };
   const assertTargetAllowed = async (target) => {
@@ -5403,6 +3999,7 @@ var OPERATION_NAMES = [
   "meetings_list",
   "meetings_get",
   "meetings_build",
+  "standup",
   "action_confidence",
   "chatgpt_memory_inspector",
   "day_summary",
@@ -5590,10 +4187,10 @@ function formatZodIssues(error) {
   const parts = [];
   for (const issue of error.issues) {
     const hasNumeric = issue.path.some((p) => typeof p === "number");
-    const path20 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const path18 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
     const options = enumOptionsFromIssue(issue);
     const suffix = options ? `. Valid: ${options.join(", ")}` : "";
-    parts.push(`${path20}: ${issue.message}${suffix}`);
+    parts.push(`${path18}: ${issue.message}${suffix}`);
   }
   return parts.length > 0 ? `request validation failed: ${parts.join("; ")}` : "request validation failed";
 }
@@ -5735,7 +4332,7 @@ function resolveQueryNamespaceWritablePreflight(caps, params, authenticatedPrinc
 }
 
 // src/admin/admin-surfaces.ts
-import path9 from "path";
+import path7 from "path";
 var REDACTED = "<redacted>";
 var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
 var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
@@ -6008,7 +4605,7 @@ async function auditTranscripts(memoryDir) {
     movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
     unmovableLines: file.unmovableLines
   }));
-  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path9.sep).includes("other"));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path7.sep).includes("other"));
   const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
   return {
     generatedAt: plan.generatedAt,
@@ -6147,11 +4744,11 @@ async function promoteMemory(options) {
 }
 
 // src/procedural/library-maintenance.ts
-import path10 from "path";
+import path8 from "path";
 var MAINTENANCE_ACTOR = "procedure-library-maintenance";
 var MAINTENANCE_RULE_VERSION = "procedure-library-maintenance:1";
 function maintenanceMarkerPath(memoryDir) {
-  return path10.join(memoryDir, "state", "procedure-maintenance.json");
+  return path8.join(memoryDir, "state", "procedure-maintenance.json");
 }
 async function readProcedureMaintenanceMarker(memoryDir) {
   try {
@@ -7176,7 +5773,7 @@ var AccessAdminOpsSurface = class {
       readMemory: async (namespace, memoryId) => {
         const resolved = await this.deps.orchestrator.getStorage(namespace);
         const memory = await resolved.getMemoryById(memoryId);
-        if (!memory) return null;
+        if (!memory || isSupportPassportPrivateMemory(memory)) return null;
         return {
           category: memory.frontmatter.category,
           content: memory.content,
@@ -7777,7 +6374,7 @@ var AccessLcmSurface = class {
 };
 
 // src/access-observe-write-surface.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/orchestration/session-context.ts
 var SessionOwnershipError = class extends Error {
@@ -9055,7 +7652,7 @@ var AccessObserveWriteSurface = class {
       sourceSessionKey: request.sessionKey,
       inputSummary: inputSummaryParts.length > 0 ? inputSummaryParts.join(" | ").slice(0, 500) : void 0,
       dryRun: request.dryRun === true,
-      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash4("sha256").update(request.sourcePrompt).digest("hex") : void 0
+      promptHash: typeof request.sourcePrompt === "string" && request.sourcePrompt.length > 0 ? createHash3("sha256").update(request.sourcePrompt).digest("hex") : void 0
     };
     const preview = this.deps.orchestrator.previewMemoryActionEvent(event);
     if (request.dryRun === true) {
@@ -9067,11 +7664,11 @@ var AccessObserveWriteSurface = class {
 };
 
 // src/access-recall-surface.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import * as nodePath2 from "path";
 
 // src/orchestration/recall-result-formatter.ts
-import path11 from "path";
+import path9 from "path";
 function renderConnectorLabel(connector) {
   if (!isValidConnectorId(connector)) return null;
   return connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : `${connector.slice(0, CONNECTOR_LABEL_MAX_LENGTH - 1)}\u2026`;
@@ -9093,15 +7690,15 @@ function resolveEffectiveIdentityInjectionMode(options) {
   return { mode: options.configuredMode, shouldInject: true };
 }
 function displayResultPath(resultPath, memoryDir, namespace) {
-  if (!path11.isAbsolute(resultPath)) return resultPath;
-  const root = path11.resolve(memoryDir);
-  const nsRoot = path11.join(root, "namespaces");
-  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path11.sep))) {
-    const afterNs = path11.relative(nsRoot, resultPath).split(path11.sep).slice(1).join("/");
+  if (!path9.isAbsolute(resultPath)) return resultPath;
+  const root = path9.resolve(memoryDir);
+  const nsRoot = path9.join(root, "namespaces");
+  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path9.sep))) {
+    const afterNs = path9.relative(nsRoot, resultPath).split(path9.sep).slice(1).join("/");
     if (afterNs) return `${namespace}/${afterNs}`;
   }
-  const rel = path11.relative(root, resultPath);
-  return rel && !rel.startsWith("..") && !path11.isAbsolute(rel) ? rel.split(path11.sep).join("/") : resultPath;
+  const rel = path9.relative(root, resultPath);
+  return rel && !rel.startsWith("..") && !path9.isAbsolute(rel) ? rel.split(path9.sep).join("/") : resultPath;
 }
 function displaySafeRecallSnapshot(snapshot, memoryDir) {
   const includedMemories = coerceIncludedMemories(snapshot).map((memory) => ({
@@ -9656,7 +8253,7 @@ var AccessRecallSurface = class {
     const snapshotForSerialization = {
       sessionKey: options.sessionKey ?? "",
       recordedAt: new Date(options.snapshot.capturedAt).toISOString(),
-      queryHash: createHash5("sha256").update(options.query).digest("hex"),
+      queryHash: createHash4("sha256").update(options.query).digest("hex"),
       queryLen: options.query.length,
       memoryIds,
       namespace,
@@ -10371,10 +8968,10 @@ var AccessRecallSurface = class {
 };
 
