@remnic/core 9.24.0 → 9.25.0

package/src/access-http.test.ts

@@ -2978,3 +2978,79 @@ test("HTTP meetings get returns 400 (not 500) for a malformed percent-encoded id
     await server.stop();
   }
 });
+
+test("HTTP authorization probe verifies requested operation grants without invoking operations (issue #2129)", async () => {
+  const service = {
+    configRef: parseConfig({ memoryDir: "/tmp/remnic-http-authorization-probe", defaultNamespace: "default" }),
+  } as unknown as EngramAccessService;
+  const server = new EngramAccessHttpServer({
+    service,
+    port: 0,
+    authTokenEntriesGetter: () => [
+      {
+        token: "delegate-token",
+        capabilities: { version: 1, ops: ["recall", "observe", "lcm_compaction_flush"] },
+      },
+      { token: "recall-only-token", capabilities: { version: 1, ops: ["recall"] } },
+      { token: "observe-only-token", capabilities: { version: 1, ops: ["observe"] } },
+      {
+        token: "fleet-scoped-token",
+        capabilities: {
+          version: 1,
+          ops: ["continuity_audit_generate"],
+          namespaces: ["default"],
+        },
+      },
+    ],
+    adminConsoleEnabled: false,
+  });
+  const status = await server.start();
+  const probe = (token: string, operations: string[]) => {
+    const query = new URLSearchParams();
+    for (const operation of operations) query.append("op", operation);
+    return fetch(`http://127.0.0.1:${status.port}/engram/v1/authorization?${query}`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+  };
+  const delegateOperations = ["recall", "observe", "lcm_compaction_flush"];
+  try {
+    const authorized = await probe("delegate-token", [...delegateOperations, "recall"]);
+    assert.equal(authorized.status, 200);
+    assert.equal(authorized.headers.get("cache-control"), "no-store");
+    assert.deepEqual(await authorized.json(), { authorized: true, operations: delegateOperations });
+
+    const alternateGrant = await probe("observe-only-token", ["namespace_writable"]);
+    assert.equal(alternateGrant.status, 200);
+    await alternateGrant.text();
+
+    const fleetWide = await probe("fleet-scoped-token", ["continuity_audit_generate"]);
+    assert.equal(fleetWide.status, 403);
+    assert.equal(fleetWide.headers.get("cache-control"), "no-store");
+    await fleetWide.text();
+
+    const denied = await probe("recall-only-token", delegateOperations);
+    assert.equal(
+      denied.status,
+      403,
+      "a token missing any requested operation is rejected without running it",
+    );
+    assert.equal(denied.headers.get("cache-control"), "no-store");
+    await denied.text();
+
+    const wrongToken = await probe("wrong-token", delegateOperations);
+    assert.equal(wrongToken.status, 401);
+    await wrongToken.text();
+
+    const empty = await probe("delegate-token", []);
+    assert.equal(empty.status, 400);
+    assert.equal(empty.headers.get("cache-control"), "no-store");
+    await empty.text();
+
+    const unknown = await probe("delegate-token", ["not_an_operation"]);
+    assert.equal(unknown.status, 400);
+    assert.equal(unknown.headers.get("cache-control"), "no-store");
+    await unknown.text();
+  } finally {
+    await server.stop();
+  }
+});

package/src/access-http.ts

@@ -38,6 +38,7 @@ import {
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { getOperation, type OperationName } from "./access-boundary.js";
+import { probeOperationAuthorization } from "./access-authorization-probe.js";
 import { resolveQueryNamespaceWritablePreflight } from "./access-namespace-preflight.js";
 import {
   assertOperationAllowed,
@@ -889,6 +890,16 @@ export class EngramAccessHttpServer {
       return;
     }
 
+    if (req.method === "GET" && pathname === "/engram/v1/authorization") {
+      res.setHeader("cache-control", "no-store");
+      this.respondJson(
+        res,
+        200,
+        probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op")),
+      );
+      return;
+    }
+
     if (req.method === "GET" && pathname === "/engram/v1/adapters") {
       // Issue #1850 round 5 (finding 1): adapter metadata is served after
       // auth but was NOT op-gated, so a deny-all or narrow-ops token reached

