@remnic/core 9.69.39 → 9.69.41

package/dist/{chunk-54NX5EG4.js → chunk-P66QH6R6.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-GG5FHZJJ.js";
+} from "./chunk-I33QYUAF.js";
 import {
   MutationSerializer,
   withHeldFileLock
@@ -1473,4 +1473,4 @@ export {
   isNamespaceKind,
   NamespaceCatalog
 };
-//# sourceMappingURL=chunk-54NX5EG4.js.map
+//# sourceMappingURL=chunk-P66QH6R6.js.map

package/dist/{chunk-62D2PAAM.js → chunk-PAAJWQH5.js}

@@ -2,9 +2,6 @@ import {
   CONVERGE_CONFLICT_POLICIES,
   DEFAULT_CONVERGE_CONFLICT_POLICY
 } from "./chunk-6MINUTGJ.js";
-import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
 import {
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
@@ -13,6 +10,9 @@ import {
   isCensusMtimeMs,
   isSha256Hex
 } from "./chunk-LQWOFU6L.js";
+import {
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
 
 // src/reconcile/plan.ts
 var ReconcilePlanInputError = class extends Error {
@@ -435,4 +435,4 @@ export {
   summarizeReconcilePlan,
   planReconciliation
 };
-//# sourceMappingURL=chunk-62D2PAAM.js.map
+//# sourceMappingURL=chunk-PAAJWQH5.js.map

package/dist/{chunk-TA4C3XB7.js → chunk-PFKIOYJH.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-CZTPU65V.js";
+} from "./chunk-ICN37XHG.js";
 import {
   copyExistingFileToBackup,
   writeFileAtomically
@@ -260,4 +260,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-TA4C3XB7.js.map
+//# sourceMappingURL=chunk-PFKIOYJH.js.map

package/dist/{chunk-WIWLX65T.js → chunk-PGGPRF6J.js}

@@ -1,6 +1,6 @@
 import {
   runLocationSync
-} from "./chunk-PCOVEDPK.js";
+} from "./chunk-KZJM7R4F.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -58,4 +58,4 @@ export {
   LOCATION_SYNC_DEFAULT_INTERVAL_MS,
   startLocationAutoSync
 };
-//# sourceMappingURL=chunk-WIWLX65T.js.map
+//# sourceMappingURL=chunk-PGGPRF6J.js.map

package/dist/{chunk-V6EGNVUT.js → chunk-PIWFNPQT.js}

@@ -1,3 +1,6 @@
+import {
+  estimateTokenCount
+} from "./chunk-TOTT6S2V.js";
 import {
   SKILL_FILE_NAME,
   renderSkillBundle
@@ -5,9 +8,6 @@ import {
 import {
   isValidSkillSlug
 } from "./chunk-ZCUTSMR2.js";
-import {
-  estimateTokenCount
-} from "./chunk-TOTT6S2V.js";
 import {
   pathIsInside
 } from "./chunk-C7HJ3NEI.js";
@@ -800,4 +800,4 @@ export {
   truncateToTokenBudget,
   describeMemoriesDir
 };
-//# sourceMappingURL=chunk-V6EGNVUT.js.map
+//# sourceMappingURL=chunk-PIWFNPQT.js.map

package/dist/{chunk-BLDBT6HZ.js → chunk-PJRKLB4Z.js}

@@ -26,14 +26,30 @@ function classifyFallbackParseFailure(reason) {
     case "no_models":
       return "auth_config";
     case "http_error":
+    case "timeout":
       return "provider_retryable";
     case "empty":
+    case "schema_rejection":
       return "parse_empty";
   }
 }
+function formatExtractionParseFailureLog(input) {
+  const modelUsed = typeof input.attemptedModel === "string" && input.attemptedModel.length > 0 ? input.attemptedModel : "unknown";
+  const errorClass = typeof input.errorClass === "string" && input.errorClass.length > 0 ? input.errorClass : "none";
+  const httpStatus = typeof input.httpStatus === "number" && Number.isFinite(input.httpStatus) ? String(input.httpStatus) : "none";
+  return [
+    "extraction fallback returned no parsed output",
+    `failureReason=${input.failureReason}`,
+    `modelUsed=${modelUsed}`,
+    `errorClass=${errorClass}`,
+    `httpStatus=${httpStatus}`,
+    `traceId=${input.traceId}`
+  ].join(" ");
+}
 
 export {
   classifyExtractionThrownError,
-  classifyFallbackParseFailure
+  classifyFallbackParseFailure,
+  formatExtractionParseFailureLog
 };
-//# sourceMappingURL=chunk-BLDBT6HZ.js.map
+//# sourceMappingURL=chunk-PJRKLB4Z.js.map

package/dist/chunk-PJRKLB4Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/extraction-error-classification.ts"],"sourcesContent":["import type { ExtractionFailureClass } from \"./types.js\";\nimport { isTransientHttpError } from \"./connectors/live/transient-errors.js\";\n\n/**\n * Read a numeric HTTP status off a thrown error without re-implementing the\n * shared transient classifier. Uses `in`/typeof narrowing (no inline casts).\n */\nfunction httpStatusFromError(err: unknown): number | undefined {\n  if (!err || typeof err !== \"object\") return undefined;\n  if (\"status\" in err && typeof err.status === \"number\" && Number.isFinite(err.status)) return err.status;\n  if (\"statusCode\" in err && typeof err.statusCode === \"number\" && Number.isFinite(err.statusCode)) {\n    return err.statusCode;\n  }\n  return undefined;\n}\n\n/**\n * Map a thrown extraction error to a coarse failure class for the retry/breaker\n * layer. 401/403 → `auth_config` (misconfigured provider, open the breaker);\n * transient (429/5xx/network, per the shared `isTransientHttpError`) → back off;\n * anything else defaults to `provider_retryable` (fail-open toward retry, but\n * capped by the per-fingerprint attempt budget). Never throws.\n */\nexport function classifyExtractionThrownError(err: unknown): ExtractionFailureClass {\n  try {\n    const status = httpStatusFromError(err);\n    if (status === 401 || status === 403) return \"auth_config\";\n    if (isTransientHttpError(err)) return \"provider_retryable\";\n    return \"provider_retryable\";\n  } catch {\n    return \"provider_retryable\";\n  }\n}\n\n/**\n * Map the gateway fallback's discriminated parse-failure reason to a coarse\n * extraction failure class. \"no models configured\" is an auth/config problem;\n * an HTTP/transport failure backs off; an unparseable-but-present response is a\n * genuine empty-parse.\n */\nexport function classifyFallbackParseFailure(\n  reason: \"no_models\" | \"empty\" | \"http_error\" | \"schema_rejection\" | \"timeout\",\n): ExtractionFailureClass {\n  switch (reason) {\n    case \"no_models\":\n      return \"auth_config\";\n    case \"http_error\":\n    case \"timeout\":\n      return \"provider_retryable\";\n    case \"empty\":\n    case \"schema_rejection\":\n      return \"parse_empty\";\n  }\n}\n\n/**\n * Operator-visible extraction parse-failure line. Keeps the historical\n * greppable prefix and appends the fields that used to live only at debug.\n */\nexport function formatExtractionParseFailureLog(input: {\n  failureReason: string;\n  attemptedModel?: string;\n  httpStatus?: number;\n  errorClass?: string;\n  traceId: string;\n}): string {\n  const modelUsed =\n    typeof input.attemptedModel === \"string\" && input.attemptedModel.length > 0\n      ? input.attemptedModel\n      : \"unknown\";\n  const errorClass =\n    typeof input.errorClass === \"string\" && input.errorClass.length > 0\n      ? input.errorClass\n      : \"none\";\n  const httpStatus =\n    typeof input.httpStatus === \"number\" && Number.isFinite(input.httpStatus)\n      ? String(input.httpStatus)\n      : \"none\";\n  return [\n    \"extraction fallback returned no parsed output\",\n    `failureReason=${input.failureReason}`,\n    `modelUsed=${modelUsed}`,\n    `errorClass=${errorClass}`,\n    `httpStatus=${httpStatus}`,\n    `traceId=${input.traceId}`,\n  ].join(\" \");\n}\n"],"mappings":";;;;;AAOA,SAAS,oBAAoB,KAAkC;AAC7D,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,MAAI,YAAY,OAAO,OAAO,IAAI,WAAW,YAAY,OAAO,SAAS,IAAI,MAAM,EAAG,QAAO,IAAI;AACjG,MAAI,gBAAgB,OAAO,OAAO,IAAI,eAAe,YAAY,OAAO,SAAS,IAAI,UAAU,GAAG;AAChG,WAAO,IAAI;AAAA,EACb;AACA,SAAO;AACT;AASO,SAAS,8BAA8B,KAAsC;AAClF,MAAI;AACF,UAAM,SAAS,oBAAoB,GAAG;AACtC,QAAI,WAAW,OAAO,WAAW,IAAK,QAAO;AAC7C,QAAI,qBAAqB,GAAG,EAAG,QAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,SAAS,6BACd,QACwB;AACxB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAMO,SAAS,gCAAgC,OAMrC;AACT,QAAM,YACJ,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe,SAAS,IACtE,MAAM,iBACN;AACN,QAAM,aACJ,OAAO,MAAM,eAAe,YAAY,MAAM,WAAW,SAAS,IAC9D,MAAM,aACN;AACN,QAAM,aACJ,OAAO,MAAM,eAAe,YAAY,OAAO,SAAS,MAAM,UAAU,IACpE,OAAO,MAAM,UAAU,IACvB;AACN,SAAO;AAAA,IACL;AAAA,IACA,iBAAiB,MAAM,aAAa;AAAA,IACpC,aAAa,SAAS;AAAA,IACtB,cAAc,UAAU;AAAA,IACxB,cAAc,UAAU;AAAA,IACxB,WAAW,MAAM,OAAO;AAAA,EAC1B,EAAE,KAAK,GAAG;AACZ;","names":[]}

