@remnic/core 9.4.2 → 9.6.0

package/dist/{chunk-M5QKGHCR.js → chunk-CYWCKFCL.js}

@@ -1,13 +1,13 @@
 import {
   createVersion
 } from "./chunk-VF4XKTX3.js";
-import {
-  parseExportBundle
-} from "./chunk-WEHSQBFR.js";
 import {
   decryptCapsuleFileInMemory,
   isEncryptedCapsuleFile
-} from "./chunk-437S3G37.js";
+} from "./chunk-LNQUAJNC.js";
+import {
+  parseExportBundle
+} from "./chunk-WEHSQBFR.js";
 import {
   assertIsDirectoryNotSymlink,
   assertRealpathInsideRoot,
@@ -227,4 +227,4 @@ function mintForkId(capsuleId, originalId, now) {
 export {
   importCapsule
 };
-//# sourceMappingURL=chunk-M5QKGHCR.js.map
+//# sourceMappingURL=chunk-CYWCKFCL.js.map

package/dist/chunk-D7FOKIY5.js

@@ -0,0 +1,173 @@
+import {
+  EngramAccessForbiddenError
+} from "./chunk-RANHFI3P.js";
+
+// src/access-token-capabilities.ts
+import { AsyncLocalStorage } from "async_hooks";
+var TOKEN_CAPABILITIES_VERSION = 1;
+var NAMESPACE_VALUE_MAX_LENGTH = 128;
+var NAMESPACE_VALUE_PATTERN = /^[^\s\/\\\x00-\x1F]+$/;
+function isValidNamespaceValue(value) {
+  if (typeof value !== "string" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {
+    return false;
+  }
+  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;
+  if (value === "." || value === "..") return false;
+  return true;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+function dedupeSort(values) {
+  return [...new Set(values)].sort();
+}
+function parseAxis(obj, key, validateValue, valueLabel) {
+  if (!Object.prototype.hasOwnProperty.call(obj, key)) return void 0;
+  const value = obj[key];
+  if (value === void 0 || value === null) return void 0;
+  if (!isStringArray(value)) {
+    throw new Error(`capabilities ${key} must be an array of non-empty strings`);
+  }
+  const cleaned = [];
+  for (const v of value) {
+    if (typeof v !== "string" || v.length === 0) {
+      throw new Error(`capabilities ${key} must be an array of non-empty strings`);
+    }
+    if (!validateValue(v)) {
+      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);
+    }
+    cleaned.push(v);
+  }
+  return dedupeSort(cleaned);
+}
+function normalizeCapabilities(raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("capabilities must be an object with a version marker");
+  }
+  const obj = raw;
+  if (obj.version !== void 0 && obj.version !== TOKEN_CAPABILITIES_VERSION) {
+    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);
+  }
+  const ops = parseAxis(obj, "ops", () => true, "operation");
+  const namespaces = parseAxis(obj, "namespaces", isValidNamespaceValue, "namespace");
+  const result = { version: TOKEN_CAPABILITIES_VERSION };
+  if (ops !== void 0) result.ops = ops;
+  if (namespaces !== void 0) result.namespaces = namespaces;
+  return result;
+}
+function validateCapabilitiesForMint(raw, validOps) {
+  const result = { version: TOKEN_CAPABILITIES_VERSION };
+  if (raw === void 0 || raw === null) {
+    return result;
+  }
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("capabilities must be an object with optional ops/namespaces arrays");
+  }
+  const obj = raw;
+  if (Object.prototype.hasOwnProperty.call(obj, "version") && obj.version !== void 0) {
+    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {
+      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);
+    }
+  }
+  const validOpSet = new Set(validOps);
+  if (Object.prototype.hasOwnProperty.call(obj, "ops") && obj.ops !== void 0 && obj.ops !== null) {
+    if (!isStringArray(obj.ops)) {
+      throw new Error("capabilities ops must be an array of non-empty strings");
+    }
+    const ops = obj.ops;
+    for (const v of ops) {
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error("capabilities ops must be an array of non-empty strings");
