@remnic/core 9.69.40 → 9.69.41

package/dist/{chunk-W23JARAQ.js → chunk-P66QH6R6.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-2SNCQHJZ.js";
+} from "./chunk-I33QYUAF.js";
 import {
   MutationSerializer,
   withHeldFileLock
@@ -1473,4 +1473,4 @@ export {
   isNamespaceKind,
   NamespaceCatalog
 };
-//# sourceMappingURL=chunk-W23JARAQ.js.map
+//# sourceMappingURL=chunk-P66QH6R6.js.map

package/dist/{chunk-62D2PAAM.js → chunk-PAAJWQH5.js}

@@ -2,9 +2,6 @@ import {
   CONVERGE_CONFLICT_POLICIES,
   DEFAULT_CONVERGE_CONFLICT_POLICY
 } from "./chunk-6MINUTGJ.js";
-import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
 import {
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
@@ -13,6 +10,9 @@ import {
   isCensusMtimeMs,
   isSha256Hex
 } from "./chunk-LQWOFU6L.js";
+import {
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
 
 // src/reconcile/plan.ts
 var ReconcilePlanInputError = class extends Error {
@@ -435,4 +435,4 @@ export {
   summarizeReconcilePlan,
   planReconciliation
 };
-//# sourceMappingURL=chunk-62D2PAAM.js.map
+//# sourceMappingURL=chunk-PAAJWQH5.js.map

package/dist/{chunk-XM46Y66S.js → chunk-PFKIOYJH.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-KJTKLXTH.js";
 import {
   StorageManager
-} from "./chunk-MVG3KXON.js";
+} from "./chunk-ICN37XHG.js";
 import {
   copyExistingFileToBackup,
   writeFileAtomically
@@ -260,4 +260,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-XM46Y66S.js.map
+//# sourceMappingURL=chunk-PFKIOYJH.js.map

package/dist/{chunk-C5R73BON.js → chunk-PGGPRF6J.js}

@@ -1,6 +1,6 @@
 import {
   runLocationSync
-} from "./chunk-YRIFXXMI.js";
+} from "./chunk-KZJM7R4F.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -58,4 +58,4 @@ export {
   LOCATION_SYNC_DEFAULT_INTERVAL_MS,
   startLocationAutoSync
 };
-//# sourceMappingURL=chunk-C5R73BON.js.map
+//# sourceMappingURL=chunk-PGGPRF6J.js.map

package/dist/{chunk-V6EGNVUT.js → chunk-PIWFNPQT.js}

@@ -1,3 +1,6 @@
+import {
+  estimateTokenCount
+} from "./chunk-TOTT6S2V.js";
 import {
   SKILL_FILE_NAME,
   renderSkillBundle
@@ -5,9 +8,6 @@ import {
 import {
   isValidSkillSlug
 } from "./chunk-ZCUTSMR2.js";
-import {
-  estimateTokenCount
-} from "./chunk-TOTT6S2V.js";
 import {
   pathIsInside
 } from "./chunk-C7HJ3NEI.js";
@@ -800,4 +800,4 @@ export {
   truncateToTokenBudget,
   describeMemoriesDir
 };
-//# sourceMappingURL=chunk-V6EGNVUT.js.map
+//# sourceMappingURL=chunk-PIWFNPQT.js.map

package/dist/{chunk-JOP7W24J.js → chunk-PLJ2MQFT.js}

@@ -1,3 +1,6 @@
+import {
+  MeilisearchBackend
+} from "./chunk-KVO2BTA4.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
@@ -13,9 +16,6 @@ import {
 import {
   LanceDbBackend
 } from "./chunk-D7MAYFQP.js";
-import {
-  MeilisearchBackend
-} from "./chunk-KVO2BTA4.js";
 import {
   createConversationIndexBackend
 } from "./chunk-TFA6HPOA.js";
@@ -179,4 +179,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-JOP7W24J.js.map
+//# sourceMappingURL=chunk-PLJ2MQFT.js.map

package/dist/{chunk-MJC7UKH7.js → chunk-PQ42DJNG.js}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-H3FZVNRN.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-IMBQFHRV.js";
+} from "./chunk-3BLHPQHT.js";
 import {
   resolvePrincipal
 } from "./chunk-MRV7VSQK.js";
@@ -798,4 +798,4 @@ var SmartBuffer = class {
 export {
   SmartBuffer
 };
-//# sourceMappingURL=chunk-MJC7UKH7.js.map
+//# sourceMappingURL=chunk-PQ42DJNG.js.map

package/dist/{chunk-37CAEC7E.js → chunk-PWPIERBM.js}

@@ -1,12 +1,12 @@
 import {
   stripAttributesSuffix
 } from "./chunk-JDSVLVCG.js";
-import {
-  normalizeNamespaceIdentity
-} from "./chunk-VUFL7X3H.js";
 import {
   parseIsoOffsetTimestamp
 } from "./chunk-P7FMDTKL.js";
+import {
+  normalizeNamespaceIdentity
+} from "./chunk-VUFL7X3H.js";
 
 // src/support-passport/contracts.ts
 import { createHash } from "crypto";
@@ -400,4 +400,4 @@ export {
   hasLiveSupportPassportCard,
   projectSupportPassportCard
 };
-//# sourceMappingURL=chunk-37CAEC7E.js.map
+//# sourceMappingURL=chunk-PWPIERBM.js.map

package/dist/{chunk-BXIJSPCL.js → chunk-Q62GA5U2.js}

@@ -1,6 +1,6 @@
 import {
   isRecallDisclosure
-} from "./chunk-MDIEES23.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   estimateTokenCount
 } from "./chunk-TOTT6S2V.js";
@@ -306,4 +306,4 @@ export {
   RecallXrayBuilder,
   summarizeDisclosureTokens
 };
-//# sourceMappingURL=chunk-BXIJSPCL.js.map
+//# sourceMappingURL=chunk-Q62GA5U2.js.map

