neotoma 0.18.3 → 0.18.5

package/dist/actions.d.ts

@@ -97,6 +97,16 @@ type GuestPrincipal = {
 type RoutePrincipal = UserPrincipal | GuestPrincipal;
 /** Exported for unit tests: routes where guest (AAuth / guest token) may be stamped before handlers run. */
 export declare function routeAcceptsGuestPrincipal(req: Pick<express.Request, "method" | "path">): boolean;
+/**
+ * Exported for unit tests: the two issue-write routes that extend local-loopback
+ * trust to unauthenticated requests. A local request to `/issues/submit` or
+ * `/issues/add_message` with no `Authorization: Bearer` header falls through to
+ * the local dev user — the same offline-developer trust the entity-read routes
+ * already grant (see `resolveGuestUserId`). This is the ONLY place that trust is
+ * widened; every other route still requires a Bearer token, and remote requests
+ * (non-loopback / untrusted XFF) get AUTH_REQUIRED on these routes too.
+ */
+export declare function routeAllowsLocalIssueWriteFallback(req: Pick<express.Request, "method" | "path">): boolean;
 /** Exported for unit tests: guest-capable routes that mutate state and should consume a guest write-rate budget. */
 export declare function routeConsumesGuestWriteBudget(req: Pick<express.Request, "method" | "path">): boolean;
 /** Exported for unit tests: guest-rate-limit key precedence is thumbprint -> guest token -> IP. */

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AA6CpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA4rB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AA47CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AA69FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;qBA84BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAlBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAvPV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BA+JlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GAkZ3B;AAigHD,wBAAsB,eAAe;;;eAmOpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AAuDpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA8CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AAqwB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AA47CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAST;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AAgHD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AA69FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;qBAu5BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAlBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAhQV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BAwKlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GA8b3B;AAigHD,wBAAsB,eAAe;;;eAmOpC"}

