@remnic/core 9.8.0 → 9.9.0

package/dist/access-admin-ops-surface.d.ts

@@ -1,4 +1,4 @@
-import { E as EngramAccessReviewQueueResponse, A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, b as EngramAccessCapsuleListResponse, M as MemoryPromotionTargetKind, c as MemoryPromotionResult } from './access-service-DEL4qCrc.js';
+import { E as EngramAccessReviewQueueResponse, A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, b as EngramAccessCapsuleListResponse, M as MemoryPromotionTargetKind, c as MemoryPromotionResult } from './access-service-DbZ1G3zV.js';
 import { D as DreamsPhase, a as DreamsRunResult } from './types-D_fG2ix8.js';
 import { GraphSnapshotRequest, GraphSnapshotResponse } from './graph-snapshot.js';
 import { O as Orchestrator } from './orchestrator-CQJ8U7En.js';

package/dist/access-admin-ops-surface.js

@@ -1,11 +1,11 @@
 import {
   AccessAdminOpsSurface
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-boundary.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { F as EngramAccessService } from './access-service-DEL4qCrc.js';
+import { F as EngramAccessService } from './access-service-DbZ1G3zV.js';
 import './catalog-BWqHb5HT.js';
 import './types-D_fG2ix8.js';
 import './message-parts/index.js';

package/dist/access-boundary.js

@@ -9,12 +9,12 @@ import {
   listRegisteredOperations,
   normalizeOptionalPath
 } from "./chunk-KF5EUVKQ.js";
-import "./chunk-TDTXKOAJ.js";
+import "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-cli.js

@@ -1,6 +1,6 @@
 import {
   Orchestrator
-} from "./chunk-2EJOEICD.js";
+} from "./chunk-BI2OJF6J.js";
 import "./chunk-5SB7SC2G.js";
 import "./chunk-I74SUMNI.js";
 import "./chunk-ILNPU5W5.js";
@@ -82,7 +82,7 @@ import "./chunk-6HEM6HTQ.js";
 import "./chunk-6QYST5XN.js";
 import "./chunk-YROFNEG5.js";
 import "./chunk-S2FSBU4H.js";
-import "./chunk-76GLCM57.js";
+import "./chunk-PMUD7ERF.js";
 import "./chunk-MMACM5G2.js";
 import "./chunk-54BGIBCR.js";
 import "./chunk-H4CKS5B2.js";
@@ -179,7 +179,7 @@ import "./chunk-KD3QD3A5.js";
 import "./chunk-MYVPLJOO.js";
 import "./chunk-H3FZVNRN.js";
 import "./chunk-KFZY2OFH.js";
-import "./chunk-IYNGIMVG.js";
+import "./chunk-ZVAYK7GU.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-RKNJBZ55.js";
@@ -192,7 +192,7 @@ import "./chunk-MKQBXQKU.js";
 import "./chunk-CXZQOVIE.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-IDZFBSHN.js";
+import "./chunk-OGCAYLNA.js";
 import "./chunk-OQJIB32H.js";
 import "./chunk-HNZKVLAN.js";
 import "./chunk-EQWEIIKQ.js";
@@ -209,12 +209,12 @@ import {
 } from "./chunk-KF5EUVKQ.js";
 import {
   EngramAccessService
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-http.d.ts

@@ -1,5 +1,5 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { F as EngramAccessService } from './access-service-DEL4qCrc.js';
+import { F as EngramAccessService } from './access-service-DbZ1G3zV.js';
 import { ResolvedIdentity } from './adapters/types.js';
 import { AdapterRegistry } from './adapters/registry.js';
 import { TokenCapabilities } from './access-token-capabilities.js';

package/dist/access-http.js

@@ -1,6 +1,6 @@
 import {
   EngramAccessHttpServer
-} from "./chunk-IYNGIMVG.js";
+} from "./chunk-ZVAYK7GU.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-RKNJBZ55.js";
@@ -13,7 +13,7 @@ import "./chunk-MKQBXQKU.js";
 import "./chunk-CXZQOVIE.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-IDZFBSHN.js";
+import "./chunk-OGCAYLNA.js";
 import "./chunk-OQJIB32H.js";
 import "./chunk-HNZKVLAN.js";
 import "./chunk-EQWEIIKQ.js";
@@ -25,12 +25,12 @@ import "./chunk-T4WDJPEZ.js";
 import "./chunk-2VEOKUPP.js";
 import "./chunk-5RUE3GHQ.js";
 import "./chunk-KF5EUVKQ.js";
-import "./chunk-TDTXKOAJ.js";
+import "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-identity-continuity-surface.js

@@ -1,11 +1,11 @@
 import {
   AccessIdentityContinuitySurface
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-lcm-surface.d.ts

@@ -1,5 +1,5 @@
 import { O as Orchestrator } from './orchestrator-CQJ8U7En.js';
-import { d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse } from './access-service-DEL4qCrc.js';
+import { d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse } from './access-service-DbZ1G3zV.js';
 import './recall-state.js';
 import './utils/serialize-mutations.js';
 import './search/port.js';

package/dist/access-lcm-surface.js

@@ -1,11 +1,11 @@
 import {
   AccessLcmSurface
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-mcp.d.ts

