@remnic/core 9.4.2 → 9.6.0

package/dist/{chunk-2FOD2YY3.js → chunk-UFUKHGZD.js}

@@ -3,26 +3,42 @@ import {
 } from "./chunk-V7IZKJI3.js";
 import {
   AdapterRegistry
-} from "./chunk-2QSZNTDO.js";
+} from "./chunk-RKNJBZ55.js";
 import {
   EngramMcpServer,
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
   cleanupExpiredChatSessions,
+  enforceChatSessionNamespace,
   loadChatSession,
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-DR6PEJU3.js";
+} from "./chunk-PCLIWBGD.js";
 import {
   validateRequest
-} from "./chunk-2MR3MFQB.js";
+} from "./chunk-UPSAT4PY.js";
+import {
+  executeResolution,
+  isValidResolutionVerb
+} from "./chunk-KQDNAXOM.js";
+import {
+  isDefaultReviewNamespace,
+  listPairs,
+  readPair
+} from "./chunk-35NN3ZFA.js";
 import {
   getOperation
-} from "./chunk-FZGGZAAU.js";
+} from "./chunk-4GNEDXDI.js";
+import {
+  assertOperationAllowed,
+  enforceNamespaceAllowList,
+  isCapabilityRestricted,
+  tokenCapabilityStore
+} from "./chunk-D7FOKIY5.js";
 import {
   CorrectionContractError,
   EngramAccessInputError
-} from "./chunk-X4A62ET7.js";
+} from "./chunk-H2DXDQCQ.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
@@ -635,7 +651,30 @@ var EngramAccessHttpServer = class {
    *  is intentionally NOT used as a fallback for REST requests — omitting namespace
    *  should default to the server's global namespace, not silently scope to an adapter. */
   resolveNamespace(_req, bodyNamespace) {
-    return bodyNamespace || void 0;
+    const namespace = bodyNamespace || void 0;
+    enforceNamespaceAllowList(
+      tokenCapabilityStore.getStore(),
+      namespace,
+      this.service.configRef?.defaultNamespace
+    );
+    return namespace;
+  }
+  /**
+   * Resolve + enforce the `namespace` field carried in a POST request body,
+   * returning a shallow-copied envelope with the gated namespace stamped on.
+   * Used by the coding/correction POST routes that pass `body` straight to
+   * `op.run`: the body `namespace` is a user-controlled field that MUST flow
+   * through the same effective-namespace allow-list gate as the query-param
+   * routes, otherwise a scoped bearer can scope its call to another tenant
+   * by setting `body.namespace` (issue #1850 finding 2). Throws 403 for a
+   * scoped token whose allow-list does not cover the effective namespace.
+   */
+  gatedBodyNamespace(req, body) {
+    const namespace = this.resolveNamespace(
+      req,
+      typeof body.namespace === "string" ? body.namespace : void 0
+    );
+    return { ...body, namespace };
   }
   /**
    * Resolve the recall disclosure depth from the request (issue #677 PR
@@ -681,7 +720,7 @@ var EngramAccessHttpServer = class {
       }
     }
     if (this.externalRequestHandler) {
-      const authorized = this.isAuthorized(req, pathname);
+      const authorized = this.isAuthorized(req, pathname) && !isCapabilityRestricted(this.resolveTokenCapabilities(req, pathname));
       if (await this.externalRequestHandler(req, res, { authorized })) {
         return;
       }
@@ -696,6 +735,12 @@ var EngramAccessHttpServer = class {
       res.end(body);
       return;
     }
+    const caps = this.resolveTokenCapabilities(req, pathname);
+    await tokenCapabilityStore.run(caps, async () => {
+      await this.dispatchAuthorizedRequest(req, res, parsed, pathname, correlationId, abortSignal);
+    });
+  }
+  async dispatchAuthorizedRequest(req, res, parsed, pathname, correlationId, abortSignal) {
     if (pathname === "/mcp" && (req.method === "GET" || req.method === "DELETE")) {
       const body = JSON.stringify({ error: "method_not_allowed", code: "method_not_allowed" });
       res.writeHead(405, {
@@ -715,6 +760,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/adapters") {
+      this.enforceTokenOp("adapters_status");
       const identity = this.resolveAdapterIdentity(req);
       this.respondJson(res, 200, {
         adaptersEnabled: this.adapterRegistry !== null,
@@ -724,6 +770,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/admin/dashboard" || pathname === "/remnic/v1/admin/dashboard")) {
+      this.requireOperatorToken();
       if (!this.adminControls) {
         this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
         return;
@@ -732,6 +779,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "PATCH" && (pathname === "/engram/v1/admin/config" || pathname === "/remnic/v1/admin/config")) {
+      this.requireOperatorToken();
       if (!this.adminControls?.update) {
         this.respondJson(res, 404, { error: "admin_controls_unavailable", code: "admin_controls_unavailable" });
         return;
@@ -748,7 +796,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/recall") {
-      void getOperation("recall");
+      this.enforceTokenOp("recall");
       const body = await this.readValidatedBody(req, "recall");
       const codingContext = "codingContext" in body ? body.codingContext : void 0;
       const disclosure = this.resolveRecallDisclosure(body.disclosure, parsed);
@@ -817,7 +865,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/coding-context") {
-      void getOperation("set_coding_context");
+      this.enforceTokenOp("set_coding_context");
       const body = await this.readValidatedBody(req, "setCodingContext");
       const codingContext = body.codingContext !== void 0 ? body.codingContext : typeof body.projectTag === "string" ? codingContextFromProjectTag(body.projectTag) : (() => {
