@remnic/core 1.1.2 → 1.1.4

package/dist/{chunk-UWB5LMWY.js → chunk-CUI2STX6.js}

@@ -1,18 +1,27 @@
 import {
   EngramMcpServer
-} from "./chunk-OC5OXUQ4.js";
+} from "./chunk-XRCYKJ3V.js";
 import {
   EngramAccessInputError
-} from "./chunk-STGWEHYR.js";
+} from "./chunk-AEMBDV7M.js";
 import {
   isTrustZoneName
 } from "./chunk-EQINRHYR.js";
+import {
+  expandTildePath
+} from "./chunk-IXEJRKCZ.js";
+import {
+  subscribeGraphEvents
+} from "./chunk-WIICJPET.js";
+import {
+  isRecallDisclosure
+} from "./chunk-43EKP2UK.js";
 import {
   log
 } from "./chunk-2ODBA7MQ.js";
 import {
   validateRequest
-} from "./chunk-WCLICCGB.js";
+} from "./chunk-RILIVK4O.js";
 
 // src/access-http.ts
 import { createServer } from "http";
@@ -156,9 +165,14 @@ var AdapterRegistry = class {
 
 // src/access-http.ts
 function resolveDefaultAdminConsolePublicDir() {
+  const thisDir = path.dirname(fileURLToPath(import.meta.url));
   const candidates = [
-    fileURLToPath(new URL("../admin-console/public", import.meta.url)),
-    fileURLToPath(new URL("./admin-console/public", import.meta.url))
+    // Standard: admin-console sibling to src/ (development layout)
+    path.resolve(thisDir, "../admin-console/public"),
+    // Bundled: admin-console inside dist/ alongside the bundle
+    path.resolve(thisDir, "./admin-console/public"),
+    // Package root: walk up from dist/ to the package root
+    path.resolve(thisDir, "../../admin-console/public")
   ];
   return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
 }
@@ -206,6 +220,13 @@ function parseTrustZoneFilter(raw) {
   }
   throw new HttpError(400, "zone must be one of quarantine|working|trusted", "invalid_zone_filter");
 }
+function decodePeerIdSegment(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    throw new EngramAccessInputError("peerId path segment is not valid percent-encoded input");
+  }
+}
 var EngramAccessHttpServer = class {
   service;
   host;
@@ -223,6 +244,18 @@ var EngramAccessHttpServer = class {
   mcpServer;
   server = null;
   boundPort = 0;
+  /** Active SSE response objects for /engram/v1/graph/events. */
+  sseClients = /* @__PURE__ */ new Set();
+  /** Throttle batch: pending SSE event batches per client. */
+  sseBatchTimers = /* @__PURE__ */ new Map();
+  ssePendingBatches = /* @__PURE__ */ new Map();
+  /**
+   * Per-client cleanup callbacks: clear heartbeat interval, flush timer,
+   * unsubscribe from bus, and end the response.  Stored here so `stop()`
+   * can invoke them even when the client hasn't disconnected yet
+   * (Cursor review thread `access-http.ts:232`).
+   */
+  sseCleanupFns = /* @__PURE__ */ new Set();
   constructor(options) {
     this.service = options.service;
     this.host = options.host?.trim() || "127.0.0.1";
@@ -298,6 +331,25 @@ var EngramAccessHttpServer = class {
     const server = this.server;
     this.server = null;
     this.boundPort = 0;
+    for (const cleanup of this.sseCleanupFns) {
+      try {
+        cleanup();
+      } catch {
+      }
+    }
+    this.sseCleanupFns.clear();
+    for (const [res, timer] of this.sseBatchTimers.entries()) {
+      clearTimeout(timer);
+      this.sseBatchTimers.delete(res);
+    }
+    this.ssePendingBatches.clear();
+    for (const res of this.sseClients) {
+      try {
+        res.end();
+      } catch {
+      }
+    }
+    this.sseClients.clear();
     await new Promise((resolve, reject) => {
       server.close((err) => err ? reject(err) : resolve());
     });
@@ -367,13 +419,37 @@ var EngramAccessHttpServer = class {
   resolveNamespace(_req, bodyNamespace) {
     return bodyNamespace || void 0;
   }
+  /**
+   * Resolve the recall disclosure depth from the request (issue #677 PR
+   * 2/4).  Explicit body value wins; otherwise we accept a
+   * `?disclosure=...` query parameter so curl/browser tooling can use the
+   * three-tier surface without rewriting JSON.  Invalid query values
+   * throw `EngramAccessInputError` (CLAUDE.md rule 51 — no silent
+   * fallback).  An absent body field AND an absent query param yields
+   * `undefined`, which the service maps to `DEFAULT_RECALL_DISCLOSURE`.
