@openparachute/vault 0.7.3-rc.12 → 0.7.3-rc.2

package/src/mcp-http.ts

@@ -109,7 +109,7 @@ export async function handleScopedMcp(
   const instruction = await getServerInstruction(vaultName, auth);
   return handleMcp(
     req,
-    () => generateScopedMcpTools(vaultName, auth, callerBearer ?? null, req),
+    () => generateScopedMcpTools(vaultName, auth, callerBearer ?? null),
     `parachute-vault/${vaultName}`,
     vaultName,
     auth,
@@ -180,15 +180,9 @@ export async function handleMcp(
     }
     try {
       const result = await tool.execute((args ?? {}) as Record<string, unknown>);
-      // The one wrapper change (attachments-for-agents design, Wave 2):
-      // `resultContent`, when a tool defines it, decides the MCP content
-      // blocks instead of the universal single-text-block default —
-      // `read-attachment`'s image branch is the only current user (needs a
-      // REAL {type:"image"} block alongside the row-JSON text block).
-      const content = tool.resultContent
-        ? tool.resultContent(result)
-        : [{ type: "text" as const, text: JSON.stringify(result, null, 2) }];
-      return { content };
+      return {
+        content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
+      };
     } catch (err) {
       // vault#555 fix 6 — never re-wrap an already-formed McpError. Passing
       // the SAME instance straight through is strictly correct (no
@@ -235,14 +229,6 @@ export async function handleMcp(
         tag?: string;
         cycle?: unknown;
         referencing_tags?: unknown;
-        /** Attachment-tickets design (§2c "errors as JIT docs") — a short, imperative next-step, distinct from the older free-form `hint`. */
-        how_to?: string;
-        /** `read-attachment` (Wave 2) refusals — `image_too_large` / `unsupported_attachment_type` carry the attachment's actual byte size. */
-        size?: number;
-        /** `read-attachment` `image_too_large` — the 4 MiB cap it exceeded. */
-        max_bytes?: number;
-        /** `read-attachment` `unsupported_attachment_type` — the mime type that couldn't be read. */
-        mime_type?: string;
       };
       // Honest-queries validation errors (vault#550) — `limit`/`offset`/date
       // values that are structurally invalid rather than merely "no
@@ -413,21 +399,6 @@ export async function handleMcp(
           error_type: e.error_type,
           field: e.field,
           hint: e.hint,
-          // Forwarded when present (undefined keys are fine — JSON-RPC
-          // `data` just omits them) so a `structuredError()` call site that
-          // stamps extra fields — `limit`/`got`/`extension` (size/type
-          // refusals) or `how_to` (attachment-tickets' JIT-docs field, §2c)
-          // — isn't silently truncated down to error_type/field/hint by
-          // this backstop.
-          ...(e.limit !== undefined ? { limit: e.limit } : {}),
-          ...(e.got !== undefined ? { got: e.got } : {}),
-          ...(e.extension !== undefined ? { extension: e.extension } : {}),
-          ...(e.how_to !== undefined ? { how_to: e.how_to } : {}),
-          // read-attachment (Wave 2) refusal fields — same forward-when-present
-          // discipline as the ticket fields just above.
-          ...(e.size !== undefined ? { size: e.size } : {}),
-          ...(e.max_bytes !== undefined ? { max_bytes: e.max_bytes } : {}),
-          ...(e.mime_type !== undefined ? { mime_type: e.mime_type } : {}),
         });
       }
       return {

package/src/mcp-tools.ts

@@ -43,9 +43,6 @@ import {
 import { chooseHubOrigin, mintHubJwt, revokeHubJwt } from "./mcp-install.ts";
 import { looksLikeJwt } from "./hub-jwt.ts";
 import { readGlobalConfig, DEFAULT_PORT } from "./config.ts";
-import { getBaseUrl } from "./oauth-discovery.ts";
-import { getSharedAttachmentTicketProvider } from "./attachment-tickets.ts";
-import { createFsAttachmentBytesProvider } from "./attachment-bytes.ts";
 
 /**
  * Filter a vault projection to entries an in-scope tag contributes to.
@@ -113,12 +110,6 @@ export async function getServerInstruction(
     description: config?.description ?? null,
     projection,
     coordinates: resolveVaultCoordinates(),
-    // Bun always wires an in-process AttachmentTicketProvider AND a fresh
-    // fs-backed AttachmentBytesProvider per session (see
-    // `generateScopedMcpTools` below) — the connect-time brief can
-    // unconditionally teach both the ticket tools and read-attachment on
-    // this door.
-    attachments: { ticketsEnabled: true, readEnabled: true },
   });
 }
 
