dotmem 0.0.8 → 0.1.0

package/index.js

@@ -18,6 +18,18 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// suppress-idb-warning.ts
+var orig;
+var init_suppress_idb_warning = __esm({
+  "suppress-idb-warning.ts"() {
+    orig = console.warn.bind(console);
+    console.warn = (...args) => {
+      if (typeof args[0] === "string" && args[0].includes("IndexedDB is not available")) return;
+      orig(...args);
+    };
+  }
+});
+
 // core/env.ts
 var DEV;
 var init_env = __esm({
@@ -2410,6 +2422,7 @@ var init_policy_store = __esm({
       if (entry.target !== void 0) built.target = entry.target;
       if (entry.reason !== void 0) built.reason = entry.reason;
       if (entry.detail !== void 0) built.detail = entry.detail;
+      if (entry.mandatory !== void 0) built.mandatory = entry.mandatory;
       return built;
     }, "validatePolicyAuditEntry");
     validatePolicyDocument = /* @__PURE__ */ __name((value) => {
@@ -2487,6 +2500,7 @@ var init_policy_store = __esm({
       if (entry.target !== void 0) built.target = entry.target;
       if (entry.reason !== void 0) built.reason = entry.reason;
       if (entry.detail !== void 0) built.detail = entry.detail;
+      if (entry.mandatory !== void 0) built.mandatory = entry.mandatory;
       return built;
     }, "buildAuditEntry");
     boundedAudit = /* @__PURE__ */ __name((entries2, overrides) => {
@@ -2499,9 +2513,10 @@ var init_policy_store = __esm({
       for (let index = entries2.length - 1; index >= 0; index--) {
         const entry = entries2[index];
         const activeLinked = entry.target !== void 0 && activeOverrideIds.has(entry.target) && (entry.action === "override" || entry.action === "revoke");
-        if (activeLinked || budget > 0) {
+        const mandatory = entry.mandatory === true;
+        if (activeLinked || mandatory || budget > 0) {
           kept.unshift(entry);
-          if (!activeLinked) budget--;
+          if (!activeLinked && !mandatory) budget--;
         }
       }
       return kept;
@@ -2542,6 +2557,12 @@ var init_policy_store = __esm({
         try {
           await fs.writeFile(temporary, `${JSON.stringify(document, null, 2)}
 `, "utf8");
+          const handle = await fs.open(temporary, "r+");
+          try {
+            await handle.sync();
+          } finally {
+            await handle.close();
+          }
           await fs.rename(temporary, filePath);
         } catch (error) {
           await fs.rm(temporary, { force: true }).catch(() => void 0);
@@ -4460,7 +4481,7 @@ function encodeMemFile(stateValue, preserved) {
 function decodeMemDocument(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid .mem file format");
   const file = value;
-  if (file.format !== MEM_FORMAT) throw new Error("Invalid .mem file format");
+  if (file.format !== MEM_FORMAT && file.format !== MEM_FORMAT_LEGACY) throw new Error("Invalid .mem file format");
   if (file.version === MEM_FORMAT_VERSION_V1) {
     if (!file.knowledge) throw new Error("Invalid .mem file format");
     return { state: validateSourceState(file.knowledge) };
@@ -4542,11 +4563,12 @@ function decodeMemDocument(value) {
     preserved: { map: structuredClone(map), data: structuredClone(stateRecord) }
   };
 }
-var MEM_FORMAT, MEM_FORMAT_VERSION, MEM_FORMAT_VERSION_V1, expectedFields, epistemicTypes, revisionKinds, claimKinds, isJsonValue2, createMemInterpretationMap, validateSourceState, trimRecord, fieldIndexes, validateVocabulary, put, get, optionalGet, requireRecord, putOptional;
+var MEM_FORMAT, MEM_FORMAT_LEGACY, MEM_FORMAT_VERSION, MEM_FORMAT_VERSION_V1, expectedFields, epistemicTypes, revisionKinds, claimKinds, isJsonValue2, createMemInterpretationMap, validateSourceState, trimRecord, fieldIndexes, validateVocabulary, put, get, optionalGet, requireRecord, putOptional;
 var init_mem_codec = __esm({
   "core/knowledge/mem-codec.ts"() {
     init_state();
     MEM_FORMAT = "dotmem.knowledge";
+    MEM_FORMAT_LEGACY = "memorio.knowledge";
     MEM_FORMAT_VERSION = 2;
     MEM_FORMAT_VERSION_V1 = 1;
     expectedFields = {
@@ -4725,12 +4747,13 @@ async function inspectMem(input) {
     return { status: artifactError.code, representation: "unknown", message: artifactError.message, parts: [] };
   }
 }
-var MEM_PACKAGE_FORMAT, MEM_PACKAGE_VERSION, MEM_PACKAGE_LIMITS, MEM_PACKAGE_WRITE_MARGIN_BYTES, MEM_PACKAGE_WRITE_LIMITS, MANIFEST_PATH, MAP_PATH, DATA_PATH, INTEGRITY_PATH, requiredParts, encoder2, decoder, MemArtifactError, stableValue, jsonBytes, sha256, parseJson, validEntryPath, concatenate, readZipParts, createManifest, digestTableIdentity, signaturePayload, base64UrlEncode, base64UrlDecode, keyIdentity, signaturePath, encodePackage, isZip, decodePackage, verifySignature;
+var MEM_PACKAGE_FORMAT, MEM_PACKAGE_FORMAT_LEGACY, MEM_PACKAGE_VERSION, MEM_PACKAGE_LIMITS, MEM_PACKAGE_WRITE_MARGIN_BYTES, MEM_PACKAGE_WRITE_LIMITS, MANIFEST_PATH, MAP_PATH, DATA_PATH, INTEGRITY_PATH, requiredParts, encoder2, decoder, MemArtifactError, stableValue, jsonBytes, sha256, parseJson, validEntryPath, concatenate, readZipParts, createManifest, digestTableIdentity, signaturePayload, base64UrlEncode, base64UrlDecode, keyIdentity, signaturePath, encodePackage, isZip, decodePackage, verifySignature;
 var init_mem_package = __esm({
   "core/knowledge/mem-package.ts"() {
     init_browser();
     init_mem_codec();
     MEM_PACKAGE_FORMAT = "dotmem.package";
+    MEM_PACKAGE_FORMAT_LEGACY = "memorio.package";
     MEM_PACKAGE_VERSION = 1;
     MEM_PACKAGE_LIMITS = Object.freeze({
       maximumPackageBytes: 10 * 1024 * 1024,
@@ -4921,10 +4944,10 @@ ${contentId}
         if (!parts[path]) throw new MemArtifactError("invalid", `Missing MEM package part: ${path}`);
       }
       const manifest = parseJson(parts[MANIFEST_PATH], MANIFEST_PATH);
-      if (manifest.format !== MEM_PACKAGE_FORMAT && manifest.format || manifest.version !== MEM_PACKAGE_VERSION) {
+      if (manifest.format !== MEM_PACKAGE_FORMAT && manifest.format !== MEM_PACKAGE_FORMAT_LEGACY || manifest.version !== MEM_PACKAGE_VERSION) {
         throw new MemArtifactError("unsupported", "Unsupported MEM package format or version");
       }
-      if (manifest.memory?.format !== MEM_FORMAT && manifest.memory?.format || manifest.memory.version !== MEM_FORMAT_VERSION || manifest.parts?.map !== MAP_PATH || manifest.parts?.data !== DATA_PATH || manifest.parts?.integrity !== INTEGRITY_PATH) {
+      if (manifest.memory?.format !== MEM_FORMAT && manifest.memory?.format !== MEM_FORMAT_LEGACY || manifest.memory.version !== MEM_FORMAT_VERSION || manifest.parts?.map !== MAP_PATH || manifest.parts?.data !== DATA_PATH || manifest.parts?.integrity !== INTEGRITY_PATH) {
         throw new MemArtifactError("invalid", "Invalid MEM package manifest");
       }
       const integrity = parseJson(parts[INTEGRITY_PATH], INTEGRITY_PATH);
@@ -5036,6 +5059,109 @@ ${contentId}
   }
 });
 
+// core/storage-coordinator/index.ts
+var nodeFs4, withStorageLock, readStorageGeneration, writeStorageGeneration;
+var init_storage_coordinator = __esm({
+  "core/storage-coordinator/index.ts"() {
+    nodeFs4 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
+    withStorageLock = /* @__PURE__ */ __name(async (directoryPath, operationOrOptions, operation, _options = {}) => {
+      const opts = typeof operationOrOptions === "function" ? operation ?? {} : operationOrOptions ?? {};
+      const op = typeof operationOrOptions === "function" ? operationOrOptions : operation;
+      const timeoutMs = opts.timeoutMs ?? 3e4;
+      const staleMs = opts.staleMs ?? 6e4;
+      const lockName = opts.lockName ?? ".storage.lock";
+      const lockPath = `${directoryPath}/${lockName}`;
+      const fs = await nodeFs4();
+      const started = Date.now();
+      await fs.mkdir(directoryPath, { recursive: true });
+      while (true) {
+        try {
+          await fs.mkdir(lockPath);
+          const token2 = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+          await fs.writeFile(`${lockPath}/owner.json`, JSON.stringify({ token: token2, pid: process.pid, createdAt: Date.now() }), { flag: "wx" });
+          break;
+        } catch (error) {
+          const code = error.code;
+          if (code !== "EEXIST" && code !== "ENOENT" && code !== "EPERM" && code !== "ENOTEMPTY") throw error;
+          let stale = false;
+          let processDead = false;
+          try {
+            const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+            const parsed = JSON.parse(raw);
+            const ageStale = typeof parsed.createdAt === "number" && Date.now() - parsed.createdAt > staleMs;
+            if (typeof parsed.pid === "number") {
+              try {
+                process.kill(parsed.pid, 0);
+              } catch {
+                processDead = true;
+              }
+            } else {
+              processDead = true;
+            }
+            if (ageStale || processDead) stale = true;
+          } catch {
+            stale = true;
+          }
+          if (stale) {
+            if (processDead) {
+              try {
+                await fs.rm(lockPath, { recursive: true, force: true });
+                continue;
+              } catch {
+              }
+            }
+            try {
+              await fs.rmdir(lockPath);
+              continue;
+            } catch {
+            }
+          }
+          if (Date.now() - started > timeoutMs) {
+            throw new Error(`Storage lock timeout for ${directoryPath}`);
+          }
+          await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+      }
+      let token = "";
+      try {
+        const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+        token = JSON.parse(raw).token ?? "";
+      } catch {
+        token = "";
+      }
+      try {
+        return await op();
+      } finally {
+        try {
+          const raw = await fs.readFile(`${lockPath}/owner.json`, "utf8");
+          const parsed = JSON.parse(raw);
+          if (parsed.token === token && token) {
+            await fs.rm(lockPath, { recursive: true, force: true });
+          }
+        } catch {
+        }
+      }
+    }, "withStorageLock");
+    readStorageGeneration = /* @__PURE__ */ __name(async (directoryPath) => {
+      const fs = await nodeFs4();
+      try {
+        const raw = await fs.readFile(`${directoryPath}/.storage.generation`, "utf8");
+        const value = Number(raw.trim());
+        return Number.isFinite(value) && value >= 0 ? value : 0;
+      } catch {
+        return 0;
+      }
+    }, "readStorageGeneration");
+    writeStorageGeneration = /* @__PURE__ */ __name(async (directoryPath, value) => {
+      const fs = await nodeFs4();
+      await fs.mkdir(directoryPath, { recursive: true });
+      const temp = `${directoryPath}/.storage.generation.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+      await fs.writeFile(temp, String(value));
+      await fs.rename(temp, `${directoryPath}/.storage.generation`);
+    }, "writeStorageGeneration");
+  }
+});
+
 // core/knowledge/mem-repository.ts
 function resolveDuplicate(existing, existingSource, current, currentSource) {
   const existingRetracts = existing.revision?.kind === "retracts";
@@ -5076,19 +5202,20 @@ async function parseMemFile(value, sourceId) {
     throw new Error(`${message} in ${sourceId}`);
   }
 }
-var DOTMEM_DIRECTORY, DEFAULT_MEM_FILE, directoryLocks, nodeFs4, separator2, normalizePath, isAbsolutePath, resolvePath, joinPath2, parentPath, uniqueSuffix, withDirectoryLock, isMissingDirectory, sourcePriority, memFilePath, MemDirectoryKnowledgeRepository;
+var DOTMEM_DIRECTORY, DEFAULT_MEM_FILE, nodeFs5, repositoryLoadCaches, separator2, normalizePath, isAbsolutePath, resolvePath, joinPath2, parentPath, uniqueSuffix, isMissingDirectory, sourcePriority, memFilePath, MemDirectoryKnowledgeRepository;
 var init_mem_repository = __esm({
   "core/knowledge/mem-repository.ts"() {
     init_mem_codec();
     init_mem_package();
     init_state();
     init_acquisition_limits();
+    init_storage_coordinator();
     DOTMEM_DIRECTORY = ".dotmem";
     DEFAULT_MEM_FILE = "project.mem";
-    directoryLocks = /* @__PURE__ */ new Map();
-    nodeFs4 = /* @__PURE__ */ __name(async () => {
+    nodeFs5 = /* @__PURE__ */ __name(async () => {
       return import('fs/promises');
     }, "nodeFs");
+    repositoryLoadCaches = /* @__PURE__ */ new Map();
     separator2 = /* @__PURE__ */ __name(() => process.platform === "win32" ? "\\" : "/", "separator");
     normalizePath = /* @__PURE__ */ __name((value) => value.replace(/[\\/]+/g, separator2()), "normalizePath");
     isAbsolutePath = /* @__PURE__ */ __name((value) => /^(?:[A-Za-z]:[\\/]|[\\/])/.test(value), "isAbsolutePath");
@@ -5100,25 +5227,8 @@ var init_mem_repository = __esm({
       return index <= 0 ? "." : normalized.slice(0, index);
     }, "parentPath");
     uniqueSuffix = /* @__PURE__ */ __name(() => globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`, "uniqueSuffix");
-    withDirectoryLock = /* @__PURE__ */ __name(async (directoryPath, operation) => {
-      const previous = directoryLocks.get(directoryPath) ?? Promise.resolve();
-      let release = /* @__PURE__ */ __name(() => void 0, "release");
-      const gate = new Promise((resolveGate) => {
-        release = resolveGate;
-      });
-      const queued = previous.then(() => gate);
-      directoryLocks.set(directoryPath, queued);
-      await previous;
-      try {
-        return await operation();
-      } finally {
-        release();
-        if (directoryLocks.get(directoryPath) === queued) directoryLocks.delete(directoryPath);
-      }
-    }, "withDirectoryLock");
     isMissingDirectory = /* @__PURE__ */ __name((error) => error.code === "ENOENT", "isMissingDirectory");
     sourcePriority = /* @__PURE__ */ __name((sourceId, scope) => {
-      if (sourceId.endsWith(".mem") && sourceId !== "project.mem" && sourceId !== "user.mem" && sourceId !== "agent.mem") return 0;
       if (scope === "project" || sourceId === "project.mem") return 4;
       if (scope === "user" || sourceId === "user.mem") return 3;
       if (sourceId === "agent.mem" || sourceId === "agent") return 2;
@@ -5146,7 +5256,7 @@ var init_mem_repository = __esm({
         this.loadWritableOnly = loadWritableOnly;
       }
       async discover() {
-        const { readdir } = await nodeFs4();
+        const { readdir } = await nodeFs5();
         try {
           const entries2 = await readdir(this.directoryPath, { withFileTypes: true });
           return entries2.filter((entry) => entry.isFile() && entry.name.endsWith(".mem") && entry.name !== "@brain.mem").map((entry) => entry.name).sort((a, b) => a.localeCompare(b));
@@ -5161,7 +5271,7 @@ var init_mem_repository = __esm({
        * receive a clear failure instead of discovering corruption on first use.