         throw new EngramAccessInputError("codingContext or projectTag is required");
@@ -830,7 +878,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/capsules/export" || pathname === "/remnic/v1/capsules/export")) {
-      void getOperation("capsule_export");
+      this.enforceTokenOp("capsule_export");
       const body = await this.readValidatedBody(req, "capsuleExport");
       this.ensureWriteRateLimitAvailable();
       const result = await this.service.capsuleExport({
@@ -848,7 +896,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/capsules/import" || pathname === "/remnic/v1/capsules/import")) {
-      void getOperation("capsule_import");
+      this.enforceTokenOp("capsule_import");
       const body = await this.readValidatedBody(req, "capsuleImport");
       this.ensureWriteRateLimitAvailable();
       const result = await this.service.capsuleImport({
@@ -863,7 +911,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
-      void getOperation("offline_sync_snapshot");
+      this.enforceTokenOp("offline_sync_snapshot");
       const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
       const includeContentRaw = parsed.searchParams.get("content");
       if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
@@ -890,7 +938,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/snapshot-stream" || pathname === "/remnic/v1/offline-sync/snapshot-stream")) {
-      void getOperation("offline_sync_snapshot_stream");
+      this.enforceTokenOp("offline_sync_snapshot_stream");
       const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
       const includeContentRaw = parsed.searchParams.get("content");
       if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
@@ -916,7 +964,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
-      void getOperation("offline_sync_snapshot");
+      this.enforceTokenOp("offline_sync_snapshot");
       const body = await this.readValidatedBody(
         req,
         "offlineSyncSnapshot",
@@ -935,7 +983,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/files" || pathname === "/remnic/v1/offline-sync/files")) {
-      void getOperation("offline_sync_files");
+      this.enforceTokenOp("offline_sync_files");
       const body = await this.readValidatedBody(req, "offlineSyncFiles");
       const result = await this.service.offlineSyncFiles({
         namespace: this.resolveNamespace(req, body.namespace),
@@ -947,7 +995,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/file-content" || pathname === "/remnic/v1/offline-sync/file-content")) {
-      void getOperation("offline_sync_file_content");
+      this.enforceTokenOp("offline_sync_file_content");
       const body = await this.readValidatedBody(req, "offlineSyncFileContent");
       const result = await this.service.offlineSyncFileContent({
         namespace: this.resolveNamespace(req, body.namespace),
@@ -969,7 +1017,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/apply-file-content" || pathname === "/remnic/v1/offline-sync/apply-file-content")) {
-      void getOperation("offline_sync_apply_file_content");
+      this.enforceTokenOp("offline_sync_apply_file_content");
       const namespaceParam = parsed.searchParams.get("namespace");
       const bytes = this.readRequiredIntegerHeader(req, "x-remnic-file-bytes");
       const offset = this.readOptionalIntegerHeader(req, "x-remnic-chunk-offset") ?? 0;
@@ -998,7 +1046,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/apply" || pathname === "/remnic/v1/offline-sync/apply")) {
-      void getOperation("offline_sync_apply");
+      this.enforceTokenOp("offline_sync_apply");
       const body = await this.readValidatedBody(req, "offlineSyncApply", OFFLINE_SYNC_APPLY_MAX_BODY_BYTES);
       const result = await this.service.offlineSyncApply({
         namespace: this.resolveNamespace(req, body.namespace),
@@ -1010,7 +1058,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/recall/explain") {
-      void getOperation("recall_explain");
+      this.enforceTokenOp("recall_explain");
       const body = await this.readValidatedBody(req, "recallExplain");
       const response = await this.service.recallExplain({
         sessionKey: body.sessionKey,
@@ -1021,13 +1069,13 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/action-confidence" || pathname === "/remnic/v1/action-confidence")) {
-      void getOperation("action_confidence");
+      this.enforceTokenOp("action_confidence");
       const body = await this.readValidatedBody(req, "actionConfidence");
       this.respondJson(res, 200, await this.service.actionConfidence(body));
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/recall/tier-explain") {
-      void getOperation("recall_tier_explain");
+      this.enforceTokenOp("recall_tier_explain");
       const sessionParam = parsed.searchParams.get("session");
       const sessionKey = sessionParam && sessionParam.length > 0 ? sessionParam : void 0;
       const namespaceParam = parsed.searchParams.get("namespace");
@@ -1044,7 +1092,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/recall/xray") {
-      void getOperation("recall_xray");
+      this.enforceTokenOp("recall_xray");
       const queryParam = parsed.searchParams.get("q");
       if (!queryParam || queryParam.trim().length === 0) {
         this.respondJson(res, 400, {