@@ -152,16 +143,6 @@ export function generateScopedMcpTools(
   vaultName: string,
   auth?: AuthResult,
   callerBearer?: string | null,
-  /**
-   * The incoming MCP request, when available (omitted by the many
-   * test-only call sites that construct tools without a live request).
-   * Threaded through ONLY so the attachment-ticket tools can resolve a
-   * request-accurate `urlBase` (honoring `X-Forwarded-Host`/proto, same as
-   * `getBaseUrl`) — falls back to `resolveVaultCoordinates()`'s configured/
-   * expose-state origin when omitted, so ticket tools are still present
-   * (just less precisely origined) in that case.
-   */
-  req?: Request,
 ): McpToolDef[] {
   const store = getVaultStore(vaultName);
 
@@ -244,48 +225,20 @@ export function generateScopedMcpTools(
     ? (info) => logStrictBypass(info)
     : undefined;
 
-  // Attachment tickets (Wave 1): bun always wires the in-process provider
-  // (see src/attachment-tickets.ts) — unlike the tag-scope predicates
-  // above, this isn't conditional on `scoped` because the tools should be
-  // listed for every session, scoped or not. Tag-scope confidentiality is
-  // still enforced (`noteVisible`, awaited inline inside the ticket tools'
-  // own async execute — see its doc comment in generateMcpTools for why
-  // this doesn't need the shared allowedHolder machinery the OTHER
-  // predicates above do).
-  const ticketNoteVisible = scoped
-    ? async (note: Note) => {
-        const allowed = await expandTokenTagScope(store, rawTags);
-        return noteWithinTagScope(note, allowed, rawTags);
-      }
-    : undefined;
-  const ticketUrlBase = req
-    ? `${getBaseUrl(req).replace(/\/$/, "")}/vault/${vaultName}`
-    : `${resolveVaultCoordinates().hubOrigin.replace(/\/$/, "")}/vault/${vaultName}`;
-
-  const tools = generateMcpTools(store, {
-    ...(expandVisibility ? { expandVisibility } : {}),
-    ...(nearTraversable ? { nearTraversable } : {}),
-    ...(ifExistsVisible ? { ifExistsVisible } : {}),
-    ...(aggregateVisibility ? { aggregateVisibility } : {}),
-    ...(writeContext ? { writeContext } : {}),
-    ...(strictBypass ? { strictBypass } : {}),
-    ...(onStrictBypass ? { onStrictBypass } : {}),
-    attachmentTickets: {
-      provider: getSharedAttachmentTicketProvider(),
-      vaultName,
-      urlBase: ticketUrlBase,
-      ...(ticketNoteVisible ? { noteVisible: ticketNoteVisible } : {}),
-    },
-    // Attachment bytes (Wave 2 model lane): bun always wires a fresh fs
-    // provider per session — cheap (stateless), unlike the ticket
-    // provider's process-wide shared Map. Same `ticketNoteVisible`
-    // tag-scope predicate as the ticket seam above (identical contract:
-    // "is the owning note in scope").
-    attachmentBytes: {
-      provider: createFsAttachmentBytesProvider(vaultName),
-      ...(ticketNoteVisible ? { noteVisible: ticketNoteVisible } : {}),
-    },
-  });
+  const tools = generateMcpTools(
+    store,
+    expandVisibility || nearTraversable || ifExistsVisible || aggregateVisibility || writeContext || strictBypass
+      ? {
+          ...(expandVisibility ? { expandVisibility } : {}),
+          ...(nearTraversable ? { nearTraversable } : {}),
+          ...(ifExistsVisible ? { ifExistsVisible } : {}),
+          ...(aggregateVisibility ? { aggregateVisibility } : {}),
+          ...(writeContext ? { writeContext } : {}),
+          ...(strictBypass ? { strictBypass } : {}),
+          ...(onStrictBypass ? { onStrictBypass } : {}),
+        }
+      : undefined,
+  );
 
   overrideVaultInfo(tools, vaultName, auth);
   applyTagDependencyGuards(tools, vaultName);