package/dist/{chunk-CC37E3QM.js → chunk-QKCXRS5A.js}

@@ -121,6 +121,18 @@ function optionalEnvelopeAt(expiresAt) {
   }
   return parsed.at;
 }
+var MAX_WRITE_EXPIRES_AT_TTL_MS = 3650 * 24 * 60 * 60 * 1e3;
+function assertBoundedFutureExpiry(expiresAt, nowMs) {
+  const expiresAtMs = Date.parse(expiresAt);
+  if (expiresAtMs <= nowMs) {
+    throw new Error("composeWriteEnvelope: expiresAt must be an instant strictly after the write time");
+  }
+  if (expiresAtMs - nowMs > MAX_WRITE_EXPIRES_AT_TTL_MS) {
+    throw new Error(
+      `composeWriteEnvelope: expiresAt exceeds the maximum TTL of ${MAX_WRITE_EXPIRES_AT_TTL_MS}ms`
+    );
+  }
+}
 function optionalEnvelopeId(supersedes) {
   if (supersedes === void 0) return void 0;
   const parsed = parseEnvelopeId(supersedes);
@@ -162,6 +174,9 @@ function requireProducer(value) {
 function composeWriteEnvelope(input) {
   const sharedBy = requireEnvelopeActor(input.origin);
   const expiresAt = optionalEnvelopeAt(input.expiresAt);
+  if (expiresAt !== void 0 && Number.isFinite(input.nowMs ?? Number.NaN)) {
+    assertBoundedFutureExpiry(expiresAt, input.nowMs);
+  }
   const supersedes = optionalEnvelopeId(input.supersedes);
   return applyDefaultEnvelope(
     { sharedBy, authority: input.authority, expiresAt, supersedes },
@@ -195,4 +210,4 @@ export {
   envelopeFromScalars,
   resolveReadAuthority
 };
-//# sourceMappingURL=chunk-CC37E3QM.js.map
+//# sourceMappingURL=chunk-QKCXRS5A.js.map