 // src/review/review-deck-surface.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 
 // src/review/review-deck.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/review/frontmatter.ts
 function splitMarkdownFrontmatter(content) {
@@ -10419,7 +9016,7 @@ var REVIEW_REASON_LABELS = {
 };
 var EXCERPT_LIMIT = 240;
 function computeReviewItemRevision(fileContent) {
-  return `rv1:${createHash6("sha256").update(fileContent).digest("hex")}`;
+  return `rv1:${createHash5("sha256").update(fileContent).digest("hex")}`;
 }
 function projectReviewDeckItem(row, namespace) {
   const provenance = provenanceFromRow(row);
@@ -10564,16 +9161,16 @@ function parseCursorPayload(cursor) {
 }
 
 // src/review/review-deck-mutation.ts
-import { createHash as createHash7, randomUUID } from "crypto";
+import { createHash as createHash6, randomUUID } from "crypto";
 import fs3 from "fs";
-import path14 from "path";
+import path12 from "path";
 
 // src/review/index.ts
 import fs from "fs";
-import path12 from "path";
+import path10 from "path";
 var historicalIdCache = new HistoricalEntityCanonicalIdCache();
 function writeReviewFileCanonicalized(memoryDir, filePath, content) {
-  const stateDir = path12.join(memoryDir, "state");
+  const stateDir = path10.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache.get(stateDir);
   let originalBytes = null;
   try {
@@ -10615,8 +9212,8 @@ function realMemoryRoot(memoryDir) {
   }
 }
 function isPathInside(rootReal, candidateReal) {
-  const relative2 = path12.relative(rootReal, candidateReal);
-  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path12.isAbsolute(relative2);
+  const relative2 = path10.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path10.isAbsolute(relative2);
 }
 function isSafeDirectory(rootReal, dir) {
   try {
@@ -10659,7 +9256,7 @@ function listReviewItems(options) {
     if (filterReason && item.reviewReason !== filterReason) return;
     items.push(item);
   };
-  const suggestionsDir = path12.join(memoryDir, "suggestions");
+  const suggestionsDir = path10.join(memoryDir, "suggestions");
   if (!isLimitReached() && fs.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
     walkMd(rootReal, suggestionsDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -10680,7 +9277,7 @@ function listReviewItems(options) {
       return isLimitReached();
     });
   }
-  const reviewDir = path12.join(memoryDir, "review");
+  const reviewDir = path10.join(memoryDir, "review");
   if (!isLimitReached() && fs.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
     walkMd(rootReal, reviewDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -10705,7 +9302,7 @@ function listReviewItems(options) {
   const categories = ALL_CATEGORY_DIRS;
   for (const category of categories) {
     if (isLimitReached()) break;
-    const dir = path12.join(memoryDir, category);
+    const dir = path10.join(memoryDir, category);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     walkMd(rootReal, dir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -10787,9 +9384,9 @@ function approveItem(memoryDir, itemId, options) {
   const targetDir = getCategoryDir(memoryDir, category);
   const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   ensureSafeDirectory(rootReal, targetDir);
-  const outputPath = path12.join(targetDir, dateDir, path12.basename(found.filePath));
-  ensureSafeDirectory(rootReal, path12.dirname(outputPath));
-  const reviewStateDir = path12.join(memoryDir, "state");
+  const outputPath = path10.join(targetDir, dateDir, path10.basename(found.filePath));
+  ensureSafeDirectory(rootReal, path10.dirname(outputPath));
+  const reviewStateDir = path10.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache.get(reviewStateDir);
   const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
   const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
@@ -10866,13 +9463,13 @@ function findReviewFileById(memoryDir, id, options = {}) {
   const rootReal = realMemoryRoot(memoryDir);
   if (!rootReal) return null;
   for (const loc of ["suggestions", "review"]) {
-    const dir = path12.join(memoryDir, loc);
+    const dir = path10.join(memoryDir, loc);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id);
     if (found) return { filePath: found, location: "queue" };
   }
   for (const category of ALL_CATEGORY_DIRS) {
-    const dir = path12.join(memoryDir, category);
+    const dir = path10.join(memoryDir, category);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
     if (found) return { filePath: found, location: "category" };
@@ -10948,10 +9545,10 @@ function readFileSafe(filePath) {
   }
 }
 function writeFileWithoutClobber(basePath, content, discriminator) {
-  const parsed = path12.parse(basePath);
+  const parsed = path10.parse(basePath);
   const safeDiscriminator = sanitizeFilePart(discriminator);
   for (let attempt = 0; attempt < 1e3; attempt++) {
-    const candidate = attempt === 0 ? basePath : path12.join(
+    const candidate = attempt === 0 ? basePath : path10.join(
       parsed.dir,
       `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
     );
@@ -11007,7 +9604,7 @@ function extractBody(content) {
 function walkMd(rootReal, dir, callback) {
   if (!isSafeDirectory(rootReal, dir)) return false;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path12.join(dir, entry.name);
+    const fullPath = path10.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       if (walkMd(rootReal, fullPath, callback)) return true;
@@ -11022,7 +9619,7 @@ function walkMdPaths(rootReal, dir) {
   const results = [];
   if (!isSafeDirectory(rootReal, dir)) return results;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path12.join(dir, entry.name);
+    const fullPath = path10.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       results.push(...walkMdPaths(rootReal, fullPath));
@@ -11035,7 +9632,7 @@ function walkMdPaths(rootReal, dir) {
 