+   */
+  resolveRecallDisclosure(bodyDisclosure, parsed) {
+    if (bodyDisclosure !== void 0) {
+      return bodyDisclosure;
+    }
+    const queryDisclosure = parsed.searchParams.get("disclosure");
+    if (queryDisclosure === null) {
+      return void 0;
+    }
+    if (!isRecallDisclosure(queryDisclosure)) {
+      throw new EngramAccessInputError(
+        `disclosure must be one of: chunk, section, raw (got: ${queryDisclosure})`
+      );
+    }
+    return queryDisclosure;
+  }
   async handle(req, res, correlationId) {
     const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
     const pathname = parsed.pathname;
     if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) {
       return;
     }
-    if (!this.isAuthorized(req)) {
+    if (!this.isAuthorized(req, pathname)) {
       const body = JSON.stringify({ error: "unauthorized", code: "unauthorized" });
       res.writeHead(401, {
         "content-type": "application/json; charset=utf-8",
@@ -403,6 +479,45 @@ var EngramAccessHttpServer = class {
     if (req.method === "POST" && pathname === "/engram/v1/recall") {
       const body = await this.readValidatedBody(req, "recall");
       const codingContext = "codingContext" in body ? body.codingContext : void 0;
+      const disclosure = this.resolveRecallDisclosure(body.disclosure, parsed);
+      const asOfQueryRaw = parsed.searchParams.get("as_of");
+      const bodyHasAsOf = typeof body.asOf === "string" && body.asOf.length > 0;
+      if (!bodyHasAsOf && asOfQueryRaw !== null && asOfQueryRaw.length === 0) {
+        throw new EngramAccessInputError(
+          "as_of must be a non-empty timestamp (got empty value)"
+        );
+      }
+      const asOf = body.asOf ?? (asOfQueryRaw !== null && asOfQueryRaw.length > 0 ? asOfQueryRaw : void 0);
+      const bodyHasTagsField = body !== null && typeof body === "object" && "tags" in body;
+      const bodyTagsValue = bodyHasTagsField ? body.tags : void 0;
+      const bodyTags = Array.isArray(bodyTagsValue) ? bodyTagsValue : void 0;
+      const queryTags = parsed.searchParams.getAll("tag");
+      const tags = bodyHasTagsField ? bodyTags : queryTags.length > 0 ? queryTags : void 0;
+      const bodyTagMatch = body.tagMatch;
+      let tagMatch;
+      if (bodyTagMatch !== void 0) {
+        if (bodyTagMatch === "any" || bodyTagMatch === "all") {
+          tagMatch = bodyTagMatch;
+        }
+      } else {
+        const queryTagMatch = parsed.searchParams.get("tag_match");
+        if (queryTagMatch !== null) {
+          if (queryTagMatch !== "any" && queryTagMatch !== "all") {
+            throw new EngramAccessInputError(
+              `tag_match must be one of: any, all (got: ${queryTagMatch})`
+            );
+          }
+          tagMatch = queryTagMatch;
+        }
+      }
+      const bodyIncludeLowConfidence = body.includeLowConfidence;
+      const queryIncludeLowConfidence = parsed.searchParams.get("include_low_confidence");
+      if (bodyIncludeLowConfidence === void 0 && queryIncludeLowConfidence !== null && queryIncludeLowConfidence !== "true" && queryIncludeLowConfidence !== "false") {
+        throw new EngramAccessInputError(
+          `include_low_confidence must be one of: true, false (got: ${queryIncludeLowConfidence})`
+        );
+      }
+      const includeLowConfidence = bodyIncludeLowConfidence === true || bodyIncludeLowConfidence === void 0 && queryIncludeLowConfidence === "true";
       const response = await this.service.recall({
         query: body.query ?? "",
         sessionKey: body.sessionKey,
@@ -410,7 +525,18 @@ var EngramAccessHttpServer = class {
         topK: body.topK,
         mode: body.mode,
         includeDebug: body.includeDebug === true,
-        codingContext
+        // Forward the validated disclosure depth to the service layer
+        // (issue #677).  The zod schema accepts/rejects body values;
+        // `resolveRecallDisclosure()` validates the query-param fallback.
