@remnic/core 9.4.2 → 9.6.0

package/dist/access-http.d.ts

@@ -1,14 +1,15 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { F as EngramAccessService } from './access-service-m-2VO_Ig.js';
+import { F as EngramAccessService } from './access-service-CXJaql3A.js';
 import { ResolvedIdentity } from './adapters/types.js';
 import { AdapterRegistry } from './adapters/registry.js';
-import './catalog-BxWokdC2.js';
-import './types-ljkd82rn.js';
+import { TokenCapabilities } from './access-token-capabilities.js';
+import './catalog-C9cu67Ig.js';
+import './types-CGgcNWCG.js';
 import './types-gb_SNtjR.js';
 import './message-parts/index.js';
-import './orchestrator-B2Y28Z9t.js';
+import './orchestrator-CWFrT8AF.js';
 import './briefing.js';
-import './storage.js';
+import './storage-C1maCNbc.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -37,7 +38,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-BDVIbLRw.js';
+import './semantic-consolidation-O5lMZ4LG.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -94,6 +95,7 @@ import './transfer/capsule-export.js';
 import './capsule-cli.js';
 import './offline-sync.js';
 import './action-confidence.js';
+import 'node:async_hooks';
 
 interface AccessHttpReadinessState {
     ready: boolean;
@@ -118,6 +120,7 @@ interface EngramAccessHttpServerOptions {
     authTokenEntriesGetter?: () => ReadonlyArray<{
         token: string;
         connector?: string;
+        capabilities?: TokenCapabilities;
     }>;
     /**
      * Optional per-request scope policy for tokens sourced from
@@ -292,6 +295,17 @@ declare class EngramAccessHttpServer {
      *  is intentionally NOT used as a fallback for REST requests — omitting namespace
      *  should default to the server's global namespace, not silently scope to an adapter. */
     private resolveNamespace;
+    /**
+     * Resolve + enforce the `namespace` field carried in a POST request body,
+     * returning a shallow-copied envelope with the gated namespace stamped on.
+     * Used by the coding/correction POST routes that pass `body` straight to
+     * `op.run`: the body `namespace` is a user-controlled field that MUST flow
+     * through the same effective-namespace allow-list gate as the query-param
+     * routes, otherwise a scoped bearer can scope its call to another tenant
+     * by setting `body.namespace` (issue #1850 finding 2). Throws 403 for a
+     * scoped token whose allow-list does not cover the effective namespace.
+     */
+    private gatedBodyNamespace;
     /**
      * Resolve the recall disclosure depth from the request (issue #677 PR
      * 2/4).  Explicit body value wins; otherwise we accept a
@@ -303,6 +317,7 @@ declare class EngramAccessHttpServer {
      */
     private resolveRecallDisclosure;
     private handle;
+    private dispatchAuthorizedRequest;
     private createRequestAbortSignal;
     /**
      * SSE handler for /engram/v1/graph/events.
@@ -348,6 +363,37 @@ declare class EngramAccessHttpServer {
      */
     private bearerChallenge;
     private isAuthorized;
+    /**
+     * Resolve the presenting token's entry for an authorized request, or null.
+     * Captures the matched entry — including its capabilities record — so the
+     * op/namespace capability enforcement (issue #1837) uses the SAME entry
+     * that validated. Static operator tokens (`authToken`/`authTokens`) and
+     * the string-token getter carry no capabilities ⇒ unrestricted.
+     */
+    private resolveAuthorizedEntry;
+    /** Cache for per-request capability resolution (avoids re-resolving). */
+    private capabilityCache;
+    /**
+     * Resolve the presenting token's capabilities for this request, or
+     * undefined when the token is unrestricted (legacy / static operator /
+     * explicit-unrestricted record). Cached per-request. `null` sentinel
+     * distinguishes "resolved as unrestricted" from "not yet resolved".
+     */
+    private resolveTokenCapabilities;
+    /**
+     * Enforce the presenting token's ops allow-list for an HTTP route that
+     * dispatches directly to the service (not through the boundary). Reads the
+     * per-request capability context set in `handle`; unrestricted tokens
+     * pass. Throws {@link EngramAccessForbiddenError} (→ 403) when a scoped
+     * token calls a non-permitted op (issue #1837).
+     */
+    private enforceTokenOp;
+    /**
+     * Operator/admin routes are unrestricted-only surfaces: a scoped
+     * (least-privileged) token must NOT reach them (issue #1837). Legacy and
+     * explicit-unrestricted tokens pass. Throws EngramAccessForbiddenError (→403).
+     */
+    private requireOperatorToken;
     private timingSafeStringEqual;
     private encodeSecret;
     private writeResponseStatus;