+      }
+    }
+    const unknown = ops.filter((op) => typeof op === "string" && !validOpSet.has(op));
+    if (unknown.length > 0) {
+      throw new Error(
+        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(", ")}`
+      );
+    }
+    result.ops = dedupeSort(ops);
+  }
+  if (Object.prototype.hasOwnProperty.call(obj, "namespaces") && obj.namespaces !== void 0 && obj.namespaces !== null) {
+    if (!isStringArray(obj.namespaces)) {
+      throw new Error("capabilities namespaces must be an array of non-empty strings");
+    }
+    const namespaces = obj.namespaces;
+    for (const v of namespaces) {
+      if (typeof v !== "string" || v.length === 0) {
+        throw new Error("capabilities namespaces must be an array of non-empty strings");
+      }
+      if (!isValidNamespaceValue(v)) {
+        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);
+      }
+    }
+    result.namespaces = dedupeSort(namespaces);
+  }
+  return result;
+}
+function isCapabilityRestricted(caps) {
+  if (!caps) return false;
+  return caps.ops !== void 0 || caps.namespaces !== void 0;
+}
+function capabilityAllowsOp(caps, op) {
+  if (caps?.ops === void 0) return true;
+  return caps.ops.includes(op);
+}
+function capabilityAllowsNamespace(caps, namespace) {
+  if (caps?.namespaces === void 0) return true;
+  if (namespace === void 0) return false;
+  return caps.namespaces.includes(namespace);
+}
+function assertOperationAllowed(caps, op) {
+  if (!capabilityAllowsOp(caps, op)) {
+    throw new EngramAccessForbiddenError(
+      `token is not permitted to call operation: ${op}`
+    );
+  }
+}
+function assertNamespaceAllowed(caps, namespace) {
+  if (!capabilityAllowsNamespace(caps, namespace)) {
+    throw new EngramAccessForbiddenError(
+      namespace === void 0 ? "token is scoped to specific namespaces and this operation requires an explicit namespace" : `token is not permitted to access namespace: ${namespace}`
+    );
+  }
+}
+function resolveEffectiveNamespace(namespace, defaultNamespace) {
+  const normalized = namespace !== void 0 && namespace.length > 0 ? namespace : void 0;
+  return normalized ?? defaultNamespace;
+}
+function enforceNamespaceAllowList(caps, namespace, defaultNamespace) {
+  if (caps?.namespaces === void 0) return;
+  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);
+  if (effective === void 0 || !caps.namespaces.includes(effective)) {
+    throw new EngramAccessForbiddenError(
+      namespace === void 0 ? "token is scoped to specific namespaces; the server default namespace is not permitted \u2014 supply an allowed namespace" : `token is not permitted to access namespace: ${namespace}`
+    );
+  }
+}
+function assertFleetWideOperationAllowed(caps) {
+  if (!capabilityAllowsNamespace(caps, void 0)) {
+    throw new EngramAccessForbiddenError(
+      "token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token"
+    );
+  }
+}
+var tokenCapabilityStore = new AsyncLocalStorage();
+
+export {
+  TOKEN_CAPABILITIES_VERSION,
+  isValidNamespaceValue,
+  normalizeCapabilities,
+  validateCapabilitiesForMint,
+  isCapabilityRestricted,
+  capabilityAllowsOp,
+  capabilityAllowsNamespace,
+  assertOperationAllowed,
+  assertNamespaceAllowed,
+  resolveEffectiveNamespace,
+  enforceNamespaceAllowList,
+  assertFleetWideOperationAllowed,
+  tokenCapabilityStore
+};
+//# sourceMappingURL=chunk-D7FOKIY5.js.map