@@ -1,5 +1,5 @@
 import { Readable, Writable } from 'node:stream';
-import { F as EngramAccessService } from './access-service-DEL4qCrc.js';
+import { F as EngramAccessService } from './access-service-DbZ1G3zV.js';
 import './catalog-BWqHb5HT.js';
 import './types-D_fG2ix8.js';
 import './message-parts/index.js';

package/dist/access-mcp.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-CXZQOVIE.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
-import "./chunk-IDZFBSHN.js";
+import "./chunk-OGCAYLNA.js";
 import "./chunk-OQJIB32H.js";
 import "./chunk-HNZKVLAN.js";
 import "./chunk-EQWEIIKQ.js";
@@ -16,12 +16,12 @@ import "./chunk-T4WDJPEZ.js";
 import "./chunk-2VEOKUPP.js";
 import "./chunk-5RUE3GHQ.js";
 import "./chunk-KF5EUVKQ.js";
-import "./chunk-TDTXKOAJ.js";
+import "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-observe-write-surface.d.ts

@@ -1,6 +1,6 @@
 import { ValidExplicitCapture } from './explicit-capture.js';
 import { O as Orchestrator } from './orchestrator-CQJ8U7En.js';
-import { C as CodingScopedWriteInput, f as MemoryScopePlan, g as EngramAccessQmdHealthResponse, h as EngramAccessQmdCollectionState, i as EngramAccessMemoryStoreRequest, j as EngramAccessSuggestionSubmitRequest, k as EngramAccessBriefingRequest, l as EngramAccessBriefingResponse, m as EngramAccessWriteResponse, n as EngramAccessObserveRequest, o as EngramAccessObserveResponse } from './access-service-DEL4qCrc.js';
+import { C as CodingScopedWriteInput, f as MemoryScopePlan, g as EngramAccessQmdHealthResponse, h as EngramAccessQmdCollectionState, i as EngramAccessMemoryStoreRequest, j as EngramAccessSuggestionSubmitRequest, k as EngramAccessBriefingRequest, l as EngramAccessBriefingResponse, m as EngramAccessWriteResponse, n as EngramAccessObserveRequest, o as EngramAccessObserveResponse } from './access-service-DbZ1G3zV.js';
 import './types-D_fG2ix8.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';

package/dist/access-observe-write-surface.js

@@ -1,11 +1,11 @@
 import {
   AccessObserveWriteSurface
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-operations-batch.js

@@ -7,12 +7,12 @@ import "./chunk-35NN3ZFA.js";
 import "./chunk-CEN6DW6X.js";
 import "./chunk-T4WDJPEZ.js";
 import "./chunk-KF5EUVKQ.js";
-import "./chunk-TDTXKOAJ.js";
+import "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-operations.d.ts

@@ -1,6 +1,6 @@
 import { BoundOperation } from './access-boundary.js';
 import { MemoryStoreRequest } from './access-schema.js';
-import { p as ArchitectureSurfaceRequest, q as ArchitectureSurfaceResponse, D as DecisionSurfaceRequest, r as DecisionSurfaceResponse, s as DeltaSurfaceRequest, t as DeltaSurfaceResponse, u as EngramAccessMemoryResponse, m as EngramAccessWriteResponse, v as CodegraphSurfaceRequest, w as CodegraphSurfaceResponse } from './access-service-DEL4qCrc.js';
+import { p as ArchitectureSurfaceRequest, q as ArchitectureSurfaceResponse, D as DecisionSurfaceRequest, r as DecisionSurfaceResponse, s as DeltaSurfaceRequest, t as DeltaSurfaceResponse, u as EngramAccessMemoryResponse, m as EngramAccessWriteResponse, v as CodegraphSurfaceRequest, w as CodegraphSurfaceResponse } from './access-service-DbZ1G3zV.js';
 import 'zod';
 import './catalog-BWqHb5HT.js';
 import './types-D_fG2ix8.js';

package/dist/access-operations.js

@@ -22,7 +22,7 @@ import {
   memoryGetOperation,
   memorySearchOperation,
   memoryStoreOperation
-} from "./chunk-IDZFBSHN.js";
+} from "./chunk-OGCAYLNA.js";
 import "./chunk-OQJIB32H.js";
 import "./chunk-HNZKVLAN.js";
 import "./chunk-EQWEIIKQ.js";
@@ -33,12 +33,12 @@ import "./chunk-CEN6DW6X.js";
 import "./chunk-T4WDJPEZ.js";
 import "./chunk-2VEOKUPP.js";
 import "./chunk-KF5EUVKQ.js";
-import "./chunk-TDTXKOAJ.js";
+import "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-recall-concurrency.d.ts

@@ -1,4 +1,4 @@
-import { x as EngramAccessRecallResponse, y as EngramAccessRecallRequest } from './access-service-DEL4qCrc.js';
+import { x as EngramAccessRecallResponse, y as EngramAccessRecallRequest } from './access-service-DbZ1G3zV.js';
 import { BudgetReservation, CrossNamespaceBudget } from './cross-namespace-budget.js';
 import './catalog-BWqHb5HT.js';
 import './types-D_fG2ix8.js';

package/dist/access-recall-concurrency.js

@@ -5,12 +5,12 @@ import {
   leadRecallFlight,
   raceAbort,
   withRecallConcurrency
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-recall-response.d.ts

@@ -1,5 +1,5 @@
 import { AccessRecallSurfaceDeps } from './access-recall-surface.js';
-import { y as EngramAccessRecallRequest, x as EngramAccessRecallResponse } from './access-service-DEL4qCrc.js';
+import { y as EngramAccessRecallRequest, x as EngramAccessRecallResponse } from './access-service-DbZ1G3zV.js';
 import { BudgetDecision } from './cross-namespace-budget.js';
 import { R as RecallPlanMode, b as RecallDisclosure } from './types-D_fG2ix8.js';
 import './access-audit.js';

package/dist/access-recall-response.js

@@ -1,11 +1,11 @@
 import {
   assembleRecallResponse
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-recall-surface.d.ts

