@remnic/core 10.0.90 → 10.0.91

package/dist/access-http-query.js

@@ -3,29 +3,29 @@ import {
   optionalNamespaceKindQueryParam,
   optionalQueryString,
   positiveIntQueryParam
-} from "./chunk-C2HORX76.js";
-import "./chunk-HLN2HOXX.js";
-import "./chunk-ATWFYXEN.js";
+} from "./chunk-27XYV2XL.js";
+import "./chunk-PUEO37QG.js";
+import "./chunk-STSLB4HT.js";
 import "./chunk-W4F3C7N7.js";
 import "./chunk-MPC7TYTZ.js";
-import "./chunk-G67EUQAB.js";
+import "./chunk-TG3R2SID.js";
 import "./chunk-QV2VZKD5.js";
 import "./chunk-IFBSZGW3.js";
-import "./chunk-TFEHSPGQ.js";
-import "./chunk-VQ7B2Q6M.js";
 import "./chunk-OGXXGHW6.js";
-import "./chunk-IBDWYRDR.js";
+import "./chunk-E5PPE4VA.js";
+import "./chunk-VQ7B2Q6M.js";
+import "./chunk-JBCCWVU2.js";
 import "./chunk-BANSBRNX.js";
 import "./chunk-GNVZQ5JN.js";
 import "./chunk-YN2UN7N3.js";
 import "./chunk-JWX2Q6HS.js";
-import "./chunk-3UZ2VMKD.js";
+import "./chunk-E6M225BJ.js";
 import "./chunk-HNOSWPKG.js";
 import "./chunk-WWDO7ZWM.js";
 import "./chunk-45VUHDV2.js";
 import "./chunk-5Y43VGYB.js";
+import "./chunk-RGUUBAT5.js";
 import "./chunk-MUHGYV2V.js";
-import "./chunk-NQP4ZYGG.js";
 import "./chunk-5HFVWYHL.js";
 import "./chunk-KIW3OOZE.js";
 import "./chunk-YE4JBZO5.js";
@@ -37,56 +37,56 @@ import "./chunk-H7XKCNR6.js";
 import "./chunk-EWJZZDRG.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-7O2MC42R.js";
-import "./chunk-YRZPBN46.js";
+import "./chunk-VNUOAXWP.js";
+import "./chunk-IQMDQJCD.js";
 import "./chunk-7IWRLYFJ.js";
-import "./chunk-ZANNIXXE.js";
-import "./chunk-IISBCCWR.js";
 import "./chunk-UD7UNYRD.js";
-import "./chunk-TSS3D7ZY.js";
-import "./chunk-QKERFEJS.js";
+import "./chunk-IISBCCWR.js";
+import "./chunk-4CJTQHEG.js";
+import "./chunk-EFYN5I7Z.js";
 import "./chunk-2YA5N2BY.js";
-import "./chunk-YLTU2DC4.js";
-import "./chunk-3PJEDHLD.js";
+import "./chunk-63O7LVMN.js";
 import "./chunk-HUDPXTXW.js";
 import "./chunk-AZEZSQ5R.js";
+import "./chunk-IHCXMYSE.js";
 import "./chunk-EI6V5UXY.js";
-import "./chunk-PDOOUXCS.js";
-import "./chunk-YAVIBVCU.js";
+import "./chunk-PPCLZ4JU.js";
+import "./chunk-UA2NDTIU.js";
 import "./chunk-6XTUZKCZ.js";
 import "./chunk-DOWACHYO.js";
 import "./chunk-QNUNAXBE.js";
 import "./chunk-LTHVM4XN.js";
-import "./chunk-MTTYIXSU.js";
+import "./chunk-RRTVGD3J.js";
 import "./chunk-C37ZRXX7.js";
 import "./chunk-NVKO5YKP.js";
 import "./chunk-ZGFLIK5H.js";
 import "./chunk-RF2SMMPP.js";
 import "./chunk-3X5OPDPF.js";
-import "./chunk-HXFIILGF.js";
+import "./chunk-BFPF5N3H.js";
+import "./chunk-HRATODNO.js";
 import "./chunk-WTWQA7BB.js";
 import "./chunk-VZIAVM72.js";
-import "./chunk-HRATODNO.js";