package/dist/chunk-D7FOKIY5.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-token-capabilities.ts"],"sourcesContent":["/**\n * Per-token capabilities (issue #1837).\n *\n * A token entry MAY carry an explicit, versioned capabilities record. The\n * record's PRESENCE is mechanically detectable, which is load-bearing for\n * security:\n *\n *   - ABSENT `capabilities` field ⇒ a PRE-FEATURE legacy entry (minted\n *     before this feature). It is UNRESTRICTED — full access — purely for\n *     backward compatibility. This is the ONLY path by which \"full access\"\n *     is granted by omission.\n *\n *   - PRESENT `capabilities` record (always carries a `version` marker) ⇒ a\n *     token minted by the capability-aware path. Even a new token minted\n *     without `--ops`/`--namespaces` records an EXPLICIT unrestricted record\n *     (`{ version: 1 }`) — a deliberate, auditable choice, never an\n *     accidentally-omitted field. Within the record, the two axes follow\n *     absent-vs-present semantics:\n *       * axis ABSENT (e.g. no `ops` key)        ⇒ unrestricted on that axis.\n *       * axis PRESENT and empty (`ops: []`)     ⇒ deny all (fail-closed).\n *       * axis PRESENT and non-empty             ⇒ allow only the listed values.\n *\n * Malformed capability input at mint time (bad version, non-array axes,\n * non-string elements, unknown op names against the catalog, malformed\n * namespace values) is REJECTED — a token is never created from invalid\n * input (rule: invalid input rejected, not defaulted).\n *\n * This module owns the pure capability logic (shape validation, allow-list\n * checks) and the per-request AsyncLocalStorage carrying the presenting\n * token's resolved capabilities down to the access boundary. It imports\n * nothing else in the package except the forbidden-error class, so it can be\n * reused by the token store, the boundary, and the HTTP/MCP surfaces without\n * cycles.\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { EngramAccessForbiddenError } from \"./access-errors.js\";\n\n/** Current capability-record schema version. */\nexport const TOKEN_CAPABILITIES_VERSION = 1 as const;\n\n/**\n * Versioned capabilities record stored on a token entry. Presence of this\n * record (vs. an absent field) is what distinguishes a capability-aware\n * token from a pre-feature legacy entry.\n */\nexport interface TokenCapabilities {\n  readonly version: typeof TOKEN_CAPABILITIES_VERSION;\n  /**\n   * Operations allow-list. `undefined` (key absent) ⇒ unrestricted on this\n   * axis. `[]` ⇒ deny all ops (fail-closed). Non-empty ⇒ allow only listed.\n   */\n  ops?: string[];\n  /**\n   * Namespaces allow-list. `undefined` ⇒ unrestricted. `[]` ⇒ deny all.\n   * Non-empty ⇒ allow only listed.\n   */\n  namespaces?: string[];\n}\n\n/**\n * Namespace value validation. Namespace identifiers are flexible (default,\n * team, self, principal-prefixed, project-prefixed) but must never contain\n * whitespace, path separators, traversal segments, or control characters —\n * such values are malformed at mint time and rejected, never silently\n * coerced.\n */\nconst NAMESPACE_VALUE_MAX_LENGTH = 128;\n// Non-empty, no whitespace, no path separators, no control chars. `.` and\n// `..` are rejected separately so legitimate dotted names (e.g. a domain)\n// remain allowed while traversal is not.\nconst NAMESPACE_VALUE_PATTERN = /^[^\\s\\/\\\\\\x00-\\x1F]+$/;\n\n/** True when `value` is an acceptable namespace allow-list entry. */\nexport function isValidNamespaceValue(value: unknown): value is string {\n  if (typeof value !== \"string\" || value.length === 0 || value.length > NAMESPACE_VALUE_MAX_LENGTH) {\n    return false;\n  }\n  if (!NAMESPACE_VALUE_PATTERN.test(value)) return false;\n  if (value === \".\" || value === \"..