@@ -5,7 +5,7 @@ import { LastRecallSnapshot } from './recall-state.js';
 import { RecallXraySnapshot } from './recall-xray.js';
 import { b as RecallDisclosure, R as RecallPlanMode, M as MemoryFile } from './types-D_fG2ix8.js';
 import { S as StorageManager } from './storage-NIyKYD8g.js';
-import { x as EngramAccessRecallResponse, z as EngramAccessMemorySummary, B as EngramAccessSetCodingContextRequest, y as EngramAccessRecallRequest } from './access-service-DEL4qCrc.js';
+import { x as EngramAccessRecallResponse, z as EngramAccessMemorySummary, B as EngramAccessSetCodingContextRequest, y as EngramAccessRecallRequest } from './access-service-DbZ1G3zV.js';
 import './recall-audit.js';
 import './recall-audit-anomaly.js';
 import './briefing.js';

package/dist/access-recall-surface.js

@@ -1,11 +1,11 @@
 import {
   AccessRecallSurface
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/{access-service-DEL4qCrc.d.ts → access-service-DbZ1G3zV.d.ts}

@@ -1502,11 +1502,10 @@ interface EngramAccessWriteEnvelope {
     idempotencyKey?: string;
     dryRun?: boolean;
     sessionKey?: string;
-    /**
-     * Trusted transport-bound principal. This must never come from untrusted client payloads.
-     * When present, write authorization is evaluated against this principal instead of sessionKey.
-     */
+    /** Trusted transport-bound principal (never from client payloads); authorizes writes instead of sessionKey. */
     authenticatedPrincipal?: string;
+    /** When set, an ACL rejection is NOT dead-lettered (#1888) so `remnic quarantine replay` can re-submit through this same surface without re-quarantining and duplicating the parked record. */
+    readonly suppressQuarantine?: boolean;
 }
 /**
  * Optional git/project context for project-scoped writes (#1434). When no
@@ -1616,6 +1615,7 @@ interface EngramAccessObserveRequest extends SourceConnectorProvenance {
      * Creates a `CodingContext` with `projectId: "tag:<projectTag>"`.
      */
     projectTag?: string;
+    readonly suppressQuarantine?: boolean;
 }
 /**
  * Additive diagnostic view of the effective {@link MemoryScopePlan} resolved for

package/dist/access-service.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, C as CodingScopedWriteInput, L as ENGRAM_ACCESS_WRITE_SCHEMA_VERSION, N as EngramAccessActionConfidenceRequest, O as EngramAccessActionConfidenceResponse, k as EngramAccessBriefingRequest, l as EngramAccessBriefingResponse, b as EngramAccessCapsuleListResponse, Q as EngramAccessDaySummaryRequest, R as EngramAccessEntityListResponse, S as EngramAccessEntityResponse, T as EngramAccessEntitySummary, U as EngramAccessHealthResponse, V as EngramAccessLcmCompactionFlushRequest, W as EngramAccessLcmCompactionFlushResponse, X as EngramAccessLcmCompactionRecordRequest, Y as EngramAccessLcmCompactionRecordResponse, d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse, Z as EngramAccessLcmStatusResponse, _ as EngramAccessMaintenanceResponse, $ as EngramAccessMemoryBrowseRequest, a0 as EngramAccessMemoryBrowseResponse, a1 as EngramAccessMemoryRecord, u as EngramAccessMemoryResponse, i as EngramAccessMemoryStoreRequest, z as EngramAccessMemorySummary, a2 as EngramAccessObserveMessage, n as EngramAccessObserveRequest, o as EngramAccessObserveResponse, a3 as EngramAccessOfflineSyncApplyFileContentRequest, a4 as EngramAccessOfflineSyncApplyFileContentResponse, a5 as EngramAccessOfflineSyncApplyRequest, a6 as EngramAccessOfflineSyncApplyResponse, a7 as EngramAccessOfflineSyncFileContentRequest, a8 as EngramAccessOfflineSyncFileContentResponse, a9 as EngramAccessOfflineSyncFilesRequest, aa as EngramAccessOfflineSyncFilesResponse, ab as EngramAccessOfflineSyncSnapshotRequest, ac as EngramAccessOfflineSyncSnapshotResponse, ad as EngramAccessOfflineSyncSnapshotStreamResponse, h as EngramAccessQmdCollectionState, g as EngramAccessQmdHealthResponse, ae as EngramAccessQualityResponse, af as EngramAccessRecallExplainRequest, ag as EngramAccessRecallExplainResponse, y as EngramAccessRecallRequest, x as EngramAccessRecallResponse, ah as EngramAccessReviewDispositionRequest, ai as EngramAccessReviewDispositionResponse, E as EngramAccessReviewQueueResponse, aj as EngramAccessScopeDebug, F as EngramAccessService, B as EngramAccessSetCodingContextRequest, j as EngramAccessSuggestionSubmitRequest, ak as EngramAccessTimelineResponse, al as EngramAccessTrustZoneBrowseRequest, am as EngramAccessTrustZoneBrowseResponse, an as EngramAccessTrustZoneDemoSeedRequest, ao as EngramAccessTrustZoneDemoSeedResponse, ap as EngramAccessTrustZonePromoteRequest, aq as EngramAccessTrustZonePromoteResponse, ar as EngramAccessTrustZoneRecordSummary, as as EngramAccessTrustZoneStatusResponse, at as EngramAccessWriteEnvelope, m as EngramAccessWriteResponse, f as MemoryScopePlan, au as buildProjectedGovernanceProposedActions, av as hasGroupedGovernanceActions, aw as shapeMemorySummary } from './access-service-DEL4qCrc.js';
+export { A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, C as CodingScopedWriteInput, L as ENGRAM_ACCESS_WRITE_SCHEMA_VERSION, N as EngramAccessActionConfidenceRequest, O as EngramAccessActionConfidenceResponse, k as EngramAccessBriefingRequest, l as EngramAccessBriefingResponse, b as EngramAccessCapsuleListResponse, Q as EngramAccessDaySummaryRequest, R as EngramAccessEntityListResponse, S as EngramAccessEntityResponse, T as EngramAccessEntitySummary, U as EngramAccessHealthResponse, V as EngramAccessLcmCompactionFlushRequest, W as EngramAccessLcmCompactionFlushResponse, X as EngramAccessLcmCompactionRecordRequest, Y as EngramAccessLcmCompactionRecordResponse, d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse, Z as EngramAccessLcmStatusResponse, _ as EngramAccessMaintenanceResponse, $ as EngramAccessMemoryBrowseRequest, a0 as EngramAccessMemoryBrowseResponse, a1 as EngramAccessMemoryRecord, u as EngramAccessMemoryResponse, i as EngramAccessMemoryStoreRequest, z as EngramAccessMemorySummary, a2 as EngramAccessObserveMessage, n as EngramAccessObserveRequest, o as EngramAccessObserveResponse, a3 as EngramAccessOfflineSyncApplyFileContentRequest, a4 as EngramAccessOfflineSyncApplyFileContentResponse, a5 as EngramAccessOfflineSyncApplyRequest, a6 as EngramAccessOfflineSyncApplyResponse, a7 as EngramAccessOfflineSyncFileContentRequest, a8 as EngramAccessOfflineSyncFileContentResponse, a9 as EngramAccessOfflineSyncFilesRequest, aa as EngramAccessOfflineSyncFilesResponse, ab as EngramAccessOfflineSyncSnapshotRequest, ac as EngramAccessOfflineSyncSnapshotResponse, ad as EngramAccessOfflineSyncSnapshotStreamResponse, h as EngramAccessQmdCollectionState, g as EngramAccessQmdHealthResponse, ae as EngramAccessQualityResponse, af as EngramAccessRecallExplainRequest, ag as EngramAccessRecallExplainResponse, y as EngramAccessRecallRequest, x as EngramAccessRecallResponse, ah as EngramAccessReviewDispositionRequest, ai as EngramAccessReviewDispositionResponse, E as EngramAccessReviewQueueResponse, aj as EngramAccessScopeDebug, F as EngramAccessService, B as EngramAccessSetCodingContextRequest, j as EngramAccessSuggestionSubmitRequest, ak as EngramAccessTimelineResponse, al as EngramAccessTrustZoneBrowseRequest, am as EngramAccessTrustZoneBrowseResponse, an as EngramAccessTrustZoneDemoSeedRequest, ao as EngramAccessTrustZoneDemoSeedResponse, ap as EngramAccessTrustZonePromoteRequest, aq as EngramAccessTrustZonePromoteResponse, ar as EngramAccessTrustZoneRecordSummary, as as EngramAccessTrustZoneStatusResponse, at as EngramAccessWriteEnvelope, m as EngramAccessWriteResponse, f as MemoryScopePlan, au as buildProjectedGovernanceProposedActions, av as hasGroupedGovernanceActions, aw as shapeMemorySummary } from './access-service-DbZ1G3zV.js';
 import './storage-NIyKYD8g.js';
 import './types-B1VHaf2w.js';
 import './recall-explain-renderer.js';

