@remnic/core 9.4.2 → 9.5.0

package/dist/{chunk-P6SYWE4G.js → chunk-STCCFQU5.js}

@@ -3,10 +3,10 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-LOR6ZM5R.js";
+} from "./chunk-MFDJ63U5.js";
 import {
   listNamespaces
-} from "./chunk-JLR3JSTL.js";
+} from "./chunk-L6V3WJ55.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -15,6 +15,9 @@ import {
 import {
   resolvePluginEntry
 } from "./chunk-CMTINOFS.js";
+import {
+  readJudgeVerdictStats
+} from "./chunk-SMX5267P.js";
 import {
   createEvalBaselineSnapshot,
   getEvalHarnessStatus,
@@ -22,9 +25,6 @@ import {
   runEvalBenchmarkCiGate,
   validateEvalBenchmarkPack
 } from "./chunk-3PY7VHV7.js";
-import {
-  readJudgeVerdictStats
-} from "./chunk-SMX5267P.js";
 import {
   resolveCuratedIncludeFilesStatePath,
   resolveNativeKnowledgeStatePath,
@@ -42,13 +42,13 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-IC6QX5TC.js";
+} from "./chunk-BGMSRN6I.js";
 import {
   analyzeGraphHealth
 } from "./chunk-OBMR4VIX.js";
 import {
   StorageManager
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-UDCDGP6A.js";
 import {
   probeProjectionHealth
 } from "./chunk-RHOZ5LLO.js";
@@ -1072,7 +1072,7 @@ async function summarizeGraphEdgeDecayStatus(config) {
 }
 async function summarizeTierDistribution(storage) {
   try {
-    const { summarizeTiers } = await import("./tier-stats-TG6GUZ6N.js");
+    const { summarizeTiers } = await import("./tier-stats-5XF4UBRQ.js");
     const summary = await summarizeTiers(storage);
     const storageDir = storage.dir ?? "";
     const journalPath = storageDir.length > 0 ? path.join(storageDir, "state", "tier-migration-journal.jsonl") : null;
@@ -1646,4 +1646,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-P6SYWE4G.js.map
+//# sourceMappingURL=chunk-STCCFQU5.js.map

package/dist/{chunk-X4A62ET7.js → chunk-TI7IHDBQ.js}

@@ -8,7 +8,7 @@ import {
 } from "./chunk-GDB4J2H3.js";
 import {
   importCapsule
-} from "./chunk-M5QKGHCR.js";
+} from "./chunk-CYWCKFCL.js";
 import {
   getTrustZoneStoreStatus,
   isTrustZoneName,
@@ -29,15 +29,15 @@ import {
   normalizeTags,
   parseTagMatch
 } from "./chunk-BT7NVCML.js";
-import {
-  decideDisclosureEscalation
-} from "./chunk-H7XKCNR6.js";
 import {
   toRecallExplainJson
 } from "./chunk-2KK5WNQB.js";
 import {
   estimateRecallTokens
 } from "./chunk-6MMONPHM.js";
+import {
+  decideDisclosureEscalation
+} from "./chunk-H7XKCNR6.js";
 import {
   recordObjectiveStateSnapshotsFromObservedMessages
 } from "./chunk-ICP53SKG.js";
@@ -59,7 +59,7 @@ import {
 } from "./chunk-BAVVI5GP.js";
 import {
   namespaceCollectionName
-} from "./chunk-4BFRBP45.js";
+} from "./chunk-2JFDHI2K.js";
 import {
   namespaceIdentityFromToken
 } from "./chunk-EGGE52UU.js";
@@ -70,7 +70,7 @@ import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact,
   runMemoryGovernance
-} from "./chunk-IC6QX5TC.js";
+} from "./chunk-BGMSRN6I.js";
 import {
   recordMemoryOutcome
 } from "./chunk-EIR5VLIH.js";
@@ -101,18 +101,18 @@ import {
 import {
   filterTrajectoriesByLookbackDays,
   readCausalTrajectoryRecords
-} from "./chunk-CXLNZXG5.js";
+} from "./chunk-7XGSIUP5.js";
 import {
   FileCalendarSource,
   buildBriefing,
   enqueuePassiveCorrectionNotification,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-DGYCWCQ7.js";
+} from "./chunk-DZSAXE3T.js";
 import {
   parseEntityFile,
   selfDeps
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-UDCDGP6A.js";
 import {
   supersessionKeysForFact
 } from "./chunk-EHK6KZHK.js";
@@ -126,6 +126,12 @@ import {
   DEFAULT_RECALL_DISCLOSURE,
   isRecallDisclosure
 } from "./chunk-JS2HKKOK.js";
+import {
+  getMemoryProjectionPath
+} from "./chunk-RHOZ5LLO.js";
+import {
+  displayErrorDetail
+} from "./chunk-RL6NEVXT.js";
 import {
   inferMemoryStatus,
   toMemoryPathRel
@@ -134,12 +140,6 @@ import {
   normalizeProjectionPreview,
   normalizeProjectionTags
 } from "./chunk-SCU65EZI.js";
-import {
-  getMemoryProjectionPath
-} from "./chunk-RHOZ5LLO.js";
-import {
-  displayErrorDetail
-} from "./chunk-RL6NEVXT.js";
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
@@ -148,7 +148,7 @@ import {
 } from "./chunk-W5H6ZRPT.js";
 import {
   exportCapsule
-} from "./chunk-FLVL4L3L.js";
+} from "./chunk-KTULX4YO.js";
 import {
   evaluateActionConfidence
 } from "./chunk-Z2YFLXHU.js";
@@ -10924,4 +10924,4 @@ export {
   EngramAccessService,
   AccessAdminOpsSurface
 };
-//# sourceMappingURL=chunk-X4A62ET7.js.map
+//# sourceMappingURL=chunk-TI7IHDBQ.js.map