package/dist/access-http.js

@@ -1,32 +1,34 @@
 import {
   EngramAccessHttpServer
-} from "./chunk-2FOD2YY3.js";
+} from "./chunk-UFUKHGZD.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
-import "./chunk-2QSZNTDO.js";
+import "./chunk-RKNJBZ55.js";
+import "./chunk-J64TK33U.js";
 import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-TMSXWOBZ.js";
-import "./chunk-J64TK33U.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-DR6PEJU3.js";
+import "./chunk-PCLIWBGD.js";
+import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-5RUE3GHQ.js";
-import "./chunk-NG7YBCJO.js";
-import "./chunk-2MR3MFQB.js";
-import "./chunk-ILFJ7AVS.js";
-import "./chunk-YF6FMLBT.js";
+import "./chunk-XCL57M6Q.js";
+import "./chunk-UPSAT4PY.js";
+import "./chunk-LADFWYHY.js";
 import "./chunk-HLTAPHZZ.js";
-import "./chunk-PRTA6444.js";
+import "./chunk-YF6FMLBT.js";
 import "./chunk-KQDNAXOM.js";
+import "./chunk-PRTA6444.js";
 import "./chunk-35NN3ZFA.js";
 import "./chunk-FTYDWKO6.js";
 import "./chunk-T4WDJPEZ.js";
-import "./chunk-FZGGZAAU.js";
-import "./chunk-X4A62ET7.js";
+import "./chunk-4GNEDXDI.js";
+import "./chunk-D7FOKIY5.js";
+import "./chunk-H2DXDQCQ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
-import "./chunk-M5QKGHCR.js";
+import "./chunk-CYWCKFCL.js";
 import "./chunk-64SE4X5G.js";
 import "./chunk-VQ7B2Q6M.js";
 import "./chunk-ERA5RSMZ.js";
@@ -35,30 +37,30 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-H7XKCNR6.js";
 import "./chunk-2KK5WNQB.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-6MMONPHM.js";
+import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
 import "./chunk-6HMYUWXR.js";
 import "./chunk-BAVVI5GP.js";
-import "./chunk-4BFRBP45.js";
-import "./chunk-27FLVMDC.js";
+import "./chunk-DEG5ULFJ.js";
+import "./chunk-HLN7RROI.js";
+import "./chunk-7MW3CVLD.js";
 import "./chunk-ZIDSD6VC.js";
 import "./chunk-QWGNDWKB.js";
-import "./chunk-YDSWRD33.js";
-import "./chunk-4P4626RY.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-CZAZX7JP.js";
+import "./chunk-N3JDIRBW.js";
+import "./chunk-UTRJFDP2.js";
+import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-AER6MT24.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-IC6QX5TC.js";
-import "./chunk-AKUCU7CI.js";
-import "./chunk-FC77VUX5.js";
+import "./chunk-3XIY7MDQ.js";
+import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
+import "./chunk-FC77VUX5.js";
 import "./chunk-3F4N4WDH.js";
 import "./chunk-WU46YPY6.js";
 import "./chunk-64UDOIMI.js";
@@ -72,29 +74,31 @@ import "./chunk-K5LLP4CY.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
+import "./chunk-7XGSIUP5.js";
 import "./chunk-OBMR4VIX.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
-import "./chunk-CXLNZXG5.js";
-import "./chunk-DGYCWCQ7.js";
-import "./chunk-M7GGMGMZ.js";
-import "./chunk-M7XQSUBB.js";
+import "./chunk-TBBDFYXW.js";
+import "./chunk-ZBJMUXZH.js";
+import "./chunk-Y7UNNAZD.js";
+import "./chunk-SVOHGUMI.js";
+import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-5GPPACXK.js";
+import "./chunk-VSMRDBFT.js";
 import "./chunk-EHK6KZHK.js";
 import "./chunk-6CIAGZ6X.js";
-import "./chunk-SVOZFLIQ.js";
-import "./chunk-LTJAMRGI.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
+import "./chunk-SVOZFLIQ.js";
+import "./chunk-LTJAMRGI.js";
 import "./chunk-JS2HKKOK.js";
+import "./chunk-RHOZ5LLO.js";
+import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-RHOZ5LLO.js";
-import "./chunk-RL6NEVXT.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-MNUHL34L.js";
@@ -108,12 +112,12 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-VFSP73LP.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-FLVL4L3L.js";
-import "./chunk-WEHSQBFR.js";
-import "./chunk-437S3G37.js";
+import "./chunk-KTULX4YO.js";
+import "./chunk-LNQUAJNC.js";
 import "./chunk-GWTFLF2P.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
+import "./chunk-WEHSQBFR.js";
 import "./chunk-J4EB7DNW.js";
 import "./chunk-Z2YFLXHU.js";
 import "./chunk-I4WBNM3M.js";
@@ -123,8 +127,8 @@ import "./chunk-U3PN77QT.js";
 import "./chunk-VSF7AAGE.js";
 import "./chunk-OEHCMALU.js";
 import "./chunk-PHK3HARR.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
 import "./chunk-37CTGERM.js";
@@ -137,8 +141,6 @@ import "./chunk-P7FMDTKL.js";
 import "./chunk-VS2IYZRU.js";
 import "./chunk-6MKAMLQL.js";
 import "./chunk-JAKIDQB2.js";
-import "./chunk-TBBDFYXW.js";
-import "./chunk-ZBJMUXZH.js";
 import "./chunk-VFUEZZBS.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-A2IYSXDQ.js";