\") return false;\n  return true;\n}\n\nfunction isStringArray(value: unknown): value is unknown[] {\n  return Array.isArray(value) && value.every((v) => typeof v === \"string\");\n}\n\nfunction dedupeSort(values: string[]): string[] {\n  return [...new Set(values)].sort();\n}\n\n/**\n * Parse one axis (ops or namespaces) for PERSISTENCE/LOAD. Returns the\n * cleaned array (deduped, sorted; possibly empty to preserve \"present ⇒\n * fail-closed\") or `undefined` when the key is absent. Throws on a malformed\n * shape (non-array, non-string elements, malformed namespace values). Op\n * validation against the catalog happens only at mint time.\n */\nfunction parseAxis(\n  obj: Record<string, unknown>,\n  key: \"ops\" | \"namespaces\",\n  validateValue: (v: unknown) => boolean,\n  valueLabel: string,\n): string[] | undefined {\n  if (!Object.prototype.hasOwnProperty.call(obj, key)) return undefined;\n  const value = obj[key];\n  if (value === undefined || value === null) return undefined;\n  if (!isStringArray(value)) {\n    throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n  }\n  const cleaned: string[] = [];\n  for (const v of value) {\n    if (typeof v !== \"string\" || v.length === 0) {\n      throw new Error(`capabilities ${key} must be an array of non-empty strings`);\n    }\n    if (!validateValue(v)) {\n      throw new Error(`capabilities ${key} contains a malformed ${valueLabel}: ${JSON.stringify(v)}`);\n    }\n    cleaned.push(v);\n  }\n  // Preserve presence: an explicitly empty array stays [] (fail-closed),\n  // NOT coerced to undefined (which would mean unrestricted).\n  return dedupeSort(cleaned);\n}\n\n/**\n * Normalize a capabilities record for PERSISTENCE/LOAD. Returns `undefined`\n * ONLY when the record is entirely absent (a pre-feature legacy entry ⇒\n * unrestricted). When present, an absent/`undefined` `version` is COERCED to\n * the current default (1) — mirroring {@link validateCapabilitiesForMint} — so\n * a record that mint-validated also load-normalizes without a schema throw.\n * An explicitly-present WRONG version (not 1) is still rejected. Throws on a\n * malformed record (non-object, explicitly-wrong version, malformed axes).\n */\nexport function normalizeCapabilities(raw: unknown): TokenCapabilities | undefined {\n  if (raw === undefined || raw === null) return undefined;\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with a version marker\");\n  }\n  const obj = raw as Record<string, unknown>;\n  // Coerce absent/undefined version → 1, mirroring validateCapabilitiesForMint\n  // (version 1 is the only schema version; coercing keeps mint-validated\n  // records reloadable). Only an explicitly-present WRONG version throws.\n  if (obj.version !== undefined && obj.version !== TOKEN_CAPABILITIES_VERSION) {\n    throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n  }\n  const ops = parseAxis(obj, \"ops\", () => true, \"operation\");\n  const namespaces = parseAxis(obj, \"namespaces\", isValidNamespaceValue, \"namespace\");\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (ops !== undefined) result.ops = ops;\n  if (namespaces !== undefined) result.namespaces = namespaces;\n  return result;\n}\n\n/**\n * Validate a capabilities record at MINT time. ALWAYS returns a versioned\n * record (never `undefined`) so every newly-minted token carries an explicit\n * capability decision — a new token can never gain full access by OMITTING\n * the field. When `raw` is absent/null, the result is an explicit\n * unrestricted record (`{ version: 1 }`), a deliberate/auditable choice. A\n * present-but-`undefined` (or absent) `version` is coerced to the current\n * default (1); an explicitly-wrong version is rejected. This version rule is\n * identical to {@link normalizeCapabilities} (mint/load symmetry). Rejects\n * unknown op names against the catalog and malformed namespace values;\n * throws a plain Error — the caller must NOT create a token when this throws.