@remnic/core 9.25.3 → 9.25.5

package/dist/transfer/types.d.ts

@@ -20,26 +20,26 @@ declare const ExportManifestV1Schema: z.ZodObject<{
         bytes: number;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
+    schemaVersion: 1;
     includesTranscripts: boolean;
 }, {
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
+    schemaVersion: 1;
     includesTranscripts: boolean;
 }>;
 type ExportManifestV1 = z.infer<typeof ExportManifestV1Schema>;
@@ -75,26 +75,26 @@ declare const ExportBundleV1Schema: z.ZodObject<{
             bytes: number;
         }>, "many">;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     }, {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
@@ -109,15 +109,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     };
     records: {
@@ -126,15 +126,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     };
     records: {
@@ -319,10 +319,10 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
-    schemaVersion: string;
+    description: string;
     id: string;
+    schemaVersion: string;
     version: string;
-    description: string;
     parentCapsule: string | null;
     parent: {
         version: string;
@@ -340,10 +340,10 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
-    schemaVersion: string;
+    description: string;
     id: string;
+    schemaVersion: string;
     version: string;
-    description: string;
     parentCapsule: string | null;
     retrievalPolicy: {
         tierWeights: Record<string, number>;
@@ -470,10 +470,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        schemaVersion: string;
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -491,10 +491,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        schemaVersion: string;
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -507,16 +507,14 @@ declare const ExportManifestV2Schema: z.ZodObject<{
         } | null | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: 2;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
-    includesTranscripts: boolean;
     capsule: {
         includes: {
             procedural: boolean;
@@ -524,10 +522,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        schemaVersion: string;
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -539,17 +537,17 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     };
-}, {
     schemaVersion: 2;
+    includesTranscripts: boolean;
+}, {
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
-    includesTranscripts: boolean;
     capsule: {
         includes: {
             procedural: boolean;
@@ -557,10 +555,10 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
-        schemaVersion: string;
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -572,6 +570,8 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             forkRoot: string;
         } | null | undefined;
     };
+    schemaVersion: 2;
+    includesTranscripts: boolean;
 }>;
 type ExportManifestV2 = z.infer<typeof ExportManifestV2Schema>;
 declare const ExportBundleV2Schema: z.ZodObject<{
@@ -689,10 +689,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -710,10 +710,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -726,16 +726,14 @@ declare const ExportBundleV2Schema: z.ZodObject<{
             } | null | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -743,10 +741,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -758,17 +756,17 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
-    }, {
         schemaVersion: 2;
+        includesTranscripts: boolean;
+    }, {
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -776,10 +774,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -791,6 +789,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
@@ -804,16 +804,14 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -821,10 +819,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -836,6 +834,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     };
     records: {
         content: string;
@@ -843,16 +843,14 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
             includes: {
                 procedural: boolean;
@@ -860,10 +858,10 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
-            schemaVersion: string;
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -875,6 +873,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     };
     records: {
         content: string;

package/dist/verified-recall.js

@@ -1,12 +1,12 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-VY6SDKWZ.js";
+} from "./chunk-SSYBI43M.js";
 import "./chunk-B7RWBZXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-XTAAG4SQ.js";
-import "./chunk-UHVXE24Y.js";
+import "./chunk-K4DP5KZA.js";
 import "./chunk-2QMKMVHH.js";
+import "./chunk-UHVXE24Y.js";
 import "./chunk-DEBHXHJR.js";
 import "./chunk-DNHVPZOD.js";
 import "./chunk-6CIAGZ6X.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.25.3",
+  "version": "9.25.5",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3056,7 +3056,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.25.3"
+    "@remnic/coding-graph": "^9.25.5"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-authorization-probe.ts

@@ -1,10 +1,22 @@
-import { getOperation, type OperationName, OPERATION_NAMES } from "./access-boundary.js";
+import {
+  getOperation,
+  operationRequiresAuthorizedNamespace,
+  OPERATION_NAMES,
+  type OperationName,
+} from "./access-boundary.js";
 import { EngramAccessInputError } from "./access-errors.js";
 import {
   assertOperationAuthorizationAllowed,
   type TokenCapabilities,
 } from "./access-token-capabilities.js";
 