 // src/review/review-deck-snapshot.ts
 import fs2 from "fs";
-import path13 from "path";
+import path11 from "path";
 var QUEUE_DIRS = ["suggestions", "review"];
 function readReviewDeckSnapshot(opts) {
   const corpusVersion = readCorpusVersion(opts.memoryDir);
@@ -11043,7 +9640,7 @@ function readReviewDeckSnapshot(opts) {
   if (!rootReal) return { corpusVersion, total: 0, rows: [] };
   const rows = [];
   for (const location of QUEUE_DIRS) {
-    const dir = path13.join(opts.memoryDir, location);
+    const dir = path11.join(opts.memoryDir, location);
     if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
     walkMd2(rootReal, dir, (filePath, content) => {
       const row = rowFromQueueFile(filePath, content, location);
@@ -11056,7 +9653,7 @@ function readReviewDeckRow(opts) {
   const rootReal = realMemoryRoot2(opts.memoryDir);
   if (!rootReal) return null;
   for (const location of QUEUE_DIRS) {
-    const dir = path13.join(opts.memoryDir, location);
+    const dir = path11.join(opts.memoryDir, location);
     if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
     let found = null;
     walkMd2(rootReal, dir, (filePath, content) => {
@@ -11072,7 +9669,7 @@ function readReviewDeckRow(opts) {
 }
 function readCorpusVersion(memoryDir) {
   try {
-    return String(fs2.statSync(path13.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
+    return String(fs2.statSync(path11.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
   } catch {
     return "0";
   }
@@ -11122,8 +9719,8 @@ function realMemoryRoot2(memoryDir) {
   }
 }
 function isPathInside2(rootReal, candidateReal) {
-  const relative2 = path13.relative(rootReal, candidateReal);
-  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path13.isAbsolute(relative2);
+  const relative2 = path11.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path11.isAbsolute(relative2);
 }
 function isSafeDirectory2(rootReal, dir) {
   try {
@@ -11137,7 +9734,7 @@ function isSafeDirectory2(rootReal, dir) {
 function walkMd2(rootReal, dir, callback) {
   if (!isSafeDirectory2(rootReal, dir)) return false;
   for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path13.join(dir, entry.name);
+    const fullPath = path11.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       if (walkMd2(rootReal, fullPath, callback)) return true;
@@ -11222,7 +9819,7 @@ var EVENT_TYPE = {
   undo: "restored"
 };
 function sha256Hex(value) {
-  return createHash7("sha256").update(value, "utf8").digest("hex");
+  return createHash6("sha256").update(value, "utf8").digest("hex");
 }
 function computeReceiptId(namespace, principalDigest, idempotencyKey) {
   return `rcp1:${sha256Hex(`${namespace}\0${principalDigest}\0${idempotencyKey}`)}`;
@@ -11252,7 +9849,7 @@ function parseReviewLifecycleReceipt(value) {
   if (!isReceiptAction(rec.action)) return null;
   if (typeof rec.beforeRevision !== "string") return null;
   if (typeof rec.afterRevision !== "string") return null;
-  if (!isNonEmptyString(rec.sourcePath) || path14.isAbsolute(rec.sourcePath)) return null;
+  if (!isNonEmptyString(rec.sourcePath) || path12.isAbsolute(rec.sourcePath)) return null;
   if (rec.revisionArtifact !== void 0 && typeof rec.revisionArtifact !== "string") return null;
   if (rec.undoOfReceiptId !== void 0 && typeof rec.undoOfReceiptId !== "string") return null;
   const parsed = {
@@ -11284,11 +9881,11 @@ function findStoredReceipt(events, receiptId) {
   return null;
 }
 function resolveInside(memoryDir, rel) {
-  if (!rel || path14.isAbsolute(rel)) return null;
-  const root = path14.resolve(memoryDir);
-  const abs = path14.resolve(root, rel.split("/").join(path14.sep));
-  const next = path14.relative(root, abs);
-  if (next.startsWith("..") || path14.isAbsolute(next)) return null;
+  if (!rel || path12.isAbsolute(rel)) return null;
+  const root = path12.resolve(memoryDir);
+  const abs = path12.resolve(root, rel.split("/").join(path12.sep));
+  const next = path12.relative(root, abs);
+  if (next.startsWith("..") || path12.isAbsolute(next)) return null;
   return abs;
 }
 function currentRevision(absPath) {
@@ -11693,7 +10290,7 @@ async function executeReviewDeckUndo(ctx, req) {
 
 // src/review/review-deck-surface.ts
 function digest(value) {
-  return createHash8("sha256").update(value).digest("hex");
+  return createHash7("sha256").update(value).digest("hex");
 }
 var ReviewDeckSurface = class {
   constructor(deps) {
@@ -11864,7 +10461,7 @@ function ownerListCards(storedCards) {
     if (replacedDraftIds.has(item.card.cardId)) return false;
     if (!item.replacesDraftId) return true;
     const replacedStatus = byId.get(item.replacesDraftId)?.card.status;
-    return replacedStatus === "pending_review" || replacedStatus === "rejected";
+    return replacedStatus === void 0 || replacedStatus === "pending_review" || replacedStatus === "rejected";
   });
 }
 
@@ -11951,14 +10548,14 @@ async function completeSupportPassportReplacementPrior(input) {
 }
 