        */
       async initialize() {
-        const { mkdir } = await nodeFs4();
+        const { mkdir } = await nodeFs5();
         await mkdir(this.directoryPath, { recursive: true });
         await this.load();
       }
@@ -5176,7 +5286,7 @@ var init_mem_repository = __esm({
        * that does not delete is not a delete.
        */
       async clearWritable() {
-        const { rm, readdir } = await nodeFs4();
+        const { rm, readdir } = await nodeFs5();
         const filePath = memFilePath(this.directoryPath, this.writableSourceId);
         await rm(filePath, { force: true });
         await rm(`${filePath}.bak`, { force: true });
@@ -5193,15 +5303,28 @@ var init_mem_repository = __esm({
         }
       }
       async load() {
-        const loaded = this.loadWritableOnly ? await this.loadSources([this.writableSourceId]) : await this.loadSources();
-        return this.combine(loaded);
+        const cacheKey = `${this.directoryPath}:${this.writableSourceId}:${this.loadWritableOnly}`;
+        for (let attempt = 0; attempt < 5; attempt += 1) {
+          const generationBefore = await readStorageGeneration(this.directoryPath);
+          const cached = repositoryLoadCaches.get(cacheKey);
+          if (cached && cached.signature === String(generationBefore)) {
+            return structuredClone(cached.state);
+          }
+          const loaded = this.loadWritableOnly ? await this.loadSources([this.writableSourceId]) : await this.loadSources();
+          const state3 = this.combine(loaded);
+          const generationAfter = await readStorageGeneration(this.directoryPath);
+          if (generationBefore !== generationAfter && attempt < 4) continue;
+          repositoryLoadCaches.set(cacheKey, { signature: String(generationAfter), state: structuredClone(state3) });
+          return state3;
+        }
+        throw new Error("Unable to load stable repository state");
       }
-      async save(state3, expectedVersion) {
+      async save(state3, expectedVersion, locked = false) {
         const validated = validateKnowledgeState(state3);
         if (!Number.isInteger(expectedVersion) || expectedVersion < 0 || validated.version !== expectedVersion + 1) {
           throw new Error("Invalid expected persisted version");
         }
-        await withDirectoryLock(this.directoryPath, async () => {
+        const doWrite = /* @__PURE__ */ __name(async () => {
           const loaded = await this.loadSources();
           const writable = loaded.find((source) => source.id === this.writableSourceId) ?? {
             id: this.writableSourceId,
@@ -5223,10 +5346,16 @@ var init_mem_repository = __esm({
             claims: [...writable.state.claims, ...newClaims]
           };
           await this.writeSource(writable.filePath, nextWritable, writable.preserved, writable.package);
-        });
+          await writeStorageGeneration(this.directoryPath, await readStorageGeneration(this.directoryPath) + 1);
+        }, "doWrite");
+        if (locked) {
+          await doWrite();
+        } else {
+          await withStorageLock(this.directoryPath, doWrite);
+        }
       }
       async loadSources(sourceIds) {
-        const { readFile: readFile5 } = await nodeFs4();
+        const { readFile: readFile5 } = await nodeFs5();
         const ids = sourceIds ?? await this.discover();
         const sources = [];
         for (const sourceId of ids) {
@@ -5316,7 +5445,7 @@ var init_mem_repository = __esm({
        * valid package, so the backup is always a version this library can read.
        */
       async keepLastValidVersion(filePath) {
-        const { readFile: readFile5, copyFile, rename, rm } = await nodeFs4();
+        const { readFile: readFile5, copyFile, rename, rm } = await nodeFs5();
         let current;
         try {
           current = await readFile5(filePath);
@@ -5340,7 +5469,7 @@ var init_mem_repository = __esm({
       }
       /** Best-effort directory sync: the rename is durable once the directory is. */
       async syncDirectory(directoryPath) {
-        const { open } = await nodeFs4();
+        const { open } = await nodeFs5();
         try {
           const handle = await open(directoryPath, "r");
           try {
@@ -5352,7 +5481,7 @@ var init_mem_repository = __esm({
         }
       }
       async writeSource(filePath, state3, preserved, preservedPackage) {
-        const { mkdir, rename, rm, open, readFile: readFile5 } = await nodeFs4();
+        const { mkdir, rename, rm, open, readFile: readFile5 } = await nodeFs5();
         if (!Number.isInteger(state3.version) || state3.version < 0) throw new Error("Invalid writable .mem knowledge version");
         for (const claim of state3.claims) validateClaim(claim);
         await mkdir(parentPath(filePath), { recursive: true });
@@ -5880,7 +6009,7 @@ var init_project_identity = __esm({
 });
 
 // core/knowledge/staging.ts
-var DOTMEM_STAGE_FORMAT, DOTMEM_STAGE_VERSION, StageFileError, generateRequestId, nodeCwd, resolveStagingDirectory, stagePathFor, nodeFs5, normalizeClaimIds, revisionFromOptions, writeStageFile, readStageFile, validateStageFile, commitStageFile, cleanupStageFile;
+var DOTMEM_STAGE_FORMAT, DOTMEM_STAGE_VERSION, StageFileError, generateRequestId, nodeCwd, resolveStagingDirectory, stagePathFor, nodeFs6, normalizeClaimIds, revisionFromOptions, writeStageFile, readStageFile, validateStageFile, commitStageFile, cleanupStageFile;
 var init_staging = __esm({
   "core/knowledge/staging.ts"() {
     init_claim_record();
@@ -5915,7 +6044,7 @@ var init_staging = __esm({
       return `${base}/dotmem`;
     }, "resolveStagingDirectory");
     stagePathFor = /* @__PURE__ */ __name((requestId) => `${resolveStagingDirectory()}/${requestId}.stage`, "stagePathFor");
-    nodeFs5 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
+    nodeFs6 = /* @__PURE__ */ __name(async () => import('fs/promises'), "nodeFs");
     normalizeClaimIds = /* @__PURE__ */ __name((value) => {
       if (!value) return [];
       return Array.isArray(value) ? value : [value];
@@ -5940,7 +6069,7 @@ var init_staging = __esm({
       };
       const requestId = generateRequestId();
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       await fs.mkdir(resolveStagingDirectory(), { recursive: true });
       const stageFile = {
         format: DOTMEM_STAGE_FORMAT,
@@ -5960,7 +6089,7 @@ var init_staging = __esm({
     }, "writeStageFile");
     readStageFile = /* @__PURE__ */ __name(async (requestId) => {
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       try {
         const content = await fs.readFile(stagePath, "utf8");
         return JSON.parse(content);
@@ -6071,7 +6200,7 @@ var init_staging = __esm({
     }, "commitStageFile");
     cleanupStageFile = /* @__PURE__ */ __name(async (requestId) => {
       const stagePath = stagePathFor(requestId);
-      const fs = await nodeFs5();
+      const fs = await nodeFs6();
       try {
         await fs.unlink(stagePath);
       } catch (error) {
@@ -6842,6 +6971,7 @@ function _inferConfidence(claim) {
 var LOGIC_MEM_FILE, nodeCwd2, cachedRuntime, LogicEngine, logic, logic_default;
 var init_logic = __esm({
   "core/logic/index.ts"() {
+    init_suppress_idb_warning();
     init_knowledge();
     init_mem_repository();
     init_acquisition_boundary();
@@ -7109,6 +7239,9 @@ Do not store secrets unless dotmem explicitly supports secure secret storage.
