@remnic/core 9.23.4 → 9.25.0

package/dist/{chunk-AYAROCWD.js → chunk-LLISELSY.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-LMDRGRJ2.js";
 import {
   parseConfig
-} from "./chunk-ZYU7ZFLT.js";
+} from "./chunk-GJJBPI6I.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-AYAROCWD.js.map
+//# sourceMappingURL=chunk-LLISELSY.js.map

package/dist/{chunk-W3BKLKG6.js → chunk-LXKJNUND.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-ZBJMUXZH.js";
 import {
   StorageManager
-} from "./chunk-GCQIMJFH.js";
+} from "./chunk-XTAAG4SQ.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-W3BKLKG6.js.map
+//# sourceMappingURL=chunk-LXKJNUND.js.map

package/dist/{chunk-MMTG3SCJ.js → chunk-M5EPMNS4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SOBJ6NEY.js";
 import {
   summarizeDisclosureTokens
-} from "./chunk-3NAHZQU3.js";
+} from "./chunk-X3SQYAPP.js";
 import {
   summarizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -587,4 +587,4 @@ export {
   renderRecallExplain,
   parseRecallExplainFormat
 };
-//# sourceMappingURL=chunk-MMTG3SCJ.js.map
+//# sourceMappingURL=chunk-M5EPMNS4.js.map

package/dist/{chunk-KYP5FSPG.js → chunk-MNLZGCM2.js}

@@ -1,9 +1,9 @@
-import {
-  runGraphEdgeDecayMaintenanceAcrossNamespaces
-} from "./chunk-W6ROK2KU.js";
 import {
   normalizeDreamsStatusWindowHours
 } from "./chunk-EQWEIIKQ.js";
+import {
+  runGraphEdgeDecayMaintenanceAcrossNamespaces
+} from "./chunk-HNZKVLAN.js";
 import {
   runContradictionScan
 } from "./chunk-BJJAX3IZ.js";
@@ -28,20 +28,20 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-6MFMTNY4.js";
+} from "./chunk-RROMWDDC.js";
 import {
   projectTagProjectId
 } from "./chunk-MQVINOJQ.js";
 import {
   validateBriefingFormat
-} from "./chunk-FPJWQZ35.js";
-import {
-  enforceNamespaceAllowList,
-  tokenCapabilityStore
-} from "./chunk-7AMFUATK.js";
+} from "./chunk-SZN6XVFC.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
+import {
+  enforceNamespaceAllowList,
+  tokenCapabilityStore
+} from "./chunk-MZWSOLMT.js";
 import {
   resolvePrincipal
 } from "./chunk-2H7OEVPO.js";
@@ -484,4 +484,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-KYP5FSPG.js.map
+//# sourceMappingURL=chunk-MNLZGCM2.js.map

package/dist/{chunk-TMX4MBSK.js → chunk-MPDX5QMH.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-GCQIMJFH.js";
+} from "./chunk-XTAAG4SQ.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -118,4 +118,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-TMX4MBSK.js.map
+//# sourceMappingURL=chunk-MPDX5QMH.js.map

package/dist/{chunk-PO5LSKQO.js → chunk-MU7ZHSZE.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-B7RWBZXW.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-CAGPP5NB.js";
+} from "./chunk-NRV4Y3PM.js";
 import {
   normalizeRecallTokens
 } from "./chunk-ZBJMUXZH.js";
@@ -339,4 +339,4 @@ export {
   scoreStitchCandidate,
   stitchCausalChain
 };
-//# sourceMappingURL=chunk-PO5LSKQO.js.map
+//# sourceMappingURL=chunk-MU7ZHSZE.js.map

package/dist/{chunk-7AMFUATK.js → chunk-MZWSOLMT.js}

@@ -114,6 +114,18 @@ function capabilityAllowsOp(caps, op) {
   if (caps?.ops === void 0) return true;
   return caps.ops.includes(op);
 }
+function assertOperationAuthorizationAllowed(caps, operation) {
+  if (operation.allowedByOps && operation.allowedByOps.length > 0) {
+    if (!operation.allowedByOps.some((allowedOperation) => capabilityAllowsOp(caps, allowedOperation))) {
+      throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${operation.name}`);
+    }
+  } else {
+    assertOperationAllowed(caps, operation.name);
+  }
+  if (operation.fleetWide) {
+    assertFleetWideOperationAllowed(caps);
+  }
+}
 function capabilityAllowsNamespace(caps, namespace) {
   if (caps?.namespaces === void 0) return true;
   if (namespace === void 0) return false;
@@ -164,6 +176,7 @@ export {
   validateCapabilitiesForMint,
   isCapabilityRestricted,
   capabilityAllowsOp,
+  assertOperationAuthorizationAllowed,
   capabilityAllowsNamespace,
   assertOperationAllowed,
   assertNamespaceAllowed,
@@ -173,4 +186,4 @@ export {
   assertFleetWideOperationAllowed,
   tokenCapabilityStore
 };
-//# sourceMappingURL=chunk-7AMFUATK.js.map
+//# sourceMappingURL=chunk-MZWSOLMT.js.map