package/src/access-surface-catalog.test.ts

@@ -493,9 +493,9 @@ test("MCP tools/list matches the catalog exactly (no untracked handlers)", async
  * patterns from the source and compares against HTTP_ROUTES so a new
  * service-invoking route cannot land without a catalog entry.
  *
- * Infrastructure routes (health, admin console, UI assets, MCP delegate) are
- * excluded — they carry no user-validated request envelope. (Adapters was
- * migrated into the catalog in issue #1850 round 5.)
+ * Infrastructure routes (health, auth capability probes, admin console, UI
+ * assets, MCP delegate) are excluded — they do not invoke an access-service
+ * method. (Adapters was migrated into the catalog in issue #1850 round 5.)
  */
 test("HTTP handler source routes match the catalog (static completeness)", () => {
   const httpSource = readFileSync(
@@ -534,6 +534,7 @@ test("HTTP handler source routes match the catalog (static completeness)", () =>
 
   const INFRA = [
     /^\/engram\/v1\/health$/,
+    /^\/engram\/v1\/authorization$/,
     /^\/engram\/v1\/admin\//,
     /^\/engram\/ui/,
     /^\/mcp$/,

package/src/access-token-capabilities.ts

@@ -249,6 +249,37 @@ export function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, o
   return caps.ops.includes(op);
 }
 
+/**
+ * The operation policy that all access surfaces use to decide whether a token
+ * can invoke an operation.
+ */
+export interface OperationAuthorizationPolicy {
+  readonly name: string;
+  readonly allowedByOps?: readonly string[];
+  readonly fleetWide?: boolean;
+}
+
+/**
+ * Apply an operation's alternate grant and fleet-wide restrictions without
+ * invoking its handler.
+ */
+export function assertOperationAuthorizationAllowed(
+  caps: TokenCapabilities | undefined | null,
+  operation: OperationAuthorizationPolicy,
+): void {
+  if (operation.allowedByOps && operation.allowedByOps.length > 0) {
+    if (!operation.allowedByOps.some((allowedOperation) => capabilityAllowsOp(caps, allowedOperation))) {
+      throw new EngramAccessForbiddenError(`token is not permitted to call operation: ${operation.name}`);
+    }
+  } else {
+    assertOperationAllowed(caps, operation.name);
+  }
+
+  if (operation.fleetWide) {
+    assertFleetWideOperationAllowed(caps);
+  }
+}
+
 /**
  * True when `caps` permits `namespace`.
  *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).

package/dist/chunk-7AMFUATK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/access-token-capabilities.ts"],"sourcesContent":["/**\n * Per-token capabilities (issue #1837).\n *\n * A token entry MAY carry an explicit, versioned capabilities record. The\n * record's PRESENCE is mechanically detectable, which is load-bearing for\n * security:\n *\n *   - ABSENT `capabilities` field ⇒ a PRE-FEATURE legacy entry (minted\n *     before this feature). It is UNRESTRICTED — full access — purely for\n *     backward compatibility. This is the ONLY path by which \"full access\"\n *     is granted by omission.\n *\n *   - PRESENT `capabilities` record (always carries a `version` marker) ⇒ a\n *     token minted by the capability-aware path. Even a new token minted\n *     without `--ops`/`--namespaces` records an EXPLICIT unrestricted record\n *     (`{ version: 1 }`) — a deliberate, auditable choice, never an\n *     accidentally-omitted field. Within the record, the two axes follow\n *     absent-vs-present semantics:\n *       * axis ABSENT (e.g. no `ops` key)        ⇒ unrestricted on that axis.\n *       * axis PRESENT and empty (`ops: []`)     ⇒ deny all (fail-closed).\n *       * axis PRESENT and non-empty             ⇒ allow only the listed values.\n *\n * Malformed capability input at mint time (bad version, non-array axes,\n * non-string elements, unknown op names against the catalog, malformed\n * namespace values) is REJECTED — a token is never created from invalid\n * input (rule: invalid input rejected, not defaulted).\n *\n * This module owns the pure capability logic (shape validation, allow-list\n * checks) and the per-request AsyncLocalStorage carrying the presenting\n * token's resolved capabilities down to the access boundary. It imports\n * nothing else in the package except the forbidden-error class, so it can be\n * reused by the token store, the boundary, and the HTTP/MCP surfaces without\n * cycles.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\n\n/** Current capability-record schema version. */\nexport const TOKEN_CAPABILITIES_VERSION = 1 as const;\n\n/**\n * Versioned capabilities record stored on a token entry. Presence of this\n * record (vs. an absent field) is what distinguishes a capability-aware\n * token from a pre-feature legacy entry.\n */\nexport interface TokenCapabilities {\n  readonly version: typeof TOKEN_CAPABILITIES_VERSION;\n  /**\n   * Operations allow-list. `undefined` (key absent) ⇒ unrestricted on this\n   * axis. `[]` ⇒ deny all ops (fail-closed). Non-empty ⇒ allow only listed.\n   */\n  ops?: string[];\n  /**\n   * Namespaces allow-list. `undefined` ⇒ unrestricted. `[]` ⇒ deny all.\n   * Non-empty ⇒ allow only listed.\n   */\n  namespaces?: string[];\n}\n\n/**\n * Namespace value validation. Namespace identifiers are flexible (default,\n * team, self, principal-prefixed, project-prefixed) but must never contain\n * whitespace, path separators, traversal segments, or control characters —\n * such values are malformed at mint time and rejected, never silently\n * coerced.\n */\nconst NAMESPACE_VALUE_MAX_LENGTH = 128;\n// Non-empty, no whitespace, no path separators, no control chars. `.` and\n// `..` are rejected separately so legitimate dotted names (e.g. a domain)\n// remain allowed while traversal is not.\nconst NAMESPACE_VALUE_PATTERN = /^[^\\s\\/\\\\\\x00-\\x1F]+$/;\n\n/** True when `value` is an acceptable namespace allow-list entry. */\nexport function isValidNamespaceValue(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {\n    return false;\n  }\n  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;\n  if (value === \".\" || value === \"..\") return false;\n  return true;\n}\n\nfunction isStringArray(value: unknown): value is unknown[] {\n  return Array.isArray(value) && value.every((v) => typeof v === \"string\");\n}\n\nfunction dedupeSort(values: string[]): string[] {\n  return [...new Set(values)].sort();\n}\n\n/**\n * Parse one axis (ops or namespaces) for PERSISTENCE/LOAD. Returns the\n * cleaned array (deduped, sorted; possibly empty to preserve \"present ⇒\n * fail-closed\") or `undefined` when the key is absent. Throws on a malformed\n * shape (non-array, non-string elements, malformed namespace values). Op\n * validation against the catalog happens only at mint time.\n */\nfunction parseAxis(\n  obj: Record<string, unknown>,\n  key: \"ops\" | \"namespaces\",\n  validateValue: (v: unknown) => boolean,\n  valueLabel: string,\n): string[] | undefined {\n  if (!Object.prototype.hasOwnProperty.call(obj, key)) return undefined;\n  const value = obj[key];\n  if (value === undefined || value === null) return undefined;\n  if (!isStringArray(value)) {\n    throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n  }\n  const cleaned: string[] = [];\n  for (const v of value) {\n    if (typeof v !== \"string\" || v.length === 0) {\n      throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n    }\n    if (!validateValue(v)) {\n      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);\n    }\n    cleaned.push(v);\n  }\n  // Preserve presence: an explicitly empty array stays [] (fail-closed),\n  // NOT coerced to undefined (which would mean unrestricted).\n  return dedupeSort(cleaned);\n}\n\n/**\n * Normalize a capabilities record for PERSISTENCE/LOAD. Returns `undefined`\n * ONLY when the record is entirely absent (a pre-feature legacy entry ⇒\n * unrestricted). When present, an absent/`undefined` `version` is COERCED to\n * the current default (1) — mirroring {@link validateCapabilitiesForMint} — so\n * a record that mint-validated also load-normalizes without a schema throw.\n * An explicitly-present WRONG version (not 1) is still rejected. Throws on a\n * malformed record (non-object, explicitly-wrong version, malformed axes).\n */\nexport function normalizeCapabilities(raw: unknown): TokenCapabilities | undefined {\n  if (raw === undefined || raw === null) return undefined;\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with a version marker\");\n  }\n  const obj = raw as Record<string, unknown>;\n  // Coerce absent/undefined version → 1, mirroring validateCapabilitiesForMint\n  // (version 1 is the only schema version; coercing keeps mint-validated\n  // records reloadable). Only an explicitly-present WRONG version throws.\n  if (obj.version !== undefined && obj.version !== TOKEN_CAPABILITIES_VERSION) {\n    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n  }\n  const ops = parseAxis(obj, \"ops\", () => true, \"operation\");\n  const namespaces = parseAxis(obj, \"namespaces\", isValidNamespaceValue, \"namespace\");\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (ops !== undefined) result.ops = ops;\n  if (namespaces !== undefined) result.namespaces = namespaces;\n  return result;\n}\n\n/**\n * Validate a capabilities record at MINT time. ALWAYS returns a versioned\n * record (never `undefined`) so every newly-minted token carries an explicit\n * capability decision — a new token can never gain full access by OMITTING\n * the field. When `raw` is absent/null, the result is an explicit\n * unrestricted record (`{ version: 1 }`), a deliberate/auditable choice. A\n * present-but-`undefined` (or absent) `version` is coerced to the current\n * default (1); an explicitly-wrong version is rejected. This version rule is\n * identical to {@link normalizeCapabilities} (mint/load symmetry). Rejects\n * unknown op names against the catalog and malformed namespace values;\n * throws a plain Error — the caller must NOT create a token when this throws.\n */\nexport function validateCapabilitiesForMint(\n  raw: unknown,\n  validOps: readonly string[],\n): TokenCapabilities {\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (raw === undefined || raw === null) {\n    return result;\n  }\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with optional ops/namespaces arrays\");\n  }\n  const obj = raw as Record<string, unknown>;\n  if (Object.prototype.hasOwnProperty.call(obj, \"version\") && obj.version !== undefined) {\n    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {\n      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n    }\n  }\n  const validOpSet = new Set(validOps);\n\n  if (Object.prototype.hasOwnProperty.call(obj, \"ops\") && obj.ops !== undefined && obj.ops !== null) {\n    if (!isStringArray(obj.ops)) {\n      throw new Error(\"capabilities ops must be an array of non-empty strings\");\n    }\n    const ops = obj.ops as unknown[];\n    for (const v of ops) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities ops must be an array of non-empty strings\");\n      }\n    }\n    // Reject unknown op names against the catalog (unknown ⇒ reject, never drop).\n    const unknown = ops.filter((op) => typeof op === \"string\" && !validOpSet.has(op));\n    if (unknown.length > 0) {\n      throw new Error(\n        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(\", \")}`,\n      );\n    }\n    // Preserve presence (empty stays [] ⇒ deny all ops).\n    result.ops = dedupeSort(ops as string[]);\n  }\n\n  if (\n    Object.prototype.hasOwnProperty.call(obj, \"namespaces\") &&\n    obj.namespaces !== undefined &&\n    obj.namespaces !== null\n  ) {\n    if (!isStringArray(obj.namespaces)) {\n      throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n    }\n    const namespaces = obj.namespaces as unknown[];\n    for (const v of namespaces) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n      }\n      if (!isValidNamespaceValue(v)) {\n        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);\n      }\n    }\n    result.namespaces = dedupeSort(namespaces as string[]);\n  }\n\n  return result;\n}\n\n/**\n * True when `caps` imposes any restriction (a present record with at least\n * one axis key). `undefined` (legacy / absent record) ⇒ unrestricted. A\n * present `{ version: 1 }` record with no axes ⇒ also unrestricted (but\n * auditable — it is a deliberate new-token decision, not omission).\n */\nexport function isCapabilityRestricted(caps: TokenCapabilities | undefined | null): boolean {\n  if (!caps) return false;\n  return caps.ops !== undefined || caps.namespaces !== undefined;\n}\n\n/**\n * True when `caps` permits `op`.\n *   - record ABSENT (legacy) ⇒ unrestricted (true).\n *   - ops axis ABSENT        ⇒ unrestricted on this axis (true).\n *   - ops axis PRESENT       ⇒ `op` must be listed; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, op: string): boolean {\n  if (caps?.ops === undefined) return true;\n  return caps.ops.includes(op);\n}\n\n/**\n * True when `caps` permits `namespace`.\n *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).\n *   - namespaces axis PRESENT ⇒ `namespace` must be listed; undefined\n *     namespace ⇒ false; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsNamespace(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true;\n  if (namespace === undefined) return false;\n  return caps.namespaces.includes(namespace);\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts ops and\n * `op` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  op: string,\n): void {\n  if (!capabilityAllowsOp(caps, op)) {\n    throw new EngramAccessForbiddenError(\n      `token is not permitted to call operation: ${op}`,\n    );\n  }\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts namespaces\n * and `namespace` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): void {\n  if (!capabilityAllowsNamespace(caps, namespace)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces and this operation requires an explicit namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Resolve the EFFECTIVE namespace an operation runs against: a present,\n * non-empty request namespace wins, otherwise the server default — the same\n * resolution downstream storage applies\n * (`getWritableStorageForNamespace(undefined)` → `defaultNamespace`). Empty\n * strings are treated as absent. Centralized so every invocation surface\n * (HTTP query/body, MCP `tools/call`, id-loaded records, legacy pairs that\n * carry no namespace) applies ONE rule and none can dodge the check by\n * dropping the param. (issue #1850)\n */\nexport function resolveEffectiveNamespace(\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): string | undefined {\n  const normalized = namespace !== undefined && namespace.length > 0 ? namespace : undefined;\n  return normalized ?? defaultNamespace;\n}\n\n/**\n * The single effective-namespace allow-list chokepoint (issues #1837/#1850).\n * Throws {@link EngramAccessForbiddenError} when `caps` carries a namespaces\n * allow-list and the EFFECTIVE namespace (request value OR server default) is\n * not a member. FAIL CLOSED:\n *   - a scoped token whose allow-list does not cover the effective namespace\n *     (explicit OR defaulted) is rejected;\n *   - an absent server default (unconfigured) is also rejected for scoped\n *     tokens, so omitting `?namespace=` can never bypass the allow-list.\n * No-op for unrestricted tokens (no namespaces axis) so legacy/unrestricted\n * behavior is unchanged. Both the HTTP transport (`resolveNamespace`) and the\n * MCP dispatch route through this ONE function so no surface is missed.\n */\nexport function isNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true; // unrestricted token\n  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);\n  return effective !== undefined && caps.namespaces.includes(effective);\n}\n\nexport function enforceNamespaceAllowList(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): void {\n  if (isNamespaceAllowed(caps, namespace, defaultNamespace)) return;\n  throw new EngramAccessForbiddenError(\n    namespace === undefined\n      ? \"token is scoped to specific namespaces; the server default namespace is not permitted — supply an allowed namespace\"\n      : `token is not permitted to access namespace: ${namespace}`,\n  );\n}\n\n/**\n * Fleet-wide / global maintenance operation guard (issue #1850 round 10).\n *\n * A distinct escalation class from the id-addressed routes (round 9) and the\n * param-namespace ops (round 4): some boundary operations inherently run\n * ACROSS ALL namespaces — or against a single global layer (compression\n * guidelines, shared context, compounding) that is not namespace-partitioned\n * — and carry NO `namespace` argument, so the MCP `tools/call` effective-\n * namespace chokepoint ({@link enforceNamespaceAllowList}, which only fires\n * when `toolAcceptsNamespace`) never applies. Without this guard a bearer\n * scoped to ONE tenant could trigger maintenance that mutates state in EVERY\n * namespace (privilege escalation).\n *\n * Fail CLOSED exactly like the other shared guards: a namespace-SCOPED token\n * (namespaces axis present) is rejected; unrestricted / legacy tokens (absent\n * record or no namespaces axis — i.e. cron and internal callers that never\n * bind a capability record) are unaffected. Reuses the EXISTING capability\n * model via {@link capabilityAllowsNamespace} — no new \"all\"/\"*\" scope concept.\n * Must run BEFORE any side effect so a denial never leaks a partial mutation.\n */\nexport function assertFleetWideOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  // capabilityAllowsNamespace returns false for ANY scoped token when the\n  // namespace is undefined (a fleet-wide op has no single namespace), and\n  // true for unrestricted/legacy tokens — exactly the desired policy.\n  if (!capabilityAllowsNamespace(caps, undefined)) {\n    throw new EngramAccessForbiddenError(\n      \"token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token\",\n    );\n  }\n}\n\n/**\n * Per-request AsyncLocalStorage carrying the presenting token's resolved\n * capabilities. The HTTP surface binds the resolved capabilities with\n * `.run(caps, handler)` for the WHOLE authorized request dispatch (NOT\n * `.enterWith()`, which mutates the current async resource and does not\n * reliably isolate the store across the handler's awaits / concurrent\n * requests — risking a fail-open read of undefined mid-handler); the\n * access boundary reads `.getStore()` to enforce the ops allow-list for\n * every boundary operation without each dispatch site threading the value\n * explicitly. Unset (CLI, direct boundary callers, tests) ⇒ undefined ⇒\n * unrestricted (issue #1850 round 7).\n */\nexport const tokenCapabilityStore = new AsyncLocalStorage<TokenCapabilities | undefined>();\n"],"mappings":";;;;;AAmCA,SAAS,yBAAyB;AAI3B,IAAM,6BAA6B;AA4B1C,IAAM,6BAA6B;AAInC,IAAM,0BAA0B;AAGzB,SAAS,sBAAsB,OAAiC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,4BAA4B;AAChG,WAAO;AAAA,EACT;AACA,MAAI,CAAC,wBAAwB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,UAAU,OAAO,UAAU,KAAM,QAAO;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAoC;AACzD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACzE;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AACnC;AASA,SAAS,UACP,KACA,KACA,eACA,YACsB;AACtB,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC5D,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,EAC7E;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,OAAO;AACrB,QAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,IAC7E;AACA,QAAI,CAAC,cAAc,CAAC,GAAG;AACrB,YAAM,IAAI,MAAM,gBAAgB,GAAG,yBAAyB,UAAU,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,IAChG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,SAAO,WAAW,OAAO;AAC3B;AAWO,SAAS,sBAAsB,KAA6C;AACjF,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM;AAIZ,MAAI,IAAI,YAAY,UAAa,IAAI,YAAY,4BAA4B;AAC3E,UAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,EAC9E;AACA,QAAM,MAAM,UAAU,KAAK,OAAO,MAAM,MAAM,WAAW;AACzD,QAAM,aAAa,UAAU,KAAK,cAAc,uBAAuB,WAAW;AAClF,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,OAAW,QAAO,MAAM;AACpC,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,SAAO;AACT;AAcO,SAAS,4BACd,KACA,UACmB;AACnB,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,QAAM,MAAM;AACZ,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,KAAK,IAAI,YAAY,QAAW;AACrF,QAAI,IAAI,YAAY,4BAA4B;AAC9C,YAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ;AAEnC,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,KAAK,KAAK,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAM;AACjG,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,MAAM,IAAI;AAChB,eAAW,KAAK,KAAK;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,wDAAwD;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;AAChF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,wDAAwD,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,IACF;AAEA,WAAO,MAAM,WAAW,GAAe;AAAA,EACzC;AAEA,MACE,OAAO,UAAU,eAAe,KAAK,KAAK,YAAY,KACtD,IAAI,eAAe,UACnB,IAAI,eAAe,MACnB;AACA,QAAI,CAAC,cAAc,IAAI,UAAU,GAAG;AAClC,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa,IAAI;AACvB,eAAW,KAAK,YAAY;AAC1B,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,UAAI,CAAC,sBAAsB,CAAC,GAAG;AAC7B,cAAM,IAAI,MAAM,2DAA2D,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AACA,WAAO,aAAa,WAAW,UAAsB;AAAA,EACvD;AAEA,SAAO;AACT;AAQO,SAAS,uBAAuB,MAAqD;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,QAAQ,UAAa,KAAK,eAAe;AACvD;AAQO,SAAS,mBAAmB,MAA4C,IAAqB;AAClG,MAAI,MAAM,QAAQ,OAAW,QAAO;AACpC,SAAO,KAAK,IAAI,SAAS,EAAE;AAC7B;AAQO,SAAS,0BACd,MACA,WACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,KAAK,WAAW,SAAS,SAAS;AAC3C;AAMO,SAAS,uBACd,MACA,IACM;AACN,MAAI,CAAC,mBAAmB,MAAM,EAAE,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,6CAA6C,EAAE;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,uBACd,MACA,WACM;AACN,MAAI,CAAC,0BAA0B,MAAM,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6FACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAYO,SAAS,0BACd,WACA,kBACoB;AACpB,QAAM,aAAa,cAAc,UAAa,UAAU,SAAS,IAAI,YAAY;AACjF,SAAO,cAAc;AACvB;AAeO,SAAS,mBACd,MACA,WACA,kBACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,QAAM,YAAY,0BAA0B,WAAW,gBAAgB;AACvE,SAAO,cAAc,UAAa,KAAK,WAAW,SAAS,SAAS;AACtE;AAEO,SAAS,0BACd,MACA,WACA,kBACM;AACN,MAAI,mBAAmB,MAAM,WAAW,gBAAgB,EAAG;AAC3D,QAAM,IAAI;AAAA,IACR,cAAc,SACV,6HACA,+CAA+C,SAAS;AAAA,EAC9D;AACF;AAsBO,SAAS,gCACd,MACM;AAIN,MAAI,CAAC,0BAA0B,MAAM,MAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,IAAI,kBAAiD;","names":[]}