@remnic/core 10.0.84 → 10.0.86

package/dist/{chunk-6LCWKS62.js → chunk-UAUV3BWS.js}

@@ -8,13 +8,10 @@ import {
 } from "./chunk-MPC7TYTZ.js";
 import {
   importCapsule
-} from "./chunk-YK7GOPIE.js";
+} from "./chunk-G67EUQAB.js";
 import {
   isSharedContextWriteInputError
 } from "./chunk-IFBSZGW3.js";
-import {
-  UNATTRIBUTED_ACCESS_WRITE_ORIGIN
-} from "./chunk-OGXXGHW6.js";
 import {
   ACTIVE_DECISION_STATUSES,
   CodegraphRuntimeError,
@@ -32,16 +29,19 @@ import {
   parseDecisionRecord,
   resolveCodegraphProjectId,
   serializeDecisionRecord
-} from "./chunk-RJWL3RHB.js";
+} from "./chunk-TFEHSPGQ.js";
 import {
-  WriteQuarantineStore
-} from "./chunk-BANSBRNX.js";
+  UNATTRIBUTED_ACCESS_WRITE_ORIGIN
+} from "./chunk-OGXXGHW6.js";
 import {
   WHO_KNOWS_DEFAULT_LIMIT,
   computeWhoKnows,
   loadWhoKnowsEntities,
   validateWhoKnowsInput
-} from "./chunk-FUOAIJKQ.js";
+} from "./chunk-IBDWYRDR.js";
+import {
+  WriteQuarantineStore
+} from "./chunk-BANSBRNX.js";
 import {
   trustResultFor
 } from "./chunk-GNVZQ5JN.js";
@@ -59,32 +59,38 @@ import {
 } from "./chunk-JWX2Q6HS.js";
 import {
   summarizeHourlyStatus
-} from "./chunk-PJYK7HH2.js";
+} from "./chunk-3UZ2VMKD.js";
 import {
   planSessionTranscriptMigration
 } from "./chunk-WWDO7ZWM.js";
 import {
   composeSalvagedEnvelope
-} from "./chunk-YUTT4ZTI.js";
+} from "./chunk-45VUHDV2.js";
 import {
   runRecallWhy
-} from "./chunk-VZELUMKK.js";
-import {
-  assertIdInNavigationWindow
-} from "./chunk-5KVT6G5U.js";
+} from "./chunk-NQP4ZYGG.js";
 import {
   renderNavigationResult
 } from "./chunk-KIW3OOZE.js";
-import {
-  planDisclosureStep
-} from "./chunk-KZSGBWOJ.js";
 import {
   DEFAULT_TRAVERSE_LIMIT,
   selectTraverseNeighbors
 } from "./chunk-YE4JBZO5.js";
+import {
+  assertIdInNavigationWindow
+} from "./chunk-5KVT6G5U.js";
+import {
+  takeNavigateBudget
+} from "./chunk-VYDGHJIN.js";
+import {
+  planDisclosureStep
+} from "./chunk-KZSGBWOJ.js";
 import {
   parseNavigateLinkType
 } from "./chunk-7O5EW7KX.js";
+import {
+  decideDisclosureEscalation
+} from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
 } from "./chunk-EWJZZDRG.js";
@@ -92,48 +98,42 @@ import {
   estimateRecallTokens,
   summarizeDisclosureTokens
 } from "./chunk-7O2MC42R.js";
-import {
-  takeNavigateBudget
-} from "./chunk-VYDGHJIN.js";
-import {
-  decideDisclosureEscalation
-} from "./chunk-H7XKCNR6.js";
 import {
   readAggregateExtractionWatermark
-} from "./chunk-EBOHFZI4.js";
+} from "./chunk-YRZPBN46.js";
 import {
   ReplicaDivergenceMonitor
-} from "./chunk-B6SPPYGJ.js";
+} from "./chunk-7IWRLYFJ.js";
 import {
   buildEmbeddingAwareSnapshotStream
-} from "./chunk-FMFCQRDM.js";
+} from "./chunk-ZANNIXXE.js";
 import {
   recordMemoryOutcome
 } from "./chunk-UD7UNYRD.js";
 import {
   runMemoryBrowse
-} from "./chunk-WBDIZWJQ.js";
+} from "./chunk-TSS3D7ZY.js";
 import {
   isSearchExcludedPath
-} from "./chunk-WYPCJK6K.js";
+} from "./chunk-QKERFEJS.js";
 import {
   coerceIncludedMemories
 } from "./chunk-2YA5N2BY.js";
-import {
-  readProjectedHarmonicGraph
-} from "./chunk-ZJJFUEPO.js";
