@remnic/core 9.3.550 → 9.3.552

package/dist/{chunk-YN3WHXBG.js → chunk-KS7WO6EQ.js}

@@ -112,7 +112,7 @@ import {
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal,
   resolvePrincipal
-} from "./chunk-HWVTS5NO.js";
+} from "./chunk-UZYLX7M6.js";
 import {
   log
 } from "./chunk-2ODBA7MQ.js";
@@ -1156,7 +1156,13 @@ var EngramAccessService = class {
     const normalizedRequest = { ...request, query };
     const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
     const principal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
-    return this.withBudgetLock(principal, async () => {
+    if (this.orchestrator.config.namespacesEnabled && !principal) {
+      throw new EngramAccessInputError(
+        "authentication required: namespaces are enabled and no principal was supplied"
+      );
+    }
+    const budgetLockPrincipal = principal ?? "default";
+    return this.withBudgetLock(budgetLockPrincipal, async () => {
       let budgetRecordPrincipal = null;
       const response = await this.handleIdempotentRead({
         operation: "recall",
@@ -1214,7 +1220,13 @@ var EngramAccessService = class {
     );
     const namespace = namespaceOverride ?? this.orchestrator.config.defaultNamespace;
     const mode = this.normalizeRecallMode(request.mode);
-    const principal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
+    const maybePrincipal = this.resolveRequestPrincipal(request.sessionKey, authenticatedPrincipal);
+    if (this.orchestrator.config.namespacesEnabled && !maybePrincipal) {
+      throw new EngramAccessInputError(
+        "authentication required: namespaces are enabled and no principal was supplied"
+      );
+    }
+    const principal = maybePrincipal ?? "default";
     const principalNamespace = defaultNamespaceForPrincipal(principal, this.orchestrator.config);
     const modeSkipsBudget = mode === "no_recall";
     const effectiveNamespaces = namespaceOverride ? [namespaceOverride] : recallNamespacesForPrincipal(principal, this.orchestrator.config);
@@ -1365,7 +1377,7 @@ var EngramAccessService = class {
     let auditAnomalies;
     if (this.auditAdapter) {
       try {
-        const resolvedAgentId = principal;
+        const resolvedAgentId = principal ?? "__anonymous__";
         const auditEntry = {
           ts: (/* @__PURE__ */ new Date()).toISOString(),
           sessionKey: request.sessionKey ?? "",
@@ -1420,11 +1432,14 @@ var EngramAccessService = class {
   }
   async recallExplain(request = {}) {
     const requestedNamespace = request.namespace?.trim() ? this.resolveNamespace(request.namespace) : void 0;
+    const authenticatedPrincipal = request.authenticatedPrincipal?.trim();
+    const principal = authenticatedPrincipal || resolvePrincipal(request.sessionKey, this.orchestrator.config);
     if (requestedNamespace) {
-      const principal = resolvePrincipal(request.sessionKey, this.orchestrator.config);
       if (!canReadNamespace(principal, requestedNamespace, this.orchestrator.config)) {
         return { found: false };
       }
+    } else if (this.orchestrator.config.namespacesEnabled && !principal) {
+      return { found: false };
     }
     const snapshot = request.sessionKey ? (() => {
       const candidate = this.orchestrator.lastRecall.get(request.sessionKey);
@@ -1437,13 +1452,25 @@ var EngramAccessService = class {
       if (!requestedNamespace) return candidate;
       return candidate.namespace === requestedNamespace ? candidate : null;
     })();
-    const namespace = requestedNamespace ?? snapshot?.namespace ?? this.orchestrator.config.defaultNamespace;
+    const readableSnapshot = (() => {
+      if (!snapshot || !this.orchestrator.config.namespacesEnabled) return snapshot;
+      const snapshotNamespace = snapshot.namespace ?? this.orchestrator.config.defaultNamespace;
+      return canReadNamespace(principal, snapshotNamespace, this.orchestrator.config) ? snapshot : null;
+    })();
+    const namespace = (() => {
+      if (requestedNamespace) return requestedNamespace;
+      if (readableSnapshot?.namespace) return readableSnapshot.namespace;
+      const fallbackNamespace = this.orchestrator.config.defaultNamespace;
+      if (!this.orchestrator.config.namespacesEnabled) return fallbackNamespace;
+      return canReadNamespace(principal, fallbackNamespace, this.orchestrator.config) ? fallbackNamespace : null;
+    })();
+    if (!namespace) return { found: false };
     const [intent, graph] = await Promise.all([
       this.orchestrator.getLastIntentSnapshot(namespace),
       this.orchestrator.getLastGraphRecallSnapshot(namespace)
     ]);
-    if (!snapshot && !intent && !graph) return { found: false };
-    return { found: true, snapshot: snapshot ?? void 0, intent, graph };
+    if (!readableSnapshot && !intent && !graph) return { found: false };
+    return { found: true, snapshot: readableSnapshot ?? void 0, intent, graph };
   }
   async recallTierExplain(sessionKey, namespace, authenticatedPrincipal) {
     const namespacesEnabled = this.orchestrator.config.namespacesEnabled;
@@ -4211,4 +4238,4 @@ export {
   shapeMemorySummary,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-YN3WHXBG.js.map
+//# sourceMappingURL=chunk-KS7WO6EQ.js.map