@remnic/core 10.0.92 → 10.0.94

package/dist/chunk-DKAA2IHQ.js

@@ -1,3644 +0,0 @@
-import {
-  WearablesInputError
-} from "./chunk-V7IZKJI3.js";
-import {
-  AdapterRegistry
-} from "./chunk-XTN54NML.js";
-import {
-  WriteRateLimiter
-} from "./chunk-TB6CBZ5V.js";
-import {
-  maybeRespondRecallNavigation
-} from "./chunk-WXDTOE6F.js";
-import {
-  maybeRespondMemoryBrowse
-} from "./chunk-UYHDMCY2.js";
-import {
-  serializeInlineScriptValue
-} from "./chunk-3HSRWJTC.js";
-import {
-  respondDeepRecall
-} from "./chunk-XNI3URDR.js";
-import {
-  handleSupportPassportOwnerHttp
-} from "./chunk-HVX4LPNY.js";
-import {
-  buildSupportPassportPublicRequestHandler
-} from "./chunk-QJPJXCS4.js";
-import {
-  handleMcpGetSse
-} from "./chunk-SRT6SHVZ.js";
-import {
-  EngramMcpServer,
-  MCP_SUPPORTED_PROTOCOL_VERSIONS,
-  cleanupExpiredChatSessions,
-  enforceChatSessionNamespace,
-  loadChatSession,
-  processChatMessage,
-  sessionBelongsToPrincipal,
-  subscribeChatTranscript
-} from "./chunk-XDSCJOH7.js";
-import {
-  RelayMissionStoreError
-} from "./chunk-BJRTMNCB.js";
-import {
-  executeResolution,
-  isValidResolutionVerb
-} from "./chunk-IQWUACVG.js";
-import {
-  handleRecallWhyHttpQuery,
-  handleRecallXrayHttpQuery
-} from "./chunk-LUJCQQ3L.js";
-import {
-  toDottedRemnicName
-} from "./chunk-ZQUVBZI4.js";
-import {
-  maybeHandleLifecycleFlush
-} from "./chunk-2BPPGNAQ.js";
-import {
-  respondOfflineManifestStream,
-  respondOfflineSnapshotStream
-} from "./chunk-5R627MYY.js";
-import {
-  nonEmptyQueryParam,
-  optionalNamespaceKindQueryParam,
-  optionalQueryString,
-  positiveIntQueryParam
-} from "./chunk-4WR2OD7K.js";
-import {
-  respondBufferAdmissionError
-} from "./chunk-I3V3JJS7.js";
-import {
-  respondBriefingHttp
-} from "./chunk-ID6JGIMD.js";
-import {
-  respondAccessCapabilitiesHttp
-} from "./chunk-DJSJ4ULL.js";
-import {
-  authorizationProbeNamespaces,
-  authorizationProbeRequiresPrincipalNamespace,
-  probeOperationAuthorization
-} from "./chunk-RRJBDXAQ.js";
-import {
-  getOperation,
-  resolveQueryNamespaceWritablePreflight
-} from "./chunk-ZTTCDQ4I.js";
-import {
-  handleWhoKnowsHttpQuery
-} from "./chunk-EXHXJETE.js";
-import {
-  isTrustZoneName
-} from "./chunk-JWX2Q6HS.js";
-import {
-  subscribeGraphEvents
-} from "./chunk-DEUNUKTD.js";
-import {
-  BriefingTimeoutError
-} from "./chunk-FNFURZBZ.js";
-import {
-  CorrectionContractError
-} from "./chunk-ETSJD5IV.js";
-import {
-  peerManifestRevision
-} from "./chunk-2LCRG2YV.js";
-import {
-  assertOperationAllowed,
-  capabilityAllowsOp,
-  enforceNamespaceAllowList,
-  isCapabilityRestricted,
-  tokenCapabilityStore
-} from "./chunk-OGBQMY46.js";
-import {
-  isDefaultReviewNamespace,
-  listPairs,
-  readPair
-} from "./chunk-CTVWELNK.js";
-import {
-  isRecallDisclosure
-} from "./chunk-43AA5FVD.js";
-import {
-  resolveNamespaceCapabilities
-} from "./chunk-C5LWPYS3.js";
-import {
-  validateRequest
-} from "./chunk-R2DOFBG4.js";
-import {
-  OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
-  OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-SLDRXK37.js";
-import {
-  projectTagProjectId
-} from "./chunk-63E37JCN.js";
-import {
-  expandTildePath
-} from "./chunk-6KH5NLQS.js";
-import {
-  EngramAccessForbiddenError,
-  EngramAccessInputError
-} from "./chunk-CJCTKL6Y.js";
-import {
-  abortError,
-  isAbortError
-} from "./chunk-R2MBW2S4.js";
-import {
-  log
-} from "./chunk-3WCASNQZ.js";
-
-// src/access-http.ts
-import { createServer } from "http";
-import { randomUUID, timingSafeEqual } from "crypto";
-import { AsyncLocalStorage } from "async_hooks";
-import { existsSync } from "fs";
-import { readFile } from "fs/promises";
-import path2 from "path";
-import { fileURLToPath, URL as URL2 } from "url";
-import { gunzipSync } from "zlib";
-
-// src/wearables/http-glue.ts
-function respondWearablesErrorGlue(respondJson2, res, err) {
-  if (err instanceof WearablesInputError) {
-    respondJson2(res, 400, {
-      error: "invalid_request",
-      code: "invalid_request",
-      message: err.message
-    });
-    return true;
-  }
-  return false;
-}
-
-// src/meetings/errors.ts
-var MeetingsInputError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "MeetingsInputError";
-  }
-};
-
-// src/meetings/http-glue.ts
-function respondMeetingsError(respondJson2, res, err) {
-  if (err instanceof MeetingsInputError) {
-    respondJson2(res, 400, { error: "invalid_request", code: "invalid_request", message: err.message });
-    return true;
-  }
-  return false;
-}
-function decodeMeetingIdSegment(raw) {
-  try {
-    return decodeURIComponent(raw);
-  } catch {
-    throw new MeetingsInputError("meeting id path segment is not valid percent-encoded input");
-  }
-}
-async function respondMeetingsList(res, respondJson2, service, date, scope) {
-  try {
-    respondJson2(res, 200, await service.meetingsList(date, scope));
-  } catch (err) {
-    if (respondMeetingsError(respondJson2, res, err)) return;
-    throw err;
-  }
-}
-async function respondMeetingsGet(res, respondJson2, service, rawId, scope) {
-  try {
-    respondJson2(res, 200, await service.meetingsGet(decodeMeetingIdSegment(rawId), scope));
-  } catch (err) {
-    if (respondMeetingsError(respondJson2, res, err)) return;
-    throw err;
-  }
-}
-async function respondMeetingsBuild(req, res, respondJson2, readJsonBody, service, quota, scopeFor) {
-  const body = await readJsonBody(req);
-  const raw = body.date;
-  if (raw !== void 0 && raw !== null && raw !== "" && typeof raw !== "string") {
-    throw new EngramAccessInputError(`date must be a string (got ${JSON.stringify(raw)})`);
-  }
-  const date = raw === void 0 || raw === null || raw === "" ? void 0 : raw;
-  if (date === void 0) {
-    throw new EngramAccessInputError("date is required (YYYY-MM-DD)");
-  }
-  quota.enforceQuota();
-  const scope = scopeFor?.(
-    typeof body.namespace === "string" ? body.namespace : void 0,
-    typeof body.sessionKey === "string" ? body.sessionKey : void 0
-  );
-  try {
-    const result = await service.meetingsBuild(date, scope);
-    quota.recordHit();
-    respondJson2(res, 200, result);
-  } catch (err) {
-    if (respondMeetingsError(respondJson2, res, err)) return;
-    throw err;
-  }
-}
-
-// src/location/http-glue.ts
-function requireLocationOperation(name) {
-  const op = getOperation(name);
-  if (!op) {
-    throw new Error(`access-boundary: operation not registered: ${name}`);
-  }
-  return op;
-}
-async function respondLocationStatus(res, respondJson2, service) {
-  const output = await requireLocationOperation("location_status").run({}, { service });
-  respondJson2(res, 200, output.result);
-}
-async function respondLocationCheck(res, respondJson2, service) {
-  const output = await requireLocationOperation("location_check").run({}, { service });
-  respondJson2(res, 200, { results: output.result });
-}
-async function respondLocationSync(body, res, respondJson2, service) {
-  const output = await requireLocationOperation("location_sync").run(
-    { date: body.date ?? null, days: body.days ?? null },
-    { service }
-  );
-  respondJson2(res, 200, output.result);
-}
-async function respondLocationBackfill(body, res, respondJson2, service) {
-  const output = await requireLocationOperation("location_backfill").run(
-    { from: body.from ?? null, to: body.to ?? null, dryRun: body.dryRun === true },
-    { service }
-  );
-  respondJson2(res, 200, output.result);
-}
-async function respondLocationDay(date, res, respondJson2, service) {
-  const output = await requireLocationOperation("location_day").run(
-    { date: date ?? null },
-    { service }
-  );
-  respondJson2(res, output.result.found ? 200 : 404, output.result);
-}
-
-// src/standup/http-glue.ts
-async function respondStandup(date, res, respondJson2, service) {
-  const op = getOperation("standup");
-  if (!op) throw new Error("access-boundary: operation not registered: standup");
-  const output = await op.run({ ...date === null ? {} : { date } }, { service });
-  respondJson2(res, 200, output.result);
-}
-
-// src/chat/chat-http.ts
-import { createHash } from "crypto";
-var chatInFlight = /* @__PURE__ */ new Map();
-function principalFingerprintComponent(principal) {
-  return principal === void 0 ? "\0absent" : `
${principal}`;
-}
-function chatDedupFingerprint(memoryDir, chatSessionId, principal, message) {
-  const messageHash = createHash("sha256").update(message, "utf8").digest("hex").slice(0, 32);
-  return `${memoryDir}:${chatSessionId}:${principalFingerprintComponent(principal)}:${messageHash}`;
-}
-function processChatMessageDedup(opts) {
-  if (!opts.chatSessionId) {
-    return processChatMessage(opts);
-  }
-  const fp = chatDedupFingerprint(opts.memoryDir, opts.chatSessionId, opts.principal, opts.message);
-  const existing = chatInFlight.get(fp);
-  if (existing) return existing;
-  const pending = processChatMessage(opts).finally(() => {
-    chatInFlight.delete(fp);
-  });
-  chatInFlight.set(fp, pending);
-  return pending;
-}
-async function handleChatMessage(req, res, body, opts, principal) {
-  if (!opts.config?.enabled) {
-    respondJson(res, 404, { error: "chat_disabled", code: "chat_disabled" });
-    return;
-  }
-  const message = typeof body.message === "string" ? body.message : "";
-  if (!message) {
-    respondJson(res, 400, { error: "message is required", code: "input_error" });
-    return;
-  }
-  if (!opts.service.fallbackLlmRef && !opts.service.localLlmRef) {
-    respondJson(res, 503, {
-      error: "No LLM model is available. Configure a local or cloud model.",
-      code: "no_llm"
-    });
-    return;
-  }
-  const chatSessionId = typeof body.chatSessionId === "string" ? body.chatSessionId : void 0;
-  let result;
-  try {
-    result = await processChatMessageDedup({
-      service: opts.service,
-      config: opts.config,
-      memoryDir: opts.memoryDir,
-      message,
-      ...chatSessionId ? { chatSessionId } : {},
-      ...principal ? { principal } : {}
-    });
-  } catch (err) {
-    const code = err instanceof Error ? err.message : String(err);
-    if (code === "chat_session_not_found") {
-      respondJson(res, 404, { error: "chat_session_not_found", code: "chat_session_not_found" });
-    } else if (code === "access_denied") {
-      respondJson(res, 403, { error: "access_denied", code: "access_denied" });
-    } else if (code === "chat_session_expired") {
-      respondJson(res, 410, { error: "chat_session_expired", code: "chat_session_expired" });
-    } else if (code === "chat_disabled") {
-      respondJson(res, 404, { error: "chat_disabled", code: "chat_disabled" });
-    } else if (code === "no_llm_available" || code === "engine_unavailable") {
-      respondJson(res, 503, {
-        error: "No LLM model is available. Configure a local or cloud model.",
-        code: "no_llm"
-      });
-    } else {
-      respondJson(res, 500, { error: "internal_error", code: "internal_error" });
-    }
-    return;
-  }
-  const wireResult = {
-    reply: result.reply,
-    chatSessionId: result.chatSessionId,
-    ...result.pendingPlan ? {
-      pendingPlan: {
-        planId: result.pendingPlan.planId,
-        preview: result.pendingPlan.preview
-      }
-    } : {},
-    ...result.skippedTools ? { skippedTools: result.skippedTools.filter((name) => typeof name === "string") } : {}
-  };
-  respondJson(res, 200, wireResult);
-}
-async function handleChatEventsSSE(req, res, chatSessionId, opts, principal) {
-  if (!opts.config?.enabled) {
-    respondJson(res, 404, { error: "chat_disabled", code: "chat_disabled" });
-    return;
-  }
-  let heartbeat;
-  let closed = false;
-  const writeSse = (chunk) => {
-    if (closed) return false;
-    try {
-      res.write(chunk);
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  const pending = [];
-  let bursting = true;
-  const unsubscribe = subscribeChatTranscript(opts.memoryDir, chatSessionId, (entry) => {
-    if (closed) return;
-    if (bursting) {
-      pending.push(entry);
-      return;
-    }
-    writeSse(`data: ${JSON.stringify(entry)}
-
-`);
-  });
-  const doCleanup = () => {
-    closed = true;
-    clearInterval(heartbeat);
-    unsubscribe();
-    try {
-      res.end();
-    } catch {
-    }
-  };
-  const unregisterServerCleanup = opts.registerSseCleanup?.(doCleanup) ?? (() => {
-  });
-  req.on("close", () => {
-    doCleanup();
-    unregisterServerCleanup();
-  });
-  const session = await loadChatSession(opts.memoryDir, chatSessionId);
-  if (closed) return;
-  if (!session) {
-    unsubscribe();
-    unregisterServerCleanup();
-    respondJson(res, 404, { error: "chat_session_not_found", code: "chat_session_not_found" });
-    return;
-  }
-  if (!sessionBelongsToPrincipal(session, principal)) {
-    unsubscribe();
-    unregisterServerCleanup();
-    respondJson(res, 403, { error: "access_denied", code: "access_denied" });
-    return;
-  }
-  res.writeHead(200, {
-    "content-type": "text/event-stream",
-    "cache-control": "no-cache",
-    connection: "keep-alive"
-  });
-  writeSse("retry: 5000\n\n");
-  const deliveredSeqs = /* @__PURE__ */ new Set();
-  for (const entry of session.transcript) {
-    writeSse(`data: ${JSON.stringify(entry)}
-
-`);
-    deliveredSeqs.add(entry.seq);
-  }
-  bursting = false;
-  for (const entry of pending) {
-    if (!deliveredSeqs.has(entry.seq)) {
-      writeSse(`data: ${JSON.stringify(entry)}
-
-`);
-    }
-  }
-  if (closed) return;
-  heartbeat = setInterval(() => {
-    writeSse(`data: ${JSON.stringify({ type: "heartbeat" })}
-
-`);
-  }, 25e3);
-  heartbeat.unref?.();
-}
-function respondJson(res, status, body) {
-  const json = JSON.stringify(body);
-  res.writeHead(status, {
-    "content-type": "application/json; charset=utf-8",
-    "content-length": Buffer.byteLength(json, "utf8")
-  });
-  res.end(json);
-}
-
-// src/support-passport/access-http-base.ts
-import path from "path";
-var SUPPORT_PASSPORT_QUOTA_LIMITED_WRITE_TOOLS = /* @__PURE__ */ new Set([
-  "engram.support_passport_draft_create",
-  "remnic.support_passport_draft_create",
-  "engram.support_passport_drafts_generate",
-  "remnic.support_passport_drafts_generate",
-  "engram.support_passport_card_replace",
-  "remnic.support_passport_card_replace",
-  "engram.support_passport_card_approve",
-  "remnic.support_passport_card_approve",
-  "engram.support_passport_card_reject",
-  "remnic.support_passport_card_reject",
-  "engram.support_passport_card_withdraw",
-  "remnic.support_passport_card_withdraw",