 import {
   buildGraphSnapshot
-} from "./chunk-VPEIWMUT.js";
+} from "./chunk-YLTU2DC4.js";
+import {
+  readProjectedHarmonicGraph
+} from "./chunk-3PJEDHLD.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
 import {
   CONNECTOR_LABEL_MAX_LENGTH
-} from "./chunk-JX3E4XCW.js";
+} from "./chunk-PDOOUXCS.js";
 import {
   isValidConnectorId
-} from "./chunk-QA3Y2O6H.js";
+} from "./chunk-YAVIBVCU.js";
 import {
   formatProfileTraceAscii
 } from "./chunk-DOWACHYO.js";
@@ -144,7 +144,7 @@ import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
-} from "./chunk-RZH5RVJC.js";
+} from "./chunk-MTTYIXSU.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
@@ -154,6 +154,12 @@ import {
   composeRecallContext,
   renderAuthorityBoundContent
 } from "./chunk-NVKO5YKP.js";
+import {
+  callDeepRecallPolicyLlm
+} from "./chunk-ZGFLIK5H.js";
+import {
+  renderDeepRecallResult
+} from "./chunk-RF2SMMPP.js";
 import {
   createDeepRecallSeedSearch
 } from "./chunk-3X5OPDPF.js";
@@ -161,11 +167,13 @@ import {
   runBudgetedDeepRecall
 } from "./chunk-HXFIILGF.js";
 import {
-  callDeepRecallPolicyLlm
-} from "./chunk-ZGFLIK5H.js";
+  CorpusWatermarkCache,
+  computeServiceCorpusCensus
+} from "./chunk-D5EV6Y2L.js";
 import {
-  renderDeepRecallResult
-} from "./chunk-RF2SMMPP.js";
+  CrossNamespaceBudget,
+  toBudgetWarning
+} from "./chunk-UFGFMWAD.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -173,34 +181,30 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-GCAQ3VUJ.js";
+} from "./chunk-JM2YZKCQ.js";
 import {
-  CorpusWatermarkCache,
-  computeServiceCorpusCensus
-} from "./chunk-TFLPDNQV.js";
+  ExtractionDeadlineError
+} from "./chunk-BIVKPQ6Q.js";
 import {
-  CrossNamespaceBudget,
-  toBudgetWarning
-} from "./chunk-UFGFMWAD.js";
+  LocalLlmClient
+} from "./chunk-2G4TV2ML.js";
+import {
+  isCapsuleImportArchiveInputError,
+  validateCapsuleImportArchive
+} from "./chunk-FKBGK3NC.js";
 import {
   defaultCapsulesDir
 } from "./chunk-ZY2MNJR6.js";
-import {
-  ExtractionDeadlineError
-} from "./chunk-KO3YBHOV.js";
-import {
-  LocalLlmClient
-} from "./chunk-MSIRVXQ3.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-YUTG35M4.js";
+} from "./chunk-CYCEROPR.js";
 import {
   withBriefingDeadline
-} from "./chunk-X2KO4FK5.js";
+} from "./chunk-FNFURZBZ.js";
 import {
   CORRECTION_TEXT_MAX,
   CorrectionContractError,
@@ -227,7 +231,7 @@ import {
 } from "./chunk-AWD36R4D.js";
 import {
   resolveEffectiveDeepRecallConfig
-} from "./chunk-AJG2TAMR.js";
+} from "./chunk-IEEV27BC.js";
 import {
   buildProcedurePersistBody,
   normalizeProcedureSteps,
@@ -236,17 +240,19 @@ import {
 import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
-} from "./chunk-6L63IN3M.js";
+} from "./chunk-ZOJUWVAU.js";
 import {
   parseEntityFile,
   parseFrontmatter,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-WAD32CZG.js";
+} from "./chunk-CC4V7HNP.js";
 import {
+  embeddingBacklogExceeds,
+  isSearchHealthDegraded,
   namespaceCollectionName
-} from "./chunk-LU66I56Q.js";
+} from "./chunk-KVSOEVAF.js";
 import {
   normalizeProjectionPreview,