package/dist/chunk-MZWSOLMT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-token-capabilities.ts"],"sourcesContent":["/**\n * Per-token capabilities (issue #1837).\n *\n * A token entry MAY carry an explicit, versioned capabilities record. The\n * record's PRESENCE is mechanically detectable, which is load-bearing for\n * security:\n *\n *   - ABSENT `capabilities` field ⇒ a PRE-FEATURE legacy entry (minted\n *     before this feature). It is UNRESTRICTED — full access — purely for\n *     backward compatibility. This is the ONLY path by which \"full access\"\n *     is granted by omission.\n *\n *   - PRESENT `capabilities` record (always carries a `version` marker) ⇒ a\n *     token minted by the capability-aware path. Even a new token minted\n *     without `--ops`/`--namespaces` records an EXPLICIT unrestricted record\n *     (`{ version: 1 }`) — a deliberate, auditable choice, never an\n *     accidentally-omitted field. Within the record, the two axes follow\n *     absent-vs-present semantics:\n *       * axis ABSENT (e.g. no `ops` key)        ⇒ unrestricted on that axis.\n *       * axis PRESENT and empty (`ops: []`)     ⇒ deny all (fail-closed).\n *       * axis PRESENT and non-empty             ⇒ allow only the listed values.\n *\n * Malformed capability input at mint time (bad version, non-array axes,\n * non-string elements, unknown op names against the catalog, malformed\n * namespace values) is REJECTED — a token is never created from invalid\n * input (rule: invalid input rejected, not defaulted).\n *\n * This module owns the pure capability logic (shape validation, allow-list\n * checks) and the per-request AsyncLocalStorage carrying the presenting\n * token's resolved capabilities down to the access boundary. It imports\n * nothing else in the package except the forbidden-error class, so it can be\n * reused by the token store, the boundary, and the HTTP/MCP surfaces without\n * cycles.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\n\n/** Current capability-record schema version. */\nexport const TOKEN_CAPABILITIES_VERSION = 1 as const;\n\n/**\n * Versioned capabilities record stored on a token entry. Presence of this\n * record (vs. an absent field) is what distinguishes a capability-aware\n * token from a pre-feature legacy entry.\n */\nexport interface TokenCapabilities {\n  readonly version: typeof TOKEN_CAPABILITIES_VERSION;\n  /**\n   * Operations allow-list. `undefined` (key absent) ⇒ unrestricted on this\n   * axis. `[]` ⇒ deny all ops (fail-closed). Non-empty ⇒ allow only listed.\n   */\n  ops?: string[];\n  /**\n   * Namespaces allow-list. `undefined` ⇒ unrestricted. `[]` ⇒ deny all.\n   * Non-empty ⇒ allow only listed.\n   */\n  namespaces?: string[];\n}\n\n/**\n * Namespace value validation. Namespace identifiers are flexible (default,\n * team, self, principal-prefixed, project-prefixed) but must never contain\n * whitespace, path separators, traversal segments, or control characters —\n * such values are malformed at mint time and rejected, never silently\n * coerced.\n */\nconst NAMESPACE_VALUE_MAX_LENGTH = 128;\n// Non-empty, no whitespace, no path separators, no control chars. `.` and\n// `..` are rejected separately so legitimate dotted names (e.g. a domain)\n// remain allowed while traversal is not.\nconst NAMESPACE_VALUE_PATTERN = /^[^\\s\\/\\\\\\x00-\\x1F]+$/;\n\n/** True when `value` is an acceptable namespace allow-list entry. */\nexport function isValidNamespaceValue(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {\n    return false;\n  }\n  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;\n  if (value === \".\" || value === \"..\") return false;\n  return true;\n}\n\nfunction isStringArray(value: unknown): value is unknown[] {\n  return Array.isArray(value) && value.every((v) => typeof v === \"string\");\n}\n\nfunction dedupeSort(values: string[]): string[] {\n  return [...new Set(values)].sort();\n}\n\n/**\n * Parse one axis (ops or namespaces) for PERSISTENCE/LOAD. Returns the\n * cleaned array (deduped, sorted; possibly empty to preserve \"present ⇒\n * fail-closed\") or `undefined` when the key is absent. Throws on a malformed\n * shape (non-array, non-string elements, malformed namespace values). Op\n * validation against the catalog happens only at mint time.\n */\nfunction parseAxis(\n  obj: Record<string, unknown>,\n  key: \"ops\" | \"namespaces\",\n  validateValue: (v: unknown) => boolean,\n  valueLabel: string,\n): string[] | undefined {\n  if (!Object.prototype.hasOwnProperty.call(obj, key)) return undefined;\n  const value = obj[key];\n  if (value === undefined || value === null) return undefined;\n  if (!isStringArray(value)) {\n    throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n  }\n  const cleaned: string[] = [];\n  for (const v of value) {\n    if (typeof v !== \"string\" || v.length === 0) {\n      throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n    }\n    if (!validateValue(v)) {\n      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);\n    }\n    cleaned.push(v);\n  }\n  // Preserve presence: an explicitly empty array stays [] (fail-closed),\n  // NOT coerced to undefined (which would mean unrestricted).