package/dist/{chunk-4JVQRFZD.js → chunk-PLJ2MQFT.js}

@@ -1,21 +1,21 @@
+import {
+  MeilisearchBackend
+} from "./chunk-KVO2BTA4.js";
+import {
+  NoopSearchBackend
+} from "./chunk-CYEPCZN5.js";
 import {
   OramaBackend
-} from "./chunk-TNSCIPBQ.js";
+} from "./chunk-G6NQ3L4T.js";
 import {
   RemoteSearchBackend
-} from "./chunk-YQNNHLCG.js";
+} from "./chunk-WPGR3RW4.js";
 import {
   EmbedHelper
 } from "./chunk-6KTXE6A3.js";
 import {
   LanceDbBackend
-} from "./chunk-BD7JTBYP.js";
-import {
-  MeilisearchBackend
-} from "./chunk-OB3XMWX5.js";
-import {
-  NoopSearchBackend
-} from "./chunk-CYEPCZN5.js";
+} from "./chunk-D7MAYFQP.js";
 import {
   createConversationIndexBackend
 } from "./chunk-TFA6HPOA.js";
@@ -24,7 +24,7 @@ import {
 } from "./chunk-F4TWWUMP.js";
 import {
   QmdClient
-} from "./chunk-3CBI2ZSA.js";
+} from "./chunk-KG2OOAFF.js";
 import {
   resolveIndexingCapabilities,
   resolvePipelineProcessingCapabilities,
@@ -179,4 +179,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-4JVQRFZD.js.map
+//# sourceMappingURL=chunk-PLJ2MQFT.js.map

package/dist/{chunk-4RX5O34R.js → chunk-PQ42DJNG.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-H3FZVNRN.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-6EHM2AV7.js";
+} from "./chunk-3BLHPQHT.js";
 import {
   resolvePrincipal
 } from "./chunk-MRV7VSQK.js";
@@ -798,4 +798,4 @@ var SmartBuffer = class {
 export {
   SmartBuffer
 };
-//# sourceMappingURL=chunk-4RX5O34R.js.map
+//# sourceMappingURL=chunk-PQ42DJNG.js.map

package/dist/{chunk-37CAEC7E.js → chunk-PWPIERBM.js}

@@ -1,12 +1,12 @@
 import {
   stripAttributesSuffix
 } from "./chunk-JDSVLVCG.js";
-import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
 import {
   parseIsoOffsetTimestamp
 } from "./chunk-P7FMDTKL.js";
+import {
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
 
 // src/support-passport/contracts.ts
 import { createHash } from "crypto";
@@ -400,4 +400,4 @@ export {
   hasLiveSupportPassportCard,
   projectSupportPassportCard
 };
-//# sourceMappingURL=chunk-37CAEC7E.js.map
+//# sourceMappingURL=chunk-PWPIERBM.js.map

package/dist/{chunk-ZEGL7YCC.js → chunk-Q62GA5U2.js}

@@ -1,6 +1,6 @@
 import {
   isRecallDisclosure
-} from "./chunk-IYKZJVL5.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   estimateTokenCount
 } from "./chunk-TOTT6S2V.js";
@@ -306,4 +306,4 @@ export {
   RecallXrayBuilder,
   summarizeDisclosureTokens
 };
-//# sourceMappingURL=chunk-ZEGL7YCC.js.map
+//# sourceMappingURL=chunk-Q62GA5U2.js.map

package/dist/{chunk-CC37E3QM.js → chunk-QKCXRS5A.js}

@@ -121,6 +121,18 @@ function optionalEnvelopeAt(expiresAt) {
   }
   return parsed.at;
 }
+var MAX_WRITE_EXPIRES_AT_TTL_MS = 3650 * 24 * 60 * 60 * 1e3;
+function assertBoundedFutureExpiry(expiresAt, nowMs) {
+  const expiresAtMs = Date.parse(expiresAt);
+  if (expiresAtMs <= nowMs) {
+    throw new Error("composeWriteEnvelope: expiresAt must be an instant strictly after the write time");
+  }
+  if (expiresAtMs - nowMs > MAX_WRITE_EXPIRES_AT_TTL_MS) {
+    throw new Error(
+      `composeWriteEnvelope: expiresAt exceeds the maximum TTL of ${MAX_WRITE_EXPIRES_AT_TTL_MS}ms`
+    );
+  }
+}
 function optionalEnvelopeId(supersedes) {
   if (supersedes === void 0) return void 0;
   const parsed = parseEnvelopeId(supersedes);
@@ -162,6 +174,9 @@ function requireProducer(value) {
 function composeWriteEnvelope(input) {
   const sharedBy = requireEnvelopeActor(input.origin);
   const expiresAt = optionalEnvelopeAt(input.expiresAt);
+  if (expiresAt !== void 0 && Number.isFinite(input.nowMs ?? Number.NaN)) {
+    assertBoundedFutureExpiry(expiresAt, input.nowMs);
+  }
   const supersedes = optionalEnvelopeId(input.supersedes);
   return applyDefaultEnvelope(
     { sharedBy, authority: input.authority, expiresAt, supersedes },
@@ -195,4 +210,4 @@ export {
   envelopeFromScalars,
   resolveReadAuthority
 };
-//# sourceMappingURL=chunk-CC37E3QM.js.map
+//# sourceMappingURL=chunk-QKCXRS5A.js.map