   normalizeProjectionTags
@@ -268,6 +274,13 @@ import {
 import {
   supersessionKeysForFact
 } from "./chunk-5WITETWU.js";
+import {
+  FallbackLlmClient,
+  gatewayTaskChainOptions
+} from "./chunk-ZU5JDLOH.js";
+import {
+  fallbackLlmRuntimeContextFromConfig
+} from "./chunk-ZU3NJNO7.js";
 import {
   withCaptureWriteLockBackoff
 } from "./chunk-7VLBZKNB.js";
@@ -275,14 +288,10 @@ import {
   groupTurnsByExtractionScope,
   hasPinnedCaptureScope,
   scopeProfilePlanIdentity
-} from "./chunk-4KLQI3L2.js";
+} from "./chunk-UXXK523X.js";
 import {
-  FallbackLlmClient,
-  gatewayTaskChainOptions
-} from "./chunk-ZU5JDLOH.js";
-import {
-  fallbackLlmRuntimeContextFromConfig
-} from "./chunk-ZU3NJNO7.js";
+  delegateExtractionForceFlush
+} from "./chunk-RMMA44HE.js";
 import {
   meetingsBuild,
   meetingsGet,
@@ -305,8 +314,9 @@ import {
   extractJsonCandidates
 } from "./chunk-YBA52OKG.js";
 import {
-  delegateExtractionForceFlush
-} from "./chunk-RMMA44HE.js";
+  PendingObserveExtractionTracker,
+  pendingObserveScopeHint
+} from "./chunk-CYTTY4M2.js";
 import {
   archiveObservedTurns
 } from "./chunk-L3E7MLMK.js";
@@ -325,18 +335,18 @@ import {
 } from "./chunk-YLXETSAH.js";
 import {
   splitCanonicalWriteRequest
-} from "./chunk-65SKM4BF.js";
+} from "./chunk-4XYAWK5H.js";
 import {
   buildWithBriefingLocation,
   daySummaryAutoOptions
-} from "./chunk-2D7BTSDW.js";
+} from "./chunk-ANZZLRUX.js";
 import {
   STRUCTURED_ATTRIBUTE_LIMITS,
   buildAccessWriteRequestFingerprint,
   buildObserveRequestFingerprint,
   composeMemoryEnvelope,
   isMemoryCategory
-} from "./chunk-JRVMCZE3.js";
+} from "./chunk-QEYTRFR3.js";
 import {
   applyTagFilter,
   normalizeTags,
@@ -344,19 +354,19 @@ import {
 } from "./chunk-BT7NVCML.js";
 import {
   computePromotionCandidates
-} from "./chunk-IZJQNDGI.js";
+} from "./chunk-R6HMAIKM.js";
 import {
   reapplyCategoryCoercion
-} from "./chunk-HWHNQVRV.js";
+} from "./chunk-YMJRLT7S.js";
 import {
   exportCapsule
-} from "./chunk-R45L4TV6.js";
+} from "./chunk-7LCGFUMB.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
 import {
   createOfflineSyncManifestStream
-} from "./chunk-FJ2VJTGA.js";
+} from "./chunk-UWRHHRDK.js";
 import {
   offlineSyncStorageForSnapshot
 } from "./chunk-TIGYOZBU.js";
@@ -384,12 +394,13 @@ import {
   displayErrorDetail
 } from "./chunk-RL6NEVXT.js";
 import {
+  assertNamespaceAllowed,
   assertOperationAuthorizationAllowed,
   capabilityAllowsOp,
   enforceNamespaceAllowList,
   isNamespaceAllowed,
   tokenCapabilityStore
-} from "./chunk-YO2JEX2Z.js";
+} from "./chunk-OGBQMY46.js";
 import {
   SUPPORT_PASSPORT_ATTRIBUTE_KEYS,
   SUPPORT_PASSPORT_CARD_TAG,
@@ -439,7 +450,7 @@ import {
   buildOfflineSyncSnapshotFromBase,
   normalizeOfflineSyncChangeset,
   readOfflineSyncFileContentChunk
-} from "./chunk-CLVILSBR.js";
+} from "./chunk-OZNBZJ3S.js";
 import {
   compileOfflineSyncExcludeGlobs
 } from "./chunk-63LFM77Z.js";
@@ -458,7 +469,7 @@ import {
   memorySearchThroughScope,
   mergeMemorySearchDefaultFallback,
   resolveMemorySearchDefaultFallback
-} from "./chunk-S5CQI2KF.js";