   }
 });
 
+// index.ts
+init_suppress_idb_warning();
+
 // core/idb.ts
 var idb = {
   db: {},
@@ -7448,7 +7581,11 @@ var security = {
   createSanitizer
 };
 
+// core/memory/index.ts
+init_suppress_idb_warning();
+
 // core/memory/journal.ts
+init_suppress_idb_warning();
 init_env();
 var g = globalThis;
 function namespace() {
@@ -7655,6 +7792,7 @@ var journal_default = journal;
 init_brain();
 
 // core/memory/knowledge-runtime.ts
+init_suppress_idb_warning();
 init_knowledge();
 init_project_identity();
 init_user_paths();
@@ -8003,6 +8141,7 @@ var policy = {
 };
 
 // core/memory/entries.ts
+init_suppress_idb_warning();
 init_env();
 var MEMORY_INDEX_KEY = "__dotmem_memory_index__";
 var SUPERSEDED_PREFIX = "__dotmem_superseded__";
@@ -8547,15 +8686,18 @@ var context = {
 };
 
 // core/memory/acquire.ts
+init_suppress_idb_warning();
 init_env();
 init_project_identity();
 init_project_anchor();
 init_acquisition_boundary();
 init_claim_record();
+init_state();
 init_router();
 init_store_queue();
 init_staging();
 init_user_paths();
+init_storage_coordinator();
 init_mem_repository();
 function normalizeClaimIds3(value) {
   if (!value) return [];
@@ -8633,23 +8775,27 @@ var acquire = {
       );
     }
     const revision = revisionFromAcquire2(opts);
+    const repository = target.repository;
     await withStoreQueue(acquisitionStoreKey(kind, scope, sourceProject), async () => {
-      const state3 = await target.runtime.select([]);
-      await target.runtime.update({
-        basedOnVersion: state3.context.knowledgeVersion,
-        claims: [buildClaimRecord({
-          id: opts.id,
-          knowledge: boundary.knowledge,
-          applicability: opts.applicability,
-          evidence: opts.evidence,
-          epistemicType: opts.epistemicType,
-          provenance: opts.provenance,
-          acquiredAt: opts.acquiredAt,
-          revision,
-          scope,
-          sourceProject,
-          kind
-        })]
+      await withStorageLock(repository.directoryPath, async () => {
+        const state3 = await repository.load();
+        const next = updateKnowledge(state3, {
+          basedOnVersion: state3.version,
+          claims: [buildClaimRecord({
+            id: opts.id,
+            knowledge: boundary.knowledge,
+            applicability: opts.applicability,
+            evidence: opts.evidence,
+            epistemicType: opts.epistemicType,
+            provenance: opts.provenance,
+            acquiredAt: opts.acquiredAt,
+            revision,
+            scope,
+            sourceProject,
+            kind
+          })]
+        });
+        await repository.save(next, state3.version, true);
       });
     });
     const verification = await target.repository.load();
@@ -10190,6 +10336,442 @@ var saveContinuityDocument = /* @__PURE__ */ __name(async (path, document) => {
   }
 }, "saveContinuityDocument");
 
+// core/continuity-ledger/index.ts
+var EVENT_ID_PREFIX = "evt.";
+var LEDGER_APPLICABILITY = { area: "continuity", baseline: false };
+var EVENT_TYPES = /* @__PURE__ */ new Set([
+  "decision",
+  "discovery",
+  "correction",
+  "conversation",
+  "commitment",
+  "open-loop",
+  "project-change",
+  "activity"
+]);
+var MEMORY_DOMAINS = /* @__PURE__ */ new Set(["environmental", "professional", "conversational", "activity"]);
+var EPITEMIC_STATUSES = /* @__PURE__ */ new Set([
+  "verified-fact",
+  "user-statement",
+  "ai-inference",
+  "hypothesis",
+  "proposal",
+  "decision",
+  "verified-result"
+]);
+var CONFIDENCE_VALUES = /* @__PURE__ */ new Set(["high", "medium", "low", "unknown"]);
+var AUTHORS = /* @__PURE__ */ new Set(["human", "ai", "system"]);
+var CHANNELS = /* @__PURE__ */ new Set(["conversation", "acquisition", "tool", "migration"]);
+var SOURCE_KINDS = /* @__PURE__ */ new Set(["claim", "file", "commit", "tool-output", "conversation"]);
+var RELATIONSHIP_KEYS = [
+  "refines",
+  "supersedes",
+  "retracts",
+  "dependsOn",
+  "resolves",
+  "relatedTo"
+];
+var isRecord = /* @__PURE__ */ __name((value) => !!value && typeof value === "object" && !Array.isArray(value), "isRecord");
+var normalizeRelationships = /* @__PURE__ */ __name((value) => {
+  const result = {
+    refines: [],
+    supersedes: [],
+    retracts: [],
+    dependsOn: [],
+    resolves: [],
+    relatedTo: []
+  };
+  if (!isRecord(value)) return result;
+  for (const key of RELATIONSHIP_KEYS) {
+    const raw = value[key];
+    if (Array.isArray(raw)) {
+      result[key] = raw.filter((item) => typeof item === "string");
+    }
+  }
+  return result;
+}, "normalizeRelationships");
+var validateEvent = /* @__PURE__ */ __name((event) => {
+  if (!isRecord(event)) throw new Error("Continuity event must be an object");
+  if (event.schemaVersion !== 1) throw new Error("Unsupported continuity event schemaVersion");
+  if (typeof event.eventId !== "string" || !event.eventId.startsWith(EVENT_ID_PREFIX)) {
+    throw new Error("Continuity event requires a valid eventId");
+  }
+  if (typeof event.eventType !== "string" || !EVENT_TYPES.has(event.eventType)) {
+    throw new Error("Continuity event requires a valid eventType");
+  }
+  if (typeof event.memoryDomain !== "string" || !MEMORY_DOMAINS.has(event.memoryDomain)) {
+    throw new Error("Continuity event requires a valid memoryDomain");
+  }
+  if (typeof event.epistemicStatus !== "string" || !EPITEMIC_STATUSES.has(event.epistemicStatus)) {
+    throw new Error("Continuity event requires a valid epistemicStatus");
+  }
+  if (typeof event.confidence !== "string" || !CONFIDENCE_VALUES.has(event.confidence)) {
+    throw new Error("Continuity event requires a valid confidence");
+  }
+  if (typeof event.createdAt !== "string") throw new Error("Continuity event requires createdAt");
+  if (typeof event.sessionId !== "string") throw new Error("Continuity event requires sessionId");
+  if (event.projectId !== null && typeof event.projectId !== "string") {
+    throw new Error("Continuity event requires projectId to be string or null");
+  }
+  if (typeof event.subject !== "string") throw new Error("Continuity event requires subject");
+  if (!isRecord(event.content)) throw new Error("Continuity event requires content object");
+  if (!Array.isArray(event.sourceRefs)) throw new Error("Continuity event requires sourceRefs array");
+  for (const ref of event.sourceRefs) {
+    if (!isRecord(ref) || typeof ref.kind !== "string" || !SOURCE_KINDS.has(ref.kind) || typeof ref.id !== "string") {
+      throw new Error("Continuity event contains an invalid sourceRef");
+    }
+  }
+  if (!isRecord(event.relationships)) throw new Error("Continuity event requires relationships object");
+  if (!isRecord(event.provenance)) throw new Error("Continuity event requires provenance object");
+  const provenance = event.provenance;
+  if (typeof provenance.author !== "string" || !AUTHORS.has(provenance.author)) {
+    throw new Error("Continuity event requires a valid provenance.author");
+  }
+  if (typeof provenance.origin !== "string") throw new Error("Continuity event requires provenance.origin");
+  if (typeof provenance.channel !== "string" || !CHANNELS.has(provenance.channel)) {
+    throw new Error("Continuity event requires a valid provenance.channel");
+  }
+  if (typeof provenance.recordedAt !== "string") throw new Error("Continuity event requires provenance.recordedAt");
+  return {
+    schemaVersion: 1,
+    eventId: event.eventId,
+    eventType: event.eventType,
+    memoryDomain: event.memoryDomain,
+    epistemicStatus: event.epistemicStatus,
+    confidence: event.confidence,
+    createdAt: event.createdAt,
+    sessionId: event.sessionId,
+    projectId: event.projectId,
+    subject: event.subject,
+    content: event.content,
+    sourceRefs: event.sourceRefs,
+    relationships: normalizeRelationships(event.relationships),
+    provenance
+  };
+}, "validateEvent");
+var isLedgerEvent = /* @__PURE__ */ __name((claim) => {
+  return isRecord(claim.knowledge) && claim.knowledge.schemaVersion === 1 && typeof claim.knowledge.eventId === "string";
+}, "isLedgerEvent");
+var loadEvents = /* @__PURE__ */ __name(async () => {
+  const state3 = await loadCombinedKnowledgeState();
+  const events = [];
+  for (const claim of state3.claims) {
+    if (isLedgerEvent(claim)) {
+      try {
+        events.push(validateEvent(claim.knowledge));
+      } catch {
+      }
+    }
+  }
+  return events.sort((left, right) => left.eventId.localeCompare(right.eventId));
+}, "loadEvents");
+var findEvent = /* @__PURE__ */ __name((events, eventId) => events.find((event) => event.eventId === eventId), "findEvent");
+var epistemicTypeFor = /* @__PURE__ */ __name((status) => {
+  if (status === "verified-fact" || status === "verified-result" || status === "decision") return "verified";
+  if (status === "user-statement") return "human-stated";
+  return "inferred";
+}, "epistemicTypeFor");
+var EVENT_ID_PATTERN = /^evt\.[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var validateEventId = /* @__PURE__ */ __name((eventId) => {
+  if (!EVENT_ID_PATTERN.test(eventId)) throw new Error(`Invalid continuity event ID: ${eventId}`);
+}, "validateEventId");
+var hasRelationshipPath = /* @__PURE__ */ __name((events, startId, targetId, relationKey) => {
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [startId];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === targetId) return true;
+    if (visited.has(current)) continue;
+    visited.add(current);
+    const event = findEvent(events, current);
+    if (!event) continue;
+    for (const next of event.relationships[relationKey]) {
+      if (!visited.has(next)) stack.push(next);
+    }
+  }
+  return false;
+}, "hasRelationshipPath");
+var CYCLIC_RELATIONSHIP_KEYS = /* @__PURE__ */ new Set([
+  "refines",
+  "supersedes",
+  "retracts",
+  "dependsOn",
+  "resolves",
+  "relatedTo"
+]);
+var validateRelationshipTargets = /* @__PURE__ */ __name(async (event, existing) => {
+  validateEventId(event.eventId);
+  for (const key of RELATIONSHIP_KEYS) {
+    for (const targetId of event.relationships[key]) {
+      validateEventId(targetId);
+      if (targetId === event.eventId) throw new Error(`Continuity event cannot reference itself: ${targetId}`);
+      const target = findEvent(existing, targetId);
+      if (!target) throw new Error(`Continuity relationship references a nonexistent event: ${targetId}`);
+      if (target.projectId !== event.projectId) {
+        throw new Error(`Cross-scope continuity relationship is not allowed: ${event.eventId} -> ${targetId}`);
+      }
+      if (CYCLIC_RELATIONSHIP_KEYS.has(key) && hasRelationshipPath(existing, targetId, event.eventId, key)) {
+        throw new Error(`Continuity relationship would create a cycle: ${event.eventId} -> ${targetId}`);
+      }
+    }
+  }
+}, "validateRelationshipTargets");
+var validateResolutionRequest = /* @__PURE__ */ __name(async (resolution, existing) => {
+  validateEventId(resolution.resolutionEventId);
+  if (!Array.isArray(resolution.conflictingEventIds) || resolution.conflictingEventIds.length === 0) {
+    throw new Error("Conflict resolution requires at least one conflicting event");
+  }
+  if (typeof resolution.selectedEventId !== "string" || !resolution.selectedEventId) {
+    throw new Error("Conflict resolution requires a selected event");
+  }
+  if (typeof resolution.reason !== "string" || !resolution.reason.trim()) {
+    throw new Error("Conflict resolution requires a reason");
+  }
+  const conflicting = resolution.conflictingEventIds.map((id) => {
+    validateEventId(id);
+    const event = findEvent(existing, id);
+    if (!event) throw new Error(`Conflict resolution references a nonexistent event: ${id}`);
+    if (event.relationships.supersedes.length !== 1) {
+      throw new Error(`Conflict resolution references a non-supersession event: ${id}`);
+    }
+    return event;
+  });
+  const targets = new Set(conflicting.map((event) => event.relationships.supersedes[0]));
+  if (targets.size !== 1) {
+    throw new Error("Conflict resolution references supersession events targeting different decisions");
+  }
+  const targetId = [...targets][0];
+  const knownCompeting = supersedingEvents(existing, targetId).map((event) => event.eventId).sort();
+  const requested = [...resolution.conflictingEventIds].sort();
+  if (requested.length !== knownCompeting.length || requested.some((id, index) => id !== knownCompeting[index])) {
+    throw new Error("Conflict resolution must include every competing supersession event");
+  }
+  if (!resolution.conflictingEventIds.includes(resolution.selectedEventId)) {
+    throw new Error("Conflict resolution selectedEventId must be one of the conflicting events");
+  }
+  const existingResolutions = existing.filter(