package/dist/access-service.js

@@ -4,12 +4,12 @@ import {
   buildProjectedGovernanceProposedActions,
   hasGroupedGovernanceActions,
   shapeMemorySummary
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-AJ7QCSIS.js";
 import "./chunk-VQ7B2Q6M.js";
-import "./chunk-SICXL4MK.js";
+import "./chunk-PJSK6OJM.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JGSKJHF7.js";

package/dist/access-surface-catalog.d.ts

@@ -1,6 +1,6 @@
 import { OperationName } from './access-boundary.js';
 import 'zod';
-import './access-service-DEL4qCrc.js';
+import './access-service-DbZ1G3zV.js';
 import './catalog-BWqHb5HT.js';
 import './types-D_fG2ix8.js';
 import './message-parts/index.js';

package/dist/{chunk-2EJOEICD.js → chunk-BI2OJF6J.js}

@@ -329,7 +329,7 @@ import {
   clusterByKey,
   createCorrectionService,
   detectPassiveCorrections
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import {
   importCapsule
 } from "./chunk-AJ7QCSIS.js";
@@ -24002,4 +24002,4 @@ export {
   blendGraphExpandedRecallScore,
   Orchestrator
 };
-//# sourceMappingURL=chunk-2EJOEICD.js.map
+//# sourceMappingURL=chunk-BI2OJF6J.js.map

package/dist/{chunk-IDZFBSHN.js → chunk-OGCAYLNA.js}

@@ -9,7 +9,7 @@ import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   isCodegraphToolName
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1807,4 +1807,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-IDZFBSHN.js.map
+//# sourceMappingURL=chunk-OGCAYLNA.js.map

