@remnic/core 9.69.40 → 9.69.42

package/dist/{chunk-MVG3KXON.js → chunk-I65KB36L.js}

@@ -1,9 +1,3 @@
-import {
-  TombstoneStore,
-  applyTombstoneResurrectionGate,
-  buildRetiredFactTombstoneInputs,
-  collectRetiredMemoriesForRebuild
-} from "./chunk-46WM6JX2.js";
 import {
   WEARABLES_DIR_NAME,
   escapeSegmentText,
@@ -15,9 +9,15 @@ import {
   unescapeSegmentText,
   unescapeSpeakerLabel
 } from "./chunk-UHVXE24Y.js";
+import {
+  TombstoneStore,
+  applyTombstoneResurrectionGate,
+  buildRetiredFactTombstoneInputs,
+  collectRetiredMemoriesForRebuild
+} from "./chunk-46WM6JX2.js";
 import {
   normalizeQmdResultPath
-} from "./chunk-TZ44E732.js";
+} from "./chunk-AIVRD66I.js";
 import {
   withholdToolScopedFromSharedNamespace
 } from "./chunk-S2V7RUCL.js";
@@ -30,7 +30,7 @@ import {
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
-} from "./chunk-MDIEES23.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -57,7 +57,7 @@ import {
 import {
   parseFaithfulnessField,
   serializeFaithfulnessFields
-} from "./chunk-3XPN7AVY.js";
+} from "./chunk-ZYSOT6HD.js";
 import {
   DeletionRevisionStore,
   TombstoneBlockedCaptureIndexHost,
@@ -114,11 +114,6 @@ import {
   normalizeSupersessionKey,
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
-import {
-  composeMemoryEnvelope,
-  isSealedMemoryEnvelope,
-  sealedWriteToLegacyArgs
-} from "./chunk-GDYU6VF4.js";
 import {
   clearMemoryCache,
   getCachedEntities,
@@ -155,11 +150,16 @@ import {
 import {
   selectArtifactMatches
 } from "./chunk-Z7L72ZHL.js";
+import {
+  composeMemoryEnvelope,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+} from "./chunk-GDYU6VF4.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitationForTemplate,
   stripCitationForTemplate
-} from "./chunk-TG3FAM2S.js";
+} from "./chunk-JL4TQYM5.js";
 import {
   ProjectionLedgerLagManager,
   appendLifecycleEventsSerialized,
@@ -174,7 +174,7 @@ import {
   readMemoryActionEventRowsFromLines,
   readProjectionRebuiltAt,
   serializeLifecycleAppendPayload
-} from "./chunk-TBXAY2SS.js";
+} from "./chunk-SGHGCFVV.js";
 import {
   assertMemoryFrontmatterId,
   warnProjectionFallback
@@ -187,18 +187,18 @@ import {
   readProjectedMemoryTimeline,
   updateProjectedMemoryPath
 } from "./chunk-AL3UYZ5N.js";
-import {
-  assertPathInsideRoot,
-  pathIsInside
-} from "./chunk-C7HJ3NEI.js";
 import {
   isSupportPassportPrivateMemory
-} from "./chunk-37CAEC7E.js";
+} from "./chunk-PWPIERBM.js";
 import {
   inferMemoryStatus,
   isArchivedMemoryPath,
   toMemoryPathRel
 } from "./chunk-7RJUVTVF.js";
+import {
+  assertPathInsideRoot,
+  pathIsInside
+} from "./chunk-C7HJ3NEI.js";
 import {
   CONTENT_HASH_INDEX_RETRY_MAX_DELAY_MS,
   ContentHashIndex,
@@ -218,15 +218,15 @@ import {
 import {
   sanitizeMemoryContent
 } from "./chunk-5GKPFL3S.js";
+import {
+  parseFlexibleIsoTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-JUOZ62Y7.js";
-import {
-  parseFlexibleIsoTimestamp
-} from "./chunk-P7FMDTKL.js";
 import {
   isAbortError,
   raceAbort
@@ -11874,4 +11874,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-MVG3KXON.js.map
+//# sourceMappingURL=chunk-I65KB36L.js.map

package/dist/chunk-IFBSZGW3.js

@@ -0,0 +1,42 @@
+// src/shared-context/write-output-controls.ts
+var CONTROL_FIELDS = ["authority", "expiresAt", "supersedes"];
+var SERVER_RESOLVED_FIELDS = ["principal", "namespace"];
+function parseSharedWriteOutputControls(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const record = raw;
+  for (const field of SERVER_RESOLVED_FIELDS) {
+    if (Object.hasOwn(record, field) && record[field] !== void 0) {
+      throw new Error(
+        `shared-context write output: ${field} is server-resolved and cannot be supplied by the caller`
+      );
+    }
+  }
+  const controls = {};
+  for (const field of CONTROL_FIELDS) {
+    const value = record[field];
+    if (value === void 0) continue;
+    if (typeof value !== "string") {
+      throw new Error(`shared-context write output: ${field} must be a string`);
+    }
+    if (value.trim().length === 0) {
+      throw new Error(`shared-context write output: ${field} must be a non-empty string`);
+    }
+    controls[field] = value;
+  }
+  return controls;
+}
+var WRITE_INPUT_PREFIXES = [
+  "shared-context write origin mismatch",
+  "applyDefaultEnvelope:",
+  "composeWriteEnvelope:",
+  "shared-context write output:"
+];
+function isSharedContextWriteInputError(message) {
+  return WRITE_INPUT_PREFIXES.some((prefix) => message.startsWith(prefix));
+}
+
+export {
+  parseSharedWriteOutputControls,
+  isSharedContextWriteInputError
+};
+//# sourceMappingURL=chunk-IFBSZGW3.js.map

package/dist/chunk-IFBSZGW3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/shared-context/write-output-controls.ts"],"sourcesContent":["/**\n * Canonical client-input parse for shared-context write-output envelope\n * controls (issue #2920).\n *\n * One module feeds BOTH documented surfaces — the Access MCP\n * `shared_context_write_output` operation and the OpenClaw\n * `shared_context_write_output` tool — so surface policy can never drift.\n * This layer owns only what is a SURFACE concern: field type/shape and the\n * rejection of client-supplied identity. Semantic validation (authority\n * allow-list, the binding gate, strict ISO instants, the future/TTL expiry\n * policy, id shape) stays in `composeWriteEnvelope`, the single write-side\n * gate every path already routes through — there is no in-process bypass\n * with looser rules than the tool surfaces.\n */\n\nexport interface SharedWriteOutputControls {\n  authority?: string;\n  expiresAt?: string;\n  supersedes?: string;\n}\n\nconst CONTROL_FIELDS = [\"authority\", \"expiresAt\", \"supersedes\"] as const;\n\n/** Server-resolved fields a caller must never supply (issue #2920). */\nconst SERVER_RESOLVED_FIELDS = [\"principal\", \"namespace\"] as const;\n\n/**\n * Parse the optional envelope controls off a raw client request.\n *\n * - Absent fields are omitted; a control must be a non-blank string when\n *   present (an explicit empty string is a client error, not \"unspecified\").\n * - A client-supplied `principal` or `namespace` is rejected: identity and\n *   scoping are resolved by the surface, never accepted from the caller.\n *\n * Throws `Error` with a `shared-context write output:` prefix; access\n * surfaces map that to their input-error class.\n */\nexport function parseSharedWriteOutputControls(raw: unknown): SharedWriteOutputControls {\n  if (raw === null || typeof raw !== \"object\" || Array.isArray(raw)) return {};\n  const record = raw as Record<string, unknown>;\n  for (const field of SERVER_RESOLVED_FIELDS) {\n    if (Object.hasOwn(record, field) && record[field] !== undefined) {\n      throw new Error(\n        `shared-context write output: ${field} is server-resolved and cannot be supplied by the caller`,\n      );\n    }\n  }\n  const controls: SharedWriteOutputControls = {};\n  for (const field of CONTROL_FIELDS) {\n    const value = record[field];\n    if (value === undefined) continue;\n    if (typeof value !== \"string\") {\n      throw new Error(`shared-context write output: ${field} must be a string`);\n    }\n    if (value.trim().length === 0) {\n      throw new Error(`shared-context write output: ${field} must be a non-empty string`);\n    }\n    controls[field] = value;\n  }\n  return controls;\n}\n\nconst WRITE_INPUT_PREFIXES = [\n  \"shared-context write origin mismatch\",\n  \"applyDefaultEnvelope:\",\n  \"composeWriteEnvelope:\",\n  \"shared-context write output:\",\n] as const;\n\nexport function isSharedContextWriteInputError(message: string): boolean {\n  return WRITE_INPUT_PREFIXES.some((prefix) => message.startsWith(prefix));\n}\n"],"mappings":";AAqBA,IAAM,iBAAiB,CAAC,aAAa,aAAa,YAAY;AAG9D,IAAM,yBAAyB,CAAC,aAAa,WAAW;AAajD,SAAS,+BAA+B,KAAyC;AACtF,MAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO,CAAC;AAC3E,QAAM,SAAS;AACf,aAAW,SAAS,wBAAwB;AAC1C,QAAI,OAAO,OAAO,QAAQ,KAAK,KAAK,OAAO,KAAK,MAAM,QAAW;AAC/D,YAAM,IAAI;AAAA,QACR,gCAAgC,KAAK;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAsC,CAAC;AAC7C,aAAW,SAAS,gBAAgB;AAClC,UAAM,QAAQ,OAAO,KAAK;AAC1B,QAAI,UAAU,OAAW;AACzB,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,gCAAgC,KAAK,mBAAmB;AAAA,IAC1E;AACA,QAAI,MAAM,KAAK,EAAE,WAAW,GAAG;AAC7B,YAAM,IAAI,MAAM,gCAAgC,KAAK,6BAA6B;AAAA,IACpF;AACA,aAAS,KAAK,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,IAAM,uBAAuB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,+BAA+B,SAA0B;AACvE,SAAO,qBAAqB,KAAK,CAAC,WAAW,QAAQ,WAAW,MAAM,CAAC;AACzE;","names":[]}

package/dist/{chunk-SFHLQPBF.js → chunk-IUTYNDFS.js}

@@ -8,10 +8,13 @@ import {
 } from "./chunk-MPC7TYTZ.js";
 import {
   importCapsule
-} from "./chunk-ZHXSOMYH.js";
+} from "./chunk-VVX5PZFS.js";
+import {
+  isSharedContextWriteInputError
+} from "./chunk-IFBSZGW3.js";
 import {
   UNATTRIBUTED_ACCESS_WRITE_ORIGIN
-} from "./chunk-CC37E3QM.js";
+} from "./chunk-QKCXRS5A.js";
 import {
   ACTIVE_DECISION_STATUSES,
   CodegraphRuntimeError,
@@ -29,22 +32,16 @@ import {
   parseDecisionRecord,
   resolveCodegraphProjectId,
   serializeDecisionRecord
-} from "./chunk-2J3V5QEO.js";
+} from "./chunk-C3QXITIP.js";
 import {
   WHO_KNOWS_DEFAULT_LIMIT,
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-RDLPFM7I.js";
+} from "./chunk-XJLTQTAO.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
-import {
-  trustResultFor
-} from "./chunk-GNVZQ5JN.js";
-import {
-  renderEpistemicHedge
-} from "./chunk-YN2UN7N3.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -54,27 +51,33 @@ import {
   seedTrustZoneDemoDataset,
   summarizeTrustZonePromotionReadiness
 } from "./chunk-ROBHL3GL.js";
+import {
+  trustResultFor
+} from "./chunk-GNVZQ5JN.js";
+import {
+  renderEpistemicHedge
+} from "./chunk-YN2UN7N3.js";
 import {
   summarizeHourlyStatus
-} from "./chunk-AEOOGXMQ.js";
+} from "./chunk-J2MGTGKC.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-P5FPO2BR.js";
 import {
   isSearchExcludedPath
-} from "./chunk-NVVZPBKI.js";
+} from "./chunk-46FVFU7S.js";
 import {
   decideDisclosureEscalation
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-KOTG3RXE.js";
+} from "./chunk-AUSRUOMQ.js";
 import {
   estimateRecallTokens
-} from "./chunk-BXIJSPCL.js";
+} from "./chunk-Q62GA5U2.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-LKFVVN7R.js";
+} from "./chunk-WNPRRBOE.js";
 import {
   ReplicaDivergenceMonitor
 } from "./chunk-CVILPI77.js";
@@ -95,7 +98,7 @@ import {
 } from "./chunk-HWLIMQE2.js";
 import {
   readProjectedHarmonicGraph
-} from "./chunk-IOPIGX7Y.js";
+} from "./chunk-OP722LOG.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
@@ -110,7 +113,7 @@ import {
 } from "./chunk-NLE6TSLG.js";
 import {
   LocalLlmClient
-} from "./chunk-G2XZFGYN.js";
+} from "./chunk-WGZHSQDV.js";
 import {
   REDACTION_RULES_SUBDIR
 } from "./chunk-LTHVM4XN.js";
@@ -118,7 +121,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-HIP6DKJJ.js";
+} from "./chunk-LQVXSRAJ.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -129,24 +132,16 @@ import {
 } from "./chunk-7ZNJN5WZ.js";
 import {
   callDeepRecallPolicyLlm
-} from "./chunk-ZRMMXWYI.js";
+} from "./chunk-YR5QT4SR.js";
 import {
   renderDeepRecallResult
 } from "./chunk-RF2SMMPP.js";
 import {
   createDeepRecallSeedSearch
-} from "./chunk-OEDW4ER7.js";
+} from "./chunk-AJBWVDRV.js";
 import {
   runBudgetedDeepRecall
-} from "./chunk-SV4Z2S67.js";
-import {
-  CorpusWatermarkCache,
-  computeServiceCorpusCensus
-} from "./chunk-VQWBUPSJ.js";
-import {
-  CrossNamespaceBudget,
-  toBudgetWarning
-} from "./chunk-UFGFMWAD.js";
+} from "./chunk-WUUGE7QC.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -154,10 +149,18 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-2SKMZUOW.js";
+} from "./chunk-U26LB4WA.js";
+import {
+  CorpusWatermarkCache,
+  computeServiceCorpusCensus
+} from "./chunk-JMAP6L6Q.js";
+import {
+  CrossNamespaceBudget,
+  toBudgetWarning
+} from "./chunk-UFGFMWAD.js";
 import {
   ExtractionDeadlineError
-} from "./chunk-IMBQFHRV.js";
+} from "./chunk-BPXJINHW.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
@@ -167,21 +170,21 @@ import {
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-VQYWKCDR.js";
+} from "./chunk-HPMCKAET.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-MVG3KXON.js";
+} from "./chunk-I65KB36L.js";
 import {
   namespaceCollectionName
-} from "./chunk-TZ44E732.js";
+} from "./chunk-AIVRD66I.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-MDIEES23.js";
+} from "./chunk-WN2OXGGH.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -203,21 +206,9 @@ import {
 import {
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
-import {
-  STRUCTURED_ATTRIBUTE_LIMITS,
-  buildAccessWriteRequestFingerprint,
-  buildObserveRequestFingerprint,
-  composeMemoryEnvelope,
-  isMemoryCategory
-} from "./chunk-GDYU6VF4.js";
-import {
-  applyTagFilter,
-  normalizeTags,
-  parseTagMatch
-} from "./chunk-BT7NVCML.js";
 import {
   FallbackLlmClient
-} from "./chunk-THTF2W7M.js";
+} from "./chunk-TRTLWUDD.js";
 import {
   CORRECTION_TEXT_MAX,
   CorrectionContractError,
@@ -232,7 +223,7 @@ import {
 } from "./chunk-FEHIOYML.js";
 import {
   formatSupersededPrefix
-} from "./chunk-NETQXOPY.js";
+} from "./chunk-EH3HNCAM.js";
 import {
   ExtractionLivenessWarnThrottle,
   computeExtractionLivenessStatus
@@ -246,9 +237,6 @@ import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
 } from "./chunk-L63GFNKL.js";
-import {
-  computePromotionCandidates
-} from "./chunk-VYCOJKSX.js";
 import {
   extractJsonCandidates
 } from "./chunk-RGMVMVMF.js";
@@ -265,12 +253,43 @@ import {
   wearablesTranscriptMemories,
   wearablesTranscriptSearch
 } from "./chunk-SYOIVK7K.js";
+import {
+  splitCanonicalWriteRequest
+} from "./chunk-RSSLDMFX.js";
+import {
+  applyBriefingLocationContext,
+  daySummaryAutoOptions
+} from "./chunk-UDAUULK2.js";
+import {
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  composeMemoryEnvelope,
+  isMemoryCategory
+} from "./chunk-GDYU6VF4.js";
+import {
+  applyTagFilter,
+  normalizeTags,
+  parseTagMatch
+} from "./chunk-BT7NVCML.js";
+import {
+  computePromotionCandidates
+} from "./chunk-VYCOJKSX.js";
+import {
+  reapplyCategoryCoercion
+} from "./chunk-ZOGKZ2XT.js";
+import {
+  exportCapsule
+} from "./chunk-VDX2J7OX.js";
+import {
+  evaluateActionConfidence
+} from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-23HFXQ5J.js";
+} from "./chunk-6EGIQEKC.js";
 import {
   offlineSyncStorageForSnapshot
-} from "./chunk-XVDZFTN5.js";
+} from "./chunk-RFIJH2OE.js";
 import {
   resolveScopePlan,
   resolveScopedWritableNamespaceValue,
@@ -280,9 +299,6 @@ import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
 } from "./chunk-MNIPH6LD.js";
-import {
-  writeFileAtomically
-} from "./chunk-AW4QUFQF.js";
 import {
   getMemoryProjectionPath
 } from "./chunk-AL3UYZ5N.js";
@@ -311,12 +327,22 @@ import {
   encodeSupportPassportNamespaceAttributes,
   isSupportPassportPrivateMemory,
   projectSupportPassportCard
-} from "./chunk-37CAEC7E.js";
+} from "./chunk-PWPIERBM.js";
 import {
   inferMemoryStatus,
   isActiveMemoryStatus,
   toMemoryPathRel
 } from "./chunk-7RJUVTVF.js";
+import {
+  assertOperationAuthorizationAllowed,
+  capabilityAllowsOp,
+  enforceNamespaceAllowList,
+  isNamespaceAllowed,
+  tokenCapabilityStore
+} from "./chunk-MZWSOLMT.js";
+import {
+  writeFileAtomically
+} from "./chunk-AW4QUFQF.js";
 import {
   computeContentHash
 } from "./chunk-5FVVY2EB.js";
@@ -335,12 +361,24 @@ import {
   isHandleToken
 } from "./chunk-JAKIDQB2.js";
 import {
-  assertOperationAuthorizationAllowed,
-  capabilityAllowsOp,
-  enforceNamespaceAllowList,
-  isNamespaceAllowed,
-  tokenCapabilityStore
-} from "./chunk-MZWSOLMT.js";
+  OFFLINE_SYNC_SNAPSHOT_FORMAT,
+  applyOfflineSyncChangeset,
+  applyOfflineSyncFileContentChunk,
+  buildOfflineSyncSnapshot,
+  buildOfflineSyncSnapshotForPaths,
+  buildOfflineSyncSnapshotFromBase,
+  compileOfflineSyncExcludeGlobs,
+  filterOfflineSyncDeletionRevisions,
+  iterateOfflineSyncSnapshotFileRecords,
+  normalizeOfflineSyncChangeset,
+  readOfflineSyncFileContentChunk
+} from "./chunk-WQZZDN5M.js";
+import {
+  validateArchiveRelativePath
+} from "./chunk-GCGJW34D.js";
+import {
+  parseIsoOffsetTimestamp
+} from "./chunk-P7FMDTKL.js";
 import {
   defaultNamespaceAtFlatRoot,
   memorySearchThroughScope,
@@ -383,37 +421,6 @@ import {
   ObserveTranscriptPersister,
   observeTranscriptSessionKey
 } from "./chunk-T2JSUEH6.js";
-import {
-  splitCanonicalWriteRequest
-} from "./chunk-ZZCR2QYL.js";
-import {
-  reapplyCategoryCoercion
-} from "./chunk-ZX3AYNNV.js";
-import {
-  exportCapsule
-} from "./chunk-KQAFEZQX.js";
-import {
-  evaluateActionConfidence
-} from "./chunk-Z2YFLXHU.js";
-import {
-  OFFLINE_SYNC_SNAPSHOT_FORMAT,
-  applyOfflineSyncChangeset,
-  applyOfflineSyncFileContentChunk,
-  buildOfflineSyncSnapshot,
-  buildOfflineSyncSnapshotForPaths,
-  buildOfflineSyncSnapshotFromBase,
-  compileOfflineSyncExcludeGlobs,
-  filterOfflineSyncDeletionRevisions,
-  iterateOfflineSyncSnapshotFileRecords,
-  normalizeOfflineSyncChangeset,
-  readOfflineSyncFileContentChunk
-} from "./chunk-WQZZDN5M.js";
-import {
-  validateArchiveRelativePath
-} from "./chunk-GCGJW34D.js";
-import {
-  parseIsoOffsetTimestamp
-} from "./chunk-P7FMDTKL.js";
 import {
   AccessIdempotencyStore,
   hashAccessIdempotencyPayload
@@ -450,7 +457,7 @@ import {
 } from "./chunk-B6O2YLUR.js";
 import {
   AccessAuditAdapter
-} from "./chunk-TVVEYCNW.js";
+} from "./chunk-7K5Q6COX.js";
 import {
   decodeCitationNamespace
 } from "./chunk-YRLHEEQT.js";
@@ -6851,7 +6858,7 @@ var AccessObserveWriteSurface = class {
     const format = request.format === "json" ? "json" : request.format === "markdown" ? "markdown" : config.briefing.defaultFormat;
     const maxFollowups = typeof request.maxFollowups === "number" && Number.isFinite(request.maxFollowups) ? Math.max(0, Math.min(10, Math.floor(request.maxFollowups))) : config.briefing.maxFollowups;
     const calendarSource = config.briefing.calendarSource ? new FileCalendarSource(config.briefing.calendarSource) : void 0;
-    const result = await buildBriefing({
+    const result = await applyBriefingLocationContext(await buildBriefing({
       storage,
       namespace,
       window,
@@ -6867,7 +6874,7 @@ var AccessObserveWriteSurface = class {
       // other LLM feature uses. A configured key keeps its precedence so
       // existing deployments are unchanged.
       followupGenerator: config.openaiApiKey ? void 0 : this.deps.orchestrator.briefingChainFollowupGenerator
-    });
+    }), request.includeLocation, storage.dir, window.from.toISOString(), config.location);
     return {
       format,
       window: result.window,
@@ -15095,9 +15102,7 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     const memories = (request.memories ?? "").trim();
     const namespace = this.resolveRecallNamespace(request.namespace, request.sessionKey);
     if (memories.length === 0) {
-      return this.orchestrator.generateDaySummaryAuto(namespace, {
-        timeZone: request.timeZone
-      });
+      return this.orchestrator.generateDaySummaryAuto(namespace, daySummaryAutoOptions(request));
     }
     return this.orchestrator.generateDaySummary(memories);
   }
@@ -15347,11 +15352,13 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
     const result = await runBudgetedDeepRecall(
       {
         config: effective,
+        ...request.abortSignal ? { signal: request.abortSignal } : {},
         searchSeed: createDeepRecallSeedSearch({
           namespace: resolvedNamespace,
           storage,
           router: this.orchestrator,
-          resolver: this.orchestrator.qmdResultResolver
+          resolver: this.orchestrator.qmdResultResolver,
+          ...request.abortSignal ? { signal: request.abortSignal } : {}
         }),
         // Nodes and anchors are projected against the namespace's CURRENT
         // active memories through the SAME helper searchHarmonicRetrieval
@@ -15362,7 +15369,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
         loadGraph: async () => readProjectedHarmonicGraph({
           memoryDir: storage.dir,
           abstractionNodeStoreDir: graphStoreDir,
-          anchorsEnabled: true
+          anchorsEnabled: true,
+          ...request.abortSignal ? { abortSignal: request.abortSignal } : {}
         }),
         loadMemory: async (memoryId) => {
           const memory = await storage.getMemoryById(memoryId);
@@ -15379,7 +15387,8 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
           config,
           localLlm: this.orchestrator.localLlm ?? null,
           fallbackLlm: this.orchestrator.fastGatewayLlm ?? null,
-          timeoutMs
+          timeoutMs,
+          ...request.abortSignal ? { signal: request.abortSignal } : {}
         })
       },
       query
@@ -16598,17 +16607,14 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
         agentId: request.agentId,
         title: request.title,
         content: request.content,
-        // The origin is server-owned in BOTH cases (issue #1957 review
-        // round 4): the authenticated principal when one resolved, and a
-        // reserved unattributed token otherwise — a principal-less
-        // authenticated request must never stamp the client's `agentId`
-        // as audit metadata. The client label survives only as the
-        // producer, which feeds grouping and display, never authority.
+        authority: request.authority,
+        expiresAt: request.expiresAt,
+        supersedes: request.supersedes,
         ...request.principal ? { authenticatedIdentity: request.principal } : { unattributedOrigin: UNATTRIBUTED_ACCESS_WRITE_ORIGIN }
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (message.startsWith("shared-context write origin mismatch")) {
+      if (isSharedContextWriteInputError(message)) {
         throw new EngramAccessInputError(message);
       }
       throw error;
@@ -17982,4 +17988,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-SFHLQPBF.js.map
+//# sourceMappingURL=chunk-IUTYNDFS.js.map