\n */\nexport function validateCapabilitiesForMint(\n  raw: unknown,\n  validOps: readonly string[],\n): TokenCapabilities {\n  const result: TokenCapabilities = { version: TOKEN_CAPABILITIES_VERSION };\n  if (raw === undefined || raw === null) {\n    return result;\n  }\n  if (typeof raw !== \"object\" || Array.isArray(raw)) {\n    throw new Error(\"capabilities must be an object with optional ops/namespaces arrays\");\n  }\n  const obj = raw as Record<string, unknown>;\n  if (Object.prototype.hasOwnProperty.call(obj, \"version\") && obj.version !== undefined) {\n    if (obj.version !== TOKEN_CAPABILITIES_VERSION) {\n      throw new Error(`capabilities.version must be ${TOKEN_CAPABILITIES_VERSION}`);\n    }\n  }\n  const validOpSet = new Set(validOps);\n\n  if (Object.prototype.hasOwnProperty.call(obj, \"ops\") && obj.ops !== undefined && obj.ops !== null) {\n    if (!isStringArray(obj.ops)) {\n      throw new Error(\"capabilities ops must be an array of non-empty strings\");\n    }\n    const ops = obj.ops as unknown[];\n    for (const v of ops) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities ops must be an array of non-empty strings\");\n      }\n    }\n    // Reject unknown op names against the catalog (unknown ⇒ reject, never drop).\n    const unknown = ops.filter((op) => typeof op === \"string\" && !validOpSet.has(op));\n    if (unknown.length > 0) {\n      throw new Error(\n        `capabilities ops contains unknown operation name(s): ${unknown.map((o) => JSON.stringify(o)).join(\", \")}`,\n      );\n    }\n    // Preserve presence (empty stays [] ⇒ deny all ops).\n    result.ops = dedupeSort(ops as string[]);\n  }\n\n  if (\n    Object.prototype.hasOwnProperty.call(obj, \"namespaces\") &&\n    obj.namespaces !== undefined &&\n    obj.namespaces !== null\n  ) {\n    if (!isStringArray(obj.namespaces)) {\n      throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n    }\n    const namespaces = obj.namespaces as unknown[];\n    for (const v of namespaces) {\n      if (typeof v !== \"string\" || v.length === 0) {\n        throw new Error(\"capabilities namespaces must be an array of non-empty strings\");\n      }\n      if (!isValidNamespaceValue(v)) {\n        throw new Error(`capabilities namespaces contains a malformed namespace: ${JSON.stringify(v)}`);\n      }\n    }\n    result.namespaces = dedupeSort(namespaces as string[]);\n  }\n\n  return result;\n}\n\n/**\n * True when `caps` imposes any restriction (a present record with at least\n * one axis key). `undefined` (legacy / absent record) ⇒ unrestricted. A\n * present `{ version: 1 }` record with no axes ⇒ also unrestricted (but\n * auditable — it is a deliberate new-token decision, not omission).\n */\nexport function isCapabilityRestricted(caps: TokenCapabilities | undefined | null): boolean {\n  if (!caps) return false;\n  return caps.ops !== undefined || caps.namespaces !== undefined;\n}\n\n/**\n * True when `caps` permits `op`.\n *   - record ABSENT (legacy) ⇒ unrestricted (true).\n *   - ops axis ABSENT        ⇒ unrestricted on this axis (true).\n *   - ops axis PRESENT       ⇒ `op` must be listed; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsOp(caps: TokenCapabilities | undefined | null, op: string): boolean {\n  if (caps?.ops === undefined) return true;\n  return caps.ops.includes(op);\n}\n\n/**\n * True when `caps` permits `namespace`.\n *   - record ABSENT / namespaces axis ABSENT ⇒ unrestricted (true).\n *   - namespaces axis PRESENT ⇒ `namespace` must be listed; undefined\n *     namespace ⇒ false; `[]` ⇒ false (deny all).