 // src/support-passport/generated-batch.ts
-import path16 from "path";
+import path14 from "path";
 import { z as z2 } from "zod";
 
 // src/support-passport/private-file.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { constants as fsConstants } from "fs";
-import { lstat as lstat3, mkdir as mkdir3, open, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
-import path15 from "path";
+import { lstat as lstat2, mkdir as mkdir3, open, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
+import path13 from "path";
 var UNSUPPORTED_DIRECTORY_SYNC_ERRORS = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
 var NON_WRITABLE_ANCESTOR_SYNC_ERRORS = /* @__PURE__ */ new Set(["EROFS", "EPERM", "EACCES"]);
 function assertStableDirectory(before, opened, after, errorMessage) {
@@ -11973,7 +10570,7 @@ function assertStableRegularFile(before, opened, after, errorMessage) {
 }
 async function lstatPrivateTarget(filePath, errorMessage) {
   try {
-    return await lstat3(filePath);
+    return await lstat2(filePath);
   } catch {
     throw new Error(errorMessage);
   }
@@ -11984,13 +10581,13 @@ function openFlags(...flags) {
   return combined;
 }
 function assertContainedPath(trustedRoot, directory, errorMessage) {
-  const relative2 = path15.relative(path15.resolve(trustedRoot), path15.resolve(directory));
-  if (relative2 === ".." || relative2.startsWith(`..${path15.sep}`) || path15.isAbsolute(relative2)) {
+  const relative2 = path13.relative(path13.resolve(trustedRoot), path13.resolve(directory));
+  if (relative2 === ".." || relative2.startsWith(`..${path13.sep}`) || path13.isAbsolute(relative2)) {
     throw new Error(errorMessage);
   }
 }
 async function openDirectoryNoFollow(directory, errorMessage) {
-  const before = await lstat3(directory);
+  const before = await lstat2(directory);
   if (before.isSymbolicLink() || !before.isDirectory()) throw new Error(errorMessage);
   const handle = await open(
     directory,
@@ -11998,7 +10595,7 @@ async function openDirectoryNoFollow(directory, errorMessage) {
   );
   try {
     const opened = await handle.stat();
-    assertStableDirectory(before, opened, await lstat3(directory), errorMessage);
+    assertStableDirectory(before, opened, await lstat2(directory), errorMessage);
     return { before, opened, handle };
   } catch (error) {
     await handle.close().catch(() => void 0);
@@ -12018,7 +10615,7 @@ async function syncDirectoryHandle(handle) {
 }
 async function resolvePrivateDirectoryPath(directory, handle, opened, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const pinnedPath = path15.join(descriptorRoot, String(handle.fd));
+  const pinnedPath = path13.join(descriptorRoot, String(handle.fd));
   const metadata = await stat2(pinnedPath);
   if (!metadata.isDirectory() || metadata.dev !== opened.dev || metadata.ino !== opened.ino) {
     throw new Error(errorMessage);
@@ -12034,12 +10631,12 @@ function requirePrivateFileDescriptorRoot(platform, errorMessage) {
   throw new Error(errorMessage);
 }
 async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform = process.platform) {
-  const root = path15.resolve(trustedRoot);
-  const target = path15.resolve(directory);
+  const root = path13.resolve(trustedRoot);
+  const target = path13.resolve(directory);
   assertContainedPath(root, target, errorMessage);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const relative2 = path15.relative(root, target);
-  const components = relative2 === "" ? [] : relative2.split(path15.sep);
+  const relative2 = path13.relative(root, target);
+  const components = relative2 === "" ? [] : relative2.split(path13.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -12047,13 +10644,13 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const child = await openDirectoryNoFollow(path15.join(pinnedParent, component), errorMessage);
+      const child = await openDirectoryNoFollow(path13.join(pinnedParent, component), errorMessage);
       handles.push(child.handle);
-      assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path15.join(currentPath, component);
+      assertStableDirectory(current.before, current.opened, await lstat2(currentPath), errorMessage);
+      currentPath = path13.join(currentPath, component);
       current = child;
     }
-    assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
+    assertStableDirectory(current.before, current.opened, await lstat2(target), errorMessage);
     return {
       ...current,
       handles,
@@ -12071,12 +10668,12 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
   }
 }
 async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, hardenExistingChildren = true, platform = process.platform) {
-  const root = path15.resolve(trustedRoot);
-  const target = path15.resolve(directory);
+  const root = path13.resolve(trustedRoot);
+  const target = path13.resolve(directory);
   assertContainedPath(root, target, errorMessage);
-  const relative2 = path15.relative(root, target);
+  const relative2 = path13.relative(root, target);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const components = relative2 === "" ? [] : relative2.split(path15.sep);
+  const components = relative2 === "" ? [] : relative2.split(path13.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -12084,7 +10681,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const childPath = path15.join(pinnedParent, component);
+      const childPath = path13.join(pinnedParent, component);
       let created = false;
       try {
         await mkdir3(childPath, { mode: 448 });
@@ -12098,18 +10695,18 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
       if (created || hardenExistingChildren && (child.opened.mode & 511) !== 448) {
         await child.handle.chmod(448);
       }
-      assertStableDirectory(current.before, current.opened, await lstat3(currentPath), errorMessage);
-      currentPath = path15.join(currentPath, component);
+      assertStableDirectory(current.before, current.opened, await lstat2(currentPath), errorMessage);
+      currentPath = path13.join(currentPath, component);
       current = child;
     }
-    assertStableDirectory(current.before, current.opened, await lstat3(target), errorMessage);
+    assertStableDirectory(current.before, current.opened, await lstat2(target), errorMessage);
   } finally {
     await closeDirectoryHandles(handles);
   }
 }
 async function ensurePrivateDirectoryTreeNoFollow(directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, platform = process.platform) {
-  const target = path15.resolve(directory);
-  const filesystemRoot = path15.parse(target).root;
+  const target = path13.resolve(directory);
+  const filesystemRoot = path13.parse(target).root;
   const rootMetadata = await stat2(filesystemRoot);
   await ensurePrivateDirectoryNoFollow(
     filesystemRoot,
@@ -12137,23 +10734,23 @@ async function withPrivateDirectoryNoFollow(trustedRoot, directory, errorMessage