@@ -1113,12 +1161,12 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/wearables/status" || pathname === "/remnic/v1/wearables/status")) {
-      void getOperation("wearables_status");
+      this.enforceTokenOp("wearables_status");
       this.respondJson(res, 200, await this.service.wearablesStatus());
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/wearables/sync" || pathname === "/remnic/v1/wearables/sync")) {
-      void getOperation("wearables_sync");
+      this.enforceTokenOp("wearables_sync");
       const body = await this.readJsonBody(req);
       const source = optionalQueryString(body.source, "source");
       const date = optionalQueryString(body.date, "date");
@@ -1151,7 +1199,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/wearables/transcript" || pathname === "/remnic/v1/wearables/transcript")) {
-      void getOperation("transcript_day");
+      this.enforceTokenOp("transcript_day");
       const date = parsed.searchParams.get("date");
       if (!date || date.trim().length === 0) {
         throw new EngramAccessInputError(
@@ -1172,7 +1220,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/wearables/transcripts/search" || pathname === "/remnic/v1/wearables/transcripts/search")) {
-      void getOperation("transcript_search");
+      this.enforceTokenOp("transcript_search");
       const queryParam = parsed.searchParams.get("q");
       if (!queryParam || queryParam.trim().length === 0) {
         throw new EngramAccessInputError(
@@ -1195,7 +1243,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && (pathname === "/engram/v1/wearables/memories" || pathname === "/remnic/v1/wearables/memories")) {
-      void getOperation("transcript_memories");
+      this.enforceTokenOp("transcript_memories");
       try {
         const memories = await this.service.wearablesTranscriptMemories({
           source: nonEmptyQueryParam(parsed.searchParams.get("source")),
@@ -1210,7 +1258,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/observe") {
-      void getOperation("observe");
+      this.enforceTokenOp("observe");
       const body = await this.readValidatedBody(req, "observe");
       const response = await this.service.observe(
         {
@@ -1247,7 +1295,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/lcm/search") {
-      void getOperation("lcm_search");
+      this.enforceTokenOp("lcm_search");
       const body = await this.readValidatedBody(req, "lcmSearch");
       const response = await this.service.lcmSearch({
         query: body.query,
@@ -1261,7 +1309,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/lcm/compaction/flush" || pathname === "/remnic/v1/lcm/compaction/flush")) {
-      void getOperation("lcm_compaction_flush");
+      this.enforceTokenOp("lcm_compaction_flush");
       const body = await this.readValidatedBody(req, "lcmCompactionFlush");
       this.ensureWriteRateLimitAvailable();
       const response = await this.service.lcmCompactionFlush({
@@ -1274,7 +1322,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/lcm/compaction/record" || pathname === "/remnic/v1/lcm/compaction/record")) {
-      void getOperation("lcm_compaction_record");
+      this.enforceTokenOp("lcm_compaction_record");
       const body = await this.readValidatedBody(req, "lcmCompactionRecord");
       this.ensureWriteRateLimitAvailable();
       const response = await this.service.lcmCompactionRecord({
@@ -1289,7 +1337,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/lcm/status") {
-      void getOperation("lcm_status");
+      this.enforceTokenOp("lcm_status");
       this.respondJson(res, 200, await this.service.lcmStatus());
       return;
     }
@@ -1325,7 +1373,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new EngramAccessInputError("access-boundary: operation not registered: coding_decision");
       }
-      const output = await op.run(body, {
+      const output = await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req)
       });
@@ -1345,7 +1393,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new EngramAccessInputError("access-boundary: operation not registered: coding_architecture");
       }
-      const output = await op.run(body, {
+      const output = await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req)
       });
@@ -1361,7 +1409,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new EngramAccessInputError("access-boundary: operation not registered: coding_delta");
       }
-      const output = await op.run(body, {
+      const output = await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req)
       });
@@ -1375,7 +1423,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_plan");
       }
-      const output = await op.run(body, {
+      const output = await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req)
       });
@@ -1390,7 +1438,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new EngramAccessInputError("access-boundary: operation not registered: memory_correct_apply");
       }
-      const output = await op.run(body, {
+      const output = await op.run(this.gatedBodyNamespace(req, body), {
         service: this.service,
         authenticatedPrincipal: this.resolveRequestPrincipal(req)
       });
@@ -1402,12 +1450,12 @@ var EngramAccessHttpServer = class {
       const op = getOperation("correction_pending");
       if (op) {
         const output = await op.run(
-          { namespace: parsed.searchParams.get("namespace") ?? void 0, sessionKey: parsed.searchParams.get("sessionKey") ?? void 0 },