package/dist/chunk-QKCXRS5A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared-context/governance.ts","../src/shared-context/authority-precedence.ts","../src/shared-context/envelope-actor.ts","../src/shared-context/iso-instant.ts","../src/shared-context/envelope-at.ts","../src/shared-context/envelope-id.ts","../src/shared-context/envelope-io.ts"],"sourcesContent":["/**\n * Shared-item authority envelope (issue #1957).\n *\n * Pure parse/default/expiry helpers over the authority classes. Binding is\n * never inferred, and the authority token is validated exactly as supplied\n * or stored — a padded value never resolves to a privileged class.\n */\n\nexport const SHARED_AUTHORITIES = [\"informational\", \"advisory\", \"binding\"] as const;\nexport type SharedAuthority = (typeof SHARED_AUTHORITIES)[number];\n\nexport interface SharedEnvelope {\n  sharedBy?: string;\n  authority: SharedAuthority;\n  expiresAt?: string;\n  supersedes?: string;\n}\n\nexport interface SharedEnvelopeInput {\n  sharedBy?: string;\n  authority?: string;\n  expiresAt?: string;\n  supersedes?: string;\n}\n\nexport interface ApplyDefaultEnvelopeOptions {\n  binding?: boolean;\n}\n\nfunction isSharedAuthority(value: string): value is SharedAuthority {\n  return (SHARED_AUTHORITIES as readonly string[]).includes(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\ntype AuthorityToken =\n  | { kind: \"absent\" }\n  | { kind: \"invalid\"; raw: string }\n  | { kind: \"valid\"; authority: SharedAuthority };\n\n/**\n * Read the authority token EXACTLY as supplied or stored. A padded value\n * such as `\" binding \"` is malformed data, never a normalized match for a\n * privileged class: trimming first would let stored whitespace resolve as\n * binding/advisory (AGENTS.md rule 45). Only the empty string counts as\n * \"unspecified\"; whitespace-only is invalid.\n */\nfunction readExactAuthority(value: unknown): AuthorityToken {\n  if (typeof value !== \"string\" || value.length === 0) return { kind: \"absent\" };\n  if (!isSharedAuthority(value)) return { kind: \"invalid\", raw: value };\n  return { kind: \"valid\", authority: value };\n}\n\nfunction withOptionalFields(\n  authority: SharedAuthority,\n  source: { sharedBy?: unknown; expiresAt?: unknown; supersedes?: unknown },\n): SharedEnvelope {\n  const envelope: SharedEnvelope = { authority };\n  const sharedBy = optionalString(source.sharedBy);\n  const expiresAt = optionalString(source.expiresAt);\n  const supersedes = optionalString(source.supersedes);\n  if (sharedBy) envelope.sharedBy = sharedBy;\n  if (expiresAt) envelope.expiresAt = expiresAt;\n  if (supersedes) envelope.supersedes = supersedes;\n  return envelope;\n}\n\nexport function applyDefaultEnvelope(\n  input: SharedEnvelopeInput = {},\n  options: ApplyDefaultEnvelopeOptions = {},\n): SharedEnvelope {\n  const requested = readExactAuthority(input.authority);\n  if (requested.kind === \"invalid\") {\n    throw new Error(\n      `applyDefaultEnvelope: authority must be informational, advisory, or binding; got ${JSON.stringify(requested.raw)}`,\n    );\n  }\n  if (requested.kind === \"valid\" && requested.authority === \"binding\" && options.binding !== true) {\n    throw new Error(\"applyDefaultEnvelope: authority \\\"binding\\\" requires an explicit binding flag\");\n  }\n  return withOptionalFields(requested.kind === \"valid\" ? requested.authority : \"informational\", input);\n}\n\nexport function parseSharedEnvelope(raw: unknown): SharedEnvelope {\n  if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n    return { authority: \"informational\" };\n  }\n  const record = raw as Record<string, unknown>;\n  const requested = readExactAuthority(record.authority);\n  const authority = requested.kind === \"valid\" ? requested.authority : \"informational\";\n  return withOptionalFields(authority, record);\n}\n\nexport function isExpired(envelope: Pick<SharedEnvelope, \"expiresAt\">, nowMs: number): boolean {\n  if (!Number.isFinite(nowMs)) return false;\n  const expiresAt = envelope.expiresAt?.trim();\n  if (!expiresAt) return false;\n  const expiresAtMs = Date.parse(expiresAt);\n  if (!Number.isFinite(expiresAtMs)) return false;\n  return expiresAtMs <= nowMs;\n}\n","/**\n * Shared-item authority precedence (issue #1957).\n *\n * Pure helpers over the authority classes owned by `governance.ts`\n * (`SHARED_AUTHORITIES`). Resolution is least-privilege: an absent,\n * malformed, or unrecognized authority never resolves above\n * `informational`, and `binding` additionally requires the explicit\n * `allowBinding` flag. The helpers are exported for callers; wiring them\n * into the shared-context read and write paths is a later slice.\n */\n\nimport { SHARED_AUTHORITIES, type SharedAuthority } from \"./governance.js\";\n\nexport { SHARED_AUTHORITIES as SHARED_AUTHORITY_CLASSES };\nexport type { SharedAuthority as SharedAuthorityClass };\n\nexport interface ResolveSharedAuthorityInput {\n  /** Raw authority value from an item's envelope, if any. */\n  authority?: unknown;\n  /** Explicit opt-in required before \"binding\" is honored. */\n  allowBinding?: boolean;\n}\n\nconst AUTHORITY_RANK: Readonly<Record<SharedAuthority, number>> = {\n  informational: 0,\n  advisory: 1,\n  binding: 2,\n};\n\nfunction isKnownAuthority(value: string): value is SharedAuthority {\n  return (SHARED_AUTHORITIES as readonly string[]).includes(value);\n}\n\n\nexport function resolveSharedAuthority(input: ResolveSharedAuthorityInput): SharedAuthority {\n  // Read the security switch ONCE. A getter (or a Proxy) can return undefined\n  // during validation and true at the decision, which would let binding\n  // through without a validated opt-in.\n  const allowBinding = input.allowBinding;\n  if (allowBinding !== undefined && typeof allowBinding !== \"boolean\") {\n    // The flag is the security switch, so a truthy string or number must\n    // not enable binding: reject it instead of coercing.\n    throw new TypeError(\n      `resolveSharedAuthority: allowBinding must be a boolean when supplied, got ${typeof allowBinding}`,\n    );\n  }\n  const authority = input.authority;\n  // Absent (missing key, undefined, null) and present-but-invalid both land\n  // on informational — the least-privileged class — so an unmarked or\n  // malformed legacy item can never be treated as binding. Validate the\n  // exact value: no trim, no case-fold, because \" binding\" and \"BINDING\"\n  // are unrecognized data, not normalized matches for a known class.