package/dist/{chunk-BGTAL46Y.js → chunk-TV7C3HCB.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-EGGE52UU.js";
 import {
   StorageManager
-} from "./chunk-M7GGMGMZ.js";
+} from "./chunk-UDCDGP6A.js";
 import {
   MutationSerializer
 } from "./chunk-LTJAMRGI.js";
@@ -339,4 +339,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-BGTAL46Y.js.map
+//# sourceMappingURL=chunk-TV7C3HCB.js.map

package/dist/{chunk-EPGWWCZF.js → chunk-UBGAOYBP.js}

@@ -1,11 +1,15 @@
 import {
   runPostConsolidationMaterialize
-} from "./chunk-KCJ5H6XQ.js";
+} from "./chunk-ODSYJXDU.js";
 import {
   discoverMemoryExtensions,
   renderExtensionsBlock,
   resolveExtensionsRoot
 } from "./chunk-JLNBQWZ2.js";
+import {
+  countRecallTokenOverlap,
+  normalizeRecallTokens
+} from "./chunk-ZBJMUXZH.js";
 import {
   isSemanticConsolidationLlmOperator
 } from "./chunk-G7D6GZ5J.js";
@@ -15,10 +19,6 @@ import {
 import {
   log
 } from "./chunk-37CTGERM.js";
-import {
-  countRecallTokenOverlap,
-  normalizeRecallTokens
-} from "./chunk-ZBJMUXZH.js";
 
 // src/semantic-consolidation.ts
 function findSimilarClusters(memories, config) {
@@ -220,4 +220,4 @@ export {
   buildExtensionsBlockForConsolidation,
   materializeAfterSemanticConsolidation
 };
-//# sourceMappingURL=chunk-EPGWWCZF.js.map
+//# sourceMappingURL=chunk-UBGAOYBP.js.map

package/dist/{chunk-M7GGMGMZ.js → chunk-UDCDGP6A.js}

@@ -16,9 +16,6 @@ import {
 import {
   supersessionKeysForFact
 } from "./chunk-EHK6KZHK.js";
-import {
-  stripAttributesSuffix
-} from "./chunk-SVOZFLIQ.js";
 import {
   DEFAULT_CITATION_FORMAT,
   hasCitation,
@@ -28,10 +25,21 @@ import {
   assertMemoryFrontmatterId,
   warnProjectionFallback
 } from "./chunk-4KJLYTLS.js";
+import {
+  stripAttributesSuffix
+} from "./chunk-SVOZFLIQ.js";
 import {
   SPECULATIVE_TTL_DAYS,
   confidenceTier
 } from "./chunk-JS2HKKOK.js";
+import {
+  markProjectedMemoryPathInvalid,
+  readProjectedGovernanceRecord,
+  readProjectedMemoryBrowse,
+  readProjectedMemoryState,
+  readProjectedMemoryTimeline,
+  updateProjectedMemoryPath
+} from "./chunk-RHOZ5LLO.js";
 import {
   getCachedEntities,
   invalidateAllForDir,
@@ -47,14 +55,6 @@ import {
   normalizeProjectionPreview,
   normalizeProjectionTags
 } from "./chunk-SCU65EZI.js";
-import {
-  markProjectedMemoryPathInvalid,
-  readProjectedGovernanceRecord,
-  readProjectedMemoryBrowse,
-  readProjectedMemoryState,
-  readProjectedMemoryTimeline,
-  updateProjectedMemoryPath
-} from "./chunk-RHOZ5LLO.js";
 import {
   rotateMarkdownFileToArchive
 } from "./chunk-DM2T26WE.js";
@@ -88,14 +88,14 @@ import {
   reconcileProvenanceRead,
   serializeProvenanceFields
 } from "./chunk-OEHCMALU.js";
-import {
-  sanitizeMemoryContent
-} from "./chunk-5GKPFL3S.js";
 import {
   matchEntitySchemaSection,
   normalizeEntityStructuredSection,
   sortStructuredSectionsBySchema
 } from "./chunk-4DJQYKMN.js";
+import {
+  sanitizeMemoryContent
+} from "./chunk-5GKPFL3S.js";
 import {
   log
 } from "./chunk-37CTGERM.js";
@@ -6154,4 +6154,4 @@ export {
   isValidBufferSurpriseEvent,
   StorageManager3 as StorageManager
 };
-//# sourceMappingURL=chunk-M7GGMGMZ.js.map
+//# sourceMappingURL=chunk-UDCDGP6A.js.map