+    (event) => event.relationships.resolves.includes(targetId) || resolution.conflictingEventIds.some((id) => event.relationships.resolves.includes(id))
+  );
+  if (existingResolutions.length > 0) {
+    const selectedOutcomes = new Set(existingResolutions.map((event) => {
+      const content = isRecord(event.content) ? event.content : {};
+      return typeof content.selectedEventId === "string" ? content.selectedEventId : null;
+    }).filter((value) => value !== null));
+    if (existingResolutions.some((event) => event.eventId === resolution.resolutionEventId)) {
+      throw new Error(`Duplicate continuity resolution event: ${resolution.resolutionEventId}`);
+    }
+    if (selectedOutcomes.size > 0 && !selectedOutcomes.has(resolution.selectedEventId)) {
+      throw new Error("Incompatible continuity conflict resolution");
+    }
+    throw new Error("Continuity conflict is already resolved");
+  }
+  const resolutionEventId = resolution.resolutionEventId;
+  for (const conflictingId of resolution.conflictingEventIds) {
+    const event = findEvent(existing, conflictingId);
+    if (event && hasRelationshipPath(existing, conflictingId, resolutionEventId, "resolves")) {
+      throw new Error(`Continuity resolution would create a cycle: ${resolutionEventId}`);
+    }
+  }
+}, "validateResolutionRequest");
+var recordEventOnce = /* @__PURE__ */ __name(async (event) => {
+  const validated = validateEvent(event);
+  const existing = await loadEvents();
+  await validateRelationshipTargets(validated, existing);
+  if (existing.some((item) => item.eventId === validated.eventId)) {
+    throw new Error(`Continuity event already exists: ${validated.eventId}`);
+  }
+  const scope = validated.projectId ? "project" : "user";
+  const evidence = validated.sourceRefs.length > 0 ? validated.sourceRefs.map((ref) => ({
+    id: ref.id,
+    source: ref.kind,
+    observedAt: validated.createdAt,
+    supports: validated.eventId
+  })) : [{ id: validated.eventId, source: "continuity-ledger", observedAt: validated.createdAt, supports: validated.eventId }];
+  await memory.acquire({
+    id: validated.eventId,
+    knowledge: validated,
+    applicability: { ...LEDGER_APPLICABILITY, topic: validated.eventType },
+    evidence,
+    epistemicType: epistemicTypeFor(validated.epistemicStatus),
+    provenance: {
+      source: validated.provenance.origin,
+      detail: validated.provenance.channel
+    },
+    scope,
+    sourceProject: validated.projectId ?? void 0,
+    kind: "experience"
+  });
+}, "recordEventOnce");
+var recordEvent = /* @__PURE__ */ __name(async (event) => {
+  let lastError;
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    try {
+      await recordEventOnce(event);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (error instanceof Error && /Stale update/i.test(error.message) && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error("Continuity event recording failed");
+}, "recordEvent");
+var getEvent = /* @__PURE__ */ __name(async (eventId) => {
+  const events = await loadEvents();
+  return findEvent(events, eventId) ?? null;
+}, "getEvent");
+var listEvents = /* @__PURE__ */ __name(async (filter = {}) => {
+  const events = await loadEvents();
+  return events.filter((event) => {
+    if (filter.eventId && event.eventId !== filter.eventId) return false;
+    if (filter.eventType && event.eventType !== filter.eventType) return false;
+    if (filter.memoryDomain && event.memoryDomain !== filter.memoryDomain) return false;
+    if (filter.sessionId && event.sessionId !== filter.sessionId) return false;
+    if (filter.projectId !== void 0 && event.projectId !== filter.projectId) return false;
+    if (filter.epistemicStatus && event.epistemicStatus !== filter.epistemicStatus) return false;
+    return true;
+  });
+}, "listEvents");
+var supersedingEvents = /* @__PURE__ */ __name((events, eventId) => events.filter((event) => event.relationships.supersedes.includes(eventId)), "supersedingEvents");
+var retractingEvents = /* @__PURE__ */ __name((events, eventId) => events.filter((event) => event.relationships.retracts.includes(eventId)), "retractingEvents");
+var resolutionEventsFor = /* @__PURE__ */ __name((events, eventId, conflictingIds) => events.filter(
+  (event) => event.relationships.resolves.includes(eventId) || conflictingIds.some((id) => event.relationships.resolves.includes(id))
+), "resolutionEventsFor");
+var deriveValidity = /* @__PURE__ */ __name(async (eventId) => {
+  let events = await loadEvents();
+  for (let stabilityAttempt = 0; stabilityAttempt < 5; stabilityAttempt += 1) {
+    const nextEvents = await loadEvents();
+    if (nextEvents.length === events.length) break;
+    events = nextEvents;
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  const supersededBy = supersedingEvents(events, eventId).map((event) => event.eventId);
+  const retractedBy = retractingEvents(events, eventId).map((event) => event.eventId);
+  const contestedBy = supersededBy.length > 1 ? supersededBy : [];
+  const resolvedBy = resolutionEventsFor(events, eventId, contestedBy).map((event) => event.eventId);
+  let state3 = "current";
+  if (retractedBy.length > 0) state3 = "retracted";
+  else if (supersededBy.length > 0) state3 = supersededBy.length > 1 && resolvedBy.length === 0 ? "contested" : "superseded";
+  else if (events.some((event) => event.eventId === eventId && event.eventType === "decision") === false) state3 = "current";
+  if (supersededBy.length > 1 && resolvedBy.length === 0) state3 = "contested";
+  return {
+    eventId,
+    state: state3,
+    supersededBy,
+    retractedBy,
+    contestedBy,
+    resolvedBy
+  };
+}, "deriveValidity");
+var listContested = /* @__PURE__ */ __name(async () => {
+  const events = await loadEvents();
+  const targets = /* @__PURE__ */ new Set();
+  for (const event of events) {
+    for (const target of event.relationships.supersedes) targets.add(target);
+  }
+  const contested = [];
+  for (const target of targets) {
+    const supersededBy = supersedingEvents(events, target);
+    if (supersededBy.length <= 1) continue;
+    const conflictingIds = supersededBy.map((event) => event.eventId);
+    const resolvedBy = resolutionEventsFor(events, target, conflictingIds);
+    if (resolvedBy.length === 0) contested.push(target);
+  }
+  return contested.sort();
+}, "listContested");
+var resolveConflictOnce = /* @__PURE__ */ __name(async (resolution) => {
+  const existing = await loadEvents();
+  await validateResolutionRequest(resolution, existing);
+  const resolutionEvent = {
+    schemaVersion: 1,
+    eventId: resolution.resolutionEventId,
+    eventType: "correction",
+    memoryDomain: "professional",
+    epistemicStatus: "decision",
+    confidence: "high",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    sessionId: "resolution",
+    projectId: null,
+    subject: "Continuity conflict resolution",
+    content: {
+      selectedEventId: resolution.selectedEventId,
+      reason: resolution.reason
+    },
+    sourceRefs: resolution.conflictingEventIds.map((id) => ({ kind: "claim", id })),
+    relationships: {
+      refines: [],
+      supersedes: [],
+      retracts: [],
+      dependsOn: [],
+      resolves: [...resolution.conflictingEventIds],
+      relatedTo: [resolution.selectedEventId]
+    },
+    provenance: {
+      author: "system",
+      origin: "continuity-ledger",
+      channel: "acquisition",
+      recordedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  await recordEvent(resolutionEvent);
+}, "resolveConflictOnce");
+var reconstructValidity = /* @__PURE__ */ __name(async () => {
+  const events = await loadEvents();
+  const result = [];
+  const targets = new Set(events.map((event) => event.eventId));
+  for (const event of events) {
+    for (const target of event.relationships.supersedes) targets.add(target);
+    for (const target of event.relationships.retracts) targets.add(target);
+  }
+  for (const target of targets) {
+    result.push(await deriveValidity(target));
+  }
+  return result.sort((left, right) => left.eventId.localeCompare(right.eventId));
+}, "reconstructValidity");
+var resolveConflict = /* @__PURE__ */ __name(async (resolution) => {
+  let lastError;
+  for (let attempt = 0; attempt < 3; attempt += 1) {
+    try {
+      await resolveConflictOnce(resolution);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (error instanceof Error && /Stale update/i.test(error.message) && attempt < 9) {
+        await new Promise((resolve) => setTimeout(resolve, 20));
+        continue;
+      }
+      throw error;
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error("Continuity conflict resolution failed");
+}, "resolveConflict");
+var validateRelationships = validateRelationshipTargets;
+var continuityLedger = {
+  recordEvent,
+  record: recordEvent,
+  append: recordEvent,
+  add: recordEvent,
+  getEvent,
+  get: getEvent,
+  find: getEvent,
+  listEvents,
+  list: listEvents,
+  query: listEvents,
+  deriveValidity,
+  validity: deriveValidity,
+  listContested,
+  contested: listContested,
+  resolveConflict,
+  resolve: resolveConflict,
+  reconstructValidity,
+  validateRelationships,
+  validateRelationshipTargets,
+  validateResolution: validateResolutionRequest
+};
+
 // core/continuity/index.ts
 var continuity = {
   async context(options) {
@@ -12018,6 +12600,1232 @@ var createCompactionEngine = /* @__PURE__ */ __name((options) => new CompactionE
 // index.ts
 init_user_identity();
 init_user_paths();
+
+// core/governance/index.ts
+init_user_paths();
+init_policy();
+init_policy_namespace_lock();
+init_detection_events();
+init_policy();
+var GOVERNANCE_FILE_NAME = "governance.policy.json";
+var GOVERNANCE_FORMAT = "dotmem.governance-policy";
+var GOVERNANCE_VERSION = 1;
+var GOVERNANCE_AUDIT_RETENTION = 200;
+var GovernancePolicyError = class extends Error {
+  static {
+    __name(this, "GovernancePolicyError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "GovernancePolicyError";
+  }
+};
+var requiredText3 = /* @__PURE__ */ __name((v) => typeof v === "string" && v.trim().length > 0, "requiredText");
+var nowIso2 = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString(), "nowIso");
+var joinPath7 = /* @__PURE__ */ __name((base, child) => {
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return `${base.replace(/[\\/]+/g, sep)}${sep}${child}`;
+}, "joinPath");
+var resolveGovernanceDir = /* @__PURE__ */ __name((directory) => directory ?? joinPath7(resolveUserDotMemPath(), "policy"), "resolveGovernanceDir");
+var resolveGovernanceFilePath = /* @__PURE__ */ __name((directory) => joinPath7(resolveGovernanceDir(directory), GOVERNANCE_FILE_NAME), "resolveGovernanceFilePath");
+var ROLE_CAPABILITIES = {
+  "human-owner": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.approve", "policy.reject", "policy.activate", "policy.suspend", "policy.retire", "role.bind", "governance.read", "governance.audit.read", "agent.execute", "guardrail.stop.activate", "guardrail.stop.release"]),
+  "human-approver": /* @__PURE__ */ new Set(["policy.review", "policy.approve", "policy.reject", "governance.read", "governance.audit.read", "guardrail.stop.activate", "guardrail.stop.release"]),
+  "coordinator-jo": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.activate", "governance.read", "governance.audit.read", "agent.execute"]),
+  "specialist-agent": /* @__PURE__ */ new Set(["policy.propose", "governance.read"]),
+  "policy-authority": /* @__PURE__ */ new Set(["policy.propose", "policy.review", "policy.activate", "governance.read", "governance.audit.read", "agent.execute"]),
+  "auditor-reviewer": /* @__PURE__ */ new Set(["governance.read", "governance.audit.read"])
+};
+var defaultRoleBindings = /* @__PURE__ */ __name(() => [
+  { principalId: "hi", role: "human-owner", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+  { principalId: "human-owner", role: "human-owner", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() },
+  { principalId: "jo", role: "coordinator-jo", scope: "*", grantedBy: "system", grantedAt: (/* @__PURE__ */ new Date(0)).toISOString() }
+], "defaultRoleBindings");
+var emptyDocument2 = /* @__PURE__ */ __name(() => ({
+  format: GOVERNANCE_FORMAT,
+  version: GOVERNANCE_VERSION,
+  revision: 0,
+  policies: [],
+  roleBindings: defaultRoleBindings(),
+  audit: []
+}), "emptyDocument");
+var validateAuthority = /* @__PURE__ */ __name((value) => {
+  try {
+    return validatePolicyAuthority(value);
+  } catch (err2) {
+    void detectAuthorityEscalationAttempt({ claimed: "invalid governance authority", channel: "governance" }).catch(() => void 0);
+    throw err2 instanceof GovernancePolicyError ? err2 : new GovernancePolicyError(err2.message);
+  }
+}, "validateAuthority");