+const UNRESOLVABLE_RESOURCE_OPERATIONS = new Set<OperationName>([
+  "review_resolve",
+  "contradiction_detail",
+  "chat_message",
+  "chat_events",
+]);
+
 export interface AuthorizationProbeResponse {
   readonly authorized: true;
   readonly operations: readonly OperationName[];
@@ -41,3 +53,20 @@ export function probeOperationAuthorization(
 
   return { authorized: true, operations };
 }
+
+/**
+ * Resolve every namespace an authorization probe can verify from the request.
+ * Resource-scoped routes resolve their stored target only after a resource id
+ * is supplied, so probes validate only request-resolvable namespaces.
+ */
+export function authorizationProbeNamespaces(
+  operations: readonly OperationName[],
+  requestedNamespace: string | undefined,
+): readonly (string | undefined)[] {
+  const namespaceOperations = operations.filter(
+    (operation) =>
+      operationRequiresAuthorizedNamespace(operation) &&
+      !UNRESOLVABLE_RESOURCE_OPERATIONS.has(operation),
+  );
+  return namespaceOperations.length > 0 ? [requestedNamespace] : [];
+}

package/src/access-boundary.ts

@@ -186,6 +186,18 @@ export const OPERATION_NAMES = [
  */
 export type OperationName = (typeof OPERATION_NAMES)[number];
 
+const IMPLICIT_HTTP_NAMESPACE_OPERATIONS = new Set<OperationName>([
+  "offline_sync_snapshot",
+  "offline_sync_snapshot_stream",
+  "memory_list",
+  "entity_list",
+  "maintenance_status",
+  "quality_status",
+  "trust_zones_status",
+  "graph_events",
+  "citations_observed",
+]);
+
 // ---------------------------------------------------------------------------
 // Operation context — what every handler receives
 // ---------------------------------------------------------------------------
@@ -435,6 +447,15 @@ export function getOperation(name: OperationName): BoundOperation | undefined {
   return registry.get(name);
 }
 
+/** Whether a probe must authorize an operation's effective namespace. */
+export function operationRequiresAuthorizedNamespace(name: OperationName): boolean {
+  if (name === "namespace_writable") return false;
+  if (IMPLICIT_HTTP_NAMESPACE_OPERATIONS.has(name)) return true;
+  const schema = registry.get(name)?.spec.schema;
+  const objectSchema = schema instanceof z.ZodEffects ? schema.innerType() : schema;
+  return objectSchema instanceof z.ZodObject && Object.hasOwn(objectSchema.shape, "namespace");
+}
+
 /** All registered operation names. */
 export function listRegisteredOperations(): readonly OperationName[] {
   return [...registry.keys()];

package/src/access-http.test.ts

@@ -2983,6 +2983,17 @@ test("HTTP authorization probe verifies requested operation grants without invok
   const service = {
     configRef: parseConfig({ memoryDir: "/tmp/remnic-http-authorization-probe", defaultNamespace: "default" }),
   } as unknown as EngramAccessService;
+  const implicitNamespaceOperations = [
+    "offline_sync_snapshot",
+    "offline_sync_snapshot_stream",
+    "memory_list",
+    "entity_list",
+    "maintenance_status",
+    "quality_status",
+    "trust_zones_status",
+    "graph_events",
+    "citations_observed",
+  ];
   const server = new EngramAccessHttpServer({
     service,
     port: 0,
@@ -2993,6 +3004,38 @@ test("HTTP authorization probe verifies requested operation grants without invok
       },
       { token: "recall-only-token", capabilities: { version: 1, ops: ["recall"] } },
       { token: "observe-only-token", capabilities: { version: 1, ops: ["observe"] } },
+      {
+        token: "namespace-scoped-delegate-token",
+        capabilities: {
+          version: 1,
+          ops: ["recall", "observe", "lcm_compaction_flush"],
+          namespaces: ["other"],
+        },
+      },
+      {
+        token: "resource-scoped-chat-token",
+        capabilities: {
+          version: 1,
+          ops: ["chat_message", "contradiction_detail"],
+          namespaces: ["other"],
+        },
+      },
+      {
+        token: "namespace-scoped-adapters-token",
+        capabilities: {
+          version: 1,
+          ops: ["adapters_status"],
+          namespaces: ["other"],
+        },
+      },
+      {
+        token: "implicit-namespace-token",
+        capabilities: {
+          version: 1,
+          ops: implicitNamespaceOperations,
+          namespaces: ["other"],
+        },
+      },
       {
         token: "fleet-scoped-token",
         capabilities: {
@@ -3005,9 +3048,10 @@ test("HTTP authorization probe verifies requested operation grants without invok
     adminConsoleEnabled: false,
   });
   const status = await server.start();
-  const probe = (token: string, operations: string[]) => {
+  const probe = (token: string, operations: string[], namespace?: string) => {
     const query = new URLSearchParams();
     for (const operation of operations) query.append("op", operation);
+    if (namespace !== undefined) query.set("namespace", namespace);
     return fetch(`http://127.0.0.1:${status.port}/engram/v1/authorization?${query}`, {
       headers: { authorization: `Bearer ${token}` },
     });
@@ -3023,6 +3067,47 @@ test("HTTP authorization probe verifies requested operation grants without invok
     assert.equal(alternateGrant.status, 200);
     await alternateGrant.text();
 