package/dist/chunk-QKCXRS5A.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared-context/governance.ts","../src/shared-context/authority-precedence.ts","../src/shared-context/envelope-actor.ts","../src/shared-context/iso-instant.ts","../src/shared-context/envelope-at.ts","../src/shared-context/envelope-id.ts","../src/shared-context/envelope-io.ts"],"sourcesContent":["/**\n * Shared-item authority envelope (issue #1957).\n *\n * Pure parse/default/expiry helpers over the authority classes. Binding is\n * never inferred, and the authority token is validated exactly as supplied\n * or stored — a padded value never resolves to a privileged class.\n */\n\nexport const SHARED_AUTHORITIES = [\"informational\", \"advisory\", \"binding\"] as const;\nexport type SharedAuthority = (typeof SHARED_AUTHORITIES)[number];\n\nexport interface SharedEnvelope {\n  sharedBy?: string;\n  authority: SharedAuthority;\n  expiresAt?: string;\n  supersedes?: string;\n}\n\nexport interface SharedEnvelopeInput {\n  sharedBy?: string;\n  authority?: string;\n  expiresAt?: string;\n  supersedes?: string;\n}\n\nexport interface ApplyDefaultEnvelopeOptions {\n  binding?: boolean;\n}\n\nfunction isSharedAuthority(value: string): value is SharedAuthority {\n  return (SHARED_AUTHORITIES as readonly string[]).includes(value);\n}\n\nfunction optionalString(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\ntype AuthorityToken =\n  | { kind: \"absent\" }\n  | { kind: \"invalid\"; raw: string }\n  | { kind: \"valid\"; authority: SharedAuthority };\n\n/**\n * Read the authority token EXACTLY as supplied or stored. A padded value\n * such as `\" binding \"` is malformed data, never a normalized match for a\n * privileged class: trimming first would let stored whitespace resolve as\n * binding/advisory (AGENTS.md rule 45). Only the empty string counts as\n * \"unspecified\"; whitespace-only is invalid.\n */\nfunction readExactAuthority(value: unknown): AuthorityToken {\n  if (typeof value !== \"string\" || value.length === 0) return { kind: \"absent\" };\n  if (!isSharedAuthority(value)) return { kind: \"invalid\", raw: value };\n  return { kind: \"valid\", authority: value };\n}\n\nfunction withOptionalFields(\n  authority: SharedAuthority,\n  source: { sharedBy?: unknown; expiresAt?: unknown; supersedes?: unknown },\n): SharedEnvelope {\n  const envelope: SharedEnvelope = { authority };\n  const sharedBy = optionalString(source.sharedBy);\n  const expiresAt = optionalString(source.expiresAt);\n  const supersedes = optionalString(source.supersedes);\n  if (sharedBy) envelope.sharedBy = sharedBy;\n  if (expiresAt) envelope.expiresAt = expiresAt;\n  if (supersedes) envelope.supersedes = supersedes;\n  return envelope;\n}\n\nexport function applyDefaultEnvelope(\n  input: SharedEnvelopeInput = {},\n  options: ApplyDefaultEnvelopeOptions = {},\n): SharedEnvelope {\n  const requested = readExactAuthority(input.authority);\n  if (requested.kind === \"invalid\") {\n    throw new Error(\n      `applyDefaultEnvelope: authority must be informational, advisory, or binding; got ${JSON.stringify(requested.raw)}`,\n    );\n  }\n  if (requested.kind === \"valid\" && requested.authority === \"binding\" && options.binding !== true) {\n    throw new Error(\"applyDefaultEnvelope: authority \\\"binding\\\" requires an explicit binding flag\");\n  }\n  return withOptionalFields(requested.kind === \"valid\" ? requested.authority : \"informational\", input);\n}\n\nexport function parseSharedEnvelope(raw: unknown): SharedEnvelope {\n  if (typeof raw !== \"object\" || raw === null || Array.isArray(raw)) {\n    return { authority: \"informational\" };\n  }\n  const record = raw as Record<string, unknown>;\n  const requested = readExactAuthority(record.authority);\n  const authority = requested.kind === \"valid\" ? requested.authority : \"informational\";\n  return withOptionalFields(authority, record);\n}\n\nexport function isExpired(envelope: Pick<SharedEnvelope, \"expiresAt\">, nowMs: number): boolean {\n  if (!Number.isFinite(nowMs)) return false;\n  const expiresAt = envelope.expiresAt?.trim();\n  if (!expiresAt) return false;\n  const expiresAtMs = Date.parse(expiresAt);\n  if (!Number.isFinite(expiresAtMs)) return false;\n  return expiresAtMs <= nowMs;\n}\n","/**\n * Shared-item authority precedence (issue #1957).\n *\n * Pure helpers over the authority classes owned by `governance.ts`\n * (`SHARED_AUTHORITIES`). Resolution is least-privilege: an absent,\n * malformed, or unrecognized authority never resolves above\n * `informational`, and `binding` additionally requires the explicit\n * `allowBinding` flag. The helpers are exported for callers; wiring them\n * into the shared-context read and write paths is a later slice.