@remnic/core 9.66.0 → 9.66.2

package/dist/{chunk-IHGMRDEE.js → chunk-B4B3QDV3.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-CTCGHNWN.js";
+} from "./chunk-J2R275FN.js";
 import {
   ACTIVE_DECISION_STATUSES,
   CodegraphRuntimeError,
@@ -32,16 +32,10 @@ import {
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-WKJFIMVN.js";
+} from "./chunk-VSMSYDIH.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
-import {
-  trustResultFor
-} from "./chunk-GNVZQ5JN.js";
-import {
-  renderEpistemicHedge
-} from "./chunk-YN2UN7N3.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -51,6 +45,12 @@ import {
   seedTrustZoneDemoDataset,
   summarizeTrustZonePromotionReadiness
 } from "./chunk-5QZR2RA3.js";
+import {
+  trustResultFor
+} from "./chunk-GNVZQ5JN.js";
+import {
+  renderEpistemicHedge
+} from "./chunk-YN2UN7N3.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
@@ -59,13 +59,13 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-CFVTRUR3.js";
+} from "./chunk-H6RSANGQ.js";
 import {
   estimateRecallTokens
-} from "./chunk-NPIBN2VL.js";
+} from "./chunk-LK4TOYPU.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-ZW4VXELZ.js";
+} from "./chunk-6PUF7LUO.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -83,7 +83,7 @@ import {
 } from "./chunk-2YA5N2BY.js";
 import {
   buildGraphSnapshot
-} from "./chunk-PD66CVSD.js";
+} from "./chunk-OUKBMQ2O.js";
 import {
   REDACTION_RULES_SUBDIR
 } from "./chunk-LTHVM4XN.js";
@@ -118,7 +118,7 @@ import {
 import {
   CorpusWatermarkCache,
   computeServiceCorpusCensus
-} from "./chunk-4FHRZD5T.js";
+} from "./chunk-F2JXJABQ.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
@@ -130,14 +130,14 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-EFQCDJZ2.js";
+} from "./chunk-4PG2CKI6.js";
 import {
   ExtractionDeadlineError,
   isActivityDigestPath,
   isArtifactMemoryPath,
   isLocationDayPath,
   isMeetingRecordPath
-} from "./chunk-RDGKVH6T.js";
+} from "./chunk-4NKIGSJM.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -147,7 +147,7 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-FESUGFIL.js";
+} from "./chunk-WKWY7YF3.js";
 import {
   OKF_RESERVED_BASENAMES,
   parseEntityFile,
@@ -155,14 +155,14 @@ import {
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-GEJKYA7D.js";
+} from "./chunk-DSEHPUID.js";
 import {
   namespaceCollectionName
-} from "./chunk-FYWLSFFS.js";
+} from "./chunk-OERZXNSK.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-MINHJ55X.js";
+} from "./chunk-XXW32OL7.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -217,16 +217,19 @@ import {
   normalizeProcedureSteps,
   parseProcedureStepsFromBody
 } from "./chunk-QDW3E4RD.js";
+import {
+  isValidActivityDate
+} from "./chunk-M6L7HI7R.js";
 import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
-} from "./chunk-GPFZFCRN.js";
+} from "./chunk-PP7R754B.js";
 import {
   computePromotionCandidates
 } from "./chunk-ME35HVDJ.js";
 import {
   exportCapsule
-} from "./chunk-7LCGFUMB.js";
+} from "./chunk-KQAFEZQX.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -411,7 +414,7 @@ import {
 } from "./chunk-P77QX3ID.js";
 import {
   AccessAuditAdapter
-} from "./chunk-TVVEYCNW.js";
+} from "./chunk-7K5Q6COX.js";
 import {
   decodeCitationNamespace
 } from "./chunk-DJORULH3.js";
@@ -3454,7 +3457,74 @@ function buildNotificationSummary(plan) {
 }
 
 // src/orchestration/generic-recall-paths.ts
+import path5 from "path";
+
+// src/activity/journal.ts
+import { mkdirSync, statSync, writeFileSync } from "fs";
 import path4 from "path";
+var JOURNAL_DIR_NAME = "journal";
+var JOURNAL_DAY_TOPLEVEL = /^journal[\\/]\d{4}-\d{2}-\d{2}\.md$/i;
+var JOURNAL_DAY_ANYWHERE = /(?:^|[\\/])journal[\\/]\d{4}-\d{2}-\d{2}\.md$/i;
+function journalPath(memoryDir, date) {
+  if (!isValidActivityDate(date)) {
+    throw new RangeError(`Invalid journal date "${date}"; expected YYYY-MM-DD.`);
+  }
+  return path4.join(memoryDir, JOURNAL_DIR_NAME, `${date}.md`);
+}
+function isJournalDayPath(filePath, memoryRoot) {
+  if (memoryRoot !== void 0 && memoryRoot.length > 0) {
+    const relative2 = path4.relative(memoryRoot, path4.resolve(memoryRoot, filePath));
+    return JOURNAL_DAY_TOPLEVEL.test(relative2);
+  }
+  return JOURNAL_DAY_ANYWHERE.test(filePath);
+}
+function todayJournalDate(now = /* @__PURE__ */ new Date()) {
+  const year = now.getFullYear();
+  const month = String(now.getMonth() + 1).padStart(2, "0");
+  const day = String(now.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
+}
+function formatCardDuration(card) {
+  const start = Date.parse(card.startUtc);
+  const end = Date.parse(card.endUtc);
+  const minutes = Number.isFinite(start) && Number.isFinite(end) && end > start ? Math.round((end - start) / 6e4) : 0;
+  return `${minutes}m`;
+}
+function renderJournalSeed(date, cards) {
+  const ordered = [...cards].sort((left, right) => {
+    const byStart = left.startUtc.localeCompare(right.startUtc);
+    return byStart !== 0 ? byStart : left.title.localeCompare(right.title);
+  });
+  const glance = ordered.length === 0 ? ["_No cards._"] : ordered.map((card) => `- ${formatCardDuration(card)} ${card.title}`);
+  return [`# Journal \u2014 ${date}`, "", "## Day at a glance", "", ...glance, "", "## Notes", "", ""].join(
+    "\n"
+  );
+}
+function writeJournalFile(filePath, content, force) {
+  let exists = false;
+  try {
+    statSync(filePath);
+    exists = true;
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT") throw err;
+  }
+  if (exists && !force) return false;
+  mkdirSync(path4.dirname(filePath), { recursive: true });
+  writeFileSync(filePath, content);
+  return true;
+}
+function seedJournal(input) {
+  const filePath = journalPath(input.memoryDir, input.date);
+  const wrote = writeJournalFile(
+    filePath,
+    renderJournalSeed(input.date, input.cards ?? []),
+    input.force === true
+  );
+  return { path: filePath, wrote };
+}
+
+// src/orchestration/generic-recall-paths.ts
 var CATEGORY_MEMORY_ROOTS = Object.fromEntries(
   ALL_CATEGORY_DIRS.map((directory) => [directory, true])
 );
@@ -3479,7 +3549,7 @@ function normalizeQmdUriPath(relativePath, source) {
   }
 }
 function stripQmdCollectionPrefix(relativePath, policy, source) {
-  const normalized = path4.posix.normalize(normalizeQmdUriPath(relativePath, source).replace(/\\/g, "/"));