-import "./chunk-D5EV6Y2L.js";
-import "./chunk-2U4LMSEX.js";
-import "./chunk-G54BOKZ6.js";
+import "./chunk-ZT6WPSII.js";
+import "./chunk-FRSHF6FU.js";
+import "./chunk-3XIWW4TB.js";
 import "./chunk-UFGFMWAD.js";
 import "./chunk-LXATZLSC.js";
-import "./chunk-JM2YZKCQ.js";
-import "./chunk-ROKDHO74.js";
+import "./chunk-LJQFJF4J.js";
+import "./chunk-BMWMTAQF.js";
 import "./chunk-3UXOZBHV.js";
-import "./chunk-J6GZ2254.js";
-import "./chunk-DC55RIEZ.js";
+import "./chunk-AL3TCNSJ.js";
+import "./chunk-M4IEZGCK.js";
 import "./chunk-QGJSBU4R.js";
+import "./chunk-GKCXTSFF.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-LXY5VVGM.js";
-import "./chunk-GKCXTSFF.js";
-import "./chunk-BIVKPQ6Q.js";
-import "./chunk-2K3AUDH7.js";
+import "./chunk-AP6NCP3V.js";
+import "./chunk-YYOMGOHB.js";
 import "./chunk-CSAKJVXW.js";
 import "./chunk-K2XUWZBM.js";
 import "./chunk-OD4FM2U7.js";
-import "./chunk-2G4TV2ML.js";
+import "./chunk-IPT2OY4B.js";
 import "./chunk-T6OZW2WR.js";
 import "./chunk-MJFL75J6.js";
 import "./chunk-QEDLJDHP.js";
@@ -94,10 +94,13 @@ import "./chunk-U4LUIE6Y.js";
 import "./chunk-5YQXWVCP.js";
 import "./chunk-FKBGK3NC.js";
 import "./chunk-ZY2MNJR6.js";
-import "./chunk-CYCEROPR.js";
+import "./chunk-6QMWECO5.js";
+import "./chunk-EKUI7I2X.js";
+import "./chunk-KF7PQ7G2.js";
+import "./chunk-TBBDFYXW.js";
 import "./chunk-FNFURZBZ.js";
 import "./chunk-GZFKCLRC.js";
-import "./chunk-EKUI7I2X.js";
+import "./chunk-TOTT6S2V.js";
 import "./chunk-ETSJD5IV.js";
 import "./chunk-FEHIOYML.js";
 import "./chunk-P32IDSHD.js";
@@ -112,23 +115,23 @@ import "./chunk-IEEV27BC.js";
 import "./chunk-236PXYG7.js";
 import "./chunk-ZCUTSMR2.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-ZOJUWVAU.js";
+import "./chunk-GKL6QYZO.js";
 import "./chunk-ZJP66Q4I.js";
-import "./chunk-CC4V7HNP.js";
-import "./chunk-UHVXE24Y.js";
+import "./chunk-WWK6J6SE.js";
 import "./chunk-QGVCFVX6.js";
+import "./chunk-UHVXE24Y.js";
 import "./chunk-IGOW4TJE.js";
 import "./chunk-NT7F7WJQ.js";
 import "./chunk-G6OFEGUR.js";
-import "./chunk-KVSOEVAF.js";
-import "./chunk-QEZ3DW5O.js";
+import "./chunk-UE6RRXMF.js";
+import "./chunk-65AUYLU3.js";
+import "./chunk-DOJBV6WR.js";
 import "./chunk-PFUXPTBT.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-DLZGSZVC.js";
 import "./chunk-OVZIYLBZ.js";
-import "./chunk-EXYT52NR.js";
-import "./chunk-DOJBV6WR.js";
 import "./chunk-WNEVEMJ3.js";
+import "./chunk-EXYT52NR.js";
 import "./chunk-Y5NLBXPV.js";
 import "./chunk-TFA6HPOA.js";
 import "./chunk-F4TWWUMP.js";
@@ -137,16 +140,16 @@ import "./chunk-A7Q43EUZ.js";
 import "./chunk-S2V7RUCL.js";
 import "./chunk-PPUNC7UX.js";