+    const namespaceDiagnostic = await probe(
+      "namespace-scoped-delegate-token",
+      ["namespace_writable"],
+    );
+    assert.equal(namespaceDiagnostic.status, 200, "writability diagnostics report scope in their response");
+    await namespaceDiagnostic.text();
+
+    const namespaceAgnostic = await probe("namespace-scoped-adapters-token", ["adapters_status"]);
+    assert.equal(namespaceAgnostic.status, 200, "namespace-free operations must not use the daemon default");
+    await namespaceAgnostic.text();
+
+    const namespaceDenied = await probe("namespace-scoped-delegate-token", delegateOperations);
+    assert.equal(namespaceDenied.status, 403, "a scoped token must cover the daemon default namespace");
+
+    for (const operation of implicitNamespaceOperations) {
+      const implicitNamespace = await probe("implicit-namespace-token", [operation]);
+      assert.equal(implicitNamespace.status, 403, `${operation} must authorize the effective namespace`);
+      await implicitNamespace.text();
+    }
+    await namespaceDenied.text();
+
+    const namespaceAllowed = await probe(
+      "namespace-scoped-delegate-token",
+      delegateOperations,
+      "other",
+    );
+    assert.equal(namespaceAllowed.status, 200);
+    await namespaceAllowed.text();
+
+    const resourceNamespaceProbe = await probe(
+      "resource-scoped-chat-token",
+      ["chat_message", "contradiction_detail"],
+      "other",
+    );
+    assert.equal(
+      resourceNamespaceProbe.status,
+      200,
+      "resource-scoped probes must not claim a namespace they cannot resolve without a resource id",
+    );
+    await resourceNamespaceProbe.text();
+
     const fleetWide = await probe("fleet-scoped-token", ["continuity_audit_generate"]);
     assert.equal(fleetWide.status, 403);
     assert.equal(fleetWide.headers.get("cache-control"), "no-store");

package/src/access-http.ts

@@ -38,7 +38,7 @@ import {
 import { expandTildePath } from "./utils/path.js";
 import { projectTagProjectId } from "./coding/coding-namespace.js";
 import { getOperation, type OperationName } from "./access-boundary.js";
-import { probeOperationAuthorization } from "./access-authorization-probe.js";
+import { authorizationProbeNamespaces, probeOperationAuthorization } from "./access-authorization-probe.js";
 import { resolveQueryNamespaceWritablePreflight } from "./access-namespace-preflight.js";
 import {
   assertOperationAllowed,
@@ -892,11 +892,11 @@ export class EngramAccessHttpServer {
 
     if (req.method === "GET" && pathname === "/engram/v1/authorization") {
       res.setHeader("cache-control", "no-store");
-      this.respondJson(
-        res,
-        200,
-        probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op")),
-      );
+      const probe = probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op"));
+      const namespaceParam = parsed.searchParams.get("namespace") ?? undefined;
+      for (const namespace of authorizationProbeNamespaces(probe.operations, namespaceParam))
+        this.resolveNamespace(req, namespace);
+      this.respondJson(res, 200, probe);
       return;
     }
 

package/src/access-mcp-output-schemas.ts

@@ -31,6 +31,7 @@ const TOOL_OUTPUT_SCHEMAS: Readonly<Record<string, Record<string, unknown>>> = {
     query: T_STRING,
     namespace: T_STRING,
     context: T_STRING,
+    contextComposition: objectSchema({ context: T_STRING, footer: T_STRING }),
     count: T_NUMBER,
     memoryIds: T_ARRAY,
     results: T_ARRAY,