+} from "./chunk-B3GKQ6DU.js";
 import {
   canReadNamespace,
   canWriteNamespace,
@@ -487,10 +498,6 @@ import {
   resolveRecallEnhancementCapabilities,
   resolveSecurityCapabilities
 } from "./chunk-C5LWPYS3.js";
-import {
-  PendingObserveExtractionTracker,
-  pendingObserveScopeHint
-} from "./chunk-CYTTY4M2.js";
 import {
   AccessIdempotencyStore,
   hashAccessIdempotencyPayload
@@ -517,7 +524,7 @@ import {
   EngramAccessForbiddenError,
   EngramAccessInputError,
   NamespaceNotWritableError
-} from "./chunk-LGEH473S.js";
+} from "./chunk-CJCTKL6Y.js";
 import {
   abortError,
   isAbortError,
@@ -559,11 +566,9 @@ import {
 
 // src/access-service.ts
 import { createHash as createHash13 } from "crypto";
-import { constants as fsConstants2 } from "fs";
 import { readdirSync, unlinkSync } from "fs";
 import { stat as stat3 } from "fs/promises";
 import * as nodeFs2 from "fs/promises";
-import { ZodError } from "zod";
 
 // src/coding/decision-surfaces.ts
 var DECISION_SUBCOMMANDS = [
@@ -4322,6 +4327,12 @@ function defineOperation(spec) {
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
       assertOperationAuthorizationAllowed(tokenCapabilityStore.getStore(), spec);
+      if (operationRequiresAuthorizedNamespace(spec.name)) {
+        const parsedNamespace = parseResult.data.namespace;
+        if (parsedNamespace) {
+          assertNamespaceAllowed(tokenCapabilityStore.getStore(), parsedNamespace);
+        }
+      }
       return spec.handler(parseResult.data, { ...ctx, rawInput });
     }
   };
@@ -7525,7 +7536,7 @@ var AccessObserveWriteSurface = class {
       } catch {
       }
     }
-    if (threshold > 0 && pendingEmbeddings !== null && pendingEmbeddings > threshold) {
+    if (embeddingBacklogExceeds(pendingEmbeddings, threshold)) {
       degraded = true;
       degradedReason = `embedding-backlog: ${pendingEmbeddings} pending > threshold ${threshold}`;
     }
@@ -7563,13 +7574,12 @@ var AccessObserveWriteSurface = class {
       const pending = health.pendingEmbeddings ?? null;
       const oldest = health.oldestPendingAgeMs ?? null;
       const threshold = this.deps.orchestrator.config.qmdEmbeddingBacklogThreshold;
-      const backlogDegraded = threshold > 0 && pending !== null && pending > threshold;
-      const degraded = !active || health.collectionState === "unknown" || backlogDegraded;
+      const backlogDegraded = embeddingBacklogExceeds(pending, threshold);
       const mode = !active ? "fallback" : health.daemonMode === true ? "daemon" : "cli";
       return {
         enabled: true,
         active,
-        degraded,
+        degraded: isSearchHealthDegraded({ ...health, pendingEmbeddings: pending }, threshold),
         mode,
         collection: health.collection || fallbackCollection,
         collectionState: health.collectionState,
@@ -17971,6 +17981,9 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
    * `versioning` defaults to the orchestrator's page-versioning config so
    * `mode: "overwrite"` automatically snapshots prior content without the
    * caller having to construct the config object.
