@remnic/core 9.3.768 → 9.3.769

package/dist/access-cli.js

@@ -23,13 +23,13 @@ import "./chunk-ABP6QMVM.js";
 import "./chunk-HW5EF6LV.js";
 import "./chunk-QPTP6SKC.js";
 import "./chunk-JRZV3767.js";
-import "./chunk-4DLFJJOQ.js";
+import "./chunk-QMN3CIFS.js";
 import "./chunk-V5OCT34X.js";
 import "./chunk-LXOM6IQU.js";
 import "./chunk-VOUOLGIP.js";
 import "./chunk-S75M5ZRK.js";
 import "./chunk-ECZU5BJH.js";
-import "./chunk-UG274TNV.js";
+import "./chunk-E2SPGGUI.js";
 import "./chunk-UHGBNIOS.js";
 import "./chunk-BCDKBDSY.js";
 import "./chunk-YN2UN7N3.js";
@@ -80,7 +80,7 @@ import "./chunk-LUPVCGYK.js";
 import "./chunk-PYPOFEMK.js";
 import "./chunk-LOPZ2DWR.js";
 import "./chunk-VEWZZM3H.js";
-import "./chunk-HBOPSFQQ.js";
+import "./chunk-EVXI2I6G.js";
 import "./chunk-MC4FJXPA.js";
 import "./chunk-LQHDIS7L.js";
 import "./chunk-7F7Z6MOS.js";
@@ -175,7 +175,7 @@ import "./chunk-KD3QD3A5.js";
 import "./chunk-VGUOEDTU.js";
 import "./chunk-H3FZVNRN.js";
 import "./chunk-OADWQ5CR.js";
-import "./chunk-J3UJJZKI.js";
+import "./chunk-SIPZ5UMK.js";
 import "./chunk-7WV3F5DQ.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-JBPKEARU.js";
@@ -184,7 +184,7 @@ import "./chunk-J64TK33U.js";
 import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-TVLN5EZZ.js";
+import "./chunk-CNXMWYLA.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-4JG55YV3.js";
 import "./chunk-GLERZDM7.js";

package/dist/access-http.d.ts

@@ -1,4 +1,4 @@
-import { IncomingMessage } from 'node:http';
+import { IncomingMessage, ServerResponse } from 'node:http';
 import { F as EngramAccessService } from './access-service-CdW6B2qQ.js';
 import { ResolvedIdentity } from './adapters/types.js';
 import { AdapterRegistry } from './adapters/registry.js';
@@ -109,6 +109,24 @@ interface EngramAccessHttpServerOptions {
     authTokens?: string[];
     /** Dynamic token loader — called on each auth check so new/revoked tokens take effect without restart. */
     authTokensGetter?: () => string[];
+    /**
+     * Dynamic token-ENTRY loader ({token, connector} pairs from one coherent
+     * snapshot). Preferred over `authTokensGetter` when a `tokenPathPolicy`
+     * is set: the connector used for the policy decision comes from the SAME
+     * entry that validated, so identity can never lag validation.
+     */
+    authTokenEntriesGetter?: () => ReadonlyArray<{
+        token: string;
+        connector?: string;
+    }>;
+    /**
+     * Optional per-request scope policy for tokens sourced from
+     * `authTokenEntriesGetter`. Return false to deny the (validated) token
+     * for this pathname. Static `authToken`/`authTokens` (operator-supplied)
+     * bypass the policy. Entries whose connector is missing FAIL CLOSED when
+     * a policy is configured.
+     */
+    tokenPathPolicy?: (connector: string, pathname: string | undefined) => boolean;
     principal?: string;
     maxBodyBytes?: number;
     adminConsoleEnabled?: boolean;
@@ -133,6 +151,26 @@ interface EngramAccessHttpServerOptions {
      * existing health behavior.
      */
     readiness?: () => AccessHttpReadinessState;
+    /**
+     * When set, every 401 response includes
+     * `WWW-Authenticate: Bearer resource_metadata="<value>"` so MCP clients
+     * can discover the OAuth 2.0 protected-resource metadata document
+     * (RFC 9728). Must be an absolute http(s) URL; constructor throws on
+     * anything else. Unset → bare `Bearer`.
+     */
+    resourceMetadataUrl?: string;
+    /**
+     * Optional pre-auth request handler (e.g. OAuth facade mounted by
+     * `@remnic/server`). Runs after the admin-console handler and BEFORE
+     * bearer authorization. Return true if the request was fully handled
+     * (response ended). `ctx.authorized` reports whether the request
+     * carries a valid operator bearer token, so the handler can gate
+     * operator-only endpoints without owning token validation.
+     * Errors thrown by the handler flow into the existing error handling.
+     */
+    externalRequestHandler?: (req: IncomingMessage, res: ServerResponse, ctx: {
+        authorized: boolean;
+    }) => Promise<boolean>;
 }
 interface EngramAccessHttpServerStatus {
     running: boolean;
@@ -191,6 +229,8 @@ declare class EngramAccessHttpServer {
     private readonly authToken?;
     private readonly authTokens;
     private readonly authTokensGetter?;
+    private readonly authTokenEntriesGetter?;
+    private readonly tokenPathPolicy?;
     private readonly authenticatedPrincipal?;
     private readonly maxBodyBytes;
     private readonly adminConsoleEnabled;
@@ -200,6 +240,8 @@ declare class EngramAccessHttpServer {
     private readonly trustPrincipalHeader;
     private readonly adapterRegistry;
     private readonly readiness;
+    private readonly resourceMetadataUrl?;
+    private readonly externalRequestHandler?;
     private readonly writeRequestTimestamps;
     private readonly mcpServer;
     private server;
@@ -297,6 +339,14 @@ declare class EngramAccessHttpServer {
     private readRequiredNumberHeader;
     private parseOptionalBooleanHeader;
     private readValidatedBody;
+    /**
+     * Build the WWW-Authenticate challenge string for 401 responses.
+     * When `resourceMetadataUrl` is configured, includes the RFC 9728
+     * `resource_metadata` parameter so MCP clients (e.g. ChatGPT) can
+     * discover the OAuth 2.0 protected-resource metadata document.
+     * Otherwise the bare `Bearer` challenge is returned (unchanged).
+     */
+    private bearerChallenge;
     private isAuthorized;
     private timingSafeStringEqual;
     private encodeSecret;