+        disclosure,
+        codingContext,
+        // Forward cwd/projectTag for auto git-context resolution (issue #569).
+        cwd: body.cwd,
+        projectTag: body.projectTag,
+        ...asOf !== void 0 ? { asOf } : {},
+        ...tags !== void 0 ? { tags } : {},
+        ...tagMatch !== void 0 ? { tagMatch } : {},
+        ...includeLowConfidence ? { includeLowConfidence: true } : {}
       });
       this.respondJson(res, 200, response);
       return;
@@ -424,6 +550,36 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, { ok: true });
       return;
     }
+    if (req.method === "POST" && (pathname === "/engram/v1/capsules/export" || pathname === "/remnic/v1/capsules/export")) {
+      const body = await this.readValidatedBody(req, "capsuleExport");
+      this.ensureWriteRateLimitAvailable();
+      const result = await this.service.capsuleExport({
+        name: body.name,
+        namespace: this.resolveNamespace(req, body.namespace),
+        principal: this.resolveRequestPrincipal(req),
+        since: body.since,
+        includeKinds: body.includeKinds,
+        peerIds: body.peerIds,
+        includeTranscripts: body.includeTranscripts,
+        encrypt: body.encrypt
+      });
+      this.recordWriteRateLimitHit();
+      this.respondJson(res, 200, result);
+      return;
+    }
+    if (req.method === "POST" && (pathname === "/engram/v1/capsules/import" || pathname === "/remnic/v1/capsules/import")) {
+      const body = await this.readValidatedBody(req, "capsuleImport");
+      this.ensureWriteRateLimitAvailable();
+      const result = await this.service.capsuleImport({
+        archivePath: expandTildePath(body.archivePath),
+        namespace: this.resolveNamespace(req, body.namespace),
+        principal: this.resolveRequestPrincipal(req),
+        mode: body.mode
+      });
+      this.recordWriteRateLimitHit();
+      this.respondJson(res, 200, result);
+      return;
+    }
     if (req.method === "POST" && pathname === "/engram/v1/recall/explain") {
       const body = await this.readValidatedBody(req, "recallExplain");
       const response = await this.service.recallExplain({
@@ -480,6 +636,19 @@ var EngramAccessHttpServer = class {
         }
         budget = parsedBudget;
       }
+      const disclosureParam = parsed.searchParams.get("disclosure");
+      let disclosure;
+      if (disclosureParam !== null && disclosureParam.length > 0) {
+        if (!isRecallDisclosure(disclosureParam)) {
+          this.respondJson(res, 400, {
+            error: "invalid_disclosure",
+            code: "invalid_disclosure",
+            message: "disclosure must be one of: chunk, section, raw"
+          });
+          return;
+        }
+        disclosure = disclosureParam;
+      }
       let payload;
       try {
         payload = await this.service.recallXray({
@@ -487,7 +656,8 @@ var EngramAccessHttpServer = class {
           sessionKey,
           namespace,
           budget,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req)
+          authenticatedPrincipal: this.resolveRequestPrincipal(req),
+          ...disclosure !== void 0 ? { disclosure } : {}
         });
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -512,7 +682,10 @@ var EngramAccessHttpServer = class {
         messages: body.messages,
         namespace: this.resolveNamespace(req, body.namespace),
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        skipExtraction: body.skipExtraction === true
+        skipExtraction: body.skipExtraction === true,
+        // Forward cwd/projectTag for auto git-context resolution (issue #569).
+        cwd: body.cwd,
+        projectTag: body.projectTag
       });
       this.recordWriteRateLimitHit();
       this.respondJson(res, 202, response);
@@ -827,7 +1000,7 @@ var EngramAccessHttpServer = class {
       }
       const namespace = parsed.searchParams.get("namespace") ?? void 0;
       const limitRaw = parseInt(parsed.searchParams.get("limit") ?? "50", 10);
-      const { listPairs } = await import("./contradiction-review-WIUBAR52.js");
+      const { listPairs } = await import("./contradiction-review-5LTTVDQV.js");
       const result = listPairs(this.service.memoryDir, {
         filter: rawFilter,
         namespace,
@@ -838,7 +1011,7 @@ var EngramAccessHttpServer = class {
     }
     if (req.method === "GET" && pathname.startsWith("/engram/v1/review/contradictions/")) {
       const pairId = pathname.split("/").pop() ?? "";
-      const { readPair } = await import("./contradiction-review-WIUBAR52.js");
+      const { readPair } = await import("./contradiction-review-5LTTVDQV.js");
       const pair = readPair(this.service.memoryDir, pairId);
       if (!pair) {
         this.respondJson(res, 404, { error: "pair_not_found" });
@@ -855,7 +1028,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 400, { error: "pairId and verb are required" });
         return;
       }
-      const { isValidResolutionVerb, executeResolution } = await import("./resolution-QBTDHTG7.js");
+      const { isValidResolutionVerb, executeResolution } = await import("./resolution-YGIBORXI.js");
       if (!isValidResolutionVerb(verb)) {
         this.respondJson(res, 400, { error: `Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context` });
         return;
@@ -864,9 +1037,83 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, result);
       return;
     }
+    if (req.method === "GET" && pathname === "/engram/v1/graph/snapshot") {
+      const limitRaw = parsed.searchParams.get("limit");
+      let limit;
+      if (limitRaw !== null && limitRaw.length > 0) {
+        const parsedLimit = Number(limitRaw);
+        if (!Number.isFinite(parsedLimit) || !Number.isInteger(parsedLimit) || parsedLimit <= 0) {
+          this.respondJson(res, 400, {
+            error: "invalid_limit",
+            code: "invalid_limit",
+            message: "limit must be a positive integer"
+          });
+          return;
+        }
+        limit = parsedLimit;
+      }
+      const sinceRaw = parsed.searchParams.get("since");
+      let since;
+      if (sinceRaw !== null && sinceRaw.length > 0) {
+        if (!Number.isFinite(Date.parse(sinceRaw))) {
+          this.respondJson(res, 400, {
+            error: "invalid_since",
+            code: "invalid_since",
+            message: "since must be a parseable ISO timestamp"
+          });
+          return;
+        }
+        since = sinceRaw;
+      }
+      const focusNodeIdRaw = parsed.searchParams.get("focusNodeId");
+      const focusNodeId = focusNodeIdRaw && focusNodeIdRaw.length > 0 ? focusNodeIdRaw : void 0;
+      const categoriesRaw = parsed.searchParams.get("categories");
+      let categories;
+      if (categoriesRaw !== null && categoriesRaw.length > 0) {
+        categories = categoriesRaw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+        if (categories.length === 0) {
+          this.respondJson(res, 400, {
+            error: "invalid_categories",
+            code: "invalid_categories",
+            message: "categories must be a comma-separated list with at least one non-empty value"
+          });
+          return;
+        }
+      }
+      const namespaceParam = parsed.searchParams.get("namespace");
+      const namespace = this.resolveNamespace(
+        req,
+        namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
+      );
+      try {
+        const snapshot = await this.service.graphSnapshot(
+          {
+            namespace,
+            ...limit !== void 0 ? { limit } : {},
+            ...since !== void 0 ? { since } : {},
+            ...focusNodeId !== void 0 ? { focusNodeId } : {},
+            ...categories !== void 0 ? { categories } : {}
+          },
+          this.resolveRequestPrincipal(req)
+        );
+        this.respondJson(res, 200, snapshot);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.startsWith("graphSnapshot:")) {
+          this.respondJson(res, 400, {
+            error: "invalid_request",
+            code: "invalid_request",
+            message
+          });
+          return;
+        }
+        throw err;
+      }
+      return;
+    }
     if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
       const body = await this.readJsonBody(req);
-      const { runContradictionScan } = await import("./contradiction-scan-E3GJTI4F.js");
+      const { runContradictionScan } = await import("./contradiction-scan-3Z6YW7YA.js");
       const result = await runContradictionScan({
         storage: this.service.storageRef,
         config: this.service.configRef,
@@ -879,12 +1126,245 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, result);
       return;
     }
+    if (req.method === "GET" && pathname === "/engram/v1/graph/events") {
+      await this.handleGraphEventsSSE(req, res);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/console/state") {
+      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const snapshot = await this.service.consoleState(namespace, this.resolveRequestPrincipal(req));
+      this.respondJson(res, 200, snapshot);
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/peers") {
+      const result = await this.service.peerList();
+      this.respondJson(res, 200, result);
+      return;
+    }
+    const peerProfileMatch = /^\/engram\/v1\/peers\/([^/]+)\/profile$/.exec(pathname);
+    if (peerProfileMatch) {
+      if (req.method !== "GET") {
+        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
+        return;
+      }
+      const peerId = decodePeerIdSegment(peerProfileMatch[1] ?? "");
+      const result = await this.service.peerProfileGet(peerId);
+      if (!result.found) {
+        this.respondJson(res, 404, { error: "peer_profile_not_found", code: "peer_profile_not_found" });
+        return;
+      }
+      this.respondJson(res, 200, result);
+      return;
+    }
+    const peerIdMatch = /^\/engram\/v1\/peers\/([^/]+)$/.exec(pathname);
+    if (peerIdMatch) {
+      const peerId = decodePeerIdSegment(peerIdMatch[1] ?? "");
+      if (req.method === "GET") {
+        const result = await this.service.peerGet(peerId);
+        if (!result.found) {
+          this.respondJson(res, 404, { error: "peer_not_found", code: "peer_not_found" });
+          return;
+        }
+        this.respondJson(res, 200, result);
+        return;
+      }
+      if (req.method === "PUT") {
+        const body = await this.readJsonBody(req);
+        if ("kind" in body && body.kind !== void 0 && typeof body.kind !== "string") {
+          throw new EngramAccessInputError("kind must be a string when provided");
+        }
+        if ("displayName" in body && body.displayName !== void 0 && typeof body.displayName !== "string") {
+          throw new EngramAccessInputError("displayName must be a string when provided");
+        }
+        if ("notes" in body && body.notes !== void 0 && typeof body.notes !== "string") {
+          throw new EngramAccessInputError("notes must be a string when provided");
+        }
+        const result = await this.service.peerSet({
+          id: peerId,
+          kind: typeof body.kind === "string" ? body.kind : void 0,
+          displayName: typeof body.displayName === "string" ? body.displayName : void 0,
+          notes: typeof body.notes === "string" ? body.notes : void 0
+        });
+        this.respondJson(res, result.created ? 201 : 200, result);
+        return;
+      }
+      if (req.method === "DELETE") {
+        const forgetParam = parsed.searchParams.get("forget");
+        if (forgetParam === "true") {
+          const body = await this.readJsonBody(req);
+          const confirm = typeof body.confirm === "string" ? body.confirm : "";
+          if (confirm !== "yes") {
+            this.respondJson(res, 400, {
+              error: "confirm_required",
+              code: "confirm_required",
+              message: "DELETE ?forget=true requires { confirm: 'yes' } in the request body"
+            });
+            return;
+          }
+          const result2 = await this.service.peerForget(peerId, { confirm: "yes" });
+          this.respondJson(res, 200, result2);
+          return;
+        }
+        const result = await this.service.peerDelete(peerId);
+        this.respondJson(res, 200, result);
+        return;
+      }
+      this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
+      return;
+    }
+    if (req.method === "GET" && pathname === "/engram/v1/dreams/status") {
+      const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-LR2NBAZE.js");
+      const windowHoursRaw = parsed.searchParams.get("windowHours");
+      let windowHours;
+      try {
+        windowHours = normalizeDreamsStatusWindowHours(
+          windowHoursRaw !== null ? Number(windowHoursRaw) : void 0
+        );
+      } catch {
+        this.respondJson(res, 400, { error: "windowHours must be a positive integer" });
+        return;
+      }
+      const namespaceParam = parsed.searchParams.get("namespace");
+      const namespace = namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0;
+      const result = await this.service.dreamsStatus({
+        windowHours,
+        namespace,
+        principal: this.resolveRequestPrincipal(req)
+      });
+      this.respondJson(res, 200, result);
+      return;
+    }
+    if (req.method === "POST" && pathname === "/engram/v1/dreams/run") {
+      const body = await this.readJsonBody(req);
+      const VALID_PHASES = ["lightSleep", "rem", "deepSleep"];
+      const phase = typeof body.phase === "string" ? body.phase : void 0;
+      if (!phase || !VALID_PHASES.includes(phase)) {
+        this.respondJson(res, 400, {
+          error: `phase is required and must be one of: ${VALID_PHASES.join(", ")}`
+        });
+        return;
+      }
+      if ("dryRun" in body && body.dryRun !== void 0 && typeof body.dryRun !== "boolean") {
+        this.respondJson(res, 400, {
+          error: "dryRun must be a boolean when provided"
+        });
+        return;
+      }
+      if ("namespace" in body && body.namespace !== void 0 && typeof body.namespace !== "string") {
+        this.respondJson(res, 400, {
+          error: "namespace must be a string when provided"
+        });
+        return;
+      }
+      const dryRun = body.dryRun === true;
+      const namespace = typeof body.namespace === "string" ? body.namespace : void 0;
+      if (!dryRun) {
+        this.ensureWriteRateLimitAvailable();
+      }
+      const result = await this.service.dreamsRun({
+        phase,
+        dryRun,
+        namespace,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req)
+      });
+      if (this.shouldCountWriteRateLimit(result)) {
+        this.recordWriteRateLimitHit();
+      }
+      this.respondJson(res, 200, result);
+      return;
+    }
     this.respondJson(res, 404, { error: "not_found", code: "not_found" });
   }
+  /**
+   * SSE handler for /engram/v1/graph/events.
+   *
+   * Lifecycle:
+   *  1. Write SSE headers (Content-Type: text/event-stream).
+   *  2. Register this response in `sseClients`.
+   *  3. Resolve the namespace from the request and subscribe to THAT
+   *     namespace's graph event bus (Codex P1: in multi-namespace
+   *     deployments each namespace has its own bus keyed by its storage
+   *     dir — subscribing to the global root leaks events across tenants).
+   *  4. On each event, add to a 200 ms batch; flush batch as a single SSE frame.
+   *  5. Send heartbeat every 25 s.
+   *  6. On client disconnect (req "close"), clean up timers and unsubscribe.
+   *  7. Register the cleanup callback in `sseCleanupFns` so `stop()` can
+   *     release the heartbeat interval and bus subscription even when the
+   *     client never disconnects (Cursor review thread `access-http.ts:232`).
+   */
+  async handleGraphEventsSSE(req, res) {
+    const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
+    const namespaceParam = parsed.searchParams.get("namespace");
+    const namespace = namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0;
+    const principal = this.resolveRequestPrincipal(req);
+    const memoryDir = await this.service.getMemoryDirForNamespace(namespace, principal);
+    res.writeHead(200, {
+      "content-type": "text/event-stream; charset=utf-8",
+      "cache-control": "no-cache, no-store, must-revalidate",
+      "connection": "keep-alive",
+      "x-accel-buffering": "no",
+      // prevent nginx buffering
+      "transfer-encoding": "chunked"
+    });
+    const writeSSE = (payload) => {
+      try {
+        res.write(`data: ${JSON.stringify(payload)}
+
+`);
+      } catch {
+      }
+    };
+    writeSSE({ type: "connected" });
+    this.sseClients.add(res);
+    const flushBatch = () => {
+      const batch = this.ssePendingBatches.get(res);
+      if (!batch || batch.length === 0) return;
+      this.ssePendingBatches.delete(res);
+      this.sseBatchTimers.delete(res);
+      writeSSE({ type: "batch", events: batch });
+    };
+    const unsubscribe = subscribeGraphEvents(memoryDir, (event) => {
+      let batch = this.ssePendingBatches.get(res);
+      if (!batch) {
+        batch = [];
+        this.ssePendingBatches.set(res, batch);
+      }
+      batch.push(event);
+      if (!this.sseBatchTimers.has(res)) {
+        this.sseBatchTimers.set(res, setTimeout(flushBatch, 200));
+      }
+    });
+    const heartbeatInterval = setInterval(() => {
+      writeSSE({ type: "heartbeat" });
+    }, 25e3);
+    const cleanup = () => {
+      clearInterval(heartbeatInterval);
+      const timer = this.sseBatchTimers.get(res);
+      if (timer !== void 0) {
+        clearTimeout(timer);
+        this.sseBatchTimers.delete(res);
+      }
+      this.ssePendingBatches.delete(res);
+      unsubscribe();
+      this.sseClients.delete(res);
+      this.sseCleanupFns.delete(cleanup);
+      try {
+        res.end();
+      } catch {
+      }
+    };
+    this.sseCleanupFns.add(cleanup);
+    req.once("close", cleanup);
+    req.once("error", cleanup);
+  }
   async handleMcpRequest(req, res) {
     const body = await this.readJsonBody(req);
     const request = body;
-    const isMcpWrite = request.method === "tools/call" && typeof request.params?.name === "string" && (request.params.name === "engram.memory_store" || request.params.name === "engram.suggestion_submit" || request.params.name === "engram.observe");
+    const toolName = typeof request.params?.name === "string" ? request.params.name : "";
+    const toolArgs = request.params?.arguments;
+    const dreamsRunDryRun = (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") && toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && toolArgs.dryRun === true;
+    const memoryActionApplyDryRun = (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply") && toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && toolArgs.dryRun === true;
+    const isMcpWrite = request.method === "tools/call" && (toolName === "engram.memory_store" || toolName === "remnic.memory_store" || toolName === "engram.suggestion_submit" || toolName === "remnic.suggestion_submit" || toolName === "engram.observe" || toolName === "remnic.observe" || toolName === "engram.capsule_export" || toolName === "remnic.capsule_export" || toolName === "engram.capsule_import" || toolName === "remnic.capsule_import" || !dreamsRunDryRun && (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") || !memoryActionApplyDryRun && (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply"));
     if (isMcpWrite) {
       this.ensureWriteRateLimitAvailable();
     }
@@ -930,11 +1410,17 @@ var EngramAccessHttpServer = class {
   }
   async handleAdminConsole(req, res, pathname) {
     if (req.method !== "GET") return false;
-    if (pathname === "/engram/ui" || pathname === "/engram/ui/") {
+    if (pathname === "/remnic/ui" || pathname === "/engram/ui") {
+      res.statusCode = 301;
+      res.setHeader("location", pathname + "/");
+      res.end();
+      return true;
+    }
+    if (pathname === "/remnic/ui/" || pathname === "/engram/ui/") {
       await this.respondStatic(res, path.join(this.adminConsolePublicDir, "index.html"), "text/html; charset=utf-8");
       return true;
     }
-    if (pathname === "/engram/ui/app.js") {
+    if (pathname === "/remnic/ui/app.js" || pathname === "/engram/ui/app.js") {
       await this.respondStatic(res, path.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
       return true;
     }
@@ -984,15 +1470,31 @@ var EngramAccessHttpServer = class {
     }
     return result.data;
   }
-  isAuthorized(req) {
+  isAuthorized(req, pathname) {
     if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter) return false;
     const raw = req.headers.authorization;
-    if (!raw) return false;
-    const separator = raw.indexOf(" ");
-    if (separator <= 0) return false;
-    const scheme = raw.slice(0, separator).toLowerCase();
-    if (scheme !== "bearer") return false;
-    const token = raw.slice(separator + 1).trim();
+    let candidate = null;
+    if (raw) {
+      const separator = raw.indexOf(" ");
+      if (separator > 0) {
+        const scheme = raw.slice(0, separator).toLowerCase();
+        if (scheme === "bearer") {
+          candidate = raw.slice(separator + 1).trim();
+        }
+      }
+    }
+    if (!candidate && pathname === "/engram/v1/graph/events") {
+      try {
+        const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
+        const queryToken = parsed.searchParams.get("token");
+        if (queryToken && queryToken.length > 0) {
+          candidate = queryToken;
+        }
+      } catch {
+      }
+    }
+    if (!candidate) return false;
+    const token = candidate;
     if (this.authToken && this.timingSafeStringEqual(token, this.authToken)) return true;
     for (const valid of this.authTokens) {
       if (this.timingSafeStringEqual(token, valid)) return true;
@@ -1043,4 +1545,4 @@ var EngramAccessHttpServer = class {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-UWB5LMWY.js.map
+//# sourceMappingURL=chunk-CUI2STX6.js.map