+  const normalized = path5.posix.normalize(normalizeQmdUriPath(relativePath, source).replace(/\\/g, "/"));
   const slashIndex = normalized.indexOf("/");
   if (slashIndex <= 0 || slashIndex >= normalized.length - 1) return normalized;
   const prefix = normalized.slice(0, slashIndex);
@@ -3488,8 +3558,8 @@ function stripQmdCollectionPrefix(relativePath, policy, source) {
   return matchesHotCollection || matchesColdCollection ? normalized.slice(slashIndex + 1) : normalized;
 }
 function isTopLevelArchivePath(filePath, policy = {}, source = "filesystem") {
-  const isAbsolutePath = path4.isAbsolute(filePath);
-  const relative2 = policy.memoryDir && isAbsolutePath ? path4.relative(policy.memoryDir, path4.resolve(filePath)) : filePath;
+  const isAbsolutePath = path5.isAbsolute(filePath);
+  const relative2 = policy.memoryDir && isAbsolutePath ? path5.relative(policy.memoryDir, path5.resolve(filePath)) : filePath;
   const normalized = !isAbsolutePath ? stripQmdCollectionPrefix(relative2, policy, source) : relative2;
   return /^(?:archive|namespaces[\\/][^\\/]+[\\/]archive)(?:[\\/]|$)/i.test(normalized);
 }
@@ -3503,7 +3573,7 @@ function isExternalWikiQmdPath(filePath, source) {
 function isSearchExcludedPath(filePath, policy = {}, source = "filesystem") {
   if (isExternalWikiQmdPath(filePath, source)) return true;
   for (const candidate of collectionSpellings(filePath, policy, source)) {
-    if (isArtifactMemoryPath(candidate) || isNamespacedActivityDigestPath(candidate, policy.memoryDir) || isNamespacedLocationDayPath(candidate, policy.memoryDir) || isMeetingRecordPath(candidate)) {
+    if (isArtifactMemoryPath(candidate) || isNamespacedActivityDigestPath(candidate, policy.memoryDir) || isNamespacedLocationDayPath(candidate, policy.memoryDir) || isNamespacedJournalDayPath(candidate, policy.memoryDir) || isMeetingRecordPath(candidate)) {
       return true;
     }
   }
@@ -3512,7 +3582,7 @@ function isSearchExcludedPath(filePath, policy = {}, source = "filesystem") {
 function isNamespacedActivityDigestPath(candidate, memoryDir) {
   if (isActivityDigestPath(candidate, memoryDir)) return true;
   if (memoryDir === void 0 || memoryDir.length === 0) return false;
-  const relative2 = path4.relative(memoryDir, path4.resolve(memoryDir, candidate));
+  const relative2 = path5.relative(memoryDir, path5.resolve(memoryDir, candidate));
   const namespaced = /^namespaces[\\/]([^\\/]+)[\\/](.*)$/.exec(relative2);
   if (namespaced === null) return false;
   return isActivityDigestPath(namespaced[2] ?? "", memoryDir);
@@ -3520,19 +3590,27 @@ function isNamespacedActivityDigestPath(candidate, memoryDir) {
 function isNamespacedLocationDayPath(candidate, memoryDir) {
   if (isLocationDayPath(candidate, memoryDir)) return true;
   if (memoryDir === void 0 || memoryDir.length === 0) return false;
-  const relative2 = path4.relative(memoryDir, path4.resolve(memoryDir, candidate));
+  const relative2 = path5.relative(memoryDir, path5.resolve(memoryDir, candidate));
   const namespaced = /^namespaces[\\/]([^\\/]+)[\\/](.*)$/.exec(relative2);
   if (namespaced === null) return false;
   return isLocationDayPath(namespaced[2] ?? "", memoryDir);
 }
+function isNamespacedJournalDayPath(candidate, memoryDir) {
+  if (isJournalDayPath(candidate, memoryDir)) return true;
+  if (memoryDir === void 0 || memoryDir.length === 0) return false;
+  const relative2 = path5.relative(memoryDir, path5.resolve(memoryDir, candidate));
+  const namespaced = /^namespaces[\\/]([^\\/]+)[\\/](.*)$/.exec(relative2);
+  if (namespaced === null) return false;
+  return isJournalDayPath(namespaced[2] ?? "", memoryDir);
+}
 function collectionSpellings(filePath, policy, source) {
-  if (path4.isAbsolute(filePath)) return [filePath];
+  if (path5.isAbsolute(filePath)) return [filePath];
   if (source === "qmd" && filePath.startsWith("qmd://")) {
-    const normalized2 = path4.posix.normalize(normalizeQmdUriPath(filePath, source).replace(/\\/g, "/"));
+    const normalized2 = path5.posix.normalize(normalizeQmdUriPath(filePath, source).replace(/\\/g, "/"));
     const slashIndex2 = normalized2.indexOf("/");
     return slashIndex2 <= 0 || slashIndex2 >= normalized2.length - 1 ? [normalized2] : [normalized2, normalized2.slice(slashIndex2 + 1)];
   }
-  const normalized = path4.posix.normalize(
+  const normalized = path5.posix.normalize(
     normalizeQmdUriPath(filePath, source).replace(/\\/g, "/")
   );
   const stripped = stripQmdCollectionPrefix(filePath, policy, source);
@@ -3549,7 +3627,7 @@ function collectionSpellings(filePath, policy, source) {
   return spellings;
 }
 function isGenericRecallExcludedPath(filePath, policy = {}, source = "filesystem") {
-  return isSearchExcludedPath(filePath, policy, source) || isTopLevelArchivePath(filePath, policy, source) || OKF_RESERVED_BASENAMES[path4.basename(filePath)] === true;
+  return isSearchExcludedPath(filePath, policy, source) || isTopLevelArchivePath(filePath, policy, source) || OKF_RESERVED_BASENAMES[path5.basename(filePath)] === true;
 }
 function filterRecallCandidates(candidates, options) {
   const pathPolicy = options.pathPolicy ?? (options.memoryRoot === void 0 ? void 0 : { memoryDir: options.memoryRoot });
@@ -3562,7 +3640,7 @@ function filterRecallCandidates(candidates, options) {
 // src/procedural/procedure-miner.ts
 import { createHash as createHash2 } from "crypto";
 import { mkdir as mkdir2, rm, stat } from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 
 // src/procedural/reinforcement-core.ts
 function clusterByKey(items, keyFn) {
@@ -3615,8 +3693,8 @@ function sleep(ms) {
   return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function acquireClusterWriteLock(memoryDir, clusterHash) {
-  const lockRoot = path5.join(path5.resolve(memoryDir), "state", "procedure-miner-locks");
-  const lockDir = path5.join(lockRoot, `${clusterHash}.lock`);
+  const lockRoot = path6.join(path6.resolve(memoryDir), "state", "procedure-miner-locks");
+  const lockDir = path6.join(lockRoot, `${clusterHash}.lock`);
   await mkdir2(lockRoot, { recursive: true });
   const startedAt = Date.now();
   let attempts = 0;
@@ -3647,7 +3725,7 @@ async function acquireClusterWriteLock(memoryDir, clusterHash) {
   }
 }
 async function withClusterWriteLock(memoryDir, clusterHash, fn) {