package/dist/{chunk-SICXL4MK.js → chunk-PJSK6OJM.js}

@@ -75,12 +75,13 @@ var WriteQuarantineStore = class {
   }
   /**
    * All valid, non-expired quarantined records across every principal, oldest
-   * first. Expired records are deleted on read (lazy GC), so an inactive
-   * principal bucket with no follow-up write is still bounded by age.
+   * first, each paired with its absolute on-disk path. Expired records are
+   * deleted on read (lazy GC), so an inactive principal bucket with no
+   * follow-up write is still bounded by age.
    */
-  async list() {
+  async entries() {
     const now = Date.now();
-    const records = [];
+    const entries = [];
     for (const dir of await this.principalDirs()) {
       for (const file of await this.entryFiles(dir)) {
         const info = await stat(file).catch(() => null);
@@ -96,11 +97,46 @@ var WriteQuarantineStore = class {
         } catch {
           continue;
         }
-        if (isQuarantinedRecord(parsed)) records.push(parsed);
+        if (isQuarantinedRecord(parsed)) entries.push({ record: parsed, path: file });
       }
     }
-    records.sort((a, b) => a.timestamp < b.timestamp ? -1 : a.timestamp > b.timestamp ? 1 : 0);
-    return records;
+    entries.sort((a, b) => {
+      const at = a.record.timestamp;
+      const bt = b.record.timestamp;
+      return at < bt ? -1 : at > bt ? 1 : 0;
+    });
+    return entries;
+  }
+  /** As {@link entries} but projected to records only (backward-compatible view). */
+  async list() {
+    return (await this.entries()).map((entry) => entry.record);
+  }
+  /**
+   * Delete one quarantined entry by its absolute on-disk path (as returned by
+   * {@link entries}). The path MUST resolve inside the quarantine root, mirroring
+   * the store's containment posture; a path outside the root — or one already
+   * absent — removes nothing. Returns true only when a file was actually deleted.
+   */
+  async removeEntry(entryPath) {
+    const rootAbs = path.resolve(this.root);
+    const rel = path.relative(rootAbs, path.resolve(entryPath));
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      return false;
+    }
+    let safe;
+    try {
+      safe = await resolveSafeStoragePath(rootAbs, rel);
+    } catch {
+      return false;
+    }
+    try {
+      await rm(safe, { force: false });
+      return true;
+    } catch (err) {
+      const errno = err;
+      if (errno?.code === "ENOENT") return false;
+      throw err;
+    }
   }
   /** Total valid, non-expired quarantined record count across every principal. */
   async count() {
@@ -162,4 +198,4 @@ export {
   DEFAULT_QUARANTINE_CAPS,
   WriteQuarantineStore
 };
-//# sourceMappingURL=chunk-SICXL4MK.js.map
+//# sourceMappingURL=chunk-PJSK6OJM.js.map