package/src/onboarding-seed.test.ts

@@ -23,17 +23,14 @@ import { BunStore } from "./vault-store.ts";
 import { seedOnboardingNotes } from "./onboarding-seed.ts";
 import {
   applySeedPack,
-  ARCHIVED_TAG,
   CAPTURE_ANYTHING_PATH,
   CONNECT_AI_PATH,
   GETTING_STARTED_PATH,
   NOTES_REQUIRED_TAGS,
-  STARTER_ONTOLOGY_PACK,
   SURFACE_STARTER_PACK,
   SURFACE_STARTER_PATH,
   TAGS_GRAPH_PATH,
   WELCOME_PATH,
-  welcomePack,
   YOURS_TO_KEEP_PATH,
 } from "../core/src/seed-packs.ts";
 import {
@@ -293,67 +290,6 @@ describe("applySeedPack — surface-starter via add-pack", () => {
   });
 });
 
-describe("applySeedPack — tag description preservation on re-apply (Aaron-ratified 2026-07-17)", () => {
-  test("fresh apply: a brand-new tag gets the pack's description, reported as touched not preserved", async () => {
-    const result = await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    expect(result.tags).toContain(ARCHIVED_TAG.name);
-    expect(result.preservedTagDescriptions).toEqual([]);
-
-    const record = await store.getTagRecord(ARCHIVED_TAG.name);
-    expect(record!.description).toBe(ARCHIVED_TAG.description);
-  });
-
-  test("re-apply unmodified: description is still the pack's text — upserted, not preserved", async () => {
-    await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    const rerun = await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    expect(rerun.preservedTagDescriptions).toEqual([]);
-
-    const record = await store.getTagRecord(ARCHIVED_TAG.name);
-    expect(record!.description).toBe(ARCHIVED_TAG.description);
-  });
-
-  test("re-apply after a user edit: the hand-tuned description survives and is reported preserved", async () => {
-    await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    const edited = "My own house rules for archiving — nothing like the default.";
-    await store.upsertTagRecord(ARCHIVED_TAG.name, { description: edited });
-
-    const rerun = await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    expect(rerun.preservedTagDescriptions).toContain(ARCHIVED_TAG.name);
-    // Still listed in `tags` — the tag itself was touched (fields/parent_names
-    // upsert unconditionally); only the description write was skipped.
-    expect(rerun.tags).toContain(ARCHIVED_TAG.name);
-
-    const record = await store.getTagRecord(ARCHIVED_TAG.name);
-    expect(record!.description).toBe(edited);
-  });
-
-  test("capture byte-identity anchor (NOTES_REQUIRED_TAGS) holds under either apply order", async () => {
-    // welcome, then starter-ontology.
-    await applySeedPack(store, welcomePack());
-    expect((await store.getTagRecord("capture"))!.description).toBe(
-      NOTES_REQUIRED_TAGS[0]!.description,
-    );
-    const afterOntology = await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    expect(afterOntology.preservedTagDescriptions).not.toContain("capture");
-    expect((await store.getTagRecord("capture"))!.description).toBe(
-      NOTES_REQUIRED_TAGS[0]!.description,
-    );
-  });
-
-  test("capture byte-identity anchor holds in the reverse order too", async () => {
-    // starter-ontology, then welcome.
-    await applySeedPack(store, STARTER_ONTOLOGY_PACK);
-    expect((await store.getTagRecord("capture"))!.description).toBe(
-      NOTES_REQUIRED_TAGS[0]!.description,
-    );
-    const afterWelcome = await applySeedPack(store, welcomePack());
-    expect(afterWelcome.preservedTagDescriptions).not.toContain("capture");
-    expect((await store.getTagRecord("capture"))!.description).toBe(
-      NOTES_REQUIRED_TAGS[0]!.description,
-    );
-  });
-});
-
 describe("vault-info / projection pointer (A2)", () => {
   test("projection carries getting_started when the note exists", async () => {
     // Absent before seeding → no pointer.