package/dist/actions.js

@@ -47,6 +47,7 @@ import { getSandboxPack } from "./services/sandbox/pack_registry.js";
 import { buildEndpointsMap, buildLandingContext, buildRootLandingJson, buildRootLandingMarkdown, buildRobotsTxt, readGitSha, readNeotomaConfigEnvironment, readPackageVersion, resolveLandingMode, wantsHtml as acceptWantsHtml, wantsMarkdown as acceptWantsMarkdown, } from "./services/root_landing/index.js";
 import { mountDocsRoutes } from "./services/docs/index.js";
 import { installInspectorLegacyRedirect, installInspectorRootStaticAssets, installInspectorSpaFallback, installInspectorSpaShellEarly, resolveBundledInspectorDir, } from "./services/inspector_mount.js";
+import { EMBED_ALLOWED_ORIGINS_ENV, applyFrameAncestorsToCsp, buildFrameAncestorsDirective, embedCorsHeaders, isEmbedReadEndpoint, isEmbedShellPath, isOriginAllowed, parseAllowedEmbedOrigins, } from "./services/embed_cross_origin.js";
 import { getSandboxTermsResponse } from "./services/sandbox/terms.js";
 import { resolveSandboxReportTransport } from "./services/sandbox/transport.js";
 import { getSqliteDb } from "./repositories/sqlite/sqlite_client.js";
@@ -113,6 +114,71 @@ app.use(helmet({
         },
     },
 }));
+// ── Official cross-origin Inspector-embed support (opt-in, secure by default) ──
+//
+// When NEOTOMA_EMBED_ALLOWED_ORIGINS lists one or more host origins, an
+// allowlisted host may iframe `/embed/graph` directly and its browser may
+// `fetch()` the two graph read endpoints cross-origin — WITHOUT running a
+// same-origin reverse proxy. Two response behaviors change, ONLY for
+// allowlisted traffic:
+//
+//   1. Embed shell paths (`/embed/*`) get `Content-Security-Policy:
+//      frame-ancestors 'self' <origins>` and drop `X-Frame-Options`, so the
+//      allowlisted host can frame them. Non-embed paths are untouched.
+//   2. The two blessed read endpoints (`/entities/query`,
+//      `/retrieve_graph_neighborhood`) get scoped CORS (exact-origin echo,
+//      never `*`, no credentials) + preflight handling — and ONLY those two.
+//      Write endpoints are never CORS-enabled here, so a browser on an
+//      allowlisted origin can never reach `/store`,`/correct`,… cross-origin.
+//
+// SECURE BY DEFAULT: with no allowlist configured, this middleware is inert and
+// every response is byte-identical to the locked-down `'self'`/`SAMEORIGIN`
+// posture. Registered AFTER Helmet (so it can override the `X-Frame-Options`
+// Helmet set and rewrite Helmet's CSP), BEFORE the global `cors()` (so it owns
+// the embed preflight and its response is not pre-empted), and before the auth
+// stack (so a CORS preflight OPTIONS is answered without a bearer, as browsers
+// require).
+const embedAllowedOrigins = parseAllowedEmbedOrigins(process.env[EMBED_ALLOWED_ORIGINS_ENV]);
+if (embedAllowedOrigins.length > 0) {
+    logger.info(`[EmbedCORS] Cross-origin Inspector embed enabled for: ${embedAllowedOrigins.join(", ")}`);
+}
+app.use((req, res, next) => {
+    if (embedAllowedOrigins.length === 0)
+        return next();
+    const requestOrigin = req.headers.origin;
+    const reqPath = req.path;
+    // (1) Relax framing on the embed shell so an allowlisted host can iframe it.
+    // Applied on embed paths (framing is enforced by the browser against the CSP
+    // `frame-ancestors` list, which is itself restricted to the configured
+    // origins — so emitting it grants nothing beyond the allowlist). Rewrite the
+    // existing Helmet CSP if present, else set a standalone `frame-ancestors`
+    // policy, and remove `X-Frame-Options` (which has no allowlist form and would
+    // otherwise still block the frame).
+    if (isEmbedShellPath(reqPath)) {
+        const existingCsp = res.getHeader("Content-Security-Policy");
+        if (typeof existingCsp === "string") {
+            res.setHeader("Content-Security-Policy", applyFrameAncestorsToCsp(existingCsp, embedAllowedOrigins));
+        }
+        else {
+            const directive = buildFrameAncestorsDirective(embedAllowedOrigins);
+            if (directive)
+                res.setHeader("Content-Security-Policy", directive);
+        }
+        res.removeHeader("X-Frame-Options");
+    }
+    // (2) Scoped CORS on the two blessed read endpoints, only for an allowlisted
+    // Origin. Preflight (OPTIONS) is answered here directly with 204.
+    if (isEmbedReadEndpoint(reqPath) && isOriginAllowed(requestOrigin, embedAllowedOrigins)) {
+        const canonical = new URL(requestOrigin).origin;
+        for (const [name, value] of Object.entries(embedCorsHeaders(canonical))) {
+            res.setHeader(name, value);
+        }
+        if (req.method === "OPTIONS") {
+            return res.status(204).end();
+        }
+    }
+    return next();
+});
 // Configure CORS to allow frontend origin
 const corsOptions = {
     origin: process.env.NEOTOMA_FRONTEND_URL || process.env.FRONTEND_URL || "http://localhost:5195",
@@ -2611,6 +2677,23 @@ export function routeAcceptsGuestPrincipal(req) {
     }
     return false;
 }
+/**
+ * Exported for unit tests: the two issue-write routes that extend local-loopback
+ * trust to unauthenticated requests. A local request to `/issues/submit` or
+ * `/issues/add_message` with no `Authorization: Bearer` header falls through to
+ * the local dev user — the same offline-developer trust the entity-read routes
+ * already grant (see `resolveGuestUserId`). This is the ONLY place that trust is
+ * widened; every other route still requires a Bearer token, and remote requests
+ * (non-loopback / untrusted XFF) get AUTH_REQUIRED on these routes too.
+ */
+export function routeAllowsLocalIssueWriteFallback(req) {
+    const path = req.path;
+    return (req.method === "POST" &&
+        (path === "/issues/submit" ||
+            path === "/api/issues/submit" ||
+            path === "/issues/add_message" ||
+            path === "/api/issues/add_message"));
+}