package/dist/{chunk-2MR3MFQB.js → chunk-UPSAT4PY.js}

@@ -1,6 +1,6 @@
 import {
   isValidCapsuleSince
-} from "./chunk-FLVL4L3L.js";
+} from "./chunk-KTULX4YO.js";
 import {
   CAPSULE_ID_PATTERN
 } from "./chunk-WEHSQBFR.js";
@@ -441,4 +441,4 @@ export {
   actionConfidenceRequestSchema,
   validateRequest
 };
-//# sourceMappingURL=chunk-2MR3MFQB.js.map
+//# sourceMappingURL=chunk-UPSAT4PY.js.map

package/dist/{chunk-CGS7UKWM.js → chunk-VCW74PNH.js}

@@ -5,7 +5,7 @@ import {
   loadTokenStore,
   revokeToken,
   saveTokenStore
-} from "./chunk-E2SPGGUI.js";
+} from "./chunk-4OKLXWDZ.js";
 import {
   getConnectorsDir,
   getRegistryPath
@@ -2257,4 +2257,4 @@ export {
   resolveWeCloneProxyConfigPath,
   buildWeCloneProxyConfig
 };
-//# sourceMappingURL=chunk-CGS7UKWM.js.map
+//# sourceMappingURL=chunk-VCW74PNH.js.map

package/dist/{chunk-DR6PEJU3.js → chunk-VWEWK2BM.js}

@@ -1,3 +1,6 @@
+import {
+  MCP_READ_ONLY_TOOL_SUFFIXES
+} from "./chunk-IC2TCZJ2.js";
 import {
   buildCitationGuidance
 } from "./chunk-D24OXEPB.js";
@@ -6,7 +9,7 @@ import {
 } from "./chunk-5RUE3GHQ.js";
 import {
   validateRequest
-} from "./chunk-2MR3MFQB.js";
+} from "./chunk-UPSAT4PY.js";
 import {
   REMNIC_CHATGPT_MEMORY_INSPECTOR_MIME_TYPE,
   REMNIC_CHATGPT_MEMORY_INSPECTOR_TOOL,
@@ -15,10 +18,16 @@ import {
 } from "./chunk-T4WDJPEZ.js";
 import {
   getOperation
-} from "./chunk-FZGGZAAU.js";
+} from "./chunk-L2QJQSHL.js";
+import {
+  assertOperationAllowed,
+  capabilityAllowsOp,
+  enforceNamespaceAllowList,
+  tokenCapabilityStore
+} from "./chunk-D7FOKIY5.js";
 import {
   EngramAccessInputError
-} from "./chunk-X4A62ET7.js";
+} from "./chunk-TI7IHDBQ.js";
 import {
   readEnvVar
 } from "./chunk-JUC24CTX.js";
@@ -923,6 +932,11 @@ async function loadChatSession(memoryDir, chatSessionId) {
     createdAt
   };
 }
+async function enforceChatSessionNamespace(service, chatSessionId) {
+  const session = await loadChatSession(service.memoryDir, chatSessionId);
+  if (!session) return;
+  enforceNamespaceAllowList(tokenCapabilityStore.getStore(), session.namespace, service.configRef?.defaultNamespace);
+}
 async function appendTranscriptEntry(memoryDir, chatSessionId, entry) {
   const filePath = chatSessionFile(memoryDir, chatSessionId);
   const full = {
@@ -1122,54 +1136,6 @@ async function processChatMessage(opts) {
 }
 
 // src/access-mcp.ts
-var MCP_READ_ONLY_TOOL_SUFFIXES = {
-  recall: true,
-  recall_explain: true,
-  recall_tier_explain: true,
-  recall_xray: true,
-  briefing: true,
-  wearables_status: true,
-  transcript_day: true,
-  transcript_search: true,
-  transcript_memories: true,
-  action_confidence: true,
-  capsule_list: true,
-  procedural_stats: true,
-  memory_get: true,
-  memory_timeline: true,
-  entity_get: true,
-  review_queue_list: true,
-  lcm_search: true,
-  continuity_incident_list: true,
-  identity_anchor_get: true,
-  memory_identity: true,
-  memory_search: true,
-  memory_profile: true,
-  memory_entities_list: true,
-  memory_questions: true,
-  memory_last_recall: true,
-  memory_intent_debug: true,
-  memory_qmd_debug: true,
-  memory_graph_explain: true,
-  graph_snapshot: true,
-  review_list: true,
-  profiling_report: true,
-  peer_list: true,
-  peer_get: true,
-  peer_profile_get: true,
-  console_state: true,
-  dreams_status: true,
-  codegraph_list_projects: true,
-  codegraph_index_status: true,
-  codegraph_search_graph: true,
-  codegraph_trace_path: true,
-  codegraph_detect_changes: true,
-  codegraph_query_graph: true,
-  codegraph_get_schema: true,
-  codegraph_get_snippet: true,
-  codegraph_get_architecture: true,
-  codegraph_search_code: true
-};
 var MCP_SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
 var MCP_DEFAULT_PROTOCOL_VERSION = MCP_SUPPORTED_PROTOCOL_VERSIONS[0] ?? "2025-06-18";
 var LEGACY_MCP_PREFIX = "engram.";
@@ -3427,13 +3393,9 @@ var EngramMcpServer = class {
       };
     }
     if (method === "tools/list") {
-      return {
-        jsonrpc: "2.0",
-        id,
-        result: {
-          tools: this.tools
-        }
-      };
+      const caps = tokenCapabilityStore.getStore();
+      const tools = caps?.ops === void 0 ? this.tools : this.tools.filter((t) => capabilityAllowsOp(caps, MCP_MIGRATED_OPERATIONS[toLegacyToolName(t.name)] ?? ""));
+      return { jsonrpc: "2.0", id, result: { tools } };
     }
     if (method === "resources/list") {
       return {
@@ -3646,6 +3608,18 @@ ${body}`;
     }
     return inputSchema?.additionalProperties === true;
   }
+  /**
+   * Whether a tool accepts a `namespace` argument — i.e. it is a
+   * namespace-scoped operation whose effective namespace MUST be gated by the
+   * per-token allow-list. Exposed (public) so the HTTP MCP transport can run
+   * the SAME effective-namespace enforcement the REST surface runs, without
+   * duplicating the tool-schema introspection (issue #1850). Namespace-
+   * agnostic tools (peer/wearables/etc.) return false and stay ungated,
+   * matching the REST surface where those routes never call resolveNamespace.
+   */
+  toolAcceptsNamespace(name) {
+    return this.toolAcceptsArgument(name, "namespace");
+  }
   /**
    * Determine whether oai-mem-citation guidance should be appended to recall.
    * Returns true when explicitly enabled via config OR when auto-detect is
@@ -3721,9 +3695,19 @@ ${body}`;
     } else if (migrated.startsWith("codegraph_")) {
       envelope = { ...args, tool: migrated.slice("codegraph_".length) };
     } else if (migrated === "chat_message") {
+      assertOperationAllowed(tokenCapabilityStore.getStore(), migrated);
       const message = typeof args.message === "string" ? args.message : "";
       if (!message) throw new EngramAccessInputError("message is required");
       const chatSessionId = typeof args.chatSessionId === "string" ? args.chatSessionId : void 0;
+      if (chatSessionId) {
+        await enforceChatSessionNamespace(this.service, chatSessionId);
+      } else {
+        enforceNamespaceAllowList(
+          tokenCapabilityStore.getStore(),
+          scope?.namespace,
+          this.service.configRef?.defaultNamespace
+        );
+      }
       const chatResult = await processChatMessage({
         service: this.service,
         config: this.service.configRef?.chat,
@@ -3776,6 +3760,7 @@ export {
   createChatExecutor,
   createChatSession,
   loadChatSession,
+  enforceChatSessionNamespace,
   appendTranscriptEntry,
   subscribeChatTranscript,
   cleanupExpiredChatSessions,
@@ -3784,4 +3769,4 @@ export {
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-DR6PEJU3.js.map
+//# sourceMappingURL=chunk-VWEWK2BM.js.map