@remnic/core 9.3.768 → 9.3.770

package/dist/{chunk-4HYFKIGH.js → chunk-PSNMICC2.js}

@@ -1,3 +1,6 @@
+import {
+  LanceDbBackend
+} from "./chunk-K2I3AWBR.js";
 import {
   MeilisearchBackend
 } from "./chunk-DMKMQTBH.js";
@@ -13,9 +16,6 @@ import {
 import {
   EmbedHelper
 } from "./chunk-HM6UJPPO.js";
-import {
-  LanceDbBackend
-} from "./chunk-K2I3AWBR.js";
 import {
   createConversationIndexBackend
 } from "./chunk-DCWIQFNA.js";
@@ -175,4 +175,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-4HYFKIGH.js.map
+//# sourceMappingURL=chunk-PSNMICC2.js.map

package/dist/{chunk-IVFIYAIP.js → chunk-QKUWPSU3.js}

@@ -1,15 +1,15 @@
 import {
   StorageManager
-} from "./chunk-DTTVX6EO.js";
+} from "./chunk-STN5KMSS.js";
 import {
   assertPathInsideRoot
 } from "./chunk-5GPPACXK.js";
-import {
-  decideLifecycleTransition
-} from "./chunk-TBBDFYXW.js";
 import {
   RECALL_FALLBACK_DIRS
 } from "./chunk-VS2IYZRU.js";
+import {
+  decideLifecycleTransition
+} from "./chunk-TBBDFYXW.js";
 
 // src/maintenance/memory-governance.ts
 import path from "path";
@@ -751,4 +751,4 @@ export {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
 };
-//# sourceMappingURL=chunk-IVFIYAIP.js.map
+//# sourceMappingURL=chunk-QKUWPSU3.js.map

package/dist/{chunk-4DLFJJOQ.js → chunk-QMN3CIFS.js}

@@ -5,7 +5,7 @@ import {
   loadTokenStore,
   revokeToken,
   saveTokenStore
-} from "./chunk-UG274TNV.js";
+} from "./chunk-E2SPGGUI.js";
 import {
   getConnectorsDir,
   getRegistryPath
@@ -2257,4 +2257,4 @@ export {
   resolveWeCloneProxyConfigPath,
   buildWeCloneProxyConfig
 };
-//# sourceMappingURL=chunk-4DLFJJOQ.js.map
+//# sourceMappingURL=chunk-QMN3CIFS.js.map

package/dist/chunk-RANHFI3P.js

@@ -0,0 +1,8 @@
+// src/access-errors.ts
+var EngramAccessForbiddenError = class extends Error {
+};
+
+export {
+  EngramAccessForbiddenError
+};
+//# sourceMappingURL=chunk-RANHFI3P.js.map

package/dist/chunk-RANHFI3P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-errors.ts"],"sourcesContent":["/** Authenticated caller lacks the required authorization (HTTP 403). */\nexport class EngramAccessForbiddenError extends Error {}\n"],"mappings":";AACO,IAAM,6BAAN,cAAyC,MAAM;AAAC;","names":[]}

package/dist/{chunk-AS2NRB45.js → chunk-RZ3KJZYE.js}

@@ -4,7 +4,7 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-DTTVX6EO.js";
+} from "./chunk-STN5KMSS.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-VSF7AAGE.js";
@@ -682,4 +682,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-AS2NRB45.js.map
+//# sourceMappingURL=chunk-RZ3KJZYE.js.map

package/dist/{chunk-4JG55YV3.js → chunk-SRSPVFSJ.js}

@@ -3,14 +3,14 @@ import {
 } from "./chunk-2MR3MFQB.js";
 import {
   defineOperation
-} from "./chunk-MSGPLITO.js";
+} from "./chunk-ZT34X56N.js";
 import {
   CorrectionContractError,
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   EngramAccessInputError,
   isCodegraphToolName
-} from "./chunk-OAREUC7N.js";
+} from "./chunk-EWGMA5W5.js";
 
 // src/access-operations.ts
 import { z } from "zod";
@@ -463,4 +463,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-4JG55YV3.js.map
+//# sourceMappingURL=chunk-SRSPVFSJ.js.map

package/dist/{chunk-DTTVX6EO.js → chunk-STN5KMSS.js}

@@ -1,18 +1,21 @@
-import {
-  WEARABLES_DIR_NAME,
-  isValidTranscriptDate
-} from "./chunk-M7XQSUBB.js";
 import {
   TombstoneStore,
   buildRetiredFactTombstoneInputs,
   collectRetiredMemoriesForRebuild
 } from "./chunk-L2B3EE7B.js";
+import {
+  WEARABLES_DIR_NAME,
+  isValidTranscriptDate
+} from "./chunk-M7XQSUBB.js";
 import {
   isErrnoCode
 } from "./chunk-5UZXUTVO.js";
 import {
   assertPathInsideRoot
 } from "./chunk-5GPPACXK.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-SVOZFLIQ.js";
 import {
   supersessionKeysForFact
 } from "./chunk-TKZ3AL5V.js";
@@ -25,9 +28,6 @@ import {
   assertMemoryFrontmatterId,
   warnProjectionFallback
 } from "./chunk-DQC3ZZYM.js";
-import {
-  stripAttributesSuffix
-} from "./chunk-SVOZFLIQ.js";
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
@@ -71,6 +71,10 @@ import {
   parseFaithfulnessField,
   serializeFaithfulnessFields
 } from "./chunk-YTU7WKYN.js";
+import {
+  isConsolidationOperator,
+  isValidDerivedFromEntry
+} from "./chunk-G7D6GZ5J.js";
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
@@ -78,10 +82,6 @@ import {
   computeContentHash,
   normalizeContent
 } from "./chunk-W5H6ZRPT.js";
-import {
-  isConsolidationOperator,
-  isValidDerivedFromEntry
-} from "./chunk-G7D6GZ5J.js";
 import {
   parseProvenanceSources,
   parseProvenanceTag,
@@ -6154,4 +6154,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-DTTVX6EO.js.map
+//# sourceMappingURL=chunk-STN5KMSS.js.map

package/dist/{chunk-J3UJJZKI.js → chunk-TGROC2UP.js}

@@ -6,22 +6,23 @@ import {
 } from "./chunk-JBPKEARU.js";
 import {
   EngramMcpServer,
+  MCP_SUPPORTED_PROTOCOL_VERSIONS,
   cleanupExpiredChatSessions,
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-TVLN5EZZ.js";
+} from "./chunk-OP43P53G.js";
 import {
   validateRequest
 } from "./chunk-2MR3MFQB.js";
 import {
   getOperation
-} from "./chunk-MSGPLITO.js";
+} from "./chunk-ZT34X56N.js";
 import {
   CorrectionContractError,
   EngramAccessInputError
-} from "./chunk-OAREUC7N.js";
+} from "./chunk-EWGMA5W5.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
@@ -49,6 +50,9 @@ import {
   abortError,
   isAbortError
 } from "./chunk-PVGDJXVK.js";
+import {
+  EngramAccessForbiddenError
+} from "./chunk-RANHFI3P.js";
 
