@remnic/core 9.69.60 → 9.69.63

package/dist/{chunk-C6FQJ52H.js → chunk-G2XTGEGL.js}

@@ -1,6 +1,7 @@
 import {
-  DEFAULT_UNTRUSTED_ORIGINS
-} from "./chunk-6Q3ZTEF6.js";
+  DEFAULT_UNTRUSTED_ORIGINS,
+  HARDENED_UNTRUSTED_ORIGINS
+} from "./chunk-23G5P7TA.js";
 import {
   coerceBool
 } from "./chunk-PQVCH2AE.js";
@@ -68,27 +69,73 @@ function resolveUntrustedOrigins(value, rawOperatorConfig) {
   }
   return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];
 }
+function validateDefenseMode(value) {
+  if (value === "custom" || value === "off" || value === "fencing" || value === "quarantine" || value === "layered") {
+    return value;
+  }
+  throw new Error(
+    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`
+  );
+}
+function isOperatorAuthored(rawOperatorConfig, key) {
+  return rawOperatorConfig !== void 0 && rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key) && rawOperatorConfig[key] !== void 0 && rawOperatorConfig[key] !== null;
+}
+function resolveMemoryInjectionDefenseMode(value, rawOperatorConfig) {
+  if (isOperatorAuthored(rawOperatorConfig, "memoryInjectionDefenseMode")) {
+    return validateDefenseMode(
+      rawOperatorConfig.memoryInjectionDefenseMode
+    );
+  }
+  const envValue = readEnvVar("REMNIC_MEMORY_INJECTION_DEFENSE_MODE");
+  if (envValue !== void 0 && rawOperatorConfig !== void 0) return validateDefenseMode(envValue);
+  if (value !== void 0 && value !== null) return validateDefenseMode(value);
+  if (envValue !== void 0) return validateDefenseMode(envValue);
+  return "custom";
+}
+function hasExplicitUntrustedOrigins(cfg, rawOperatorConfig) {
+  const configAuthored = rawOperatorConfig === void 0 ? Object.prototype.hasOwnProperty.call(cfg, "untrustedOrigins") : rawOperatorConfig !== null && Object.prototype.hasOwnProperty.call(rawOperatorConfig, "untrustedOrigins");
+  return configAuthored || readEnvVar("REMNIC_UNTRUSTED_ORIGINS") !== void 0;
+}
 function parseSecurityConfig(cfg, rawOperatorConfig) {
+  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(
+    cfg.memoryInjectionDefenseMode,
+    rawOperatorConfig
+  );
+  const customOriginAuthority = resolveSecurityBooleanConfig(
+    cfg.originAuthorityEnabled,
+    rawOperatorConfig,
+    "originAuthorityEnabled",
+    "REMNIC_ORIGIN_AUTHORITY_ENABLED",
+    false
+  );
+  const customInjectionScreen = resolveSecurityBooleanConfig(
+    cfg.injectionScreenEnabled,
+    rawOperatorConfig,
+    "injectionScreenEnabled",
+    "REMNIC_INJECTION_SCREEN_ENABLED",
+    true
+  );
+  const flags = {
+    custom: [customOriginAuthority, customInjectionScreen],
+    off: [false, false],
+    fencing: [true, false],
+    quarantine: [false, true],
+    layered: [true, true]
+  };
+  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];
+  const injectionScreenProfile = memoryInjectionDefenseMode === "custom" ? "default" : "hardened";
+  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);
+  const untrustedOrigins = memoryInjectionDefenseMode !== "custom" && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig) ? [...HARDENED_UNTRUSTED_ORIGINS] : configuredOrigins;
   return {
-    originAuthorityEnabled: resolveSecurityBooleanConfig(
-      cfg.originAuthorityEnabled,
-      rawOperatorConfig,
-      "originAuthorityEnabled",
-      "REMNIC_ORIGIN_AUTHORITY_ENABLED",
-      false
-    ),
-    injectionScreenEnabled: resolveSecurityBooleanConfig(
-      cfg.injectionScreenEnabled,
-      rawOperatorConfig,
-      "injectionScreenEnabled",
-      "REMNIC_INJECTION_SCREEN_ENABLED",
-      true
-    ),
-    untrustedOrigins: resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig)
+    memoryInjectionDefenseMode,
+    originAuthorityEnabled,
+    injectionScreenEnabled,
+    injectionScreenProfile,
+    untrustedOrigins
   };
 }
 
 export {
   parseSecurityConfig
 };
-//# sourceMappingURL=chunk-C6FQJ52H.js.map
+//# sourceMappingURL=chunk-G2XTGEGL.js.map