package/dist/chunk-PJSK6OJM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/write-quarantine.ts"],"sourcesContent":["/**\n * Dead-letter quarantine for writes rejected by the namespace write-ACL\n * (issue #1888).\n *\n * When `observe` / `memory_store` / `suggestion_submit` fail namespace\n * authorization, the payload used to be dropped with no recoverable copy: a\n * client configured with a namespace that matches no policy (and is not the\n * default/shared namespace) had every write in the window silently destroyed.\n * The ACL rejection is CORRECT and stays fail-closed; this store only\n * preserves the payload so it can be replayed after the config is fixed,\n * following the AGENTS.md \"reject loudly but never destroy state\" posture\n * (patterns 14/42).\n *\n * Records live OUTSIDE any memory namespace at\n * `<memoryDir>/state/quarantine/<principalSafe>/<timestamp>-<id>.json`, keyed\n * by the encoded principal, and are bounded per principal by count and age.\n * Every path is resolved from `memoryDir` through `resolveSafeStoragePath`, so\n * a symlinked `state`/`quarantine` cannot redirect writes outside the memory\n * directory. The store never re-routes a payload into a writable namespace.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport type { Dirent } from \"node:fs\";\nimport { lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { encodeStoragePathSegment, resolveSafeStoragePath } from \"./storage-paths.js\";\n\nexport type QuarantineOperation = \"observe\" | \"memory_store\" | \"suggestion_submit\";\n\nexport interface QuarantineEntryInput {\n  operation: QuarantineOperation;\n  /** Authenticated principal the write was attributed to, if any. */\n  principal: string | undefined;\n  /** Namespace the caller attempted to write and was denied. */\n  attemptedNamespace: string;\n  /** The original request payload, preserved verbatim for replay. */\n  payload: unknown;\n  /** ISO timestamp; defaults to now. Injectable for deterministic tests. */\n  timestamp?: string;\n}\n\nexport interface QuarantinedRecord {\n  operation: QuarantineOperation;\n  principal: string | null;\n  attemptedNamespace: string;\n  timestamp: string;\n  payload: unknown;\n}\n\n/** A quarantined record paired with the absolute on-disk path it was read from. */\nexport interface QuarantineEntry {\n  record: QuarantinedRecord;\n  path: string;\n}\n\nexport interface QuarantineCaps {\n  /** Keep at most this many records per principal (newest win). */\n  maxEntriesPerPrincipal: number;\n  /** Drop records older than this many milliseconds. */\n  maxAgeMs: number;\n}\n\nexport const DEFAULT_QUARANTINE_CAPS: QuarantineCaps = {\n  maxEntriesPerPrincipal: 500,\n  maxAgeMs: 14 * 24 * 60 * 60 * 1000,\n};\n\nconst QUARANTINE_DIRNAME = \"quarantine\";\n\nfunction validateCaps(caps: QuarantineCaps): void {\n  if (!Number.isInteger(caps.maxEntriesPerPrincipal) || caps.maxEntriesPerPrincipal < 1) {\n    throw new Error(\n      `WriteQuarantineStore: maxEntriesPerPrincipal must be a positive integer (got ${caps.maxEntriesPerPrincipal})`\n    );\n  }\n  if (!Number.isFinite(caps.maxAgeMs) || caps.maxAgeMs <= 0) {\n    throw new Error(\n      `WriteQuarantineStore: maxAgeMs must be a positive finite number of milliseconds (got ${caps.maxAgeMs})`\n    );\n  }\n}\n\nfunction isQuarantinedRecord(value: unknown): value is QuarantinedRecord {\n  if (!value || typeof value !== \"object\") return false;\n  const record = value as Record<string, unknown>;\n  return (\n    (record.operation === \"observe\" ||\n      record.operation === \"memory_store\" ||\n      record.operation === \"suggestion_submit\") &&\n    (record.principal === null || typeof record.principal === \"string\") &&\n    typeof record.attemptedNamespace === \"string\" &&\n    typeof record.timestamp === \"string\" &&\n    \"payload\" in record\n  );\n}\n\nexport class WriteQuarantineStore {\n  private readonly memoryDir: string;\n\n  constructor(\n    memoryDir: string,\n    private readonly caps: QuarantineCaps = DEFAULT_QUARANTINE_CAPS\n  ) {\n    validateCaps(caps);\n    this.memoryDir = path.resolve(memoryDir);\n  }\n\n  /** Absolute quarantine root (`<memoryDir>/state/quarantine`). */\n  get root(): string {\n    return path.join(this.memoryDir, \"state\", QUARANTINE_DIRNAME);\n  }\n\n  /**\n   * Resolve a path under the quarantine root, checked for containment and\n   * symlink traversal from `memoryDir` down — so a symlinked `state` or\n   * `quarantine` component that escapes the memory directory is rejected.\n   */\n  private safeDir(...segments: string[]): Promise<string> {\n    return resolveSafeStoragePath(this.memoryDir, \"state\", QUARANTINE_DIRNAME, ...segments);\n  }\n\n  /**\n   * Park a rejected write. Returns the absolute path of the record written.\n   * Prunes the principal's bucket to the configured caps afterward.\n   */\n  async quarantine(input: QuarantineEntryInput): Promise<string> {\n    const timestamp = input.timestamp ?? new Date().toISOString();\n    const record: QuarantinedRecord = {\n      operation: input.operation,\n      principal: input.principal ?? null,\n      attemptedNamespace: input.attemptedNamespace,\n      timestamp,\n      payload: input.payload,\n    };\n    const principalSegment = encodeStoragePathSegment(input.principal ?? \"unknown\");\n    const fileName = `${timestamp.replace(/[:.]/g, \"-\")}-${randomUUID().slice(0, 8)}.json`;\n\n    const dir = await this.safeDir(principalSegment);\n    await mkdir(dir, { recursive: true });\n    // The temp write uses the exclusive `wx` flag so a pre-planted symlink at\n    // the temp name can never be followed (O_EXCL); rename is atomic (rule 42).\n    const finalPath = await this.safeDir(principalSegment, fileName);\n    const tmpPath = await this.safeDir(principalSegment, `${fileName}.tmp`);\n    await writeFile(tmpPath, JSON.stringify(record, null, 2), { encoding: \"utf8\", flag: \"wx\" });\n    await rename(tmpPath, finalPath);\n\n    await this.pruneDir(dir);\n    return finalPath;\n  }\n\n  /**\n   * All valid, non-expired quarantined records across every principal, oldest\n   * first, each paired with its absolute on-disk path. Expired records are\n   * deleted on read (lazy GC), so an inactive principal bucket with no\n   * follow-up write is still bounded by age.\n   */\n  async entries(): Promise<QuarantineEntry[]> {\n    const now = Date.now();\n    const entries: QuarantineEntry[] = [];\n    for (const dir of await this.principalDirs()) {\n      for (const file of await this.entryFiles(dir)) {\n        const info = await stat(file).catch(() => null);\n        if (!info) continue;\n        if (now - info.mtimeMs > this.caps.maxAgeMs) {\n          await rm(file, { force: true }).catch(() => {});\n          continue;\n        }\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(await readFile(file, \"utf8\"));\n        } catch {\n          continue;\n        }\n        if (isQuarantinedRecord(parsed)) entries.push({ record: parsed, path: file });\n      }\n    }\n    entries.sort((a, b) => {\n      const at = a.record.timestamp;\n      const bt = b.record.timestamp;\n      return at < bt ? -1 : at > bt ? 1 : 0;\n    });\n    return entries;\n  }\n\n  /** As {@link entries} but projected to records only (backward-compatible view). */\n  async list(): Promise<QuarantinedRecord[]> {\n    return (await this.entries()).map((entry) => entry.record);\n  }\n\n  /**\n   * Delete one quarantined entry by its absolute on-disk path (as returned by\n   * {@link entries}). The path MUST resolve inside the quarantine root, mirroring\n   * the store's containment posture; a path outside the root — or one already\n   * absent — removes nothing. Returns true only when a file was actually deleted.\n   */\n  async removeEntry(entryPath: string): Promise<boolean> {\n    const rootAbs = path.resolve(this.root);\n    const rel = path.relative(rootAbs, path.resolve(entryPath));\n    if (rel === \"\" || rel === \"..\" || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {\n      return false;\n    }\n    // Symlink-race-safe resolution (issue #1888): resolveSafeStoragePath rejects\n    // any symlinked path component and verifies the REAL path stays inside the\n    // real quarantine root before we touch it, so a swapped component cannot\n    // redirect the deletion outside the store — lexical containment alone is not\n    // sufficient against a TOCTOU symlink swap.\n    let safe: string;\n    try {\n      safe = await resolveSafeStoragePath(rootAbs, rel);\n    } catch {\n      return false;\n    }\n    try {\n      await rm(safe, { force: false });\n      return true;\n    } catch (err) {\n      const errno = err as NodeJS.ErrnoException;\n      if (errno?.code === \"ENOENT\") return false;\n      throw err;\n    }\n  }\n\n  /** Total valid, non-expired quarantined record count across every principal. */\n  async count(): Promise<number> {\n    return (await this.list()).length;\n  }\n\n  /** lstat (no symlink follow): true only for a real directory. */\n  private async isRealDir(dir: string): Promise<boolean> {\n    const info = await lstat(dir).catch(() => null);\n    return info?.isDirectory() === true;\n  }\n\n  private async principalDirs(): Promise<string[]> {\n    // safeDir() rejects a symlinked/containment-escaping root — let that\n    // propagate instead of masquerading as an empty store.\n    const root = await this.safeDir();\n    if (!(await this.isRealDir(root))) return [];\n    let entries: Dirent[];\n    try {\n      entries = await readdir(root, { withFileTypes: true });\n    } catch (err) {\n      // Root vanished mid-scan → legitimately empty. Any other failure\n      // (permissions, IO) is a genuine inspection failure and must surface.\n      if ((err as NodeJS.ErrnoException)?.code === \"ENOENT\") return [];\n      throw err;\n    }\n    return entries\n      .filter((entry) => entry.isDirectory())\n      .map((entry) => path.join(root, entry.name))\n      .sort();\n  }\n\n  private async entryFiles(dir: string): Promise<string[]> {\n    if (!(await this.isRealDir(dir))) return [];\n    let entries: Dirent[];\n    try {\n      entries = await readdir(dir, { withFileTypes: true });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException)?.code === \"ENOENT\") return [];\n      throw err;\n    }\n    return entries\n      .filter((entry) => entry.isFile() && entry.name.endsWith(\".json\"))\n      .map((entry) => path.join(dir, entry.name))\n      .sort();\n  }\n\n  private async pruneDir(dir: string): Promise<void> {\n    const files = await this.entryFiles(dir);\n    const now = Date.now();\n    const survivors: Array<{ path: string; mtimeMs: number }> = [];\n    for (const file of files) {\n      const info = await stat(file).catch(() => null);\n      if (!info) continue;\n      if (now - info.mtimeMs > this.caps.maxAgeMs) {\n        await rm(file, { force: true }).catch(() => {});\n        continue;\n      }\n      survivors.push({ path: file, mtimeMs: info.mtimeMs });\n    }\n    const surplus = survivors.length - this.caps.maxEntriesPerPrincipal;\n    if (surplus <= 0) return;\n    survivors.sort((a, b) => a.mtimeMs - b.mtimeMs || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));\n    for (const victim of survivors.slice(0, surplus)) {\n      await rm(victim.path, { force: true }).catch(() => {});\n    }\n  }\n}\n"],"mappings":";;;;;;AAqBA,SAAS,kBAAkB;AAE3B,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AAC7E,OAAO,UAAU;AAuCV,IAAM,0BAA0C;AAAA,EACrD,wBAAwB;AAAA,EACxB,UAAU,KAAK,KAAK,KAAK,KAAK;AAChC;AAEA,IAAM,qBAAqB;AAE3B,SAAS,aAAa,MAA4B;AAChD,MAAI,CAAC,OAAO,UAAU,KAAK,sBAAsB,KAAK,KAAK,yBAAyB,GAAG;AACrF,UAAM,IAAI;AAAA,MACR,gFAAgF,KAAK,sBAAsB;AAAA,IAC7G;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,KAAK,KAAK,YAAY,GAAG;AACzD,UAAM,IAAI;AAAA,MACR,wFAAwF,KAAK,QAAQ;AAAA,IACvG;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,OAA4C;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AACf,UACG,OAAO,cAAc,aACpB,OAAO,cAAc,kBACrB,OAAO,cAAc,yBACtB,OAAO,cAAc,QAAQ,OAAO,OAAO,cAAc,aAC1D,OAAO,OAAO,uBAAuB,YACrC,OAAO,OAAO,cAAc,YAC5B,aAAa;AAEjB;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAGhC,YACE,WACiB,OAAuB,yBACxC;AADiB;AAEjB,iBAAa,IAAI;AACjB,SAAK,YAAY,KAAK,QAAQ,SAAS;AAAA,EACzC;AAAA,EAJmB;AAAA,EAJF;AAAA;AAAA,EAWjB,IAAI,OAAe;AACjB,WAAO,KAAK,KAAK,KAAK,WAAW,SAAS,kBAAkB;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,UAAqC;AACtD,WAAO,uBAAuB,KAAK,WAAW,SAAS,oBAAoB,GAAG,QAAQ;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,OAA8C;AAC7D,UAAM,YAAY,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC5D,UAAM,SAA4B;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM,aAAa;AAAA,MAC9B,oBAAoB,MAAM;AAAA,MAC1B;AAAA,MACA,SAAS,MAAM;AAAA,IACjB;AACA,UAAM,mBAAmB,yBAAyB,MAAM,aAAa,SAAS;AAC9E,UAAM,WAAW,GAAG,UAAU,QAAQ,SAAS,GAAG,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAE/E,UAAM,MAAM,MAAM,KAAK,QAAQ,gBAAgB;AAC/C,UAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAGpC,UAAM,YAAY,MAAM,KAAK,QAAQ,kBAAkB,QAAQ;AAC/D,UAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,GAAG,QAAQ,MAAM;AACtE,UAAM,UAAU,SAAS,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC;AAC1F,UAAM,OAAO,SAAS,SAAS;AAE/B,UAAM,KAAK,SAAS,GAAG;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAsC;AAC1C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAA6B,CAAC;AACpC,eAAW,OAAO,MAAM,KAAK,cAAc,GAAG;AAC5C,iBAAW,QAAQ,MAAM,KAAK,WAAW,GAAG,GAAG;AAC7C,cAAM,OAAO,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI;AAC9C,YAAI,CAAC,KAAM;AACX,YAAI,MAAM,KAAK,UAAU,KAAK,KAAK,UAAU;AAC3C,gBAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAC9C;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,mBAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,QAClD,QAAQ;AACN;AAAA,QACF;AACA,YAAI,oBAAoB,MAAM,EAAG,SAAQ,KAAK,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,YAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,YAAM,KAAK,EAAE,OAAO;AACpB,YAAM,KAAK,EAAE,OAAO;AACpB,aAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAAA,IACtC,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,OAAqC;AACzC,YAAQ,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,UAAU,MAAM,MAAM;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,WAAqC;AACrD,UAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;AACtC,UAAM,MAAM,KAAK,SAAS,SAAS,KAAK,QAAQ,SAAS,CAAC;AAC1D,QAAI,QAAQ,MAAM,QAAQ,QAAQ,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,KAAK,KAAK,WAAW,GAAG,GAAG;AACzF,aAAO;AAAA,IACT;AAMA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,uBAAuB,SAAS,GAAG;AAAA,IAClD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,GAAG,MAAM,EAAE,OAAO,MAAM,CAAC;AAC/B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,QAAQ;AACd,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,QAAyB;AAC7B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAc,UAAU,KAA+B;AACrD,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI;AAC9C,WAAO,MAAM,YAAY,MAAM;AAAA,EACjC;AAAA,EAEA,MAAc,gBAAmC;AAG/C,UAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,QAAI,CAAE,MAAM,KAAK,UAAU,IAAI,EAAI,QAAO,CAAC;AAC3C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IACvD,SAAS,KAAK;AAGZ,UAAK,KAA+B,SAAS,SAAU,QAAO,CAAC;AAC/D,YAAM;AAAA,IACR;AACA,WAAO,QACJ,OAAO,CAAC,UAAU,MAAM,YAAY,CAAC,EACrC,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,MAAM,IAAI,CAAC,EAC1C,KAAK;AAAA,EACV;AAAA,EAEA,MAAc,WAAW,KAAgC;AACvD,QAAI,CAAE,MAAM,KAAK,UAAU,GAAG,EAAI,QAAO,CAAC;AAC1C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACtD,SAAS,KAAK;AACZ,UAAK,KAA+B,SAAS,SAAU,QAAO,CAAC;AAC/D,YAAM;AAAA,IACR;AACA,WAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,OAAO,CAAC,EAChE,IAAI,CAAC,UAAU,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC,EACzC,KAAK;AAAA,EACV;AAAA,EAEA,MAAc,SAAS,KAA4B;AACjD,UAAM,QAAQ,MAAM,KAAK,WAAW,GAAG;AACvC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAsD,CAAC;AAC7D,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI;AAC9C,UAAI,CAAC,KAAM;AACX,UAAI,MAAM,KAAK,UAAU,KAAK,KAAK,UAAU;AAC3C,cAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC9C;AAAA,MACF;AACA,gBAAU,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,QAAQ,CAAC;AAAA,IACtD;AACA,UAAM,UAAU,UAAU,SAAS,KAAK,KAAK;AAC7C,QAAI,WAAW,EAAG;AAClB,cAAU,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;AAClG,eAAW,UAAU,UAAU,MAAM,GAAG,OAAO,GAAG;AAChD,YAAM,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-76GLCM57.js → chunk-PMUD7ERF.js}