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const result = await task(stableDirectory.pinnedDirectory);
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     return result;
   } finally {
     await closeDirectoryHandles(directoryHandles);
   }
 }
 async function readPrivateFileNoFollow(directory, filePath, errorMessage, trustedRoot = directory, platform = process.platform) {
-  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path15.basename(filePath);
+  if (path13.dirname(filePath) !== path13.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path13.basename(filePath);
   let directoryHandles = [];
   let fileHandle;
   try {
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    const targetPath = path15.join(pinnedDirectory, targetName);
-    const before = await lstat3(targetPath);
+    const targetPath = path13.join(pinnedDirectory, targetName);
+    const before = await lstat2(targetPath);
     if (before.isSymbolicLink() || !before.isFile()) throw new Error(errorMessage);
     try {
       fileHandle = await open(targetPath, openFlags(fsConstants.O_RDONLY, fsConstants.O_NOFOLLOW));
@@ -12162,8 +10759,8 @@ async function readPrivateFileNoFollow(directory, filePath, errorMessage, truste
       throw error;
     }
     const fileMetadata = await fileHandle.stat();
-    assertStableRegularFile(before, fileMetadata, await lstat3(targetPath), errorMessage);
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    assertStableRegularFile(before, fileMetadata, await lstat2(targetPath), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     return await fileHandle.readFile("utf8");
   } finally {
     await fileHandle?.close().catch(() => void 0);
@@ -12171,10 +10768,10 @@ async function readPrivateFileNoFollow(directory, filePath, errorMessage, truste
   }
 }
 async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, content, errorMessage, directoryHandle, openFile) {
-  if (targetName.length === 0 || targetName === "." || targetName === ".." || path15.basename(targetName) !== targetName) {
+  if (targetName.length === 0 || targetName === "." || targetName === ".." || path13.basename(targetName) !== targetName) {
     throw new Error(errorMessage);
   }
-  const targetPath = path15.join(pinnedDirectory, targetName);
+  const targetPath = path13.join(pinnedDirectory, targetName);
   let fileHandle;
   try {
     try {
@@ -12210,8 +10807,8 @@ async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, c
 }
 async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, content, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const resolvedDirectory = path15.resolve(pinnedDirectory);
-  const descriptor = path15.relative(descriptorRoot, resolvedDirectory);
+  const resolvedDirectory = path13.resolve(pinnedDirectory);
+  const descriptor = path13.relative(descriptorRoot, resolvedDirectory);
   if (!/^\d+$/.test(descriptor)) throw new Error(errorMessage);
   const before = await stat2(resolvedDirectory);
   if (!before.isDirectory()) throw new Error(errorMessage);
@@ -12227,8 +10824,8 @@ async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, con
   }
 }
 async function writePrivateFileAtomicallyNoFollow(directory, filePath, content, errorMessage, trustedRoot = directory, platform = process.platform, syncVerifiedDirectory = syncDirectoryHandle) {
-  if (path15.dirname(filePath) !== path15.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path15.basename(filePath);
+  if (path13.dirname(filePath) !== path13.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path13.basename(filePath);
   const tempName = `.${targetName}.${randomUUID2()}.tmp`;
   let tempPath;
   let directoryHandles = [];
@@ -12237,8 +10834,8 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    tempPath = path15.join(pinnedDirectory, tempName);
-    const targetPath = path15.join(pinnedDirectory, targetName);
+    tempPath = path13.join(pinnedDirectory, tempName);
+    const targetPath = path13.join(pinnedDirectory, targetName);
     try {
       fileHandle = await open(
         tempPath,
@@ -12250,15 +10847,15 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
       throw error;
     }
     const fileMetadata = await fileHandle.stat();
-    const tempMetadata = await lstat3(tempPath);
-    assertStableRegularFile(tempMetadata, fileMetadata, await lstat3(tempPath), errorMessage);
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    const tempMetadata = await lstat2(tempPath);
+    assertStableRegularFile(tempMetadata, fileMetadata, await lstat2(tempPath), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     await fileHandle.chmod(384);
     await fileHandle.writeFile(content, "utf8");
     await fileHandle.sync();
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     await rename2(tempPath, targetPath);
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     if (stableDirectory.handle) await syncVerifiedDirectory(stableDirectory.handle);
     const committedMetadata = await lstatPrivateTarget(targetPath, errorMessage);
     assertStableRegularFile(
@@ -12275,7 +10872,7 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
 }
 async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, trustedRoot = directory, platform = process.platform) {
   if (fileNames.some(
-    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path15.basename(fileName) !== fileName
+    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path13.basename(fileName) !== fileName
   )) {
     throw new Error(errorMessage);
   }
@@ -12285,9 +10882,9 @@ async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, tr
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
     for (const fileName of fileNames) {
-      await rm2(path15.join(pinnedDirectory, fileName), { force: true });
+      await rm2(path13.join(pinnedDirectory, fileName), { force: true });
     }
-    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat3(directory), errorMessage);
+    assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
   } finally {
     await closeDirectoryHandles(directoryHandles);
@@ -12306,13 +10903,13 @@ var GeneratedBatchMarkerSchema = z2.object({
 }).strict();
 var BATCH_ERROR = "The generated draft batch state is not safe.";
 function batchDirectory(storage) {
-  return path16.join(storage.dir, "state", "support-passport", "generated-batches");
+  return path14.join(storage.dir, "state", "support-passport", "generated-batches");
 }
 function batchFileName(batchId) {
   return `${BatchIdSchema.parse(batchId)}.json`;
 }
 function batchPath(storage, batchId) {
-  return path16.join(batchDirectory(storage), batchFileName(batchId));
+  return path14.join(batchDirectory(storage), batchFileName(batchId));
 }
 function markerFor(context, batchId, size, complete) {
   return GeneratedBatchMarkerSchema.parse({
@@ -12736,19 +11333,19 @@ var SupportPassportAnswerModelInputSchema = z4.object({
 }).strict();
 