\n */\nexport function capabilityAllowsNamespace(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): boolean {\n  if (caps?.namespaces === undefined) return true;\n  if (namespace === undefined) return false;\n  return caps.namespaces.includes(namespace);\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts ops and\n * `op` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n  op: string,\n): void {\n  if (!capabilityAllowsOp(caps, op)) {\n    throw new EngramAccessForbiddenError(\n      `token is not permitted to call operation: ${op}`,\n    );\n  }\n}\n\n/**\n * Throw {@link EngramAccessForbiddenError} when `caps` restricts namespaces\n * and `namespace` is not permitted. No-op for unrestricted tokens.\n */\nexport function assertNamespaceAllowed(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n): void {\n  if (!capabilityAllowsNamespace(caps, namespace)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces and this operation requires an explicit namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Resolve the EFFECTIVE namespace an operation runs against: a present,\n * non-empty request namespace wins, otherwise the server default — the same\n * resolution downstream storage applies\n * (`getWritableStorageForNamespace(undefined)` → `defaultNamespace`). Empty\n * strings are treated as absent. Centralized so every invocation surface\n * (HTTP query/body, MCP `tools/call`, id-loaded records, legacy pairs that\n * carry no namespace) applies ONE rule and none can dodge the check by\n * dropping the param. (issue #1850)\n */\nexport function resolveEffectiveNamespace(\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): string | undefined {\n  const normalized = namespace !== undefined && namespace.length > 0 ? namespace : undefined;\n  return normalized ?? defaultNamespace;\n}\n\n/**\n * The single effective-namespace allow-list chokepoint (issues #1837/#1850).\n * Throws {@link EngramAccessForbiddenError} when `caps` carries a namespaces\n * allow-list and the EFFECTIVE namespace (request value OR server default) is\n * not a member. FAIL CLOSED:\n *   - a scoped token whose allow-list does not cover the effective namespace\n *     (explicit OR defaulted) is rejected;\n *   - an absent server default (unconfigured) is also rejected for scoped\n *     tokens, so omitting `?namespace=` can never bypass the allow-list.\n * No-op for unrestricted tokens (no namespaces axis) so legacy/unrestricted\n * behavior is unchanged. Both the HTTP transport (`resolveNamespace`) and the\n * MCP dispatch route through this ONE function so no surface is missed.\n */\nexport function enforceNamespaceAllowList(\n  caps: TokenCapabilities | undefined | null,\n  namespace: string | undefined,\n  defaultNamespace: string | undefined,\n): void {\n  if (caps?.namespaces === undefined) return; // unrestricted token — unchanged\n  const effective = resolveEffectiveNamespace(namespace, defaultNamespace);\n  if (effective === undefined || !caps.namespaces.includes(effective)) {\n    throw new EngramAccessForbiddenError(\n      namespace === undefined\n        ? \"token is scoped to specific namespaces; the server default namespace is not permitted — supply an allowed namespace\"\n        : `token is not permitted to access namespace: ${namespace}`,\n    );\n  }\n}\n\n/**\n * Fleet-wide / global maintenance operation guard (issue #1850 round 10).\n *\n * A distinct escalation class from the id-addressed routes (round 9) and the\n * param-namespace ops (round 4): some boundary operations inherently run\n * ACROSS ALL namespaces — or against a single global layer (compression\n * guidelines, shared context, compounding) that is not namespace-partitioned\n * — and carry NO `namespace` argument, so the MCP `tools/call` effective-\n * namespace chokepoint ({@link enforceNamespaceAllowList}, which only fires\n * when `toolAcceptsNamespace`) never applies. Without this guard a bearer\n * scoped to ONE tenant could trigger maintenance that mutates state in EVERY\n * namespace (privilege escalation).