package/dist/chunk-G2XTGEGL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config-security.ts"],"sourcesContent":["import { coerceBool } from \"./connectors/coerce.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport {\n  DEFAULT_UNTRUSTED_ORIGINS,\n  HARDENED_UNTRUSTED_ORIGINS,\n} from \"./security/origin-authority.js\";\nimport type { MemoryInjectionDefenseMode } from \"./security/types.js\";\nimport type { InjectionScreenProfile } from \"./security/injection-screen.js\";\n\n// Memory-poisoning hardening (#1955): preserve explicit config, but let env\n// values replace schema-materialized defaults from the host config loader.\nfunction resolveSecurityBooleanConfig(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n  flagName: string,\n  envName: string,\n  defaultValue: boolean,\n): boolean {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, flagName) &&\n    rawOperatorConfig[flagName] !== undefined &&\n    rawOperatorConfig[flagName] !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    value === defaultValue;\n  if (!schemaDefaultMaterialized && value !== undefined && value !== null) {\n    return resolveBooleanConfig(value, defaultValue, flagName);\n  }\n  if (rawAuthored) {\n    return resolveBooleanConfig(value ?? rawOperatorConfig?.[flagName], defaultValue, flagName);\n  }\n  const envValue = readEnvVar(envName);\n  return envValue === undefined\n    ? defaultValue\n    : resolveBooleanConfig(envValue, defaultValue, flagName);\n}\n\nfunction resolveBooleanConfig(\n  value: unknown,\n  defaultValue: boolean,\n  keyName: string,\n): boolean {\n  if (value === undefined || value === null) return defaultValue;\n  const coerced = coerceBool(value);\n  if (coerced === undefined) {\n    throw new Error(\n      `${keyName} must be a boolean-like value (true/false/1/0/yes/no/on/off); got ${JSON.stringify(value)}`,\n    );\n  }\n  return coerced;\n}\n\n// Memory-poisoning hardening (#1955): keep origin allow-list parsing in the\n// parser module so config-contract extraction covers this delegated surface.\nfunction resolveUntrustedOrigins(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): string[] {\n  const rawAuthored =\n    rawOperatorConfig !== undefined &&\n    rawOperatorConfig !== null &&\n    Object.prototype.hasOwnProperty.call(rawOperatorConfig, \"untrustedOrigins\") &&\n    rawOperatorConfig.untrustedOrigins !== undefined &&\n    rawOperatorConfig.untrustedOrigins !== null;\n  const schemaDefaultMaterialized =\n    rawOperatorConfig !== undefined &&\n    !rawAuthored &&\n    Array.isArray(value) &&\n    value.length === DEFAULT_UNTRUSTED_ORIGINS.length &&\n    value.every((entry, index) => entry === DEFAULT_UNTRUSTED_ORIGINS[index]);\n  const configValue = schemaDefaultMaterialized ? undefined : value;\n  const fromEnv = configValue === undefined || configValue === null;\n  const envValue = fromEnv ? readEnvVar(\"REMNIC_UNTRUSTED_ORIGINS\") : undefined;\n  const source = fromEnv ? envValue : configValue;\n  if (source === undefined || source === null) return [...DEFAULT_UNTRUSTED_ORIGINS];\n\n  let entries: unknown[];\n  if (Array.isArray(source)) {\n    entries = source;\n  } else if (fromEnv && typeof source === \"string\" && source.trim().length > 0) {\n    const trimmed = source.trim();\n    if (trimmed.startsWith(\"[\")) {\n      try {\n        const parsed: unknown = JSON.parse(trimmed);\n        if (!Array.isArray(parsed)) throw new Error(\"not an array\");\n        entries = parsed;\n      } catch {\n        throw new Error(\"untrustedOrigins must be an array of strings\");\n      }\n    } else {\n      entries = trimmed.split(\",\");\n    }\n  } else {\n    throw new Error(\"untrustedOrigins must be an array of strings\");\n  }\n\n  const normalized: string[] = [];\n  for (const entry of entries) {\n    if (typeof entry !