@remnic/core 9.7.14 → 9.8.0

package/dist/verified-recall.js

@@ -1,55 +1,65 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-67ZCJLJY.js";
-import "./chunk-2A3OXAP2.js";
-import "./chunk-ZBJMUXZH.js";
-import "./chunk-7ICYQUOL.js";
-import "./chunk-L2B3EE7B.js";
+} from "./chunk-MYFQ3ED4.js";
+import "./chunk-B7RWBZXW.js";
+import "./chunk-4BJQODZF.js";
 import "./chunk-B3ABVQ36.js";
-import "./chunk-5UZXUTVO.js";
-import "./chunk-VSMRDBFT.js";
-import "./chunk-LTJAMRGI.js";
-import "./chunk-EHK6KZHK.js";
+import "./chunk-2QMKMVHH.js";
+import "./chunk-DEBHXHJR.js";
+import "./chunk-DNHVPZOD.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-J6A3CX5N.js";
-import "./chunk-4KJLYTLS.js";
-import "./chunk-SVOZFLIQ.js";
-import "./chunk-B3F4CWQR.js";
-import "./chunk-RULE4VG5.js";
-import "./chunk-SCU65EZI.js";
-import "./chunk-RHOZ5LLO.js";
+import "./chunk-V57NLO5P.js";
+import "./chunk-FF4KLI5W.js";
+import "./chunk-YVKF3HEW.js";
+import "./chunk-AVPXXV6J.js";
+import "./chunk-EGGE52UU.js";
+import "./chunk-GCASGYIO.js";
+import "./chunk-WL5EBRDH.js";
+import "./chunk-347WD2LE.js";
 import "./chunk-RL6NEVXT.js";
+import "./chunk-ILGC6JH6.js";
+import "./chunk-SCU65EZI.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-VA4WSW54.js";
+import "./chunk-CGASUJVP.js";
+import "./chunk-R3DJVOSM.js";
+import "./chunk-BT7NVCML.js";
+import "./chunk-JYIJNNN3.js";
 import "./chunk-AAD2ZS6P.js";
 import "./chunk-G7D6GZ5J.js";
-import "./chunk-VZ5OJE4X.js";
-import "./chunk-OKUEZOGW.js";
-import "./chunk-X47LWMKA.js";
+import "./chunk-5VQJBH2G.js";
+import "./chunk-AITCS2RC.js";
+import "./chunk-XMMESCPD.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-PDJTHRAW.js";
 import "./chunk-W5H6ZRPT.js";
-import "./chunk-UXKMMNJD.js";
-import "./chunk-K2ZLHESQ.js";
-import "./chunk-VFSP73LP.js";
+import "./chunk-C23BYTJV.js";
+import "./chunk-QIEUU4UK.js";
 import "./chunk-L2EXJQJP.js";
+import "./chunk-45GF7Y3V.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-OEHCMALU.js";
-import "./chunk-PHK3HARR.js";
-import "./chunk-4DJQYKMN.js";
+import "./chunk-5I4M26Q7.js";
 import "./chunk-5GKPFL3S.js";
+import "./chunk-4DJQYKMN.js";
+import "./chunk-PQVCH2AE.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
-import "./chunk-37CTGERM.js";
-import "./chunk-J2HSAU72.js";
+import "./chunk-6MKAMLQL.js";
+import "./chunk-JAKIDQB2.js";
+import "./chunk-ZBJMUXZH.js";
+import "./chunk-BJMBJZ2Y.js";
+import "./chunk-UKJAGEXH.js";
+import "./chunk-FP2373TW.js";
+import "./chunk-AIK5W3IW.js";
 import "./chunk-A6XUJE5D.js";
+import "./chunk-5UZXUTVO.js";
 import "./chunk-P7FMDTKL.js";
 import "./chunk-VS2IYZRU.js";
-import "./chunk-6MKAMLQL.js";
-import "./chunk-JAKIDQB2.js";
+import "./chunk-SCCO46KZ.js";
+import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {
   compareVerifiedEpisodeResults,