+var buildAudit = /* @__PURE__ */ __name((entry) => ({
+  id: entry.id ?? `gov-audit.${entry.action}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`,
+  action: entry.action,
+  at: entry.at,
+  ...entry.actorPrincipal !== void 0 ? { actorPrincipal: entry.actorPrincipal } : {},
+  ...entry.actorRole !== void 0 ? { actorRole: entry.actorRole } : {},
+  ...entry.targetPolicyId !== void 0 ? { targetPolicyId: entry.targetPolicyId } : {},
+  ...entry.targetVersion !== void 0 ? { targetVersion: entry.targetVersion } : {},
+  ...entry.scope !== void 0 ? { scope: entry.scope } : {},
+  outcome: entry.outcome,
+  ...entry.reason !== void 0 ? { reason: entry.reason } : {},
+  ...entry.detail !== void 0 ? { detail: entry.detail } : {},
+  ...entry.correlationId !== void 0 ? { correlationId: entry.correlationId } : {},
+  ...entry.mandatory !== void 0 ? { mandatory: entry.mandatory } : {}
+}), "buildAudit");
+var boundedAudit2 = /* @__PURE__ */ __name((entries2) => {
+  if (entries2.length <= GOVERNANCE_AUDIT_RETENTION) return [...entries2];
+  const kept = [];
+  let budget = GOVERNANCE_AUDIT_RETENTION;
+  for (let i2 = entries2.length - 1; i2 >= 0; i2--) {
+    const e = entries2[i2];
+    const mandatory = e.mandatory === true;
+    if (mandatory || budget > 0) {
+      kept.unshift(e);
+      if (!mandatory) budget--;
+    }
+  }
+  return kept;
+}, "boundedAudit");
+var validatePolicy = /* @__PURE__ */ __name((p) => {
+  if (!p || typeof p !== "object" || Array.isArray(p)) throw new GovernancePolicyError("Governance policy must be an object");
+  const r = p;
+  if (!requiredText3(r.policyId)) throw new GovernancePolicyError("policyId is required");
+  if (typeof r.version !== "number" || !Number.isInteger(r.version) || r.version < 1) throw new GovernancePolicyError("version must be a positive integer");
+  if (!requiredText3(r.scope)) throw new GovernancePolicyError("scope is required");
+  if (!requiredText3(r.rationale)) throw new GovernancePolicyError("rationale is required");
+  if (!requiredText3(r.proposedBy)) throw new GovernancePolicyError("proposedBy is required");
+  if (!requiredText3(r.proposedAt)) throw new GovernancePolicyError("proposedAt is required");
+  if (typeof r.status !== "string" || !["proposed", "under_review", "approved", "active", "rejected", "suspended", "retired"].includes(r.status)) {
+    throw new GovernancePolicyError("invalid status");
+  }
+  if (typeof r.revision !== "number" || !Number.isInteger(r.revision) || r.revision < 0) throw new GovernancePolicyError("revision must be a non-negative integer");
+  if (!Array.isArray(r.applicablePrincipals)) throw new GovernancePolicyError("applicablePrincipals must be an array");
+  if (!Array.isArray(r.applicableResources)) throw new GovernancePolicyError("applicableResources must be an array");
+  const authority = validateAuthority(r.ownerAuthority);
+  return {
+    policyId: r.policyId,
+    version: r.version,
+    ...requiredText3(r.title) ? { title: r.title } : {},
+    ...requiredText3(r.description) ? { description: r.description } : {},
+    scope: r.scope,
+    applicablePrincipals: r.applicablePrincipals,
+    applicableResources: r.applicableResources,
+    ...requiredText3(r.effectiveAt) ? { effectiveAt: r.effectiveAt } : {},
+    ...requiredText3(r.expiresAt) ? { expiresAt: r.expiresAt } : {},
+    rationale: r.rationale,
+    status: r.status,
+    ownerAuthority: authority,
+    proposedBy: r.proposedBy,
+    proposedAt: r.proposedAt,
+    ...requiredText3(r.reviewedBy) ? { reviewedBy: r.reviewedBy } : {},
+    ...requiredText3(r.reviewedAt) ? { reviewedAt: r.reviewedAt } : {},
+    ...r.approval && typeof r.approval === "object" ? { approval: r.approval } : {},
+    ...requiredText3(r.activatedBy) ? { activatedBy: r.activatedBy } : {},
+    ...requiredText3(r.activatedAt) ? { activatedAt: r.activatedAt } : {},
+    ...requiredText3(r.suspendedBy) ? { suspendedBy: r.suspendedBy } : {},
+    ...requiredText3(r.suspendedAt) ? { suspendedAt: r.suspendedAt } : {},
+    ...requiredText3(r.retiredBy) ? { retiredBy: r.retiredBy } : {},
+    ...requiredText3(r.retiredAt) ? { retiredAt: r.retiredAt } : {},
+    ...requiredText3(r.supersedes) ? { supersedes: r.supersedes } : {},
+    ...requiredText3(r.supersededBy) ? { supersededBy: r.supersededBy } : {},
+    ...requiredText3(r.correlationId) ? { correlationId: r.correlationId } : {},
+    revision: r.revision,
+    ...requiredText3(r.fingerprint) ? { fingerprint: r.fingerprint } : {}
+  };
+}, "validatePolicy");
+var validateRoleBinding = /* @__PURE__ */ __name((rb) => {
+  if (!rb || typeof rb !== "object" || Array.isArray(rb)) throw new GovernancePolicyError("role binding must be an object");
+  const r = rb;
+  if (!requiredText3(r.principalId)) throw new GovernancePolicyError("principalId is required");
+  if (typeof r.role !== "string" || !["human-owner", "human-approver", "coordinator-jo", "specialist-agent", "policy-authority", "auditor-reviewer"].includes(r.role)) {
+    throw new GovernancePolicyError("invalid role");
+  }
+  if (!requiredText3(r.scope)) throw new GovernancePolicyError("scope is required");
+  return {
+    principalId: r.principalId,
+    role: r.role,
+    scope: r.scope,
+    ...requiredText3(r.grantedBy) ? { grantedBy: r.grantedBy } : {},
+    ...requiredText3(r.grantedAt) ? { grantedAt: r.grantedAt } : {}
+  };
+}, "validateRoleBinding");
+var validateDocument2 = /* @__PURE__ */ __name((value) => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new GovernancePolicyError("document must be an object");
+  const d = value;
+  if (d.format !== GOVERNANCE_FORMAT) throw new GovernancePolicyError("invalid format");
+  if (d.version !== GOVERNANCE_VERSION) throw new GovernancePolicyError("invalid version");
+  if (typeof d.revision !== "number" || !Number.isInteger(d.revision) || d.revision < 0) throw new GovernancePolicyError("invalid revision");
+  if (!Array.isArray(d.policies)) throw new GovernancePolicyError("policies must be an array");
+  if (!Array.isArray(d.roleBindings)) throw new GovernancePolicyError("roleBindings must be an array");
+  if (!Array.isArray(d.audit)) throw new GovernancePolicyError("audit must be an array");
+  const policies = d.policies.map(validatePolicy);
+  const roleBindings = d.roleBindings.map(validateRoleBinding);
+  const audit = d.audit.map((e) => {
+    if (!e || typeof e !== "object" || Array.isArray(e)) throw new GovernancePolicyError("audit entry must be an object");
+    const r = e;
+    if (!requiredText3(r.id)) throw new GovernancePolicyError("audit id required");
+    if (!requiredText3(r.action)) throw new GovernancePolicyError("audit action required");
+    if (!requiredText3(r.at)) throw new GovernancePolicyError("audit at required");
+    if (r.outcome !== "applied" && r.outcome !== "rejected") throw new GovernancePolicyError("audit outcome invalid");
+    return r;
+  });
+  return { format: GOVERNANCE_FORMAT, version: GOVERNANCE_VERSION, revision: d.revision, policies, roleBindings, audit };
+}, "validateDocument");
+var scopeCovers = /* @__PURE__ */ __name((bindingScope, targetScope) => {
+  if (bindingScope === "*") return true;
+  if (bindingScope === targetScope) return true;
+  return targetScope.startsWith(bindingScope.endsWith("/") ? bindingScope : bindingScope + "/");
+}, "scopeCovers");
+var GovernancePolicyStore = class {
+  constructor(directory) {
+    this.directory = directory;
+  }
+  directory;
+  static {
+    __name(this, "GovernancePolicyStore");
+  }
+  dir() {
+    return resolveGovernanceDir(this.directory);
+  }
+  filePath() {
+    return resolveGovernanceFilePath(this.directory);
+  }
+  async load() {
+    const fs = await import('fs/promises');
+    let raw;
+    try {
+      raw = await fs.readFile(this.filePath(), "utf8");
+    } catch (err2) {
+      if (err2.code === "ENOENT") return emptyDocument2();
+      throw err2;
+    }
+    return validateDocument2(JSON.parse(raw));
+  }
+  async readDoc(fs) {
+    try {
+      const raw = await fs.readFile(this.filePath(), "utf8");
+      return validateDocument2(JSON.parse(raw));
+    } catch (err2) {
+      if (err2.code === "ENOENT") return emptyDocument2();
+      throw err2;
+    }
+  }
+  async writeDoc(fs, doc) {
+    await fs.mkdir(this.dir(), { recursive: true });
+    const fp = this.filePath();
+    const tmp = `${fp}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    try {
+      await fs.writeFile(tmp, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+      const handle = await fs.open(tmp, "r+");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await fs.rename(tmp, fp);
+    } catch (err2) {
+      await fs.rm(tmp, { force: true }).catch(() => void 0);
+      throw err2;
+    }
+  }
+  async mutate(operation, options = {}) {
+    const directory = this.dir();
+    return withPolicyNamespaceLock(async (session3) => {
+      const fs = await import('fs/promises');
+      const doc = await this.readDoc(fs);
+      if (options.basedOnRevision !== void 0 && options.basedOnRevision !== doc.revision) {
+        throw new GovernancePolicyError(`Stale governance revision: expected ${options.basedOnRevision}, current ${doc.revision}`);
+      }
+      const outcome = operation(doc);
+      let next = outcome.document;
+      validateDocument2(next);
+      await session3.assertOwnership();
+      await this.writeDoc(fs, next);
+      return outcome.result;
+    }, { directory });
+  }
+  // --- role helpers ---
+  findRoleBinding(doc, principalId, scope) {
+    const candidates = doc.roleBindings.filter((rb) => rb.principalId === principalId && scopeCovers(rb.scope, scope));
+    if (candidates.length === 0) return null;
+    return candidates.sort((a, b) => b.scope.length - a.scope.length)[0];
+  }
+  resolveRole(principalId, scope = "*") {
+    return { principalId, role: null, scope, reason: "use resolveRoleAsync" };
+  }
+  async resolveRoleAsync(principalId, scope = "*") {
+    const doc = await this.load();
+    const rb = this.findRoleBinding(doc, principalId, scope);
+    if (!rb) return { principalId, role: null, scope, reason: "no role binding for principal in scope" };
+    return { principalId, role: rb.role, scope, reason: `bound role ${rb.role} (scope ${rb.scope})` };
+  }
+  async hasPermission(principalId, action, scope) {
+    const res = await this.resolveRoleAsync(principalId, scope);
+    if (!res.role) return false;
+    return ROLE_CAPABILITIES[res.role].has(action);
+  }
+  // --- role binding governed ---
+  async bindRole(input, basedOnRevision) {
+    const authority = validateAuthority(input.authority);
+    if (!requiredText3(input.principalId)) throw new GovernancePolicyError("principalId is required");
+    if (!requiredText3(input.grantedBy)) throw new GovernancePolicyError("grantedBy is required");
+    if (input.principalId === input.grantedBy && (input.role === "human-owner" || input.role === "human-approver" || input.role === "policy-authority")) {
+      void detectSelfPromoted({ claim: `self-grant ${input.role}`, channel: "governance.role.bind" }).catch(() => void 0);
+      throw new GovernancePolicyError("self-grant of elevated role denied");
+    }
+    const doc0 = await this.load();
+    const grantedByRole = this.findRoleBinding(doc0, input.grantedBy, input.scope ?? "*");
+    if (!grantedByRole || !ROLE_CAPABILITIES[grantedByRole.role].has("role.bind")) {
+      throw new GovernancePolicyError("grantedBy lacks role.bind authority");
+    }
+    if (authority.kind !== "HI" && authority.kind !== "operator") {
+      throw new GovernancePolicyError("invalid authority for role binding");
+    }
+    const binding = {
+      principalId: input.principalId,
+      role: input.role,
+      scope: input.scope || "*",
+      grantedBy: input.grantedBy,
+      grantedAt: nowIso2()
+    };
+    return this.mutate((doc) => {
+      const nextBindings = [...doc.roleBindings.filter((rb) => !(rb.principalId === binding.principalId && rb.scope === binding.scope)), binding];
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "role.bind",
+        at: binding.grantedAt,
+        actorPrincipal: input.grantedBy,
+        actorRole: grantedByRole.role,
+        scope: binding.scope,
+        outcome: "applied",
+        detail: `bound ${binding.principalId} to ${binding.role} in scope ${binding.scope}`,
+        correlationId: void 0
+      })]);
+      return { document: { ...doc, revision, roleBindings: nextBindings, audit }, result: binding };
+    }, { basedOnRevision });
+  }
+  // --- propose ---
+  async propose(input, basedOnRevision) {
+    if (!input || typeof input !== "object") throw new GovernancePolicyError("proposal input required");
+    if (!requiredText3(input.scope)) throw new GovernancePolicyError("scope is required");