== \"string\") {\n      throw new Error(\"untrustedOrigins must be an array of strings\");\n    }\n    const trimmed = entry.trim();\n    if (trimmed.length > 0) normalized.push(trimmed);\n  }\n  return normalized.length > 0 ? normalized : [...DEFAULT_UNTRUSTED_ORIGINS];\n}\n\nfunction validateDefenseMode(value: unknown): MemoryInjectionDefenseMode {\n  if (\n    value === \"custom\"\n    || value === \"off\"\n    || value === \"fencing\"\n    || value === \"quarantine\"\n    || value === \"layered\"\n  ) {\n    return value;\n  }\n  throw new Error(\n    `memoryInjectionDefenseMode must be custom|off|fencing|quarantine|layered; got ${JSON.stringify(value)}`,\n  );\n}\n\nfunction isOperatorAuthored(\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n  key: string,\n): boolean {\n  return rawOperatorConfig !== undefined\n    && rawOperatorConfig !== null\n    && Object.prototype.hasOwnProperty.call(rawOperatorConfig, key)\n    && (rawOperatorConfig as Record<string, unknown>)[key] !== undefined\n    && (rawOperatorConfig as Record<string, unknown>)[key] !== null;\n}\n\nfunction resolveMemoryInjectionDefenseMode(\n  value: unknown,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): MemoryInjectionDefenseMode {\n  // Precedence: operator-authored config, then the environment, then a\n  // host-materialized schema default. A host that fills in the manifest\n  // default must not shadow an operator's environment override.\n  if (isOperatorAuthored(rawOperatorConfig, \"memoryInjectionDefenseMode\")) {\n    return validateDefenseMode(\n      (rawOperatorConfig as Record<string, unknown>).memoryInjectionDefenseMode,\n    );\n  }\n  const envValue = readEnvVar(\"REMNIC_MEMORY_INJECTION_DEFENSE_MODE\");\n  if (envValue !== undefined && rawOperatorConfig !== undefined) return validateDefenseMode(envValue);\n  if (value !== undefined && value !== null) return validateDefenseMode(value);\n  if (envValue !== undefined) return validateDefenseMode(envValue);\n  return \"custom\";\n}\n\nfunction hasExplicitUntrustedOrigins(\n  cfg: Record<string, unknown>,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): boolean {\n  const configAuthored = rawOperatorConfig === undefined\n    ? Object.prototype.hasOwnProperty.call(cfg, \"untrustedOrigins\")\n    : rawOperatorConfig !== null\n      && Object.prototype.hasOwnProperty.call(rawOperatorConfig, \"untrustedOrigins\");\n  return configAuthored || readEnvVar(\"REMNIC_UNTRUSTED_ORIGINS\") !== undefined;\n}\n\nexport function parseSecurityConfig(\n  cfg: Record<string, unknown>,\n  rawOperatorConfig: Record<string, unknown> | null | undefined,\n): {\n  memoryInjectionDefenseMode: MemoryInjectionDefenseMode;\n  originAuthorityEnabled: boolean;\n  injectionScreenEnabled: boolean;\n  injectionScreenProfile: InjectionScreenProfile;\n  untrustedOrigins: string[];\n} {\n  const memoryInjectionDefenseMode = resolveMemoryInjectionDefenseMode(\n    cfg.memoryInjectionDefenseMode,\n    rawOperatorConfig,\n  );\n  const customOriginAuthority = resolveSecurityBooleanConfig(\n    cfg.originAuthorityEnabled,\n    rawOperatorConfig,\n    \"originAuthorityEnabled\",\n    \"REMNIC_ORIGIN_AUTHORITY_ENABLED\",\n    false,\n  );\n  const customInjectionScreen = resolveSecurityBooleanConfig(\n    cfg.injectionScreenEnabled,\n    rawOperatorConfig,\n    \"injectionScreenEnabled\",\n    \"REMNIC_INJECTION_SCREEN_ENABLED\",\n    true,\n  );\n  const flags = {\n    custom: [customOriginAuthority, customInjectionScreen],\n    off: [false, false],\n    fencing: [true, false],\n    quarantine: [false, true],\n    layered: [true, true],\n  } satisfies Record<MemoryInjectionDefenseMode, readonly [boolean, boolean]>;\n  const [originAuthorityEnabled, injectionScreenEnabled] = flags[memoryInjectionDefenseMode];\n  const injectionScreenProfile: InjectionScreenProfile =\n    memoryInjectionDefenseMode === \"custom\" ? \"default\" : \"hardened\";\n  const configuredOrigins = resolveUntrustedOrigins(cfg.untrustedOrigins, rawOperatorConfig);\n  const untrustedOrigins =\n    memoryInjectionDefenseMode !