@@ -210,7 +210,7 @@ import {
 } from "./chunk-EEC7UJPX.js";
 import {
   EngramAccessHttpServer
-} from "./chunk-IYNGIMVG.js";
+} from "./chunk-ZVAYK7GU.js";
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
@@ -229,7 +229,7 @@ import {
 } from "./chunk-OADWQ5CR.js";
 import {
   EngramAccessService
-} from "./chunk-TDTXKOAJ.js";
+} from "./chunk-XQDRKZ7V.js";
 import {
   WorkStorage
 } from "./chunk-GDB4J2H3.js";
@@ -7650,4 +7650,4 @@ export {
   listMemoryMarkdownFilePaths,
   registerCli
 };
-//# sourceMappingURL=chunk-76GLCM57.js.map
+//# sourceMappingURL=chunk-PMUD7ERF.js.map

package/dist/{chunk-TDTXKOAJ.js → chunk-XQDRKZ7V.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-AJ7QCSIS.js";
 import {
   WriteQuarantineStore
-} from "./chunk-SICXL4MK.js";
+} from "./chunk-PJSK6OJM.js";
 import {
   trustResultFor
 } from "./chunk-GNVZQ5JN.js";
@@ -5464,7 +5464,7 @@ var AccessObserveWriteSurface = class {
     try {
       namespace = await this.deps.resolveCodingScopedWriteNamespace(request);
     } catch (err) {
-      if (request.dryRun !== true) {
+      if (request.dryRun !== true && request.suppressQuarantine !== true) {
         await this.parkRejectedWrite(err, "memory_store", request);
       }
       throw err;
@@ -5534,7 +5534,7 @@ var AccessObserveWriteSurface = class {
     try {
       namespace = await this.deps.resolveCodingScopedWriteNamespace(request);
     } catch (err) {
-      if (request.dryRun !== true) {
+      if (request.dryRun !== true && request.suppressQuarantine !== true) {
         await this.parkRejectedWrite(err, "suggestion_submit", request);
       }
       throw err;
@@ -5622,7 +5622,9 @@ var AccessObserveWriteSurface = class {
     try {
       scope = await this.deps.resolveMemoryScopePlan(request);
     } catch (err) {
-      await this.parkRejectedWrite(err, "observe", request);
+      if (request.suppressQuarantine !== true) {
+        await this.parkRejectedWrite(err, "observe", request);
+      }
       throw err;
     }
     const writeNamespace = scope.writeNamespace;
@@ -11977,4 +11979,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-TDTXKOAJ.js.map
+//# sourceMappingURL=chunk-XQDRKZ7V.js.map