-  "engram.support_passport_grant_create",
-  "remnic.support_passport_grant_create",
-  "engram.support_passport_grant_revoke",
-  "remnic.support_passport_grant_revoke"
-]);
-var SUPPORT_PASSPORT_ADMIN_CONSOLE_ASSETS = /* @__PURE__ */ new Map([
-  ["what-helps-me.css", "text/css; charset=utf-8"],
-  ["model.js", "application/javascript; charset=utf-8"],
-  ["app.js", "application/javascript; charset=utf-8"]
-]);
-var SupportPassportAccessHttpBase = class {
-  supportPassportPublicHandler;
-  handleSupportPassportOwnerRequest(req, res, pathname, hasQuery, abortSignal) {
-    return handleSupportPassportOwnerHttp({
-      req,
-      res,
-      pathname,
-      hasQuery,
-      service: this.service,
-      principal: this.resolveRequestPrincipal(req),
-      abortSignal,
-      readJsonBody: () => this.readJsonBody(req),
-      respondJson: (status, payload) => {
-        res.setHeader("cache-control", "private, no-store");
-        res.setHeader("vary", "Authorization");
-        this.respondJson(res, status, payload);
-      },
-      reserveWriteRateLimitSlot: () => this.reserveWriteRateLimitSlot(req)
-    });
-  }
-  handleSupportPassportPublicRequest(req, res) {
-    this.supportPassportPublicHandler ??= buildSupportPassportPublicRequestHandler(this.service, {
-      trustedProxyAddresses: this.service.configRef?.supportPassport?.trustedProxyAddresses ?? []
-    });
-    return this.supportPassportPublicHandler(req, res, {
-      authorized: false,
-      tokenAuthorized: false
-    });
-  }
-  async enforceSupportPassportAuthorizationProbe(req) {
-    const principal = this.resolveRequestPrincipal(req)?.trim();
-    if (!principal) {
-      throw new EngramAccessForbiddenError("A trusted principal is required for support passport access.");
-    }
-    const owner = await this.service.getWritableStorageForNamespace(void 0, principal);
-    enforceNamespaceAllowList(
-      tokenCapabilityStore.getStore(),
-      owner.namespace,
-      this.service.configRef.defaultNamespace
-    );
-  }
-  isSupportPassportQuotaLimitedWriteTool(toolName) {
-    return SUPPORT_PASSPORT_QUOTA_LIMITED_WRITE_TOOLS.has(toolName);
-  }
-  async handleSupportPassportUi(req, res, pathname) {
-    if (req.method !== "GET") return false;
-    const isSupportPassportPath = pathname === "/remnic/ui/what-helps-me" || pathname === "/engram/ui/what-helps-me" || pathname.startsWith("/remnic/ui/what-helps-me/") || pathname.startsWith("/engram/ui/what-helps-me/");
-    if (!isSupportPassportPath) return false;
-    if (!this.service.supportPassportEnabled) {
-      this.respondJson(res, 404, { error: "not_found" });
-      return true;
-    }
-    if (pathname === "/remnic/ui/what-helps-me" || pathname === "/engram/ui/what-helps-me") {
-      const search = new URL(req.url ?? pathname, "http://placeholder").search;
-      res.statusCode = 301;
-      res.setHeader("location", `${pathname}/${search}`);
-      res.end();
-      return true;
-    }
-    if (pathname === "/remnic/ui/what-helps-me/" || pathname === "/engram/ui/what-helps-me/") {
-      const helperRequest = new URL(req.url ?? pathname, "http://placeholder").searchParams.has("grant");
-      res.setHeader("content-security-policy", "frame-ancestors 'none'");
-      res.setHeader("x-frame-options", "DENY");
-      await this.respondAdminConsoleShell(req, res, pathname, "what-helps-me/index.html", !helperRequest);
-      return true;
-    }
-    const fileName = pathname.split("/").at(-1) ?? "";
-    const assetType = SUPPORT_PASSPORT_ADMIN_CONSOLE_ASSETS.get(fileName);
-    if (assetType && pathname.split("/").length === 5) {
-      await this.respondStatic(res, path.join(this.adminConsolePublicDir, "what-helps-me", fileName), assetType);
-      return true;
-    }
-    this.respondJson(res, 404, { error: "not_found" });
-    return true;
-  }
-};
-
-// src/review/review-deck-http-base.ts
-var LIST_PATHS = ["/remnic/v1/review/deck", "/engram/v1/review/deck"];
-var ACTION_PATHS = ["/remnic/v1/review/deck/action", "/engram/v1/review/deck/action"];
-var UNDO_PATHS = ["/remnic/v1/review/deck/undo", "/engram/v1/review/deck/undo"];
-var LIMIT_MIN = 1;
-var LIMIT_MAX = 100;
-var CURSOR_RE = /^[^\s%]{1,2048}$/;
-function requiredString(body, field) {
-  const value = body[field];
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new EngramAccessInputError(`${field} is required`);
-  }
-  return value.trim();
-}
-function parseLimit(raw) {
-  if (raw === null || raw.length === 0) {
-    throw new EngramAccessInputError("limit is required and must be an integer");
-  }
-  if (!/^(?:0|[1-9]\d*)$/.test(raw)) {
-    throw new EngramAccessInputError("limit must be an integer");
-  }
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value < LIMIT_MIN || value > LIMIT_MAX) {
-    throw new EngramAccessInputError(`limit must be an integer from ${LIMIT_MIN} to ${LIMIT_MAX}`);
-  }
-  return value;
-}
-function parseCursor(raw) {
-  if (raw === null) return void 0;
-  if (!CURSOR_RE.test(raw)) {
-    throw new EngramAccessInputError("cursor is malformed");
-  }
-  return raw;
-}
-function parseActionBody(body) {
-  const action = body.action;
-  if (action !== "keep" && action !== "not_true" && action !== "prepare_fix") {
-    throw new EngramAccessInputError("action must be one of: keep, not_true, prepare_fix");
-  }
-  const itemId = requiredString(body, "itemId");
-  const revision = requiredString(body, "revision");
-  const idempotencyKey = requiredString(body, "idempotencyKey");
-  if (action === "prepare_fix") {
-    const correctionText = requiredString(body, "correctionText");
-    return { schemaVersion: 1, itemId, revision, action, correctionText, idempotencyKey };
-  }
-  return { schemaVersion: 1, itemId, revision, action, idempotencyKey };
-}
-function parseUndoBody(body) {
-  return {
-    schemaVersion: 1,
-    receiptId: requiredString(body, "receiptId"),
-    expectedRevision: requiredString(body, "expectedRevision"),
-    idempotencyKey: requiredString(body, "idempotencyKey")
-  };
-}
-var ReviewDeckAccessHttpBase = class extends SupportPassportAccessHttpBase {
-  async handleReviewDeckRequest(req, res, pathname, abortSignal) {
-    const method = req.method;
-    const isList = method === "GET" && (pathname === LIST_PATHS[0] || pathname === LIST_PATHS[1]);
-    const isAction = method === "POST" && (pathname === ACTION_PATHS[0] || pathname === ACTION_PATHS[1]);
-    const isUndo = method === "POST" && (pathname === UNDO_PATHS[0] || pathname === UNDO_PATHS[1]);
-    if (!isList && !isAction && !isUndo) return false;
-    if (!this.service.reviewDeckEnabled) {
-      this.respondJson(res, 404, { error: "not_found", code: "not_found" });
-      return true;
-    }
-    const parsed = new URL(req.url ?? "/", "http://127.0.0.1");
-    const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-    const principal = this.resolveRequestPrincipal(req);
-    if (isList) {
-      this.enforceTokenOp("review_deck_list");
-      const page = await this.service.reviewDeckList({
-        namespace,
-        principal,
-        cursor: parseCursor(parsed.searchParams.get("cursor")),
-        limit: parseLimit(parsed.searchParams.get("limit"))
-      });
-      this.respondJson(res, 200, page);
-      return true;
-    }
-    if (isAction) this.enforceTokenOp("review_deck_action");
-    else this.enforceTokenOp("review_deck_undo");
-    const writeQuota = this.reserveWriteRateLimitSlot(req);
-    try {
-      const body = await this.readJsonBody(req, this.maxBodyBytes);
-      const result = isAction ? await this.service.reviewDeckAction(parseActionBody(body), {
-        namespace,
-        principal,
-        signal: abortSignal
-      }) : await this.service.reviewDeckUndo(parseUndoBody(body), {
-        namespace,
-        principal,
-        signal: abortSignal
-      });
-      writeQuota.commit();
-      this.respondJson(res, 200, result);
-    } catch (error) {
-      writeQuota.release();
-      throw error;
-    }
-    return true;
-  }
-};
-
-// src/access-http.ts
-function resolveDefaultAdminConsolePublicDir(sourceUrl = import.meta.url) {
-  const thisDir = path2.dirname(fileURLToPath(sourceUrl));
-  const candidates = [
-    path2.resolve(thisDir, "../../../admin-console/public"),
-    path2.resolve(thisDir, "../dist/admin-console/public"),
-    path2.resolve(thisDir, "./admin-console/public"),
-    path2.resolve(thisDir, "../../admin-console/public")
-  ];
-  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
-}
-var defaultAdminConsolePublicDir = resolveDefaultAdminConsolePublicDir();
-var correlationIdStore = new AsyncLocalStorage();
-var RELAY_ADMIN_CONSOLE_ASSETS = /* @__PURE__ */ new Map([
-  ["relay.css", "text/css; charset=utf-8"],
-  ["relay-model.js", "application/javascript; charset=utf-8"],
-  ["relay.js", "application/javascript; charset=utf-8"],
-  ["replay.json", "application/json; charset=utf-8"]
-]);
-var TRUST_ZONE_RECORD_KINDS = ["memory", "artifact", "state", "trajectory", "external"];
-var TRUST_ZONE_SOURCE_CLASSES = ["tool_output", "web_content", "subagent_trace", "system_memory", "user_input", "manual"];
-var HttpError = class extends Error {
-  constructor(status, message, code, details) {
-    super(message);
-    this.status = status;
-    this.code = code ?? `http_${status}`;
-    this.details = details;
-  }
-  status;
-  code;
-  details;
-};
-function hostToUrlAuthority(host) {
-  if (host.includes(":") && !host.startsWith("[") && !host.endsWith("]")) {
-    return `[${host}]`;
-  }
-  return host;
-}
-function parseHttpServerPort(port) {
-  if (port === void 0) return 0;
-  if (!Number.isInteger(port) || port < 0 || port > 65535) {
-    throw new Error("access HTTP port must be an integer from 0 to 65535");
-  }
-  return port;
-}
-function assertResourceMetadataUrl(value) {
-  if (value === void 0) return void 0;
-  let parsed;
-  try {
-    parsed = new URL2(value);
-  } catch {
-    throw new Error(
-      `access HTTP resourceMetadataUrl must be an absolute http(s) URL, got: ${value}`
-    );
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(
-      `access HTTP resourceMetadataUrl must use http or https, got: ${parsed.protocol}`
-    );
-  }
-  return value;
-}
-function parseTrustZoneKindFilter(raw) {
-  if (raw === null) return void 0;
-  if (TRUST_ZONE_RECORD_KINDS.includes(raw)) {
-    return raw;
-  }
-  throw new HttpError(400, `kind must be one of ${TRUST_ZONE_RECORD_KINDS.join("|")}`, "invalid_kind_filter");
-}
-function parseTrustZoneSourceClassFilter(raw) {
-  if (raw === null) return void 0;
-  if (TRUST_ZONE_SOURCE_CLASSES.includes(raw)) {
-    return raw;
-  }
-  throw new HttpError(400, `sourceClass must be one of ${TRUST_ZONE_SOURCE_CLASSES.join("|")}`, "invalid_source_class_filter");
-}
-function parseTrustZoneFilter(raw) {
-  if (raw === null) return void 0;
-  if (isTrustZoneName(raw)) {
-    return raw;
-  }
-  throw new HttpError(400, "zone must be one of quarantine|working|trusted", "invalid_zone_filter");
-}
-function summarizeHttpRequest(req) {
-  const method = req.method ?? "UNKNOWN";
-  try {
-    const parsed = new URL2(req.url ?? "/", "http://localhost");
-    return `${method} ${parsed.pathname}`;
-  } catch {
-    return `${method} ${(req.url ?? "/").split("?")[0]}`;
-  }
-}
-function parseStrictIntegerQuery(raw, field, defaultValue, minValue) {
-  if (raw === null) return defaultValue;
-  if (!/^(?:0|[1-9]\d*)$/.test(raw)) {
-    throw new HttpError(400, `${field} must be an integer`, `invalid_${field}`);
-  }
-  const value = Number(raw);
-  if (!Number.isInteger(value) || value < minValue) {
-    throw new HttpError(400, `${field} must be an integer >= ${minValue}`, `invalid_${field}`);
-  }
-  return value;
-}
-function parseMemorySort(raw) {
-  if (raw === null) return void 0;
-  if (raw === "updated_desc" || raw === "updated_asc" || raw === "created_desc" || raw === "created_asc") {
-    return raw;
-  }
-  throw new HttpError(400, "sort must be one of updated_desc|updated_asc|created_desc|created_asc", "invalid_sort");
-}
-function decodePeerIdSegment(raw) {
-  try {
-    return decodeURIComponent(raw);
-  } catch {
-    throw new EngramAccessInputError("peerId path segment is not valid percent-encoded input");
-  }
-}
-function decodeRelayMissionIdSegment(raw) {
-  try {
-    return decodeURIComponent(raw);
-  } catch {
-    throw new EngramAccessInputError("missionId path segment is not valid percent-encoded input");
-  }
-}
-function rejectBlankRelayNamespace(value) {
-  if (value !== void 0 && value !== null && value.trim().length === 0) {
-    throw new EngramAccessInputError("Relay namespace must not be blank when provided");
-  }
-}
-function codingContextFromProjectTag(projectTag) {
-  const projectId = projectTagProjectId(projectTag);
-  return {
-    projectId,
-    branch: null,
-    rootPath: projectId,
-    defaultBranch: null
-  };
-}
-var EngramAccessHttpServer = class extends ReviewDeckAccessHttpBase {
-  service;
-  host;
-  requestedPort;
-  authToken;
-  authTokens;
-  authTokensGetter;
-  authTokenEntriesGetter;
-  tokenPathPolicy;
-  authenticatedPrincipal;
-  maxBodyBytes;
-  adminConsoleEnabled;
-  adminConsolePublicDir;
-  adminConsolePrefillToken;
-  adminControls;
-  trustPrincipalHeader;
-  adapterRegistry;
-  readiness;
-  resourceMetadataUrl;
-  externalRequestHandler;
-  writeLimiter;
-  // Reservations taken by ensureWriteRateLimitAvailable and not yet committed
-  // by recordWriteRateLimitHit, keyed by request. The per-request release in
-  // the connection callback covers every early return and error path, so a
-  // failed or exempt write never leaks its slot (issue #3225 C4).
-  pendingWriteQuotas = /* @__PURE__ */ new WeakMap();
-  mcpServer;
-  server = null;
-  boundPort = 0;
-  /** Active SSE response objects for /engram/v1/graph/events. */
-  sseClients = /* @__PURE__ */ new Set();
-  /** Throttle batch: pending SSE event batches per client. */
-  sseBatchTimers = /* @__PURE__ */ new Map();
-  ssePendingBatches = /* @__PURE__ */ new Map();
-  /**
-   * Per-client cleanup callbacks: clear heartbeat interval, flush timer,
-   * unsubscribe from bus, and end the response.  Stored here so `stop()`
-   * can invoke them even when the client hasn't disconnected yet
-   * (Cursor review thread `access-http.ts:232`).
-   */
-  sseCleanupFns = /* @__PURE__ */ new Set();
-  /**
-   * Periodic chat-session TTL sweep handle (issue #1685 item 1 /
-   * #1687 Thread 21).  unref'd so it never blocks process exit
-   * (rule 47); cleared in `stop()`.