== \"custom\"\n      && !hasExplicitUntrustedOrigins(cfg, rawOperatorConfig)\n      ? [...HARDENED_UNTRUSTED_ORIGINS]\n      : configuredOrigins;\n  return {\n    memoryInjectionDefenseMode,\n    originAuthorityEnabled,\n    injectionScreenEnabled,\n    injectionScreenProfile,\n    untrustedOrigins,\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAWA,SAAS,6BACP,OACA,mBACA,UACA,SACA,cACS;AACT,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,QAAQ,KAChE,kBAAkB,QAAQ,MAAM,UAChC,kBAAkB,QAAQ,MAAM;AAClC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,UAAU;AACZ,MAAI,CAAC,6BAA6B,UAAU,UAAa,UAAU,MAAM;AACvE,WAAO,qBAAqB,OAAO,cAAc,QAAQ;AAAA,EAC3D;AACA,MAAI,aAAa;AACf,WAAO,qBAAqB,SAAS,oBAAoB,QAAQ,GAAG,cAAc,QAAQ;AAAA,EAC5F;AACA,QAAM,WAAW,WAAW,OAAO;AACnC,SAAO,aAAa,SAChB,eACA,qBAAqB,UAAU,cAAc,QAAQ;AAC3D;AAEA,SAAS,qBACP,OACA,cACA,SACS;AACT,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,QAAW;AACzB,UAAM,IAAI;AAAA,MACR,GAAG,OAAO,qEAAqE,KAAK,UAAU,KAAK,CAAC;AAAA,IACtG;AAAA,EACF;AACA,SAAO;AACT;AAIA,SAAS,wBACP,OACA,mBACU;AACV,QAAM,cACJ,sBAAsB,UACtB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,kBAAkB,KAC1E,kBAAkB,qBAAqB,UACvC,kBAAkB,qBAAqB;AACzC,QAAM,4BACJ,sBAAsB,UACtB,CAAC,eACD,MAAM,QAAQ,KAAK,KACnB,MAAM,WAAW,0BAA0B,UAC3C,MAAM,MAAM,CAAC,OAAO,UAAU,UAAU,0BAA0B,KAAK,CAAC;AAC1E,QAAM,cAAc,4BAA4B,SAAY;AAC5D,QAAM,UAAU,gBAAgB,UAAa,gBAAgB;AAC7D,QAAM,WAAW,UAAU,WAAW,0BAA0B,IAAI;AACpE,QAAM,SAAS,UAAU,WAAW;AACpC,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO,CAAC,GAAG,yBAAyB;AAEjF,MAAI;AACJ,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,cAAU;AAAA,EACZ,WAAW,WAAW,OAAO,WAAW,YAAY,OAAO,KAAK,EAAE,SAAS,GAAG;AAC5E,UAAM,UAAU,OAAO,KAAK;AAC5B,QAAI,QAAQ,WAAW,GAAG,GAAG;AAC3B,UAAI;AACF,cAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,YAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,OAAM,IAAI,MAAM,cAAc;AAC1D,kBAAU;AAAA,MACZ,QAAQ;AACN,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AAAA,IACF,OAAO;AACL,gBAAU,QAAQ,MAAM,GAAG;AAAA,IAC7B;AAAA,EACF,OAAO;AACL,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AAEA,QAAM,aAAuB,CAAC;AAC9B,aAAW,SAAS,SAAS;AAC3B,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,IAAI,MAAM,8CAA8C;AAAA,IAChE;AACA,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,QAAQ,SAAS,EAAG,YAAW,KAAK,OAAO;AAAA,EACjD;AACA,SAAO,WAAW,SAAS,IAAI,aAAa,CAAC,GAAG,yBAAyB;AAC3E;AAEA,SAAS,oBAAoB,OAA4C;AACvE,MACE,UAAU,YACP,UAAU,SACV,UAAU,aACV,UAAU,gBACV,UAAU,WACb;AACA,WAAO;AAAA,EACT;AACA,QAAM,IAAI;AAAA,IACR,iFAAiF,KAAK,UAAU,KAAK,CAAC;AAAA,EACxG;AACF;AAEA,SAAS,mBACP,mBACA,KACS;AACT,SAAO,sBAAsB,UACxB,sBAAsB,QACtB,OAAO,UAAU,eAAe,KAAK,mBAAmB,GAAG,KAC1D,kBAA8C,GAAG,MAAM,UACvD,kBAA8C,GAAG,MAAM;AAC/D;AAEA,SAAS,kCACP,OACA,mBAC4B;AAI5B,MAAI,mBAAmB,mBAAmB,4BAA4B,GAAG;AACvE,WAAO;AAAA,MACJ,kBAA8C;AAAA,IACjD;AAAA,EACF;AACA,QAAM,WAAW,WAAW,sCAAsC;AAClE,MAAI,aAAa,UAAa,sBAAsB,OAAW,QAAO,oBAAoB,QAAQ;AAClG,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO,oBAAoB,KAAK;AAC3E,MAAI,aAAa,OAAW,QAAO,oBAAoB,QAAQ;AAC/D,SAAO;AACT;AAEA,SAAS,4BACP,KACA,mBACS;AACT,QAAM,iBAAiB,sBAAsB,SACzC,OAAO,UAAU,eAAe,KAAK,KAAK,kBAAkB,IAC5D,sBAAsB,QACnB,OAAO,UAAU,eAAe,KAAK,mBAAmB,kBAAkB;AACjF,SAAO,kBAAkB,WAAW,0BAA0B,MAAM;AACtE;AAEO,SAAS,oBACd,KACA,mBAOA;AACA,QAAM,6BAA6B;AAAA,IACjC,IAAI;AAAA,IACJ;AAAA,EACF;AACA,QAAM,wBAAwB;AAAA,IAC5B,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,wBAAwB;AAAA,IAC5B,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,QAAQ;AAAA,IACZ,QAAQ,CAAC,uBAAuB,qBAAqB;AAAA,IACrD,KAAK,CAAC,OAAO,KAAK;AAAA,IAClB,SAAS,CAAC,MAAM,KAAK;AAAA,IACrB,YAAY,CAAC,OAAO,IAAI;AAAA,IACxB,SAAS,CAAC,MAAM,IAAI;AAAA,EACtB;AACA,QAAM,CAAC,wBAAwB,sBAAsB,IAAI,MAAM,0BAA0B;AACzF,QAAM,yBACJ,+BAA+B,WAAW,YAAY;AACxD,QAAM,oBAAoB,wBAAwB,IAAI,kBAAkB,iBAAiB;AACzF,QAAM,mBACJ,+BAA+B,YAC1B,CAAC,4BAA4B,KAAK,iBAAiB,IACpD,CAAC,GAAG,0BAA0B,IAC9B;AACN,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-Q5FL3MEH.js → chunk-G4WZDQ32.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -19,7 +19,7 @@ import {
 import {
   resolveNamespaceCapabilities,
   resolveRecallAuxiliaryCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -412,4 +412,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-Q5FL3MEH.js.map
+//# sourceMappingURL=chunk-G4WZDQ32.js.map

package/dist/{chunk-4HNY6ORZ.js → chunk-GMHWCPLP.js}

@@ -4,7 +4,7 @@ import {
 import {
   computeCorpusWatermarks,
   resolveCorpusNamespaceRoots
-} from "./chunk-YHGRA7CK.js";
+} from "./chunk-CDQO5DCD.js";
 
 // src/operator-doctor-corpus.ts
 var DIGEST_PREFIX_LENGTH = 12;
@@ -78,4 +78,4 @@ export {
   corpusWatermarksFromCheck,
   summarizeCorpusAndReplica
 };
-//# sourceMappingURL=chunk-4HNY6ORZ.js.map
+//# sourceMappingURL=chunk-GMHWCPLP.js.map

package/dist/{chunk-ZWWKKAJL.js → chunk-GYNCJSQ7.js}

@@ -1,9 +1,9 @@
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-Q5FL3MEH.js";
+} from "./chunk-G4WZDQ32.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   composeLocationDayBody,
   composeLocationDayMeta,
@@ -26,7 +26,7 @@ import {
 } from "./chunk-IGEZE6QB.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   readEnvVar
 } from "./chunk-P2QRMMVQ.js";
@@ -728,4 +728,4 @@ export {
   runLocationBackfill,
   runLocationCliCommand
 };
-//# sourceMappingURL=chunk-ZWWKKAJL.js.map
+//# sourceMappingURL=chunk-GYNCJSQ7.js.map

package/dist/{chunk-BJI2D4SU.js → chunk-GZBNEZIU.js}

@@ -1,10 +1,10 @@
 import {
   parseXrayFormat
-} from "./chunk-36S7UHAW.js";
+} from "./chunk-VEBYLZQQ.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-FNQEXI3D.js";
+} from "./chunk-F5O6WEDO.js";
 
 // src/recall-xray-cli.ts
 function parseXrayDisclosureFlag(value) {
@@ -50,4 +50,4 @@ export {
   parseXrayBudgetFlag,
   parseXrayCliOptions
 };
-//# sourceMappingURL=chunk-BJI2D4SU.js.map
+//# sourceMappingURL=chunk-GZBNEZIU.js.map

package/dist/{chunk-NYVECYCF.js → chunk-HNOKNHFO.js}

@@ -1,6 +1,6 @@
 import {
   parseEntityFile
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   inferMemoryStatus
 } from "./chunk-7RJUVTVF.js";
@@ -253,4 +253,4 @@ export {
   WHO_KNOWS_MCP_TOOLS,
   handleWhoKnowsHttpQuery
 };
-//# sourceMappingURL=chunk-NYVECYCF.js.map
+//# sourceMappingURL=chunk-HNOKNHFO.js.map

package/dist/{chunk-XLXYARWC.js → chunk-HXCJF4XU.js}

@@ -1,7 +1,7 @@
 import {
   canReadNamespace,
   defaultNamespaceForPrincipal
-} from "./chunk-MRV7VSQK.js";
+} from "./chunk-Y23L4YJV.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -207,4 +207,4 @@ export {
   runScopedMemorySearch,
   memorySearchThroughScope
 };
-//# sourceMappingURL=chunk-XLXYARWC.js.map
+//# sourceMappingURL=chunk-HXCJF4XU.js.map

package/dist/{chunk-RMF763SX.js → chunk-IDRSTHVR.js}

@@ -4,16 +4,16 @@ import {
 import {
   CONNECTOR_LABEL_MAX_LENGTH,
   knownConnectorIds
-} from "./chunk-BQB5ZMYO.js";
+} from "./chunk-KKNZ7PUZ.js";
 import {
   isValidConnectorId
-} from "./chunk-GK6NOQE6.js";
+} from "./chunk-AERXJCOG.js";
 import {
   deriveSourceConnector
-} from "./chunk-FF2XYADH.js";
+} from "./chunk-FQGY7XB2.js";
 import {
   resolvePipelineProcessingCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 
 // src/source-agent-qualifier.ts
 function resolveSourceConnector(turns) {
@@ -112,4 +112,4 @@ export {
   renderExtractionConversation,
   applyGroundingWithConnector
 };
-//# sourceMappingURL=chunk-RMF763SX.js.map
+//# sourceMappingURL=chunk-IDRSTHVR.js.map

package/dist/{chunk-UXREWVW4.js → chunk-IW3RMBPB.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-OD4FM2U7.js";
 import {
   resolveCompressionCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -283,4 +283,4 @@ export {
   CompressionGuidelineCoordinator,
   formatCompressionGuidelinesForRecall
 };
-//# sourceMappingURL=chunk-UXREWVW4.js.map
+//# sourceMappingURL=chunk-IW3RMBPB.js.map

package/dist/{chunk-W6YK672C.js → chunk-JTTLH646.js}

@@ -1,13 +1,13 @@
 import {
   createSearchBackend
-} from "./chunk-IAZPYX6W.js";
+} from "./chunk-NRVGODSE.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -508,4 +508,4 @@ export {
   NamespaceSearchRouter,
   normalizeQmdResultPath
 };
-//# sourceMappingURL=chunk-W6YK672C.js.map
+//# sourceMappingURL=chunk-JTTLH646.js.map

package/dist/{chunk-BQB5ZMYO.js → chunk-KKNZ7PUZ.js}

@@ -1,7 +1,7 @@
 import {
   BUILTIN_CONNECTORS,
   loadRegistry
-} from "./chunk-GK6NOQE6.js";
+} from "./chunk-AERXJCOG.js";
 
 // src/connectors/label.ts
 var CONNECTOR_LABEL_MAX_LENGTH = 64;
@@ -25,4 +25,4 @@ export {
   CONNECTOR_LABEL_MAX_LENGTH,
   knownConnectorIds
 };
-//# sourceMappingURL=chunk-BQB5ZMYO.js.map
+//# sourceMappingURL=chunk-KKNZ7PUZ.js.map

package/dist/{chunk-AAMFQHKI.js → chunk-KRPMISWO.js}

@@ -1,6 +1,6 @@
 import {
   resolveCorpusNamespaceRoots
-} from "./chunk-YHGRA7CK.js";
+} from "./chunk-CDQO5DCD.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-IG747LRN.js";
@@ -9,7 +9,7 @@ import {
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 
 // src/orchestration/extraction-watermark.ts
 import path from "path";
@@ -200,4 +200,4 @@ async function readAggregateExtractionWatermark(options) {
 export {
   readAggregateExtractionWatermark
 };
-//# sourceMappingURL=chunk-AAMFQHKI.js.map
+//# sourceMappingURL=chunk-KRPMISWO.js.map

package/dist/{chunk-XX2IGMCB.js → chunk-KV44HTMJ.js}

@@ -2,7 +2,7 @@ import {
   WHO_KNOWS_DEFAULT_LIMIT,
   WHO_KNOWS_MAX_LIMIT,
   validateWhoKnowsInput
-} from "./chunk-NYVECYCF.js";
+} from "./chunk-HNOKNHFO.js";
 
 // src/who-knows-cli.ts
 function extractWhoKnowsRawArgs(rest) {
@@ -74,4 +74,4 @@ export {
   renderWhoKnowsText,
   renderWhoKnows
 };
-//# sourceMappingURL=chunk-XX2IGMCB.js.map
+//# sourceMappingURL=chunk-KV44HTMJ.js.map

package/dist/{chunk-FKFTPFUG.js → chunk-KXJ7XYUT.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-FKFTPFUG.js.map
+//# sourceMappingURL=chunk-KXJ7XYUT.js.map

package/dist/{chunk-2NZ7KWRW.js → chunk-LAEW4S43.js}

@@ -1,7 +1,7 @@
 import {
   SUPPORT_PASSPORT_DRAFT_MAX_CONTENT_CHARACTERS,
   SUPPORT_PASSPORT_DRAFT_MAX_MEMORIES
-} from "./chunk-4B5S3VWD.js";
+} from "./chunk-VXGB766B.js";
 import {
   SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH
 } from "./chunk-PWPIERBM.js";
@@ -343,4 +343,4 @@ export {
   parseSupportPassportModelJob,
   SupportPassportModelBridge
 };
-//# sourceMappingURL=chunk-2NZ7KWRW.js.map
+//# sourceMappingURL=chunk-LAEW4S43.js.map

package/dist/{chunk-5SV2GFZX.js → chunk-LDP6LBDS.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-6JMQR72P.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -957,4 +957,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-5SV2GFZX.js.map
+//# sourceMappingURL=chunk-LDP6LBDS.js.map

package/dist/{chunk-F6WCOXTF.js → chunk-LMLPLIT4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-TBBDFYXW.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   bumpMemoryCorpusVersionForDir
 } from "./chunk-XCB6QDL6.js";
@@ -765,4 +765,4 @@ export {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
 };
-//# sourceMappingURL=chunk-F6WCOXTF.js.map
+//# sourceMappingURL=chunk-LMLPLIT4.js.map

package/dist/{chunk-QJTFMH5Y.js → chunk-LVGVXG22.js}

@@ -1,7 +1,7 @@
 import {
   SupportPassportError,
   getOperation
-} from "./chunk-4B5S3VWD.js";
+} from "./chunk-VXGB766B.js";
 import {
   abortError,
   isAbortError
@@ -499,4 +499,4 @@ export {
   buildSupportPassportPublicRequestHandler,
   composeSupportPassportExternalRequestHandlers
 };
-//# sourceMappingURL=chunk-QJTFMH5Y.js.map
+//# sourceMappingURL=chunk-LVGVXG22.js.map

package/dist/{chunk-OINFRHLR.js → chunk-NRTVZSPO.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   getCachedEpisodeMap,
   setCachedEpisodeMap
@@ -109,4 +109,4 @@ export {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
 };
-//# sourceMappingURL=chunk-OINFRHLR.js.map
+//# sourceMappingURL=chunk-NRTVZSPO.js.map

package/dist/{chunk-IAZPYX6W.js → chunk-NRVGODSE.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-WPGR3RW4.js";
 import {
   EmbedHelper
-} from "./chunk-6KTXE6A3.js";
+} from "./chunk-Z4TXB4K7.js";
 import {
   LanceDbBackend
 } from "./chunk-D7MAYFQP.js";
@@ -29,7 +29,7 @@ import {
   resolveIndexingCapabilities,
   resolvePipelineProcessingCapabilities,
   resolveQmdCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -179,4 +179,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-IAZPYX6W.js.map
+//# sourceMappingURL=chunk-NRVGODSE.js.map

package/dist/{chunk-IHOXK2I6.js → chunk-NVKO5YKP.js}

@@ -2,7 +2,7 @@ import {
   isUntrustedOrigin,
   parseOriginClass,
   renderAuthorityFence
-} from "./chunk-6Q3ZTEF6.js";
+} from "./chunk-23G5P7TA.js";
 
 // src/recall-context-composition.ts
 function renderAuthorityBoundContent(content, rawOrigin, options) {
@@ -140,4 +140,4 @@ export {
   composeRecallContext,
   renderMemoryContextPrompt
 };
-//# sourceMappingURL=chunk-IHOXK2I6.js.map
+//# sourceMappingURL=chunk-NVKO5YKP.js.map

package/dist/{chunk-OQQXGYMX.js → chunk-OWYHHW67.js}

@@ -1,14 +1,14 @@
 import {
   expandScopeProfileReadNamespaces,
   resolveScopeProfilePlan
-} from "./chunk-MNIPH6LD.js";
+} from "./chunk-WBYQA3VN.js";
 import {
   canReadNamespace,
   canWriteNamespace,
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal,
   resolvePrincipal
-} from "./chunk-MRV7VSQK.js";
+} from "./chunk-Y23L4YJV.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityLegacyToken,
@@ -17,7 +17,7 @@ import {
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   combineNamespaces,
   lcmReadSessionIdsForNamespaces,
@@ -204,4 +204,4 @@ export {
   resolveWritableNamespaceValue,
   resolveScopedWritableNamespaceValue
 };
-//# sourceMappingURL=chunk-OQQXGYMX.js.map
+//# sourceMappingURL=chunk-OWYHHW67.js.map

package/dist/{chunk-KPKGDQR3.js → chunk-PZEXA6CM.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7T4TOGMS.js";
 import {
   defineOperation
-} from "./chunk-4B5S3VWD.js";
+} from "./chunk-VXGB766B.js";
 
 // src/external-wiki-access.ts
 import { z } from "zod";
@@ -26,4 +26,4 @@ var externalWikiSearchOperation = defineOperation({
 export {
   externalWikiSearchOperation
 };
-//# sourceMappingURL=chunk-KPKGDQR3.js.map
+//# sourceMappingURL=chunk-PZEXA6CM.js.map

package/dist/{chunk-DXODYQ7J.js → chunk-Q3THVX75.js}

@@ -1,6 +1,6 @@
 import {
   ACTIVE_STATUSES
-} from "./chunk-42DJ235G.js";
+} from "./chunk-DINRT75P.js";
 
 // src/recall-why.ts
 var RECALL_WHY_STAGES = Object.freeze(["retrieval", "policy-filter", "rerank", "cap", "format"]);
@@ -316,4 +316,4 @@ export {
   RecallWhyInputError,
   explainRecallMiss
 };
-//# sourceMappingURL=chunk-DXODYQ7J.js.map
+//# sourceMappingURL=chunk-Q3THVX75.js.map

package/dist/{chunk-TAC5WFJC.js → chunk-QEGKMZNQ.js}

@@ -1,9 +1,9 @@
 import {
   NamespaceStorageRouter
-} from "./chunk-Q5FL3MEH.js";
+} from "./chunk-G4WZDQ32.js";
 import {
   namespaceCollectionName
-} from "./chunk-W6YK672C.js";
+} from "./chunk-JTTLH646.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-PCXDUHQH.js";
@@ -13,7 +13,7 @@ import {
 } from "./chunk-VUFL7X3H.js";
 import {
   resolveNamespaceCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -213,4 +213,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-TAC5WFJC.js.map
+//# sourceMappingURL=chunk-QEGKMZNQ.js.map

package/dist/{chunk-VRF2KFI2.js → chunk-RA3C46VX.js}

@@ -1,6 +1,6 @@
 import {
   defineOperation
-} from "./chunk-4B5S3VWD.js";
+} from "./chunk-VXGB766B.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -71,4 +71,4 @@ defineOperation({
     })
   })
 });
-//# sourceMappingURL=chunk-VRF2KFI2.js.map
+//# sourceMappingURL=chunk-RA3C46VX.js.map

package/dist/{chunk-V2HHAAPI.js → chunk-RB776UH3.js}

@@ -6,7 +6,7 @@ import {
   resolveLocalLlmCapabilities,
   resolveMemoryLifecycleCapabilities,
   resolvePipelineProcessingCapabilities
-} from "./chunk-JUOZ62Y7.js";
+} from "./chunk-BMXEBWBT.js";
 import {
   readEnvVar
 } from "./chunk-P2QRMMVQ.js";
@@ -515,4 +515,4 @@ export {
   EmbeddingProviderUnavailableError,
   EmbeddingFallback
 };
-//# sourceMappingURL=chunk-V2HHAAPI.js.map
+//# sourceMappingURL=chunk-RB776UH3.js.map

package/dist/{chunk-TAIIC5OM.js → chunk-SEHKTE4F.js}

@@ -7,10 +7,10 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-F6WCOXTF.js";
+} from "./chunk-LMLPLIT4.js";
 import {
   StorageManager
-} from "./chunk-2T2RF5ZK.js";
+} from "./chunk-5QZHDS4X.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -1005,4 +1005,4 @@ export {
   verifyMemoryProjection,
   repairMemoryProjection
 };
-//# sourceMappingURL=chunk-TAIIC5OM.js.map
+//# sourceMappingURL=chunk-SEHKTE4F.js.map