 import "./chunk-X3724WL4.js";
-import "./chunk-S2HLHAZ4.js";
 import "./chunk-MRPOZBJC.js";
+import "./chunk-S2HLHAZ4.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
+import "./chunk-FF6N7BXC.js";
 import "./chunk-QFEDITXM.js";
 import "./chunk-AAD2ZS6P.js";
-import "./chunk-S45INSV3.js";
 import "./chunk-FHGWKODN.js";
-import "./chunk-YXZG5TVN.js";
 import "./chunk-ZIKENA2C.js";
+import "./chunk-YXZG5TVN.js";
 import "./chunk-3OUGSOJP.js";
 import "./chunk-SCU65EZI.js";
 import "./chunk-3ONXXHQO.js";
@@ -154,7 +157,6 @@ import "./chunk-3WU7XOFN.js";
 import "./chunk-P4GUQSK3.js";
 import "./chunk-4LZ7SVKM.js";
 import "./chunk-YHTG64XV.js";
-import "./chunk-G7D6GZ5J.js";
 import "./chunk-ER7XANP3.js";
 import "./chunk-M5GVCJSJ.js";
 import "./chunk-RBOJCG4T.js";
@@ -162,12 +164,15 @@ import "./chunk-IAYUTGF2.js";
 import "./chunk-5WITETWU.js";
 import "./chunk-6CIAGZ6X.js";
 import "./chunk-7CT3AI52.js";
-import "./chunk-ELHJK7LM.js";
-import "./chunk-IUM3VSHI.js";
+import "./chunk-G7D6GZ5J.js";
+import "./chunk-7VLBZKNB.js";
+import "./chunk-Y33KJ556.js";
+import "./chunk-5IYOKDM4.js";
 import "./chunk-NWA6IXR3.js";
+import "./chunk-OR42ZI54.js";
+import "./chunk-IUM3VSHI.js";
 import "./chunk-VILPVT4S.js";
 import "./chunk-AF2XMJKD.js";
-import "./chunk-OR42ZI54.js";
 import "./chunk-23G5P7TA.js";
 import "./chunk-C64XATK7.js";
 import "./chunk-42JKGUFJ.js";
@@ -177,45 +182,61 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-45GF7Y3V.js";
 import "./chunk-ZU3NJNO7.js";
 import "./chunk-E2AWJ7KQ.js";
-import "./chunk-7VLBZKNB.js";
-import "./chunk-Y33KJ556.js";
 import "./chunk-UXXK523X.js";
+import "./chunk-YCVB7X56.js";
+import "./chunk-PQVCH2AE.js";
 import "./chunk-PJKTFXE2.js";
 import "./chunk-W5BIQOAJ.js";
 import "./chunk-HADD45AR.js";
 import "./chunk-RNFMFC37.js";
 import "./chunk-C5C7IJ4Q.js";
-import "./chunk-KF7PQ7G2.js";
-import "./chunk-TBBDFYXW.js";
-import "./chunk-YCVB7X56.js";
 import "./chunk-RMMA44HE.js";
 import "./chunk-SYOIVK7K.js";
-import "./chunk-TOTT6S2V.js";
-import "./chunk-PQVCH2AE.js";
+import "./chunk-MKRYQROF.js";
+import "./chunk-2LCRG2YV.js";
+import "./chunk-JDY34KBL.js";
+import "./chunk-E6Z4FBX6.js";
+import "./chunk-I6QGI65T.js";
+import "./chunk-7EPY3IQL.js";
+import "./chunk-EHHQJTAU.js";
+import "./chunk-L272A5QW.js";
+import "./chunk-BNZAR6PO.js";
+import "./chunk-ZA53AZND.js";
+import "./chunk-7RJUVTVF.js";
+import "./chunk-AL3UYZ5N.js";
+import "./chunk-RL6NEVXT.js";
+import "./chunk-YET735EZ.js";
+import "./chunk-OGBQMY46.js";
 import "./chunk-YVRQ5JRA.js";
-import "./chunk-4Q26RNSR.js";
-import "./chunk-P4JED3ZL.js";
+import "./chunk-CD4BCCNP.js";