package/dist/access-identity-continuity-surface.d.ts

@@ -1,7 +1,7 @@
-import { O as Orchestrator } from './orchestrator-B2Y28Z9t.js';
+import { O as Orchestrator } from './orchestrator-CWFrT8AF.js';
 import './briefing.js';
-import './storage.js';
-import './types-ljkd82rn.js';
+import './storage-C1maCNbc.js';
+import './types-CGgcNWCG.js';
 import './types-gb_SNtjR.js';
 import './message-parts/index.js';
 import './page-versioning.js';
@@ -23,7 +23,7 @@ import './session-integrity.js';
 import './summarizer.js';
 import './orchestration/maintenance.js';
 import './namespaces/search.js';
-import './catalog-BxWokdC2.js';
+import './catalog-C9cu67Ig.js';
 import './recall-state.js';
 import './compounding/engine.js';
 import './shared-context/manager.js';
@@ -33,7 +33,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-BDVIbLRw.js';
+import './semantic-consolidation-O5lMZ4LG.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';

package/dist/access-identity-continuity-surface.js

@@ -1,9 +1,9 @@
 import {
   AccessIdentityContinuitySurface
-} from "./chunk-X4A62ET7.js";
+} from "./chunk-H2DXDQCQ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
-import "./chunk-M5QKGHCR.js";
+import "./chunk-CYWCKFCL.js";
 import "./chunk-64SE4X5G.js";
 import "./chunk-VQ7B2Q6M.js";
 import "./chunk-ERA5RSMZ.js";
@@ -12,30 +12,30 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-H7XKCNR6.js";
 import "./chunk-2KK5WNQB.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-6MMONPHM.js";
+import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
 import "./chunk-6HMYUWXR.js";
 import "./chunk-BAVVI5GP.js";
-import "./chunk-4BFRBP45.js";
-import "./chunk-27FLVMDC.js";
+import "./chunk-DEG5ULFJ.js";
+import "./chunk-HLN7RROI.js";
+import "./chunk-7MW3CVLD.js";
 import "./chunk-ZIDSD6VC.js";
 import "./chunk-QWGNDWKB.js";
-import "./chunk-YDSWRD33.js";
-import "./chunk-4P4626RY.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-CZAZX7JP.js";
+import "./chunk-N3JDIRBW.js";
+import "./chunk-UTRJFDP2.js";
+import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-AER6MT24.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-IC6QX5TC.js";
-import "./chunk-AKUCU7CI.js";
-import "./chunk-FC77VUX5.js";
+import "./chunk-3XIY7MDQ.js";
+import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
+import "./chunk-FC77VUX5.js";
 import "./chunk-3F4N4WDH.js";
 import "./chunk-WU46YPY6.js";
 import "./chunk-64UDOIMI.js";
@@ -49,29 +49,31 @@ import "./chunk-K5LLP4CY.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
+import "./chunk-7XGSIUP5.js";
 import "./chunk-OBMR4VIX.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
-import "./chunk-CXLNZXG5.js";
-import "./chunk-DGYCWCQ7.js";
-import "./chunk-M7GGMGMZ.js";
-import "./chunk-M7XQSUBB.js";
+import "./chunk-TBBDFYXW.js";
+import "./chunk-ZBJMUXZH.js";
+import "./chunk-Y7UNNAZD.js";
+import "./chunk-SVOHGUMI.js";
+import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-5GPPACXK.js";
+import "./chunk-VSMRDBFT.js";
 import "./chunk-EHK6KZHK.js";
 import "./chunk-6CIAGZ6X.js";
-import "./chunk-SVOZFLIQ.js";
-import "./chunk-LTJAMRGI.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
+import "./chunk-SVOZFLIQ.js";
+import "./chunk-LTJAMRGI.js";
 import "./chunk-JS2HKKOK.js";
+import "./chunk-RHOZ5LLO.js";
+import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-RHOZ5LLO.js";
-import "./chunk-RL6NEVXT.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-MNUHL34L.js";
@@ -85,12 +87,12 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-VFSP73LP.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-FLVL4L3L.js";
-import "./chunk-WEHSQBFR.js";
-import "./chunk-437S3G37.js";
+import "./chunk-KTULX4YO.js";
+import "./chunk-LNQUAJNC.js";
 import "./chunk-GWTFLF2P.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
+import "./chunk-WEHSQBFR.js";
 import "./chunk-J4EB7DNW.js";
 import "./chunk-Z2YFLXHU.js";
 import "./chunk-I4WBNM3M.js";
@@ -100,8 +102,8 @@ import "./chunk-U3PN77QT.js";
 import "./chunk-VSF7AAGE.js";
 import "./chunk-OEHCMALU.js";
 import "./chunk-PHK3HARR.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
 import "./chunk-37CTGERM.js";
@@ -114,8 +116,6 @@ import "./chunk-P7FMDTKL.js";
 import "./chunk-VS2IYZRU.js";
 import "./chunk-6MKAMLQL.js";
 import "./chunk-JAKIDQB2.js";
-import "./chunk-TBBDFYXW.js";
-import "./chunk-ZBJMUXZH.js";
 import "./chunk-VFUEZZBS.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-A2IYSXDQ.js";