\n  if (typeof authority !== \"string\") return \"informational\";\n  if (!isKnownAuthority(authority)) return \"informational\";\n  if (authority === \"binding\" && allowBinding !== true) {\n    // Downgrade rather than throw: a legacy item already carrying \"binding\"\n    // is stored data, not a caller bug, so it resolves to the highest class\n    // that does not require the explicit opt-in.\n    return \"advisory\";\n  }\n  return authority;\n}\n\nexport function compareSharedAuthority(a: string, b: string): number {\n  const rankA = isKnownAuthority(a) ? AUTHORITY_RANK[a] : AUTHORITY_RANK.informational;\n  const rankB = isKnownAuthority(b) ? AUTHORITY_RANK[b] : AUTHORITY_RANK.informational;\n  return Math.sign(rankA - rankB);\n}\n","/**\n * Shared-item envelope actor parse (issue #1957 leftover).\n *\n * Pure. Empty is missing_actor. Newline is invalid_actor.\n */\n\nexport type ParseEnvelopeActorResult =\n  | { ok: true; actor: string }\n  | { ok: false; error: \"missing_actor\" | \"invalid_actor\" };\n\nexport function parseEnvelopeActor(value: string): ParseEnvelopeActorResult {\n  const actor = value.trim();\n  if (actor.length === 0) return { ok: false, error: \"missing_actor\" };\n  if (actor.includes(\"\\n\")) return { ok: false, error: \"invalid_actor\" };\n  return { ok: true, actor };\n}\n","/**\n * Strict ISO-8601 instant validation for shared-context envelopes\n * (issue #1957 review round 3).\n *\n * `Date.parse` is permissive: under the supported Node runtime it reads\n * `\"2026-02-30\"` as March 2 and `\"1\"` as January 1 2001. A caller-supplied\n * expiry would therefore be silently reinterpreted into a governance deadline\n * the caller never asked for. Validate the ISO shape AND the calendar\n * components against the exact input, and reject rather than normalize.\n *\n * Extracted from `provenance.ts` so the envelope write path and the\n * provenance stamp share one validator instead of two copies.\n */\n\n// Linear ISO instant. No nested quantifiers.\nconst ISO_INSTANT =\n  /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$/;\n\n/**\n * True only for a calendar-valid ISO-8601 instant carrying an explicit zone.\n * Non-strings and non-finite parses are rejected explicitly, never coerced.\n */\nexport function isStrictIsoInstant(value: unknown): boolean {\n  if (typeof value !== \"string\") return false;\n  const match = ISO_INSTANT.exec(value);\n  if (!match) return false;\n  const year = Number(match[1]);\n  const month = Number(match[2]);\n  const day = Number(match[3]);\n  const hour = Number(match[4]);\n  const minute = Number(match[5]);\n  const second = Number(match[6]);\n  const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));\n  return (\n    Number.isFinite(Date.parse(value)) &&\n    utc.getUTCFullYear() === year &&\n    utc.getUTCMonth() === month - 1 &&\n    utc.getUTCDate() === day &&\n    utc.getUTCHours() === hour &&\n    utc.getUTCMinutes() === minute &&\n    utc.getUTCSeconds() === second\n  );\n}\n","/**\n * Shared-item envelope at parse (issue #1957 leftover).\n *\n * Pure. Blank is missing_at. Anything that is not a calendar-valid ISO-8601\n * instant is invalid_at — including values permissive `Date.parse` would\n * silently reinterpret (`\"2026-02-30\"` -> March 2, `\"1\"` -> January 1 2001),\n * a whitespace-padded timestamp, and any non-string or non-finite input\n * (review round 3). `trim()` only detects blankness; validation reads the\n * exact value, so normalization can never widen what passes.\n */\n\nimport { isStrictIsoInstant } from \"./iso-instant.js\";\n\nexport type ParseEnvelopeAtResult =\n  | { ok: true; at: string }\n  | { ok: false; error: \"missing_at\" | \"invalid_at\" };\n\nexport function parseEnvelopeAt(value: string): ParseEnvelopeAtResult {\n  if (typeof value !== \"string\") return { ok: false, error: \"invalid_at\" };\n  if (value.trim().length === 0) return { ok: false, error: \"missing_at\" };\n  if (!isStrictIsoInstant(value)) return { ok: false, error: \"invalid_at\" };\n  return { ok: true, at: new Date(Date.parse(value)).toISOString() };\n}\n","/**\n * Shared-item envelope id parse (issue #1957 leftover).\n *\n * Pure. Empty is missing_id. Newline is invalid_id.\n */\n\nexport type ParseEnvelopeIdResult =\n  | { ok: true; id: string }\n  | { ok: false; error: \"missing_id\" | \"invalid_id\" };\n\nexport function parseEnvelopeId(value: string): ParseEnvelopeIdResult {\n  const id = value.trim();\n  if (id.length === 0) return { ok: false, error: \"missing_id\" };\n  if (id.includes(\"\\n\")) return { ok: false, error: \"invalid_id\" };\n  return { ok: true, id };\n}\n","/**\n * Shared-item envelope wiring (issue #1957, control 1: origin + authority).\n *\n * Bridges the pure envelope helpers onto the markdown frontmatter the\n * shared-context manager reads and writes.\n *\n * Write side rejects invalid input (an unrecognized authority or a binding\n * request without the config opt-in throws — never silently reinterpreted).\n * Read side resolves least privilege: a missing, malformed, or unrecognized\n * authority never resolves above informational, and stored binding\n * downgrades to advisory unless config opted in.\n */\n\nimport { applyDefaultEnvelope, parseSharedEnvelope, type SharedEnvelope } from \"./governance.js\";\nimport { resolveSharedAuthority } from \"./authority-precedence.js\";\nimport type { SharedAuthority } from \"./governance.js\";\nimport { parseEnvelopeActor } from \"./envelope-actor.js\";\nimport { parseEnvelopeAt } from \"./envelope-at.js\";\nimport { parseEnvelopeId } from \"./envelope-id.js\";\n\nexport interface ComposeWriteEnvelopeInput {\n  /** Governance origin. Becomes the envelope's `sharedBy`. */\n  origin: string;\n  /** Requested authority class. Unrecognized values throw. */\n  authority?: string;\n  /** Optional ISO-8601 expiry. Invalid timestamps throw. */\n  expiresAt?: string;\n  /** Optional id of the item this one supersedes. */\n  supersedes?: string;\n  /** Config opt-in (`sharedContextAllowBindingAuthority`). Binding throws without it. */\n  allowBinding: boolean;\n  /**\n   * Write instant for the expiry TTL policy (issue #2920). When finite, an\n   * `expiresAt` must land strictly after it and within the maximum TTL —\n   * a past or effectively-immortal expiry is a client input error, never a\n   * silently accepted stamp.