package/src/routes.ts

@@ -42,10 +42,6 @@ import {
   type ContentRange,
 } from "../core/src/content-range.ts";
 import { attachValidationStatus, enforceStrictWrite, applySchemaDefaults } from "../core/src/mcp.ts";
-import {
-  BLOCKED_ATTACHMENT_EXTENSIONS,
-  ATTACHMENT_MIME_TYPES,
-} from "../core/src/attachment/policy.ts";
 import type { ValidationWarning } from "../core/src/schema-defaults.ts";
 import { logStrictBypass } from "./scopes.ts";
 import * as linkOps from "../core/src/links.ts";
@@ -143,7 +139,7 @@ import {
   type ExpandMode,
 } from "../core/src/expand.ts";
 import { join, extname, normalize } from "path";
-import { existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { assetsDir, readGlobalConfig, readVaultConfig } from "./config.ts";
 import { shouldAutoTranscribe } from "./auto-transcribe.ts";
 // usage.ts imports `assetsDir` from config.ts (neutral ground), so this import
@@ -4444,64 +4440,97 @@ export const MAX_UPLOAD_BYTES = 100 * 1024 * 1024; // 100MB
  */
 export const MAX_REQUEST_BODY_BYTES = MAX_UPLOAD_BYTES + 20 * 1024 * 1024; // 120MB
 
-// Storage upload policy (extension blocklist + MIME lookup) now lives in
-// core/src/attachment/policy.ts — the canonical source shared with the
-// attachment-ticket mint/spend path (vault attachment-tickets design,
-// "shared BLOCKED_EXTENSIONS"), so a blocked extension can never diverge
-// between REST and tickets. See that module's doc comment for the full
-// same-origin-XSS rationale and the MIME curation invariant.
-const BLOCKED_EXTENSIONS = BLOCKED_ATTACHMENT_EXTENSIONS;
-const MIME_TYPES = ATTACHMENT_MIME_TYPES;
-
-/**
- * Parse a single-range `Range: bytes=a-b` header (RFC 7233 §2.1 — single
- * range only, attachments-for-agents design D9, the REST twin of MCP's
- * `content_offset`). Returns `null` — this function's own contract is
- * "serve the full response, unranged" — for a missing header, a
- * MALFORMED value, an unrecognized unit, a multi-range list
- * (`bytes=0-10,20-30` — ignored, not an error, per D9), or a range this
- * file can't satisfy (a `start` past EOF). `start`/`end` are both
- * INCLUSIVE byte offsets; `end` is clamped to `total - 1` when the
- * request left it open (`bytes=500-`) or asked past EOF.
- *
- * IMPORTANT — this `null` contract is NOT the last word for an
- * unsatisfiable (syntactically-valid but out-of-bounds) range on a real
- * `Bun.serve()` deployment. Live-verified against an actual socket (not
- * the in-process `handleStorage()` call the test suite uses): when the
- * response body is a `Bun.file()` — which `handleStorage`'s full-response
- * branch below always hands back — Bun's OWN runtime transparently
- * reinterprets the incoming request's `Range` header a second time and,
- * for an out-of-bounds range, overrides our 200 with a native
- * **416 Range Not Satisfiable**, regardless of what this function or
- * `handleStorage` returned. That's RFC 7233-correct and is being KEPT,
- * not fought — so in practice, `null` from an out-of-bounds `start`
- * still results in a 200 from `handleStorage`'s own logic, but the byte
- * that actually reaches a real client for that specific case is a 416
- * courtesy of Bun itself. MALFORMED and multi-range headers are NOT
- * range-shaped at all, so Bun's native layer doesn't touch them — those
- * two cases genuinely serve the full 200, in-process harness and real
- * socket alike.
- */
-export function parseByteRangeHeader(header: string | null, total: number): { start: number; end: number } | null {
-  if (!header || total <= 0) return null;
-  const match = header.match(/^bytes=(\d*)-(\d*)$/);
-  if (!match) return null; // malformed, unrecognized unit, or a multi-range list
-  const [, startRaw, endRaw] = match;
-  if (startRaw === "" && endRaw === "") return null;
-
-  if (startRaw === "") {
-    // Suffix range: last N bytes (`bytes=-500`).
-    const suffixLength = Number(endRaw);
-    if (!Number.isSafeInteger(suffixLength) || suffixLength <= 0) return null;
-    return { start: Math.max(0, total - suffixLength), end: total - 1 };
-  }
-
-  const start = Number(startRaw);
-  if (!Number.isSafeInteger(start) || start < 0 || start >= total) return null;
-  const end = endRaw === "" ? total - 1 : Math.min(Number(endRaw), total - 1);
-  if (!Number.isSafeInteger(end) || end < start) return null;
-  return { start, end };
-}
+// Storage upload policy: DENY-LIST (vault#517). A knowledge vault stores
+// arbitrary files — ebooks, office docs, datasets, archives, binaries — so we
+// accept ANY upload EXCEPT the handful of types a browser can execute as
+// active content in our origin when served back from /storage/. (The prior
+// allowlist rejected the long tail: .epub/.csv/.zip/… all came back "File type
+// not allowed".)
+//
+// BLOCKED — same-origin-XSS / active-content set:
+//   .html/.htm/.xhtml/.shtml/.xht  HTML — embeds <script>
+//   .svg                           XML image — embeds <script>
+//   .xml                           can carry XSLT / be parsed as XHTML
+//   .js/.mjs/.cjs                  JavaScript
+//   .css                           style-injection / UI-redress vector
+//
+// Two independent guards keep every STORED file inert when served:
+//   1. Only the curated MIME_TYPES below map to a real (always passive) type;
+//      every other extension serves as application/octet-stream — a download,
+//      never rendered.
+//   2. The GET byte-serve response pins `X-Content-Type-Options: nosniff`, so
+//      a browser can't sniff an octet-stream body into an executable type.
+// The blocklist is belt-and-suspenders on top of those: even if a future MIME
+// entry or an upstream proxy weakened (1) or (2), these extensions still never
+// land on disk. If a future use case needs SVG, sanitize on read (strip
+// <script>/<foreignObject>) and revisit.
+const BLOCKED_EXTENSIONS = new Set([
+  ".html", ".htm", ".xhtml", ".shtml", ".xht",
+  ".svg",
+  ".xml",
+  ".js", ".mjs", ".cjs",
+  ".css",
+]);
+
+// Explicit MIME types for the commonly-previewed formats. Anything accepted
+// but absent here serves as application/octet-stream — a download, never
+// rendered (e.g. .pages/.key/.numbers/.azw3/.exe/arbitrary binaries). None of
+// these map to an active type (text/html, image/svg+xml), so a served asset
+// can't execute script; `nosniff` on the GET response makes that ironclad.
+//
+// INVARIANT: never add an entry that maps to a browser-active type —
+// text/html, image/svg+xml, application/xhtml+xml, text/javascript,
+// application/wasm, text/css. Doing so re-enables same-origin execution for
+// that extension (and would mean it must also join BLOCKED_EXTENSIONS).
+const MIME_TYPES: Record<string, string> = {
+  // Audio
+  ".wav": "audio/wav",
+  ".mp3": "audio/mpeg",
+  ".m4a": "audio/mp4",
+  ".ogg": "audio/ogg",
+  ".oga": "audio/ogg",
+  ".opus": "audio/opus",
+  ".aac": "audio/aac",
+  ".flac": "audio/flac",
+  ".webm": "audio/webm",
+  // Image
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".bmp": "image/bmp",
+  ".tiff": "image/tiff",
+  ".tif": "image/tiff",
+  ".heic": "image/heic",
+  ".heif": "image/heif",
+  ".avif": "image/avif",
+  // Video
+  ".mp4": "video/mp4",
+  ".m4v": "video/x-m4v",
+  ".mov": "video/quicktime",
+  // Documents / ebooks / data
+  ".pdf": "application/pdf",
+  ".epub": "application/epub+zip",
+  ".mobi": "application/x-mobipocket-ebook",
+  ".txt": "text/plain; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".markdown": "text/markdown; charset=utf-8",
+  ".rtf": "application/rtf",
+  ".csv": "text/csv; charset=utf-8",
+  ".tsv": "text/tab-separated-values; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".zip": "application/zip",
+};
 