-   */
-  chatTtlTimer = null;
-  constructor(options) {
-    super();
-    this.service = options.service;
-    this.host = options.host?.trim() || "127.0.0.1";
-    this.requestedPort = parseHttpServerPort(options.port);
-    this.authToken = options.authToken?.trim() || void 0;
-    this.authTokens = (options.authTokens ?? []).map((t) => t.trim()).filter(Boolean);
-    this.authTokensGetter = options.authTokensGetter;
-    this.authTokenEntriesGetter = options.authTokenEntriesGetter;
-    this.tokenPathPolicy = options.tokenPathPolicy;
-    this.authenticatedPrincipal = options.principal?.trim() || void 0;
-    this.maxBodyBytes = Number.isFinite(options.maxBodyBytes) ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072)) : 131072;
-    this.writeLimiter = new WriteRateLimiter(
-      options.writeRateLimitMaxRequests,
-      options.writeRateLimitWindowMs
-    );
-    this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
-    this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
-    this.adminConsolePrefillToken = options.adminConsolePrefillToken === true ? this.authToken : void 0;
-    this.adminControls = options.adminControls;
-    this.trustPrincipalHeader = options.trustPrincipalHeader === true;
-    this.readiness = options.readiness ?? (() => ({ ready: true, warmupAttempts: 0 }));
-    this.resourceMetadataUrl = assertResourceMetadataUrl(options.resourceMetadataUrl);
-    this.externalRequestHandler = options.externalRequestHandler;
-    this.adapterRegistry = options.enableAdapters !== false ? options.adapterRegistry ?? new AdapterRegistry() : null;
-    this.mcpServer = new EngramMcpServer(this.service, {
-      principal: options.principal,
-      citationsEnabled: options.citationsEnabled,
-      citationsAutoDetect: options.citationsAutoDetect,
-      emitLegacyTools: options.emitLegacyTools,
-      codingDecisionVisible: this.service.decisionRecordSurfaceVisible,
-      architectureCardVisible: this.service.architectureCardSurfaceVisible,
-      codegraphVisible: this.service.codegraphSurfaceVisible,
-      sessionDeltaVisible: this.service.sessionDeltaSurfaceVisible,
-      chatVisible: this.service.configRef?.chat?.enabled === true,
-      correctionVisible: this.service.correctionSurfaceVisible
-    });
-  }
-  async start() {
-    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter && !this.authTokenEntriesGetter) {
-      throw new Error("engram access HTTP requires authToken or authTokens");
-    }
-    if (this.server) return this.status();
-    const server = createServer((req, res) => {
-      const correlationId = randomUUID();
-      const abortController = new AbortController();
-      const abortDisconnectedRequest = () => {
-        if (!res.writableFinished && !abortController.signal.aborted) {
-          abortController.abort(abortError("HTTP client disconnected"));
-        }
-      };
-      req.once("aborted", abortDisconnectedRequest);
-      res.once("close", abortDisconnectedRequest);
-      correlationIdStore.run(correlationId, () => {
-        void this.handle(req, res, correlationId, abortController.signal).catch((err) => {
-          if (err instanceof BriefingTimeoutError) {
-            this.respondJson(res, 504, { error: err.message, code: "briefing_timeout" });
-            return;
-          }
-          if (isAbortError(err)) {
-            if (!res.destroyed && !res.writableEnded) {
-              res.end();
-            }
-            return;
-          }
-          log.debug(`engram access HTTP request failed [${correlationId}]: ${err}`);
-          if (err instanceof HttpError) {
-            const payload = { error: err.message, code: err.code };
-            if (err.details) payload.details = err.details;
-            this.respondJson(res, err.status, payload);
-            return;
-          }
-          if (err instanceof EngramAccessInputError) {
-            this.respondJson(res, 400, { error: err.message, code: "input_error" });
-            return;
-          }
-          if (err instanceof EngramAccessForbiddenError) {
-            this.respondJson(res, 403, { error: err.message, code: "forbidden" });
-            return;
-          }
-          if (err instanceof CorrectionContractError) {
-            this.respondJson(res, 400, { error: err.message, code: "correction_contract_error" });
-            return;
-          }
-          if (err instanceof RelayMissionStoreError) {
-            const status = err.code === "idempotency_conflict" ? 409 : err.code === "limit_exceeded" ? 413 : err.code === "lock_unavailable" ? 503 : 500;
-            this.respondJson(res, status, {
-              error: status >= 500 ? "relay_backend_unavailable" : err.message,
-              code: `relay_${err.code}`
-            });
-            return;
-          }
-          if (respondBufferAdmissionError(err, res, correlationId, (status, body) => this.respondJson(res, status, body))) {
-            return;
-          }
-          if (res.headersSent) {
-            res.destroy(err);
-            return;
-          }
-          log.error(
-            `engram access HTTP internal error [${correlationId}] ${summarizeHttpRequest(req)}`,
-            err
-          );
-          this.respondJson(res, 500, { error: "internal_error", code: "internal_error" });
-        }).finally(() => {
-          req.off("aborted", abortDisconnectedRequest);
-          res.off("close", abortDisconnectedRequest);
-          this.releasePendingWriteQuota(req);
-        });
-      });
-    });
-    try {
-      await new Promise((resolve, reject) => {
-        const onError = (err) => {
-          server.off("listening", onListening);
-          reject(err);
-        };
-        const onListening = () => {
-          server.off("error", onError);
-          resolve();
-        };
-        server.once("error", onError);
-        server.once("listening", onListening);
-        server.listen(this.requestedPort, this.host);
-      });
-    } catch (err) {
-      server.close();
-      throw err;
-    }
-    this.server = server;
-    const address = server.address();
-    this.boundPort = typeof address === "object" && address ? address.port : this.requestedPort;
-    this.scheduleChatSessionTtlSweep();
-    return this.status();
-  }
-  async stop() {
-    if (!this.server) return;
-    if (this.chatTtlTimer) {
-      clearInterval(this.chatTtlTimer);
-      this.chatTtlTimer = null;
-    }
-    const server = this.server;
-    this.server = null;
-    this.boundPort = 0;
-    for (const cleanup of this.sseCleanupFns) {
-      try {
-        cleanup();
-      } catch {
-      }
-    }
-    this.sseCleanupFns.clear();
-    for (const [res, timer] of this.sseBatchTimers.entries()) {
-      clearTimeout(timer);
-      this.sseBatchTimers.delete(res);
-    }
-    this.ssePendingBatches.clear();
-    for (const res of this.sseClients) {
-      try {
-        res.end();
-      } catch {
-      }
-    }
-    this.sseClients.clear();
-    await new Promise((resolve, reject) => {
-      server.close((err) => err ? reject(err) : resolve());
-    });
-  }
-  /**
-   * Schedule the chat-session TTL sweep: one immediate pass plus a
-   * recurring hourly pass (issue #1685 item 1 / #1687 Thread 21).  Both
-   * are skipped when chat is disabled.  The recurring timer is unref'd
-   * so it never keeps the event loop alive on its own (rule 47).  The
-   * sweep itself is best-effort — cleanup failures are swallowed inside
-   * `cleanupExpiredChatSessions`.
-   */
-  scheduleChatSessionTtlSweep() {
-    if (this.chatTtlTimer) {
-      clearInterval(this.chatTtlTimer);
-      this.chatTtlTimer = null;
-    }
-    const chat = this.service.configRef?.chat;
-    if (!chat?.enabled) return;
-    const ttlHours = typeof chat.sessionTtlHours === "number" && chat.sessionTtlHours > 0 ? chat.sessionTtlHours : 72;
-    void cleanupExpiredChatSessions(this.service.memoryDir, ttlHours).catch(() => {
-    });
-    const SWEEP_INTERVAL_MS = 60 * 60 * 1e3;
-    this.chatTtlTimer = setInterval(() => {
-      void cleanupExpiredChatSessions(this.service.memoryDir, ttlHours).catch(() => {
-      });
-    }, SWEEP_INTERVAL_MS);
-    this.chatTtlTimer.unref?.();
-  }
-  status() {
-    return {
-      running: this.server !== null,
-      host: this.host,
-      port: this.boundPort,
-      maxBodyBytes: this.maxBodyBytes
-    };
-  }
-  /**
-   * Resolve the adapter identity for the incoming request.
-   * Includes MCP clientInfo from the last initialize handshake if available.
-   * Returns null if no adapter matches or adapters are disabled.
-   */
-  resolveAdapterIdentity(req) {
-    if (!this.adapterRegistry) return null;
-    const sessionId = (() => {
-      const raw = req.headers["mcp-session-id"];
-      return typeof raw === "string" ? raw.trim() : void 0;
-    })();
-    return this.adapterRegistry.resolve({
-      headers: req.headers,
-      clientInfo: this.mcpServer.getClientInfo(sessionId)
-    });
-  }
-  /** Cache for per-request identity resolution (avoids double adapter resolution) */
-  identityCache = /* @__PURE__ */ new WeakMap();
-  /** Resolve principal, namespace, and session key from request headers and adapter identity */
-  resolveRequestIdentity(req) {
-    const cached = this.identityCache.get(req);
-    if (cached) return cached;
-    let principal;
-    let namespace;
-    let sessionKey;
-    if (this.trustPrincipalHeader) {
-      const headerVal = req.headers["x-engram-principal"];
-      const raw = Array.isArray(headerVal) ? headerVal[0] : headerVal;
-      if (typeof raw === "string") {
-        const trimmed = raw.trim();
-        if (trimmed.length > 0) {
-          principal = trimmed;
-        }
-      }
-    }
-    if (!principal) {
-      principal = this.authenticatedPrincipal;
-    }
-    const adapterIdentity = this.resolveAdapterIdentity(req);
-    if (adapterIdentity) {
-      if (!principal) {
-        principal = adapterIdentity.principal;
-      }
-      namespace = adapterIdentity.namespace;
-      const config = this.service.configRef;
-      if (adapterIdentity.namespaceExplicit === false && !(config && resolveNamespaceCapabilities(config).namespaces)) {
-        namespace = void 0;
-      }
-      sessionKey = adapterIdentity.sessionKey;
-    }
-    const result = { principal, namespace, sessionKey };
-    this.identityCache.set(req, result);
-    return result;
-  }
-  resolveRequestPrincipal(req) {
-    return this.resolveRequestIdentity(req).principal;
-  }
-  /** Caller scope for wearables/meetings ops (issue #2123): request principal +
-   *  gated namespace + optional sessionKey, so reads/writes resolve to the caller
-   *  namespace instead of the machine default. */
-  wearablesScope(req, namespace, sessionKey) {
-    return { authenticatedPrincipal: this.resolveRequestPrincipal(req), namespace: this.resolveNamespace(req, namespace), ...sessionKey ? { sessionKey } : {} };
-  }
-  /** Resolve namespace: only use the explicit body value. Adapter-inferred namespace
-   *  is intentionally NOT used as a fallback for REST requests — omitting namespace
-   *  should default to the server's global namespace, not silently scope to an adapter. */
-  resolveNamespace(_req, bodyNamespace) {
-    const namespace = bodyNamespace || void 0;
-    enforceNamespaceAllowList(tokenCapabilityStore.getStore(), namespace, this.service.configRef?.defaultNamespace);
-    return namespace;
-  }
-  /**
-   * Resolve + enforce the `namespace` field carried in a POST request body,
-   * returning a shallow-copied envelope with the gated namespace stamped on.
-   * Used by the coding/correction POST routes that pass `body` straight to
-   * `op.run`: the body `namespace` is a user-controlled field that MUST flow
-   * through the same effective-namespace allow-list gate as the query-param
-   * routes, otherwise a scoped bearer can scope its call to another tenant
-   * by setting `body.namespace` (issue #1850 finding 2). Throws 403 for a
-   * scoped token whose allow-list does not cover the effective namespace.
-   *
-   * A `namespace` that is neither a string nor `null` is REJECTED here rather
-   * than coerced to `undefined`: silently reinterpreting it would default the
-   * request to the principal's namespace set and answer 200, hiding the
-   * caller's mistake behind a plausible result (AGENTS.md pattern 39). `null`
-   * and an absent field keep their documented "no explicit namespace" meaning.
-   */
-  gatedBodyNamespace(req, body) {
-    const requested = body.namespace;
-    if (requested !== void 0 && requested !== null && typeof requested !== "string") {
-      throw new EngramAccessInputError(
-        `namespace must be a string or null (got: ${typeof requested})`
-      );
-    }
-    const trimmed = typeof requested === "string" ? requested.trim() : void 0;
-    const namespace = this.resolveNamespace(req, trimmed || void 0);
-    return { ...body, namespace };
-  }
-  /**
-   * Resolve the recall disclosure depth from the request (issue #677 PR
-   * 2/4).  Explicit body value wins; otherwise we accept a
-   * `?disclosure=...` query parameter so curl/browser tooling can use the
-   * three-tier surface without rewriting JSON.  Invalid query values
-   * throw `EngramAccessInputError` (CLAUDE.md rule 51 — no silent
-   * fallback).  An absent body field AND an absent query param yields
-   * `undefined`, which the service maps to `DEFAULT_RECALL_DISCLOSURE`.
-   */
-  resolveRecallDisclosure(bodyDisclosure, parsed) {
-    if (bodyDisclosure !== void 0) {
-      return bodyDisclosure;
-    }
-    const queryDisclosure = parsed.searchParams.get("disclosure");
-    if (queryDisclosure === null) {
-      return void 0;
-    }
-    if (!isRecallDisclosure(queryDisclosure)) {
-      throw new EngramAccessInputError(
-        `disclosure must be one of: chunk, section, raw (got: ${queryDisclosure})`
-      );
-    }
-    return queryDisclosure;
-  }
-  async handle(req, res, correlationId, abortSignal) {
-    const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
-    const pathname = parsed.pathname;
-    if (await this.handleSupportPassportUi(req, res, pathname)) return;
-    if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) return;
-    if (req.method === "GET" && (pathname === "/engram/v1/live" || pathname === "/engram/v1/health")) {
-      const { ready, warmupAttempts, lastError } = this.readiness();
-      if (!ready) {
-        this.respondJson(res, 503, {
-          ok: false,
-          ready: false,
-          warmupAttempts,
-          lastError: lastError ?? null,
-          code: "not_ready"
-        });
-        return;
-      }
-    }
-    if (await this.handleSupportPassportPublicRequest(req, res)) return;
-    if (this.externalRequestHandler) {
-      const tokenAuthorized = this.isAuthorized(req, pathname);
-      const capabilities = this.resolveTokenCapabilities(req, pathname);
-      const authorized = tokenAuthorized && !isCapabilityRestricted(capabilities);
-      if (await this.externalRequestHandler(req, res, {
-        authorized,
-        tokenAuthorized
-      })) return;
-    }
-    if (!this.isAuthorized(req, pathname)) {
-      const body = JSON.stringify({ error: "unauthorized", code: "unauthorized" });
-      res.writeHead(401, {
-        "content-type": "application/json; charset=utf-8",
-        "www-authenticate": this.bearerChallenge(),
-        "x-request-id": correlationId
-      });
-      res.end(body);
-      return;
-    }
-    const caps = this.resolveTokenCapabilities(req, pathname);
-    await tokenCapabilityStore.run(caps, async () => {
-      await this.dispatchAuthorizedRequest(req, res, parsed, pathname, correlationId, abortSignal);
-    });
-  }
-  async dispatchAuthorizedRequest(req, res, parsed, pathname, correlationId, abortSignal) {
-    if (pathname === "/mcp" && req.method === "DELETE") {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-    if (pathname === "/mcp" && req.method === "GET") {
-      if ((req.headers.accept ?? "").includes("text/event-stream"))
-        return handleMcpGetSse(req, res, this.sseCleanupFns);
-      const body = JSON.stringify({ error: "method_not_allowed", code: "method_not_allowed" });
-      res.writeHead(405, { "content-type": "application/json; charset=utf-8", allow: "GET, POST, DELETE", "x-request-id": correlationId });
-      res.end(body);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/mcp") return this.handleMcpRequest(req, res, abortSignal);
-    if (await this.handleSupportPassportOwnerRequest(req, res, pathname, parsed.search.length > 0, abortSignal)) return;
-    if (await this.handleReviewDeckRequest(req, res, pathname, abortSignal)) return;
-    if (req.method === "GET" && pathname === "/engram/v1/live") return this.respondJson(res, 200, { ok: true, ready: true });
-    if (req.method === "GET" && pathname === "/engram/v1/health") {
-      const { degraded, warmupAttempts, lastError } = this.readiness();
-      const health = await this.service.health();
-      this.respondJson(res, 200, degraded !== true ? health : {
-        ...health,
-        degraded: true,
-        warmupAttempts,
-        lastError: lastError ?? null
-      });
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/capabilities") return respondAccessCapabilitiesHttp(res);
-    if (req.method === "GET" && pathname === "/engram/v1/authorization") {
-      res.setHeader("cache-control", "no-store");
-      const probe = probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op"));
-      for (const namespace of authorizationProbeNamespaces(probe.operations, parsed.searchParams.get("namespace") ?? void 0))
-        this.resolveNamespace(req, namespace);
-      if (authorizationProbeRequiresPrincipalNamespace(probe.operations))
-        await this.enforceSupportPassportAuthorizationProbe(req);
-      this.respondJson(res, 200, probe);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/adapters") {
-      this.enforceTokenOp("adapters_status");
-      const identity = this.resolveAdapterIdentity(req);
-      this.respondJson(res, 200, {
-        adaptersEnabled: this.adapterRegistry !== null,
-        registered: this.adapterRegistry?.list() ?? [],
-        resolved: identity
-      });
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/admin/dashboard" || pathname === "/remnic/v1/admin/dashboard")) {
-      this.requireOperatorToken();
-      if (!this.adminControls) {
-        this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
-        return;
-      }
-      this.respondJson(res, 200, await this.adminControls.status());
-      return;
-    }
-    if (req.method === "PATCH" && (pathname === "/engram/v1/admin/config" || pathname === "/remnic/v1/admin/config")) {
-      this.requireOperatorToken();
-      if (!this.adminControls?.update) {
-        this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
-        return;
-      }
-      try {
-        this.respondJson(res, 200, await this.adminControls.update(await this.readJsonBody(req)));
-      } catch (error) {
-        throw new HttpError(
-          400,
-          error instanceof Error ? error.message : "invalid_admin_config_patch",
-          "invalid_admin_config_patch"
-        );
-      }
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/external-wikis/search" || pathname === "/remnic/v1/external-wikis/search")) {
-      this.enforceTokenOp("external_wiki_search");
-      const operation = getOperation("external_wiki_search");
-      if (!operation) throw new EngramAccessInputError("external_wiki_search operation is not registered");
-      const output = await operation.run(await this.readJsonBody(req), { service: this.service });
-      if (!output || typeof output !== "object" || !("result" in output)) {
-        throw new Error("external_wiki_search returned an invalid operation result");
-      }
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/memories/search" || pathname === "/remnic/v1/memories/search")) {
-      this.enforceTokenOp("memory_search");
-      const operation = getOperation("memory_search");
-      if (!operation) throw new EngramAccessInputError("access-boundary: operation not registered: memory_search");
-      const body = this.gatedBodyNamespace(req, await this.readJsonBody(req));
-      if (body.namespace === void 0 && tokenCapabilityStore.getStore()?.namespaces !== void 0) {
-        body.namespace = this.service.configRef?.defaultNamespace ?? "";
-      }
-      const output = await operation.run(body, {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/recall") {
-      this.enforceTokenOp("recall");
-      const body = await this.readValidatedBody(req, "recall");
-      const disclosure = this.resolveRecallDisclosure(body.disclosure, parsed);
-      const asOfQueryRaw = parsed.searchParams.get("as_of");
-      const bodyHasAsOf = typeof body.asOf === "string" && body.asOf.length > 0;
-      if (!bodyHasAsOf && asOfQueryRaw !== null && asOfQueryRaw.length === 0) {
-        throw new EngramAccessInputError(
-          "as_of must be a non-empty timestamp (got empty value)"
-        );
-      }
-      const asOf = body.asOf ?? (asOfQueryRaw !== null && asOfQueryRaw.length > 0 ? asOfQueryRaw : void 0);
-      const bodyHasTagsField = body !== null && typeof body === "object" && "tags" in body;
-      const bodyTagsValue = bodyHasTagsField ? body.tags : void 0;
-      const bodyTags = Array.isArray(bodyTagsValue) ? bodyTagsValue : void 0;
-      const queryTags = parsed.searchParams.getAll("tag");
-      const tags = bodyHasTagsField ? bodyTags : queryTags.length > 0 ? queryTags : void 0;
-      const bodyTagMatch = body.tagMatch;
-      let tagMatch;
-      if (bodyTagMatch !== void 0) {
-        if (bodyTagMatch === "any" || bodyTagMatch === "all") {
-          tagMatch = bodyTagMatch;
-        }
-      } else {
-        const queryTagMatch = parsed.searchParams.get("tag_match");
-        if (queryTagMatch !== null) {
-          if (queryTagMatch !== "any" && queryTagMatch !== "all") {
-            throw new EngramAccessInputError(
-              `tag_match must be one of: any, all (got: ${queryTagMatch})`
-            );
-          }
-          tagMatch = queryTagMatch;
-        }
-      }
-      const bodyIncludeLowConfidence = body.includeLowConfidence;
-      const queryIncludeLowConfidence = parsed.searchParams.get("include_low_confidence");
-      if (bodyIncludeLowConfidence === void 0 && queryIncludeLowConfidence !== null && queryIncludeLowConfidence !== "true" && queryIncludeLowConfidence !== "false") {
-        throw new EngramAccessInputError(
-          `include_low_confidence must be one of: true, false (got: ${queryIncludeLowConfidence})`
-        );
-      }
-      const includeLowConfidence = bodyIncludeLowConfidence === true || bodyIncludeLowConfidence === void 0 && queryIncludeLowConfidence === "true";
-      const op = getOperation("recall");
-      if (!op) {
-        throw new EngramAccessInputError("access-boundary: operation not registered: recall");
-      }
-      const output = await op.run(
-        {
-          ...body,
-          namespace: this.resolveNamespace(req, body.namespace),
-          ...disclosure !== void 0 ? { disclosure } : {},
-          ...asOf !== void 0 ? { asOf } : {},
-          ...tags !== void 0 ? { tags } : {},
-          ...tagMatch !== void 0 ? { tagMatch } : {},
-          ...includeLowConfidence ? { includeLowConfidence: true } : {}
-        },
-        {