+          { namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0), sessionKey: parsed.searchParams.get("sessionKey") ?? void 0 },
           { service: this.service, authenticatedPrincipal: this.resolveRequestPrincipal(req) }
         );
         this.respondJson(res, 200, output.result);
       } else {
-        const namespace = parsed.searchParams.get("namespace") ?? void 0;
+        const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
         const sessionKey = parsed.searchParams.get("sessionKey") ?? void 0;
         const plans = await this.service.correctionListPending({
           ...namespace ? { namespace } : {},
@@ -1419,7 +1467,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/suggestions") {
-      void getOperation("suggestion_submit");
+      this.enforceTokenOp("suggestion_submit");
       const body = await this.readValidatedBody(req, "suggestionSubmit");
       const request = {
         schemaVersion: body.schemaVersion,
@@ -1448,7 +1496,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/memories") {
-      void getOperation("memory_list");
+      this.enforceTokenOp("memory_list");
       const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
       const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
       const sort = parseMemorySort(parsed.searchParams.get("sort"));
@@ -1456,7 +1504,7 @@ var EngramAccessHttpServer = class {
         query: parsed.searchParams.get("q") ?? void 0,
         status: parsed.searchParams.get("status") ?? void 0,
         category: parsed.searchParams.get("category") ?? void 0,
-        namespace: parsed.searchParams.get("namespace") ?? void 0,
+        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
         sort,
         limit,
@@ -1482,7 +1530,7 @@ var EngramAccessHttpServer = class {
     const memoryMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)$/);
     if (req.method === "GET" && memoryMatch) {
       const memoryId = decodeURIComponent(memoryMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
       const sessionKey = this.resolveRequestIdentity(req).sessionKey ?? parsed.searchParams.get("session") ?? parsed.searchParams.get("sessionKey") ?? void 0;
       const op = getOperation("memory_get");
       if (!op) {
@@ -1497,21 +1545,21 @@ var EngramAccessHttpServer = class {
       return;
     }
     const timelineMatch = pathname.match(/^\/engram\/v1\/memories\/([^/]+)\/timeline$/);
-    void getOperation("memory_timeline");
     if (req.method === "GET" && timelineMatch) {
+      this.enforceTokenOp("memory_timeline");
       const memoryId = decodeURIComponent(timelineMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
       const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 200, 1);
       const response = await this.service.memoryTimeline(memoryId, namespace, limit, this.resolveRequestPrincipal(req));
       this.respondJson(res, response.found ? 200 : 404, response);
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/entities") {
-      void getOperation("entity_list");
+      this.enforceTokenOp("entity_list");
       const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
       const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
       const response = await this.service.entityList({
-        namespace: parsed.searchParams.get("namespace") ?? void 0,
+        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
         query: parsed.searchParams.get("q") ?? void 0,
         limit,
         offset
@@ -1520,45 +1568,47 @@ var EngramAccessHttpServer = class {
       return;
     }
     const entityMatch = pathname.match(/^\/engram\/v1\/entities\/([^/]+)$/);
-    void getOperation("entity_get");
     if (req.method === "GET" && entityMatch) {
+      this.enforceTokenOp("entity_get");
       const entityName = decodeURIComponent(entityMatch[1] ?? "");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
       const response = await this.service.entityGet(entityName, namespace);
       this.respondJson(res, response.found ? 200 : 404, response);
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/review-queue") {
-      void getOperation("review_queue_list");
+      this.enforceTokenOp("review_queue_list");
       const response = await this.service.reviewQueue(
         parsed.searchParams.get("runId") ?? void 0,
-        parsed.searchParams.get("namespace") ?? void 0,
+        this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
         this.resolveRequestPrincipal(req)
       );
       this.respondJson(res, 200, response);
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/maintenance") {
-      void getOperation("maintenance_status");
-      this.respondJson(res, 200, await this.service.maintenance(parsed.searchParams.get("namespace") ?? void 0, this.resolveRequestPrincipal(req)));
+      this.enforceTokenOp("maintenance_status");
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
+      this.respondJson(res, 200, await this.service.maintenance(namespace, this.resolveRequestPrincipal(req)));
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/quality") {
-      void getOperation("quality_status");
-      this.respondJson(res, 200, await this.service.quality(parsed.searchParams.get("namespace") ?? void 0, this.resolveRequestPrincipal(req)));
+      this.enforceTokenOp("quality_status");
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