 // src/support-passport/owner-lock.ts
-import { createHash as createHash9 } from "crypto";
-import path17 from "path";
+import { createHash as createHash8 } from "crypto";
+import path15 from "path";
 var CARD_MUTATION_LOCK_STALE_MS = 6e4;
 var CARD_MUTATION_LOCK_MAX_WAIT_MS = 3e4;
 function computeSupportPassportOwnerLockKey(namespace, principal) {
-  return createHash9("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
+  return createHash8("sha256").update(JSON.stringify([namespace, principal])).digest("hex");
 }
 function supportPassportOwnerLockPath(storage, scope) {
   const ownerLockKey = scope.ownerKey ?? computeSupportPassportOwnerLockKey(scope.namespace, scope.principal);
   if (!/^[a-f0-9]{64}$/.test(ownerLockKey)) {
     throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
   }
-  return path17.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
+  return path15.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
 }
 async function withSupportPassportOwnerLock(storage, scope, task) {
   const lockPath = supportPassportOwnerLockPath(storage, scope);
@@ -13387,7 +11984,7 @@ var SupportPassportCardService = class {
     if (currentCard.card.status === "pending_review") {
       const priorId = currentMemory.frontmatter.supersedes;
       if (!priorId) return currentMemory;
-      const prior = await storage.getMemoryById(priorId);
+      const prior = await storage.getMemoryByIdIncludingArchived(priorId);
       if (prior && ownsMemory(prior, namespace, principal) && prior.frontmatter.status === "superseded" && prior.frontmatter.supersededBy === replacement.card.cardId) {
         await this.restorePriorAfterApprovalFailure(
           storage,
@@ -13488,7 +12085,7 @@ var SupportPassportCardService = class {
   }
   async recoverReplacedDraft(storage, replacement, lock, principal, namespace, onCommitted) {
     if (!replacement.replacesDraftId) return;
-    const replacedDraft = await storage.getMemoryById(replacement.replacesDraftId);
+    const replacedDraft = await storage.getMemoryByIdIncludingArchived(replacement.replacesDraftId);
     const projectedDraft = replacedDraft ? projectOwnedCard(replacedDraft, namespace, principal) : null;
     if (replacedDraft && projectedDraft?.card.status === "pending_review" && projectedDraft.card.revision === replacement.replacedRevision) {
       await this.requireOwnerLock(lock);
@@ -13510,7 +12107,7 @@ var SupportPassportCardService = class {
         return;
       }
     }
-    const currentDraft = await storage.getMemoryById(replacement.replacesDraftId);
+    const currentDraft = await storage.getMemoryByIdIncludingArchived(replacement.replacesDraftId);
     if (currentDraft && ownsMemory(currentDraft, namespace, principal) && currentDraft.frontmatter.status === "rejected") {
       await this.finishPreparedDraftReplacement(
         storage,
@@ -13644,9 +12241,9 @@ var SupportPassportCardService = class {
 };
 