+import "./chunk-RMXS4I66.js";
 import "./chunk-CTVWELNK.js";
 import "./chunk-V4XE263I.js";
 import "./chunk-YBA52OKG.js";
+import "./chunk-YCNIGRRF.js";
+import "./chunk-B3GKQ6DU.js";
+import "./chunk-ESG6ITGP.js";
+import "./chunk-PCXDUHQH.js";
+import "./chunk-VUFL7X3H.js";
 import "./chunk-CYTTY4M2.js";
 import "./chunk-L3E7MLMK.js";
 import "./chunk-QCFZDYYG.js";
 import "./chunk-Z64TS5V4.js";
 import "./chunk-AQEJKOKI.js";
 import "./chunk-4RNBLLZR.js";
+import "./chunk-C5LWPYS3.js";
 import "./chunk-WZU5AGO6.js";
 import "./chunk-YLXETSAH.js";
-import "./chunk-4XYAWK5H.js";
+import "./chunk-25BUV3TU.js";
 import "./chunk-ANZZLRUX.js";
 import "./chunk-353C5UNV.js";
 import "./chunk-QEYTRFR3.js";
 import "./chunk-BT7NVCML.js";
 import "./chunk-R6HMAIKM.js";
-import "./chunk-YMJRLT7S.js";
-import "./chunk-7LCGFUMB.js";
-import "./chunk-X7Y7WX73.js";
+import "./chunk-R2DOFBG4.js";
+import "./chunk-KQAFEZQX.js";
 import "./chunk-WEHSQBFR.js";
+import "./chunk-X7Y7WX73.js";
 import "./chunk-J4EB7DNW.js";
 import "./chunk-BJMBJZ2Y.js";
 import "./chunk-UKJAGEXH.js";
@@ -223,48 +244,27 @@ import "./chunk-FP2373TW.js";
 import "./chunk-Z2YFLXHU.js";
 import "./chunk-I4WBNM3M.js";
 import "./chunk-SOAU2OE2.js";
-import "./chunk-UWRHHRDK.js";
-import "./chunk-AJHNXIQU.js";
-import "./chunk-QUMKDRCF.js";
-import "./chunk-TIGYOZBU.js";
-import "./chunk-I6QGI65T.js";
-import "./chunk-7EPY3IQL.js";
-import "./chunk-EHHQJTAU.js";
-import "./chunk-L272A5QW.js";
-import "./chunk-BNZAR6PO.js";
-import "./chunk-ZA53AZND.js";
-import "./chunk-7RJUVTVF.js";
-import "./chunk-AL3UYZ5N.js";
-import "./chunk-RL6NEVXT.js";
-import "./chunk-YET735EZ.js";
-import "./chunk-OGBQMY46.js";
-import "./chunk-PWPIERBM.js";
 import "./chunk-UDKWFDV2.js";
 import "./chunk-5FVVY2EB.js";
 import "./chunk-BTNNL7ZW.js";
-import "./chunk-JDSVLVCG.js";
-import "./chunk-5GKPFL3S.js";
-import "./chunk-JAKIDQB2.js";
-import "./chunk-OZNBZJ3S.js";
+import "./chunk-SLDRXK37.js";
 import "./chunk-UI3NYK34.js";
 import "./chunk-XXR4A33N.js";
-import "./chunk-3DAWHP5K.js";
-import "./chunk-TAUHAP5J.js";
+import "./chunk-NZSRRVJQ.js";
+import "./chunk-UXPXOVJI.js";
+import "./chunk-LDWE7OZS.js";
 import "./chunk-63LFM77Z.js";
 import "./chunk-UWMZT2TY.js";
 import "./chunk-GCGJW34D.js";
-import "./chunk-LDWE7OZS.js";
-import "./chunk-XZ66U5M3.js";
 import "./chunk-SWRRZNHM.js";
+import "./chunk-XZ66U5M3.js";
 import "./chunk-JNA7LFMQ.js";
 import "./chunk-LQWOFU6L.js";
 import "./chunk-EBV6VXKF.js";
+import "./chunk-JDSVLVCG.js";
+import "./chunk-5GKPFL3S.js";
+import "./chunk-JAKIDQB2.js";
 import "./chunk-P7FMDTKL.js";
-import "./chunk-B3GKQ6DU.js";