+    if (!requiredText3(input.rationale)) throw new GovernancePolicyError("rationale is required");
+    if (!requiredText3(input.proposedBy)) throw new GovernancePolicyError("proposedBy is required");
+    const authority = validateAuthority(input.authority);
+    const doc0 = await this.load();
+    if (!await this.hasPermission(input.proposedBy, "policy.propose", input.scope)) {
+      void detectAuthorityEscalationAttempt({ claimed: `${input.proposedBy} propose without permission`, channel: "governance.propose" }).catch(() => void 0);
+      await this.recordDenial(doc0, "policy.propose", input.proposedBy, input.scope, "permission denied");
+      throw new GovernancePolicyError("proposer lacks policy.propose permission");
+    }
+    const policyId = requiredText3(input.policyId) ? input.policyId : `gov-policy.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    const existing = doc0.policies.filter((p) => p.policyId === policyId);
+    const version = existing.length > 0 ? Math.max(...existing.map((p) => p.version)) + 1 : 1;
+    const supersedes = input.supersedes;
+    const policy2 = {
+      policyId,
+      version,
+      ...requiredText3(input.title) ? { title: input.title } : {},
+      ...requiredText3(input.description) ? { description: input.description } : {},
+      scope: input.scope,
+      applicablePrincipals: input.applicablePrincipals ?? [],
+      applicableResources: input.applicableResources ?? [],
+      ...requiredText3(input.effectiveAt) ? { effectiveAt: input.effectiveAt } : {},
+      ...requiredText3(input.expiresAt) ? { expiresAt: input.expiresAt } : {},
+      rationale: input.rationale,
+      status: "proposed",
+      ownerAuthority: authority,
+      proposedBy: input.proposedBy,
+      proposedAt: nowIso2(),
+      ...requiredText3(supersedes) ? { supersedes } : {},
+      ...requiredText3(input.correlationId) ? { correlationId: input.correlationId } : {},
+      revision: 0
+    };
+    return this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const fingerprint = `${policy2.policyId}@v${policy2.version}`;
+      const stored = { ...policy2, revision, fingerprint };
+      const policies = [...doc.policies, stored];
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.proposed",
+        at: stored.proposedAt,
+        actorPrincipal: input.proposedBy,
+        targetPolicyId: stored.policyId,
+        targetVersion: stored.version,
+        scope: stored.scope,
+        outcome: "applied",
+        detail: `policy ${stored.policyId} v${stored.version} proposed`,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: stored };
+    }, { basedOnRevision });
+  }
+  async recordDenial(doc, action, actor, scope, reason) {
+    try {
+      await this.mutate((d) => {
+        const revision = d.revision + 1;
+        const audit = boundedAudit2([...d.audit, buildAudit({
+          action: `${action}.denied`,
+          at: nowIso2(),
+          actorPrincipal: actor,
+          scope,
+          outcome: "rejected",
+          reason
+        })]);
+        return { document: { ...d, revision, audit }, result: void 0 };
+      });
+    } catch {
+    }
+  }
+  // --- review ---
+  async review(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.reviewerPrincipal)) throw new GovernancePolicyError("reviewerPrincipal is required");
+    const doc0 = await this.load();
+    if (!await this.hasPermission(input.reviewerPrincipal, "policy.review", "*")) {
+      const pol = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+      const scope = pol?.scope ?? "*";
+      if (!await this.hasPermission(input.reviewerPrincipal, "policy.review", scope)) {
+        await this.recordDenial(doc0, "policy.review", input.reviewerPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("reviewer lacks policy.review permission");
+      }
+    }
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    if (policy2.status !== "proposed") throw new GovernancePolicyError(`cannot review policy in status ${policy2.status}`);
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const updated = {
+        ...doc.policies[idx],
+        status: "under_review",
+        reviewedBy: input.reviewerPrincipal,
+        reviewedAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.reviewed",
+        at: updated.reviewedAt,
+        actorPrincipal: input.reviewerPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- decide (approve/reject) ---
+  async decide(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.approverPrincipal)) throw new GovernancePolicyError("approverPrincipal is required");
+    if (input.decision !== "approved" && input.decision !== "rejected") throw new GovernancePolicyError("decision must be approved or rejected");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    const action = input.decision === "approved" ? "policy.approve" : "policy.reject";
+    if (!await this.hasPermission(input.approverPrincipal, "policy.approve", scope) && !await this.hasPermission(input.approverPrincipal, "policy.reject", scope)) {
+      if (!await this.hasPermission(input.approverPrincipal, "policy.approve", scope)) {
+        await this.recordDenial(doc0, action, input.approverPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("approver lacks approval permission");
+      }
+    }
+    if (input.approverPrincipal === policy2.proposedBy) {
+      void detectSelfPromoted({ claim: `self-approval ${policy2.policyId}`, channel: "governance.approve" }).catch(() => void 0);
+      await this.recordDenial(doc0, action, input.approverPrincipal, scope, "self-approval denied");
+      throw new GovernancePolicyError("self-approval denied: proposer cannot be sole approver");
+    }
+    if (policy2.status !== "under_review" && policy2.status !== "proposed") {
+      throw new GovernancePolicyError(`cannot decide policy in status ${policy2.status}`);
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      const newStatus = input.decision === "approved" ? "approved" : "rejected";
+      const updated = {
+        ...current,
+        status: newStatus,
+        approval: {
+          approverPrincipal: input.approverPrincipal,
+          decision: input.decision,
+          ...requiredText3(input.reason) ? { reason: input.reason } : {},
+          at: nowIso2()
+        }
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: input.decision === "approved" ? "policy.approved" : "policy.rejected",
+        at: updated.approval.at,
+        actorPrincipal: input.approverPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- activate ---
+  async activate(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.activatorPrincipal)) throw new GovernancePolicyError("activatorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    if (policy2.status !== "approved") throw new GovernancePolicyError(`cannot activate policy in status ${policy2.status}`);
+    const scope = policy2.scope;
+    if (!await this.hasPermission(input.activatorPrincipal, "policy.activate", scope)) {
+      await this.recordDenial(doc0, "policy.activate", input.activatorPrincipal, scope, "permission denied");
+      throw new GovernancePolicyError("activator lacks policy.activate permission");
+    }
+    const now3 = /* @__PURE__ */ new Date();
+    if (policy2.effectiveAt && Date.parse(policy2.effectiveAt) > now3.getTime()) {
+      throw new GovernancePolicyError("policy not yet effective");
+    }
+    if (policy2.expiresAt && Date.parse(policy2.expiresAt) <= now3.getTime()) {
+      throw new GovernancePolicyError("policy expired");
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      if (current.status !== "approved") throw new GovernancePolicyError(`cannot activate policy in status ${current.status}`);
+      const policies = doc.policies.map((p) => {
+        if (p.policyId === current.policyId && p.version !== current.version && p.status === "active") {
+          return { ...p, status: "retired", retiredBy: input.activatorPrincipal, retiredAt: nowIso2(), supersededBy: `${current.policyId}@v${current.version}` };
+        }
+        return p;
+      });
+      const nowStr = nowIso2();
+      policies[idx] = {
+        ...current,
+        status: "active",
+        activatedBy: input.activatorPrincipal,
+        activatedAt: nowStr
+      };
+      const updated = policies[idx];
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.activated",
+        at: nowStr,
+        actorPrincipal: input.activatorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  async suspend(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.actorPrincipal)) throw new GovernancePolicyError("actorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    if (!await this.hasPermission(input.actorPrincipal, "policy.suspend", scope)) {
+      const role = await this.resolveRoleAsync(input.actorPrincipal, scope);
+      if (role.role !== "human-owner" && role.role !== "human-approver") {
+        await this.recordDenial(doc0, "policy.suspend", input.actorPrincipal, scope, "permission denied");
+        throw new GovernancePolicyError("actor lacks suspend permission");
+      }
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      if (current.status !== "active" && current.status !== "approved") throw new GovernancePolicyError(`cannot suspend policy in status ${current.status}`);
+      const updated = {
+        ...current,
+        status: "suspended",
+        suspendedBy: input.actorPrincipal,
+        suspendedAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.suspended",
+        at: updated.suspendedAt,
+        actorPrincipal: input.actorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  async retire(input) {
+    if (!input || !requiredText3(input.policyId)) throw new GovernancePolicyError("policyId is required");
+    if (typeof input.version !== "number") throw new GovernancePolicyError("version is required");
+    if (!requiredText3(input.actorPrincipal)) throw new GovernancePolicyError("actorPrincipal is required");
+    const doc0 = await this.load();
+    const policy2 = doc0.policies.find((p) => p.policyId === input.policyId && p.version === input.version);
+    if (!policy2) throw new GovernancePolicyError("policy not found");
+    const scope = policy2.scope;
+    const role = await this.resolveRoleAsync(input.actorPrincipal, scope);
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.recordDenial(doc0, "policy.retire", input.actorPrincipal, scope, "permission denied");
+      throw new GovernancePolicyError("actor lacks retire permission");
+    }
+    return this.mutate((doc) => {
+      const idx = doc.policies.findIndex((p) => p.policyId === input.policyId && p.version === input.version);
+      if (idx < 0) throw new GovernancePolicyError("policy not found");
+      const current = doc.policies[idx];
+      const updated = {
+        ...current,
+        status: "retired",
+        retiredBy: input.actorPrincipal,
+        retiredAt: nowIso2()
+      };
+      const policies = [...doc.policies];
+      policies[idx] = updated;
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: "policy.retired",
+        at: updated.retiredAt,
+        actorPrincipal: input.actorPrincipal,
+        targetPolicyId: updated.policyId,
+        targetVersion: updated.version,
+        scope: updated.scope,
+        outcome: "applied",
+        reason: input.reason,
+        correlationId: input.correlationId
+      })]);
+      return { document: { ...doc, revision, policies, audit }, result: updated };
+    });
+  }
+  // --- resolution (fail-closed) ---
+  async resolvePolicy(policyId, version, requestedScope, now3 = /* @__PURE__ */ new Date()) {
+    const doc = await this.load();
+    const policy2 = doc.policies.find((p) => p.policyId === policyId && p.version === version);
+    if (!policy2) {
+      return { outcome: "none", policy: null, reason: "no applicable policy" };
+    }
+    if (!scopeCovers(policy2.scope, requestedScope)) {
+      return { outcome: "insufficient-scope", policy: null, reason: "policy scope does not cover requested scope" };
+    }
+    if (!policy2.ownerAuthority || policy2.ownerAuthority.kind !== "HI" && policy2.ownerAuthority.kind !== "operator") {
+      return { outcome: "unresolved-authority", policy: null, reason: "unresolved or invalid authority" };
+    }
+    if (policy2.effectiveAt && Date.parse(policy2.effectiveAt) > now3.getTime()) {
+      return { outcome: "not-yet-effective", policy: null, reason: "policy not yet effective" };
+    }
+    if (policy2.expiresAt && Date.parse(policy2.expiresAt) <= now3.getTime()) {
+      return { outcome: "expired", policy: null, reason: "policy expired" };
+    }
+    if (policy2.status !== "active") {
+      return { outcome: "none", policy: null, reason: `policy status ${policy2.status} is not active` };