\n */\n\nimport { SHARED_AUTHORITIES, type SharedAuthority } from \"./governance.js\";\n\nexport { SHARED_AUTHORITIES as SHARED_AUTHORITY_CLASSES };\nexport type { SharedAuthority as SharedAuthorityClass };\n\nexport interface ResolveSharedAuthorityInput {\n  /** Raw authority value from an item's envelope, if any. */\n  authority?: unknown;\n  /** Explicit opt-in required before \"binding\" is honored. */\n  allowBinding?: boolean;\n}\n\nconst AUTHORITY_RANK: Readonly<Record<SharedAuthority, number>> = {\n  informational: 0,\n  advisory: 1,\n  binding: 2,\n};\n\nfunction isKnownAuthority(value: string): value is SharedAuthority {\n  return (SHARED_AUTHORITIES as readonly string[]).includes(value);\n}\n\n\nexport function resolveSharedAuthority(input: ResolveSharedAuthorityInput): SharedAuthority {\n  // Read the security switch ONCE. A getter (or a Proxy) can return undefined\n  // during validation and true at the decision, which would let binding\n  // through without a validated opt-in.\n  const allowBinding = input.allowBinding;\n  if (allowBinding !== undefined && typeof allowBinding !== \"boolean\") {\n    // The flag is the security switch, so a truthy string or number must\n    // not enable binding: reject it instead of coercing.\n    throw new TypeError(\n      `resolveSharedAuthority: allowBinding must be a boolean when supplied, got ${typeof allowBinding}`,\n    );\n  }\n  const authority = input.authority;\n  // Absent (missing key, undefined, null) and present-but-invalid both land\n  // on informational — the least-privileged class — so an unmarked or\n  // malformed legacy item can never be treated as binding. Validate the\n  // exact value: no trim, no case-fold, because \" binding\" and \"BINDING\"\n  // are unrecognized data, not normalized matches for a known class.\n  if (typeof authority !== \"string\") return \"informational\";\n  if (!isKnownAuthority(authority)) return \"informational\";\n  if (authority === \"binding\" && allowBinding !== true) {\n    // Downgrade rather than throw: a legacy item already carrying \"binding\"\n    // is stored data, not a caller bug, so it resolves to the highest class\n    // that does not require the explicit opt-in.\n    return \"advisory\";\n  }\n  return authority;\n}\n\nexport function compareSharedAuthority(a: string, b: string): number {\n  const rankA = isKnownAuthority(a) ? AUTHORITY_RANK[a] : AUTHORITY_RANK.informational;\n  const rankB = isKnownAuthority(b) ? AUTHORITY_RANK[b] : AUTHORITY_RANK.informational;\n  return Math.sign(rankA - rankB);\n}\n","/**\n * Shared-item envelope actor parse (issue #1957 leftover).\n *\n * Pure. Empty is missing_actor. Newline is invalid_actor.\n */\n\nexport type ParseEnvelopeActorResult =\n  | { ok: true; actor: string }\n  | { ok: false; error: \"missing_actor\" | \"invalid_actor\" };\n\nexport function parseEnvelopeActor(value: string): ParseEnvelopeActorResult {\n  const actor = value.trim();\n  if (actor.length === 0) return { ok: false, error: \"missing_actor\" };\n  if (actor.includes(\"\\n\")) return { ok: false, error: \"invalid_actor\" };\n  return { ok: true, actor };\n}\n","/**\n * Strict ISO-8601 instant validation for shared-context envelopes\n * (issue #1957 review round 3).\n *\n * `Date.parse` is permissive: under the supported Node runtime it reads\n * `\"2026-02-30\"` as March 2 and `\"1\"` as January 1 2001. A caller-supplied\n * expiry would therefore be silently reinterpreted into a governance deadline\n * the caller never asked for. Validate the ISO shape AND the calendar\n * components against the exact input, and reject rather than normalize.\n *\n * Extracted from `provenance.ts` so the envelope write path and the\n * provenance stamp share one validator instead of two copies.\n */\n\n// Linear ISO instant. No nested quantifiers.\nconst ISO_INSTANT =\n  /^(\\d{4})-(\\d{2})-(\\d{2})T(\\d{2}):(\\d{2}):(\\d{2})(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$/;\n\n/**\n * True only for a calendar-valid ISO-8601 instant carrying an explicit zone.\n * Non-strings and non-finite parses are rejected explicitly, never coerced.\n */\nexport function isStrictIsoInstant(value: unknown): boolean {\n  if (typeof value !== \"string\") return false;\n  const match = ISO_INSTANT.exec(value);\n  if (!match) return false;\n  const year = Number(match[1]);\n  const month = Number(match[2]);\n  const day = Number(match[3]);\n  const hour = Number(match[4]);\n  const minute = Number(match[5]);\n  const second = Number(match[6]);\n  const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));\n  return (\n    Number.isFinite(Date.parse(value)) &&\n    utc.getUTCFullYear() === year &&\n    utc.getUTCMonth() === month - 1 &&\n    utc.getUTCDate() === day &&\n    utc.getUTCHours() === hour &&\n    utc.getUTCMinutes() === minute &&\n    utc.getUTCSeconds() === second\n  );\n}\n","/**\n * Shared-item envelope at parse (issue #1957 leftover).\n *\n * Pure. Blank is missing_at. Anything that is not a calendar-valid ISO-8601\n * instant is invalid_at — including values permissive `Date.parse` would\n * silently reinterpret (`\"2026-02-30\"` -> March 2, `\"1\"` -> January 1 2001),\n * a whitespace-padded timestamp, and any non-string or non-finite input\n * (review round 3). `trim()` only detects blankness; validation reads the\n * exact value, so normalization can never widen what passes.