-  const inProcessKey = `${path5.resolve(memoryDir)}:${clusterHash}`;
+  const inProcessKey = `${path6.resolve(memoryDir)}:${clusterHash}`;
   const previous = inProcessClusterWriteLocks.get(inProcessKey) ?? Promise.resolve();
   let releaseInProcess;
   const current = previous.catch(() => void 0).then(
@@ -3785,7 +3863,7 @@ async function runProcedureMining(options) {
 }
 
 // src/support-passport/offline-sync-guard.ts
-import path6 from "path";
+import path7 from "path";
 var MAX_SUPPORT_PASSPORT_FRONTMATTER_BYTES = 1048576;
 var SUPPORT_PASSPORT_MARKER = "support-passport-";
 var FRONTMATTER_PREFIXES = ["---\n", "---\r\n"];
@@ -3855,7 +3933,7 @@ function createSupportPassportOfflineSyncGuard(storage) {
     return {
       root: storage.dir,
       path: normalizedPath,
-      filePath: path6.resolve(storage.dir, ...normalizedPath.split("/"))
+      filePath: path7.resolve(storage.dir, ...normalizedPath.split("/"))
     };
   };
   const assertTargetAllowed = async (target) => {
@@ -4187,10 +4265,10 @@ function formatZodIssues(error) {
   const parts = [];
   for (const issue of error.issues) {
     const hasNumeric = issue.path.some((p) => typeof p === "number");
-    const path18 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
+    const path19 = hasNumeric ? issue.path.filter((p) => typeof p === "string").join(".") || "(root)" : issue.path.length > 0 ? issue.path.join(".") : "(root)";
     const options = enumOptionsFromIssue(issue);
     const suffix = options ? `. Valid: ${options.join(", ")}` : "";
-    parts.push(`${path18}: ${issue.message}${suffix}`);
+    parts.push(`${path19}: ${issue.message}${suffix}`);
   }
   return parts.length > 0 ? `request validation failed: ${parts.join("; ")}` : "request validation failed";
 }
@@ -4332,7 +4410,7 @@ function resolveQueryNamespaceWritablePreflight(caps, params, authenticatedPrinc
 }
 
 // src/admin/admin-surfaces.ts
-import path7 from "path";
+import path8 from "path";
 var REDACTED = "<redacted>";
 var SENSITIVE_KEY_RE = /(token|secret|password|api[_-]?key|bearer|authorization|credential|private[_-]?key)/i;
 var BEARER_VALUE_RE = /^(bearer|sk-|pk-|xox[bp]-|AKIA)/i;
@@ -4605,7 +4683,7 @@ async function auditTranscripts(memoryDir) {
     movedEntries: file.groups.reduce((sum, group) => sum + group.entryCount, 0),
     unmovableLines: file.unmovableLines
   }));
-  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path7.sep).includes("other"));
+  const mixedOtherDefault = files.some((file) => file.sourceRelPath.split(path8.sep).includes("other"));
   const summary = plan.movedEntries === 0 ? "No mixed-session transcript data detected; nothing to migrate." : `Found ${plan.movedEntries} entries across ${plan.distinctSessions} distinct sessions stranded in shared/legacy directories. Run the CLI migration command to re-home them.`;
   return {
     generatedAt: plan.generatedAt,
@@ -4744,11 +4822,11 @@ async function promoteMemory(options) {
 }
 
 // src/procedural/library-maintenance.ts
-import path8 from "path";
+import path9 from "path";
 var MAINTENANCE_ACTOR = "procedure-library-maintenance";
 var MAINTENANCE_RULE_VERSION = "procedure-library-maintenance:1";
 function maintenanceMarkerPath(memoryDir) {
-  return path8.join(memoryDir, "state", "procedure-maintenance.json");
+  return path9.join(memoryDir, "state", "procedure-maintenance.json");
 }
 async function readProcedureMaintenanceMarker(memoryDir) {
   try {
@@ -7668,7 +7746,7 @@ import { createHash as createHash4 } from "crypto";
 import * as nodePath2 from "path";
 
 // src/orchestration/recall-result-formatter.ts
-import path9 from "path";
+import path10 from "path";
 function renderConnectorLabel(connector) {
   if (!isValidConnectorId(connector)) return null;
   return connector.length <= CONNECTOR_LABEL_MAX_LENGTH ? connector : `${connector.slice(0, CONNECTOR_LABEL_MAX_LENGTH - 1)}\u2026`;
@@ -7690,15 +7768,15 @@ function resolveEffectiveIdentityInjectionMode(options) {
   return { mode: options.configuredMode, shouldInject: true };
 }
 function displayResultPath(resultPath, memoryDir, namespace) {
-  if (!path9.isAbsolute(resultPath)) return resultPath;
-  const root = path9.resolve(memoryDir);
-  const nsRoot = path9.join(root, "namespaces");
-  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path9.sep))) {
-    const afterNs = path9.relative(nsRoot, resultPath).split(path9.sep).slice(1).join("/");
+  if (!path10.isAbsolute(resultPath)) return resultPath;
+  const root = path10.resolve(memoryDir);
+  const nsRoot = path10.join(root, "namespaces");
+  if (namespace && (resultPath === nsRoot || resultPath.startsWith(nsRoot + path10.sep))) {
+    const afterNs = path10.relative(nsRoot, resultPath).split(path10.sep).slice(1).join("/");
     if (afterNs) return `${namespace}/${afterNs}`;
   }
-  const rel = path9.relative(root, resultPath);
-  return rel && !rel.startsWith("..") && !path9.isAbsolute(rel) ? rel.split(path9.sep).join("/") : resultPath;
+  const rel = path10.relative(root, resultPath);
+  return rel && !rel.startsWith("..") && !path10.isAbsolute(rel) ? rel.split(path10.sep).join("/") : resultPath;
 }
 function displaySafeRecallSnapshot(snapshot, memoryDir) {
   const includedMemories = coerceIncludedMemories(snapshot).map((memory) => ({
@@ -9163,14 +9241,14 @@ function parseCursorPayload(cursor) {
 // src/review/review-deck-mutation.ts
 import { createHash as createHash6, randomUUID } from "crypto";
 import fs3 from "fs";
-import path12 from "path";
+import path13 from "path";
 
 // src/review/index.ts
 import fs from "fs";
-import path10 from "path";
+import path11 from "path";
 var historicalIdCache = new HistoricalEntityCanonicalIdCache();
 function writeReviewFileCanonicalized(memoryDir, filePath, content) {
-  const stateDir = path10.join(memoryDir, "state");
+  const stateDir = path11.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache.get(stateDir);
   let originalBytes = null;
   try {
@@ -9212,8 +9290,8 @@ function realMemoryRoot(memoryDir) {
   }
 }
 function isPathInside(rootReal, candidateReal) {
-  const relative2 = path10.relative(rootReal, candidateReal);
-  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path10.isAbsolute(relative2);
+  const relative2 = path11.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path11.isAbsolute(relative2);
 }