+      this.respondJson(res, 200, await this.service.quality(namespace, this.resolveRequestPrincipal(req)));
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/trust-zones/status") {
-      void getOperation("trust_zones_status");
+      this.enforceTokenOp("trust_zones_status");
       this.respondJson(
         res,
         200,
-        await this.service.trustZoneStatus(parsed.searchParams.get("namespace") ?? void 0, this.resolveRequestPrincipal(req))
+        await this.service.trustZoneStatus(this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0), this.resolveRequestPrincipal(req))
       );
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/procedural/stats") {
-      void getOperation("procedural_stats");
+      this.enforceTokenOp("procedural_stats");
       const namespaceParam = parsed.searchParams.get("namespace");
       this.respondJson(
         res,
@@ -1576,7 +1626,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/trust-zones/records") {
-      void getOperation("trust_zones_records");
+      this.enforceTokenOp("trust_zones_records");
       const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 25, 1);
       const offset = parseStrictIntegerQuery(parsed.searchParams.get("offset"), "offset", 0, 0);
       const response = await this.service.trustZoneBrowse({
@@ -1584,7 +1634,7 @@ var EngramAccessHttpServer = class {
         zone: parseTrustZoneFilter(parsed.searchParams.get("zone")),
         kind: parseTrustZoneKindFilter(parsed.searchParams.get("kind")),
         sourceClass: parseTrustZoneSourceClassFilter(parsed.searchParams.get("sourceClass")),
-        namespace: parsed.searchParams.get("namespace") ?? void 0,
+        namespace: this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0),
         limit,
         offset
       }, this.resolveRequestPrincipal(req));
@@ -1592,7 +1642,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/review-disposition") {
-      void getOperation("review_disposition");
+      this.enforceTokenOp("review_disposition");
       const body = await this.readValidatedBody(req, "reviewDisposition");
       this.ensureWriteRateLimitAvailable();
       const response = await this.service.reviewDisposition({
@@ -1609,7 +1659,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/trust-zones/promote") {
-      void getOperation("trust_zones_promote");
+      this.enforceTokenOp("trust_zones_promote");
       const body = await this.readValidatedBody(req, "trustZonePromote");
       const dryRun = body.dryRun === true;
       if (!dryRun) {
@@ -1632,7 +1682,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/trust-zones/demo-seed") {
-      void getOperation("trust_zones_demo_seed");
+      this.enforceTokenOp("trust_zones_demo_seed");
       const body = await this.readValidatedBody(req, "trustZoneDemoSeed");
       const dryRun = body.dryRun === true;
       if (!dryRun) {
@@ -1652,7 +1702,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/v1/citations/observed") {
-      void getOperation("citations_observed");
+      this.enforceTokenOp("citations_observed");
       const body = await this.readJsonBody(req);
       if (!body || typeof body !== "object" || Array.isArray(body)) {
         throw new HttpError(400, "request body must be a JSON object", "invalid_body");
@@ -1712,19 +1762,15 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/review/contradictions") {
-      void getOperation("review_list");
+      this.enforceTokenOp("review_list");
       const VALID_FILTERS = /* @__PURE__ */ new Set(["all", "unresolved", "contradicts", "independent", "duplicates", "needs-user"]);
       const rawFilter = parsed.searchParams.get("filter") ?? "unresolved";
       if (!VALID_FILTERS.has(rawFilter)) {
         this.respondJson(res, 400, { error: `Invalid filter '${rawFilter}'. Valid: ${[...VALID_FILTERS].join(", ")}` });
         return;
       }
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
       const limit = parseStrictIntegerQuery(parsed.searchParams.get("limit"), "limit", 50, 1);
-      const {
-        isDefaultReviewNamespace,
-        listPairs
-      } = await import("./contradiction-review-QKJH5DKD.js");
       const principal = this.resolveRequestPrincipal(req);
       const resolved = await this.service.getReadableStorageForNamespace(namespace, principal);
       const reviewNamespace = this.service.configRef.namespacesEnabled ? resolved.namespace : void 0;
@@ -1741,14 +1787,18 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname.startsWith("/engram/v1/review/contradictions/")) {
-      void getOperation("contradiction_detail");
+      this.enforceTokenOp("contradiction_detail");
       const pairId = pathname.split("/").pop() ?? "";
-      const { readPair } = await import("./contradiction-review-QKJH5DKD.js");
       const pair = readPair(this.service.memoryDir, pairId);
       if (!pair) {
         this.respondJson(res, 404, { error: "pair_not_found" });
         return;
       }
+      enforceNamespaceAllowList(
+        tokenCapabilityStore.getStore(),
+        pair.namespace,
+        this.service.configRef?.defaultNamespace
+      );
       try {
         await this.service.getReadableStorageForNamespace(pair.namespace, this.resolveRequestPrincipal(req));
       } catch {
@@ -1759,7 +1809,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/review/resolve") {
-      void getOperation("review_resolve");