\n  return dedupeSort(cleaned);\n}\n\n/**\n * Normalize a capabilities record for PERSISTENCE/LOAD. Returns `undefined`\n * ONLY when the record is entirely absent (a pre-feature legacy entry ⇒\n * unrestricted). When present, an absent/`undefined` `version` is COERCED to\n * the current default (1) — mirroring {@link validateCapabilitiesForMint} — so\n * a record that mint-validated also load-normalizes without a schema throw.\n * An explicitly-present WRONG version (not 1) is still rejected. Throws on a\n * malformed record (non-object, explicitly-wrong version, malformed axes).\n */\nexport function normalizeCapabilities(raw: unknown): TokenCapabilities | undefined {\n  if (raw === undefined || raw === null) return undefined;\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with a version marker\");\n  }\n  const obj = raw as Record<string, unknown>;\n  // Coerce absent/undefined version → 1, mirroring validateCapabilitiesForMint\n  // (version 1 is the only schema version; coercing keeps mint-validated\n  // records reloadable). Only an explicitly-present WRONG version throws.\n  if (obj.version !== undefined && obj.version !== TOKEN_CAPABILITIES_VERSION) {\n    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n  }\n  const ops = parseAxis(obj, \"ops\", () => true, \"operation\");\n  const namespaces = parseAxis(obj, \"namespaces\", isValidNamespaceValue, \"namespace\");\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (ops !== undefined) result.ops = ops;\n  if (namespaces !== undefined) result.namespaces = namespaces;\n  return result;\n}\n\n/**\n * Validate a capabilities record at MINT time. ALWAYS returns a versioned\n * record (never `undefined`) so every newly-minted token carries an explicit\n * capability decision — a new token can never gain full access by OMITTING\n * the field. When `raw` is absent/null, the result is an explicit\n * unrestricted record (`{ version: 1 }`), a deliberate/auditable choice. A\n * present-but-`undefined` (or absent) `version` is coerced to the current\n * default (1); an explicitly-wrong version is rejected. This version rule is\n * identical to {@link normalizeCapabilities} (mint/load symmetry). Rejects\n * unknown op names against the catalog and malformed namespace values;\n * throws a plain Error — the caller must NOT create a token when this throws.\n */\nexport function validateCapabilitiesForMint(\n  raw: unknown,\n  validOps: readonly string[],\n): TokenCapabilities {\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (raw === undefined || raw === null) {\n    return result;\n  }\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with optional ops/namespaces arrays\");\n  }\n  const obj = raw as Record<string, unknown>;\n  if (Object.prototype.hasOwnProperty.call(obj, \"version\") && obj.version !== undefined) {\n    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {\n      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n    }\n  }\n  const validOpSet = new Set(validOps);\n\n  if (Object.prototype.hasOwnProperty.call(obj, \"ops\") && obj.ops !== undefined && obj.ops !== null) {\n    if (!isStringArray(obj.ops)) {\n      throw new Error(\"capabilities ops must be an array of non-empty strings\");\n    }\n    const ops = obj.ops as unknown[];\n    for (const v of ops) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities ops must be an array of non-empty strings\");\n      }\n    }\n    // Reject unknown op names against the catalog (unknown ⇒ reject, never drop).\n    const unknown = ops.filter((op) => typeof op === \"string\" && !validOpSet.has(op));\n    if (unknown.length > 0) {\n      throw new Error(\n        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(\", \")}`,\n      );\n    }\n    // Preserve presence (empty stays [] ⇒ deny all ops).\n    result.ops = dedupeSort(ops as string[]);\n  }\n\n  if (\n    Object.prototype.hasOwnProperty.call(obj, \"namespaces\") &&\n    obj.namespaces !== undefined &&\n    obj.namespaces !== null\n  ) {\n    if (!isStringArray(obj.namespaces)) {\n      throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n    }\n    const namespaces = obj.namespaces as unknown[];\n    for (const v of namespaces) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n      }\n      if (!isValidNamespaceValue(v)) {\n        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);\n      }\n    }\n    result.namespaces = dedupeSort(namespaces as string[]);\n  }\n\n  return result;\n}\n\n/**\n * True when `caps` imposes any restriction (a present record with at least\n * one axis key). `undefined` (legacy / absent record) ⇒ unrestricted. A\n * present `{ version: 1 }` record with no axes ⇒ also unrestricted (but\n * auditable — it is a deliberate new-token decision, not omission).\n */\nexport function isCapabilityRestricted(caps: TokenCapabilities | undefined | null): boolean {\n  if (!caps) return false;\n  return caps.ops !== undefined || caps.namespaces !== undefined;\n}\n\n/**\n * True when `caps` permits `op`.\n *   - record ABSENT (legacy) ⇒ unrestricted (true).\n *   - ops axis ABSENT        ⇒ unrestricted on this axis (true).\n *   - ops axis PRESENT       ⇒ `op` must be listed; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, op: string): boolean {\n  if (caps?.ops === undefined) return true;\n  return caps.ops.includes(op);\n}\n\n/**\n * The operation policy that all access surfaces use to decide whether a token\n * can invoke an operation.