 function isSafeDirectory(rootReal, dir) {
   try {
@@ -9256,7 +9334,7 @@ function listReviewItems(options) {
     if (filterReason && item.reviewReason !== filterReason) return;
     items.push(item);
   };
-  const suggestionsDir = path10.join(memoryDir, "suggestions");
+  const suggestionsDir = path11.join(memoryDir, "suggestions");
   if (!isLimitReached() && fs.existsSync(suggestionsDir) && isSafeDirectory(rootReal, suggestionsDir)) {
     walkMd(rootReal, suggestionsDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -9277,7 +9355,7 @@ function listReviewItems(options) {
       return isLimitReached();
     });
   }
-  const reviewDir = path10.join(memoryDir, "review");
+  const reviewDir = path11.join(memoryDir, "review");
   if (!isLimitReached() && fs.existsSync(reviewDir) && isSafeDirectory(rootReal, reviewDir)) {
     walkMd(rootReal, reviewDir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -9302,7 +9380,7 @@ function listReviewItems(options) {
   const categories = ALL_CATEGORY_DIRS;
   for (const category of categories) {
     if (isLimitReached()) break;
-    const dir = path10.join(memoryDir, category);
+    const dir = path11.join(memoryDir, category);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     walkMd(rootReal, dir, (filePath, content) => {
       if (isLimitReached()) return true;
@@ -9384,9 +9462,9 @@ function approveItem(memoryDir, itemId, options) {
   const targetDir = getCategoryDir(memoryDir, category);
   const dateDir = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
   ensureSafeDirectory(rootReal, targetDir);
-  const outputPath = path10.join(targetDir, dateDir, path10.basename(found.filePath));
-  ensureSafeDirectory(rootReal, path10.dirname(outputPath));
-  const reviewStateDir = path10.join(memoryDir, "state");
+  const outputPath = path11.join(targetDir, dateDir, path11.basename(found.filePath));
+  ensureSafeDirectory(rootReal, path11.dirname(outputPath));
+  const reviewStateDir = path11.join(memoryDir, "state");
   const idsAtWrite = historicalIdCache.get(reviewStateDir);
   const promotedWritten = canonicalizeEntityRefFrontmatter(updatedContent, idsAtWrite);
   const promotedPath = writeFileWithoutClobber(outputPath, promotedWritten, itemId);
@@ -9463,13 +9541,13 @@ function findReviewFileById(memoryDir, id, options = {}) {
   const rootReal = realMemoryRoot(memoryDir);
   if (!rootReal) return null;
   for (const loc of ["suggestions", "review"]) {
-    const dir = path10.join(memoryDir, loc);
+    const dir = path11.join(memoryDir, loc);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id);
     if (found) return { filePath: found, location: "queue" };
   }
   for (const category of ALL_CATEGORY_DIRS) {
-    const dir = path10.join(memoryDir, category);
+    const dir = path11.join(memoryDir, category);
     if (!fs.existsSync(dir) || !isSafeDirectory(rootReal, dir)) continue;
     const found = findFileById(rootReal, dir, id, (fm) => isLowConfidenceReviewCandidate(fm, options));
     if (found) return { filePath: found, location: "category" };
@@ -9545,10 +9623,10 @@ function readFileSafe(filePath) {
   }
 }
 function writeFileWithoutClobber(basePath, content, discriminator) {
-  const parsed = path10.parse(basePath);
+  const parsed = path11.parse(basePath);
   const safeDiscriminator = sanitizeFilePart(discriminator);
   for (let attempt = 0; attempt < 1e3; attempt++) {
-    const candidate = attempt === 0 ? basePath : path10.join(
+    const candidate = attempt === 0 ? basePath : path11.join(
       parsed.dir,
       `${parsed.name}-${safeDiscriminator}${attempt === 1 ? "" : `-${attempt}`}${parsed.ext || ".md"}`
     );
@@ -9604,7 +9682,7 @@ function extractBody(content) {
 function walkMd(rootReal, dir, callback) {
   if (!isSafeDirectory(rootReal, dir)) return false;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path10.join(dir, entry.name);
+    const fullPath = path11.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       if (walkMd(rootReal, fullPath, callback)) return true;
@@ -9619,7 +9697,7 @@ function walkMdPaths(rootReal, dir) {
   const results = [];
   if (!isSafeDirectory(rootReal, dir)) return results;
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path10.join(dir, entry.name);
+    const fullPath = path11.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       results.push(...walkMdPaths(rootReal, fullPath));
@@ -9632,7 +9710,7 @@ function walkMdPaths(rootReal, dir) {
 
 // src/review/review-deck-snapshot.ts
 import fs2 from "fs";
-import path11 from "path";
+import path12 from "path";
 var QUEUE_DIRS = ["suggestions", "review"];
 function readReviewDeckSnapshot(opts) {
   const corpusVersion = readCorpusVersion(opts.memoryDir);
@@ -9640,7 +9718,7 @@ function readReviewDeckSnapshot(opts) {
   if (!rootReal) return { corpusVersion, total: 0, rows: [] };
   const rows = [];
   for (const location of QUEUE_DIRS) {
-    const dir = path11.join(opts.memoryDir, location);
+    const dir = path12.join(opts.memoryDir, location);
     if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
     walkMd2(rootReal, dir, (filePath, content) => {
       const row = rowFromQueueFile(filePath, content, location);
@@ -9653,7 +9731,7 @@ function readReviewDeckRow(opts) {
   const rootReal = realMemoryRoot2(opts.memoryDir);
   if (!rootReal) return null;
   for (const location of QUEUE_DIRS) {
-    const dir = path11.join(opts.memoryDir, location);
+    const dir = path12.join(opts.memoryDir, location);
     if (!fs2.existsSync(dir) || !isSafeDirectory2(rootReal, dir)) continue;
     let found = null;
     walkMd2(rootReal, dir, (filePath, content) => {
@@ -9669,7 +9747,7 @@ function readReviewDeckRow(opts) {
 }
 function readCorpusVersion(memoryDir) {
   try {
-    return String(fs2.statSync(path11.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
+    return String(fs2.statSync(path12.join(memoryDir, "state", MEMORY_CORPUS_VERSION_SENTINEL)).size);
   } catch {
     return "0";
   }
@@ -9719,8 +9797,8 @@ function realMemoryRoot2(memoryDir) {
   }
 }
 function isPathInside2(rootReal, candidateReal) {
-  const relative2 = path11.relative(rootReal, candidateReal);
-  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path11.isAbsolute(relative2);
+  const relative2 = path12.relative(rootReal, candidateReal);