+    }
+    if (policy2.fingerprint && policy2.fingerprint !== `${policy2.policyId}@v${policy2.version}`) {
+      return { outcome: "invalid-provenance", policy: null, reason: "fingerprint mismatch" };
+    }
+    return { outcome: "applicable", policy: policy2, reason: "applicable and valid" };
+  }
+  async resolveActivePolicies(scope, now3 = /* @__PURE__ */ new Date()) {
+    const doc = await this.load();
+    const active = doc.policies.filter((p) => p.status === "active" && scopeCovers(p.scope, scope));
+    return active.filter((p) => {
+      if (p.effectiveAt && Date.parse(p.effectiveAt) > now3.getTime()) return false;
+      if (p.expiresAt && Date.parse(p.expiresAt) <= now3.getTime()) return false;
+      return true;
+    });
+  }
+  async checkConflicts(scope, now3 = /* @__PURE__ */ new Date()) {
+    const actives = await this.resolveActivePolicies(scope, now3);
+    const conflicting = actives.length > 1;
+    return { conflicting, policies: actives };
+  }
+  async failClosedResolve(scope, now3 = /* @__PURE__ */ new Date()) {
+    const actives = await this.resolveActivePolicies(scope, now3);
+    if (actives.length === 0) {
+      return { outcome: "none", policy: null, reason: "no applicable policy" };
+    }
+    if (actives.length > 1) {
+      return { outcome: "conflicting", policy: null, reason: "conflicting active policies" };
+    }
+    const p = actives[0];
+    if (!p.ownerAuthority || p.ownerAuthority.kind !== "HI" && p.ownerAuthority.kind !== "operator") {
+      return { outcome: "unresolved-authority", policy: null, reason: "unresolved authority" };
+    }
+    return { outcome: "applicable", policy: p, reason: "applicable and valid" };
+  }
+  // --- authorization granted/denied audit ---
+  async recordAuthorization(decision) {
+    await this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: decision.allowed ? "authorization.granted" : "authorization.denied",
+        at: nowIso2(),
+        actorPrincipal: decision.principalId,
+        scope: decision.scope ?? decision.resource,
+        outcome: decision.allowed ? "applied" : "rejected",
+        reason: decision.reason,
+        detail: `${decision.action} on ${decision.resource}`,
+        correlationId: decision.correlationId
+      })]);
+      return { document: { ...doc, revision, audit }, result: void 0 };
+    });
+  }
+  // --- list ---
+  async listPolicies() {
+    const doc = await this.load();
+    return [...doc.policies].sort((a, b) => a.policyId.localeCompare(b.policyId) || a.version - b.version);
+  }
+  async listRoleBindings() {
+    const doc = await this.load();
+    return [...doc.roleBindings];
+  }
+  async auditTrail() {
+    const doc = await this.load();
+    return [...doc.audit];
+  }
+  async recordAuditEvent(input) {
+    await this.mutate((doc) => {
+      const revision = doc.revision + 1;
+      const audit = boundedAudit2([...doc.audit, buildAudit({
+        action: input.action,
+        at: input.at ?? nowIso2(),
+        ...input.actorPrincipal !== void 0 ? { actorPrincipal: input.actorPrincipal } : {},
+        ...input.actorRole !== void 0 ? { actorRole: input.actorRole } : {},
+        ...input.targetPolicyId !== void 0 ? { targetPolicyId: input.targetPolicyId } : {},
+        ...input.targetVersion !== void 0 ? { targetVersion: input.targetVersion } : {},
+        ...input.scope !== void 0 ? { scope: input.scope } : {},
+        outcome: input.outcome,
+        ...input.reason !== void 0 ? { reason: input.reason } : {},
+        ...input.detail !== void 0 ? { detail: input.detail } : {},
+        ...input.correlationId !== void 0 ? { correlationId: input.correlationId } : {},
+        ...input.mandatory !== void 0 ? { mandatory: input.mandatory } : {}
+      })]);
+      return { document: { ...doc, revision, audit }, result: void 0 };
+    });
+  }
+};
+var roleHasPermission = /* @__PURE__ */ __name((role, action) => ROLE_CAPABILITIES[role].has(action), "roleHasPermission");
+var GOVERNANCE_ROLES = [
+  "human-owner",
+  "human-approver",
+  "coordinator-jo",
+  "specialist-agent",
+  "policy-authority",
+  "auditor-reviewer"
+];
+var GOVERNANCE_POLICY_STATUSES = [
+  "proposed",
+  "under_review",
+  "approved",
+  "active",
+  "rejected",
+  "suspended",
+  "retired"
+];
+
+// core/guardrails/index.ts
+init_user_paths();
+init_policy_namespace_lock();
+var STOP_FILE_NAME = "guardrails.stop.json";
+var STOP_FORMAT = "dotmem.guardrails-stop";
+var STOP_VERSION = 1;
+var GuardrailError = class extends Error {
+  static {
+    __name(this, "GuardrailError");
+  }
+  constructor(message) {
+    super(message);
+    this.name = "GuardrailError";
+  }
+};
+var requiredText4 = /* @__PURE__ */ __name((v) => typeof v === "string" && v.trim().length > 0, "requiredText");
+var nowIso3 = /* @__PURE__ */ __name(() => (/* @__PURE__ */ new Date()).toISOString(), "nowIso");
+var joinPath8 = /* @__PURE__ */ __name((base, child) => {
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return `${base.replace(/[\\/]+/g, sep)}${sep}${child}`;
+}, "joinPath");
+var resolveGuardrailDir = /* @__PURE__ */ __name((directory) => directory ?? joinPath8(resolveUserDotMemPath(), "policy"), "resolveGuardrailDir");
+var resolveStopFilePath = /* @__PURE__ */ __name((directory) => joinPath8(resolveGuardrailDir(directory), STOP_FILE_NAME), "resolveStopFilePath");
+var ACTIONS_REQUIRING_TRUSTED_IDENTITY = /* @__PURE__ */ new Set([
+  "agent.execute",
+  "guardrail.stop.activate",
+  "guardrail.stop.release"
+]);
+var GuardrailService = class {
+  static {
+    __name(this, "GuardrailService");
+  }
+  directory;
+  governance;
+  constructor(directory, governance) {
+    this.directory = directory;
+    this.governance = governance ?? new GovernancePolicyStore(directory);
+  }
+  dir() {
+    return resolveGuardrailDir(this.directory);
+  }
+  // --- stop controller persistence ---
+  async readStopState() {
+    const fs = await import('fs/promises');
+    let raw;
+    try {
+      raw = await fs.readFile(resolveStopFilePath(this.directory), "utf8");
+    } catch (err2) {
+      if (err2.code === "ENOENT") {
+        return { stopped: false, revision: 0 };
+      }
+      throw err2;
+    }
+    const parsed = JSON.parse(raw);
+    if (parsed.format !== STOP_FORMAT || parsed.version !== STOP_VERSION) {
+      throw new GuardrailError("invalid stop state document");
+    }
+    return {
+      stopped: parsed.stopped === true,
+      ...requiredText4(parsed.activatedBy) ? { activatedBy: parsed.activatedBy } : {},
+      ...requiredText4(parsed.activatedAt) ? { activatedAt: parsed.activatedAt } : {},
+      ...requiredText4(parsed.reason) ? { reason: parsed.reason } : {},
+      ...requiredText4(parsed.releasedBy) ? { releasedBy: parsed.releasedBy } : {},
+      ...requiredText4(parsed.releasedAt) ? { releasedAt: parsed.releasedAt } : {},
+      revision: typeof parsed.revision === "number" ? parsed.revision : 0
+    };
+  }
+  async writeStopState(state3) {
+    const fs = await import('fs/promises');
+    const dir = this.dir();
+    await fs.mkdir(dir, { recursive: true });
+    const fp = resolveStopFilePath(this.directory);
+    const tmp = `${fp}.${process.pid}.${Date.now().toString(36)}.tmp`;
+    const doc = { format: STOP_FORMAT, version: STOP_VERSION, ...state3 };
+    try {
+      await fs.writeFile(tmp, `${JSON.stringify(doc, null, 2)}
+`, "utf8");
+      const handle = await fs.open(tmp, "r+");
+      try {
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await fs.rename(tmp, fp);
+    } catch (err2) {
+      await fs.rm(tmp, { force: true }).catch(() => void 0);
+      throw err2;
+    }
+  }
+  async getStopState() {
+    return this.readStopState();
+  }
+  async isStopped() {
+    const s = await this.readStopState();
+    return s.stopped;
+  }
+  async activateStop(input) {
+    if (!requiredText4(input.actorPrincipal)) throw new GuardrailError("actorPrincipal is required");
+    const role = await this.governance.resolveRoleAsync(input.actorPrincipal, "*");
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.activate.denied",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "rejected",
+        reason: "insufficient authority to activate stop",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      throw new GuardrailError("unauthorized stop activation");
+    }
+    const current = await this.readStopState();
+    if (current.stopped) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.activate",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "applied",
+        reason: "already stopped (idempotent)",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      return current;
+    }
+    const now3 = nowIso3();
+    const next = {
+      stopped: true,
+      activatedBy: input.actorPrincipal,
+      activatedAt: now3,
+      ...requiredText4(input.reason) ? { reason: input.reason } : {},
+      revision: current.revision + 1
+    };
+    await this.governance.recordAuditEvent({
+      action: "guardrail.stop.activated",
+      actorPrincipal: input.actorPrincipal,
+      actorRole: role.role ?? void 0,
+      outcome: "applied",
+      reason: input.reason,
+      correlationId: input.correlationId
+    });
+    await withPolicyNamespaceLock(async (session3) => {
+      await this.writeStopState(next);
+      await session3.assertOwnership();
+    }, { directory: this.dir() });
+    return next;
+  }
+  async releaseStop(input) {
+    if (!requiredText4(input.actorPrincipal)) throw new GuardrailError("actorPrincipal is required");
+    const role = await this.governance.resolveRoleAsync(input.actorPrincipal, "*");
+    if (role.role !== "human-owner" && role.role !== "human-approver") {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.release.denied",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "rejected",
+        reason: "insufficient authority to release stop",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      throw new GuardrailError("unauthorized stop release");
+    }
+    const current = await this.readStopState();
+    if (!current.stopped) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.stop.release",
+        actorPrincipal: input.actorPrincipal,
+        actorRole: role.role ?? void 0,
+        outcome: "applied",
+        reason: "already running (idempotent)",
+        correlationId: input.correlationId
+      }).catch(() => void 0);
+      return current;
+    }
+    const now3 = nowIso3();
+    const next = {
+      stopped: false,
+      activatedBy: current.activatedBy,
+      activatedAt: current.activatedAt,
+      reason: current.reason,
+      releasedBy: input.actorPrincipal,
+      releasedAt: now3,
+      revision: current.revision + 1
+    };
+    await this.governance.recordAuditEvent({
+      action: "guardrail.stop.released",
+      actorPrincipal: input.actorPrincipal,
+      actorRole: role.role ?? void 0,
+      outcome: "applied",
+      reason: input.reason,
+      correlationId: input.correlationId
+    });
+    await withPolicyNamespaceLock(async (session3) => {
+      await this.writeStopState(next);
+      await session3.assertOwnership();
+    }, { directory: this.dir() });
+    return next;
+  }
+  auditModes = {
+    "agent.execute": "mandatory",
+    "guardrail.stop.activate": "mandatory",
+    "guardrail.stop.release": "mandatory"
+  };
+  auditModeFor(action) {
+    return this.auditModes[action] ?? "best_effort";
+  }
+  async recordAudit(decision, auditMode) {
+    const persisted = await this.auditDecision(decision);
+    decision.auditPersisted = persisted;
+    decision.auditMode = auditMode;
+    if (!persisted && auditMode === "mandatory" && decision.allowed) {
+      decision.outcome = "audit_failure";
+      decision.allowed = false;
+      decision.reason = "mandatory audit persistence failed";
+    }
+    return persisted;
+  }
+  // --- evaluation ---
+  async evaluate(input) {
+    const evaluatedAt = nowIso3();
+    const auditMode = this.auditModeFor(input.action);
+    const principalId = input.principalContext.trusted ? input.principalContext.trustedPrincipalId : input.principalContext.assertedPrincipalId;
+    const stopState = await this.readStopState().catch(() => ({ stopped: false, revision: 0 }));
+    const base = {
+      outcome: "deny",
+      allowed: false,
+      reason: "",
+      evaluatedAt,
+      principalId,
+      action: input.action,
+      resource: input.resource,
+      scope: input.scope,
+      phase: input.phase,
+      stopState: stopState.stopped ? "stopped" : "running",
+      correlationId: input.correlationId,
+      auditMode,
+      auditPersisted: false
+    };
+    if (stopState.stopped && input.action !== "guardrail.stop.release") {