\n */\nexport interface OperationAuthorizationPolicy {\n  readonly name: string;\n  readonly allowedByOps?: readonly string[];\n  readonly fleetWide?: boolean;\n}\n\n/**\n * Apply an operation's alternate grant and fleet-wide restrictions without\n * invoking its handler.\n */\nexport function assertOperationAuthorizationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  operation: OperationAuthorizationPolicy,\n): void {\n  if (operation.allowedByOps && operation.allowedByOps.length > 0) {\n    if (!operation.allowedByOps.some((allowedOperation) => capabilityAllowsOp(caps, allowedOperation))) {\n      throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${operation.name}`);\n    }\n  } else {\n    assertOperationAllowed(caps, operation.name);\n  }\n\n  if (operation.fleetWide) {\n    assertFleetWideOperationAllowed(caps);\n  }\n}\n\n/**\n * True when `caps` permits `namespace`.\n *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).\n *   - namespaces axis PRESENT ⇒ `namespace` must be listed; undefined\n *     namespace ⇒ false; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsNamespace(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true;\n  if (namespace === undefined) return false;\n  return caps.namespaces.includes(namespace);\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts ops and\n * `op` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  op: string,\n): void {\n  if (!capabilityAllowsOp(caps, op)) {\n    throw new EngramAccessForbiddenError(\n      `token is not permitted to call operation: ${op}`,\n    );\n  }\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts namespaces\n * and `namespace` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): void {\n  if (!capabilityAllowsNamespace(caps, namespace)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces and this operation requires an explicit namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Resolve the EFFECTIVE namespace an operation runs against: a present,\n * non-empty request namespace wins, otherwise the server default — the same\n * resolution downstream storage applies\n * (`getWritableStorageForNamespace(undefined)` → `defaultNamespace`). Empty\n * strings are treated as absent. Centralized so every invocation surface\n * (HTTP query/body, MCP `tools/call`, id-loaded records, legacy pairs that\n * carry no namespace) applies ONE rule and none can dodge the check by\n * dropping the param. (issue #1850)\n */\nexport function resolveEffectiveNamespace(\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): string | undefined {\n  const normalized = namespace !== undefined && namespace.length > 0 ? namespace : undefined;\n  return normalized ?? defaultNamespace;\n}\n\n/**\n * The single effective-namespace allow-list chokepoint (issues #1837/#1850).\n * Throws {@link EngramAccessForbiddenError} when `caps` carries a namespaces\n * allow-list and the EFFECTIVE namespace (request value OR server default) is\n * not a member. FAIL CLOSED:\n *   - a scoped token whose allow-list does not cover the effective namespace\n *     (explicit OR defaulted) is rejected;\n *   - an absent server default (unconfigured) is also rejected for scoped\n *     tokens, so omitting `?namespace=` can never bypass the allow-list.\n * No-op for unrestricted tokens (no namespaces axis) so legacy/unrestricted\n * behavior is unchanged. Both the HTTP transport (`resolveNamespace`) and the\n * MCP dispatch route through this ONE function so no surface is missed.\n */\nexport function isNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true; // unrestricted token\n  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);\n  return effective !== undefined && caps.namespaces.includes(effective);\n}\n\nexport function enforceNamespaceAllowList(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): void {\n  if (isNamespaceAllowed(caps, namespace, defaultNamespace)) return;\n  throw new EngramAccessForbiddenError(\n    namespace === undefined\n      ? \"token is scoped to specific namespaces; the server default namespace is not permitted — supply an allowed namespace\"\n      : `token is not permitted to access namespace: ${namespace}`,\n  );\n}\n\n/**\n * Fleet-wide / global maintenance operation guard (issue #1850 round 10).\n *\n * A distinct escalation class from the id-addressed routes (round 9) and the\n * param-namespace ops (round 4): some boundary operations inherently run\n * ACROSS ALL namespaces — or against a single global layer (compression\n * guidelines, shared context, compounding) that is not namespace-partitioned\n * — and carry NO `namespace` argument, so the MCP `tools/call` effective-\n * namespace chokepoint ({@link enforceNamespaceAllowList}, which only fires\n * when `toolAcceptsNamespace`) never applies. Without this guard a bearer\n * scoped to ONE tenant could trigger maintenance that mutates state in EVERY\n * namespace (privilege escalation).\n *\n * Fail CLOSED exactly like the other shared guards: a namespace-SCOPED token\n * (namespaces axis present) is rejected; unrestricted / legacy tokens (absent\n * record or no namespaces axis — i.e. cron and internal callers that never\n * bind a capability record) are unaffected. Reuses the EXISTING capability\n * model via {@link capabilityAllowsNamespace} — no new \"all\"/\"*\" scope concept.\n * Must run BEFORE any side effect so a denial never leaks a partial mutation.