+  return relative2 === "" || !!relative2 && !relative2.startsWith("..") && !path12.isAbsolute(relative2);
 }
 function isSafeDirectory2(rootReal, dir) {
   try {
@@ -9734,7 +9812,7 @@ function isSafeDirectory2(rootReal, dir) {
 function walkMd2(rootReal, dir, callback) {
   if (!isSafeDirectory2(rootReal, dir)) return false;
   for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
-    const fullPath = path11.join(dir, entry.name);
+    const fullPath = path12.join(dir, entry.name);
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
       if (walkMd2(rootReal, fullPath, callback)) return true;
@@ -9849,7 +9927,7 @@ function parseReviewLifecycleReceipt(value) {
   if (!isReceiptAction(rec.action)) return null;
   if (typeof rec.beforeRevision !== "string") return null;
   if (typeof rec.afterRevision !== "string") return null;
-  if (!isNonEmptyString(rec.sourcePath) || path12.isAbsolute(rec.sourcePath)) return null;
+  if (!isNonEmptyString(rec.sourcePath) || path13.isAbsolute(rec.sourcePath)) return null;
   if (rec.revisionArtifact !== void 0 && typeof rec.revisionArtifact !== "string") return null;
   if (rec.undoOfReceiptId !== void 0 && typeof rec.undoOfReceiptId !== "string") return null;
   const parsed = {
@@ -9881,11 +9959,11 @@ function findStoredReceipt(events, receiptId) {
   return null;
 }
 function resolveInside(memoryDir, rel) {
-  if (!rel || path12.isAbsolute(rel)) return null;
-  const root = path12.resolve(memoryDir);
-  const abs = path12.resolve(root, rel.split("/").join(path12.sep));
-  const next = path12.relative(root, abs);
-  if (next.startsWith("..") || path12.isAbsolute(next)) return null;
+  if (!rel || path13.isAbsolute(rel)) return null;
+  const root = path13.resolve(memoryDir);
+  const abs = path13.resolve(root, rel.split("/").join(path13.sep));
+  const next = path13.relative(root, abs);
+  if (next.startsWith("..") || path13.isAbsolute(next)) return null;
   return abs;
 }
 function currentRevision(absPath) {
@@ -10548,14 +10626,14 @@ async function completeSupportPassportReplacementPrior(input) {
 }
 
 // src/support-passport/generated-batch.ts
-import path14 from "path";
+import path15 from "path";
 import { z as z2 } from "zod";
 
 // src/support-passport/private-file.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { constants as fsConstants } from "fs";
 import { lstat as lstat2, mkdir as mkdir3, open, rename as rename2, rm as rm2, stat as stat2 } from "fs/promises";
-import path13 from "path";
+import path14 from "path";
 var UNSUPPORTED_DIRECTORY_SYNC_ERRORS = /* @__PURE__ */ new Set(["EINVAL", "ENOSYS", "ENOTSUP", "EOPNOTSUPP"]);
 var NON_WRITABLE_ANCESTOR_SYNC_ERRORS = /* @__PURE__ */ new Set(["EROFS", "EPERM", "EACCES"]);
 function assertStableDirectory(before, opened, after, errorMessage) {
@@ -10581,8 +10659,8 @@ function openFlags(...flags) {
   return combined;
 }
 function assertContainedPath(trustedRoot, directory, errorMessage) {
-  const relative2 = path13.relative(path13.resolve(trustedRoot), path13.resolve(directory));
-  if (relative2 === ".." || relative2.startsWith(`..${path13.sep}`) || path13.isAbsolute(relative2)) {
+  const relative2 = path14.relative(path14.resolve(trustedRoot), path14.resolve(directory));
+  if (relative2 === ".." || relative2.startsWith(`..${path14.sep}`) || path14.isAbsolute(relative2)) {
     throw new Error(errorMessage);
   }
 }
@@ -10615,7 +10693,7 @@ async function syncDirectoryHandle(handle) {
 }
 async function resolvePrivateDirectoryPath(directory, handle, opened, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const pinnedPath = path13.join(descriptorRoot, String(handle.fd));
+  const pinnedPath = path14.join(descriptorRoot, String(handle.fd));
   const metadata = await stat2(pinnedPath);
   if (!metadata.isDirectory() || metadata.dev !== opened.dev || metadata.ino !== opened.ino) {
     throw new Error(errorMessage);
@@ -10631,12 +10709,12 @@ function requirePrivateFileDescriptorRoot(platform, errorMessage) {
   throw new Error(errorMessage);
 }
 async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform = process.platform) {
-  const root = path13.resolve(trustedRoot);
-  const target = path13.resolve(directory);
+  const root = path14.resolve(trustedRoot);
+  const target = path14.resolve(directory);
   assertContainedPath(root, target, errorMessage);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const relative2 = path13.relative(root, target);
-  const components = relative2 === "" ? [] : relative2.split(path13.sep);
+  const relative2 = path14.relative(root, target);
+  const components = relative2 === "" ? [] : relative2.split(path14.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10644,10 +10722,10 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const child = await openDirectoryNoFollow(path13.join(pinnedParent, component), errorMessage);
+      const child = await openDirectoryNoFollow(path14.join(pinnedParent, component), errorMessage);
       handles.push(child.handle);
       assertStableDirectory(current.before, current.opened, await lstat2(currentPath), errorMessage);
-      currentPath = path13.join(currentPath, component);
+      currentPath = path14.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat2(target), errorMessage);
@@ -10668,12 +10746,12 @@ async function openStableDirectoryFromRoot(trustedRoot, directory, errorMessage,
   }
 }
 async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, hardenExistingChildren = true, platform = process.platform) {
-  const root = path13.resolve(trustedRoot);
-  const target = path13.resolve(directory);
+  const root = path14.resolve(trustedRoot);
+  const target = path14.resolve(directory);
   assertContainedPath(root, target, errorMessage);
-  const relative2 = path13.relative(root, target);
+  const relative2 = path14.relative(root, target);
   requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const components = relative2 === "" ? [] : relative2.split(path13.sep);
+  const components = relative2 === "" ? [] : relative2.split(path14.sep);
   const handles = [];
   let currentPath = root;
   try {
@@ -10681,7 +10759,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
     handles.push(current.handle);
     for (const component of components) {
       const pinnedParent = await resolvePrivateDirectoryPath(currentPath, current.handle, current.opened, errorMessage);