package/dist/write-envelope.d.ts

@@ -0,0 +1,282 @@
+import { w as MemoryCategory } from './types-D_fG2ix8.js';
+import './message-parts/index.js';
+import './bounded-jsonl-state.js';
+import './types-continuity.js';
+
+/**
+ * Sealed memory-write envelope (issue #1989, umbrella #1988).
+ *
+ * THE single stamping point for cross-cutting memory-creation fields.
+ *
+ * Why this exists: PR #1852 needed 27 rework commits because adding one
+ * cross-cutting field (`sourceConnector`) required hand-editing every
+ * write call site and every idempotency payload, and reviewers discovered
+ * missed sites one round at a time. This module removes the fan-out:
+ *
+ *   1. `composeMemoryEnvelope()` is the only way to mint a
+ *      `SealedMemoryEnvelope` — the brand is a non-exported `unique symbol`,
+ *      so a hand-built object literal fails `tsc` (`npm run check-types`
+ *      is already a required repo-wide gate; the type system IS the fence).
+ *   2. `buildWriteIdempotencyPayload()` derives every access-surface
+ *      idempotency payload from ONE ordered field registry
+ *      (`WRITE_FINGERPRINT_FIELDS`). Adding a fingerprint-relevant field is
+ *      a one-line registry change picked up by every surface; forgetting to
+ *      classify a new `MemoryWriteInput` field is a compile error (see the
+ *      exhaustiveness guards at the bottom of this file).
+ *
+ * PR1 scope (no call-site changes): the composer, the registry, and the
+ * payload builder, fully tested. PR2–PR4 migrate storage entry points and
+ * the write call sites onto this module (see #1989 for the slicing).
+ */
+
+/**
+ * Every cross-cutting memory-creation field lives HERE and only here.
+ *
+ * When you add a field you MUST also add it to either
+ * `WRITE_FINGERPRINT_FIELDS` or `FINGERPRINT_EXEMPT_FIELDS` — the
+ * exhaustiveness guard below makes forgetting a compile error.
+ */
+interface MemoryWriteInput {
+    /** Raw memory content. Must be non-empty after trimming. */
+    content: string;
+    /** Memory category — validated against the canonical category set. */
+    category: MemoryCategory;
+    /** Free-form labels; normalized (trim/dedupe) and capped, see TAG_LIMITS. */
+    tags?: string[];
+    /** String→string structured attributes; non-string values are rejected. */
+    structuredAttributes?: Record<string, string>;
+    /** Entity file reference (e.g. `person-jane-doe`). */
+    entityRef?: string;
+    /** Extraction confidence in [0, 1]. */
+    confidence?: number;
+    /** Opaque TTL expression (e.g. `90d` or an ISO date) — validated non-empty. */
+    ttl?: string;
+    /** Event-time validity start (ISO 8601). */
+    validAt?: string;
+    /** Connector identity that produced this write (issue #1852). */
+    sourceConnector?: string;
+    /** Human-readable provenance note. */
+    sourceReason?: string;
+}
+/** Context supplied by the write path, not by the payload author. */
+interface WriteContext {
+    /** Frontmatter `source` string (e.g. `extraction`, `wearable:bee`). */
+    source: string;
+    /** Clock override for tests. */
+    now?: () => Date;
+}
+/** Scope facts that participate in idempotency but never in frontmatter. */
+interface FingerprintScope {
+    /** Access surface performing the write (e.g. `memory_store`, `observe`). */
+    surface: string;
+    namespace?: string;
+    principal?: string;
+    codingContext?: string;
+}
+declare const TAG_LIMITS: Readonly<{
+    /** Maximum number of tags persisted per memory. */
+    maxTags: 50;
+    /** Maximum length of a single tag. */
+    maxTagLength: 256;
+}>;
+declare const STRUCTURED_ATTRIBUTE_LIMITS: Readonly<{
+    /** Maximum number of structured attributes per memory. */
+    maxEntries: 64;
+    /** Maximum length of one attribute key. */
+    maxKeyLength: 128;
+    /** Maximum length of one attribute value. */
+    maxValueLength: 1024;
+}>;
+declare function isMemoryCategory(value: string): value is MemoryCategory;
+declare const sealed: unique symbol;
+/**
+ * A normalized, validated memory-write envelope.
+ *
+ * Opaque: only `composeMemoryEnvelope()` can mint one. Storage creation
+ * entry points accept this type (PR2), so every write path is forced
+ * through the composer at compile time.
+ */
+interface SealedMemoryEnvelope {
+    readonly [sealed]: true;
+    /**
+     * Caller-supplied content VERBATIM (validated non-empty-after-trim).
+     * `StorageManager.writeMemory` persists content byte-for-byte (callers
+     * that trim, e.g. explicit capture, do so before composing), so the
+     * envelope must not transform it — the earlier compose-time trim/sanitize
+     * broke byte-parity with extraction writes and was removed in PR2.