package/dist/access-lcm-surface.d.ts

@@ -1,8 +1,8 @@
-import { O as Orchestrator } from './orchestrator-B2Y28Z9t.js';
-import { d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse } from './access-service-m-2VO_Ig.js';
+import { O as Orchestrator } from './orchestrator-CWFrT8AF.js';
+import { d as EngramAccessLcmSearchRequest, e as EngramAccessLcmSearchResponse } from './access-service-CXJaql3A.js';
 import './briefing.js';
-import './storage.js';
-import './types-ljkd82rn.js';
+import './storage-C1maCNbc.js';
+import './types-CGgcNWCG.js';
 import './types-gb_SNtjR.js';
 import './message-parts/index.js';
 import './page-versioning.js';
@@ -24,7 +24,7 @@ import './session-integrity.js';
 import './summarizer.js';
 import './orchestration/maintenance.js';
 import './namespaces/search.js';
-import './catalog-BxWokdC2.js';
+import './catalog-C9cu67Ig.js';
 import './recall-state.js';
 import './compounding/engine.js';
 import './shared-context/manager.js';
@@ -34,7 +34,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-BDVIbLRw.js';
+import './semantic-consolidation-O5lMZ4LG.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';

package/dist/access-lcm-surface.js

@@ -1,9 +1,9 @@
 import {
   AccessLcmSurface
-} from "./chunk-X4A62ET7.js";
+} from "./chunk-H2DXDQCQ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
-import "./chunk-M5QKGHCR.js";
+import "./chunk-CYWCKFCL.js";
 import "./chunk-64SE4X5G.js";
 import "./chunk-VQ7B2Q6M.js";
 import "./chunk-ERA5RSMZ.js";
@@ -12,30 +12,30 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-H7XKCNR6.js";
 import "./chunk-2KK5WNQB.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-6MMONPHM.js";
+import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
 import "./chunk-6HMYUWXR.js";
 import "./chunk-BAVVI5GP.js";
-import "./chunk-4BFRBP45.js";
-import "./chunk-27FLVMDC.js";
+import "./chunk-DEG5ULFJ.js";
+import "./chunk-HLN7RROI.js";
+import "./chunk-7MW3CVLD.js";
 import "./chunk-ZIDSD6VC.js";
 import "./chunk-QWGNDWKB.js";
-import "./chunk-YDSWRD33.js";
-import "./chunk-4P4626RY.js";
-import "./chunk-CYEPCZN5.js";
-import "./chunk-CZAZX7JP.js";
+import "./chunk-N3JDIRBW.js";
+import "./chunk-UTRJFDP2.js";
+import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
-import "./chunk-AER6MT24.js";
+import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-IC6QX5TC.js";
-import "./chunk-AKUCU7CI.js";
-import "./chunk-FC77VUX5.js";
+import "./chunk-3XIY7MDQ.js";
+import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
+import "./chunk-FC77VUX5.js";
 import "./chunk-3F4N4WDH.js";
 import "./chunk-WU46YPY6.js";
 import "./chunk-64UDOIMI.js";
@@ -49,29 +49,31 @@ import "./chunk-K5LLP4CY.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
+import "./chunk-7XGSIUP5.js";
 import "./chunk-OBMR4VIX.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
-import "./chunk-CXLNZXG5.js";
-import "./chunk-DGYCWCQ7.js";
-import "./chunk-M7GGMGMZ.js";
-import "./chunk-M7XQSUBB.js";
+import "./chunk-TBBDFYXW.js";
+import "./chunk-ZBJMUXZH.js";
+import "./chunk-Y7UNNAZD.js";
+import "./chunk-SVOHGUMI.js";
+import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
-import "./chunk-5GPPACXK.js";
+import "./chunk-VSMRDBFT.js";
 import "./chunk-EHK6KZHK.js";
 import "./chunk-6CIAGZ6X.js";
-import "./chunk-SVOZFLIQ.js";
-import "./chunk-LTJAMRGI.js";