\n   */\n  nowMs?: number;\n}\n\nfunction requireEnvelopeActor(agentId: string): string {\n  const parsed = parseEnvelopeActor(agentId);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: agentId must be a non-blank single-line string (${parsed.error})`);\n  }\n  return parsed.actor;\n}\n\nfunction optionalEnvelopeAt(expiresAt: string | undefined): string | undefined {\n  if (expiresAt === undefined) return undefined;\n  const parsed = parseEnvelopeAt(expiresAt);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: expiresAt must be a valid ISO-8601 timestamp (${parsed.error})`);\n  }\n  return parsed.at;\n}\n\n/** Maximum write-side TTL: 10 years. A farther `expiresAt` is rejected. */\nexport const MAX_WRITE_EXPIRES_AT_TTL_MS = 3650 * 24 * 60 * 60 * 1000;\n\nfunction assertBoundedFutureExpiry(expiresAt: string, nowMs: number): void {\n  const expiresAtMs = Date.parse(expiresAt);\n  if (expiresAtMs <= nowMs) {\n    throw new Error(\"composeWriteEnvelope: expiresAt must be an instant strictly after the write time\");\n  }\n  if (expiresAtMs - nowMs > MAX_WRITE_EXPIRES_AT_TTL_MS) {\n    throw new Error(\n      `composeWriteEnvelope: expiresAt exceeds the maximum TTL of ${MAX_WRITE_EXPIRES_AT_TTL_MS}ms`,\n    );\n  }\n}\n\nfunction optionalEnvelopeId(supersedes: string | undefined): string | undefined {\n  if (supersedes === undefined) return undefined;\n  const parsed = parseEnvelopeId(supersedes);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: supersedes must be a non-blank single-line id (${parsed.error})`);\n  }\n  return parsed.id;\n}\n\n/**\n * Reserved governance origin for an authenticated external access write that\n * resolved no principal (`agentAccessHttp.principal` unset, no adapter\n * identity). Server-owned: the caller cannot mint or influence it, and the\n * caller-supplied `agentId` never becomes audit metadata on that path.\n */\nexport const UNATTRIBUTED_ACCESS_WRITE_ORIGIN = \"unattributed:access-surface\";\n\nexport interface ResolvedWriteIdentity {\n  /**\n   * Producer identity: frontmatter `agent`, on-disk segment, and the\n   * cross-signals grouping key. Self-declared by the caller only on\n   * surfaces that resolved no server identity; never decides authority.\n   */\n  agent: string;\n  /** Governance origin stamped as the envelope's `sharedBy`. */\n  origin: string;\n}\n\n/**\n * Resolve the producer identity and governance origin for a shared-context\n * write. They are different fields with different trust requirements:\n *\n * - The origin (`sharedBy`) is audit metadata and is always server-derived.\n *   When the surface resolved an authenticated identity, that identity IS the\n *   origin; when it resolved none but the write crosses an external\n *   boundary, the caller-supplied `unattributedOrigin` token is stamped\n *   instead — never the caller's value. Only a trusted in-process caller\n *   (no identity, no token) may stamp its own id as the origin.\n * - The producer (`agent`) drives grouping and display only. When an\n *   authenticated identity exists it is also the producer, and a\n *   caller-supplied `agentId` naming a different agent is REJECTED, so a\n *   caller can never publish an item attributed to another agent. Without a\n *   server identity the caller's label stands as the producer — collapsing\n *   it instead would merge every writer into one agent and erase\n *   multi-agent overlaps from `synthesizeCrossSignals`.\n */\nexport function resolveWriteOrigin(input: {\n  agentId: string;\n  authenticatedIdentity?: string;\n  unattributedOrigin?: string;\n}): ResolvedWriteIdentity {\n  const identity = input.authenticatedIdentity?.trim() ?? \"\";\n  if (identity.length > 0) {\n    const requested = input.agentId.trim();\n    if (requested.length > 0 && requested !== identity) {\n      throw new Error(\n        `shared-context write origin mismatch: authenticated identity ${JSON.stringify(identity)} cannot publish as ${JSON.stringify(requested)}`,\n      );\n    }\n    return { agent: identity, origin: identity };\n  }\n  const unattributed = input.unattributedOrigin?.trim() ?? \"\";\n  if (unattributed.length > 0) {\n    const label = input.agentId.trim();\n    return {\n      agent: label.length > 0 ? requireProducer(label) : requireProducer(unattributed),\n      origin: requireProducer(unattributed),\n    };\n  }\n  const actor = requireProducer(input.agentId);\n  return { agent: actor, origin: actor };\n}\n\nfunction requireProducer(value: string): string {\n  const parsed = parseEnvelopeActor(value);\n  if (!parsed.ok) {\n    throw new Error(`shared-context write producer must be a non-blank single-line string (${parsed.error})`);\n  }\n  return parsed.actor;\n}\n\n/**\n * Validate and compose the envelope for a shared-context write.\n * `sharedBy` is stamped from the server-derived origin — provenance is\n * never injected through item content or the caller's producer label.\n */\nexport function composeWriteEnvelope(input: ComposeWriteEnvelopeInput): SharedEnvelope {\n  const sharedBy = requireEnvelopeActor(input.origin);\n  const expiresAt = optionalEnvelopeAt(input.expiresAt);\n  if (expiresAt !== undefined && Number.isFinite(input.nowMs ?? Number.NaN)) {\n    assertBoundedFutureExpiry(expiresAt, input.nowMs as number);\n  }\n  const supersedes = optionalEnvelopeId(input.supersedes);\n  return applyDefaultEnvelope(\n    { sharedBy, authority: input.authority, expiresAt, supersedes },\n    { binding: input.allowBinding },\n  );\n}\n\n/** Serialize an envelope into frontmatter lines (caller adds the `---` fences). */\nexport function envelopeToFrontmatterLines(envelope: SharedEnvelope): string[] {\n  const line = (key: string, value: string) => `${key}: ${JSON.stringify(value)}`;\n  const lines = [line(\"sharedBy\", envelope.sharedBy ?? \"\"), line(\"authority\", envelope.authority)];\n  if (envelope.expiresAt !== undefined) lines.push(line(\"expiresAt\", envelope.expiresAt));\n  if (envelope.supersedes !== undefined) lines.push(line(\"supersedes\", envelope.supersedes));\n  return lines;\n}\n\n/**\n * Build an envelope from frontmatter scalars already read off a stored item.\n * Missing scalars (legacy items) compose to informational with no expiry.\n */\nexport function envelopeFromScalars(scalars: {\n  sharedBy: string | null;\n  authority: string | null;\n  expiresAt: string | null;\n  supersedes: string | null;\n}): SharedEnvelope {\n  const record: Record<string, string> = {};\n  if (scalars.sharedBy !== null) record.sharedBy = scalars.sharedBy;\n  if (scalars.authority !== null) record.authority = scalars.authority;\n  if (scalars.expiresAt !== null) record.expiresAt = scalars.expiresAt;\n  if (scalars.supersedes !== null) record.supersedes = scalars.supersedes;\n  return parseSharedEnvelope(record);\n}\n\n/**\n * Resolve a stored envelope's authority for read-side consumption.\n * Least privilege: unrecognized/missing stays informational; binding\n * requires the config opt-in or downgrades to advisory.\n */\nexport function resolveReadAuthority(\n  envelope: Pick<SharedEnvelope, \"authority\">,\n  allowBinding: boolean,\n): SharedAuthority {\n  return resolveSharedAuthority({ authority: envelope.authority, allowBinding });\n}\n"],"mappings":";AAQO,IAAM,qBAAqB,CAAC,iBAAiB,YAAY,SAAS;AAqBzE,SAAS,kBAAkB,OAAyC;AAClE,SAAQ,mBAAyC,SAAS,KAAK;AACjE;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAcA,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO,EAAE,MAAM,SAAS;AAC7E,MAAI,CAAC,kBAAkB,KAAK,EAAG,QAAO,EAAE,MAAM,WAAW,KAAK,MAAM;AACpE,SAAO,EAAE,MAAM,SAAS,WAAW,MAAM;AAC3C;AAEA,SAAS,mBACP,WACA,QACgB;AAChB,QAAM,WAA2B,EAAE,UAAU;AAC7C,QAAM,WAAW,eAAe,OAAO,QAAQ;AAC/C,QAAM,YAAY,eAAe,OAAO,SAAS;AACjD,QAAM,aAAa,eAAe,OAAO,UAAU;AACnD,MAAI,SAAU,UAAS,WAAW;AAClC,MAAI,UAAW,UAAS,YAAY;AACpC,MAAI,WAAY,UAAS,aAAa;AACtC,SAAO;AACT;AAEO,SAAS,qBACd,QAA6B,CAAC,GAC9B,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,MAAI,UAAU,SAAS,WAAW;AAChC,UAAM,IAAI;AAAA,MACR,oFAAoF,KAAK,UAAU,UAAU,GAAG,CAAC;AAAA,IACnH;AAAA,EACF;AACA,MAAI,UAAU,SAAS,WAAW,UAAU,cAAc,aAAa,QAAQ,YAAY,MAAM;AAC/F,UAAM,IAAI,MAAM,6EAA+E;AAAA,EACjG;AACA,SAAO,mBAAmB,UAAU,SAAS,UAAU,UAAU,YAAY,iBAAiB,KAAK;AACrG;AAEO,SAAS,oBAAoB,KAA8B;AAChE,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,WAAO,EAAE,WAAW,gBAAgB;AAAA,EACtC;AACA,QAAM,SAAS;AACf,QAAM,YAAY,mBAAmB,OAAO,SAAS;AACrD,QAAM,YAAY,UAAU,SAAS,UAAU,UAAU,YAAY;AACrE,SAAO,mBAAmB,WAAW,MAAM;AAC7C;;;AClEA,SAAS,iBAAiB,OAAyC;AACjE,SAAQ,mBAAyC,SAAS,KAAK;AACjE;AAGO,SAAS,uBAAuB,OAAqD;AAI1F,QAAM,eAAe,MAAM;AAC3B,MAAI,iBAAiB,UAAa,OAAO,iBAAiB,WAAW;AAGnE,UAAM,IAAI;AAAA,MACR,6EAA6E,OAAO,YAAY;AAAA,IAClG;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAMxB,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,MAAI,CAAC,iBAAiB,SAAS,EAAG,QAAO;AACzC,MAAI,cAAc,aAAa,iBAAiB,MAAM;AAIpD,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACnDO,SAAS,mBAAmB,OAAyC;AAC1E,QAAM,QAAQ,MAAM,KAAK;AACzB,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AACnE,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AACrE,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;;;ACAA,IAAM,cACJ;AAMK,SAAS,mBAAmB,OAAyB;AAC1D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,MAAM,IAAI,KAAK,KAAK,IAAI,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,MAAM,CAAC;AACzE,SACE,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,KACjC,IAAI,eAAe,MAAM,QACzB,IAAI,YAAY,MAAM,QAAQ,KAC9B,IAAI,WAAW,MAAM,OACrB,IAAI,YAAY,MAAM,QACtB,IAAI,cAAc,MAAM,UACxB,IAAI,cAAc,MAAM;AAE5B;;;ACzBO,SAAS,gBAAgB,OAAsC;AACpE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACvE,MAAI,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACvE,MAAI,CAAC,mBAAmB,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACxE,SAAO,EAAE,IAAI,MAAM,IAAI,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,YAAY,EAAE;AACnE;;;ACZO,SAAS,gBAAgB,OAAsC;AACpE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,GAAG,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAC7D,MAAI,GAAG,SAAS,IAAI,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAC/D,SAAO,EAAE,IAAI,MAAM,GAAG;AACxB;;;ACyBA,SAAS,qBAAqB,SAAyB;AACrD,QAAM,SAAS,mBAAmB,OAAO;AACzC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,yEAAyE,OAAO,KAAK,GAAG;AAAA,EAC1G;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,WAAmD;AAC7E,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,SAAS,gBAAgB,SAAS;AACxC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,uEAAuE,OAAO,KAAK,GAAG;AAAA,EACxG;AACA,SAAO,OAAO;AAChB;AAGO,IAAM,8BAA8B,OAAO,KAAK,KAAK,KAAK;AAEjE,SAAS,0BAA0B,WAAmB,OAAqB;AACzE,QAAM,cAAc,KAAK,MAAM,SAAS;AACxC,MAAI,eAAe,OAAO;AACxB,UAAM,IAAI,MAAM,kFAAkF;AAAA,EACpG;AACA,MAAI,cAAc,QAAQ,6BAA6B;AACrD,UAAM,IAAI;AAAA,MACR,8DAA8D,2BAA2B;AAAA,IAC3F;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,YAAoD;AAC9E,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,wEAAwE,OAAO,KAAK,GAAG;AAAA,EACzG;AACA,SAAO,OAAO;AAChB;AAQO,IAAM,mCAAmC;AA+BzC,SAAS,mBAAmB,OAIT;AACxB,QAAM,WAAW,MAAM,uBAAuB,KAAK,KAAK;AACxD,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,YAAY,MAAM,QAAQ,KAAK;AACrC,QAAI,UAAU,SAAS,KAAK,cAAc,UAAU;AAClD,YAAM,IAAI;AAAA,QACR,gEAAgE,KAAK,UAAU,QAAQ,CAAC,sBAAsB,KAAK,UAAU,SAAS,CAAC;AAAA,MACzI;AAAA,IACF;AACA,WAAO,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,EAC7C;AACA,QAAM,eAAe,MAAM,oBAAoB,KAAK,KAAK;AACzD,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,QAAQ,MAAM,QAAQ,KAAK;AACjC,WAAO;AAAA,MACL,OAAO,MAAM,SAAS,IAAI,gBAAgB,KAAK,IAAI,gBAAgB,YAAY;AAAA,MAC/E,QAAQ,gBAAgB,YAAY;AAAA,IACtC;AAAA,EACF;AACA,QAAM,QAAQ,gBAAgB,MAAM,OAAO;AAC3C,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM;AACvC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,yEAAyE,OAAO,KAAK,GAAG;AAAA,EAC1G;AACA,SAAO,OAAO;AAChB;AAOO,SAAS,qBAAqB,OAAkD;AACrF,QAAM,WAAW,qBAAqB,MAAM,MAAM;AAClD,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,MAAI,cAAc,UAAa,OAAO,SAAS,MAAM,SAAS,OAAO,GAAG,GAAG;AACzE,8BAA0B,WAAW,MAAM,KAAe;AAAA,EAC5D;AACA,QAAM,aAAa,mBAAmB,MAAM,UAAU;AACtD,SAAO;AAAA,IACL,EAAE,UAAU,WAAW,MAAM,WAAW,WAAW,WAAW;AAAA,IAC9D,EAAE,SAAS,MAAM,aAAa;AAAA,EAChC;AACF;AAGO,SAAS,2BAA2B,UAAoC;AAC7E,QAAM,OAAO,CAAC,KAAa,UAAkB,GAAG,GAAG,KAAK,KAAK,UAAU,KAAK,CAAC;AAC7E,QAAM,QAAQ,CAAC,KAAK,YAAY,SAAS,YAAY,EAAE,GAAG,KAAK,aAAa,SAAS,SAAS,CAAC;AAC/F,MAAI,SAAS,cAAc,OAAW,OAAM,KAAK,KAAK,aAAa,SAAS,SAAS,CAAC;AACtF,MAAI,SAAS,eAAe,OAAW,OAAM,KAAK,KAAK,cAAc,SAAS,UAAU,CAAC;AACzF,SAAO;AACT;AAMO,SAAS,oBAAoB,SAKjB;AACjB,QAAM,SAAiC,CAAC;AACxC,MAAI,QAAQ,aAAa,KAAM,QAAO,WAAW,QAAQ;AACzD,MAAI,QAAQ,cAAc,KAAM,QAAO,YAAY,QAAQ;AAC3D,MAAI,QAAQ,cAAc,KAAM,QAAO,YAAY,QAAQ;AAC3D,MAAI,QAAQ,eAAe,KAAM,QAAO,aAAa,QAAQ;AAC7D,SAAO,oBAAoB,MAAM;AACnC;AAOO,SAAS,qBACd,UACA,cACiB;AACjB,SAAO,uBAAuB,EAAE,WAAW,SAAS,WAAW,aAAa,CAAC;AAC/E;","names":[]}

package/dist/{chunk-WKDFJXW5.js → chunk-QM2SPLKQ.js}

@@ -155,4 +155,4 @@ export {
   probeFetch,
   SingleFlightProbe
 };
-//# sourceMappingURL=chunk-WKDFJXW5.js.map
+//# sourceMappingURL=chunk-QM2SPLKQ.js.map

package/dist/chunk-QM2SPLKQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/local-llm-helpers.ts"],"sourcesContent":["import { log } from \"./logger.js\";\nimport type { LocalLlmRequestPriority } from \"./local-llm.js\";\n\nexport interface LocalLlmChatCompletionOptions {\n  temperature?: number;\n  maxTokens?: number;\n  responseFormat?: { type: string };\n  timeoutMs?: number;\n  operation?: string;\n  forceDisableThinking?: boolean;\n  disableThinking?: boolean;\n  priority?: LocalLlmRequestPriority;\n  signal?: AbortSignal;\n  redactProviderErrors?: boolean;\n  /** Per-request model; defaults to config.localLlmModel. */\n  model?: string;\n  /**\n   * Optional out-box for the terminal failure cause (issue #2891): on a\n   * failed request the client records the last provider error here so\n   * callers can classify it (e.g. HTTP 429 → rate-limited) in memory\n   * instead of seeing only null. Never logged.\n   */\n  failureDiag?: { lastError?: unknown };\n}\n\nexport interface LocalLlmChatCompletionResult {\n  content: string;\n  usage?: { promptTokens: number; completionTokens: number; totalTokens: number };\n}\nexport function isAbortError(err: unknown): boolean {\n  if (!err || typeof err !== \"object\") return false;\n  const maybe = err as { name?: string; message?: string };\n  return (\n    maybe.name === \"AbortError\" ||\n    maybe.message === \"This operation was aborted\" ||\n    maybe.message === \"The operation was aborted\"\n  );\n}\n\nexport function waitForRetryBackoff(backoffMs: number, signal?: AbortSignal): Promise<boolean> {\n  return new Promise((resolve) => {\n    let settled = false;\n    let timer: NodeJS.Timeout | undefined;\n    const onAbort = (): void => {\n      if (settled) return;\n      settled = true;\n      if (timer) clearTimeout(timer);\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve(false);\n    };\n    const onTimer = (): void => {\n      if (settled) return;\n      settled = true;\n      signal?.removeEventListener(\"abort\", onAbort);\n      resolve(true);\n    };\n    timer = setTimeout(onTimer, backoffMs);\n    if (signal) {\n      if (signal.aborted) onAbort();\n      else signal.addEventListener(\"abort\", onAbort, { once: true });\n    }\n  });\n}\n\nexport function normalizeBackendTripReason(reason: string): string {\n  const cleaned = reason.replace(/\\s+/g, \" \").replace(/^[-:–—\\s]+/, \"\").trim();\n  if (!cleaned) return \"unknown local backend failure\";\n  return cleaned.length > 160 ? `${cleaned.slice(0, 157)}...` : cleaned;\n}\n\nexport function extractNonRecoverableBackendReason(reason: string): string | null {\n  const match = reason.match(\n    /Failed to load model|Library not loaded|different Team IDs|code signature|llm_engine_mlx_amphibian/i,\n  );\n  return match?.[0] ?? null;\n}\n\nexport function extractNonRecoverableBackendReasonFromErrorText(errorText: string): string | null {\n  const directReason = extractNonRecoverableBackendReason(errorText);\n  if (directReason) return directReason;\n  try {\n    const parsed = JSON.parse(errorText) as { error?: { message?: string } };\n    return extractNonRecoverableBackendReason(parsed?.error?.message ?? \"\");\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Flatten a fetch rejection into one line, including the `cause` undici hides\n * the real reason behind (`fetch failed` alone says nothing).\n */\nexport function describeFetchFailure(err: unknown): string {\n  const name = err instanceof Error ? err.name : \"\";\n  const message = err instanceof Error ? err.message : String(err);\n  const cause: unknown = err instanceof Error ? (err as Error & { cause?: unknown }).cause : undefined;\n  const causeText = cause instanceof Error\n    ? ` (cause: ${cause.name}: ${cause.message}${\n      typeof (cause as Error & { code?: unknown }).code === \"string\"\n        ? ` [${String((cause as Error & { code?: unknown }).code)}]`\n        : \"\"\n    })`\n    : cause === undefined\n      ? \"\"\n      : ` (cause: ${String(cause)})`;\n  return `${name ? `${name}: ` : \"\"}${message}${causeText}`;\n}\n\n/**\n * What to record when every availability probe failed.\n *\n * A probe that TIMED OUT is not evidence the backend is down: the budget is a\n * fixed 2s and a busy event loop can burn it before the socket is scheduled,\n * so the backend looks dead while it answers other callers in single-digit ms.\n * Caching that verdict took extraction offline for a whole health-check\n * interval at a time (issue #2210), so a timeout leaves availability UNKNOWN —\n * this call fails, the next one re-probes instead of reading a stale false.\n *\n * A backend that ANSWERED and said no is a real verdict and stays cached, or\n * the daemon re-probes a known-bad endpoint on every request.\n */\nexport function resolveUnavailableVerdict(args: {\n  baseUrl: string;\n  sawAbortedProbe: boolean;\n  wasAvailable: boolean | null;\n}): { cacheVerdict: boolean; warning: string | null } {\n  if (args.sawAbortedProbe) {\n    return {\n      cacheVerdict: false,\n      warning:\n        `local LLM availability probe timed out at ${args.baseUrl} (event loop busy?); treating availability as ` +\n        \"unknown and re-probing on the next request rather than marking the backend down\",\n    };\n  }\n  return {\n    cacheVerdict: true,\n    // Surfaced at warn, not debug: extraction stops silently when this flips,\n    // and the daemon emits no debug at all unless configured for it.\n    warning: args.wasAvailable !== false ? `local LLM became unavailable at ${args.baseUrl}` : null,\n  };\n}\n\nexport interface ProbeFetchResult {\n  ok: boolean;\n  data: unknown;\n  status: number | null;\n  /** The probe hit its own budget rather than getting an answer. */\n  aborted?: boolean;\n}\n\n/**\n * One health-probe request.\n *\n * Every failure is logged with its cause: a transport error and a 404 both\n * returned `ok: false` with nothing recorded, so an unreachable backend was\n * indistinguishable from a wrong path and an availability failure had no\n * diagnosable reason at all (§22, issue #2210).\n */\nexport async function probeFetch(\n  url: string,\n  options: { timeoutMs: number; headers: Record<string, string>; signal?: AbortSignal },\n): Promise<ProbeFetchResult> {\n  const controller = new AbortController();\n  const requestSignal = options.signal\n    ? AbortSignal.any([options.signal, controller.signal])\n    : controller.signal;\n  const timeout = setTimeout(() => controller.abort(), options.timeoutMs);\n  try {\n    const response = await fetch(url, { signal: requestSignal, headers: options.headers });\n    clearTimeout(timeout);\n    if (!response.ok) {\n      log.debug(`local LLM probe: ${url} returned HTTP ${response.status}`);\n      return { ok: false, data: null, status: response.status };\n    }\n    const contentType = response.headers.get(\"content-type\");\n    const data = contentType?.includes(\"application/json\") ? await response.json() : await response.text();\n    return { ok: true, data, status: response.status };\n  } catch (err) {\n    clearTimeout(timeout);\n    const aborted = isAbortError(err);\n    log.debug(\n      `local LLM probe: ${url} ${aborted ? `timed out after ${options.timeoutMs}ms` : \"failed\"}: ${describeFetchFailure(err)}`,\n    );\n    return { ok: false, data: null, status: null, aborted };\n  }\n}\n\ninterface PendingProbe {\n  promise: Promise<boolean>;\n  controller: AbortController;\n  /** Callers still awaiting this sequence; at zero the sequence is aborted. */\n  waiters: number;\n}\n\n/**\n * Collapses concurrent probe sequences onto one in-flight run.