-      const childPath = path13.join(pinnedParent, component);
+      const childPath = path14.join(pinnedParent, component);
       let created = false;
       try {
         await mkdir3(childPath, { mode: 448 });
@@ -10696,7 +10774,7 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
         await child.handle.chmod(448);
       }
       assertStableDirectory(current.before, current.opened, await lstat2(currentPath), errorMessage);
-      currentPath = path13.join(currentPath, component);
+      currentPath = path14.join(currentPath, component);
       current = child;
     }
     assertStableDirectory(current.before, current.opened, await lstat2(target), errorMessage);
@@ -10705,8 +10783,8 @@ async function ensurePrivateDirectoryNoFollow(trustedRoot, directory, errorMessa
   }
 }
 async function ensurePrivateDirectoryTreeNoFollow(directory, errorMessage, syncVerifiedParent = syncDirectoryHandle, platform = process.platform) {
-  const target = path13.resolve(directory);
-  const filesystemRoot = path13.parse(target).root;
+  const target = path14.resolve(directory);
+  const filesystemRoot = path14.parse(target).root;
   const rootMetadata = await stat2(filesystemRoot);
   await ensurePrivateDirectoryNoFollow(
     filesystemRoot,
@@ -10741,15 +10819,15 @@ async function withPrivateDirectoryNoFollow(trustedRoot, directory, errorMessage
   }
 }
 async function readPrivateFileNoFollow(directory, filePath, errorMessage, trustedRoot = directory, platform = process.platform) {
-  if (path13.dirname(filePath) !== path13.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path13.basename(filePath);
+  if (path14.dirname(filePath) !== path14.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path14.basename(filePath);
   let directoryHandles = [];
   let fileHandle;
   try {
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    const targetPath = path13.join(pinnedDirectory, targetName);
+    const targetPath = path14.join(pinnedDirectory, targetName);
     const before = await lstat2(targetPath);
     if (before.isSymbolicLink() || !before.isFile()) throw new Error(errorMessage);
     try {
@@ -10768,10 +10846,10 @@ async function readPrivateFileNoFollow(directory, filePath, errorMessage, truste
   }
 }
 async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, content, errorMessage, directoryHandle, openFile) {
-  if (targetName.length === 0 || targetName === "." || targetName === ".." || path13.basename(targetName) !== targetName) {
+  if (targetName.length === 0 || targetName === "." || targetName === ".." || path14.basename(targetName) !== targetName) {
     throw new Error(errorMessage);
   }
-  const targetPath = path13.join(pinnedDirectory, targetName);
+  const targetPath = path14.join(pinnedDirectory, targetName);
   let fileHandle;
   try {
     try {
@@ -10807,8 +10885,8 @@ async function appendPrivateFileAtPinnedDirectory(pinnedDirectory, targetName, c
 }
 async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, content, errorMessage, platform = process.platform) {
   const descriptorRoot = requirePrivateFileDescriptorRoot(platform, errorMessage);
-  const resolvedDirectory = path13.resolve(pinnedDirectory);
-  const descriptor = path13.relative(descriptorRoot, resolvedDirectory);
+  const resolvedDirectory = path14.resolve(pinnedDirectory);
+  const descriptor = path14.relative(descriptorRoot, resolvedDirectory);
   if (!/^\d+$/.test(descriptor)) throw new Error(errorMessage);
   const before = await stat2(resolvedDirectory);
   if (!before.isDirectory()) throw new Error(errorMessage);
@@ -10824,8 +10902,8 @@ async function appendPrivateFileInPinnedDirectory(pinnedDirectory, fileName, con
   }
 }
 async function writePrivateFileAtomicallyNoFollow(directory, filePath, content, errorMessage, trustedRoot = directory, platform = process.platform, syncVerifiedDirectory = syncDirectoryHandle) {
-  if (path13.dirname(filePath) !== path13.resolve(directory)) throw new Error(errorMessage);
-  const targetName = path13.basename(filePath);
+  if (path14.dirname(filePath) !== path14.resolve(directory)) throw new Error(errorMessage);
+  const targetName = path14.basename(filePath);
   const tempName = `.${targetName}.${randomUUID2()}.tmp`;
   let tempPath;
   let directoryHandles = [];
@@ -10834,8 +10912,8 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
     const stableDirectory = await openStableDirectoryFromRoot(trustedRoot, directory, errorMessage, platform);
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
-    tempPath = path13.join(pinnedDirectory, tempName);
-    const targetPath = path13.join(pinnedDirectory, targetName);
+    tempPath = path14.join(pinnedDirectory, tempName);
+    const targetPath = path14.join(pinnedDirectory, targetName);
     try {
       fileHandle = await open(
         tempPath,
@@ -10872,7 +10950,7 @@ async function writePrivateFileAtomicallyNoFollow(directory, filePath, content,
 }
 async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, trustedRoot = directory, platform = process.platform) {
   if (fileNames.some(
-    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path13.basename(fileName) !== fileName
+    (fileName) => fileName.length === 0 || fileName === "." || fileName === ".." || path14.basename(fileName) !== fileName
   )) {
     throw new Error(errorMessage);
   }
@@ -10882,7 +10960,7 @@ async function removePrivateFilesNoFollow(directory, fileNames, errorMessage, tr
     directoryHandles = stableDirectory.handles;
     const pinnedDirectory = stableDirectory.pinnedDirectory;
     for (const fileName of fileNames) {
-      await rm2(path13.join(pinnedDirectory, fileName), { force: true });
+      await rm2(path14.join(pinnedDirectory, fileName), { force: true });
     }
     assertStableDirectory(stableDirectory.before, stableDirectory.opened, await lstat2(directory), errorMessage);
     if (stableDirectory.handle) await syncDirectoryHandle(stableDirectory.handle);
@@ -10903,13 +10981,13 @@ var GeneratedBatchMarkerSchema = z2.object({
 }).strict();
 var BATCH_ERROR = "The generated draft batch state is not safe.";
 function batchDirectory(storage) {
-  return path14.join(storage.dir, "state", "support-passport", "generated-batches");
+  return path15.join(storage.dir, "state", "support-passport", "generated-batches");
 }
 function batchFileName(batchId) {
   return `${BatchIdSchema.parse(batchId)}.json`;
 }
 function batchPath(storage, batchId) {
-  return path14.join(batchDirectory(storage), batchFileName(batchId));
+  return path15.join(batchDirectory(storage), batchFileName(batchId));
 }
 function markerFor(context, batchId, size, complete) {
   return GeneratedBatchMarkerSchema.parse({
@@ -11334,7 +11412,7 @@ var SupportPassportAnswerModelInputSchema = z4.object({
 
 // src/support-passport/owner-lock.ts
 import { createHash as createHash8 } from "crypto";
-import path15 from "path";
+import path16 from "path";
 var CARD_MUTATION_LOCK_STALE_MS = 6e4;
 var CARD_MUTATION_LOCK_MAX_WAIT_MS = 3e4;
 function computeSupportPassportOwnerLockKey(namespace, principal) {
@@ -11345,7 +11423,7 @@ function supportPassportOwnerLockPath(storage, scope) {
   if (!/^[a-f0-9]{64}$/.test(ownerLockKey)) {
     throw new SupportPassportError("card_data_invalid", "The support passport owner scope is invalid.", 500);
   }
-  return path15.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
+  return path16.join(storage.dir, "state", `support-passport-cards-${ownerLockKey}.lock`);
 }
 async function withSupportPassportOwnerLock(storage, scope, task) {
   const lockPath = supportPassportOwnerLockPath(storage, scope);
@@ -12243,7 +12321,7 @@ var SupportPassportCardService = class {
 // src/support-passport/grant-store.ts
 import { createHash as createHash9, randomBytes, randomUUID as randomUUID4, timingSafeEqual } from "crypto";
 import { lstat as lstat3, open as open2, readdir as readdir3 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 var GRANT_LOCK_STALE_MS = 3e4;
 var GRANT_LOCK_WAIT_MS = 5e3;
 var GRANT_LOCK_HEARTBEAT_MS = 1e4;
@@ -12335,9 +12413,9 @@ var SupportPassportGrantStore = class {
   runWithHeldFileLock;
   syncDirectory;
   constructor(options) {
-    this.memoryDir = path16.resolve(expandTildePath(options.memoryDir));
-    this.grantsDir = path16.join(this.memoryDir, "state", "support-passport", "grants");
-    this.ownerIndexesDir = path16.join(this.grantsDir, "owners");
+    this.memoryDir = path17.resolve(expandTildePath(options.memoryDir));
+    this.grantsDir = path17.join(this.memoryDir, "state", "support-passport", "grants");
+    this.ownerIndexesDir = path17.join(this.grantsDir, "owners");
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
     this.makeSecret = options.makeSecret ?? (() => randomBytes(32));
     this.makeGrantId = options.makeGrantId ?? randomUUID4;
@@ -12550,11 +12628,11 @@ var SupportPassportGrantStore = class {
   }
   filePath(grantId) {
     const normalizedGrantId = normalizeGrantId(grantId);
-    return path16.join(this.grantsDir, `${normalizedGrantId}.json`);
+    return path17.join(this.grantsDir, `${normalizedGrantId}.json`);
   }
   ownerIndexPath(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path16.join(this.ownerIndexesDir, `${ownerHash}.json`);
+    return path17.join(this.ownerIndexesDir, `${ownerHash}.json`);
   }
   ownerHash(namespace, principalHash) {
     return sha256("support-passport-owner-index:v1", `${namespace}\0${principalHash}`);
@@ -12610,12 +12688,12 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       grantIds.map((grantId) => `${grantId}.json`),
       "support passport grant files must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
   }
   ownerMembershipDirectory(ownerHash) {
     if (!SAFE_OWNER_INDEX_HASH.test(ownerHash)) throw new Error("support passport owner index hash is invalid");
-    return path16.join(this.ownerIndexesDir, ownerHash);
+    return path17.join(this.ownerIndexesDir, ownerHash);
   }
   async ensureOwnerMembershipDirectory(ownerHash) {
     const directory = this.ownerMembershipDirectory(ownerHash);
@@ -12630,11 +12708,11 @@ var SupportPassportGrantStore = class {
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     await writePrivateFileAtomicallyNoFollow(
       directory,
-      path16.join(directory, `${state.grantId}.json`),
+      path17.join(directory, `${state.grantId}.json`),
       `${JSON.stringify({ schemaVersion: 1, grantId: state.grantId })}
 `,
       "support passport owner membership must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
   }
   async removeOwnerMembership(state) {
@@ -12644,7 +12722,7 @@ var SupportPassportGrantStore = class {
       directory,
       [`${state.grantId}.json`],
       "support passport owner membership must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
   }
   async removeStoredGrant(state) {
@@ -12745,7 +12823,7 @@ var SupportPassportGrantStore = class {
     const ownerHash = this.ownerHash(namespace, principalHash);
     const directory = await this.ensureOwnerMembershipDirectory(ownerHash);
     const grantIds = await withPrivateDirectoryNoFollow(
-      path16.parse(this.memoryDir).root,
+      path17.parse(this.memoryDir).root,
       directory,
       "support passport owner membership must be regular files in a stable directory",
       async (pinnedDirectory) => {
@@ -12776,7 +12854,7 @@ var SupportPassportGrantStore = class {
         this.ownerIndexesDir,
         filePath,
         "support passport owner indexes must be regular files in a stable directory",
-        path16.parse(this.memoryDir).root
+        path17.parse(this.memoryDir).root
       );
     } catch (error) {
       if (error.code === "ENOENT") return [];
@@ -12816,7 +12894,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify({ schemaVersion: 1, ownerHash, grantIds }, null, 2)}
 `,
       "support passport owner indexes must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
   }
   async readState(grantId) {
@@ -12826,7 +12904,7 @@ var SupportPassportGrantStore = class {
       this.grantsDir,
       filePath,
       "support passport grant files must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
     try {
       const state = SupportPassportGrantStateSchema.parse(JSON.parse(content));
@@ -12860,7 +12938,7 @@ var SupportPassportGrantStore = class {
       `${JSON.stringify(state, null, 2)}
 `,
       "support passport grant files must be regular files in a stable directory",
-      path16.parse(this.memoryDir).root
+      path17.parse(this.memoryDir).root
     );
   }
   async ensureSafeDirectories() {
@@ -12894,8 +12972,8 @@ var SupportPassportGrantStore = class {