 import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
+import "./chunk-SVOZFLIQ.js";
+import "./chunk-LTJAMRGI.js";
 import "./chunk-JS2HKKOK.js";
+import "./chunk-RHOZ5LLO.js";
+import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";
 import "./chunk-42JKGUFJ.js";
 import "./chunk-RULE4VG5.js";
 import "./chunk-SCU65EZI.js";
-import "./chunk-RHOZ5LLO.js";
-import "./chunk-RL6NEVXT.js";
 import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-MNUHL34L.js";
@@ -85,12 +87,12 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-VFSP73LP.js";
 import "./chunk-RGMVMVMF.js";
 import "./chunk-N7RWREIQ.js";
-import "./chunk-FLVL4L3L.js";
-import "./chunk-WEHSQBFR.js";
-import "./chunk-437S3G37.js";
+import "./chunk-KTULX4YO.js";
+import "./chunk-LNQUAJNC.js";
 import "./chunk-GWTFLF2P.js";
 import "./chunk-UKJAGEXH.js";
 import "./chunk-FP2373TW.js";
+import "./chunk-WEHSQBFR.js";
 import "./chunk-J4EB7DNW.js";
 import "./chunk-Z2YFLXHU.js";
 import "./chunk-I4WBNM3M.js";
@@ -100,8 +102,8 @@ import "./chunk-U3PN77QT.js";
 import "./chunk-VSF7AAGE.js";
 import "./chunk-OEHCMALU.js";
 import "./chunk-PHK3HARR.js";
-import "./chunk-5GKPFL3S.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-5GKPFL3S.js";
 import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
 import "./chunk-37CTGERM.js";
@@ -114,8 +116,6 @@ import "./chunk-P7FMDTKL.js";
 import "./chunk-VS2IYZRU.js";
 import "./chunk-6MKAMLQL.js";
 import "./chunk-JAKIDQB2.js";
-import "./chunk-TBBDFYXW.js";
-import "./chunk-ZBJMUXZH.js";
 import "./chunk-VFUEZZBS.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-A2IYSXDQ.js";

package/dist/access-mcp.d.ts

@@ -1,12 +1,12 @@
 import { Readable, Writable } from 'node:stream';
-import { F as EngramAccessService } from './access-service-m-2VO_Ig.js';
-import './catalog-BxWokdC2.js';
-import './types-ljkd82rn.js';
+import { F as EngramAccessService } from './access-service-CXJaql3A.js';
+import './catalog-C9cu67Ig.js';
+import './types-CGgcNWCG.js';
 import './types-gb_SNtjR.js';
 import './message-parts/index.js';
-import './orchestrator-B2Y28Z9t.js';
+import './orchestrator-CWFrT8AF.js';
 import './briefing.js';
-import './storage.js';
+import './storage-C1maCNbc.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -35,7 +35,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-BDVIbLRw.js';
+import './semantic-consolidation-O5lMZ4LG.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -211,6 +211,16 @@ declare class EngramMcpServer {
     private flushBuffer;
     private writeMessage;
     private toolAcceptsArgument;
+    /**
+     * Whether a tool accepts a `namespace` argument — i.e. it is a
+     * namespace-scoped operation whose effective namespace MUST be gated by the
+     * per-token allow-list. Exposed (public) so the HTTP MCP transport can run
+     * the SAME effective-namespace enforcement the REST surface runs, without
+     * duplicating the tool-schema introspection (issue #1850). Namespace-
+     * agnostic tools (peer/wearables/etc.) return false and stay ungated,
+     * matching the REST surface where those routes never call resolveNamespace.
+     */
+    toolAcceptsNamespace(name: string): boolean;
     /**
      * Determine whether oai-mem-citation guidance should be appended to recall.
      * Returns true when explicitly enabled via config OR when auto-detect is