 export async function handleStorage(
   req: Request,
@@ -4665,38 +4694,12 @@ export async function handleStorage(
     const stat = statSync(filePath);
     const ext = extname(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
-    const total = stat.size;
-
-    // vault attachments-for-agents design (D9) — the REST twin of MCP's
-    // `content_offset`. `Bun.file(filePath)` resolves lazily: `.slice()`
-    // creates a bounded view and only the requested bytes are actually read
-    // on `.arrayBuffer()`/streaming, replacing the prior whole-file
-    // `readFileSync` (a standing memory smell on a large attachment, e.g. a
-    // 90 MB video) on BOTH the ranged and full-file paths below.
-    const bunFile = Bun.file(filePath);
-    const range = parseByteRangeHeader(req.headers.get("range"), total);
-
-    if (range) {
-      const { start, end } = range; // inclusive
-      return new Response(bunFile.slice(start, end + 1), {
-        status: 206,
-        headers: {
-          "Content-Type": contentType,
-          "Content-Length": String(end - start + 1),
-          "Content-Range": `bytes ${start}-${end}/${total}`,
-          "Accept-Ranges": "bytes",
-          // Defense-in-depth: never let a browser MIME-sniff a stored asset
-          // into an active type — see the full-response branch below.
-          "X-Content-Type-Options": "nosniff",
-        },
-      });
-    }
+    const fileBuffer = readFileSync(filePath);
 