-          service: this.service,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          sourceConnector: this.resolveConnector(req),
-          ...abortSignal ? { abortSignal } : {}
-        }
-      );
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/coding-context") {
-      this.enforceTokenOp("set_coding_context");
-      const body = await this.readValidatedBody(req, "setCodingContext");
-      const codingContext = body.codingContext !== void 0 ? body.codingContext : typeof body.projectTag === "string" ? codingContextFromProjectTag(body.projectTag) : (() => {
-        throw new EngramAccessInputError("codingContext or projectTag is required");
-      })();
-      this.service.setCodingContext({
-        sessionKey: body.sessionKey,
-        codingContext
-      });
-      this.respondJson(res, 200, { ok: true });
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/capsules/export" || pathname === "/remnic/v1/capsules/export")) {
-      this.enforceTokenOp("capsule_export");
-      const body = await this.readValidatedBody(req, "capsuleExport");
-      this.ensureWriteRateLimitAvailable(req);
-      const result = await this.service.capsuleExport({
-        name: body.name,
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        since: body.since,
-        includeKinds: body.includeKinds,
-        peerIds: body.peerIds,
-        includeTranscripts: body.includeTranscripts,
-        encrypt: body.encrypt
-      });
-      this.recordWriteRateLimitHit(req);
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/capsules/import" || pathname === "/remnic/v1/capsules/import")) {
-      this.enforceTokenOp("capsule_import");
-      const body = await this.readValidatedBody(req, "capsuleImport");
-      this.ensureWriteRateLimitAvailable(req);
-      const result = await this.service.capsuleImport({
-        archivePath: expandTildePath(body.archivePath),
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        mode: body.mode,
-        passphrase: body.passphrase
-      });
-      this.recordWriteRateLimitHit(req);
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/capabilities" || pathname === "/remnic/v1/offline-sync/capabilities")) {
-      this.enforceTokenOp("offline_sync_snapshot");
-      this.respondJson(res, 200, {
-        version: 1,
-        convergenceFinalization: true,
-        manifestStream: true,
-        manifestRevision: peerManifestRevision(this.service.configRef?.inlineSourceAttributionFormat)
-      });
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
-      this.enforceTokenOp("offline_sync_snapshot");
-      const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
-      const includeContentRaw = parsed.searchParams.get("content");
-      if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
-        throw new EngramAccessInputError(
-          `include_transcripts must be one of: true, false (got: ${includeTranscriptsRaw})`
-        );
-      }
-      if (includeContentRaw !== null && includeContentRaw !== "true" && includeContentRaw !== "false") {
-        throw new EngramAccessInputError(
-          `content must be one of: true, false (got: ${includeContentRaw})`
-        );
-      }
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const result = await this.service.offlineSyncSnapshot({
-        namespace: this.resolveNamespace(
-          req,
-          namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-        ),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: includeTranscriptsRaw !== "false",
-        includeContent: includeContentRaw !== "false"
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/snapshot-stream" || pathname === "/remnic/v1/offline-sync/snapshot-stream")) {
-      this.enforceTokenOp("offline_sync_snapshot_stream");
-      const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
-      const includeContentRaw = parsed.searchParams.get("content");
-      if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
-        throw new EngramAccessInputError(
-          `include_transcripts must be one of: true, false (got: ${includeTranscriptsRaw})`
-        );
-      }
-      if (includeContentRaw !== null && includeContentRaw !== "false") {
-        throw new EngramAccessInputError("snapshot-stream content must be false");
-      }
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const result = await this.service.offlineSyncSnapshotStream({
-        namespace: this.resolveNamespace(
-          req,
-          namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-        ),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: includeTranscriptsRaw !== "false",
-        includeContent: false,
-        signal: this.createRequestAbortSignal(req, res)
-      });
-      await respondOfflineSnapshotStream(res, result, correlationIdStore.getStore());
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/manifest-stream" || pathname === "/remnic/v1/offline-sync/manifest-stream")) {
-      this.enforceTokenOp("offline_sync_snapshot_stream");
-      const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
-      const includeContentRaw = parsed.searchParams.get("content");
-      if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
-        throw new EngramAccessInputError(
-          `include_transcripts must be one of: true, false (got: ${includeTranscriptsRaw})`
-        );
-      }
-      if (includeContentRaw !== null && includeContentRaw !== "false") {
-        throw new EngramAccessInputError("manifest-stream content must be false");
-      }
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const result = await this.service.offlineSyncManifestStream({
-        namespace: this.resolveNamespace(
-          req,
-          namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-        ),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: includeTranscriptsRaw !== "false",
-        signal: this.createRequestAbortSignal(req, res)
-      });
-      await respondOfflineManifestStream(res, result, correlationIdStore.getStore());
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
-      this.enforceTokenOp("offline_sync_snapshot");
-      const body = await this.readValidatedBody(
-        req,
-        "offlineSyncSnapshot",
-        OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-      );
-      const result = await this.service.offlineSyncSnapshot({
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: body.includeTranscripts,
-        includeContent: body.includeContent,
-        baseFiles: body.baseFiles,
-        ...body.baseCapturedAt ? { baseCapturedAt: new Date(body.baseCapturedAt) } : {},
-        signal: this.createRequestAbortSignal(req, res)
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/files" || pathname === "/remnic/v1/offline-sync/files")) {
-      this.enforceTokenOp("offline_sync_files");
-      const body = await this.readValidatedBody(req, "offlineSyncFiles");
-      const result = await this.service.offlineSyncFiles({
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: body.includeTranscripts,
-        paths: body.paths
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/file-content" || pathname === "/remnic/v1/offline-sync/file-content")) {
-      this.enforceTokenOp("offline_sync_file_content");
-      const body = await this.readValidatedBody(req, "offlineSyncFileContent");
-      const result = await this.service.offlineSyncFileContent({
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: body.includeTranscripts,
-        path: body.path,
-        offset: body.offset,
-        length: body.length
-      });
-      this.respondBinary(res, 200, result.content, {
-        "x-remnic-namespace": encodeURIComponent(result.namespace),
-        "x-remnic-file-path": encodeURIComponent(result.path),
-        "x-remnic-file-bytes": String(result.bytes),
-        "x-remnic-file-mtime-ms": String(result.mtimeMs),
-        "x-remnic-chunk-offset": String(result.offset),
-        "x-remnic-chunk-bytes": String(result.chunkBytes),
-        ...result.sha256 ? { "x-remnic-file-sha256": result.sha256 } : {}
-      });
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/apply-file-content" || pathname === "/remnic/v1/offline-sync/apply-file-content")) {
-      this.enforceTokenOp("offline_sync_apply_file_content");
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const bytes = this.readRequiredIntegerHeader(req, "x-remnic-file-bytes");
-      const offset = this.readOptionalIntegerHeader(req, "x-remnic-chunk-offset") ?? 0;
-      const content = await this.readBinaryBody(req, OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES);
-      const result = await this.service.offlineSyncApplyFileContent({
-        namespace: this.resolveNamespace(
-          req,
-          namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-        ),
-        principal: this.resolveRequestPrincipal(req),
-        includeTranscripts: this.parseOptionalBooleanHeader(
-          req,
-          "x-remnic-include-transcripts",
-          true
-        ),
-        sourceId: this.readRequiredDecodedHeader(req, "x-remnic-source-id"),
-        path: this.readRequiredDecodedHeader(req, "x-remnic-file-path"),
-        sha256: this.readRequiredHeader(req, "x-remnic-file-sha256"),
-        bytes,
-        mtimeMs: this.readRequiredNumberHeader(req, "x-remnic-file-mtime-ms"),
-        offset,
-        baseSha256: this.readOptionalHeader(req, "x-remnic-base-sha256"),
-        content
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/convergence-complete" || pathname === "/remnic/v1/offline-sync/convergence-complete")) {
-      void getOperation("offline_sync_apply_file_content");
-      this.enforceTokenAnyOf(["offline_sync_apply_file_content", "offline_sync_apply"]);
-      const namespaceParams = parsed.searchParams.getAll("namespace").filter(Boolean);
-      const requestedNamespaces = namespaceParams.length > 0 ? namespaceParams : [void 0];
-      const namespaces = requestedNamespaces.map((namespace) => this.resolveNamespace(req, namespace)).filter((namespace) => namespace !== void 0);
-      this.ensureWriteRateLimitAvailable(req);
-      const result = await this.service.offlineSyncFinalizeConvergence({
-        ...namespaces.length > 0 ? { namespaces } : {},
-        principal: this.resolveRequestPrincipal(req),
-        sourceId: this.readRequiredDecodedHeader(req, "x-remnic-source-id")
-      });
-      this.recordWriteRateLimitHit(req);
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/apply" || pathname === "/remnic/v1/offline-sync/apply")) {
-      this.enforceTokenOp("offline_sync_apply");
-      const body = await this.readValidatedBody(req, "offlineSyncApply", OFFLINE_SYNC_APPLY_MAX_BODY_BYTES);
-      const result = await this.service.offlineSyncApply({
-        namespace: this.resolveNamespace(req, body.namespace),
-        principal: this.resolveRequestPrincipal(req),
-        changeset: body.changeset,
-        returnCurrentFiles: body.returnCurrentFiles
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/recall/explain") {
-      this.enforceTokenOp("recall_explain");
-      const body = await this.readValidatedBody(req, "recallExplain");
-      const response = await this.service.recallExplain({
-        sessionKey: body.sessionKey,
-        namespace: this.resolveNamespace(req, body.namespace),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/action-confidence" || pathname === "/remnic/v1/action-confidence")) {
-      this.enforceTokenOp("action_confidence");
-      const body = await this.readValidatedBody(req, "actionConfidence");
-      this.respondJson(res, 200, await this.service.actionConfidence(body));
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/recall/tier-explain") {
-      this.enforceTokenOp("recall_tier_explain");
-      const sessionParam = parsed.searchParams.get("session");
-      const sessionKey = sessionParam && sessionParam.length > 0 ? sessionParam : void 0;
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const namespace = this.resolveNamespace(
-        req,
-        namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-      );
-      const payload = await this.service.recallTierExplain(sessionKey, namespace, this.resolveRequestPrincipal(req));
-      this.respondJson(res, 200, payload);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/recall/xray") {
-      this.enforceTokenOp("recall_xray");
-      const outcome = await handleRecallXrayHttpQuery({
-        getParam: (name) => parsed.searchParams.get(name),
-        resolveNamespace: (namespace) => this.resolveNamespace(req, namespace),
-        principal: this.resolveRequestPrincipal(req),
-        connector: this.resolveConnector(req),
-        run: (request) => this.service.recallXray(request)
-      });
-      this.respondJson(res, outcome.status, outcome.body);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/recall/why" || pathname === "/remnic/v1/recall/why")) {
-      this.enforceTokenOp("recall_why");
-      const outcome = await handleRecallWhyHttpQuery({
-        getParam: (name) => parsed.searchParams.get(name),
-        resolveNamespace: (namespace) => this.resolveNamespace(req, namespace),
-        principal: this.resolveRequestPrincipal(req),
-        connector: this.resolveConnector(req),
-        run: (request) => this.service.recallWhy(request)
-      });
-      this.respondJson(res, outcome.status, outcome.body);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/who-knows" || pathname === "/remnic/v1/who-knows")) {
-      this.enforceTokenOp("who_knows");
-      const outcome = await handleWhoKnowsHttpQuery({
-        getParam: (name) => parsed.searchParams.get(name),
-        resolveNamespace: (namespace) => this.resolveNamespace(req, namespace),
-        principal: this.resolveRequestPrincipal(req),
-        run: (request) => this.service.whoKnows(request)
-      });
-      this.respondJson(res, outcome.status, outcome.body);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/namespace/writable") {
-      if (!getOperation("namespace_writable")) throw new Error("namespace_writable operation is not registered");
-      this.respondJson(
-        res,
-        200,
-        await resolveQueryNamespaceWritablePreflight(
-          tokenCapabilityStore.getStore(),
-          parsed.searchParams,
-          this.resolveRequestPrincipal(req),
-          this.service.configRef.defaultNamespace,
-          (request) => this.service.namespaceWritablePreflight(request)
-        )
-      );
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/wearables/status" || pathname === "/remnic/v1/wearables/status")) {
-      this.enforceTokenOp("wearables_status");
-      this.respondJson(res, 200, await this.service.wearablesStatus(this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0)));
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/wearables/sync" || pathname === "/remnic/v1/wearables/sync")) {
-      this.enforceTokenOp("wearables_sync");
-      const body = await this.readJsonBody(req);
-      const source = optionalQueryString(body.source, "source");
-      const date = optionalQueryString(body.date, "date");
-      let days;
-      if (body.days !== void 0 && body.days !== null) {
-        if (typeof body.days !== "number" || !Number.isInteger(body.days) || body.days < 1) {
-          throw new EngramAccessInputError(
-            `days must be a positive integer (got ${JSON.stringify(body.days)})`
-          );
-        }
-        days = body.days;
-      }
-      if (body.forceMemories !== void 0 && typeof body.forceMemories !== "boolean") {
-        throw new EngramAccessInputError(
-          `forceMemories must be a boolean (got ${JSON.stringify(body.forceMemories)})`
-        );
-      }
-      try {
-        const summaries = await this.service.wearablesSync({ source, date, days, forceMemories: body.forceMemories === true, ...this.wearablesScope(req, optionalQueryString(body.namespace, "namespace"), optionalQueryString(body.sessionKey, "sessionKey")) });
-        this.respondJson(res, 200, { summaries });
-      } catch (err) {
-        if (this.respondWearablesError(res, err)) return;
-        throw err;
-      }
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/wearables/transcript" || pathname === "/remnic/v1/wearables/transcript")) {
-      this.enforceTokenOp("transcript_day");
-      const date = parsed.searchParams.get("date");
-      if (!date || date.trim().length === 0) {
-        throw new EngramAccessInputError(
-          "date query parameter is required (YYYY-MM-DD)"
-        );
-      }
-      const sourceParam = parsed.searchParams.get("source");
-      try {
-        const transcripts = await this.service.wearablesTranscriptDay({ date, source: sourceParam && sourceParam.length > 0 ? sourceParam : void 0, ...this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0) });
-        this.respondJson(res, 200, { transcripts });
-      } catch (err) {
-        if (this.respondWearablesError(res, err)) return;
-        throw err;
-      }
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/wearables/transcripts/search" || pathname === "/remnic/v1/wearables/transcripts/search")) {
-      this.enforceTokenOp("transcript_search");
-      const queryParam = parsed.searchParams.get("q");
-      if (!queryParam || queryParam.trim().length === 0) {
-        throw new EngramAccessInputError(
-          "q query parameter is required and must be non-empty"
-        );
-      }
-      try {
-        const results = await this.service.wearablesTranscriptSearch({ query: queryParam, source: nonEmptyQueryParam(parsed.searchParams.get("source")), from: nonEmptyQueryParam(parsed.searchParams.get("from")), to: nonEmptyQueryParam(parsed.searchParams.get("to")), limit: positiveIntQueryParam(parsed.searchParams.get("limit"), "limit"), ...this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0) });
-        this.respondJson(res, 200, { results });
-      } catch (err) {
-        if (this.respondWearablesError(res, err)) return;
-        throw err;
-      }
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/wearables/memories" || pathname === "/remnic/v1/wearables/memories")) {
-      this.enforceTokenOp("transcript_memories");
-      try {
-        const memories = await this.service.wearablesTranscriptMemories({ source: nonEmptyQueryParam(parsed.searchParams.get("source")), date: nonEmptyQueryParam(parsed.searchParams.get("date")), limit: positiveIntQueryParam(parsed.searchParams.get("limit"), "limit"), ...this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0) });
-        this.respondJson(res, 200, { memories });
-      } catch (err) {
-        if (this.respondWearablesError(res, err)) return;
-        throw err;
-      }
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/meetings" || pathname === "/remnic/v1/meetings")) {
-      this.enforceTokenOp("meetings_list");
-      await respondMeetingsList(res, this.respondJson.bind(this), this.service, nonEmptyQueryParam(parsed.searchParams.get("date")), this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0));
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/meetings/build" || pathname === "/remnic/v1/meetings/build")) {
-      this.enforceTokenOp("meetings_build");
-      await respondMeetingsBuild(req, res, this.respondJson.bind(this), this.readJsonBody.bind(this), this.service, { enforceQuota: () => this.ensureWriteRateLimitAvailable(req), recordHit: () => this.recordWriteRateLimitHit(req) }, (ns, sk) => this.wearablesScope(req, ns, sk));
-      return;
-    }
-    const meetingGetEngram = /^\/engram\/v1\/meetings\/([^/]+)$/.exec(pathname);
-    if (req.method === "GET" && meetingGetEngram) {
-      this.enforceTokenOp("meetings_get");
-      await respondMeetingsGet(res, this.respondJson.bind(this), this.service, meetingGetEngram[1] ?? "", this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0));
-      return;
-    }
-    const meetingGetRemnic = /^\/remnic\/v1\/meetings\/([^/]+)$/.exec(pathname);
-    if (req.method === "GET" && meetingGetRemnic) {
-      this.enforceTokenOp("meetings_get");
-      await respondMeetingsGet(res, this.respondJson.bind(this), this.service, meetingGetRemnic[1] ?? "", this.wearablesScope(req, parsed.searchParams.get("namespace") ?? void 0, parsed.searchParams.get("sessionKey") ?? void 0));
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/recall/deep" || pathname === "/remnic/v1/recall/deep")) {
-      this.enforceTokenOp("deep_recall");
-      await respondDeepRecall(req, res, this.respondJson.bind(this), this.readJsonBody.bind(this), this.service, (ns, sk) => this.wearablesScope(req, ns ?? parsed.searchParams.get("namespace") ?? void 0, sk ?? parsed.searchParams.get("sessionKey") ?? void 0), abortSignal);
-      return;
-    }
-    if (await maybeRespondRecallNavigation(req, res, pathname, req.method, (op) => this.enforceTokenOp(op), this.respondJson.bind(this), this.readJsonBody.bind(this), this.service, (ns, sk) => this.wearablesScope(req, ns ?? parsed.searchParams.get("namespace") ?? void 0, sk ?? parsed.searchParams.get("sessionKey") ?? void 0))) return;
-    if (await maybeRespondMemoryBrowse(req, res, pathname, req.method, (op) => this.enforceTokenOp(op), this.respondJson.bind(this), this.readJsonBody.bind(this), this.service, (ns) => this.wearablesScope(req, ns ?? parsed.searchParams.get("namespace") ?? void 0))) return;
-    if (req.method === "GET" && (pathname === "/engram/v1/location/status" || pathname === "/remnic/v1/location/status")) {
-      this.enforceTokenOp("location_status");
-      await respondLocationStatus(res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/location/check" || pathname === "/remnic/v1/location/check")) {
-      this.enforceTokenOp("location_check");
-      await respondLocationCheck(res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/location/sync" || pathname === "/remnic/v1/location/sync")) {
-      this.enforceTokenOp("location_sync");
-      await respondLocationSync(await this.readJsonBody(req), res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "POST" && (pathname === "/engram/v1/location/backfill" || pathname === "/remnic/v1/location/backfill")) {
-      this.enforceTokenOp("location_backfill");
-      await respondLocationBackfill(await this.readJsonBody(req), res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/location/day" || pathname === "/remnic/v1/location/day")) {
-      this.enforceTokenOp("location_day");
-      await respondLocationDay(parsed.searchParams.get("date"), res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "GET" && (pathname === "/engram/v1/standup" || pathname === "/remnic/v1/standup")) {
-      this.enforceTokenOp("standup");
-      await respondStandup(parsed.searchParams.get("date"), res, this.respondJson.bind(this), this.service);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/observe") {
-      this.enforceTokenOp("observe");
-      const body = await this.readValidatedBody(req, "observe");
-      const op = getOperation("observe");
-      if (!op) {
-        throw new EngramAccessInputError("access-boundary: operation not registered: observe");
-      }
-      const output = await op.run(
-        { ...body, namespace: this.resolveNamespace(req, body.namespace) },
-        {
-          service: this.service,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req) },
-          // Phase 1 provenance: server-resolved connector identity from the
-          // bearer token (REST path, mirroring the MCP tools/call dispatch).