\n */\n\nimport { isStrictIsoInstant } from \"./iso-instant.js\";\n\nexport type ParseEnvelopeAtResult =\n  | { ok: true; at: string }\n  | { ok: false; error: \"missing_at\" | \"invalid_at\" };\n\nexport function parseEnvelopeAt(value: string): ParseEnvelopeAtResult {\n  if (typeof value !== \"string\") return { ok: false, error: \"invalid_at\" };\n  if (value.trim().length === 0) return { ok: false, error: \"missing_at\" };\n  if (!isStrictIsoInstant(value)) return { ok: false, error: \"invalid_at\" };\n  return { ok: true, at: new Date(Date.parse(value)).toISOString() };\n}\n","/**\n * Shared-item envelope id parse (issue #1957 leftover).\n *\n * Pure. Empty is missing_id. Newline is invalid_id.\n */\n\nexport type ParseEnvelopeIdResult =\n  | { ok: true; id: string }\n  | { ok: false; error: \"missing_id\" | \"invalid_id\" };\n\nexport function parseEnvelopeId(value: string): ParseEnvelopeIdResult {\n  const id = value.trim();\n  if (id.length === 0) return { ok: false, error: \"missing_id\" };\n  if (id.includes(\"\\n\")) return { ok: false, error: \"invalid_id\" };\n  return { ok: true, id };\n}\n","/**\n * Shared-item envelope wiring (issue #1957, control 1: origin + authority).\n *\n * Bridges the pure envelope helpers onto the markdown frontmatter the\n * shared-context manager reads and writes.\n *\n * Write side rejects invalid input (an unrecognized authority or a binding\n * request without the config opt-in throws — never silently reinterpreted).\n * Read side resolves least privilege: a missing, malformed, or unrecognized\n * authority never resolves above informational, and stored binding\n * downgrades to advisory unless config opted in.\n */\n\nimport { applyDefaultEnvelope, parseSharedEnvelope, type SharedEnvelope } from \"./governance.js\";\nimport { resolveSharedAuthority } from \"./authority-precedence.js\";\nimport type { SharedAuthority } from \"./governance.js\";\nimport { parseEnvelopeActor } from \"./envelope-actor.js\";\nimport { parseEnvelopeAt } from \"./envelope-at.js\";\nimport { parseEnvelopeId } from \"./envelope-id.js\";\n\nexport interface ComposeWriteEnvelopeInput {\n  /** Governance origin. Becomes the envelope's `sharedBy`. */\n  origin: string;\n  /** Requested authority class. Unrecognized values throw. */\n  authority?: string;\n  /** Optional ISO-8601 expiry. Invalid timestamps throw. */\n  expiresAt?: string;\n  /** Optional id of the item this one supersedes. */\n  supersedes?: string;\n  /** Config opt-in (`sharedContextAllowBindingAuthority`). Binding throws without it. */\n  allowBinding: boolean;\n  /**\n   * Write instant for the expiry TTL policy (issue #2920). When finite, an\n   * `expiresAt` must land strictly after it and within the maximum TTL —\n   * a past or effectively-immortal expiry is a client input error, never a\n   * silently accepted stamp.\n   */\n  nowMs?: number;\n}\n\nfunction requireEnvelopeActor(agentId: string): string {\n  const parsed = parseEnvelopeActor(agentId);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: agentId must be a non-blank single-line string (${parsed.error})`);\n  }\n  return parsed.actor;\n}\n\nfunction optionalEnvelopeAt(expiresAt: string | undefined): string | undefined {\n  if (expiresAt === undefined) return undefined;\n  const parsed = parseEnvelopeAt(expiresAt);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: expiresAt must be a valid ISO-8601 timestamp (${parsed.error})`);\n  }\n  return parsed.at;\n}\n\n/** Maximum write-side TTL: 10 years. A farther `expiresAt` is rejected. */\nexport const MAX_WRITE_EXPIRES_AT_TTL_MS = 3650 * 24 * 60 * 60 * 1000;\n\nfunction assertBoundedFutureExpiry(expiresAt: string, nowMs: number): void {\n  const expiresAtMs = Date.parse(expiresAt);\n  if (expiresAtMs <= nowMs) {\n    throw new Error(\"composeWriteEnvelope: expiresAt must be an instant strictly after the write time\");\n  }\n  if (expiresAtMs - nowMs > MAX_WRITE_EXPIRES_AT_TTL_MS) {\n    throw new Error(\n      `composeWriteEnvelope: expiresAt exceeds the maximum TTL of ${MAX_WRITE_EXPIRES_AT_TTL_MS}ms`,\n    );\n  }\n}\n\nfunction optionalEnvelopeId(supersedes: string | undefined): string | undefined {\n  if (supersedes === undefined) return undefined;\n  const parsed = parseEnvelopeId(supersedes);\n  if (!parsed.ok) {\n    throw new Error(`composeWriteEnvelope: supersedes must be a non-blank single-line id (${parsed.error})`);\n  }\n  return parsed.id;\n}\n\n/**\n * Reserved governance origin for an authenticated external access write that\n * resolved no principal (`agentAccessHttp.principal` unset, no adapter\n * identity). Server-owned: the caller cannot mint or influence it, and the\n * caller-supplied `agentId` never becomes audit metadata on that path.\n */\nexport const UNATTRIBUTED_ACCESS_WRITE_ORIGIN = \"unattributed:access-surface\";\n\nexport interface ResolvedWriteIdentity {\n  /**\n   * Producer identity: frontmatter `agent`, on-disk segment, and the\n   * cross-signals grouping key. Self-declared by the caller only on\n   * surfaces that resolved no server identity; never decides authority.\n   */\n  agent: string;\n  /** Governance origin stamped as the envelope's `sharedBy`. */\n  origin: string;\n}\n\n/**\n * Resolve the producer identity and governance origin for a shared-context\n * write. They are different fields with different trust requirements:\n *\n * - The origin (`sharedBy`) is audit metadata and is always server-derived.\n *   When the surface resolved an authenticated identity, that identity IS the\n *   origin; when it resolved none but the write crosses an external\n *   boundary, the caller-supplied `unattributedOrigin` token is stamped\n *   instead — never the caller's value. Only a trusted in-process caller\n *   (no identity, no token) may stamp its own id as the origin.\n * - The producer (`agent`) drives grouping and display only. When an\n *   authenticated identity exists it is also the producer, and a\n *   caller-supplied `agentId` naming a different agent is REJECTED, so a\n *   caller can never publish an item attributed to another agent. Without a\n *   server identity the caller's label stands as the producer — collapsing\n *   it instead would merge every writer into one agent and erase\n *   multi-agent overlaps from `synthesizeCrossSignals`.\n */\nexport function resolveWriteOrigin(input: {\n  agentId: string;\n  authenticatedIdentity?: string;\n  unattributedOrigin?: string;\n}): ResolvedWriteIdentity {\n  const identity = input.authenticatedIdentity?.trim() ?? \"\";\n  if (identity.length > 0) {\n    const requested = input.agentId.trim();\n    if (requested.length > 0 && requested !== identity) {\n      throw new Error(\n        `shared-context write origin mismatch: authenticated identity ${JSON.stringify(identity)} cannot publish as ${JSON.stringify(requested)}`,\n      );\n    }\n    return { agent: identity, origin: identity };\n  }\n  const unattributed = input.unattributedOrigin?.trim() ?? \"\";\n  if (unattributed.length > 0) {\n    const label = input.agentId.trim();\n    return {\n      agent: label.length > 0 ? requireProducer(label) : requireProducer(unattributed),\n      origin: requireProducer(unattributed),\n    };\n  }\n  const actor = requireProducer(input.agentId);\n  return { agent: actor, origin: actor };\n}\n\nfunction requireProducer(value: string): string {\n  const parsed = parseEnvelopeActor(value);\n  if (!parsed.ok) {\n    throw new Error(`shared-context write producer must be a non-blank single-line string (${parsed.error})`);\n  }\n  return parsed.actor;\n}\n\n/**\n * Validate and compose the envelope for a shared-context write.\n * `sharedBy` is stamped from the server-derived origin — provenance is\n * never injected through item content or the caller's producer label.\n */\nexport function composeWriteEnvelope(input: ComposeWriteEnvelopeInput): SharedEnvelope {\n  const sharedBy = requireEnvelopeActor(input.origin);\n  const expiresAt = optionalEnvelopeAt(input.expiresAt);\n  if (expiresAt !== undefined && Number.isFinite(input.nowMs ?? Number.NaN)) {\n    assertBoundedFutureExpiry(expiresAt, input.nowMs as number);\n  }\n  const supersedes = optionalEnvelopeId(input.supersedes);\n  return applyDefaultEnvelope(\n    { sharedBy, authority: input.authority, expiresAt, supersedes },\n    { binding: input.allowBinding },\n  );\n}\n\n/** Serialize an envelope into frontmatter lines (caller adds the `---` fences). */\nexport function envelopeToFrontmatterLines(envelope: SharedEnvelope): string[] {\n  const line = (key: string, value: string) => `${key}: ${JSON.stringify(value)}`;\n  const lines = [line(\"sharedBy\", envelope.sharedBy ?? \"\"), line(\"authority\", envelope.authority)];\n  if (envelope.expiresAt !== undefined) lines.push(line(\"expiresAt\", envelope.expiresAt));\n  if (envelope.supersedes !== undefined) lines.push(line(\"supersedes\", envelope.supersedes));\n  return lines;\n}\n\n/**\n * Build an envelope from frontmatter scalars already read off a stored item.\n * Missing scalars (legacy items) compose to informational with no expiry.\n */\nexport function envelopeFromScalars(scalars: {\n  sharedBy: string | null;\n  authority: string | null;\n  expiresAt: string | null;\n  supersedes: string | null;\n}): SharedEnvelope {\n  const record: Record<string, string> = {};\n  if (scalars.sharedBy !== null) record.sharedBy = scalars.sharedBy;\n  if (scalars.authority !== null) record.authority = scalars.authority;\n  if (scalars.expiresAt !== null) record.expiresAt = scalars.expiresAt;\n  if (scalars.supersedes !== null) record.supersedes = scalars.supersedes;\n  return parseSharedEnvelope(record);\n}\n\n/**\n * Resolve a stored envelope's authority for read-side consumption.\n * Least privilege: unrecognized/missing stays informational; binding\n * requires the config opt-in or downgrades to advisory.\n */\nexport function resolveReadAuthority(\n  envelope: Pick<SharedEnvelope, \"authority\">,\n  allowBinding: boolean,\n): SharedAuthority {\n  return resolveSharedAuthority({ authority: envelope.authority, allowBinding });\n}\n"],"mappings":";AAQO,IAAM,qBAAqB,CAAC,iBAAiB,YAAY,SAAS;AAqBzE,SAAS,kBAAkB,OAAyC;AAClE,SAAQ,mBAAyC,SAAS,KAAK;AACjE;AAEA,SAAS,eAAe,OAAoC;AAC1D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAcA,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,EAAG,QAAO,EAAE,MAAM,SAAS;AAC7E,MAAI,CAAC,kBAAkB,KAAK,EAAG,QAAO,EAAE,MAAM,WAAW,KAAK,MAAM;AACpE,SAAO,EAAE,MAAM,SAAS,WAAW,MAAM;AAC3C;AAEA,SAAS,mBACP,WACA,QACgB;AAChB,QAAM,WAA2B,EAAE,UAAU;AAC7C,QAAM,WAAW,eAAe,OAAO,QAAQ;AAC/C,QAAM,YAAY,eAAe,OAAO,SAAS;AACjD,QAAM,aAAa,eAAe,OAAO,UAAU;AACnD,MAAI,SAAU,UAAS,WAAW;AAClC,MAAI,UAAW,UAAS,YAAY;AACpC,MAAI,WAAY,UAAS,aAAa;AACtC,SAAO;AACT;AAEO,SAAS,qBACd,QAA6B,CAAC,GAC9B,UAAuC,CAAC,GACxB;AAChB,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,MAAI,UAAU,SAAS,WAAW;AAChC,UAAM,IAAI;AAAA,MACR,oFAAoF,KAAK,UAAU,UAAU,GAAG,CAAC;AAAA,IACnH;AAAA,EACF;AACA,MAAI,UAAU,SAAS,WAAW,UAAU,cAAc,aAAa,QAAQ,YAAY,MAAM;AAC/F,UAAM,IAAI,MAAM,6EAA+E;AAAA,EACjG;AACA,SAAO,mBAAmB,UAAU,SAAS,UAAU,UAAU,YAAY,iBAAiB,KAAK;AACrG;AAEO,SAAS,oBAAoB,KAA8B;AAChE,MAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAAG;AACjE,WAAO,EAAE,WAAW,gBAAgB;AAAA,EACtC;AACA,QAAM,SAAS;AACf,QAAM,YAAY,mBAAmB,OAAO,SAAS;AACrD,QAAM,YAAY,UAAU,SAAS,UAAU,UAAU,YAAY;AACrE,SAAO,mBAAmB,WAAW,MAAM;AAC7C;;;AClEA,SAAS,iBAAiB,OAAyC;AACjE,SAAQ,mBAAyC,SAAS,KAAK;AACjE;AAGO,SAAS,uBAAuB,OAAqD;AAI1F,QAAM,eAAe,MAAM;AAC3B,MAAI,iBAAiB,UAAa,OAAO,iBAAiB,WAAW;AAGnE,UAAM,IAAI;AAAA,MACR,6EAA6E,OAAO,YAAY;AAAA,IAClG;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAMxB,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,MAAI,CAAC,iBAAiB,SAAS,EAAG,QAAO;AACzC,MAAI,cAAc,aAAa,iBAAiB,MAAM;AAIpD,WAAO;AAAA,EACT;AACA,SAAO;AACT;;;ACnDO,SAAS,mBAAmB,OAAyC;AAC1E,QAAM,QAAQ,MAAM,KAAK;AACzB,MAAI,MAAM,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AACnE,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,gBAAgB;AACrE,SAAO,EAAE,IAAI,MAAM,MAAM;AAC3B;;;ACAA,IAAM,cACJ;AAMK,SAAS,mBAAmB,OAAyB;AAC1D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,MAAM,IAAI,KAAK,KAAK,IAAI,MAAM,QAAQ,GAAG,KAAK,MAAM,QAAQ,MAAM,CAAC;AACzE,SACE,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,KACjC,IAAI,eAAe,MAAM,QACzB,IAAI,YAAY,MAAM,QAAQ,KAC9B,IAAI,WAAW,MAAM,OACrB,IAAI,YAAY,MAAM,QACtB,IAAI,cAAc,MAAM,UACxB,IAAI,cAAc,MAAM;AAE5B;;;ACzBO,SAAS,gBAAgB,OAAsC;AACpE,MAAI,OAAO,UAAU,SAAU,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACvE,MAAI,MAAM,KAAK,EAAE,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACvE,MAAI,CAAC,mBAAmB,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AACxE,SAAO,EAAE,IAAI,MAAM,IAAI,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,EAAE,YAAY,EAAE;AACnE;;;ACZO,SAAS,gBAAgB,OAAsC;AACpE,QAAM,KAAK,MAAM,KAAK;AACtB,MAAI,GAAG,WAAW,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAC7D,MAAI,GAAG,SAAS,IAAI,EAAG,QAAO,EAAE,IAAI,OAAO,OAAO,aAAa;AAC/D,SAAO,EAAE,IAAI,MAAM,GAAG;AACxB;;;ACyBA,SAAS,qBAAqB,SAAyB;AACrD,QAAM,SAAS,mBAAmB,OAAO;AACzC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,yEAAyE,OAAO,KAAK,GAAG;AAAA,EAC1G;AACA,SAAO,OAAO;AAChB;AAEA,SAAS,mBAAmB,WAAmD;AAC7E,MAAI,cAAc,OAAW,QAAO;AACpC,QAAM,SAAS,gBAAgB,SAAS;AACxC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,uEAAuE,OAAO,KAAK,GAAG;AAAA,EACxG;AACA,SAAO,OAAO;AAChB;AAGO,IAAM,8BAA8B,OAAO,KAAK,KAAK,KAAK;AAEjE,SAAS,0BAA0B,WAAmB,OAAqB;AACzE,QAAM,cAAc,KAAK,MAAM,SAAS;AACxC,MAAI,eAAe,OAAO;AACxB,UAAM,IAAI,MAAM,kFAAkF;AAAA,EACpG;AACA,MAAI,cAAc,QAAQ,6BAA6B;AACrD,UAAM,IAAI;AAAA,MACR,8DAA8D,2BAA2B;AAAA,IAC3F;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,YAAoD;AAC9E,MAAI,eAAe,OAAW,QAAO;AACrC,QAAM,SAAS,gBAAgB,UAAU;AACzC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,wEAAwE,OAAO,KAAK,GAAG;AAAA,EACzG;AACA,SAAO,OAAO;AAChB;AAQO,IAAM,mCAAmC;AA+BzC,SAAS,mBAAmB,OAIT;AACxB,QAAM,WAAW,MAAM,uBAAuB,KAAK,KAAK;AACxD,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,YAAY,MAAM,QAAQ,KAAK;AACrC,QAAI,UAAU,SAAS,KAAK,cAAc,UAAU;AAClD,YAAM,IAAI;AAAA,QACR,gEAAgE,KAAK,UAAU,QAAQ,CAAC,sBAAsB,KAAK,UAAU,SAAS,CAAC;AAAA,MACzI;AAAA,IACF;AACA,WAAO,EAAE,OAAO,UAAU,QAAQ,SAAS;AAAA,EAC7C;AACA,QAAM,eAAe,MAAM,oBAAoB,KAAK,KAAK;AACzD,MAAI,aAAa,SAAS,GAAG;AAC3B,UAAM,QAAQ,MAAM,QAAQ,KAAK;AACjC,WAAO;AAAA,MACL,OAAO,MAAM,SAAS,IAAI,gBAAgB,KAAK,IAAI,gBAAgB,YAAY;AAAA,MAC/E,QAAQ,gBAAgB,YAAY;AAAA,IACtC;AAAA,EACF;AACA,QAAM,QAAQ,gBAAgB,MAAM,OAAO;AAC3C,SAAO,EAAE,OAAO,OAAO,QAAQ,MAAM;AACvC;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,SAAS,mBAAmB,KAAK;AACvC,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,IAAI,MAAM,yEAAyE,OAAO,KAAK,GAAG;AAAA,EAC1G;AACA,SAAO,OAAO;AAChB;AAOO,SAAS,qBAAqB,OAAkD;AACrF,QAAM,WAAW,qBAAqB,MAAM,MAAM;AAClD,QAAM,YAAY,mBAAmB,MAAM,SAAS;AACpD,MAAI,cAAc,UAAa,OAAO,SAAS,MAAM,SAAS,OAAO,GAAG,GAAG;AACzE,8BAA0B,WAAW,MAAM,KAAe;AAAA,EAC5D;AACA,QAAM,aAAa,mBAAmB,MAAM,UAAU;AACtD,SAAO;AAAA,IACL,EAAE,UAAU,WAAW,MAAM,WAAW,WAAW,WAAW;AAAA,IAC9D,EAAE,SAAS,MAAM,aAAa;AAAA,EAChC;AACF;AAGO,SAAS,2BAA2B,UAAoC;AAC7E,QAAM,OAAO,CAAC,KAAa,UAAkB,GAAG,GAAG,KAAK,KAAK,UAAU,KAAK,CAAC;AAC7E,QAAM,QAAQ,CAAC,KAAK,YAAY,SAAS,YAAY,EAAE,GAAG,KAAK,aAAa,SAAS,SAAS,CAAC;AAC/F,MAAI,SAAS,cAAc,OAAW,OAAM,KAAK,KAAK,aAAa,SAAS,SAAS,CAAC;AACtF,MAAI,SAAS,eAAe,OAAW,OAAM,KAAK,KAAK,cAAc,SAAS,UAAU,CAAC;AACzF,SAAO;AACT;AAMO,SAAS,oBAAoB,SAKjB;AACjB,QAAM,SAAiC,CAAC;AACxC,MAAI,QAAQ,aAAa,KAAM,QAAO,WAAW,QAAQ;AACzD,MAAI,QAAQ,cAAc,KAAM,QAAO,YAAY,QAAQ;AAC3D,MAAI,QAAQ,cAAc,KAAM,QAAO,YAAY,QAAQ;AAC3D,MAAI,QAAQ,eAAe,KAAM,QAAO,aAAa,QAAQ;AAC7D,SAAO,oBAAoB,MAAM;AACnC;AAOO,SAAS,qBACd,UACA,cACiB;AACjB,SAAO,uBAAuB,EAAE,WAAW,SAAS,WAAW,aAAa,CAAC;AAC/E;","names":[]}