 /** Exported for unit tests: guest-capable routes that mutate state and should consume a guest write-rate budget. */
 export function routeConsumesGuestWriteBudget(req) {
     const path = req.path;
@@ -2704,6 +2787,24 @@ async function resolveRoutePrincipal(req, accept) {
         }
     }
     if (accept.includes("user")) {
+        // Local-loopback trust for the two issue-write routes: a local request with
+        // no Bearer token resolves to the local dev user instead of failing
+        // AUTH_REQUIRED. This mirrors the existing local fallback in
+        // `resolveGuestUserId` and keeps `neotoma issues create` working offline
+        // (gh-CLI auth alone does not configure a Neotoma Bearer token). Scoped as
+        // narrowly as possible: ONLY these routes, ONLY local requests, ONLY when
+        // no Bearer header is present — remote/Bearer requests fall through to the
+        // normal `getAuthenticatedUserId` gate below.
+        const headerAuth = (req.headers.authorization || req.headers.Authorization || "");
+        if (routeAllowsLocalIssueWriteFallback(req) &&
+            isLocalRequest(req) &&
+            !headerAuth.startsWith("Bearer ")) {
+            const userId = _localSandboxActive ? ensureLocalSandboxUser().id : ensureLocalDevUser().id;
+            // Stamp the principal so a later `getAuthenticatedUserId` in the handler
+            // resolves the same local user without re-tripping the missing-Bearer gate.
+            stampUserPrincipal(req, userId);
+            return { kind: "user", userId };
+        }
         const userId = await getAuthenticatedUserId(req, (req.body?.user_id ??
             req.query.user_id));
         return { kind: "user", userId };
@@ -5704,6 +5805,12 @@ export async function storeStructuredForApi(params) {
         }
     }
     const createdEntities = [];
+    // Issue #1839: capture each entity's prior and post-reduction snapshot so the
+    // store_warnings loop below can detect a NULL_CLEARED_FIELD event (an incoming
+    // null clearing a prior non-null value under highest_priority). Keyed by
+    // entity_id.
+    const priorSnapshotByEntityId = new Map();
+    const newSnapshotByEntityId = new Map();
     for (const r of resolved) {
         let observation_id = null;
         let snapshotAfter = null;
@@ -5715,6 +5822,7 @@ export async function storeStructuredForApi(params) {
                 .eq("user_id", userId)
                 .maybeSingle();
             const priorSnapshot = priorSnapRow?.snapshot ?? {};
+            priorSnapshotByEntityId.set(r.entity_id, priorSnapshot);
             const obsData = await createObservation({
                 entity_id: r.entity_id,
                 entity_type: r.entity_type,
@@ -5737,6 +5845,8 @@ export async function storeStructuredForApi(params) {
                 const snap = await recomputeSnapshot(r.entity_id, userId);
                 snapshotAfter =
                     snap?.snapshot ?? null;
+                if (snapshotAfter)
+                    newSnapshotByEntityId.set(r.entity_id, snapshotAfter);
             }
             catch (snapshotErr) {
                 logger.warn(`Snapshot recompute failed for ${r.entity_id}: ${snapshotErr}`);
@@ -6076,6 +6186,48 @@ export async function storeStructuredForApi(params) {
                 });
                 if (spWarn)
                     schemaStoreWarnings.push(spWarn);
+                // Issue #1838: SOURCE_PRIORITY_ESCALATION — mirror-image advisory. A
+                // write at the DEFAULT source_priority (100) into a `highest_priority`
+                // field silently OUTRANKS any prior observation written with an
+                // explicit lower priority. Non-blocking; reuses the same import.
+                const { buildSourcePriorityEscalationWarning } = await import("./services/source_priority_warning.js");
+                const spEsc = buildSourcePriorityEscalationWarning({
+                    sourcePriority,
+                    writtenFields: r.fields,
+                    mergePolicies: schemaEntry?.reducer_config?.merge_policies,
+                    observationIndex: r.observation_index,
+                    entityType: r.entity_type,
+                    entityId: r.entity_id,
+                });
+                if (spEsc)
+                    schemaStoreWarnings.push(spEsc);
+            }
+            // Issue #1839: NULL_CLEARED_FIELD — non-blocking advisory warning when an
+            // incoming null clears a prior non-null value under a `highest_priority`
+            // field. The clear is by design (null is an explicit tombstone), but it
+            // is silent today; this surfaces the data-loss vector. Warn-only: no
+            // change to snapshot computation or clearing semantics.
+            {
+                const mergePolicies = schemaEntry?.reducer_config?.merge_policies;
+                if (mergePolicies) {
+                    const priorSnapshot = priorSnapshotByEntityId.get(r.entity_id) ?? {};
+                    const newSnapshot = newSnapshotByEntityId.get(r.entity_id) ?? {};
+                    const { buildNullClearedFieldWarning } = await import("./services/null_cleared_field_warning.js");
+                    for (const field of Object.keys(r.fields)) {
+                        const nullWarn = buildNullClearedFieldWarning({
+                            field,
+                            strategy: mergePolicies[field]?.strategy,
+                            prior_value: priorSnapshot[field],
+                            incoming_value: r.fields[field],
+                            new_value: newSnapshot[field],
+                            observation_index: r.observation_index,
+                            entity_type: r.entity_type,
+                            entity_id: r.entity_id,
+                        });
+                        if (nullWarn)
+                            schemaStoreWarnings.push(nullWarn);
+                    }
+                }
             }
         }
     }