+      const decision2 = { ...base, outcome: "stop_active", reason: "global stop active" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    const requiresTrusted = ACTIONS_REQUIRING_TRUSTED_IDENTITY.has(input.action);
+    if (requiresTrusted && !input.principalContext.trusted) {
+      const decision2 = { ...base, outcome: "identity_unverified", reason: "trusted identity required but not verified" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    if (!requiredText4(input.action) || !requiredText4(input.resource) || !requiredText4(input.scope)) {
+      const decision2 = { ...base, outcome: "invalid_context", reason: "missing action/resource/scope" };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    let policyId;
+    let policyVersion;
+    try {
+      const resolution = await this.governance.failClosedResolve(input.scope, input.now ?? /* @__PURE__ */ new Date());
+      if (resolution.outcome !== "applicable" || !resolution.policy) {
+        const decision2 = {
+          ...base,
+          outcome: resolution.outcome === "conflicting" ? "deny" : "policy_unavailable",
+          reason: `policy resolution: ${resolution.outcome} - ${resolution.reason}`
+        };
+        await this.recordAudit(decision2, auditMode);
+        return decision2;
+      }
+      policyId = resolution.policy.policyId;
+      policyVersion = resolution.policy.version;
+      const actorForPermission = principalId ?? "";
+      const allowed = await this.governance.hasPermission(actorForPermission, input.action, input.scope);
+      if (!allowed) {
+        const decision2 = {
+          ...base,
+          outcome: "deny",
+          reason: "permission denied by governance role binding",
+          policyId,
+          policyVersion
+        };
+        await this.recordAudit(decision2, auditMode);
+        return decision2;
+      }
+    } catch (err2) {
+      const decision2 = {
+        ...base,
+        outcome: "policy_unavailable",
+        reason: `governance unavailable: ${err2.message}`
+      };
+      await this.recordAudit(decision2, auditMode);
+      return decision2;
+    }
+    const decision = {
+      ...base,
+      outcome: "allow",
+      allowed: true,
+      reason: "allowed by governance policy",
+      policyId,
+      policyVersion
+    };
+    await this.recordAudit(decision, auditMode);
+    return decision;
+  }
+  async auditDecision(decision) {
+    try {
+      await this.governance.recordAuditEvent({
+        action: decision.allowed ? "guardrail.evaluation.allowed" : "guardrail.evaluation.denied",
+        actorPrincipal: decision.principalId,
+        scope: decision.scope,
+        outcome: decision.allowed ? "applied" : "rejected",
+        reason: decision.reason,
+        detail: `${decision.action} on ${decision.resource} (${decision.outcome})`,
+        correlationId: decision.correlationId,
+        mandatory: decision.auditMode === "mandatory"
+      });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async execute(input, operation) {
+    const decision = await this.evaluate(input);
+    if (!decision.allowed) {
+      return { decision, executed: false, error: decision.reason };
+    }
+    await this.governance.recordAuditEvent({
+      action: "guardrail.operation.started",
+      actorPrincipal: decision.principalId,
+      scope: decision.scope,
+      outcome: "applied",
+      detail: `${decision.action} on ${decision.resource}`,
+      correlationId: decision.correlationId
+    }).catch(() => void 0);
+    let result;
+    try {
+      result = await operation();
+    } catch (err2) {
+      await this.governance.recordAuditEvent({
+        action: "guardrail.operation.failed",
+        actorPrincipal: decision.principalId,
+        scope: decision.scope,
+        outcome: "rejected",
+        reason: err2.message,
+        detail: `${decision.action} on ${decision.resource}`,
+        correlationId: decision.correlationId
+      }).catch(() => void 0);
+      return { decision, executed: true, error: err2.message };
+    }
+    await this.governance.recordAuditEvent({
+      action: "guardrail.operation.completed",
+      actorPrincipal: decision.principalId,
+      scope: decision.scope,
+      outcome: "applied",
+      detail: `${decision.action} on ${decision.resource}`,
+      correlationId: decision.correlationId
+    }).catch(() => void 0);
+    return { decision, executed: true, result };
+  }
+};
+function createGuardrailService(directory, governance) {
+  return new GuardrailService(directory, governance);
+}
+__name(createGuardrailService, "createGuardrailService");
+
+// core/memory-anthology/index.ts
+var VALID_TRANSITIONS = {
+  unassessed: ["asserted", "corroborated", "reviewed", "disputed", "refuted", "superseded"],
+  asserted: ["corroborated", "reviewed", "disputed", "refuted", "superseded"],
+  corroborated: ["reviewed", "disputed", "refuted", "superseded"],
+  reviewed: ["disputed", "refuted", "superseded"],
+  disputed: ["corroborated", "reviewed", "refuted", "superseded"],
+  refuted: ["superseded"],
+  superseded: []
+};
+function canTransitionEpistemic(from, to) {
+  if (from === to) return true;
+  return (VALID_TRANSITIONS[from] ?? []).includes(to);
+}
+__name(canTransitionEpistemic, "canTransitionEpistemic");
+function validateEpistemicTransition(from, to, reason) {
+  if (from === to) return { allowed: true, reason: "no change" };
+  if (!canTransitionEpistemic(from, to)) {
+    return { allowed: false, reason: `invalid transition ${from} -> ${to}` };
+  }
+  if (to === "corroborated" && !reason) {
+    return { allowed: false, reason: "corroborated requires explanation of independent sources" };
+  }
+  if (to === "reviewed" && !reason) {
+    return { allowed: false, reason: "reviewed requires reviewer identity and scope" };
+  }
+  return { allowed: true, reason: reason ?? "ok" };
+}
+__name(validateEpistemicTransition, "validateEpistemicTransition");
+function validateProvenance(p) {
+  const errors = [];
+  if (!p || typeof p !== "object") {
+    errors.push("provenance must be an object");
+    return { valid: false, errors };
+  }
+  const kinds = ["user-statement", "system-observation", "imported-document", "external-source", "agent-inference", "model-summary", "human-correction", "system-event", "unknown"];
+  if (!kinds.includes(p.kind)) errors.push("invalid provenance kind");
+  if (p.observedAt !== void 0 && (typeof p.observedAt !== "string" || isNaN(Date.parse(p.observedAt)))) {
+    errors.push("observedAt must be valid ISO timestamp if provided");
+  }
+  return { valid: errors.length === 0, errors };
+}
+__name(validateProvenance, "validateProvenance");
+function validateMemoryItem(item) {
+  const errors = [];
+  if (!item || typeof item !== "object") {
+    errors.push("item must be an object");
+    return { valid: false, errors };
+  }
+  if (typeof item.itemId !== "string" || !item.itemId.trim()) errors.push("itemId is required");
+  if (typeof item.schemaVersion !== "number" || !Number.isInteger(item.schemaVersion) || item.schemaVersion < 1) errors.push("schemaVersion must be positive integer");
+  if (typeof item.scope !== "string" || !item.scope.trim()) errors.push("scope is required");
+  if (!item.temporal || typeof item.temporal !== "object") errors.push("temporal is required");
+  else if (typeof item.temporal.recordedAt !== "string" || isNaN(Date.parse(item.temporal.recordedAt))) errors.push("recordedAt must be valid ISO timestamp");
+  if (!item.provenance) errors.push("provenance is required");
+  else {
+    const pv = validateProvenance(item.provenance);
+    if (!pv.valid) errors.push(...pv.errors);
+  }
+  if (!item.revision || typeof item.revision !== "object") errors.push("revision is required");
+  else if (typeof item.revision.revision !== "number" || item.revision.revision < 0) errors.push("revision.revision must be non-negative integer");
+  if (item.category === "derived-summary") {
+    if (!item.derivedLineage) errors.push("derived summary requires lineage");
+  }
+  return { valid: errors.length === 0, errors };
+}
+__name(validateMemoryItem, "validateMemoryItem");
+function validateDerivedLineage(lineage, _sourceStatuses) {
+  const errors = [];
+  if (!lineage || typeof lineage !== "object") {
+    errors.push("lineage required");
+    return { valid: false, errors };
+  }
+  if (!Array.isArray(lineage.sourceItemIds) || lineage.sourceItemIds.length === 0) errors.push("sourceItemIds required");
+  if (!Array.isArray(lineage.sourceRevisions) || lineage.sourceRevisions.length !== lineage.sourceItemIds.length) errors.push("sourceRevisions must match sourceItemIds length");
+  if (typeof lineage.derivedAt !== "string" || isNaN(Date.parse(lineage.derivedAt))) errors.push("derivedAt invalid");
+  if (typeof lineage.producingComponent !== "string" || !lineage.producingComponent.trim()) errors.push("producingComponent required");
+  return { valid: errors.length === 0, errors };
+}
+__name(validateDerivedLineage, "validateDerivedLineage");
+function markDerivedStale(lineage) {
+  return { ...lineage, stale: true };
+}
+__name(markDerivedStale, "markDerivedStale");
+function isLegacyRecord(item) {
+  return !item || typeof item !== "object" || !item.provenance || !item.temporal || !item.revision;
+}
+__name(isLegacyRecord, "isLegacyRecord");
+function normalizeLegacyRecord(item) {
+  return {
+    itemId: item?.id ?? item?.itemId ?? `legacy-${Math.random().toString(36).slice(2, 10)}`,
+    schemaVersion: 0,
+    category: "legacy",
+    payload: item,
+    scope: item?.scope ?? "unknown",
+    provenance: { kind: "unknown" },
+    epistemicStatus: "unassessed",
+    sensitivity: "unknown",
+    temporal: { recordedAt: item?.createdAt ? new Date(item.createdAt).toISOString() : (/* @__PURE__ */ new Date(0)).toISOString() },
+    revision: { revision: 0 }
+  };
+}
+__name(normalizeLegacyRecord, "normalizeLegacyRecord");
+var MEMORY_CATEGORIES = [
+  "observation",
+  "claim",
+  "fact-candidate",
+  "hypothesis",
+  "decision",
+  "preference",
+  "instruction",
+  "experience",
+  "goal",
+  "relationship",
+  "derived-summary",
+  "unknown-disputed",
+  "legacy"
+];
+var EPITEMIC_STATUSES2 = [
+  "unassessed",
+  "asserted",
+  "corroborated",
+  "reviewed",
+  "disputed",
+  "refuted",
+  "superseded"
+];
+
+// index.ts
 var dotmem = {
   version: "0.0.8",
   isBrowser,
@@ -12029,4 +13837,4 @@ var dotmem = {
 };
 var index_default = dotmem;
 
-export { CompactionEngine, ContextCompiler, ContextLifecycleOrchestrator, RecoveryService, addDecision, addOpenLoopRef, addRejectedApproach, addUnresolvedQuestion, appendReasoningStep, clearUserIdentity, closeConversationalState, compileContext, continuity, createCompactionEngine, createConversationalState, createNoOpHost, createRecoveryService, index_default as default, deleteConversationalState, dotmem, encryption, getCapabilities, getPlatform, idb, inspectMem, isBrowser, isBun, isDeno, isEdge, isNode, listUnfinishedConversations, loadAllConversationalStates, loadConversationalStateById, memory, recoverConversation, resolveUserAgentMemoryPath, resolveUserBrainPath, resolveUserContractPath, resolveUserDotMemPath, resolveUserExperiencePath, resolveUserIdentity, resolveUserProjectMemoryPath, resolveUserReadmePath, saveConversationalState, security, setUserIdentity, signMemPackage, updateConversationalState };
+export { CompactionEngine, ContextCompiler, ContextLifecycleOrchestrator, EPITEMIC_STATUSES2 as EPITEMIC_STATUSES, GOVERNANCE_POLICY_STATUSES, GOVERNANCE_ROLES, GovernancePolicyError, GovernancePolicyStore, GuardrailError, GuardrailService, MEMORY_CATEGORIES, RecoveryService, addDecision, addOpenLoopRef, addRejectedApproach, addUnresolvedQuestion, appendReasoningStep, canTransitionEpistemic, clearUserIdentity, closeConversationalState, compileContext, continuity, continuityLedger, createCompactionEngine, createConversationalState, createGuardrailService, createNoOpHost, createRecoveryService, index_default as default, deleteConversationalState, dotmem, encryption, getCapabilities, getPlatform, idb, inspectMem, isBrowser, isBun, isDeno, isEdge, isLegacyRecord, isNode, listUnfinishedConversations, loadAllConversationalStates, loadConversationalStateById, markDerivedStale, memory, normalizeLegacyRecord, recoverConversation, resolveUserAgentMemoryPath, resolveUserBrainPath, resolveUserContractPath, resolveUserDotMemPath, resolveUserExperiencePath, resolveUserIdentity, resolveUserProjectMemoryPath, resolveUserReadmePath, roleHasPermission, saveConversationalState, security, setUserIdentity, signMemPackage, updateConversationalState, validateDerivedLineage, validateEpistemicTransition, validatePolicyAuthority as validateGovernanceAuthority, validateMemoryItem, validateProvenance, validateRelationshipTargets, validateResolutionRequest };