\n */\nexport function assertFleetWideOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  // capabilityAllowsNamespace returns false for ANY scoped token when the\n  // namespace is undefined (a fleet-wide op has no single namespace), and\n  // true for unrestricted/legacy tokens — exactly the desired policy.\n  if (!capabilityAllowsNamespace(caps, undefined)) {\n    throw new EngramAccessForbiddenError(\n      \"token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token\",\n    );\n  }\n}\n\n/**\n * Per-request AsyncLocalStorage carrying the presenting token's resolved\n * capabilities. The HTTP surface binds the resolved capabilities with\n * `.run(caps, handler)` for the WHOLE authorized request dispatch (NOT\n * `.enterWith()`, which mutates the current async resource and does not\n * reliably isolate the store across the handler's awaits / concurrent\n * requests — risking a fail-open read of undefined mid-handler); the\n * access boundary reads `.getStore()` to enforce the ops allow-list for\n * every boundary operation without each dispatch site threading the value\n * explicitly. Unset (CLI, direct boundary callers, tests) ⇒ undefined ⇒\n * unrestricted (issue #1850 round 7).\n */\nexport const tokenCapabilityStore = new AsyncLocalStorage<TokenCapabilities | undefined>();\n"],"mappings":";;;;;AAmCA,SAAS,yBAAyB;AAI3B,IAAM,6BAA6B;AA4B1C,IAAM,6BAA6B;AAInC,IAAM,0BAA0B;AAGzB,SAAS,sBAAsB,OAAiC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,4BAA4B;AAChG,WAAO;AAAA,EACT;AACA,MAAI,CAAC,wBAAwB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,UAAU,OAAO,UAAU,KAAM,QAAO;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAoC;AACzD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACzE;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AACnC;AASA,SAAS,UACP,KACA,KACA,eACA,YACsB;AACtB,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC5D,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,EAC7E;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,OAAO;AACrB,QAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,IAC7E;AACA,QAAI,CAAC,cAAc,CAAC,GAAG;AACrB,YAAM,IAAI,MAAM,gBAAgB,GAAG,yBAAyB,UAAU,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,IAChG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,SAAO,WAAW,OAAO;AAC3B;AAWO,SAAS,sBAAsB,KAA6C;AACjF,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM;AAIZ,MAAI,IAAI,YAAY,UAAa,IAAI,YAAY,4BAA4B;AAC3E,UAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,EAC9E;AACA,QAAM,MAAM,UAAU,KAAK,OAAO,MAAM,MAAM,WAAW;AACzD,QAAM,aAAa,UAAU,KAAK,cAAc,uBAAuB,WAAW;AAClF,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,OAAW,QAAO,MAAM;AACpC,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,SAAO;AACT;AAcO,SAAS,4BACd,KACA,UACmB;AACnB,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,QAAM,MAAM;AACZ,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,KAAK,IAAI,YAAY,QAAW;AACrF,QAAI,IAAI,YAAY,4BAA4B;AAC9C,YAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ;AAEnC,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,KAAK,KAAK,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAM;AACjG,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,MAAM,IAAI;AAChB,eAAW,KAAK,KAAK;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,wDAAwD;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;AAChF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,wDAAwD,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,IACF;AAEA,WAAO,MAAM,WAAW,GAAe;AAAA,EACzC;AAEA,MACE,OAAO,UAAU,eAAe,KAAK,KAAK,YAAY,KACtD,IAAI,eAAe,UACnB,IAAI,eAAe,MACnB;AACA,QAAI,CAAC,cAAc,IAAI,UAAU,GAAG;AAClC,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa,IAAI;AACvB,eAAW,KAAK,YAAY;AAC1B,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,UAAI,CAAC,sBAAsB,CAAC,GAAG;AAC7B,cAAM,IAAI,MAAM,2DAA2D,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AACA,WAAO,aAAa,WAAW,UAAsB;AAAA,EACvD;AAEA,SAAO;AACT;AAQO,SAAS,uBAAuB,MAAqD;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,QAAQ,UAAa,KAAK,eAAe;AACvD;AAQO,SAAS,mBAAmB,MAA4C,IAAqB;AAClG,MAAI,MAAM,QAAQ,OAAW,QAAO;AACpC,SAAO,KAAK,IAAI,SAAS,EAAE;AAC7B;AAgBO,SAAS,oCACd,MACA,WACM;AACN,MAAI,UAAU,gBAAgB,UAAU,aAAa,SAAS,GAAG;AAC/D,QAAI,CAAC,UAAU,aAAa,KAAK,CAAC,qBAAqB,mBAAmB,MAAM,gBAAgB,CAAC,GAAG;AAClG,YAAM,IAAI,2BAA2B,6CAA6C,UAAU,IAAI,EAAE;AAAA,IACpG;AAAA,EACF,OAAO;AACL,2BAAuB,MAAM,UAAU,IAAI;AAAA,EAC7C;AAEA,MAAI,UAAU,WAAW;AACvB,oCAAgC,IAAI;AAAA,EACtC;AACF;AAQO,SAAS,0BACd,MACA,WACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,KAAK,WAAW,SAAS,SAAS;AAC3C;AAMO,SAAS,uBACd,MACA,IACM;AACN,MAAI,CAAC,mBAAmB,MAAM,EAAE,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,6CAA6C,EAAE;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,uBACd,MACA,WACM;AACN,MAAI,CAAC,0BAA0B,MAAM,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6FACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAYO,SAAS,0BACd,WACA,kBACoB;AACpB,QAAM,aAAa,cAAc,UAAa,UAAU,SAAS,IAAI,YAAY;AACjF,SAAO,cAAc;AACvB;AAeO,SAAS,mBACd,MACA,WACA,kBACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,QAAM,YAAY,0BAA0B,WAAW,gBAAgB;AACvE,SAAO,cAAc,UAAa,KAAK,WAAW,SAAS,SAAS;AACtE;AAEO,SAAS,0BACd,MACA,WACA,kBACM;AACN,MAAI,mBAAmB,MAAM,WAAW,gBAAgB,EAAG;AAC3D,QAAM,IAAI;AAAA,IACR,cAAc,SACV,6HACA,+CAA+C,SAAS;AAAA,EAC9D;AACF;AAsBO,SAAS,gCACd,MACM;AAIN,MAAI,CAAC,0BAA0B,MAAM,MAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,IAAI,kBAAiD;","names":[]}