 // src/support-passport/grant-store.ts
-import { createHash as createHash10, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
-import { lstat as lstat4, open as open2, readdir as readdir4 } from "fs/promises";
-import path18 from "path";
+import { createHash as createHash9, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
+import { lstat as lstat3, open as open2, readdir as readdir3 } from "fs/promises";
+import path16 from "path";
 var GRANT_LOCK_STALE_MS = 3e4;
 var GRANT_LOCK_WAIT_MS = 5e3;
 var GRANT_LOCK_HEARTBEAT_MS = 1e4;
@@ -13669,7 +12266,7 @@ var MalformedGrantStateError = class extends Error {
   }
 };
 function sha256(domain, value) {
-  return createHash10("sha256").update(domain).update("\0").update(value).digest("hex");
+  return createHash9("sha256").update(domain).update("\0").update(value).digest("hex");
 }
 function hashesMatch(left, right) {
   const leftBytes = Buffer.from(left, "hex");
@@ -13738,9 +12335,9 @@ var SupportPassportGrantStore = class {
   runWithHeldFileLock;
   syncDirectory;
   constructor(options) {
-    this.memoryDir = path18.resolve(expandTildePath(options.memoryDir));
-    this.grantsDir = path18.join(this.memoryDir, "state", "support-passport", "grants");
-    this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
+    this.memoryDir = path16.resolve(expandTildePath(options.memoryDir));
+    this.grantsDir = path16.join(this.memoryDir, "state", "support-passport", "grants");
+    this.ownerIndexesDir = path16.join(this.grantsDir, "owners");
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.makeSecret = options.makeSecret ?? (() => randomBytes(32));
     this.makeGrantId = options.makeGrantId ?? randomUUID4;
@@ -13953,11 +12550,11 @@ var SupportPassportGrantStore = class {
   }
   filePath(grantId) {
     const normalizedGrantId = normalizeGrantId(grantId);
-    return path18.join(this.grantsDir, `${normalizedGrantId}.json`);
+    return path16.join(this.grantsDir, `${normalizedGrantId}.json`);
   }
   ownerIndexPath(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path18.join(this.ownerIndexesDir, `${ownerHash}.json`);
+    return path16.join(this.ownerIndexesDir, `${ownerHash}.json`);
   }
   ownerHash(namespace, principalHash) {
     return sha256("support-passport-owner-index:v1", `${namespace}\0${principalHash}`);
@@ -14013,12 +12610,12 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       grantIds.map((grantId) => `${grantId}.json`),
       "support passport grant files must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
   }
   ownerMembershipDirectory(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path18.join(this.ownerIndexesDir, ownerHash);
+    return path16.join(this.ownerIndexesDir, ownerHash);
   }
   async ensureOwnerMembershipDirectory(ownerHash) {
     const directory = this.ownerMembershipDirectory(ownerHash);
@@ -14033,11 +12630,11 @@ var SupportPassportGrantStore = class {
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     await writePrivateFileAtomicallyNoFollow(
       directory,
-      path18.join(directory, `${state.grantId}.json`),
+      path16.join(directory, `${state.grantId}.json`),
       `${JSON.stringify({ schemaVersion: 1, grantId: state.grantId })}
 `,
       "support passport owner membership must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
   }
   async removeOwnerMembership(state) {
@@ -14047,7 +12644,7 @@ var SupportPassportGrantStore = class {
       directory,
       [`${state.grantId}.json`],
       "support passport owner membership must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
   }
   async removeStoredGrant(state) {
@@ -14148,11 +12745,11 @@ var SupportPassportGrantStore = class {
     const ownerHash = this.ownerHash(namespace, principalHash);
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     const grantIds = await withPrivateDirectoryNoFollow(
-      path18.parse(this.memoryDir).root,
+      path16.parse(this.memoryDir).root,
       directory,
       "support passport owner membership must be regular files in a stable directory",
       async (pinnedDirectory) => {
-        const entries = await readdir4(pinnedDirectory, { withFileTypes: true });
+        const entries = await readdir3(pinnedDirectory, { withFileTypes: true });
         return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -5)).filter((grantId) => SAFE_GRANT_ID.test(grantId));
       }
     );
@@ -14179,7 +12776,7 @@ var SupportPassportGrantStore = class {
         this.ownerIndexesDir,
         filePath,
         "support passport owner indexes must be regular files in a stable directory",
-        path18.parse(this.memoryDir).root
+        path16.parse(this.memoryDir).root
       );
     } catch (error) {
       if (error.code === "ENOENT") return [];
@@ -14206,7 +12803,7 @@ var SupportPassportGrantStore = class {
   async writeOwnerIndex(ownerHash, grantIds) {
     const filePath = this.ownerIndexPath(ownerHash);
     try {
-      const metadata = await lstat4(filePath);
+      const metadata = await lstat3(filePath);
       if (metadata.isSymbolicLink() || !metadata.isFile()) {
         throw new Error("support passport owner indexes must be regular files");
       }
@@ -14219,7 +12816,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify({ schemaVersion: 1, ownerHash, grantIds }, null, 2)}
 `,
       "support passport owner indexes must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
   }
   async readState(grantId) {
@@ -14229,7 +12826,7 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       filePath,
       "support passport grant files must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
     try {
       const state = SupportPassportGrantStateSchema.parse(JSON.parse(content));
@@ -14248,7 +12845,7 @@ var SupportPassportGrantStore = class {
   async writeState(state, requireAbsent = false) {
     const filePath = this.filePath(state.grantId);
     try {
-      const metadata = await lstat4(filePath);
+      const metadata = await lstat3(filePath);
       if (metadata.isSymbolicLink() || !metadata.isFile())
         throw new Error("support passport grant files must be regular files");
       if (requireAbsent) {
@@ -14263,7 +12860,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify(state, null, 2)}
 `,
       "support passport grant files must be regular files in a stable directory",
-      path18.parse(this.memoryDir).root
+      path16.parse(this.memoryDir).root
     );
   }
   async ensureSafeDirectories() {
@@ -14297,8 +12894,8 @@ var SupportPassportGrantStore = class {
           void 0
         );
         this.memoryDir = configuredMemoryDir;
-        this.grantsDir = path18.join(configuredMemoryDir, "state", "support-passport", "grants");
-        this.ownerIndexesDir = path18.join(this.grantsDir, "owners");
+        this.grantsDir = path16.join(configuredMemoryDir, "state", "support-passport", "grants");
+        this.ownerIndexesDir = path16.join(this.grantsDir, "owners");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -14312,12 +12909,12 @@ var SupportPassportGrantStore = class {
   async withMutationLock(task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path18.parse(this.memoryDir).root,
+      path16.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grants:${this.grantsDir}`,
-        path18.join(pinnedDirectory, ".grants.lock"),
+        path16.join(pinnedDirectory, ".grants.lock"),
         task
       )
     );
@@ -14326,12 +12923,12 @@ var SupportPassportGrantStore = class {
     const normalizedGrantId = normalizeGrantId(grantId);
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path18.parse(this.memoryDir).root,
+      path16.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grant:${this.grantsDir}:${normalizedGrantId}`,
-        path18.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
+        path16.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
         task
       )
     );
@@ -14339,12 +12936,12 @@ var SupportPassportGrantStore = class {
   async withOwnerIndexLock(ownerHash, task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path18.parse(this.memoryDir).root,
+      path16.parse(this.memoryDir).root,
       this.ownerIndexesDir,
       "support passport owner lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-owner:${this.ownerIndexesDir}:${ownerHash}`,
-        path18.join(pinnedDirectory, `.${ownerHash}.lock`),
+        path16.join(pinnedDirectory, `.${ownerHash}.lock`),
         task
       )
     );
@@ -15181,8 +13778,8 @@ var SupportPassportModelAdapter = class {
 };
 