+   *
+   * Remote callers (HTTP and MCP) may only import from the destination
+   * namespace's capsule store; the CLI keeps unrestricted local paths.
    */
   async capsuleImport(opts) {
     const { namespace, principal, root: explicitRoot, memoryDir: explicitMemoryDir, ...importOptions } = opts;
@@ -17983,47 +17996,17 @@ var EngramAccessService = class extends SupportPassportAccessServiceBase {
       maxVersionsPerPage: this.orchestrator.config.versioningMaxPerPage,
       sidecarDir: this.orchestrator.config.versioningSidecarDir
     };
-    await this.validateCapsuleImportArchivePath(importOptions.archivePath);
+    await validateCapsuleImportArchive(importOptions.archivePath, storage.dir);
     try {
       return await importCapsule({ ...importOptions, root, memoryDir, versioning });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      if (this.isCapsuleImportArchiveInputError(err, message)) {
+      if (isCapsuleImportArchiveInputError(err, message)) {
         throw new EngramAccessInputError(`capsule import failed: ${message}`);
       }
       throw err;
     }
   }
-  async validateCapsuleImportArchivePath(archivePath) {
-    let archiveStat;
-    try {
-      archiveStat = await stat3(archivePath);
-    } catch (err) {
-      if (!this.isCapsuleImportPathInputFsError(err)) throw err;
-      const message = err instanceof Error ? err.message : String(err);
-      throw new EngramAccessInputError(`capsule import failed: archive is not readable: ${message}`);
-    }
-    if (!archiveStat.isFile()) {
-      throw new EngramAccessInputError("capsule import failed: archivePath must point to a file");
-    }
-    try {
-      await nodeFs2.access(archivePath, fsConstants2.R_OK);
-    } catch (err) {
-      if (!this.isCapsuleImportPathInputFsError(err)) throw err;
-      const message = err instanceof Error ? err.message : String(err);
-      throw new EngramAccessInputError(`capsule import failed: archive is not readable: ${message}`);
-    }
-  }
-  isCapsuleImportPathInputFsError(err) {
-    const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-    return code === "ENOENT" || code === "ENOTDIR" || code === "EACCES" || code === "EPERM" || code === "ELOOP";
-  }
-  isCapsuleImportArchiveInputError(err, message) {
-    if (err instanceof ZodError) return true;
-    const code = typeof err === "object" && err !== null && "code" in err ? err.code : void 0;
-    if (typeof code === "string" && code.startsWith("Z_")) return true;
-    return message.startsWith("importCapsule: archive") || message.startsWith("importCapsule: bundle") || message.startsWith("importCapsule: manifest") || message.startsWith("importCapsule: record") || /incorrect header check|invalid stored block lengths|not in gzip format|unexpected end of file/i.test(message);
-  }
   /**
    * Export a capsule archive from the orchestrator's memory directory.
    *
@@ -18803,4 +18786,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-6LCWKS62.js.map
+//# sourceMappingURL=chunk-UAUV3BWS.js.map