-import "./chunk-ESG6ITGP.js";
-import "./chunk-PCXDUHQH.js";
-import "./chunk-VUFL7X3H.js";
-import "./chunk-C5LWPYS3.js";
 import "./chunk-F5GVIPC7.js";
 import "./chunk-X4OZMANG.js";
 import "./chunk-NGHDW6UU.js";

package/dist/access-http-types.d.ts

@@ -0,0 +1,145 @@
+import type { AdapterRegistry } from "./adapters/index.js";
+import type { EngramAccessService } from "./access-service.js";
+import type { TokenCapabilities } from "./access-token-capabilities.js";
+import type { SupportPassportExternalRequestHandler } from "./support-passport/public-http.js";
+/** Public option, status and admin-control types for the access HTTP server (split out of access-http.ts for the file-size ratchet, #1995). */
+export interface AccessHttpReadinessState {
+    ready: boolean;
+    warmupAttempts: number;
+    lastError?: string | null;
+    /**
+     * True when the standalone init gate opened before search warm-up completed
+     * (issue #2215): the service is functional (recall serves via fallback
+     * retrieval), so health answers 200 with degraded info instead of 503.
+     */
+    degraded?: boolean;
+}
+export interface EngramAccessHttpServerOptions {
+    service: EngramAccessService;
+    host?: string;
+    port?: number;
+    authToken?: string;
+    /** Additional valid tokens (for multi-connector auth). Checked alongside authToken. */
+    authTokens?: string[];
+    /** Dynamic token loader — called on each auth check so new/revoked tokens take effect without restart. */
+    authTokensGetter?: () => string[];
+    /**
+     * Dynamic token-ENTRY loader ({token, connector} pairs from one coherent
+     * snapshot). Preferred over `authTokensGetter` when a `tokenPathPolicy`
+     * is set: the connector used for the policy decision comes from the SAME
+     * entry that validated, so identity can never lag validation.
+     */
+    authTokenEntriesGetter?: () => ReadonlyArray<{
+        token: string;
+        connector?: string;
+        capabilities?: TokenCapabilities;
+    }>;
+    /**
+     * Optional per-request scope policy for tokens sourced from
+     * `authTokenEntriesGetter`. Return false to deny the (validated) token
+     * for this pathname. Static `authToken`/`authTokens` (operator-supplied)
+     * bypass the policy. Entries whose connector is missing FAIL CLOSED when
+     * a policy is configured.
+     */
+    tokenPathPolicy?: (connector: string, pathname: string | undefined) => boolean;
+    principal?: string;
+    maxBodyBytes?: number;
+    /**
+     * Max non-replayed write requests per rolling window before 429
+     * `write_rate_limited` (issue #1937). Positive integer; defaults to 30.