+     */
+    readonly content: string;
+    /**
+     * The exact body persistence will write: attribute-suffix enrichment then
+     * combined sanitization, produced by the SAME `assemblePersistedBody`
+     * helper `writeMemory` uses (issue #1989 PR2; AGENTS.md §13). This is the
+     * form write-idempotency fingerprints hash.
+     */
+    readonly persistedBody: string;
+    /** Injection patterns matched during body assembly (empty = clean). */
+    readonly sanitizeViolations: readonly string[];
+    /**
+     * Salvage-mode hygiene notes (empty in strict mode): each dropped/clamped
+     * invalid optional field is recorded here — visible, never silent
+     * (repo rule 34). Callers persisting machine-generated input log these.
+     */
+    readonly salvageNotes: readonly string[];
+    readonly category: MemoryCategory;
+    readonly tags: readonly string[];
+    /**
+     * CANONICAL attributes (keys trim+lowercase, values trim) — the form
+     * fingerprints and downstream consumers use; stable across caller casing.
+     */
+    readonly structuredAttributes: Readonly<Record<string, string>> | undefined;
+    /**
+     * The validated ORIGINAL attribute map, byte-preserved. `writeMemory`
+     * persists frontmatter attributes raw (canonicalizing only the body
+     * suffix via normalizeAttributePairs) — a pre-existing raw/canonical
+     * inconsistency (supersession keys read the raw form). The sealed path
+     * preserves those bytes; canonicalizing the frontmatter at the storage
+     * boundary is a follow-up once the legacy path retires (#1989 PR4).
+     */
+    readonly rawStructuredAttributes: Readonly<Record<string, string>> | undefined;
+    readonly entityRef: string | undefined;
+    readonly confidence: number | undefined;
+    readonly ttl: string | undefined;
+    readonly validAt: string | undefined;
+    readonly sourceConnector: string | undefined;
+    readonly sourceReason: string | undefined;
+    readonly source: string;
+    /** ISO timestamp the envelope was composed (from ctx.now). */
+    readonly composedAt: string;
+}
+/**
+ * Compose-time input hygiene mode (issue #1989 PR2, review round on #2014).
+ *
+ * - `strict` (default): every invalid field throws — correct for OPERATOR
+ *   and API input (explicit capture, memory_store), where a bad value is a
+ *   caller bug that must surface.
+ * - `salvage`: for MACHINE-GENERATED input (LLM extraction, wearable
+ *   ingestion). One malformed fact from an extractor must not abort a whole
+ *   persistence batch that legacy `writeMemory` would have accepted.
+ *   Invalid tags/attributes/optional fields are DROPPED with a note pushed
+ *   to `envelope.salvageNotes` — visible, never silent (repo rule 34);
+ *   callers log the notes. Content, category, ctx.source, and validAt stay
+ *   FATAL in both modes (legacy writeMemory also throws on bad validAt, and
+ *   a write without valid content/category cannot proceed).
+ */
+interface ComposeEnvelopeOptions {
+    salvage?: boolean;
+}
+/**
+ * Compose (normalize + validate + seal) a memory-write envelope.
+ *
+ * Strict mode (default) throws on any invalid input — never silently
+ * defaults (AGENTS.md §1/§39). Salvage mode (`{ salvage: true }`, for
+ * machine-generated input like LLM extraction) drops invalid OPTIONAL
+ * fields with notes on `envelope.salvageNotes` instead of aborting the
+ * batch; content/category/source/validAt stay fatal in both modes.
+ */
+declare function composeMemoryEnvelope(input: MemoryWriteInput, ctx: WriteContext, opts?: ComposeEnvelopeOptions): SealedMemoryEnvelope;
+/**
+ * Runtime check (belt) — the compile-time brand is the real fence.
+ *
+ * Fast path: WeakSet membership (same module graph). Fallback: RE-COMPOSITION
+ * EQUIVALENCE — Node resolves `@remnic/core` through `dist/` for built
+ * consumers and `src/` for tsx-loaded tests, and each graph gets its OWN
+ * WeakSet, so identity alone would reject genuinely-sealed envelopes that
+ * crossed a build boundary. The structural arm requires frozen DATA-only
+ * properties (no accessors — TOCTOU guard, round 4), then re-runs the
+ * STRICT composer on the candidate's own inputs and demands every envelope
+ * field reproduce exactly (#2014 round 2: shape-only validation admitted
+ * lookalikes with 51 tags or out-of-range confidence). A value that
+ * survives has, by construction, passed every composer invariant, and its
+ * fields cannot change between validation and the write that follows.
+ *
+ * `salvageNotes` is deliberately NOT compared: a legitimately salvage-minted
+ * envelope carries notes while the strict re-composition of its (already