package/dist/{chunk-JVOA5VDZ.js → chunk-NMGO2HAZ.js}

@@ -1,13 +1,13 @@
 import {
   memoryStoreRequestSchema
-} from "./chunk-M2PG7OTI.js";
+} from "./chunk-P25IPRXP.js";
 import {
   CorrectionContractError,
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-6MFMTNY4.js";
+} from "./chunk-RROMWDDC.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1805,4 +1805,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-JVOA5VDZ.js.map
+//# sourceMappingURL=chunk-NMGO2HAZ.js.map

package/dist/{chunk-CAGPP5NB.js → chunk-NRV4Y3PM.js}

@@ -216,4 +216,4 @@ export {
   getCausalTrajectoryStoreStatus,
   searchCausalTrajectories
 };
-//# sourceMappingURL=chunk-CAGPP5NB.js.map
+//# sourceMappingURL=chunk-NRV4Y3PM.js.map

package/dist/{chunk-H2M4YA6K.js → chunk-NVYCTASB.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-GCQIMJFH.js";
+} from "./chunk-XTAAG4SQ.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
@@ -386,4 +386,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-H2M4YA6K.js.map
+//# sourceMappingURL=chunk-NVYCTASB.js.map

package/dist/{chunk-M2PG7OTI.js → chunk-P25IPRXP.js}

@@ -1,14 +1,9 @@
 import {
   isValidCapsuleSince
-} from "./chunk-VDX2J7OX.js";
+} from "./chunk-KQAFEZQX.js";
 import {
   CAPSULE_ID_PATTERN
 } from "./chunk-WEHSQBFR.js";
-import {
-  ACTION_CONFIDENCE_CONTEXT_READINESS,
-  ACTION_CONFIDENCE_RISK_CATEGORIES,
-  ACTION_CONFIDENCE_RULE_KINDS
-} from "./chunk-Z2YFLXHU.js";
 import {
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_MAX_MTIME_MS
@@ -16,6 +11,11 @@ import {
 import {
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
+import {
+  ACTION_CONFIDENCE_CONTEXT_READINESS,
+  ACTION_CONFIDENCE_RISK_CATEGORIES,
+  ACTION_CONFIDENCE_RULE_KINDS
+} from "./chunk-Z2YFLXHU.js";
 
 // src/access-schema.ts
 import { z } from "zod";
@@ -441,4 +441,4 @@ export {
   actionConfidenceRequestSchema,
   validateRequest
 };
-//# sourceMappingURL=chunk-M2PG7OTI.js.map
+//# sourceMappingURL=chunk-P25IPRXP.js.map

package/dist/{chunk-6MFMTNY4.js → chunk-RROMWDDC.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-AJ7QCSIS.js";
+} from "./chunk-7CPOZH6Y.js";
 import {
   WriteQuarantineStore
 } from "./chunk-PJSK6OJM.js";
@@ -35,10 +35,10 @@ import {
 } from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
-} from "./chunk-MMTG3SCJ.js";
+} from "./chunk-M5EPMNS4.js";
 import {
   estimateRecallTokens
-} from "./chunk-3NAHZQU3.js";
+} from "./chunk-X3SQYAPP.js";
 import {
   buildProposedActions,
   buildQualityScore,
@@ -46,7 +46,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-POHSSW2T.js";
+} from "./chunk-3CDMIR3C.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-ICP53SKG.js";
@@ -75,32 +75,32 @@ import {
 } from "./chunk-EIR5VLIH.js";
 import {
   buildGraphSnapshot
-} from "./chunk-UZGJFIIG.js";
+} from "./chunk-JYIFGGEM.js";
 import {
   wrapWorkLayerContext
 } from "./chunk-EI6V5UXY.js";
 import {
   formatProfileTraceAscii
 } from "./chunk-NLE6TSLG.js";
+import {
+  buildProcedurePersistBody,
+  normalizeProcedureSteps
+} from "./chunk-QDW3E4RD.js";
 import {
   persistExplicitCapture,
   queueExplicitCaptureForReview,
   validateExplicitCaptureInput
 } from "./chunk-IKMAO55B.js";
-import {
-  buildProcedurePersistBody,
-  normalizeProcedureSteps
-} from "./chunk-QDW3E4RD.js";
 import {
   lcmEvidenceIdentity
 } from "./chunk-C37ZRXX7.js";
 import {
   CorpusWatermarkCache,
   computeServiceCorpusWatermarks
-} from "./chunk-XJTYLU6J.js";
+} from "./chunk-W4ZDTHWZ.js";
 import {
   namespaceCollectionName
-} from "./chunk-RSLXMGFP.js";
+} from "./chunk-ZN4UZWMT.js";
 import {
   CrossNamespaceBudget,
   toBudgetWarning
@@ -111,27 +111,31 @@ import {
 import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
-} from "./chunk-CAGPP5NB.js";
+} from "./chunk-NRV4Y3PM.js";
+import {
+  ExtractionLivenessWarnThrottle,
+  computeExtractionLivenessStatus
+} from "./chunk-443XCR34.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-FPJWQZ35.js";
+} from "./chunk-SZN6XVFC.js";
 import {
   parseEntityFile,
   qmdCollectionPathParts,
   qmdResultPathCandidates,
   selfDeps
-} from "./chunk-GCQIMJFH.js";
+} from "./chunk-XTAAG4SQ.js";
 import {
   supersessionKeysForFact
 } from "./chunk-DNHVPZOD.js";
 import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
-} from "./chunk-SCOT5DTA.js";
+} from "./chunk-V25OWXAC.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-EGGE52UU.js";
@@ -167,23 +171,43 @@ import {
   normalizeTags,
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
+import {
+  computeContentHash
+} from "./chunk-W5H6ZRPT.js";
 import {
   createVersion
 } from "./chunk-5VQJBH2G.js";
 import {
-  computeContentHash
-} from "./chunk-W5H6ZRPT.js";
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
+import {
+  expandTildePath
+} from "./chunk-EYIEWJNI.js";
+import {
+  buildHandleIndexForResults,
+  isHandleToken
+} from "./chunk-JAKIDQB2.js";
 import {
   exportCapsule
-} from "./chunk-VDX2J7OX.js";
+} from "./chunk-KQAFEZQX.js";
 import {
-  assertFleetWideOperationAllowed,
-  assertOperationAllowed,
+  OFFLINE_SYNC_SNAPSHOT_FORMAT,
+  applyOfflineSyncChangeset,
+  applyOfflineSyncFileContentChunk,
+  buildOfflineSyncSnapshot,
+  buildOfflineSyncSnapshotForPaths,