-    return new Response(bunFile, {
+    return new Response(fileBuffer, {
       headers: {
         "Content-Type": contentType,
-        "Content-Length": String(total),
-        "Accept-Ranges": "bytes",
+        "Content-Length": String(stat.size),
         // Defense-in-depth: never let a browser MIME-sniff a stored asset into
         // an active type (e.g. an octet-stream body sniffed as text/html).
         // Combined with the upload blocklist (no .svg/.html) this closes the

package/src/routing.ts

@@ -103,7 +103,6 @@ import {
 } from "./mirror-routes.ts";
 import { getMirrorManager } from "./mirror-registry.ts";
 import { buildUsageReport } from "./usage.ts";
-import { handleTicketSpend } from "./attachment-tickets.ts";
 
 /**
  * Decorate a 401 response from the MCP endpoint with the RFC 9728 challenge
@@ -491,22 +490,6 @@ export async function route(
     return handleAuthorizationServer(req, vaultName);
   }
 
-  // Attachment ticket spend (attachment-tickets design, Wave 1) — no auth
-  // beyond the ticket itself; the ticket IS the credential (single-use,
-  // short TTL, scoped to exactly one upload slot or one attachment's
-  // bytes). Deliberately placed BEFORE `authenticateVaultRequest` below —
-  // a bearer-less runtime (a bare `curl`) must be able to spend a ticket
-  // without ever holding this vault's API key. The path segment
-  // (`/tickets/<id>`) is outside the authed `/api` tree and outside
-  // `/mcp` on purpose — see `request-attachment-upload`/`-download`
-  // (core/src/mcp.ts) for where tickets are minted.
-  const vaultTicketMatch = subpath.match(/^\/tickets\/([^/]+)$/);
-  if (vaultTicketMatch) {
-    const ticketId = decodeURIComponent(vaultTicketMatch[1]!);
-    const store = getVaultStore(vaultName);
-    return handleTicketSpend(req, ticketId, vaultName, store);
-  }
-
   // ---------------------------------------------------------------------
   // Authenticated surface
   // ---------------------------------------------------------------------

package/src/server.ts

@@ -21,7 +21,6 @@ import { migrateVaultKeys } from "./token-store.ts";
 import { resolveFirstBootVaultName, reservedNameSquatWarnings } from "./vault-name.ts";
 import { getVaultStore, getVaultNameForStore, getSharedEmbeddingProvider } from "./vault-store.ts";
 import { EmbeddingWorker, registerEmbeddingHook } from "./embedding-worker.ts";
-import { startAttachmentTicketSweep, stopAttachmentTicketSweep } from "./attachment-tickets.ts";
 import { seedOnboardingNotesBestEffort } from "./onboarding-seed.ts";
 import { defaultHookRegistry } from "../core/src/hooks.ts";
 import { registerTriggers } from "./triggers.ts";
@@ -238,11 +237,6 @@ const embeddingWorker = new EmbeddingWorker({
 registerEmbeddingHook(defaultHookRegistry, embeddingWorker, (store) => getVaultNameForStore(store as never));
 embeddingWorker.start();
 
-// Attachment-ticket sweep (vault#612) — drops expired-unspent tickets from
-// the in-process store so an abandoned mint (an agent that never curls)
-// doesn't sit in memory forever. See src/attachment-tickets.ts.
-startAttachmentTicketSweep();
-
 if (process.env.VAULT_AUTH_TOKEN?.trim()) {
   console.log("[auth] VAULT_AUTH_TOKEN set — server-wide operator bearer active");
 }
@@ -625,7 +619,6 @@ async function shutdown(signal: string): Promise<void> {
         // Then drain hooks + stop the transcription/embedding workers in
         // parallel.
         embeddingWorker.stop();
-        stopAttachmentTicketSweep();
         await Promise.all([
           defaultHookRegistry.drain(),
           transcriptionWorker?.stop() ?? Promise.resolve(),