 // src/access-http.ts
 import { createServer } from "http";
@@ -272,6 +276,23 @@ function parseHttpServerPort(port) {
   }
   return port;
 }
+function assertResourceMetadataUrl(value) {
+  if (value === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(
+      `access HTTP resourceMetadataUrl must be an absolute http(s) URL, got: ${value}`
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(
+      `access HTTP resourceMetadataUrl must use http or https, got: ${parsed.protocol}`
+    );
+  }
+  return value;
+}
 function parseTrustZoneKindFilter(raw) {
   if (raw === null) return void 0;
   if (TRUST_ZONE_RECORD_KINDS.includes(raw)) {
@@ -343,6 +364,8 @@ var EngramAccessHttpServer = class {
   authToken;
   authTokens;
   authTokensGetter;
+  authTokenEntriesGetter;
+  tokenPathPolicy;
   authenticatedPrincipal;
   maxBodyBytes;
   adminConsoleEnabled;
@@ -352,6 +375,8 @@ var EngramAccessHttpServer = class {
   trustPrincipalHeader;
   adapterRegistry;
   readiness;
+  resourceMetadataUrl;
+  externalRequestHandler;
   writeRequestTimestamps = [];
   mcpServer;
   server = null;
@@ -381,6 +406,8 @@ var EngramAccessHttpServer = class {
     this.authToken = options.authToken?.trim() || void 0;
     this.authTokens = (options.authTokens ?? []).map((t) => t.trim()).filter(Boolean);
     this.authTokensGetter = options.authTokensGetter;
+    this.authTokenEntriesGetter = options.authTokenEntriesGetter;
+    this.tokenPathPolicy = options.tokenPathPolicy;
     this.authenticatedPrincipal = options.principal?.trim() || void 0;
     this.maxBodyBytes = Number.isFinite(options.maxBodyBytes) ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072)) : 131072;
     this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
@@ -389,6 +416,8 @@ var EngramAccessHttpServer = class {
     this.adminControls = options.adminControls;
     this.trustPrincipalHeader = options.trustPrincipalHeader === true;
     this.readiness = options.readiness ?? (() => ({ ready: true, warmupAttempts: 0 }));
+    this.resourceMetadataUrl = assertResourceMetadataUrl(options.resourceMetadataUrl);
+    this.externalRequestHandler = options.externalRequestHandler;
     this.adapterRegistry = options.enableAdapters !== false ? options.adapterRegistry ?? new AdapterRegistry() : null;
     this.mcpServer = new EngramMcpServer(this.service, {
       principal: options.principal,
@@ -404,7 +433,7 @@ var EngramAccessHttpServer = class {
     });
   }
   async start() {
-    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter) {
+    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter && !this.authTokenEntriesGetter) {
       throw new Error("engram access HTTP requires authToken or authTokens");
     }
     if (this.server) return this.status();
@@ -437,6 +466,10 @@ var EngramAccessHttpServer = class {
             this.respondJson(res, 400, { error: err.message, code: "input_error" });
             return;
           }
+          if (err instanceof EngramAccessForbiddenError) {
+            this.respondJson(res, 403, { error: err.message, code: "forbidden" });
+            return;
+          }
           if (err instanceof CorrectionContractError) {
             this.respondJson(res, 400, { error: err.message, code: "correction_contract_error" });
             return;
@@ -647,11 +680,27 @@ var EngramAccessHttpServer = class {
         return;
       }
     }
+    if (this.externalRequestHandler) {
+      const authorized = this.isAuthorized(req, pathname);
+      if (await this.externalRequestHandler(req, res, { authorized })) {
+        return;
+      }
+    }
     if (!this.isAuthorized(req, pathname)) {
       const body = JSON.stringify({ error: "unauthorized", code: "unauthorized" });
       res.writeHead(401, {
         "content-type": "application/json; charset=utf-8",
-        "www-authenticate": "Bearer",
+        "www-authenticate": this.bearerChallenge(),
+        "x-request-id": correlationId
+      });
+      res.end(body);
+      return;
+    }
+    if (pathname === "/mcp" && (req.method === "GET" || req.method === "DELETE")) {
+      const body = JSON.stringify({ error: "method_not_allowed", code: "method_not_allowed" });
+      res.writeHead(405, {
+        "content-type": "application/json; charset=utf-8",
+        allow: "POST",
         "x-request-id": correlationId
       });
       res.end(body);
@@ -1416,6 +1465,20 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, response);
       return;
     }
+    if (req.method === "GET" && pathname === "/engram/v1/recall/timings") {
+      const op = getOperation("recall_timings");
+      if (!op) {
+        throw new Error("access-boundary: operation not registered: recall_timings");
+      }
+      res.setHeader("cache-control", "no-store");
+      const output = await op.run({}, {
+        service: this.service,
+        authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        operatorPrincipal: this.authenticatedPrincipal
+      });
+      this.respondJson(res, 200, output.result);
+      return;
+    }
     const memoryMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)$/);
     if (req.method === "GET" && memoryMatch) {
       const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
@@ -2253,6 +2316,20 @@ var EngramAccessHttpServer = class {
     req.once("error", cleanup);
   }
   async handleMcpRequest(req, res) {
+    const headerVersion = req.headers["mcp-protocol-version"];
+    if (typeof headerVersion === "string" && headerVersion.length > 0) {
+      if (!MCP_SUPPORTED_PROTOCOL_VERSIONS.includes(headerVersion)) {
+        this.respondJson(res, 400, {
+          jsonrpc: "2.0",
+          id: null,
+          error: {
+            code: -32e3,
+            message: `unsupported MCP-Protocol-Version: ${headerVersion}; supported: ${MCP_SUPPORTED_PROTOCOL_VERSIONS.join(", ")}`
+          }
+        });
+        return;
+      }
+    }
     const body = await this.readJsonBody(req);
     const request = body;
     const toolName = typeof request.params?.name === "string" ? request.params.name : "";
@@ -2552,8 +2629,23 @@ var EngramAccessHttpServer = class {
     }
     return result.data;
   }
+  /**
+   * Build the WWW-Authenticate challenge string for 401 responses.
+   * When `resourceMetadataUrl` is configured, includes the RFC 9728
+   * `resource_metadata` parameter so MCP clients (e.g. ChatGPT) can
+   * discover the OAuth 2.0 protected-resource metadata document.
+   * Otherwise the bare `Bearer` challenge is returned (unchanged).
+   */
+  bearerChallenge() {
+    if (this.resourceMetadataUrl) {
+      return `Bearer resource_metadata="${this.resourceMetadataUrl}"`;
+    }
+    return "Bearer";
+  }
   isAuthorized(req, pathname) {
-    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter) return false;
+    if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter && !this.authTokenEntriesGetter) {
+      return false;
+    }
     const raw = req.headers.authorization;
     let candidate = null;
     if (raw) {
@@ -2581,6 +2673,15 @@ var EngramAccessHttpServer = class {
     for (const valid of this.authTokens) {
       if (this.timingSafeStringEqual(token, valid)) return true;
     }
+    if (this.authTokenEntriesGetter) {
+      for (const entry of this.authTokenEntriesGetter()) {
+        if (!this.timingSafeStringEqual(token, entry.token)) continue;
+        if (!this.tokenPathPolicy) return true;
+        if (typeof entry.connector !== "string" || entry.connector.length === 0) return false;
+        return this.tokenPathPolicy(entry.connector, pathname);
+      }
+      return false;
+    }
     if (this.authTokensGetter) {
       for (const valid of this.authTokensGetter()) {
         if (this.timingSafeStringEqual(token, valid)) return true;
@@ -2664,4 +2765,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-J3UJJZKI.js.map
+//# sourceMappingURL=chunk-TGROC2UP.js.map