+      this.enforceTokenOp("review_resolve");
       const body = await this.readJsonBody(req);
       const pairId = typeof body.pairId === "string" ? body.pairId : "";
       const verb = typeof body.verb === "string" ? body.verb : "";
@@ -1767,11 +1817,18 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 400, { error: "pairId and verb are required" });
         return;
       }
-      const { isValidResolutionVerb, executeResolution } = await import("./resolution-VH4NGENZ.js");
       if (!isValidResolutionVerb(verb)) {
         this.respondJson(res, 400, { error: `Invalid verb: ${verb}. Must be one of: keep-a, keep-b, merge, both-valid, needs-more-context` });
         return;
       }
+      const targetPair = readPair(this.service.memoryDir, pairId);
+      if (targetPair) {
+        enforceNamespaceAllowList(
+          tokenCapabilityStore.getStore(),
+          targetPair.namespace,
+          this.service.configRef?.defaultNamespace
+        );
+      }
       const principal = this.resolveRequestPrincipal(req);
       const result = await executeResolution(this.service.memoryDir, this.service.storageRef, pairId, verb, {
         mergedMemoryId: typeof body.mergedMemoryId === "string" ? body.mergedMemoryId : void 0,
@@ -1791,7 +1848,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/graph/snapshot") {
-      void getOperation("graph_snapshot");
+      this.enforceTokenOp("graph_snapshot");
       const limitRaw = parsed.searchParams.get("limit");
       let limit;
       if (limitRaw !== null && limitRaw.length > 0) {
@@ -1865,7 +1922,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
-      void getOperation("contradiction_scan_run");
+      this.enforceTokenOp("contradiction_scan_run");
       const body = await this.readJsonBody(req);
       const { runContradictionScan } = await import("./contradiction-scan-SSKCAMLX.js");
       const principal = this.resolveRequestPrincipal(req);
@@ -1877,19 +1934,29 @@ var EngramAccessHttpServer = class {
         storageForNamespace: (namespace) => this.service.getWritableStorageForNamespace(namespace, principal),
         localLlm: this.service.localLlmRef,
         fallbackLlm: this.service.fallbackLlmRef,
-        namespace: typeof body.namespace === "string" ? body.namespace : void 0
+        namespace: this.resolveNamespace(req, typeof body.namespace === "string" ? body.namespace : void 0)
       });
       this.respondJson(res, 200, result);
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/graph/events") {
-      void getOperation("graph_events");
+      this.enforceTokenOp("graph_events");
       await this.handleGraphEventsSSE(req, res);
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/chat/message") {
-      void getOperation("chat_message");
+      this.enforceTokenOp("chat_message");
       const body = await this.readJsonBody(req);
+      const resumeChatSessionId = typeof body.chatSessionId === "string" ? body.chatSessionId : void 0;
+      if (resumeChatSessionId) {
+        await enforceChatSessionNamespace(this.service, resumeChatSessionId);
+      } else {
+        enforceNamespaceAllowList(
+          tokenCapabilityStore.getStore(),
+          void 0,
+          this.service.configRef?.defaultNamespace
+        );
+      }
       await handleChatMessage(
         req,
         res,
@@ -1901,7 +1968,8 @@ var EngramAccessHttpServer = class {
     }
     const chatEventsMatch = /^\/engram\/v1\/chat\/events\/([^/]+)$/.exec(pathname);
     if (req.method === "GET" && chatEventsMatch) {
-      void getOperation("chat_events");
+      this.enforceTokenOp("chat_events");
+      await enforceChatSessionNamespace(this.service, chatEventsMatch[1] ?? "");
       await handleChatEventsSSE(
         req,
         res,
@@ -1927,21 +1995,21 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/console/state") {
-      void getOperation("console_state");
-      const namespace = parsed.searchParams.get("namespace") ?? void 0;
+      this.enforceTokenOp("console_state");
+      const namespace = this.resolveNamespace(req, parsed.searchParams.get("namespace") ?? void 0);
       const snapshot = await this.service.consoleState(namespace, this.resolveRequestPrincipal(req));
       this.respondJson(res, 200, snapshot);
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/peers") {
-      void getOperation("peer_list");
+      this.enforceTokenOp("peer_list");
       const result = await this.service.peerList();
       this.respondJson(res, 200, result);
       return;
     }
     const peerProfileMatch = /^\/engram\/v1\/peers\/([^/]+)\/profile$/.exec(pathname);
     if (peerProfileMatch) {
-      void getOperation("peer_profile_get");
+      this.enforceTokenOp("peer_profile_get");
       if (req.method !== "GET") {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
@@ -1959,7 +2027,7 @@ var EngramAccessHttpServer = class {
     if (peerIdMatch) {
       const peerId = decodePeerIdSegment(peerIdMatch[1] ?? "");
       if (req.method === "GET") {
-        void getOperation("peer_get");
+        this.enforceTokenOp("peer_get");
         const result = await this.service.peerGet(peerId);
         if (!result.found) {
           this.respondJson(res, 404, { error: "peer_not_found", code: "peer_not_found" });
@@ -1969,7 +2037,7 @@ var EngramAccessHttpServer = class {
         return;
       }
       if (req.method === "PUT") {
-        void getOperation("peer_set");
+        this.enforceTokenOp("peer_set");
         const body = await this.readJsonBody(req);
         if ("kind" in body && body.kind !== void 0 && typeof body.kind !== "string") {
           throw new EngramAccessInputError("kind must be a string when provided");
@@ -1990,7 +2058,7 @@ var EngramAccessHttpServer = class {
         return;
       }
       if (req.method === "DELETE") {
-        void getOperation("peer_delete");
+        this.enforceTokenOp("peer_delete");
         const forgetParam = parsed.searchParams.get("forget");
         if (forgetParam === "true") {
           const body = await this.readJsonBody(req);
@@ -2015,7 +2083,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "GET" && pathname === "/engram/v1/dreams/status") {
-      void getOperation("dreams_status");
+      this.enforceTokenOp("dreams_status");
       const { normalizeDreamsStatusWindowHours } = await import("./dreams-ledger-6UODQOX6.js");
       const windowHoursRaw = parsed.searchParams.get("windowHours");
       let windowHours;
@@ -2028,7 +2096,7 @@ var EngramAccessHttpServer = class {
         return;
       }
       const namespaceParam = parsed.searchParams.get("namespace");
-      const namespace = namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0;
+      const namespace = this.resolveNamespace(req, namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0);
       const result = await this.service.dreamsStatus({
         windowHours,
         namespace,
@@ -2038,7 +2106,7 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && pathname === "/engram/v1/dreams/run") {
-      void getOperation("dreams_run");
+      this.enforceTokenOp("dreams_run");
       const body = await this.readJsonBody(req);
       const VALID_PHASES = ["lightSleep", "rem", "deepSleep"];
       const phase = typeof body.phase === "string" ? body.phase : void 0;
@@ -2061,7 +2129,7 @@ var EngramAccessHttpServer = class {
         return;
       }
       const dryRun = body.dryRun === true;
-      const namespace = typeof body.namespace === "string" ? body.namespace : void 0;
+      const namespace = this.resolveNamespace(req, typeof body.namespace === "string" ? body.namespace : void 0);
       if (!dryRun) {
         this.ensureWriteRateLimitAvailable();
       }
@@ -2082,6 +2150,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      this.requireOperatorToken();
       const principal = this.resolveRequestPrincipal(req);
       let sessionKey;
       let namespaceOverride;
@@ -2110,6 +2179,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      this.requireOperatorToken();
       const kind = parsed.searchParams.get("kind");
       const principal = parsed.searchParams.get("principal");
       const projectId = parsed.searchParams.get("projectId");
@@ -2128,6 +2198,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      this.requireOperatorToken();
       const report = await this.service.adminMaintenanceHealth();
       this.respondJson(res, 200, report);
       return;
@@ -2137,6 +2208,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      this.requireOperatorToken();
       const report = await this.service.adminTranscriptAudit();
       this.respondJson(res, 200, report);
       return;
@@ -2146,6 +2218,7 @@ var EngramAccessHttpServer = class {
         this.respondJson(res, 405, { error: "method_not_allowed", code: "method_not_allowed" });
         return;
       }
+      this.requireOperatorToken();
       const body = await this.readJsonBody(req);
       if (typeof body.sourceMemoryId !== "string" || body.sourceMemoryId.trim().length === 0) {
         this.respondJson(res, 400, {
@@ -2253,7 +2326,7 @@ var EngramAccessHttpServer = class {
   async handleGraphEventsSSE(req, res) {
     const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
     const namespaceParam = parsed.searchParams.get("namespace");
-    const namespace = namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0;
+    const namespace = this.resolveNamespace(req, namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0);
     const principal = this.resolveRequestPrincipal(req);
     const memoryDir = await this.service.getMemoryDirForNamespace(namespace, principal);
     res.writeHead(200, {
@@ -2360,6 +2433,14 @@ var EngramAccessHttpServer = class {
     })();
     const mcpCorrelationId = correlationIdStore.getStore() ?? randomUUID();
     const requestIdentity = this.resolveRequestIdentity(req);
+    if (request.method === "tools/call" && this.mcpServer.toolAcceptsNamespace(toolName)) {
+      const mcpExplicitNamespace = toolArgs !== null && typeof toolArgs === "object" && !Array.isArray(toolArgs) && typeof toolArgs.namespace === "string" && toolArgs.namespace.length > 0 ? toolArgs.namespace : void 0;
+      enforceNamespaceAllowList(
+        tokenCapabilityStore.getStore(),
+        mcpExplicitNamespace ?? requestIdentity.namespace,
+        this.service.configRef?.defaultNamespace
+      );
+    }
     const response = await this.mcpServer.handleRequest(request, {
       principalOverride: requestIdentity.principal,
       namespaceOverride: requestIdentity.namespace,
@@ -2643,8 +2724,18 @@ var EngramAccessHttpServer = class {
     return "Bearer";
   }
   isAuthorized(req, pathname) {
+    return this.resolveAuthorizedEntry(req, pathname) !== null;
+  }
+  /**
+   * Resolve the presenting token's entry for an authorized request, or null.