+ * clean) surviving fields yields none. Notes are advisory provenance, not
+ * identity — every load-bearing field is still verified.
+ */
+declare function isSealedMemoryEnvelope(value: unknown): value is SealedMemoryEnvelope;
+/**
+ * The ONE mapping from a sealed envelope (+ extras) to the legacy
+ * `writeMemory(category, content, options)` argument shape. Used by
+ * `StorageManager.writeSealedMemory` AND by test doubles that stub storage —
+ * so mock fidelity (AGENTS.md §21) cannot drift from production.
+ */
+declare function sealedWriteToLegacyArgs(envelope: SealedMemoryEnvelope, extras?: Record<string, unknown>): {
+    category: MemoryCategory;
+    content: string;
+    options: Record<string, unknown>;
+};
+/**
+ * Ordered registry of envelope fields that participate in write-idempotency
+ * fingerprints. Adding a fingerprint-relevant field = one entry here; every
+ * surface that builds its payload via `buildWriteIdempotencyPayload()` picks
+ * it up automatically.
+ */
+declare const WRITE_FINGERPRINT_FIELDS: readonly ["content", "category", "tags", "structuredAttributes", "entityRef", "ttl", "validAt", "sourceConnector"];
+/**
+ * Envelope fields deliberately EXCLUDED from fingerprints. Exempting a field
+ * is a visible, reviewable decision — this list exists so the exhaustiveness
+ * guard can force every new `MemoryWriteInput` field to be classified.
+ */
+declare const FINGERPRINT_EXEMPT_FIELDS: readonly ["confidence", "sourceReason"];
+/** Scope keys always folded into the fingerprint payload. */
+declare const FINGERPRINT_SCOPE_FIELDS: readonly ["surface", "namespace", "principal", "codingContext"];
+/**
+ * Build the canonical write-idempotency payload for a sealed envelope.
+ *
+ * Determinism guarantees (AGENTS.md §26):
+ *   - tags are SORTED in the payload (tag order never changes identity);
+ *   - structured attributes are serialized key-sorted by the existing
+ *     `stableStringify` inside `hashAccessIdempotencyPayload`;
+ *   - the payload shape is versioned (`v: 1`) so a future field-semantics
+ *     change can migrate stored idempotency state explicitly instead of
+ *     silently colliding.
+ *
+ * Feed the result to `hashAccessIdempotencyPayload()` — this module does
+ * not hash so surfaces keep a single hashing implementation.
+ */
+declare function buildWriteIdempotencyPayload(envelope: SealedMemoryEnvelope, scope: FingerprintScope): Record<string, unknown>;
+/** The raw request fields the write surfaces fingerprint (legacy shape). */
+interface AccessWriteFingerprintParts {
+    schemaVersion: number;
+    namespace: string;
+    content: string;
+    category?: string;
+    confidence?: number;
+    tags?: string[];
+    entityRef?: string;
+    ttl?: string;
+    sourceReason?: string;
+    sourceConnector?: string;
+}
+/**
+ * Fingerprint payload for `memory_store` / `suggestion_submit` (write AND
+ * peek paths — both MUST call this so peek can never diverge from the
+ * write it predicts). Key set and values reproduce the historical inline
+ * literals exactly; `hashAccessIdempotencyPayload`'s stableStringify sorts
+ * keys and drops `undefined`, so optional absent fields hash identically
+ * to the old shape.
+ */
+declare function buildAccessWriteRequestFingerprint(parts: AccessWriteFingerprintParts): Record<string, unknown>;
+/** The raw request fields the observe surface fingerprints (legacy shape). */
+interface ObserveFingerprintParts {
+    sessionKey: string;
+    messages: unknown;
+    namespace?: string;
+    skipExtraction?: boolean;
+    authenticatedPrincipal?: string;
+    cwd?: string;
+    projectTag?: string;
+    /** Resolved coding context — `null` (not undefined) when absent, matching the historical literal. */
+    effectiveCodingContext: unknown;
+    sourceConnector?: string;
+}
+/**
+ * Fingerprint payload for `observe` — turn ingestion, not a memory write,
+ * so it fingerprints session/message identity rather than MemoryWriteInput
+ * fields. Shape reproduces the historical inline literal exactly.
+ */
+declare function buildObserveRequestFingerprint(parts: ObserveFingerprintParts): Record<string, unknown>;
+
+export { type AccessWriteFingerprintParts, type ComposeEnvelopeOptions, FINGERPRINT_EXEMPT_FIELDS, FINGERPRINT_SCOPE_FIELDS, type FingerprintScope, type MemoryWriteInput, type ObserveFingerprintParts, STRUCTURED_ATTRIBUTE_LIMITS, type SealedMemoryEnvelope, TAG_LIMITS, WRITE_FINGERPRINT_FIELDS, type WriteContext, buildAccessWriteRequestFingerprint, buildObserveRequestFingerprint, buildWriteIdempotencyPayload, composeMemoryEnvelope, isMemoryCategory, isSealedMemoryEnvelope, sealedWriteToLegacyArgs };