package/dist/{chunk-VKWFNPBH.js → chunk-RQQO3ORQ.js}

@@ -1,6 +1,6 @@
 import {
   getVerdictKind
-} from "./chunk-JUDT33RX.js";
+} from "./chunk-4AX5OYKC.js";
 import {
   scoreImportance
 } from "./chunk-UOBPK2OS.js";
@@ -1320,4 +1320,4 @@ export {
   syncWearableSource,
   defaultTimezone
 };
-//# sourceMappingURL=chunk-VKWFNPBH.js.map
+//# sourceMappingURL=chunk-RQQO3ORQ.js.map

package/dist/{chunk-SFHLQPBF.js → chunk-S4MJTIPG.js}

@@ -8,10 +8,13 @@ import {
 } from "./chunk-MPC7TYTZ.js";
 import {
   importCapsule
-} from "./chunk-ZHXSOMYH.js";
+} from "./chunk-VVX5PZFS.js";
+import {
+  isSharedContextWriteInputError
+} from "./chunk-IFBSZGW3.js";
 import {
   UNATTRIBUTED_ACCESS_WRITE_ORIGIN
-} from "./chunk-CC37E3QM.js";
+} from "./chunk-QKCXRS5A.js";
 import {
   ACTIVE_DECISION_STATUSES,
   CodegraphRuntimeError,
@@ -35,16 +38,10 @@ import {
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-RDLPFM7I.js";
+} from "./chunk-2ZG2LLZT.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
-import {
-  trustResultFor
-} from "./chunk-GNVZQ5JN.js";
-import {
-  renderEpistemicHedge
-} from "./chunk-YN2UN7N3.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -54,27 +51,33 @@ import {
   seedTrustZoneDemoDataset,
   summarizeTrustZonePromotionReadiness
 } from "./chunk-ROBHL3GL.js";
+import {
+  trustResultFor
+} from "./chunk-GNVZQ5JN.js";
+import {
+  renderEpistemicHedge
+} from "./chunk-YN2UN7N3.js";
 import {
   summarizeHourlyStatus
-} from "./chunk-AEOOGXMQ.js";
+} from "./chunk-J2MGTGKC.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
 import {
   isSearchExcludedPath
-} from "./chunk-NVVZPBKI.js";
+} from "./chunk-JMWUPUE6.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-KOTG3RXE.js";
+} from "./chunk-AUSRUOMQ.js";
 import {
   estimateRecallTokens
-} from "./chunk-BXIJSPCL.js";
+} from "./chunk-Q62GA5U2.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-LKFVVN7R.js";
+} from "./chunk-563X6JJX.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -95,7 +98,7 @@ import {
 } from "./chunk-HWLIMQE2.js";
 import {
   readProjectedHarmonicGraph
-} from "./chunk-IOPIGX7Y.js";
+} from "./chunk-AKABVXFS.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -110,7 +113,7 @@ import {
 } from "./chunk-NLE6TSLG.js";
 import {
   LocalLlmClient
-} from "./chunk-G2XZFGYN.js";
+} from "./chunk-WGZHSQDV.js";
 import {
   REDACTION_RULES_SUBDIR
 } from "./chunk-LTHVM4XN.js";
@@ -118,7 +121,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-HIP6DKJJ.js";
+} from "./chunk-LQVXSRAJ.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -129,24 +132,16 @@ import {
 } from "./chunk-7ZNJN5WZ.js";
 import {
   callDeepRecallPolicyLlm
-} from "./chunk-ZRMMXWYI.js";
+} from "./chunk-YR5QT4SR.js";
 import {
   renderDeepRecallResult
 } from "./chunk-RF2SMMPP.js";
 import {
   createDeepRecallSeedSearch
-} from "./chunk-OEDW4ER7.js";
+} from "./chunk-AJBWVDRV.js";
 import {
   runBudgetedDeepRecall
-} from "./chunk-SV4Z2S67.js";
-import {
-  CorpusWatermarkCache,
-  computeServiceCorpusCensus
-} from "./chunk-VQWBUPSJ.js";
-import {
-  CrossNamespaceBudget,
-  toBudgetWarning
-} from "./chunk-UFGFMWAD.js";
+} from "./chunk-WUUGE7QC.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -154,10 +149,18 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-2SKMZUOW.js";
+} from "./chunk-KLUC2GSG.js";
+import {
+  CorpusWatermarkCache,
+  computeServiceCorpusCensus
+} from "./chunk-5EQT62HH.js";
+import {
+  CrossNamespaceBudget,
+  toBudgetWarning
+} from "./chunk-UFGFMWAD.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-IMBQFHRV.js";
+} from "./chunk-3BLHPQHT.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -167,21 +170,21 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-VQYWKCDR.js";
+} from "./chunk-ZX6NNFSY.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-MVG3KXON.js";
+} from "./chunk-ICN37XHG.js";
 import {
   namespaceCollectionName
-} from "./chunk-TZ44E732.js";
+} from "./chunk-AIVRD66I.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-MDIEES23.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -217,7 +220,7 @@ import {
 } from "./chunk-BT7NVCML.js";
 import {
   FallbackLlmClient
-} from "./chunk-THTF2W7M.js";
+} from "./chunk-TRTLWUDD.js";
 import {
   CORRECTION_TEXT_MAX,
   CorrectionContractError,
@@ -232,7 +235,7 @@ import {
 } from "./chunk-FEHIOYML.js";
 import {
   formatSupersededPrefix
-} from "./chunk-NETQXOPY.js";
+} from "./chunk-EH3HNCAM.js";
 import {
   ExtractionLivenessWarnThrottle,
   computeExtractionLivenessStatus
@@ -265,9 +268,21 @@ import {
   wearablesTranscriptMemories,
   wearablesTranscriptSearch
 } from "./chunk-SYOIVK7K.js";
+import {
+  splitCanonicalWriteRequest
+} from "./chunk-ZZEIL3MI.js";
+import {
+  reapplyCategoryCoercion
+} from "./chunk-DM5CU5J7.js";
+import {
+  exportCapsule
+} from "./chunk-VDX2J7OX.js";
+import {
+  evaluateActionConfidence
+} from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-23HFXQ5J.js";
+} from "./chunk-Z7NBT6AK.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-XVDZFTN5.js";
@@ -311,7 +326,7 @@ import {
   encodeSupportPassportNamespaceAttributes,
   isSupportPassportPrivateMemory,
   projectSupportPassportCard
-} from "./chunk-37CAEC7E.js";
+} from "./chunk-PWPIERBM.js";
 import {
   inferMemoryStatus,
   isActiveMemoryStatus,
@@ -341,6 +356,25 @@ import {
   isNamespaceAllowed,
   tokenCapabilityStore
 } from "./chunk-MZWSOLMT.js";
+import {
+  OFFLINE_SYNC_SNAPSHOT_FORMAT,
+  applyOfflineSyncChangeset,
+  applyOfflineSyncFileContentChunk,
+  buildOfflineSyncSnapshot,
+  buildOfflineSyncSnapshotForPaths,
+  buildOfflineSyncSnapshotFromBase,
+  compileOfflineSyncExcludeGlobs,
+  filterOfflineSyncDeletionRevisions,
+  iterateOfflineSyncSnapshotFileRecords,
+  normalizeOfflineSyncChangeset,
+  readOfflineSyncFileContentChunk
+} from "./chunk-WQZZDN5M.js";
+import {
+  validateArchiveRelativePath
+} from "./chunk-GCGJW34D.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   defaultNamespaceAtFlatRoot,
   memorySearchThroughScope,
@@ -383,37 +417,6 @@ import {
   ObserveTranscriptPersister,
   observeTranscriptSessionKey
 } from "./chunk-T2JSUEH6.js";
-import {
-  splitCanonicalWriteRequest
-} from "./chunk-ZZCR2QYL.js";
-import {
-  reapplyCategoryCoercion
-} from "./chunk-ZX3AYNNV.js";
-import {
-  exportCapsule
-} from "./chunk-KQAFEZQX.js";
-import {
-  evaluateActionConfidence
-} from "./chunk-Z2YFLXHU.js";
-import {
-  OFFLINE_SYNC_SNAPSHOT_FORMAT,
-  applyOfflineSyncChangeset,
-  applyOfflineSyncFileContentChunk,
-  buildOfflineSyncSnapshot,
-  buildOfflineSyncSnapshotForPaths,
-  buildOfflineSyncSnapshotFromBase,
-  compileOfflineSyncExcludeGlobs,
-  filterOfflineSyncDeletionRevisions,
-  iterateOfflineSyncSnapshotFileRecords,
-  normalizeOfflineSyncChangeset,
-  readOfflineSyncFileContentChunk
-} from "./chunk-WQZZDN5M.js";
-import {
-  validateArchiveRelativePath
-} from "./chunk-GCGJW34D.js";
-import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
 import {
   AccessIdempotencyStore,
   hashAccessIdempotencyPayload
@@ -450,7 +453,7 @@ import {
 } from "./chunk-B6O2YLUR.js";
 import {
   AccessAuditAdapter
-} from "./chunk-TVVEYCNW.js";
+} from "./chunk-7K5Q6COX.js";
 import {
   decodeCitationNamespace
 } from "./chunk-YRLHEEQT.js";
@@ -15347,11 +15350,13 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     const result = await runBudgetedDeepRecall(
       {
         config: effective,
+        ...request.abortSignal ? { signal: request.abortSignal } : {},
         searchSeed: createDeepRecallSeedSearch({
           namespace: resolvedNamespace,
           storage,
           router: this.orchestrator,
-          resolver: this.orchestrator.qmdResultResolver
+          resolver: this.orchestrator.qmdResultResolver,
+          ...request.abortSignal ? { signal: request.abortSignal } : {}
         }),
         // Nodes and anchors are projected against the namespace's CURRENT
         // active memories through the SAME helper searchHarmonicRetrieval
@@ -15362,7 +15367,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
         loadGraph: async () => readProjectedHarmonicGraph({
           memoryDir: storage.dir,
           abstractionNodeStoreDir: graphStoreDir,
-          anchorsEnabled: true
+          anchorsEnabled: true,
+          ...request.abortSignal ? { abortSignal: request.abortSignal } : {}
         }),
         loadMemory: async (memoryId) => {
           const memory = await storage.getMemoryById(memoryId);
@@ -15379,7 +15385,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
           config,
           localLlm: this.orchestrator.localLlm ?? null,
           fallbackLlm: this.orchestrator.fastGatewayLlm ?? null,
-          timeoutMs
+          timeoutMs,
+          ...request.abortSignal ? { signal: request.abortSignal } : {}
         })
       },
       query
@@ -16598,17 +16605,14 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
         agentId: request.agentId,
         title: request.title,
         content: request.content,
-        // The origin is server-owned in BOTH cases (issue #1957 review
-        // round 4): the authenticated principal when one resolved, and a
-        // reserved unattributed token otherwise — a principal-less
-        // authenticated request must never stamp the client's `agentId`
-        // as audit metadata. The client label survives only as the
-        // producer, which feeds grouping and display, never authority.
+        authority: request.authority,
+        expiresAt: request.expiresAt,
+        supersedes: request.supersedes,
         ...request.principal ? { authenticatedIdentity: request.principal } : { unattributedOrigin: UNATTRIBUTED_ACCESS_WRITE_ORIGIN }
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (message.startsWith("shared-context write origin mismatch")) {
+      if (isSharedContextWriteInputError(message)) {
         throw new EngramAccessInputError(message);
       }
       throw error;
@@ -17982,4 +17986,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-SFHLQPBF.js.map
+//# sourceMappingURL=chunk-S4MJTIPG.js.map