+   * Captures the matched entry — including its capabilities record — so the
+   * op/namespace capability enforcement (issue #1837) uses the SAME entry
+   * that validated. Static operator tokens (`authToken`/`authTokens`) and
+   * the string-token getter carry no capabilities ⇒ unrestricted.
+   */
+  resolveAuthorizedEntry(req, pathname) {
     if (!this.authToken && this.authTokens.length === 0 && !this.authTokensGetter && !this.authTokenEntriesGetter) {
-      return false;
+      return null;
     }
     const raw = req.headers.authorization;
     let candidate = null;
@@ -2667,27 +2758,69 @@ var EngramAccessHttpServer = class {
       } catch {
       }
     }
-    if (!candidate) return false;
+    if (!candidate) return null;
     const token = candidate;
-    if (this.authToken && this.timingSafeStringEqual(token, this.authToken)) return true;
+    if (this.authToken && this.timingSafeStringEqual(token, this.authToken)) {
+      return { token };
+    }
     for (const valid of this.authTokens) {
-      if (this.timingSafeStringEqual(token, valid)) return true;
+      if (this.timingSafeStringEqual(token, valid)) return { token: valid };
     }
     if (this.authTokenEntriesGetter) {
       for (const entry of this.authTokenEntriesGetter()) {
         if (!this.timingSafeStringEqual(token, entry.token)) continue;
-        if (!this.tokenPathPolicy) return true;
-        if (typeof entry.connector !== "string" || entry.connector.length === 0) return false;
-        return this.tokenPathPolicy(entry.connector, pathname);
+        const matched = { token: entry.token, connector: entry.connector, capabilities: entry.capabilities };
+        if (!this.tokenPathPolicy) return matched;
+        if (typeof entry.connector !== "string" || entry.connector.length === 0) return null;
+        return this.tokenPathPolicy(entry.connector, pathname) ? matched : null;
       }
-      return false;
+      return null;
     }
     if (this.authTokensGetter) {
       for (const valid of this.authTokensGetter()) {
-        if (this.timingSafeStringEqual(token, valid)) return true;
+        if (this.timingSafeStringEqual(token, valid)) return { token: valid };
       }
     }
-    return false;
+    return null;
+  }
+  /** Cache for per-request capability resolution (avoids re-resolving). */
+  capabilityCache = /* @__PURE__ */ new WeakMap();
+  /**
+   * Resolve the presenting token's capabilities for this request, or
+   * undefined when the token is unrestricted (legacy / static operator /
+   * explicit-unrestricted record). Cached per-request. `null` sentinel
+   * distinguishes "resolved as unrestricted" from "not yet resolved".
+   */
+  resolveTokenCapabilities(req, pathname) {
+    if (this.capabilityCache.has(req)) {
+      return this.capabilityCache.get(req) ?? void 0;
+    }
+    const caps = this.resolveAuthorizedEntry(req, pathname)?.capabilities;
+    this.capabilityCache.set(req, caps ?? null);
+    return caps;
+  }
+  /**
+   * Enforce the presenting token's ops allow-list for an HTTP route that
+   * dispatches directly to the service (not through the boundary). Reads the
+   * per-request capability context set in `handle`; unrestricted tokens
+   * pass. Throws {@link EngramAccessForbiddenError} (→ 403) when a scoped
+   * token calls a non-permitted op (issue #1837).
+   */
+  enforceTokenOp(op) {
+    void getOperation(op);
+    assertOperationAllowed(tokenCapabilityStore.getStore(), op);
+  }
+  /**
+   * Operator/admin routes are unrestricted-only surfaces: a scoped
+   * (least-privileged) token must NOT reach them (issue #1837). Legacy and
+   * explicit-unrestricted tokens pass. Throws EngramAccessForbiddenError (→403).
+   */
+  requireOperatorToken() {
+    if (isCapabilityRestricted(tokenCapabilityStore.getStore())) {
+      throw new EngramAccessForbiddenError(
+        "token is scoped and may not access operator/admin routes"
+      );
+    }
   }
   timingSafeStringEqual(a, b) {
     const left = this.encodeSecret(a);
@@ -2765,4 +2898,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-2FOD2YY3.js.map
+//# sourceMappingURL=chunk-UFUKHGZD.js.map