\n *\n * A timed-out availability probe deliberately caches nothing (issue #2210),\n * which removed the false verdict that used to absorb concurrent callers:\n * every queued request would then run its own full probe sequence, on a host\n * already slow enough to blow the probe budget.\n *\n * Cancellation is refcounted rather than shared: one caller walking away must\n * not abort a sequence the others are still waiting on, so the underlying task\n * is aborted only once every waiter has gone.\n */\nexport class SingleFlightProbe {\n  private pending: PendingProbe | null = null;\n\n  run(task: (signal: AbortSignal) => Promise<boolean>, signal?: AbortSignal): Promise<boolean> {\n    let active = this.pending;\n    if (!active) {\n      const controller = new AbortController();\n      const created: PendingProbe = { promise: Promise.resolve(false), controller, waiters: 0 };\n      created.promise = task(controller.signal).finally(() => {\n        if (this.pending === created) this.pending = null;\n      });\n      this.pending = created;\n      active = created;\n    }\n    const entry = active;\n    entry.waiters += 1;\n    let released = false;\n    const release = () => {\n      if (released) return;\n      released = true;\n      entry.waiters -= 1;\n      if (entry.waiters > 0) return;\n      // Detach BEFORE aborting. `pending` would otherwise still point at this\n      // doomed entry until the task's own `finally` runs a microtask later, and\n      // a caller arriving in that window would join an aborted sequence and\n      // read its `false` as a verdict.\n      if (this.pending === entry) this.pending = null;\n      entry.controller.abort();\n    };\n    if (!signal) return entry.promise.finally(release);\n    return new Promise<boolean>((resolve, reject) => {\n      const onAbort = () => {\n        release();\n        resolve(false);\n      };\n      signal.addEventListener(\"abort\", onAbort, { once: true });\n      entry.promise.then(\n        (value) => {\n          signal.removeEventListener(\"abort\", onAbort);\n          release();\n          resolve(value);\n        },\n        (err: unknown) => {\n          signal.removeEventListener(\"abort\", onAbort);\n          release();\n          reject(err instanceof Error ? err : new Error(String(err)));\n        },\n      );\n    });\n  }\n}\n"],"mappings":";;;;;AA6BO,SAAS,aAAa,KAAuB;AAClD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,QAAQ;AACd,SACE,MAAM,SAAS,gBACf,MAAM,YAAY,gCAClB,MAAM,YAAY;AAEtB;AAEO,SAAS,oBAAoB,WAAmB,QAAwC;AAC7F,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,QAAI,UAAU;AACd,QAAI;AACJ,UAAM,UAAU,MAAY;AAC1B,UAAI,QAAS;AACb,gBAAU;AACV,UAAI,MAAO,cAAa,KAAK;AAC7B,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ,KAAK;AAAA,IACf;AACA,UAAM,UAAU,MAAY;AAC1B,UAAI,QAAS;AACb,gBAAU;AACV,cAAQ,oBAAoB,SAAS,OAAO;AAC5C,cAAQ,IAAI;AAAA,IACd;AACA,YAAQ,WAAW,SAAS,SAAS;AACrC,QAAI,QAAQ;AACV,UAAI,OAAO,QAAS,SAAQ;AAAA,UACvB,QAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,IAC/D;AAAA,EACF,CAAC;AACH;AAEO,SAAS,2BAA2B,QAAwB;AACjE,QAAM,UAAU,OAAO,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,EAAE,EAAE,KAAK;AAC3E,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,SAAS,MAAM,GAAG,QAAQ,MAAM,GAAG,GAAG,CAAC,QAAQ;AAChE;AAEO,SAAS,mCAAmC,QAA+B;AAChF,QAAM,QAAQ,OAAO;AAAA,IACnB;AAAA,EACF;AACA,SAAO,QAAQ,CAAC,KAAK;AACvB;AAEO,SAAS,gDAAgD,WAAkC;AAChG,QAAM,eAAe,mCAAmC,SAAS;AACjE,MAAI,aAAc,QAAO;AACzB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,WAAO,mCAAmC,QAAQ,OAAO,WAAW,EAAE;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,qBAAqB,KAAsB;AACzD,QAAM,OAAO,eAAe,QAAQ,IAAI,OAAO;AAC/C,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAM,QAAiB,eAAe,QAAS,IAAoC,QAAQ;AAC3F,QAAM,YAAY,iBAAiB,QAC/B,YAAY,MAAM,IAAI,KAAK,MAAM,OAAO,GACxC,OAAQ,MAAqC,SAAS,WAClD,KAAK,OAAQ,MAAqC,IAAI,CAAC,MACvD,EACN,MACE,UAAU,SACR,KACA,YAAY,OAAO,KAAK,CAAC;AAC/B,SAAO,GAAG,OAAO,GAAG,IAAI,OAAO,EAAE,GAAG,OAAO,GAAG,SAAS;AACzD;AAeO,SAAS,0BAA0B,MAIY;AACpD,MAAI,KAAK,iBAAiB;AACxB,WAAO;AAAA,MACL,cAAc;AAAA,MACd,SACE,6CAA6C,KAAK,OAAO;AAAA,IAE7D;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA;AAAA;AAAA,IAGd,SAAS,KAAK,iBAAiB,QAAQ,mCAAmC,KAAK,OAAO,KAAK;AAAA,EAC7F;AACF;AAkBA,eAAsB,WACpB,KACA,SAC2B;AAC3B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,gBAAgB,QAAQ,SAC1B,YAAY,IAAI,CAAC,QAAQ,QAAQ,WAAW,MAAM,CAAC,IACnD,WAAW;AACf,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,SAAS;AACtE,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,eAAe,SAAS,QAAQ,QAAQ,CAAC;AACrF,iBAAa,OAAO;AACpB,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,MAAM,oBAAoB,GAAG,kBAAkB,SAAS,MAAM,EAAE;AACpE,aAAO,EAAE,IAAI,OAAO,MAAM,MAAM,QAAQ,SAAS,OAAO;AAAA,IAC1D;AACA,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AACvD,UAAM,OAAO,aAAa,SAAS,kBAAkB,IAAI,MAAM,SAAS,KAAK,IAAI,MAAM,SAAS,KAAK;AACrG,WAAO,EAAE,IAAI,MAAM,MAAM,QAAQ,SAAS,OAAO;AAAA,EACnD,SAAS,KAAK;AACZ,iBAAa,OAAO;AACpB,UAAM,UAAU,aAAa,GAAG;AAChC,QAAI;AAAA,MACF,oBAAoB,GAAG,IAAI,UAAU,mBAAmB,QAAQ,SAAS,OAAO,QAAQ,KAAK,qBAAqB,GAAG,CAAC;AAAA,IACxH;AACA,WAAO,EAAE,IAAI,OAAO,MAAM,MAAM,QAAQ,MAAM,QAAQ;AAAA,EACxD;AACF;AAqBO,IAAM,oBAAN,MAAwB;AAAA,EACrB,UAA+B;AAAA,EAEvC,IAAI,MAAiD,QAAwC;AAC3F,QAAI,SAAS,KAAK;AAClB,QAAI,CAAC,QAAQ;AACX,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,UAAwB,EAAE,SAAS,QAAQ,QAAQ,KAAK,GAAG,YAAY,SAAS,EAAE;AACxF,cAAQ,UAAU,KAAK,WAAW,MAAM,EAAE,QAAQ,MAAM;AACtD,YAAI,KAAK,YAAY,QAAS,MAAK,UAAU;AAAA,MAC/C,CAAC;AACD,WAAK,UAAU;AACf,eAAS;AAAA,IACX;AACA,UAAM,QAAQ;AACd,UAAM,WAAW;AACjB,QAAI,WAAW;AACf,UAAM,UAAU,MAAM;AACpB,UAAI,SAAU;AACd,iBAAW;AACX,YAAM,WAAW;AACjB,UAAI,MAAM,UAAU,EAAG;AAKvB,UAAI,KAAK,YAAY,MAAO,MAAK,UAAU;AAC3C,YAAM,WAAW,MAAM;AAAA,IACzB;AACA,QAAI,CAAC,OAAQ,QAAO,MAAM,QAAQ,QAAQ,OAAO;AACjD,WAAO,IAAI,QAAiB,CAAC,SAAS,WAAW;AAC/C,YAAM,UAAU,MAAM;AACpB,gBAAQ;AACR,gBAAQ,KAAK;AAAA,MACf;AACA,aAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,YAAM,QAAQ;AAAA,QACZ,CAAC,UAAU;AACT,iBAAO,oBAAoB,SAAS,OAAO;AAC3C,kBAAQ;AACR,kBAAQ,KAAK;AAAA,QACf;AAAA,QACA,CAAC,QAAiB;AAChB,iBAAO,oBAAoB,SAAS,OAAO;AAC3C,kBAAQ;AACR,iBAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,QAC5D;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AACF;","names":[]}

package/dist/{chunk-GAS7KYC7.js → chunk-RQQO3ORQ.js}

@@ -1,6 +1,6 @@
 import {
   getVerdictKind
-} from "./chunk-YUW66UAH.js";
+} from "./chunk-4AX5OYKC.js";
 import {
   scoreImportance
 } from "./chunk-UOBPK2OS.js";
@@ -1320,4 +1320,4 @@ export {
   syncWearableSource,
   defaultTimezone
 };
-//# sourceMappingURL=chunk-GAS7KYC7.js.map
+//# sourceMappingURL=chunk-RQQO3ORQ.js.map