           void 0
         );
         this.memoryDir = configuredMemoryDir;
-        this.grantsDir = path16.join(configuredMemoryDir, "state", "support-passport", "grants");
-        this.ownerIndexesDir = path16.join(this.grantsDir, "owners");
+        this.grantsDir = path17.join(configuredMemoryDir, "state", "support-passport", "grants");
+        this.ownerIndexesDir = path17.join(this.grantsDir, "owners");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -12909,12 +12987,12 @@ var SupportPassportGrantStore = class {
   async withMutationLock(task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path16.parse(this.memoryDir).root,
+      path17.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grants:${this.grantsDir}`,
-        path16.join(pinnedDirectory, ".grants.lock"),
+        path17.join(pinnedDirectory, ".grants.lock"),
         task
       )
     );
@@ -12923,12 +13001,12 @@ var SupportPassportGrantStore = class {
     const normalizedGrantId = normalizeGrantId(grantId);
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path16.parse(this.memoryDir).root,
+      path17.parse(this.memoryDir).root,
       this.grantsDir,
       "support passport grant lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-grant:${this.grantsDir}:${normalizedGrantId}`,
-        path16.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
+        path17.join(pinnedDirectory, `.${normalizedGrantId}.lock`),
         task
       )
     );
@@ -12936,12 +13014,12 @@ var SupportPassportGrantStore = class {
   async withOwnerIndexLock(ownerHash, task) {
     await this.ensureSafeDirectories();
     return await withPrivateDirectoryNoFollow(
-      path16.parse(this.memoryDir).root,
+      path17.parse(this.memoryDir).root,
       this.ownerIndexesDir,
       "support passport owner lock directory must remain inside the memory directory",
       async (pinnedDirectory) => await this.withExclusiveLock(
         `support-passport-owner:${this.ownerIndexesDir}:${ownerHash}`,
-        path16.join(pinnedDirectory, `.${ownerHash}.lock`),
+        path17.join(pinnedDirectory, `.${ownerHash}.lock`),
         task
       )
     );
@@ -13779,7 +13857,7 @@ var SupportPassportModelAdapter = class {
 
 // src/support-passport/model-audit.ts
 import { createHash as createHash10 } from "crypto";
-import path17 from "path";
+import path18 from "path";
 import { z as z5 } from "zod";
 var HashSchema = z5.string().regex(/^[a-f0-9]{64}$/);
 var SupportPassportModelAuditRecordSchema = z5.object({
@@ -13824,15 +13902,15 @@ var SupportPassportModelAuditStore = class {
   memoryRootReady;
   runWithHeldFileLock;
   constructor(options) {
-    this.memoryDir = path17.resolve(expandTildePath(options.memoryDir));
-    this.auditDir = path17.join(this.memoryDir, "state", "support-passport", "audit");
+    this.memoryDir = path18.resolve(expandTildePath(options.memoryDir));
+    this.auditDir = path18.join(this.memoryDir, "state", "support-passport", "audit");
     this.runWithHeldFileLock = options.withHeldFileLock ?? withHeldFileLock;
   }
   async record(input) {
     const record = SupportPassportModelAuditRecordSchema.parse(input);
     await this.ensureSafeDirectories();
     const day = record.occurredAt.slice(0, 10);
-    const filePath = path17.join(this.auditDir, `${day}.jsonl`);
+    const filePath = path18.join(this.auditDir, `${day}.jsonl`);
     await serializeMutations(
       `support-passport-audit:${filePath}`,
       () => withPrivateDirectoryNoFollow(
@@ -13840,7 +13918,7 @@ var SupportPassportModelAuditStore = class {
         this.auditDir,
         "support passport audit directory must remain inside the memory directory",
         async (pinnedDirectory) => await this.runWithHeldFileLock(
-          path17.join(pinnedDirectory, `.${day}.lock`),
+          path18.join(pinnedDirectory, `.${day}.lock`),
           {
             staleMs: 3e4,
             maxWaitMs: 5e3,
@@ -13877,7 +13955,7 @@ var SupportPassportModelAuditStore = class {
           "support passport memory directory must be a stable directory"
         );
         this.memoryDir = configuredMemoryDir;
-        this.auditDir = path17.join(configuredMemoryDir, "state", "support-passport", "audit");
+        this.auditDir = path18.join(configuredMemoryDir, "state", "support-passport", "audit");
       })();
     }
     const currentAttempt = this.memoryRootReady;
@@ -17425,7 +17503,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     const resolvedNamespace = this.resolveReadableNamespace(options.namespace, options.principal);
     const storage = await offlineSyncStorageForSnapshot(this.orchestrator, resolvedNamespace);
     const storageHash = createHash12("sha256").update(storage.dir).digest("hex").slice(0, 16);
-    const deletions = [...await storage.readDeletionRevisions()].map(([path18, mtimeMs]) => ({ path: path18, mtimeMs }));
+    const deletions = [...await storage.readDeletionRevisions()].map(([path19, mtimeMs]) => ({ path: path19, mtimeMs }));
     const snapshotBuilder = options.includeContent === false && options.baseFiles && options.baseFiles.length > 0 ? buildOfflineSyncSnapshotFromBase : buildOfflineSyncSnapshot;
     const snapshot = await snapshotBuilder({
       root: storage.dir,
@@ -17451,7 +17529,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     const storageHash = createHash12("sha256").update(storage.dir).digest("hex").slice(0, 16);
     const deletions = await filterOfflineSyncDeletionRevisions({
       root: storage.dir,
-      deletions: [...await storage.readDeletionRevisions()].map(([path18, mtimeMs]) => ({ path: path18, mtimeMs })),
+      deletions: [...await storage.readDeletionRevisions()].map(([path19, mtimeMs]) => ({ path: path19, mtimeMs })),
       includeTranscripts: options.includeTranscripts !== false,
       userExcludeRegexps: this.offlineSyncUserExcludes
     });
@@ -18073,6 +18151,12 @@ export {
   CorrectionContractError,
   detectPassiveCorrections,
   capturePassiveCorrections,
+  JOURNAL_DIR_NAME,
+  journalPath,
+  isJournalDayPath,
+  todayJournalDate,
+  writeJournalFile,
+  seedJournal,
   isTopLevelArchivePath,
   isGenericRecallExcludedPath,
   filterRecallCandidates,
@@ -18164,4 +18248,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-IHGMRDEE.js.map
+//# sourceMappingURL=chunk-B4B3QDV3.js.map