package/dist/write-envelope.js

@@ -0,0 +1,35 @@
+import {
+  FINGERPRINT_EXEMPT_FIELDS,
+  FINGERPRINT_SCOPE_FIELDS,
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  TAG_LIMITS,
+  WRITE_FINGERPRINT_FIELDS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  buildWriteIdempotencyPayload,
+  composeMemoryEnvelope,
+  isMemoryCategory,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+} from "./chunk-CGASUJVP.js";
+import "./chunk-R3DJVOSM.js";
+import "./chunk-BT7NVCML.js";
+import "./chunk-5GKPFL3S.js";
+import "./chunk-JAKIDQB2.js";
+import "./chunk-P7FMDTKL.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  FINGERPRINT_EXEMPT_FIELDS,
+  FINGERPRINT_SCOPE_FIELDS,
+  STRUCTURED_ATTRIBUTE_LIMITS,
+  TAG_LIMITS,
+  WRITE_FINGERPRINT_FIELDS,
+  buildAccessWriteRequestFingerprint,
+  buildObserveRequestFingerprint,
+  buildWriteIdempotencyPayload,
+  composeMemoryEnvelope,
+  isMemoryCategory,
+  isSealedMemoryEnvelope,
+  sealedWriteToLegacyArgs
+};
+//# sourceMappingURL=write-envelope.js.map