-          sourceConnector: this.resolveConnector(req)
-        }
-      );
-      if (this.shouldCountWriteRateLimit(output.result)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, 202, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/lcm/search") {
-      this.enforceTokenOp("lcm_search");
-      const body = await this.readValidatedBody(req, "lcmSearch");
-      const response = await this.service.lcmSearch({
-        query: body.query,
-        sessionKey: body.sessionKey,
-        sessionPrefix: body.sessionPrefix,
-        namespace: this.resolveNamespace(req, body.namespace),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        limit: body.limit
-      });
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (await maybeHandleLifecycleFlush(
-      this.lifecycleFlushDeps(req, res),
-      req.method,
-      pathname,
-      abortSignal
-    )) return;
-    if (req.method === "GET" && pathname === "/engram/v1/lcm/status") {
-      this.enforceTokenOp("lcm_status");
-      this.respondJson(res, 200, await this.service.lcmStatus());
-      return;
-    }
-    const relayEventMatch = /^\/engram\/v1\/relay\/missions\/([^/]+)\/events$/.exec(pathname);
-    if (req.method === "POST" && relayEventMatch) {
-      const missionId = decodeRelayMissionIdSegment(relayEventMatch[1] ?? "");
-      const body = await this.readJsonBody(req);
-      const unexpectedFields = Object.keys(body).filter(
-        (key) => key !== "namespace" && key !== "event"
-      );
-      if (unexpectedFields.length > 0) {
-        throw new EngramAccessInputError(
-          `Relay append body contains unexpected field(s): ${unexpectedFields.sort().join(", ")}`
-        );
-      }
-      if (!Object.prototype.hasOwnProperty.call(body, "event")) {
-        throw new EngramAccessInputError("Relay append body must contain an event object");
-      }
-      if (Object.prototype.hasOwnProperty.call(body, "namespace") && body.namespace !== void 0 && body.namespace !== null && typeof body.namespace !== "string") {
-        throw new EngramAccessInputError("namespace must be a string when provided");
-      }
-      rejectBlankRelayNamespace(
-        typeof body.namespace === "string" ? body.namespace : void 0
-      );
-      const namespace = this.resolveNamespace(
-        req,
-        typeof body.namespace === "string" ? body.namespace : void 0
-      );
-      const op = getOperation("relay_mission_append");
-      if (!op) {
-        throw new Error("access-boundary: operation not registered: relay_mission_append");
-      }
-      let writeQuota;
-      try {
-        const output = await op.run(
-          { missionId, namespace, event: body.event },
-          {
-            service: this.service,
-            authenticatedPrincipal: this.resolveRequestPrincipal(req),
-            hooks: {
-              enforceWriteQuota: () => {
-                writeQuota ??= this.reserveWriteRateLimitSlot(req);
-              }
-            }
-          }
-        );
-        if (output.result.appended) {
-          writeQuota?.commit();
-          writeQuota = void 0;
-        }
-        this.respondJson(res, output.result.appended ? 201 : 200, output.result);
-      } finally {
-        writeQuota?.release();
-      }
-      return;
-    }
-    const relayMissionMatch = /^\/engram\/v1\/relay\/missions\/([^/]+)$/.exec(pathname);
-    if (req.method === "GET" && relayMissionMatch) {
-      const missionId = decodeRelayMissionIdSegment(relayMissionMatch[1] ?? "");
-      rejectBlankRelayNamespace(parsed.searchParams.get("namespace"));
-      const namespace = this.resolveNamespace(
-        req,
-        parsed.searchParams.get("namespace") ?? void 0
-      );
-      const op = getOperation("relay_mission_read");
-      if (!op) {
-        throw new Error("access-boundary: operation not registered: relay_mission_read");
-      }
-      const authenticatedPrincipal = this.resolveRequestPrincipal(req)?.trim() || void 0;
-      const output = await op.run(
-        {
-          missionId,
-          namespace,
-          since: parsed.searchParams.get("since") ?? void 0,
-          until: parsed.searchParams.get("until") ?? void 0,
-          limit: parsed.searchParams.get("limit") ?? void 0
-        },
-        {
-          service: this.service,
-          authenticatedPrincipal
-        }
-      );
-      res.setHeader("cache-control", "no-store");
-      if (authenticatedPrincipal !== void 0) {
-        try {
-          res.setHeader("x-remnic-authenticated-principal", encodeURIComponent(authenticatedPrincipal));
-        } catch {
-        }
-      }
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/memories") {
-      const body = await this.readValidatedBody(req, "memoryStore");
-      const envelope = {
-        ...body,
-        namespace: this.resolveNamespace(req, body.namespace)
-      };
-      const op = getOperation("memory_store");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: memory_store");
-      const output = await op.run(envelope, {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        hooks: { enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req) },
-        // Phase 1 provenance: server-resolved connector identity from the
-        // bearer token (REST path, mirroring the MCP tools/call dispatch).
-        sourceConnector: this.resolveConnector(req)
-      });
-      const response = output.result;
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, this.writeResponseStatus(response), response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/coding/decisions") {
-      const body = await this.readJsonBody(req);
-      const isWriteSubcommand = body.subcommand === "record" || body.subcommand === "supersede";
-      if (isWriteSubcommand) {
-        this.ensureWriteRateLimitAvailable(req);
-      }
-      const op = getOperation("coding_decision");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: coding_decision");
-      const output = await op.run(this.gatedBodyNamespace(req, body), {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        sourceConnector: this.resolveConnector(req)
-      });
-      if (isWriteSubcommand) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/coding/architecture") {
-      const body = await this.readJsonBody(req);
-      const isWriteSubcommand = body.subcommand === "refresh";
-      if (isWriteSubcommand) {
-        this.ensureWriteRateLimitAvailable(req);
-      }
-      const op = getOperation("coding_architecture");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: coding_architecture");
-      const output = await op.run(this.gatedBodyNamespace(req, body), {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        sourceConnector: this.resolveConnector(req)
-      });
-      if (isWriteSubcommand) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/coding/delta") {
-      const body = await this.readJsonBody(req);
-      const op = getOperation("coding_delta");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: coding_delta");
-      const output = await op.run(this.gatedBodyNamespace(req, body), {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/briefing") {
-      await respondBriefingHttp({
-        gatedBody: this.gatedBodyNamespace(req, await this.readJsonBody(req)),
-        service: this.service,
-        principal: this.resolveRequestPrincipal(req),
-        respondJson: (status, payload) => this.respondJson(res, status, payload),
-        abortSignal
-      });
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/correction/plan") {
-      this.ensureWriteRateLimitAvailable(req);
-      const body = await this.readJsonBody(req);
-      const op = getOperation("memory_correct_plan");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_plan");
-      const output = await op.run(this.gatedBodyNamespace(req, body), {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        ...abortSignal ? { abortSignal } : {}
-      });
-      this.recordWriteRateLimitHit(req);
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/correction/apply") {
-      this.ensureWriteRateLimitAvailable(req);
-      const body = await this.readJsonBody(req);
-      const op = getOperation("memory_correct_apply");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_apply");
-      const output = await op.run(this.gatedBodyNamespace(req, body), {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      this.recordWriteRateLimitHit(req);
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/correction/pending") {
-      const op = getOperation("correction_pending");
-      if (op) {
-        const output = await op.run(
-          { namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0), sessionKey: parsed.searchParams.get("sessionKey") ?? void 0 },
-          { service: this.service, authenticatedPrincipal: this.resolveRequestPrincipal(req) }
-        );
-        this.respondJson(res, 200, output.result);
-      } else {
-        const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-        const sessionKey = parsed.searchParams.get("sessionKey") ?? void 0;
-        const plans = await this.service.correctionListPending({
-          ...namespace ? { namespace } : {},
-          ...sessionKey ? { sessionKey } : {},
-          principal: this.resolveRequestPrincipal(req)
-        });
-        this.respondJson(res, 200, plans);
-      }
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
-      this.enforceTokenOp("suggestion_submit");
-      const body = await this.readValidatedBody(req, "suggestionSubmit");
-      const request = {
-        schemaVersion: body.schemaVersion,
-        idempotencyKey: body.idempotencyKey,
-        dryRun: body.dryRun === true,
-        sessionKey: body.sessionKey,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        content: body.content,
-        category: body.category,
-        confidence: body.confidence,
-        namespace: this.resolveNamespace(req, body.namespace),
-        tags: body.tags,
-        entityRef: body.entityRef,
-        ttl: body.ttl,
-        sourceReason: body.sourceReason,
-        cwd: body.cwd,
-        projectTag: body.projectTag,
-        // #2829: raw alias spelling retained by the schema transform.
-        ...body.rawCategory !== void 0 ? { rawCategory: body.rawCategory } : {},
-        // Phase 1 provenance: server-resolved connector identity from the
-        // bearer token (REST path, mirroring the MCP tools/call dispatch).
-        sourceConnector: this.resolveConnector(req)
-      };
-      const response = await this.service.suggestionSubmit(request, {
-        enforceWriteQuota: () => this.ensureWriteRateLimitAvailable(req)
-      });
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, this.writeResponseStatus(response), response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/memories") {
-      this.enforceTokenOp("memory_list");
-      const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
-      const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
-      const sort = parseMemorySort(parsed.searchParams.get("sort"));
-      const response = await this.service.memoryBrowse({
-        query: parsed.searchParams.get("q") ?? void 0,
-        status: parsed.searchParams.get("status") ?? void 0,
-        category: parsed.searchParams.get("category") ?? void 0,
-        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        sort,
-        limit,
-        offset
-      });
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/recall/timings") {
-      const op = getOperation("recall_timings");
-      if (!op) {
-        throw new Error("access-boundary: operation not registered: recall_timings");
-      }
-      res.setHeader("cache-control", "no-store");
-      const output = await op.run({}, {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        operatorPrincipal: this.authenticatedPrincipal
-      });
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    const memoryMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)$/);
-    if (req.method === "GET" && memoryMatch) {
-      const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      const sessionKey = this.resolveRequestIdentity(req).sessionKey ?? parsed.searchParams.get("session") ?? parsed.searchParams.get("sessionKey") ?? void 0;
-      const op = getOperation("memory_get");
-      if (!op) {
-        throw new EngramAccessInputError("access-boundary: operation not registered: memory_get");
-      }
-      const output = await op.run(
-        { memoryId, namespace: namespace ?? null, sessionKey: sessionKey ?? null },
-        { service: this.service, authenticatedPrincipal: this.resolveRequestPrincipal(req) }
-      );
-      const response = output.result;
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    const timelineMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)\/timeline$/);
-    if (req.method === "GET" && timelineMatch) {
-      this.enforceTokenOp("memory_timeline");
-      const memoryId = decodeURIComponent(timelineMatch[1] ?? "");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 200, 1);
-      const response = await this.service.memoryTimeline(memoryId, namespace, limit, this.resolveRequestPrincipal(req));
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/entities") {
-      this.enforceTokenOp("entity_list");
-      const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
-      const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
-      const response = await this.service.entityList({
-        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
-        query: parsed.searchParams.get("q") ?? void 0,
-        limit,
-        offset
-      }, this.resolveRequestPrincipal(req));
-      this.respondJson(res, 200, response);
-      return;
-    }
-    const entityMatch = pathname.match(/^\/engram\/v1\/entities\/([^/]+)$/);
-    if (req.method === "GET" && entityMatch) {
-      this.enforceTokenOp("entity_get");
-      const entityName = decodeURIComponent(entityMatch[1] ?? "");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      const response = await this.service.entityGet(entityName, namespace, this.resolveRequestPrincipal(req));
-      this.respondJson(res, response.found ? 200 : 404, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/review-queue") {
-      this.enforceTokenOp("review_queue_list");
-      const response = await this.service.reviewQueue(
-        parsed.searchParams.get("runId") ?? void 0,
-        this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
-        this.resolveRequestPrincipal(req)
-      );
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/maintenance") {
-      this.enforceTokenOp("maintenance_status");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      this.respondJson(res, 200, await this.service.maintenance(namespace, this.resolveRequestPrincipal(req)));
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/quality") {
-      this.enforceTokenOp("quality_status");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      this.respondJson(res, 200, await this.service.quality(namespace, this.resolveRequestPrincipal(req)));
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/trust-zones/status") {
-      this.enforceTokenOp("trust_zones_status");
-      this.respondJson(
-        res,
-        200,
-        await this.service.trustZoneStatus(this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0), this.resolveRequestPrincipal(req))
-      );
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/procedural/stats") {
-      this.enforceTokenOp("procedural_stats");
-      const namespaceParam = parsed.searchParams.get("namespace");
-      this.respondJson(
-        res,
-        200,
-        await this.service.procedureStats(
-          {
-            namespace: this.resolveNamespace(
-              req,
-              namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-            )
-          },
-          this.resolveRequestPrincipal(req)
-        )
-      );
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/trust-zones/records") {
-      this.enforceTokenOp("trust_zones_records");
-      const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 25, 1);
-      const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
-      const response = await this.service.trustZoneBrowse({
-        query: parsed.searchParams.get("q") ?? void 0,
-        zone: parseTrustZoneFilter(parsed.searchParams.get("zone")),
-        kind: parseTrustZoneKindFilter(parsed.searchParams.get("kind")),
-        sourceClass: parseTrustZoneSourceClassFilter(parsed.searchParams.get("sourceClass")),
-        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
-        limit,
-        offset
-      }, this.resolveRequestPrincipal(req));
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/review-disposition") {
-      this.enforceTokenOp("review_disposition");
-      const body = await this.readValidatedBody(req, "reviewDisposition");
-      this.ensureWriteRateLimitAvailable(req);
-      const response = await this.service.reviewDisposition({
-        memoryId: body.memoryId,
-        status: body.status,
-        reasonCode: body.reasonCode,
-        namespace: this.resolveNamespace(req, body.namespace),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, 200, response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/trust-zones/promote") {
-      this.enforceTokenOp("trust_zones_promote");
-      const body = await this.readValidatedBody(req, "trustZonePromote");
-      const dryRun = body.dryRun === true;
-      if (!dryRun) {
-        this.ensureWriteRateLimitAvailable(req);
-      }
-      const response = await this.service.trustZonePromote({
-        recordId: body.recordId,
-        targetZone: body.targetZone,
-        promotionReason: body.promotionReason,
-        recordedAt: body.recordedAt,
-        summary: body.summary,
-        dryRun,
-        namespace: this.resolveNamespace(req, body.namespace),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, response.dryRun ? 200 : 201, response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/trust-zones/demo-seed") {
-      this.enforceTokenOp("trust_zones_demo_seed");
-      const body = await this.readValidatedBody(req, "trustZoneDemoSeed");
-      const dryRun = body.dryRun === true;
-      if (!dryRun) {
-        this.ensureWriteRateLimitAvailable(req);
-      }
-      const response = await this.service.trustZoneDemoSeed({
-        scenario: body.scenario,
-        recordedAt: body.recordedAt,
-        dryRun,
-        namespace: this.resolveNamespace(req, body.namespace),
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      if (this.shouldCountWriteRateLimit(response)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, response.dryRun ? 200 : 201, response);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/v1/citations/observed") {
-      this.enforceTokenOp("citations_observed");
-      const body = await this.readJsonBody(req);
-      if (!body || typeof body !== "object" || Array.isArray(body)) {
-        throw new HttpError(400, "request body must be a JSON object", "invalid_body");
-      }
-      const payload = body;
-      const sessionId = typeof payload.sessionId === "string" ? payload.sessionId : void 0;
-      const namespace = typeof payload.namespace === "string" ? payload.namespace : void 0;
-      const citationsRaw = payload.citations;
-      if (!citationsRaw || typeof citationsRaw !== "object" || Array.isArray(citationsRaw)) {
-        throw new HttpError(400, "citations must be a JSON object with entries and rolloutIds", "invalid_citations");
-      }
-      const citObj = citationsRaw;
-      const entries = [];
-      if (Array.isArray(citObj.entries)) {
-        for (const raw of citObj.entries) {
-          if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-            const e = raw;
-            if (typeof e.path === "string" && typeof e.lineStart === "number" && typeof e.lineEnd === "number") {
-              entries.push({
-                path: e.path,
-                lineStart: e.lineStart,
-                lineEnd: e.lineEnd,
-                note: typeof e.note === "string" ? e.note : ""
-              });
-            }
-          }
-        }
-      }
-      const rolloutIds = [];
-      if (Array.isArray(citObj.rolloutIds)) {
-        for (const id of citObj.rolloutIds) {
-          if (typeof id === "string" && id.length > 0) {
-            rolloutIds.push(id);
-          }
-        }
-      }
-      let matched = 0;
-      let submitted = 0;
-      if (typeof this.service.recordCitationUsage === "function") {
-        const result = await this.service.recordCitationUsage({
-          sessionId,
-          namespace: this.resolveNamespace(req, namespace),
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          entries,
-          rolloutIds
-        });
-        submitted = result.submitted;
-        matched = result.matched;
-      }
-      this.respondJson(res, 200, {
-        ok: true,
-        submitted,
-        matched,
-        entriesReceived: entries.length,
-        rolloutIdsReceived: rolloutIds.length
-      });
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/review/contradictions") {
-      this.enforceTokenOp("review_list");
-      const VALID_FILTERS = /* @__PURE__ */ new Set(["all", "unresolved", "contradicts", "independent", "duplicates", "needs-user"]);
-      const rawFilter = parsed.searchParams.get("filter") ?? "unresolved";
-      if (!VALID_FILTERS.has(rawFilter)) {
-        this.respondJson(res, 400, { error: `Invalid filter '${rawFilter}'. Valid: ${[...VALID_FILTERS].join(", ")}` });
-        return;
-      }
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
-      const principal = this.resolveRequestPrincipal(req);
-      const resolved = await this.service.getReadableStorageForNamespace(namespace, principal);
-      const reviewNamespace = this.service.configRef.namespacesEnabled ? resolved.namespace : void 0;
-      const includeUnscopedForNamespace = Boolean(
-        reviewNamespace && isDefaultReviewNamespace(this.service.configRef.defaultNamespace, namespace, reviewNamespace)
-      );
-      const result = listPairs(this.service.memoryDir, {
-        filter: rawFilter,
-        namespace: reviewNamespace,
-        includeUnscopedForNamespace,
-        limit
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "GET" && pathname.startsWith("/engram/v1/review/contradictions/")) {
-      this.enforceTokenOp("contradiction_detail");
-      const pairId = pathname.split("/").pop() ?? "";
-      const pair = readPair(this.service.memoryDir, pairId);
-      if (!pair) {
-        this.respondJson(res, 404, { error: "pair_not_found" });
-        return;
-      }
-      enforceNamespaceAllowList(
-        tokenCapabilityStore.getStore(),
-        pair.namespace,
-        this.service.configRef?.defaultNamespace
-      );
-      try {
-        await this.service.getReadableStorageForNamespace(pair.namespace, this.resolveRequestPrincipal(req));
-      } catch {
-        this.respondJson(res, 404, { error: "pair_not_found" });
-        return;
-      }
-      this.respondJson(res, 200, pair);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/review/resolve") {
-      this.enforceTokenOp("review_resolve");
-      const body = await this.readJsonBody(req);
-      const pairId = typeof body.pairId === "string" ? body.pairId : "";
-      const verb = typeof body.verb === "string" ? body.verb : "";
-      if (!pairId || !verb) {
-        this.respondJson(res, 400, { error: "pairId and verb are required" });
-        return;
-      }
-      if (!isValidResolutionVerb(verb)) {
-        this.respondJson(res, 400, { error: `Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context` });
-        return;
-      }
-      const targetPair = readPair(this.service.memoryDir, pairId);
-      if (targetPair) {
-        enforceNamespaceAllowList(
-          tokenCapabilityStore.getStore(),
-          targetPair.namespace,
-          this.service.configRef?.defaultNamespace
-        );
-      }
-      const principal = this.resolveRequestPrincipal(req);
-      const result = await executeResolution(this.service.memoryDir, this.service.storageRef, pairId, verb, {
-        mergedMemoryId: typeof body.mergedMemoryId === "string" ? body.mergedMemoryId : void 0,
-        mergedContent: typeof body.mergedContent === "string" ? body.mergedContent : void 0,
-        storageForNamespace: async (namespace) => {
-          const resolved = await this.service.getWritableStorageForNamespace(namespace, principal);
-          return resolved.storage;
-        },
-        // Catalog write touch (issue #1499 sweep): a contradiction merge writes a
-        // new memory directly to the resolved namespace storage, bypassing the
-        // extraction write path. Record it so QMD maintenance / writtenSince
-        // don't miss the write. Best-effort and failure-tolerant.
-        onMergedMemoryWritten: (namespace, storageDir) => {
-        }
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/graph/snapshot") {
-      this.enforceTokenOp("graph_snapshot");
-      const limitRaw = parsed.searchParams.get("limit");
-      let limit;
-      if (limitRaw !== null && limitRaw.length > 0) {
-        const parsedLimit = Number(limitRaw);
-        if (!Number.isFinite(parsedLimit) || !Number.isInteger(parsedLimit) || parsedLimit <= 0) {
-          this.respondJson(res, 400, {
-            error: "invalid_limit",
-            code: "invalid_limit",
-            message: "limit must be a positive integer"
-          });
-          return;
-        }
-        limit = parsedLimit;
-      }
-      const sinceRaw = parsed.searchParams.get("since");
-      let since;
-      if (sinceRaw !== null && sinceRaw.length > 0) {
-        if (!Number.isFinite(Date.parse(sinceRaw))) {
-          this.respondJson(res, 400, {
-            error: "invalid_since",
-            code: "invalid_since",
-            message: "since must be a parseable ISO timestamp"
-          });
-          return;
-        }
-        since = sinceRaw;
-      }
-      const focusNodeIdRaw = parsed.searchParams.get("focusNodeId");
-      const focusNodeId = focusNodeIdRaw && focusNodeIdRaw.length > 0 ? focusNodeIdRaw : void 0;
-      const categoriesRaw = parsed.searchParams.get("categories");
-      let categories;
-      if (categoriesRaw !== null && categoriesRaw.length > 0) {
-        categories = categoriesRaw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
-        if (categories.length === 0) {
-          this.respondJson(res, 400, {
-            error: "invalid_categories",
-            code: "invalid_categories",
-            message: "categories must be a comma-separated list with at least one non-empty value"
-          });
-          return;
-        }
-      }
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const namespace = this.resolveNamespace(
-        req,
-        namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
-      );
-      try {
-        const snapshot = await this.service.graphSnapshot(
-          {
-            namespace,
-            ...limit !== void 0 ? { limit } : {},
-            ...since !== void 0 ? { since } : {},
-            ...focusNodeId !== void 0 ? { focusNodeId } : {},
-            ...categories !== void 0 ? { categories } : {}
-          },
-          this.resolveRequestPrincipal(req)
-        );
-        this.respondJson(res, 200, snapshot);
-      } catch (err) {
-        if (err instanceof Error && err.message.startsWith("graphSnapshot:")) {
-          this.respondJson(res, 400, {
-            error: "invalid_request",
-            code: "invalid_request",
-            message: err.message
-          });
-          return;
-        }
-        throw err;
-      }
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
-      this.enforceTokenOp("contradiction_scan_run");
-      const body = await this.readJsonBody(req);
-      const { runContradictionScan } = await import("./contradiction-scan-P2MHYFVG.js");
-      const principal = this.resolveRequestPrincipal(req);
-      const result = await runContradictionScan({
-        storage: this.service.storageRef,
-        config: this.service.configRef,
-        memoryDir: this.service.memoryDir,
-        embeddingLookupFactory: this.service.embeddingLookupFactoryRef,
-        storageForNamespace: (namespace) => this.service.getWritableStorageForNamespace(namespace, principal),
-        localLlm: this.service.localLlmRef,
-        fallbackLlm: this.service.fallbackLlmRef,
-        namespace: this.resolveNamespace(req, typeof body.namespace === "string" ? body.namespace : void 0)
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/graph/events") {
-      this.enforceTokenOp("graph_events");
-      await this.handleGraphEventsSSE(req, res);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/chat/message") {
-      this.enforceTokenOp("chat_message");
-      const body = await this.readJsonBody(req);
-      const resumeChatSessionId = typeof body.chatSessionId === "string" ? body.chatSessionId : void 0;
-      if (resumeChatSessionId) {
-        await enforceChatSessionNamespace(this.service, resumeChatSessionId);
-      } else {
-        enforceNamespaceAllowList(
-          tokenCapabilityStore.getStore(),
-          void 0,
-          this.service.configRef?.defaultNamespace
-        );
-      }
-      await handleChatMessage(
-        req,
-        res,
-        body,
-        { service: this.service, config: this.service.configRef?.chat, memoryDir: this.service.memoryDir },
-        this.resolveRequestPrincipal(req)
-      );
-      return;
-    }
-    const chatEventsMatch = /^\/engram\/v1\/chat\/events\/([^/]+)$/.exec(pathname);
-    if (req.method === "GET" && chatEventsMatch) {
-      this.enforceTokenOp("chat_events");
-      await enforceChatSessionNamespace(this.service, chatEventsMatch[1] ?? "");
-      await handleChatEventsSSE(
-        req,
-        res,
-        chatEventsMatch[1] ?? "",
-        {
-          service: this.service,
-          config: this.service.configRef?.chat,
-          memoryDir: this.service.memoryDir,
-          // Register the chat-SSE disconnect cleanup with this server's
-          // stop() set so an HTTP shutdown forcibly releases the heartbeat
-          // and transcript subscription even when a lingering client never
-          // emits 'close' (cursor Medium review; mirrors handleGraphEventsSSE
-          // which registers in sseCleanupFns at access-http.ts:2604).
-          registerSseCleanup: (cleanup) => {
-            this.sseCleanupFns.add(cleanup);
-            return () => {
-              this.sseCleanupFns.delete(cleanup);
-            };
-          }
-        },
-        this.resolveRequestPrincipal(req)
-      );
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/console/state") {
-      this.enforceTokenOp("console_state");
-      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
-      const snapshot = await this.service.consoleState(namespace, this.resolveRequestPrincipal(req));
-      this.respondJson(res, 200, snapshot);
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/peers") {
-      const op = getOperation("peer_list");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_list");
-      const output = await op.run({}, {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        sourceConnector: this.resolveConnector(req)
-      });
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    const peerProfileMatch = /^\/engram\/v1\/peers\/([^/]+)\/profile$/.exec(pathname);
-    if (peerProfileMatch) {
-      if (req.method !== "GET") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      const op = getOperation("peer_profile_get");
-      if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_profile_get");
-      const peerId = decodePeerIdSegment(peerProfileMatch[1] ?? "");
-      const output = await op.run({ id: peerId }, {
-        service: this.service,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req),
-        sourceConnector: this.resolveConnector(req)
-      });
-      if (!output.result.found) {
-        this.respondJson(res, 404, { error: "peer_profile_not_found", code: "peer_profile_not_found" });
-        return;
-      }
-      this.respondJson(res, 200, output.result);
-      return;
-    }
-    const peerIdMatch = /^\/engram\/v1\/peers\/([^/]+)$/.exec(pathname);
-    if (peerIdMatch) {
-      const peerId = decodePeerIdSegment(peerIdMatch[1] ?? "");
-      if (req.method === "GET") {
-        const op = getOperation("peer_get");
-        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_get");
-        const output = await op.run({ id: peerId }, {
-          service: this.service,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          sourceConnector: this.resolveConnector(req)
-        });
-        if (!output.result.found) {
-          this.respondJson(res, 404, { error: "peer_not_found", code: "peer_not_found" });
-          return;
-        }
-        this.respondJson(res, 200, output.result);
-        return;
-      }
-      if (req.method === "PUT") {
-        const body = await this.readJsonBody(req);
-        const op = getOperation("peer_set");
-        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_set");
-        for (const field of ["kind", "displayName", "notes"]) {
-          if (body[field] === null) throw new EngramAccessInputError(`${field} must be a string when provided`);
-        }
-        const output = await op.run({
-          id: peerId,
-          kind: body.kind,
-          displayName: body.displayName,
-          notes: body.notes
-        }, {
-          service: this.service,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          sourceConnector: this.resolveConnector(req)
-        });
-        this.respondJson(res, output.result.created ? 201 : 200, output.result);
-        return;
-      }
-      if (req.method === "DELETE") {
-        const forgetParam = parsed.searchParams.get("forget");
-        if (forgetParam === "true") {
-          const body = await this.readJsonBody(req);
-          const confirm = typeof body.confirm === "string" ? body.confirm : "";
-          if (confirm !== "yes") {
-            this.respondJson(res, 400, {
-              error: "confirm_required",
-              code: "confirm_required",
-              message: "DELETE ?forget=true requires { confirm: 'yes' } in the request body"
-            });
-            return;
-          }
-          const op2 = getOperation("peer_forget");
-          if (!op2) throw new EngramAccessInputError("access-boundary: operation not registered: peer_forget");
-          const output2 = await op2.run({ id: peerId, confirm: "yes" }, {
-            service: this.service,
-            authenticatedPrincipal: this.resolveRequestPrincipal(req),
-            sourceConnector: this.resolveConnector(req)
-          });
-          this.respondJson(res, 200, output2.result);
-          return;
-        }
-        const op = getOperation("peer_delete");
-        if (!op) throw new EngramAccessInputError("access-boundary: operation not registered: peer_delete");
-        const output = await op.run({ id: peerId }, {
-          service: this.service,
-          authenticatedPrincipal: this.resolveRequestPrincipal(req),
-          sourceConnector: this.resolveConnector(req)
-        });
-        this.respondJson(res, 200, output.result);
-        return;
-      }
-      this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-      return;
-    }
-    if (req.method === "GET" && pathname === "/engram/v1/dreams/status") {
-      this.enforceTokenOp("dreams_status");
-      const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-UCHHRQ4R.js");
-      const windowHoursRaw = parsed.searchParams.get("windowHours");
-      let windowHours;
-      try {
-        windowHours = normalizeDreamsStatusWindowHours(
-          windowHoursRaw !== null ? Number(windowHoursRaw) : void 0
-        );
-      } catch {
-        this.respondJson(res, 400, { error: "windowHours must be a positive integer" });
-        return;
-      }
-      const namespaceParam = parsed.searchParams.get("namespace");
-      const namespace = this.resolveNamespace(req, namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0);
-      const result = await this.service.dreamsStatus({
-        windowHours,
-        namespace,
-        principal: this.resolveRequestPrincipal(req)
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (req.method === "POST" && pathname === "/engram/v1/dreams/run") {
-      this.enforceTokenOp("dreams_run");
-      const body = await this.readJsonBody(req);
-      const VALID_PHASES = ["lightSleep", "rem", "deepSleep"];
-      const phase = typeof body.phase === "string" ? body.phase : void 0;
-      if (!phase || !VALID_PHASES.includes(phase)) {
-        this.respondJson(res, 400, {
-          error: `phase is required and must be one of: ${VALID_PHASES.join(", ")}`
-        });
-        return;
-      }
-      if ("dryRun" in body && body.dryRun !== void 0 && typeof body.dryRun !== "boolean") {
-        this.respondJson(res, 400, {
-          error: "dryRun must be a boolean when provided"
-        });
-        return;
-      }
-      if ("namespace" in body && body.namespace !== void 0 && typeof body.namespace !== "string") {
-        this.respondJson(res, 400, {
-          error: "namespace must be a string when provided"
-        });
-        return;
-      }
-      const dryRun = body.dryRun === true;
-      const namespace = this.resolveNamespace(req, typeof body.namespace === "string" ? body.namespace : void 0);
-      if (!dryRun) {
-        this.ensureWriteRateLimitAvailable(req);
-      }
-      const result = await this.service.dreamsRun({
-        phase,
-        dryRun,
-        namespace,
-        authenticatedPrincipal: this.resolveRequestPrincipal(req)
-      });
-      if (this.shouldCountWriteRateLimit(result)) {
-        this.recordWriteRateLimitHit(req);
-      }
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (pathname.startsWith("/engram/v1/admin/scope/inspect")) {
-      if (req.method !== "GET" && req.method !== "POST") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      this.requireOperatorToken();
-      const principal = this.resolveRequestPrincipal(req);
-      let sessionKey;
-      let namespaceOverride;
-      let operation;
-      if (req.method === "GET") {
-        sessionKey = parsed.searchParams.get("session") ?? void 0;
-        namespaceOverride = parsed.searchParams.get("namespace") ?? void 0;
-        operation = parsed.searchParams.get("operation") ?? void 0;
-      } else {
-        const body = await this.readJsonBody(req);
-        sessionKey = typeof body.sessionKey === "string" ? body.sessionKey : void 0;
-        namespaceOverride = typeof body.namespace === "string" ? body.namespace : void 0;
-        operation = typeof body.operation === "string" ? body.operation : void 0;
-      }
-      const inspection = await this.service.adminInspectScope({
-        sessionKey: sessionKey && sessionKey.length > 0 ? sessionKey : void 0,
-        namespace: namespaceOverride && namespaceOverride.length > 0 ? namespaceOverride : void 0,
-        principalOverride: principal,
-        operation
-      });
-      this.respondJson(res, 200, inspection);
-      return;
-    }
-    if (pathname === "/engram/v1/admin/namespaces") {
-      if (req.method !== "GET") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      this.requireOperatorToken();
-      const kind = optionalNamespaceKindQueryParam(parsed.searchParams.get("kind"));
-      const discoveredBy = parsed.searchParams.get("discoveredBy");
-      const result = await this.service.adminListNamespaces({
-        ...kind ? { kind } : {},
-        ...discoveredBy ? { discoveredBy } : {}
-      });
-      this.respondJson(res, 200, result);
-      return;
-    }
-    if (pathname === "/engram/v1/admin/maintenance-health") {
-      if (req.method !== "GET") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      this.requireOperatorToken();
-      const report = await this.service.adminMaintenanceHealth();
-      this.respondJson(res, 200, report);
-      return;
-    }
-    if (pathname === "/engram/v1/admin/transcript-audit") {
-      if (req.method !== "GET") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      this.requireOperatorToken();
-      const report = await this.service.adminTranscriptAudit();
-      this.respondJson(res, 200, report);
-      return;
-    }
-    if (pathname === "/engram/v1/admin/promote") {
-      if (req.method !== "POST") {
-        this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
-        return;
-      }
-      this.requireOperatorToken();
-      const body = await this.readJsonBody(req);
-      if (typeof body.sourceMemoryId !== "string" || body.sourceMemoryId.trim().length === 0) {
-        this.respondJson(res, 400, {
-          error: "invalid_request",
-          code: "invalid_request",
-          message: "sourceMemoryId is required"
-        });
-        return;
-      }
-      if (typeof body.reason !== "string" || body.reason.trim().length === 0) {
-        this.respondJson(res, 400, {
-          error: "invalid_request",
-          code: "invalid_request",
-          message: "reason is required for promotion"
-        });
-        return;
-      }
-      if (!Array.isArray(body.targets) || body.targets.length === 0) {
-        this.respondJson(res, 400, {
-          error: "invalid_request",
-          code: "invalid_request",
-          message: "targets must be a non-empty array"
-        });
-        return;
-      }
-      const VALID_TARGETS = ["teamProject", "serverShared", "userProject", "userGlobal", "explicit"];
-      const targets = [];
-      for (const entry of body.targets) {
-        if (typeof entry !== "object" || entry === null || typeof entry.kind !== "string") {
-          this.respondJson(res, 400, {
-            error: "invalid_request",
-            code: "invalid_request",
-            message: "each target must be an object with a 'kind' string"
-          });
-          return;
-        }
-        if (!VALID_TARGETS.includes(entry.kind)) {
-          this.respondJson(res, 400, {
-            error: "invalid_request",
-            code: "invalid_request",
-            message: `target.kind must be one of: ${VALID_TARGETS.join(", ")}`
-          });
-          return;
-        }
-        targets.push({
-          kind: entry.kind,
-          namespace: typeof entry.namespace === "string" ? entry.namespace : void 0
-        });
-      }
-      try {
-        this.ensureWriteRateLimitAvailable(req);
-        const result = await this.service.adminPromoteMemory({
-          sourceMemoryId: body.sourceMemoryId,
-          namespace: typeof body.namespace === "string" ? body.namespace : void 0,
-          principal: this.resolveRequestPrincipal(req),
-          sessionKey: typeof body.sessionKey === "string" ? body.sessionKey : void 0,
-          targets,
-          reason: body.reason
-        });
-        this.recordWriteRateLimitHit(req);
-        this.respondJson(res, 200, result);
-      } catch (err) {
-        if (err instanceof EngramAccessInputError) {
-          this.respondJson(res, 400, {
-            error: "invalid_request",
-            code: "invalid_request",
-            message: err.message
-          });
-          return;
-        }
-        throw err;
-      }
-      return;
-    }
-    this.respondJson(res, 404, { error: "not_found", code: "not_found" });
-  }
-  createRequestAbortSignal(req, res) {
-    const controller = new AbortController();
-    const abort = () => {
-      if (!controller.signal.aborted) controller.abort();
-    };
-    req.once("aborted", abort);
-    res.once("close", () => {
-      if (!res.writableEnded) abort();
-    });
-    return controller.signal;
-  }
-  /**
-   * SSE handler for /engram/v1/graph/events.
-   *
-   * Lifecycle:
-   *  1. Write SSE headers (Content-Type: text/event-stream).
-   *  2. Register this response in `sseClients`.
-   *  3. Resolve the namespace from the request and subscribe to THAT
-   *     namespace's graph event bus (Codex P1: in multi-namespace
-   *     deployments each namespace has its own bus keyed by its storage
-   *     dir — subscribing to the global root leaks events across tenants).
-   *  4. On each event, add to a 200 ms batch; flush batch as a single SSE frame.
-   *  5. Send heartbeat every 25 s.
-   *  6. On client disconnect (req "close"), clean up timers and unsubscribe.
-   *  7. Register the cleanup callback in `sseCleanupFns` so `stop()` can
-   *     release the heartbeat interval and bus subscription even when the
-   *     client never disconnects (Cursor review thread `access-http.ts:232`).
-   */
-  async handleGraphEventsSSE(req, res) {
-    const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
-    const namespaceParam = parsed.searchParams.get("namespace");
-    const namespace = this.resolveNamespace(req, namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0);
-    const principal = this.resolveRequestPrincipal(req);
-    const memoryDir = await this.service.getMemoryDirForNamespace(namespace, principal);
-    res.writeHead(200, {
-      "content-type": "text/event-stream; charset=utf-8",
-      "cache-control": "no-cache, no-store, must-revalidate",
-      "connection": "keep-alive",
-      "x-accel-buffering": "no",
-      // prevent nginx buffering
-      "transfer-encoding": "chunked"
-    });
-    const writeSSE = (payload) => {
-      try {
-        res.write(`data: ${JSON.stringify(payload)}
-
-`);
-      } catch {
-      }
-    };
-    writeSSE({ type: "connected" });
-    this.sseClients.add(res);
-    const flushBatch = () => {
-      const batch = this.ssePendingBatches.get(res);
-      if (!batch || batch.length === 0) return;
-      this.ssePendingBatches.delete(res);
-      this.sseBatchTimers.delete(res);
-      writeSSE({ type: "batch", events: batch });
-    };
-    const unsubscribe = subscribeGraphEvents(memoryDir, (event) => {
-      let batch = this.ssePendingBatches.get(res);
-      if (!batch) {
-        batch = [];
-        this.ssePendingBatches.set(res, batch);
-      }
-      batch.push(event);
-      if (!this.sseBatchTimers.has(res)) {
-        this.sseBatchTimers.set(res, setTimeout(flushBatch, 200));
-      }
-    });
-    const heartbeatInterval = setInterval(() => {
-      writeSSE({ type: "heartbeat" });
-    }, 25e3);
-    const cleanup = () => {
-      clearInterval(heartbeatInterval);
-      const timer = this.sseBatchTimers.get(res);
-      if (timer !== void 0) {
-        clearTimeout(timer);
-        this.sseBatchTimers.delete(res);
-      }
-      this.ssePendingBatches.delete(res);
-      unsubscribe();
-      this.sseClients.delete(res);
-      this.sseCleanupFns.delete(cleanup);
-      try {
-        res.end();
-      } catch {
-      }
-    };
-    this.sseCleanupFns.add(cleanup);
-    req.once("close", cleanup);
-    req.once("error", cleanup);
-  }
-  async handleMcpRequest(req, res, abortSignal) {
-    const headerVersion = req.headers["mcp-protocol-version"];
-    if (typeof headerVersion === "string" && headerVersion.length > 0) {
-      if (!MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(headerVersion)) {
-        this.respondJson(res, 400, {
-          jsonrpc: "2.0",
-          id: null,
-          error: {
-            code: -32e3,
-            message: `unsupported MCP-Protocol-Version: ${headerVersion}; supported: ${MCP_SUPPORTED_PROTOCOL_VERSIONS.join(", ")}`
-          }
-        });
-        return;
-      }
-    }
-    const body = await this.readJsonBody(req);
-    const request = body;
-    const toolName = toDottedRemnicName(typeof request.params?.name === "string" ? request.params.name : "");
-    const toolArgs = request.params?.arguments;
-    const dreamsRunDryRun = (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") && toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && toolArgs.dryRun === true;
-    const memoryActionApplyDryRun = (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply") && toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && toolArgs.dryRun === true;
-    const toolArgsSubcommand = toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && "subcommand" in toolArgs ? toolArgs.subcommand : void 0;
-    const codingDecisionWrite = (toolName === "engram.coding_decision" || toolName === "remnic.coding_decision") && (toolArgsSubcommand === "record" || toolArgsSubcommand === "supersede");
-    const codingArchitectureWrite = (toolName === "engram.coding_architecture" || toolName === "remnic.coding_architecture") && toolArgsSubcommand === "refresh";
-    const CODEGRAPH_WRITE_TOOLS = /* @__PURE__ */ new Set([
-      "engram.codegraph_index",
-      "remnic.codegraph_index",
-      "engram.codegraph_delete_project",
-      "remnic.codegraph_delete_project",
-      "engram.codegraph_ingest_traces",
-      "remnic.codegraph_ingest_traces"
-    ]);
-    const isCodegraphManageAdr = toolName === "engram.codegraph_manage_adr" || toolName === "remnic.codegraph_manage_adr";
-    const codegraphWrite = CODEGRAPH_WRITE_TOOLS.has(toolName) || isCodegraphManageAdr && (toolArgsSubcommand === "record" || toolArgsSubcommand === "supersede");
-    const supportPassportQuotaLimitedWrite = this.isSupportPassportQuotaLimitedWriteTool(toolName);
-    const isMcpWrite = request.method === "tools/call" && (toolName === "engram.memory_store" || toolName === "remnic.memory_store" || toolName === "engram.suggestion_submit" || toolName === "remnic.suggestion_submit" || toolName === "engram.observe" || toolName === "remnic.observe" || toolName === "engram.lcm_compaction_flush" || toolName === "remnic.lcm_compaction_flush" || toolName === "engram.extraction_force_flush" || toolName === "remnic.extraction_force_flush" || toolName === "engram.lcm_compaction_record" || toolName === "remnic.lcm_compaction_record" || toolName === "engram.capsule_export" || toolName === "remnic.capsule_export" || toolName === "engram.capsule_import" || toolName === "remnic.capsule_import" || toolName === "engram.entity_synthesis_run" || toolName === "remnic.entity_synthesis_run" || !dreamsRunDryRun && (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") || !memoryActionApplyDryRun && (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply") || (toolName === "engram.memory_correct_apply" || toolName === "remnic.memory_correct_apply" || toolName === "engram.memory_correct_plan" || toolName === "remnic.memory_correct_plan") || codingDecisionWrite || codingArchitectureWrite || codegraphWrite || supportPassportQuotaLimitedWrite);
-    const observeSelfEnforcesQuota = toolName === "engram.observe" || toolName === "remnic.observe";
-    const extractionForceFlushWrite = toolName === "engram.extraction_force_flush" || toolName === "remnic.extraction_force_flush";
-    let writeRateLimitRecorded = false;
-    let supportPassportQuota;
-    const recordCommittedMcpWrite = extractionForceFlushWrite ? () => {
-      if (writeRateLimitRecorded) return;
-      writeRateLimitRecorded = true;
-      this.recordWriteRateLimitHit(req);
-    } : supportPassportQuotaLimitedWrite ? () => {
-      if (writeRateLimitRecorded) return;
-      writeRateLimitRecorded = true;
-      supportPassportQuota?.commit();
-      supportPassportQuota = void 0;
-    } : void 0;
-    if (isMcpWrite && !observeSelfEnforcesQuota) {
-      if (supportPassportQuotaLimitedWrite) supportPassportQuota = this.reserveWriteRateLimitSlot(req);
-      else this.ensureWriteRateLimitAvailable(req);
-    }
-    const sessionId = (() => {
-      const raw = req.headers["mcp-session-id"];
-      return typeof raw === "string" ? raw.trim() : void 0;
-    })();
-    const mcpCorrelationId = correlationIdStore.getStore() ?? randomUUID();
-    const requestIdentity = this.resolveRequestIdentity(req);
-    if (request.method === "tools/call" && this.mcpServer.toolAcceptsNamespace(toolName)) {
-      const mcpExplicitNamespace = toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && typeof toolArgs.namespace === "string" && toolArgs.namespace.length > 0 ? toolArgs.namespace : void 0;
-      enforceNamespaceAllowList(
-        tokenCapabilityStore.getStore(),
-        mcpExplicitNamespace ?? requestIdentity.namespace,
-        this.service.configRef?.defaultNamespace
-      );
-    }
-    const response = await this.mcpServer.handleRequest(request, {
-      principalOverride: requestIdentity.principal,
-      namespaceOverride: requestIdentity.namespace,
-      sessionKeyOverride: requestIdentity.sessionKey,
-      sessionId,
-      correlationId: mcpCorrelationId,
-      enforceWriteQuota: observeSelfEnforcesQuota ? () => this.ensureWriteRateLimitAvailable(req) : void 0,
-      recordWriteCommit: recordCommittedMcpWrite,
-      sourceConnector: this.resolveConnector(req),
-      abortSignal
-    }).catch((error) => {
-      supportPassportQuota?.release();
-      throw error;
-    });
-    if (isMcpWrite && response !== null) {
-      const result = response.result;
-      const isError = result?.isError === true;
-      const structured = result?.structuredContent;
-      const isRejectedCodegraph = structured?.ok === false;
-      const counts = structured ? this.shouldCountWriteRateLimit(structured) : true;
-      if (!writeRateLimitRecorded && !isError && !isRejectedCodegraph && counts) {
-        if (supportPassportQuota) {
-          supportPassportQuota.commit();
-          supportPassportQuota = void 0;
-        } else {
-          this.recordWriteRateLimitHit(req);
-        }
-        writeRateLimitRecorded = true;
-      }
-    }
-    supportPassportQuota?.release();
-    if (abortSignal.aborted) {
-      throw isAbortError(abortSignal.reason) ? abortSignal.reason : abortError("HTTP client disconnected");
-    }
-    if (response === null) {
-      res.statusCode = 202;
-      res.end();
-      return;
-    }
-    const assignedSessionId = this.mcpServer.popInitSessionId(mcpCorrelationId);
-    if (assignedSessionId) {
-      res.setHeader("mcp-session-id", assignedSessionId);
-    }
-    this.respondJson(res, 200, response);
-  }
-  respondJson(res, status, payload) {
-    const body = JSON.stringify(payload, null, 2);
-    res.statusCode = status;
-    res.setHeader("content-type", "application/json; charset=utf-8");
-    res.setHeader("content-length", String(Buffer.byteLength(body)));
-    const cid = correlationIdStore.getStore();
-    if (cid) {
-      res.setHeader("x-request-id", cid);
-    }
-    res.end(body);
-  }
-  respondBinary(res, status, body, headers = {}) {
-    res.statusCode = status;
-    res.setHeader("content-type", "application/octet-stream");
-    res.setHeader("content-length", String(body.length));
-    for (const [key, value] of Object.entries(headers)) {
-      res.setHeader(key, value);
-    }
-    const cid = correlationIdStore.getStore();
-    if (cid) {
-      res.setHeader("x-request-id", cid);
-    }
-    res.end(body);
-  }
-  async handleAdminConsole(req, res, pathname) {
-    if (req.method !== "GET") return false;
-    if (pathname === "/remnic/ui" || pathname === "/engram/ui") {
-      res.statusCode = 301;
-      res.setHeader("location", pathname + "/");
-      res.end();
-      return true;
-    }
-    if (pathname === "/remnic/ui/relay" || pathname === "/engram/ui/relay") {
-      res.statusCode = 301;
-      res.setHeader("location", pathname + "/");
-      res.end();
-      return true;
-    }
-    if (pathname === "/remnic/ui/" || pathname === "/engram/ui/") {
-      await this.respondAdminConsoleShell(req, res, pathname);
-      return true;
-    }
-    if (pathname === "/remnic/ui/relay/" || pathname === "/engram/ui/relay/") {
-      await this.respondAdminConsoleShell(req, res, pathname, "relay/index.html");
-      return true;
-    }
-    if (pathname === "/remnic/ui/app.js" || pathname === "/engram/ui/app.js") {
-      await this.respondStatic(res, path2.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
-      return true;
-    }
-    const relayAsset = RELAY_ADMIN_CONSOLE_ASSETS.get(pathname.split("/").at(-1) ?? "");
-    const isRelayAsset = pathname.startsWith("/remnic/ui/relay/") || pathname.startsWith("/engram/ui/relay/");
-    if (isRelayAsset && relayAsset && pathname.split("/").length === 5) {
-      const fileName = pathname.split("/").at(-1);
-      if (fileName) {
-        await this.respondStatic(res, path2.join(this.adminConsolePublicDir, "relay", fileName), relayAsset);
-        return true;
-      }
-    }
-    return false;
-  }
-  async respondAdminConsoleShell(req, res, pathname, relativePath = "index.html", allowPrefill = true) {
-    try {
-      let body = await readFile(path2.join(this.adminConsolePublicDir, relativePath), "utf-8");
-      const matched = this.resolveAuthorizedEntry(req, pathname);
-      const canPrefillToken = allowPrefill && this.adminConsolePrefillToken && matched !== null && matched.capabilities === void 0 && this.timingSafeStringEqual(matched.token, this.adminConsolePrefillToken);
-      if (canPrefillToken) {
-        const serializedToken = serializeInlineScriptValue(this.adminConsolePrefillToken);
-        const script = `<script>(function(token,script){const key="__REMNIC_ADMIN_CONSOLE_PREFILL_TOKEN__";const clear=function(){token="";try{delete window[key]}catch{window[key]=""}};window.addEventListener("pagehide",clear,{once:true});window.addEventListener("beforeunload",clear,{once:true});try{if(new URLSearchParams(location.hash.slice(1)).has("secret")){clear();return}Object.defineProperty(window,key,{configurable:true,get:function(){const value=token;clear();return value}})}finally{if(script){script.textContent="";script.remove()}}})(${serializedToken},document.currentScript);</script>`;
-        body = body.includes("</head>") ? body.replace("</head>", `${script}</head>`) : `${script}${body}`;
-        res.setHeader("cache-control", "private, no-store");
-      }
-      res.setHeader("vary", "authorization");
-      res.statusCode = 200;
-      res.setHeader("content-type", "text/html; charset=utf-8");
-      res.setHeader("content-length", String(Buffer.byteLength(body)));
-      res.end(body);
-    } catch {
-      this.respondJson(res, 404, { error: "not_found" });
-    }
-  }
-  async respondStatic(res, filePath, contentType) {
-    try {
-      const body = await readFile(filePath, "utf-8");
-      res.statusCode = 200;
-      res.setHeader("content-type", contentType);
-      res.setHeader("content-length", String(Buffer.byteLength(body)));
-      res.end(body);
-    } catch {
-      this.respondJson(res, 404, { error: "not_found" });
-    }
-  }
-  async readJsonBody(req, maxBodyBytes = this.maxBodyBytes) {
-    const encoding = (this.readOptionalHeader(req, "content-encoding") ?? "identity").toLowerCase();
-    if (encoding !== "identity" && encoding !== "gzip") {
-      throw new HttpError(415, "unsupported_content_encoding", "unsupported_content_encoding");
-    }
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of req) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      total += buffer.length;
-      if (total > maxBodyBytes) {
-        throw new HttpError(413, "request_body_too_large", "request_body_too_large");
-      }
-      chunks.push(buffer);
-    }
-    if (chunks.length === 0) return {};
-    let body = Buffer.concat(chunks, total);
-    if (encoding === "gzip") {
-      try {
-        body = gunzipSync(body, { maxOutputLength: maxBodyBytes });
-      } catch (error) {
-        if (error.code === "ERR_BUFFER_TOO_LARGE") {
-          throw new HttpError(413, "request_body_too_large", "request_body_too_large");
-        }
-        throw new HttpError(400, "invalid_gzip_body", "invalid_gzip_body");
-      }
-      if (body.byteLength > maxBodyBytes) {
-        throw new HttpError(413, "request_body_too_large", "request_body_too_large");
-      }
-    }
-    const raw = body.toString("utf-8").trim();
-    if (raw.length === 0) return {};
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      throw new HttpError(400, "invalid_json", "invalid_json");
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new HttpError(400, "invalid_json_object", "invalid_json_object");
-    }
-    return parsed;
-  }
-  async readBinaryBody(req, maxBytes) {
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of req) {
-      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      total += buffer.length;
-      if (total > maxBytes) {
-        throw new HttpError(413, "request_body_too_large", "request_body_too_large");
-      }
-      chunks.push(buffer);
-    }
-    return Buffer.concat(chunks, total);
-  }
-  readRequiredHeader(req, name) {
-    const value = this.readOptionalHeader(req, name);
-    if (value === void 0 || value.length === 0) {
-      throw new EngramAccessInputError(`${name} header is required`);
-    }
-    return value;
-  }
-  readOptionalHeader(req, name) {
-    const raw = req.headers[name.toLowerCase()];
-    if (Array.isArray(raw)) return raw[0]?.trim() || void 0;
-    return raw?.trim() || void 0;
-  }
-  readRequiredDecodedHeader(req, name) {
-    const raw = this.readRequiredHeader(req, name);
-    try {
-      return decodeURIComponent(raw);
-    } catch {
-      throw new EngramAccessInputError(`${name} header is not valid percent-encoded input`);
-    }
-  }
-  readRequiredIntegerHeader(req, name) {
-    const raw = this.readRequiredHeader(req, name);
-    const parsed = Number(raw);
-    if (!Number.isInteger(parsed) || parsed < 0) {
-      throw new EngramAccessInputError(`${name} header must be a non-negative integer`);
-    }
-    return parsed;
-  }
-  readOptionalIntegerHeader(req, name) {
-    const raw = this.readOptionalHeader(req, name);
-    if (raw === void 0) return void 0;
-    const parsed = Number(raw);
-    if (!Number.isInteger(parsed) || parsed < 0) {
-      throw new EngramAccessInputError(`${name} header must be a non-negative integer`);
-    }
-    return parsed;
-  }
-  readRequiredNumberHeader(req, name) {
-    const raw = this.readRequiredHeader(req, name);
-    const parsed = Number(raw);
-    if (!Number.isFinite(parsed) || parsed < 0) {
-      throw new EngramAccessInputError(`${name} header must be a non-negative finite number`);
-    }
-    return parsed;
-  }
-  parseOptionalBooleanHeader(req, name, defaultValue) {
-    const raw = this.readOptionalHeader(req, name);
-    if (raw === void 0) return defaultValue;
-    if (raw === "true") return true;
-    if (raw === "false") return false;
-    throw new EngramAccessInputError(`${name} header must be one of: true, false`);
-  }
-  lifecycleFlushDeps(req, res) {
-    const readValidatedBody = ((schemaName) => this.readValidatedBody(req, schemaName));
-    return {
-      service: this.service,
-      defaultNamespace: this.service.configRef?.defaultNamespace,
-      enforceTokenOp: (op) => this.enforceTokenOp(op),
-      readValidatedBody,
-      ensureWriteRateLimitAvailable: () => this.ensureWriteRateLimitAvailable(req),
-      resolveNamespace: (namespace) => this.resolveNamespace(req, namespace),
-      resolveRequestPrincipal: () => this.resolveRequestPrincipal(req),
-      recordWriteRateLimitHit: () => this.recordWriteRateLimitHit(req),
-      respondJson: (payload) => this.respondJson(res, 200, payload)
-    };
-  }
-  async readValidatedBody(req, schemaName, maxBodyBytes) {
-    const raw = await this.readJsonBody(req, maxBodyBytes);
-    const result = validateRequest(schemaName, raw);
-    if (!result.success) {
-      throw new HttpError(400, result.error.error, "validation_error", result.error.details);
-    }
-    return result.data;
-  }
-  /**
-   * Build the WWW-Authenticate challenge string for 401 responses.
-   * When `resourceMetadataUrl` is configured, includes the RFC 9728
-   * `resource_metadata` parameter so MCP clients (e.g. ChatGPT) can
-   * discover the OAuth 2.0 protected-resource metadata document.
-   * Otherwise the bare `Bearer` challenge is returned (unchanged).
-   */
-  bearerChallenge() {
-    if (this.resourceMetadataUrl) {
-      return `Bearer resource_metadata="${this.resourceMetadataUrl}"`;
-    }
-    return "Bearer";
-  }
-  isAuthorized(req, pathname) {
-    return this.resolveAuthorizedEntry(req, pathname) !== null;
-  }
-  /**
-   * Per-request cache of the matched token entry (the entry whose token
-   * matched the bearer credential, BEFORE any path-policy check). Pinning
-   * the entry to the first read means authorization, capability
-   * enforcement, and connector provenance all observe the SAME token-store
-   * snapshot — a rotation between the auth check and the write handler can
-   * no longer stamp the wrong connector (PR #1852 race).
-   */
-  matchedEntryCache = /* @__PURE__ */ new WeakMap();
-  /**
-   * Resolve the matched token entry for this request, caching the result so
-   * every downstream consumer (authorization, capability enforcement,
-   * connector provenance) sees the same snapshot entry (PR #1852).
-   */
-  resolveMatchedEntry(req, pathname) {
-    if (this.matchedEntryCache.has(req)) {
-      return this.matchedEntryCache.get(req) ?? null;
-    }
-    const entry = this.computeMatchedEntry(req, pathname);
-    this.matchedEntryCache.set(req, entry);
-    return entry;
-  }
-  /**
-   * Find the entry whose token matches the request's bearer credential.
-   * Static operator tokens (`authToken`/`authTokens`) and the string-token
-   * getter carry no capabilities ⇒ unrestricted. Dynamic entry-based tokens
-   * capture connector identity and capabilities. A corrupt or unreadable
-   * token store returns null rather than propagating an error — provenance
-   * must never block an already-authenticated request.
-   */
-  computeMatchedEntry(req, pathname) {
-    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter && !this.authTokenEntriesGetter) {
-      return null;
-    }
-    const raw = req.headers.authorization;
-    let candidate = null;
-    if (raw) {
-      const separator = raw.indexOf(" ");
-      if (separator > 0) {
-        const scheme = raw.slice(0, separator).toLowerCase();
-        if (scheme === "bearer") {
-          candidate = raw.slice(separator + 1).trim();
-        }
-      }
-    }
-    if (!candidate && pathname === "/engram/v1/graph/events") {
-      try {
-        const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
-        const queryToken = parsed.searchParams.get("token");
-        if (queryToken && queryToken.length > 0) {
-          candidate = queryToken;
-        }
-      } catch {
-      }
-    }
-    if (!candidate) return null;
-    const token = candidate;
-    if (this.authToken && this.timingSafeStringEqual(token, this.authToken)) {
-      return { token };
-    }
-    for (const valid of this.authTokens) {
-      if (this.timingSafeStringEqual(token, valid)) return { token: valid };
-    }
-    if (this.authTokenEntriesGetter) {
-      try {
-        for (const entry of this.authTokenEntriesGetter()) {
-          if (!this.timingSafeStringEqual(token, entry.token)) continue;
-          return { token: entry.token, connector: entry.connector, capabilities: entry.capabilities };
-        }
-      } catch {
-      }
-      return null;
-    }
-    if (this.authTokensGetter) {
-      for (const valid of this.authTokensGetter()) {
-        if (this.timingSafeStringEqual(token, valid)) return { token: valid };
-      }
-    }
-    return null;
-  }
-  /**
-   * Resolve the presenting token's entry for an authorized request, or null.
-   * Applies the path-policy gate (if configured) on top of the per-request
-   * cached matched entry so the identity that is authorized is the same one
-   * whose connector later stamps frontmatter. Static operator tokens and the
-   * string-token getter carry no capabilities ⇒ unrestricted.
-   */
-  resolveAuthorizedEntry(req, pathname) {
-    const matched = this.resolveMatchedEntry(req, pathname);
-    if (!matched) return null;
-    if ("connector" in matched && this.tokenPathPolicy) {
-      if (typeof matched.connector !== "string" || matched.connector.length === 0) return null;
-      return this.tokenPathPolicy(matched.connector, pathname) ? matched : null;
-    }
-    return matched;
-  }
-  /**
-   * Resolve the presenting token's capabilities for this request, or
-   * undefined when the token is unrestricted (legacy / static operator /
-   * explicit-unrestricted record). Reads from the per-request cached matched
-   * entry so capabilities come from the same snapshot as authorization and
-   * connector provenance (PR #1852).
-   */
-  resolveTokenCapabilities(req, pathname) {
-    return this.resolveMatchedEntry(req, pathname)?.capabilities;
-  }
-  /**
-   * Enforce the presenting token's ops allow-list for an HTTP route that
-   * dispatches directly to the service (not through the boundary). Reads the
-   * per-request capability context set in `handle`; unrestricted tokens
-   * pass. Throws {@link EngramAccessForbiddenError} (→ 403) when a scoped
-   * token calls a non-permitted op (issue #1837).
-   */
-  enforceTokenOp(op) {
-    void getOperation(op);
-    assertOperationAllowed(tokenCapabilityStore.getStore(), op);
-  }
-  enforceTokenAnyOf(ops) {
-    for (const op of ops) void getOperation(op);
-    const capabilities = tokenCapabilityStore.getStore();
-    if (ops.some((op) => capabilityAllowsOp(capabilities, op))) return;
-    throw new EngramAccessForbiddenError(
-      `token is not permitted to call any required operation: ${ops.join(", ")}`
-    );
-  }
-  /**
-   * Operator/admin routes are unrestricted-only surfaces: a scoped
-   * (least-privileged) token must NOT reach them (issue #1837). Legacy and
-   * explicit-unrestricted tokens pass. Throws EngramAccessForbiddenError (→403).
-   */
-  requireOperatorToken() {
-    if (isCapabilityRestricted(tokenCapabilityStore.getStore())) {
-      throw new EngramAccessForbiddenError(
-        "token is scoped and may not access operator/admin routes"
-      );
-    }
-  }
-  /**
-   * Resolve the connector identity for the request's bearer token (Phase 1
-   * provenance). Reuses the per-request cached matched entry so a token
-   * rotation between the auth check and the write handler cannot stamp the
-   * wrong connector (PR #1852 race). Returns `undefined` for operator-
-   * supplied static tokens or when no entry getter is configured — those
-   * writes are operator-initiated.
-   */
-  resolveConnector(req) {
-    return this.resolveMatchedEntry(req)?.connector;
-  }
-  timingSafeStringEqual(a, b) {
-    const left = this.encodeSecret(a);
-    const right = this.encodeSecret(b);
-    if (!left || !right) return false;
-    return timingSafeEqual(left, right);
-  }
-  encodeSecret(value) {
-    const encoded = Buffer.from(value, "utf-8");
-    if (encoded.length > 1024) return null;
-    const out = Buffer.alloc(2 + 1024);
-    out.writeUInt16BE(encoded.length, 0);
-    encoded.copy(out, 2);
-    return out;
-  }
-  writeResponseStatus(response) {
-    if (response.dryRun === true) return 200;
-    if (response.status === "stored" || response.status === "queued_for_review") return 201;
-    return 200;
-  }
-  /**
-   * Admit a quota-counted write by RESERVING a limiter slot for the request
-   * (issue #3225 C4). A bare hasCapacity check admits N concurrent requests
-   * against the same committed count; the reservation holds in-flight
-   * capacity until the write commits at recordWriteRateLimitHit or the
-   * request ends. Idempotent per request, so a quota hook that fires after
-   * an earlier reservation is a no-op.
-   */
-  ensureWriteRateLimitAvailable(req) {
-    if (!req) {
-      if (!this.writeLimiter.hasCapacity()) {
-        throw new HttpError(429, "write_rate_limited", "write_rate_limited");
-      }
-      return;
-    }
-    if (this.pendingWriteQuotas.has(req)) return;
-    const reservation = this.writeLimiter.reserve(this.principalForRateLimit(req));
-    if (!reservation) {
-      throw new HttpError(429, "write_rate_limited", "write_rate_limited");
-    }
-    this.pendingWriteQuotas.set(req, reservation);
-  }
-  /** Commit a counted write at the durable boundary; consumes the request's reservation. */
-  recordWriteRateLimitHit(req) {
-    const pending = req ? this.pendingWriteQuotas.get(req) : void 0;
-    if (pending && req) {
-      this.pendingWriteQuotas.delete(req);
-      pending.commit();
-      return;
-    }
-    this.writeLimiter.record(this.principalForRateLimit(req));
-  }
-  /** Release an uncommitted reservation after a rejection, failure, or exempt outcome. */
-  releasePendingWriteQuota(req) {
-    const pending = this.pendingWriteQuotas.get(req);
-    if (!pending) return;
-    this.pendingWriteQuotas.delete(req);
-    pending.release();
-  }
-  reserveWriteRateLimitSlot(req) {
-    const reservation = this.writeLimiter.reserve(this.principalForRateLimit(req));
-    if (!reservation) {
-      throw new HttpError(429, "write_rate_limited", "write_rate_limited");
-    }
-    return reservation;
-  }
-  principalForRateLimit(req) {
-    if (!req) return void 0;
-    return this.resolveRequestPrincipal(req) ?? this.resolveConnector(req);
-  }
-  shouldCountWriteRateLimit(response) {
-    return response.dryRun !== true && response.idempotencyReplay !== true;
-  }
-  /** Map wearables validation errors to 400 (body lives in wearables/http-glue.ts). */
-  respondWearablesError(res, err) {
-    return respondWearablesErrorGlue(this.respondJson.bind(this), res, err);
-  }
-};
-
-export {
-  MeetingsInputError,
-  resolveDefaultAdminConsolePublicDir,
-  EngramAccessHttpServer
-};
-//# sourceMappingURL=chunk-DKAA2IHQ.js.map