@remnic/core 10.0.84 → 10.0.86

package/dist/verified-recall.js

@@ -1,22 +1,22 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-2IW5PT7U.js";
+} from "./chunk-2N4OUSIA.js";
 import "./chunk-B7RWBZXW.js";
-import "./chunk-WAD32CZG.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-7PMOCQOL.js";
-import "./chunk-LU66I56Q.js";
-import "./chunk-VKDAJJQP.js";
-import "./chunk-OVZIYLBZ.js";
-import "./chunk-EXYT52NR.js";
-import "./chunk-DOJBV6WR.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
 import "./chunk-PFUXPTBT.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
+import "./chunk-OVZIYLBZ.js";
+import "./chunk-EXYT52NR.js";
+import "./chunk-DOJBV6WR.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
 import "./chunk-TFA6HPOA.js";
@@ -26,23 +26,23 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
-import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
+import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-FF6N7BXC.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-BV2BRHD4.js";
-import "./chunk-ZIKENA2C.js";
-import "./chunk-3ONXXHQO.js";
+import "./chunk-S45INSV3.js";
+import "./chunk-FHGWKODN.js";
 import "./chunk-YXZG5TVN.js";
+import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
+import "./chunk-3ONXXHQO.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -51,35 +51,35 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
-import "./chunk-7VLBZKNB.js";
-import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
 import "./chunk-NWA6IXR3.js";
 import "./chunk-VILPVT4S.js";
 import "./chunk-AF2XMJKD.js";
 import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-4KLQI3L2.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
+import "./chunk-7VLBZKNB.js";
+import "./chunk-Y33KJ556.js";
+import "./chunk-UXXK523X.js";
+import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
 import "./chunk-RNFMFC37.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-PQVCH2AE.js";
-import "./chunk-PJKTFXE2.js";
 import "./chunk-V4XE263I.js";
 import "./chunk-YBA52OKG.js";
-import "./chunk-JRVMCZE3.js";
+import "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-IZJQNDGI.js";
+import "./chunk-R6HMAIKM.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
@@ -91,7 +91,7 @@ import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
 import "./chunk-PWPIERBM.js";
-import "./chunk-KQUSP6LB.js";
+import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-BTNNL7ZW.js";
 import "./chunk-JDSVLVCG.js";

package/dist/who-knows-cli.js

@@ -4,22 +4,22 @@ import {
   renderWhoKnows,
   renderWhoKnowsJson,
   renderWhoKnowsText
-} from "./chunk-KJCL2FZO.js";
-import "./chunk-FUOAIJKQ.js";
-import "./chunk-WAD32CZG.js";
+} from "./chunk-QD5R6U5J.js";
+import "./chunk-IBDWYRDR.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-7PMOCQOL.js";
-import "./chunk-LU66I56Q.js";
-import "./chunk-VKDAJJQP.js";
-import "./chunk-OVZIYLBZ.js";
-import "./chunk-EXYT52NR.js";
-import "./chunk-DOJBV6WR.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
 import "./chunk-PFUXPTBT.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
+import "./chunk-OVZIYLBZ.js";
+import "./chunk-EXYT52NR.js";
+import "./chunk-DOJBV6WR.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
 import "./chunk-TFA6HPOA.js";
@@ -29,23 +29,23 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
-import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
+import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-FF6N7BXC.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-BV2BRHD4.js";
-import "./chunk-ZIKENA2C.js";
-import "./chunk-3ONXXHQO.js";
+import "./chunk-S45INSV3.js";
+import "./chunk-FHGWKODN.js";
 import "./chunk-YXZG5TVN.js";
+import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
+import "./chunk-3ONXXHQO.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -54,35 +54,35 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
-import "./chunk-7VLBZKNB.js";
-import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
 import "./chunk-NWA6IXR3.js";
 import "./chunk-VILPVT4S.js";
 import "./chunk-AF2XMJKD.js";
 import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-4KLQI3L2.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
+import "./chunk-7VLBZKNB.js";
+import "./chunk-Y33KJ556.js";
+import "./chunk-UXXK523X.js";
+import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
 import "./chunk-RNFMFC37.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-PQVCH2AE.js";
-import "./chunk-PJKTFXE2.js";
 import "./chunk-V4XE263I.js";
 import "./chunk-YBA52OKG.js";
-import "./chunk-JRVMCZE3.js";
+import "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-IZJQNDGI.js";
+import "./chunk-R6HMAIKM.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
@@ -94,7 +94,7 @@ import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
 import "./chunk-PWPIERBM.js";
-import "./chunk-KQUSP6LB.js";
+import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-BTNNL7ZW.js";
 import "./chunk-JDSVLVCG.js";
@@ -108,7 +108,7 @@ import "./chunk-X4OZMANG.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";
-import "./chunk-LGEH473S.js";
+import "./chunk-CJCTKL6Y.js";
 import "./chunk-R2MBW2S4.js";
 import "./chunk-QUIRIG2P.js";
 import "./chunk-LDPPTPO5.js";

package/dist/who-knows.js

@@ -9,21 +9,21 @@ import {
   loadWhoKnowsEntities,
   tokenizeTopic,
   validateWhoKnowsInput
-} from "./chunk-FUOAIJKQ.js";
-import "./chunk-WAD32CZG.js";
+} from "./chunk-IBDWYRDR.js";
+import "./chunk-CC4V7HNP.js";
 import "./chunk-UHVXE24Y.js";
 import "./chunk-QGVCFVX6.js";
 import "./chunk-IGOW4TJE.js";
+import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-7PMOCQOL.js";
-import "./chunk-LU66I56Q.js";
-import "./chunk-VKDAJJQP.js";
-import "./chunk-OVZIYLBZ.js";
-import "./chunk-EXYT52NR.js";
-import "./chunk-DOJBV6WR.js";
+import "./chunk-KVSOEVAF.js";
+import "./chunk-QEZ3DW5O.js";
 import "./chunk-PFUXPTBT.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
+import "./chunk-OVZIYLBZ.js";
+import "./chunk-EXYT52NR.js";
+import "./chunk-DOJBV6WR.js";
 import "./chunk-WNEVEMJ3.js";
 import "./chunk-Y5NLBXPV.js";
 import "./chunk-TFA6HPOA.js";
@@ -33,23 +33,23 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
-import "./chunk-MRPOZBJC.js";
 import "./chunk-S2HLHAZ4.js";
+import "./chunk-MRPOZBJC.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
-import "./chunk-FF6N7BXC.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-BV2BRHD4.js";
-import "./chunk-ZIKENA2C.js";
-import "./chunk-3ONXXHQO.js";
+import "./chunk-S45INSV3.js";
+import "./chunk-FHGWKODN.js";
 import "./chunk-YXZG5TVN.js";
+import "./chunk-ZIKENA2C.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
+import "./chunk-3ONXXHQO.js";
+import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-3WU7XOFN.js";
 import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
@@ -58,35 +58,35 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
-import "./chunk-7VLBZKNB.js";
-import "./chunk-Y33KJ556.js";
-import "./chunk-WBN66HPI.js";
+import "./chunk-ELHJK7LM.js";
+import "./chunk-IUM3VSHI.js";
 import "./chunk-NWA6IXR3.js";
 import "./chunk-VILPVT4S.js";
 import "./chunk-AF2XMJKD.js";
 import "./chunk-OR42ZI54.js";
-import "./chunk-IUM3VSHI.js";
+import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
-import "./chunk-23G5P7TA.js";
-import "./chunk-4KLQI3L2.js";
 import "./chunk-ZU5JDLOH.js";
 import "./chunk-I55KAVET.js";
 import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
+import "./chunk-7VLBZKNB.js";
+import "./chunk-Y33KJ556.js";
+import "./chunk-UXXK523X.js";
+import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
 import "./chunk-RNFMFC37.js";
 import "./chunk-YCVB7X56.js";
 import "./chunk-PQVCH2AE.js";
-import "./chunk-PJKTFXE2.js";
 import "./chunk-V4XE263I.js";
 import "./chunk-YBA52OKG.js";
-import "./chunk-JRVMCZE3.js";
+import "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-IZJQNDGI.js";
+import "./chunk-R6HMAIKM.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
@@ -98,7 +98,7 @@ import "./chunk-AL3UYZ5N.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-YET735EZ.js";
 import "./chunk-PWPIERBM.js";
-import "./chunk-KQUSP6LB.js";
+import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-BTNNL7ZW.js";
 import "./chunk-JDSVLVCG.js";
@@ -112,7 +112,7 @@ import "./chunk-X4OZMANG.js";
 import "./chunk-ZEFVK7XC.js";
 import "./chunk-6KH5NLQS.js";
 import "./chunk-P2QRMMVQ.js";
-import "./chunk-LGEH473S.js";
+import "./chunk-CJCTKL6Y.js";
 import "./chunk-R2MBW2S4.js";
 import "./chunk-QUIRIG2P.js";
 import "./chunk-LDPPTPO5.js";

package/dist/write-envelope.js

@@ -12,10 +12,10 @@ import {
   isMemoryCategory,
   isSealedMemoryEnvelope,
   sealedWriteToLegacyArgs
-} from "./chunk-JRVMCZE3.js";
+} from "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-IZJQNDGI.js";
-import "./chunk-KQUSP6LB.js";
+import "./chunk-R6HMAIKM.js";
+import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-JDSVLVCG.js";
 import "./chunk-5GKPFL3S.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "10.0.84",
+  "version": "10.0.86",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3386,7 +3386,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^10.0.84"
+    "@remnic/coding-graph": "^10.0.86"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-boundary.ts

@@ -18,6 +18,7 @@
 import { z } from "zod";
 import { EngramAccessInputError, type EngramAccessService } from "./access-service.js";
 import {
+  assertNamespaceAllowed,
   assertOperationAuthorizationAllowed,
   tokenCapabilityStore,
 } from "./access-token-capabilities.js";
@@ -493,6 +494,20 @@ export function defineOperation<In, Out>(spec: OperationSpec<In, Out>): BoundOpe
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
       assertOperationAuthorizationAllowed(tokenCapabilityStore.getStore(), spec);
+      // Post-parse namespace re-check (issue #3225 B1): the transports authorize
+      // the RAW namespace before preprocessing. Re-check the PARSED value so a
+      // namespace that only appears after validation cannot bypass the token
+      // allow-list. Absent namespaces keep the transport check; no default is
+      // invented here.
+      if (operationRequiresAuthorizedNamespace(spec.name)) {
+        // SAFETY: namespace-bearing schemas parse `namespace` as a non-empty
+        // string, an explicit null (transport null-for-absent idiom), or
+        // undefined; falsy spellings mean absent and keep the transport check.
+        const parsedNamespace = (parseResult.data as { namespace?: string | null }).namespace;
+        if (parsedNamespace) {
+          assertNamespaceAllowed(tokenCapabilityStore.getStore(), parsedNamespace);
+        }
+      }
       return spec.handler(parseResult.data, { ...ctx, rawInput });
     },
   };

package/src/access-errors.ts

@@ -35,6 +35,28 @@ export class NamespaceNotWritableError extends EngramAccessInputError {
   }
 }
 
+// ─── Reserved argument keys (issue #3225 B1) ──────────────────────────────
+
+/**
+ * Dictionary keys that change object shape or prototype resolution. A JSON
+ * body can carry them as own members; the request preprocessors reject them
+ * before copying, so a decoded `__proto__` member cannot become an inherited
+ * schema field. Lives in this lowest module so the boundary and wire schema
+ * layers share one implementation without an import cycle.
+ */
+export const RESERVED_PROTO_KEYS: readonly string[] = ["__proto__", "constructor", "prototype"];
+
+/**
+ * Reject the reserved keys with the input-error type, so a client that
+ * submits a magic dictionary key gets a validation error instead of a
+ * silently reshaped request object.
+ */
+export function rejectReservedArgumentKey(key: string): void {
+  if (RESERVED_PROTO_KEYS.includes(key)) {
+    throw new EngramAccessInputError(`${key} is not a permitted argument key`);
+  }
+}
+
 // ─── Levenshtein distance ─────────────────────────────────────────────────
 
 /**