package/dist/write-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/write-quarantine.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Dead-letter quarantine for writes rejected by the namespace write-ACL
+ * (issue #1888).
+ *
+ * When `observe` / `memory_store` / `suggestion_submit` fail namespace
+ * authorization, the payload used to be dropped with no recoverable copy: a
+ * client configured with a namespace that matches no policy (and is not the
+ * default/shared namespace) had every write in the window silently destroyed.
+ * The ACL rejection is CORRECT and stays fail-closed; this store only
+ * preserves the payload so it can be replayed after the config is fixed,
+ * following the AGENTS.md "reject loudly but never destroy state" posture
+ * (patterns 14/42).
+ *
+ * Records live OUTSIDE any memory namespace at
+ * `<memoryDir>/state/quarantine/<principalSafe>/<timestamp>-<id>.json`, keyed
+ * by the encoded principal, and are bounded per principal by count and age.
+ * Every path is resolved from `memoryDir` through `resolveSafeStoragePath`, so
+ * a symlinked `state`/`quarantine` cannot redirect writes outside the memory
+ * directory. The store never re-routes a payload into a writable namespace.
+ */
+type QuarantineOperation = "observe" | "memory_store" | "suggestion_submit";
+interface QuarantineEntryInput {
+    operation: QuarantineOperation;
+    /** Authenticated principal the write was attributed to, if any. */
+    principal: string | undefined;
+    /** Namespace the caller attempted to write and was denied. */
+    attemptedNamespace: string;
+    /** The original request payload, preserved verbatim for replay. */
+    payload: unknown;
+    /** ISO timestamp; defaults to now. Injectable for deterministic tests. */
+    timestamp?: string;
+}
+interface QuarantinedRecord {
+    operation: QuarantineOperation;
+    principal: string | null;
+    attemptedNamespace: string;
+    timestamp: string;
+    payload: unknown;
+}
+interface QuarantineCaps {
+    /** Keep at most this many records per principal (newest win). */
+    maxEntriesPerPrincipal: number;
+    /** Drop records older than this many milliseconds. */
+    maxAgeMs: number;
+}
+declare const DEFAULT_QUARANTINE_CAPS: QuarantineCaps;
+declare class WriteQuarantineStore {
+    private readonly caps;
+    private readonly memoryDir;
+    constructor(memoryDir: string, caps?: QuarantineCaps);
+    /** Absolute quarantine root (`<memoryDir>/state/quarantine`). */
+    get root(): string;
+    /**
+     * Resolve a path under the quarantine root, checked for containment and
+     * symlink traversal from `memoryDir` down — so a symlinked `state` or
+     * `quarantine` component that escapes the memory directory is rejected.
+     */
+    private safeDir;
+    /**
+     * Park a rejected write. Returns the absolute path of the record written.
+     * Prunes the principal's bucket to the configured caps afterward.
+     */
+    quarantine(input: QuarantineEntryInput): Promise<string>;
+    /**
+     * All valid, non-expired quarantined records across every principal, oldest
+     * first. Expired records are deleted on read (lazy GC), so an inactive
+     * principal bucket with no follow-up write is still bounded by age.
+     */
+    list(): Promise<QuarantinedRecord[]>;
+    /** Total valid, non-expired quarantined record count across every principal. */
+    count(): Promise<number>;
+    /** lstat (no symlink follow): true only for a real directory. */
+    private isRealDir;
+    private principalDirs;
+    private entryFiles;
+    private pruneDir;
+}
+
+export { DEFAULT_QUARANTINE_CAPS, type QuarantineCaps, type QuarantineEntryInput, type QuarantineOperation, type QuarantinedRecord, WriteQuarantineStore };

package/dist/write-quarantine.js

@@ -0,0 +1,11 @@
+import {
+  DEFAULT_QUARANTINE_CAPS,
+  WriteQuarantineStore
+} from "./chunk-SICXL4MK.js";
+import "./chunk-FF4KLI5W.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DEFAULT_QUARANTINE_CAPS,
+  WriteQuarantineStore
+};
+//# sourceMappingURL=write-quarantine.js.map