+  buildOfflineSyncSnapshotFromBase,
+  compileOfflineSyncExcludeGlobs,
+  iterateOfflineSyncSnapshotFileRecords,
+  readOfflineSyncFileContentChunk
+} from "./chunk-E4OCKU67.js";
+import {
+  assertOperationAuthorizationAllowed,
   capabilityAllowsOp,
   enforceNamespaceAllowList,
   isNamespaceAllowed,
   tokenCapabilityStore
-} from "./chunk-7AMFUATK.js";
+} from "./chunk-MZWSOLMT.js";
 import {
   meetingsBuild,
   meetingsGet,
@@ -197,27 +221,6 @@ import {
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
-import {
-  expandTildePath
-} from "./chunk-EYIEWJNI.js";
-import {
-  OFFLINE_SYNC_SNAPSHOT_FORMAT,
-  applyOfflineSyncChangeset,
-  applyOfflineSyncFileContentChunk,
-  buildOfflineSyncSnapshot,
-  buildOfflineSyncSnapshotForPaths,
-  buildOfflineSyncSnapshotFromBase,
-  compileOfflineSyncExcludeGlobs,
-  iterateOfflineSyncSnapshotFileRecords,
-  readOfflineSyncFileContentChunk
-} from "./chunk-E4OCKU67.js";
-import {
-  buildHandleIndexForResults,
-  isHandleToken
-} from "./chunk-JAKIDQB2.js";
 import {
   defaultNamespaceAtFlatRoot,
   mergeMemorySearchDefaultFallback,
@@ -5046,17 +5049,7 @@ function defineOperation(spec) {
       if (!parseResult.success) {
         throw new EngramAccessInputError(formatZodIssues(parseResult.error));
       }
-      if (spec.allowedByOps && spec.allowedByOps.length > 0) {
-        const store = tokenCapabilityStore.getStore();
-        if (!spec.allowedByOps.some((op) => capabilityAllowsOp(store, op))) {
-          throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${spec.name}`);
-        }
-      } else {
-        assertOperationAllowed(tokenCapabilityStore.getStore(), spec.name);
-      }
-      if (spec.fleetWide) {
-        assertFleetWideOperationAllowed(tokenCapabilityStore.getStore());
-      }
+      assertOperationAuthorizationAllowed(tokenCapabilityStore.getStore(), spec);
       return spec.handler(parseResult.data, ctx);
     }
   };
@@ -8904,6 +8897,7 @@ var EngramAccessService = class {
     }
     return this._accessIdentityContinuitySurface;
   }
+  extractionLivenessWarn = new ExtractionLivenessWarnThrottle();
   get briefingEnabled() {
     return this.orchestrator.config.briefing?.enabled === true;
   }
@@ -9587,6 +9581,7 @@ var EngramAccessService = class {
     const storage = await this.orchestrator.getStorage(resolvedNamespace);
     const searchBackend = this.orchestrator.config.searchBackend ?? "qmd";
     const qmdEnabled = resolveQmdCapabilities(this.orchestrator.config).qmd === true;
+    const extraction = await computeExtractionLivenessStatus(this.orchestrator, this.extractionLivenessWarn);
     let projectionAvailable = false;
     try {
       await stat2(getMemoryProjectionPath(storage.dir));
@@ -9609,6 +9604,7 @@ var EngramAccessService = class {
       ),
       nativeKnowledgeEnabled: this.orchestrator.config.nativeKnowledge?.enabled === true,
       projectionAvailable,
+      extraction,
       corpus: await computeServiceCorpusWatermarks(this.orchestrator, {
         cache: this.corpusWatermarkCache,
         caps: tokenCapabilityStore.getStore()
@@ -12450,4 +12446,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-6MFMTNY4.js.map
+//# sourceMappingURL=chunk-RROMWDDC.js.map