 // src/support-passport/model-audit.ts
-import { createHash as createHash11 } from "crypto";
-import path19 from "path";
+import { createHash as createHash10 } from "crypto";
+import path17 from "path";
 import { z as z5 } from "zod";
 var HashSchema = z5.string().regex(/^[a-f0-9]{64}$/);
 var SupportPassportModelAuditRecordSchema = z5.object({
@@ -15219,7 +13816,7 @@ var SupportPassportModelAuditRecordSchema = z5.object({
   }
 });
 function hashSupportPassportAuditValues(domain, values) {
-  return createHash11("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
+  return createHash10("sha256").update(`support-passport-audit:${domain}:v1`).update("\0").update([...values].sort().join("\0")).digest("hex");
 }
 var SupportPassportModelAuditStore = class {
   memoryDir;
@@ -15227,15 +13824,15 @@ var SupportPassportModelAuditStore = class {
   memoryRootReady;
   runWithHeldFileLock;
   constructor(options) {
-    this.memoryDir = path19.resolve(expandTildePath(options.memoryDir));
-    this.auditDir = path19.join(this.memoryDir, "state", "support-passport", "audit");
+    this.memoryDir = path17.resolve(expandTildePath(options.memoryDir));
+    this.auditDir = path17.join(this.memoryDir, "state", "support-passport", "audit");
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
   }
   async record(input) {
     const record = SupportPassportModelAuditRecordSchema.parse(input);
     await this.ensureSafeDirectories();
     const day = record.occurredAt.slice(0, 10);
-    const filePath = path19.join(this.auditDir, `${day}.jsonl`);
+    const filePath = path17.join(this.auditDir, `${day}.jsonl`);
     await serializeMutations(
       `support-passport-audit:${filePath}`,
       () => withPrivateDirectoryNoFollow(
@@ -15243,7 +13840,7 @@ var SupportPassportModelAuditStore = class {
         this.auditDir,
         "support passport audit directory must remain inside the memory directory",
         async (pinnedDirectory) => await this.runWithHeldFileLock(
-          path19.join(pinnedDirectory, `.${day}.lock`),
+          path17.join(pinnedDirectory, `.${day}.lock`),
           {
             staleMs: 3e4,
             maxWaitMs: 5e3,
@@ -15280,7 +13877,7 @@ var SupportPassportModelAuditStore = class {
           "support passport memory directory must be a stable directory"
         );
         this.memoryDir = configuredMemoryDir;
-        this.auditDir = path19.join(configuredMemoryDir, "state", "support-passport", "audit");
+        this.auditDir = path17.join(configuredMemoryDir, "state", "support-passport", "audit");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -15294,7 +13891,7 @@ var SupportPassportModelAuditStore = class {
 };
 
 // src/support-passport/model-service.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { z as z6 } from "zod";
 var DraftServiceInputSchema = z6.object({
   principal: z6.string().trim().min(1).max(512),
@@ -15330,7 +13927,7 @@ function supportPassportSourceContent(memory) {
   return hasStructuredAttributes(memory.frontmatter.structuredAttributes) ? stripAttributesSuffix(memory.content) : memory.content;
 }
 function computeSupportPassportSourceRevision(content, structuredAttributes) {
-  return createHash12("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
+  return createHash11("sha256").update("support-passport-source:v1\0").update(hasStructuredAttributes(structuredAttributes) ? stripAttributesSuffix(content) : content).digest("hex");
 }
 function isSupportPassportSourceEligible(memory) {
   const status = memory.frontmatter.status ?? "active";
@@ -18827,8 +17424,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshot(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
-    const deletions = [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs }));
+    const storageHash = createHash12("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const deletions = [...await storage.readDeletionRevisions()].map(([path18, mtimeMs]) => ({ path: path18, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -18851,10 +17448,10 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncSnapshotStream(options = {}) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash12("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const deletions = await filterOfflineSyncDeletionRevisions({
       root: storage.dir,
-      deletions: [...await storage.readDeletionRevisions()].map(([path20, mtimeMs]) => ({ path: path20, mtimeMs })),
+      deletions: [...await storage.readDeletionRevisions()].map(([path18, mtimeMs]) => ({ path: path18, mtimeMs })),
       includeTranscripts: options.includeTranscripts !== false,
       userExcludeRegexps: this.offlineSyncUserExcludes
     });
@@ -18891,7 +17488,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
   async offlineSyncFiles(options) {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
-    const storageHash = createHash13("sha256").update(storage.dir).digest("hex").slice(0, 16);
+    const storageHash = createHash12("sha256").update(storage.dir).digest("hex").slice(0, 16);
     try {
       const snapshot = await buildOfflineSyncSnapshotForPaths({
         root: storage.dir,
@@ -19567,4 +18164,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-RQE4TITU.js.map
+//# sourceMappingURL=chunk-IHGMRDEE.js.map