package/dist/write-quarantine.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/write-rate-limiter.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Per-principal write rate limiter for the access HTTP surface
+ * (issues #1937 / #2029).
+ *
+ * Extracted from access-http.ts so the limiter is a cohesive unit. Each
+ * principal (authenticated caller identity) gets its own rolling-window
+ * bucket, so one chatty connector cannot starve writes for the others;
+ * requests with no resolved principal share a single global bucket.
+ *
+ * Deliberately transport-agnostic: it never throws `HttpError` — callers
+ * translate a refusal into their own 429. It logs a sampled warning when it
+ * refuses a write, so a sustained limit condition is diagnosable server-side
+ * (previously the refusal was a bare throw with no trace).
+ */
+type Slot = {
+    readonly recordedAt: number;
+};
+declare class WriteRateLimiter {
+    readonly maxRequests: number;
+    readonly windowMs: number;
+    private readonly buckets;
+    private lastLogAt;
+    private suppressed;
+    constructor(maxRequests?: number, windowMs?: number);
+    private key;
+    private prune;
+    /** Prune every bucket to the current window; drop buckets that go empty. */
+    private sweep;
+    /** Live reservation/record count for a principal (test/introspection). */
+    slotsFor(principal?: string): ReadonlyArray<Slot>;
+    /** Total live reservations across all principals (test/introspection). */
+    totalSlots(): number;
+    /** True if a write may proceed for the principal. Logs (sampled) when not. */
+    hasCapacity(principal?: string): boolean;
+    /** Record a committed write against the principal's rolling window. */
+    record(principal?: string): void;
+    /**
+     * Reserve a slot for an in-flight write. Returns a release function, or
+     * `null` when the principal is already at the limit (caller raises its 429).
+     */
+    reserve(principal?: string): (() => void) | null;
+    private logRejected;
+}
+
+export { WriteRateLimiter };

package/dist/write-rate-limiter.js

@@ -0,0 +1,9 @@
+import {
+  WriteRateLimiter
+} from "./chunk-MKQBXQKU.js";
+import "./chunk-3WCASNQZ.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  WriteRateLimiter
+};
+//# sourceMappingURL=write-rate-limiter.js.map

package/dist/write-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.7.14",
+  "version": "9.8.0",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -16,6 +16,11 @@
       "remnic-source": "./src/abort-error.ts",
       "import": "./dist/abort-error.js"
     },
+    "./salvage-envelope": {
+      "types": "./dist/salvage-envelope.d.ts",
+      "remnic-source": "./src/salvage-envelope.ts",
+      "import": "./dist/salvage-envelope.js"
+    },
     "./abort-error.js": {
       "types": "./dist/abort-error.d.ts",
       "remnic-source": "./src/abort-error.ts",
@@ -1655,6 +1660,16 @@
       "remnic-source": "./src/objective-state.ts",
       "import": "./dist/objective-state.js"
     },
+    "./offline-sync-exclude-globs": {
+      "types": "./dist/offline-sync-exclude-globs.d.ts",
+      "remnic-source": "./src/offline-sync-exclude-globs.ts",
+      "import": "./dist/offline-sync-exclude-globs.js"
+    },
+    "./offline-sync-exclude-globs.js": {
+      "types": "./dist/offline-sync-exclude-globs.d.ts",
+      "remnic-source": "./src/offline-sync-exclude-globs.ts",
+      "import": "./dist/offline-sync-exclude-globs.js"
+    },
     "./openai-chat-compat": {
       "types": "./dist/openai-chat-compat.d.ts",
       "remnic-source": "./src/openai-chat-compat.ts",
@@ -2954,6 +2969,26 @@
       "types": "./dist/work/types.d.ts",
       "remnic-source": "./src/work/types.ts",
       "import": "./dist/work/types.js"
+    },
+    "./write-envelope": {
+      "types": "./dist/write-envelope.d.ts",
+      "remnic-source": "./src/write-envelope.ts",
+      "import": "./dist/write-envelope.js"
+    },
+    "./write-envelope.js": {
+      "types": "./dist/write-envelope.d.ts",
+      "remnic-source": "./src/write-envelope.ts",
+      "import": "./dist/write-envelope.js"
+    },
+    "./write-quarantine": {
+      "types": "./dist/write-quarantine.d.ts",
+      "remnic-source": "./src/write-quarantine.ts",
+      "import": "./dist/write-quarantine.js"
+    },
+    "./write-quarantine.js": {
+      "types": "./dist/write-quarantine.d.ts",
+      "remnic-source": "./src/write-quarantine.ts",
+      "import": "./dist/write-quarantine.js"
     }
   },
   "files": [
@@ -3010,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.7.14"
+    "@remnic/coding-graph": "^9.8.0"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {