@remnic/core 10.0.85 → 10.0.86

package/dist/{chunk-CMRHXPLQ.js → chunk-YL4UKMD7.js}

@@ -3,28 +3,28 @@ import {
 } from "./chunk-V7IZKJI3.js";
 import {
   AdapterRegistry
-} from "./chunk-G3T6YMBO.js";
+} from "./chunk-64S6X4IU.js";
 import {
   WriteRateLimiter
 } from "./chunk-TB6CBZ5V.js";
 import {
   maybeRespondRecallNavigation
-} from "./chunk-2TGIKMMZ.js";
+} from "./chunk-WXDTOE6F.js";
 import {
   maybeRespondMemoryBrowse
-} from "./chunk-SDESKFKT.js";
+} from "./chunk-UYHDMCY2.js";
 import {
   serializeInlineScriptValue
 } from "./chunk-3HSRWJTC.js";
 import {
   respondDeepRecall
-} from "./chunk-WFDWLWDK.js";
+} from "./chunk-CN7Q3T2J.js";
 import {
   handleSupportPassportOwnerHttp
-} from "./chunk-OMYRPMQC.js";
+} from "./chunk-US7KPQA5.js";
 import {
   buildSupportPassportPublicRequestHandler
-} from "./chunk-BATPQNRG.js";
+} from "./chunk-7GSL4LBG.js";
 import {
   handleMcpGetSse
 } from "./chunk-SRT6SHVZ.js";
@@ -37,10 +37,10 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-XSFQN7TP.js";
+} from "./chunk-IBGU6AN6.js";
 import {
   RelayMissionStoreError
-} from "./chunk-NIV7RPWQ.js";
+} from "./chunk-6BCWFCDG.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -48,7 +48,7 @@ import {
 import {
   handleRecallWhyHttpQuery,
   handleRecallXrayHttpQuery
-} from "./chunk-ZXF3O7P4.js";
+} from "./chunk-ARRTLPRC.js";
 import {
   toDottedRemnicName
 } from "./chunk-ZQUVBZI4.js";
@@ -61,10 +61,10 @@ import {
   optionalNamespaceKindQueryParam,
   optionalQueryString,
   positiveIntQueryParam
-} from "./chunk-4DPLCYEK.js";
+} from "./chunk-C2HORX76.js";
 import {
   respondBriefingHttp
-} from "./chunk-2ASEDFOA.js";
+} from "./chunk-73UZZFJC.js";
 import {
   maybeHandleLifecycleFlush
 } from "./chunk-2BPPGNAQ.js";
@@ -75,14 +75,14 @@ import {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace,
   probeOperationAuthorization
-} from "./chunk-FZPDRCOB.js";
+} from "./chunk-IJ3OEECW.js";
 import {
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-HVFX2N2G.js";
+} from "./chunk-UAUV3BWS.js";
 import {
   handleWhoKnowsHttpQuery
-} from "./chunk-Y43X3E24.js";
+} from "./chunk-IBDWYRDR.js";
 import {
   isTrustZoneName
 } from "./chunk-JWX2Q6HS.js";
@@ -91,7 +91,7 @@ import {
 } from "./chunk-DEUNUKTD.js";
 import {
   BriefingTimeoutError
-} from "./chunk-X2KO4FK5.js";
+} from "./chunk-FNFURZBZ.js";
 import {
   CorrectionContractError
 } from "./chunk-ETSJD5IV.js";
@@ -105,7 +105,7 @@ import {
 } from "./chunk-V4XE263I.js";
 import {
   validateRequest
-} from "./chunk-GYNRNKMW.js";
+} from "./chunk-YMJRLT7S.js";
 import {
   peerManifestRevision
 } from "./chunk-AJHNXIQU.js";
@@ -115,12 +115,12 @@ import {
   enforceNamespaceAllowList,
   isCapabilityRestricted,
   tokenCapabilityStore
-} from "./chunk-YO2JEX2Z.js";
+} from "./chunk-OGBQMY46.js";
 import {
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-CLVILSBR.js";
+} from "./chunk-OZNBZJ3S.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-C5LWPYS3.js";
@@ -133,7 +133,7 @@ import {
 import {
   EngramAccessForbiddenError,
   EngramAccessInputError
-} from "./chunk-LGEH473S.js";
+} from "./chunk-CJCTKL6Y.js";
 import {
   abortError,
   isAbortError
@@ -820,6 +820,11 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
   resourceMetadataUrl;
   externalRequestHandler;
   writeLimiter;
+  // Reservations taken by ensureWriteRateLimitAvailable and not yet committed
+  // by recordWriteRateLimitHit, keyed by request. The per-request release in
+  // the connection callback covers every early return and error path, so a
+  // failed or exempt write never leaks its slot (issue #3225 C4).
+  pendingWriteQuotas = /* @__PURE__ */ new WeakMap();
   mcpServer;
   server = null;
   boundPort = 0;
@@ -933,6 +938,10 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
             });
             return;
           }
+          if (err.name === "ReplayAdmissionRefusedError") {
+            this.respondJson(res, 503, { error: err.message, code: "buffer_admission_refused" });
+            return;
+          }
           if (res.headersSent) {
             res.destroy(err);
             return;
@@ -945,6 +954,7 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
         }).finally(() => {
           req.off("aborted", abortDisconnectedRequest);
           res.off("close", abortDisconnectedRequest);
+          this.releasePendingWriteQuota(req);
         });
       });
     });
@@ -2640,63 +2650,76 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/peers") {
-      this.enforceTokenOp("peer_list");
-      const result = await this.service.peerList();
-      this.respondJson(res, 200, result);
+      const op = getOperation("peer_list");
+      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_list");
+      const output = await op.run({}, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        sourceConnector: this.resolveConnector(req)
+      });
+      this.respondJson(res, 200, output.result);
       return;
     }
     const peerProfileMatch = /^\/engram\/v1\/peers\/([^/]+)\/profile$/.exec(pathname);
     if (peerProfileMatch) {
-      this.enforceTokenOp("peer_profile_get");
       if (req.method !== "GET") {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      const op = getOperation("peer_profile_get");
+      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_profile_get");
       const peerId = decodePeerIdSegment(peerProfileMatch[1] ?? "");
-      const result = await this.service.peerProfileGet(peerId);
-      if (!result.found) {
+      const output = await op.run({ id: peerId }, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        sourceConnector: this.resolveConnector(req)
+      });
+      if (!output.result.found) {
         this.respondJson(res, 404, { error: "peer_profile_not_found", code: "peer_profile_not_found" });
         return;
       }
-      this.respondJson(res, 200, result);
+      this.respondJson(res, 200, output.result);
       return;
     }
     const peerIdMatch = /^\/engram\/v1\/peers\/([^/]+)$/.exec(pathname);
     if (peerIdMatch) {
       const peerId = decodePeerIdSegment(peerIdMatch[1] ?? "");
       if (req.method === "GET") {
-        this.enforceTokenOp("peer_get");
-        const result = await this.service.peerGet(peerId);
-        if (!result.found) {
+        const op = getOperation("peer_get");
+        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_get");
+        const output = await op.run({ id: peerId }, {
+          service: this.service,
+          authenticatedPrincipal: this.resolveRequestPrincipal(req),
+          sourceConnector: this.resolveConnector(req)
+        });
+        if (!output.result.found) {
           this.respondJson(res, 404, { error: "peer_not_found", code: "peer_not_found" });
           return;
         }
-        this.respondJson(res, 200, result);
+        this.respondJson(res, 200, output.result);
         return;
       }
       if (req.method === "PUT") {
-        this.enforceTokenOp("peer_set");
         const body = await this.readJsonBody(req);
-        if ("kind" in body && body.kind !== void 0 && typeof body.kind !== "string") {
-          throw new EngramAccessInputError("kind must be a string when provided");
-        }
-        if ("displayName" in body && body.displayName !== void 0 && typeof body.displayName !== "string") {
-          throw new EngramAccessInputError("displayName must be a string when provided");
-        }
-        if ("notes" in body && body.notes !== void 0 && typeof body.notes !== "string") {
-          throw new EngramAccessInputError("notes must be a string when provided");
+        const op = getOperation("peer_set");
+        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_set");
+        for (const field of ["kind", "displayName", "notes"]) {
+          if (body[field] === null) throw new EngramAccessInputError(`${field} must be a string when provided`);
         }
-        const result = await this.service.peerSet({
+        const output = await op.run({
           id: peerId,
-          kind: typeof body.kind === "string" ? body.kind : void 0,
-          displayName: typeof body.displayName === "string" ? body.displayName : void 0,
-          notes: typeof body.notes === "string" ? body.notes : void 0
+          kind: body.kind,
+          displayName: body.displayName,
+          notes: body.notes
+        }, {
+          service: this.service,
+          authenticatedPrincipal: this.resolveRequestPrincipal(req),
+          sourceConnector: this.resolveConnector(req)
         });
-        this.respondJson(res, result.created ? 201 : 200, result);
+        this.respondJson(res, output.result.created ? 201 : 200, output.result);
         return;
       }
       if (req.method === "DELETE") {
-        this.enforceTokenOp("peer_delete");
         const forgetParam = parsed.searchParams.get("forget");
         if (forgetParam === "true") {
           const body = await this.readJsonBody(req);
@@ -2709,12 +2732,24 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
             });
             return;
           }
-          const result2 = await this.service.peerForget(peerId, { confirm: "yes" });
-          this.respondJson(res, 200, result2);
+          const op2 = getOperation("peer_forget");
+          if (!op2) throw new EngramAccessInputError("access-boundary: operation not registered: peer_forget");
+          const output2 = await op2.run({ id: peerId, confirm: "yes" }, {
+            service: this.service,
+            authenticatedPrincipal: this.resolveRequestPrincipal(req),
+            sourceConnector: this.resolveConnector(req)
+          });
+          this.respondJson(res, 200, output2.result);
           return;
         }
-        const result = await this.service.peerDelete(peerId);
-        this.respondJson(res, 200, result);
+        const op = getOperation("peer_delete");
+        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_delete");
+        const output = await op.run({ id: peerId }, {
+          service: this.service,
+          authenticatedPrincipal: this.resolveRequestPrincipal(req),
+          sourceConnector: this.resolveConnector(req)
+        });
+        this.respondJson(res, 200, output.result);
         return;
       }
       this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
@@ -3540,14 +3575,45 @@ var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
     if (response.status === "stored" || response.status === "queued_for_review") return 201;
     return 200;
   }
+  /**
+   * Admit a quota-counted write by RESERVING a limiter slot for the request
+   * (issue #3225 C4). A bare hasCapacity check admits N concurrent requests
+   * against the same committed count; the reservation holds in-flight
+   * capacity until the write commits at recordWriteRateLimitHit or the
+   * request ends. Idempotent per request, so a quota hook that fires after
+   * an earlier reservation is a no-op.
+   */
   ensureWriteRateLimitAvailable(req) {
-    if (!this.writeLimiter.hasCapacity(this.principalForRateLimit(req))) {
+    if (!req) {
+      if (!this.writeLimiter.hasCapacity()) {
+        throw new HttpError(429, "write_rate_limited", "write_rate_limited");
+      }
+      return;
+    }
+    if (this.pendingWriteQuotas.has(req)) return;
+    const reservation = this.writeLimiter.reserve(this.principalForRateLimit(req));
+    if (!reservation) {
       throw new HttpError(429, "write_rate_limited", "write_rate_limited");
     }
+    this.pendingWriteQuotas.set(req, reservation);
   }
+  /** Commit a counted write at the durable boundary; consumes the request's reservation. */
   recordWriteRateLimitHit(req) {
+    const pending = req ? this.pendingWriteQuotas.get(req) : void 0;
+    if (pending && req) {
+      this.pendingWriteQuotas.delete(req);
+      pending.commit();
+      return;
+    }
     this.writeLimiter.record(this.principalForRateLimit(req));
   }
+  /** Release an uncommitted reservation after a rejection, failure, or exempt outcome. */
+  releasePendingWriteQuota(req) {
+    const pending = this.pendingWriteQuotas.get(req);
+    if (!pending) return;
+    this.pendingWriteQuotas.delete(req);
+    pending.release();
+  }
   reserveWriteRateLimitSlot(req) {
     const reservation = this.writeLimiter.reserve(this.principalForRateLimit(req));
     if (!reservation) {
@@ -3573,4 +3639,4 @@ export {
   resolveDefaultAdminConsolePublicDir,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-CMRHXPLQ.js.map
+//# sourceMappingURL=chunk-YL4UKMD7.js.map