package/dist/access-http.js

@@ -1,6 +1,6 @@
 import {
   EngramAccessHttpServer
-} from "./chunk-J3UJJZKI.js";
+} from "./chunk-SIPZ5UMK.js";
 import "./chunk-7WV3F5DQ.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-JBPKEARU.js";
@@ -9,7 +9,7 @@ import "./chunk-J64TK33U.js";
 import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-TVLN5EZZ.js";
+import "./chunk-CNXMWYLA.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-4JG55YV3.js";
 import "./chunk-GLERZDM7.js";

package/dist/access-mcp.d.ts

@@ -113,6 +113,12 @@ type McpRequestOptions = {
      */
     enforceWriteQuota?: () => void | Promise<void>;
 };
+/**
+ * MCP protocol versions this server understands, ordered newest → oldest.
+ * Exported so the HTTP transport can validate the `MCP-Protocol-Version`
+ * header and reject requests advertising an unknown version.
+ */
+declare const MCP_SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 declare class EngramMcpServer {
     private readonly service;
     private buffer;
@@ -226,4 +232,4 @@ declare class EngramMcpServer {
     private callTool;
 }
 
-export { EngramMcpServer };
+export { EngramMcpServer, MCP_SUPPORTED_PROTOCOL_VERSIONS };

package/dist/access-mcp.js

@@ -1,6 +1,7 @@
 import {
-  EngramMcpServer
-} from "./chunk-TVLN5EZZ.js";
+  EngramMcpServer,
+  MCP_SUPPORTED_PROTOCOL_VERSIONS
+} from "./chunk-CNXMWYLA.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-4JG55YV3.js";
 import "./chunk-GLERZDM7.js";
@@ -136,6 +137,7 @@ import "./chunk-LBLXEFWK.js";
 import "./chunk-VFUEZZBS.js";
 import "./chunk-PZ5AY32C.js";
 export {
-  EngramMcpServer
+  EngramMcpServer,
+  MCP_SUPPORTED_PROTOCOL_VERSIONS
 };
 //# sourceMappingURL=access-mcp.js.map

package/dist/access-operations.d.ts

@@ -127,14 +127,14 @@ interface MemoryStoreOutput {
 }
 declare const memoryStoreOperation: BoundOperation<{
     content: string;
-    namespace?: string | undefined;
+    schemaVersion?: number | undefined;
     sessionKey?: string | undefined;
+    tags?: string[] | undefined;
     dryRun?: boolean | undefined;
     category?: "fact" | "preference" | "correction" | "entity" | "decision" | "relationship" | "principle" | "commitment" | "moment" | "skill" | "rule" | "procedure" | "reasoning_trace" | undefined;
-    confidence?: number | undefined;
-    tags?: string[] | undefined;
+    namespace?: string | undefined;
     entityRef?: string | undefined;
-    schemaVersion?: number | undefined;
+    confidence?: number | undefined;
     cwd?: string | undefined;
     ttl?: string | undefined;
     sourceReason?: string | undefined;