+     */
+    writeRateLimitMaxRequests?: number;
+    /** Rolling window for the write rate limit, in ms. Positive integer; defaults to 60000. */
+    writeRateLimitWindowMs?: number;
+    adminConsoleEnabled?: boolean;
+    adminConsolePublicDir?: string;
+    /** Inject the primary auth token into the admin console shell for trusted launch surfaces. */
+    adminConsolePrefillToken?: boolean;
+    trustPrincipalHeader?: boolean;
+    /** Enable adapter-based identity resolution from request headers */
+    enableAdapters?: boolean;
+    /** Custom adapter registry (defaults to built-in adapters) */
+    adapterRegistry?: AdapterRegistry;
+    /** Enable oai-mem-citation blocks in recall responses (issue #379). */
+    citationsEnabled?: boolean;
+    /** Auto-enable citations for Codex adapter connections (issue #379). */
+    citationsAutoDetect?: boolean;
+    /** Advertise legacy engram.* tool aliases on tools/list (issue #1427). Default true. */
+    emitLegacyTools?: boolean;
+    /** Optional authenticated admin dashboard/config controls supplied by the host server. */
+    adminControls?: RemnicAdminControls;
+    /**
+     * Standalone readiness state. Defaults to ready so embedded hosts keep their
+     * existing health behavior.
+     */
+    readiness?: () => AccessHttpReadinessState;
+    /**
+     * When set, every 401 response includes
+     * `WWW-Authenticate: Bearer resource_metadata="<value>"` so MCP clients
+     * can discover the OAuth 2.0 protected-resource metadata document
+     * (RFC 9728). Must be an absolute http(s) URL; constructor throws on
+     * anything else. Unset → bare `Bearer`.
+     */
+    resourceMetadataUrl?: string;
+    /**
+     * Optional pre-auth request handler (e.g. OAuth facade mounted by
+     * `@remnic/server`). Runs after the admin-console handler and BEFORE
+     * bearer authorization. Return true if the request was fully handled
+     * (response ended). `ctx.authorized` reports whether the request
+     * carries a valid operator bearer token, so the handler can gate
+     * operator-only endpoints without owning token validation.
+     * Errors thrown by the handler flow into the existing error handling.
+     */
+    externalRequestHandler?: SupportPassportExternalRequestHandler;
+}
+export interface EngramAccessHttpServerStatus {
+    running: boolean;
+    host: string;
+    port: number;
+    maxBodyBytes: number;
+}
+export interface RemnicAdminHarnessStatus {
+    id: string;
+    label: string;
+    detected: boolean;
+    enabled: boolean;
+    source?: string;
+    detail?: string;
+}
+export interface RemnicAdminModelOption {
+    id: string;
+    label: string;
+    provider: string;
+    detected: boolean;
+    enabled: boolean;
+    default?: boolean;
+    source?: string;
+    endpoint?: string;
+}
+export interface RemnicAdminFeatureStatus {
+    key: string;
+    label: string;
+    enabled: boolean;
+    writable: boolean;
+    restartRequired?: boolean;
+}
+export interface RemnicAdminConfigStatus {
+    path: string;
+    exists: boolean;
+    writable: boolean;
+    restartRequired: boolean;
+    values: Record<string, string | number | boolean | null>;
+}
+export interface RemnicAdminDashboardStatus {
+    config: RemnicAdminConfigStatus;
+    harnesses: RemnicAdminHarnessStatus[];
+    providers?: RemnicAdminHarnessStatus[];
+    models: RemnicAdminModelOption[];
+    features: RemnicAdminFeatureStatus[];
+}
+export type RemnicAdminConfigPatch = Record<string, unknown>;
+export interface RemnicAdminControls {
+    status: () => Promise<RemnicAdminDashboardStatus>;
+    update?: (patch: RemnicAdminConfigPatch) => Promise<RemnicAdminDashboardStatus>;
+}
+//# sourceMappingURL=access-http-types.d.ts.map

package/dist/access-http-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-http-types.d.ts","sourceRoot":"","sources":["../src/access-http-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,mCAAmC,CAAC;AAE/F,+IAA+I;AAE/I,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AACD,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,mBAAmB,CAAC;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAClC;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,aAAa,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,iBAAiB,CAAA;KAAE,CAAC,CAAC;IACtH;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,2FAA2F;IAC3F,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8FAA8F;IAC9F,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,oEAAoE;IACpE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,8DAA8D;IAC9D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wEAAwE;IACxE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,wFAAwF;IACxF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,0FAA0F;IAC1F,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,wBAAwB,CAAC;IAC3C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,qCAAqC,CAAC;CAChE;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,EAAE,wBAAwB,EAAE,CAAC;IACtC,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAKD,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACjF"}

package/dist/access-http-types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=access-http-types.js.map

package/dist/access-http.d.ts

@@ -1,151 +1,12 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
 import { type WriteRateLimitReservation } from "./write-rate-limiter.js";
 import { type EngramAccessService } from "./access-service.js";
-import { AdapterRegistry, type ResolvedIdentity } from "./adapters/index.js";
+import { type ResolvedIdentity } from "./adapters/index.js";
 import { type OperationName } from "./access-boundary.js";
-import { type TokenCapabilities } from "./access-token-capabilities.js";
 import "./access-operations.js";
 import { ReviewDeckAccessHttpBase } from "./review/review-deck-http-base.js";
-import type { SupportPassportExternalRequestHandler } from "./support-passport/public-http.js";
-export interface AccessHttpReadinessState {
-    ready: boolean;
-    warmupAttempts: number;
-    lastError?: string | null;
-    /**
-     * True when the standalone init gate opened before search warm-up completed
-     * (issue #2215): the service is functional (recall serves via fallback
-     * retrieval), so health answers 200 with degraded info instead of 503.
-     */
-    degraded?: boolean;
-}
-export interface EngramAccessHttpServerOptions {
-    service: EngramAccessService;
-    host?: string;
-    port?: number;
-    authToken?: string;
-    /** Additional valid tokens (for multi-connector auth). Checked alongside authToken. */
-    authTokens?: string[];
-    /** Dynamic token loader — called on each auth check so new/revoked tokens take effect without restart. */
-    authTokensGetter?: () => string[];
-    /**
-     * Dynamic token-ENTRY loader ({token, connector} pairs from one coherent
-     * snapshot). Preferred over `authTokensGetter` when a `tokenPathPolicy`
-     * is set: the connector used for the policy decision comes from the SAME
-     * entry that validated, so identity can never lag validation.
-     */
-    authTokenEntriesGetter?: () => ReadonlyArray<{
-        token: string;
-        connector?: string;
-        capabilities?: TokenCapabilities;
-    }>;
-    /**
-     * Optional per-request scope policy for tokens sourced from
-     * `authTokenEntriesGetter`. Return false to deny the (validated) token
-     * for this pathname. Static `authToken`/`authTokens` (operator-supplied)
-     * bypass the policy. Entries whose connector is missing FAIL CLOSED when
-     * a policy is configured.
-     */
-    tokenPathPolicy?: (connector: string, pathname: string | undefined) => boolean;
-    principal?: string;
-    maxBodyBytes?: number;
-    /**
-     * Max non-replayed write requests per rolling window before 429
-     * `write_rate_limited` (issue #1937). Positive integer; defaults to 30.
-     */
-    writeRateLimitMaxRequests?: number;
-    /** Rolling window for the write rate limit, in ms. Positive integer; defaults to 60000. */
-    writeRateLimitWindowMs?: number;
-    adminConsoleEnabled?: boolean;
-    adminConsolePublicDir?: string;
-    /** Inject the primary auth token into the admin console shell for trusted launch surfaces. */
-    adminConsolePrefillToken?: boolean;
-    trustPrincipalHeader?: boolean;
-    /** Enable adapter-based identity resolution from request headers */
-    enableAdapters?: boolean;
-    /** Custom adapter registry (defaults to built-in adapters) */
-    adapterRegistry?: AdapterRegistry;
-    /** Enable oai-mem-citation blocks in recall responses (issue #379). */
-    citationsEnabled?: boolean;
-    /** Auto-enable citations for Codex adapter connections (issue #379). */
-    citationsAutoDetect?: boolean;
-    /** Advertise legacy engram.* tool aliases on tools/list (issue #1427). Default true. */
-    emitLegacyTools?: boolean;
-    /** Optional authenticated admin dashboard/config controls supplied by the host server. */
-    adminControls?: RemnicAdminControls;
-    /**
-     * Standalone readiness state. Defaults to ready so embedded hosts keep their
-     * existing health behavior.
-     */
-    readiness?: () => AccessHttpReadinessState;
-    /**
-     * When set, every 401 response includes
-     * `WWW-Authenticate: Bearer resource_metadata="<value>"` so MCP clients
-     * can discover the OAuth 2.0 protected-resource metadata document
-     * (RFC 9728). Must be an absolute http(s) URL; constructor throws on
-     * anything else. Unset → bare `Bearer`.
-     */
-    resourceMetadataUrl?: string;
-    /**
-     * Optional pre-auth request handler (e.g. OAuth facade mounted by
-     * `@remnic/server`). Runs after the admin-console handler and BEFORE
-     * bearer authorization. Return true if the request was fully handled
-     * (response ended). `ctx.authorized` reports whether the request
-     * carries a valid operator bearer token, so the handler can gate
-     * operator-only endpoints without owning token validation.
-     * Errors thrown by the handler flow into the existing error handling.
-     */
-    externalRequestHandler?: SupportPassportExternalRequestHandler;
-}
-export interface EngramAccessHttpServerStatus {
-    running: boolean;
-    host: string;
-    port: number;
-    maxBodyBytes: number;
-}
-export interface RemnicAdminHarnessStatus {
-    id: string;
-    label: string;
-    detected: boolean;
-    enabled: boolean;
-    source?: string;
-    detail?: string;
-}
-export interface RemnicAdminModelOption {
-    id: string;
-    label: string;
-    provider: string;
-    detected: boolean;
-    enabled: boolean;
-    default?: boolean;
-    source?: string;
-    endpoint?: string;
-}
-export interface RemnicAdminFeatureStatus {
-    key: string;
-    label: string;
-    enabled: boolean;
-    writable: boolean;
-    restartRequired?: boolean;
-}
-export interface RemnicAdminConfigStatus {
-    path: string;
-    exists: boolean;
-    writable: boolean;
-    restartRequired: boolean;
-    values: Record<string, string | number | boolean | null>;
-}
-export interface RemnicAdminDashboardStatus {
-    config: RemnicAdminConfigStatus;
-    harnesses: RemnicAdminHarnessStatus[];
-    providers?: RemnicAdminHarnessStatus[];
-    models: RemnicAdminModelOption[];
-    features: RemnicAdminFeatureStatus[];
-}
-export type RemnicAdminConfigPatch = Record<string, unknown>;
-export interface RemnicAdminControls {
-    status: () => Promise<RemnicAdminDashboardStatus>;
-    update?: (patch: RemnicAdminConfigPatch) => Promise<RemnicAdminDashboardStatus>;
-}
+import type { EngramAccessHttpServerOptions, EngramAccessHttpServerStatus } from "./access-http-types.js";
+export type { AccessHttpReadinessState, EngramAccessHttpServerOptions, EngramAccessHttpServerStatus, RemnicAdminHarnessStatus, RemnicAdminModelOption, RemnicAdminFeatureStatus, RemnicAdminConfigStatus, RemnicAdminDashboardStatus, RemnicAdminConfigPatch, RemnicAdminControls, } from "./access-http-types.js";
 export declare function resolveDefaultAdminConsolePublicDir(sourceUrl?: string): string;
 export declare class EngramAccessHttpServer extends ReviewDeckAccessHttpBase {
     protected readonly service: EngramAccessService;