\n *\n * Fail CLOSED exactly like the other shared guards: a namespace-SCOPED token\n * (namespaces axis present) is rejected; unrestricted / legacy tokens (absent\n * record or no namespaces axis — i.e. cron and internal callers that never\n * bind a capability record) are unaffected. Reuses the EXISTING capability\n * model via {@link capabilityAllowsNamespace} — no new \"all\"/\"*\" scope concept.\n * Must run BEFORE any side effect so a denial never leaks a partial mutation.\n */\nexport function assertFleetWideOperationAllowed(\n  caps: TokenCapabilities | undefined | null,\n): void {\n  // capabilityAllowsNamespace returns false for ANY scoped token when the\n  // namespace is undefined (a fleet-wide op has no single namespace), and\n  // true for unrestricted/legacy tokens — exactly the desired policy.\n  if (!capabilityAllowsNamespace(caps, undefined)) {\n    throw new EngramAccessForbiddenError(\n      \"token is scoped to specific namespaces; this maintenance operation runs across all namespaces and is not permitted for a namespace-scoped token\",\n    );\n  }\n}\n\n/**\n * Per-request AsyncLocalStorage carrying the presenting token's resolved\n * capabilities. The HTTP surface binds the resolved capabilities with\n * `.run(caps, handler)` for the WHOLE authorized request dispatch (NOT\n * `.enterWith()`, which mutates the current async resource and does not\n * reliably isolate the store across the handler's awaits / concurrent\n * requests — risking a fail-open read of undefined mid-handler); the\n * access boundary reads `.getStore()` to enforce the ops allow-list for\n * every boundary operation without each dispatch site threading the value\n * explicitly. Unset (CLI, direct boundary callers, tests) ⇒ undefined ⇒\n * unrestricted (issue #1850 round 7).\n */\nexport const tokenCapabilityStore = new AsyncLocalStorage<TokenCapabilities | undefined>();\n"],"mappings":";;;;;AAmCA,SAAS,yBAAyB;AAI3B,IAAM,6BAA6B;AA4B1C,IAAM,6BAA6B;AAInC,IAAM,0BAA0B;AAGzB,SAAS,sBAAsB,OAAiC;AACrE,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,4BAA4B;AAChG,WAAO;AAAA,EACT;AACA,MAAI,CAAC,wBAAwB,KAAK,KAAK,EAAG,QAAO;AACjD,MAAI,UAAU,OAAO,UAAU,KAAM,QAAO;AAC5C,SAAO;AACT;AAEA,SAAS,cAAc,OAAoC;AACzD,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ;AACzE;AAEA,SAAS,WAAW,QAA4B;AAC9C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AACnC;AASA,SAAS,UACP,KACA,KACA,eACA,YACsB;AACtB,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,EAAG,QAAO;AAC5D,QAAM,QAAQ,IAAI,GAAG;AACrB,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,CAAC,cAAc,KAAK,GAAG;AACzB,UAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,EAC7E;AACA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,OAAO;AACrB,QAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,MAAM,gBAAgB,GAAG,wCAAwC;AAAA,IAC7E;AACA,QAAI,CAAC,cAAc,CAAC,GAAG;AACrB,YAAM,IAAI,MAAM,gBAAgB,GAAG,yBAAyB,UAAU,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,IAChG;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,SAAO,WAAW,OAAO;AAC3B;AAWO,SAAS,sBAAsB,KAA6C;AACjF,MAAI,QAAQ,UAAa,QAAQ,KAAM,QAAO;AAC9C,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM;AAIZ,MAAI,IAAI,YAAY,UAAa,IAAI,YAAY,4BAA4B;AAC3E,UAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,EAC9E;AACA,QAAM,MAAM,UAAU,KAAK,OAAO,MAAM,MAAM,WAAW;AACzD,QAAM,aAAa,UAAU,KAAK,cAAc,uBAAuB,WAAW;AAClF,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,OAAW,QAAO,MAAM;AACpC,MAAI,eAAe,OAAW,QAAO,aAAa;AAClD,SAAO;AACT;AAcO,SAAS,4BACd,KACA,UACmB;AACnB,QAAM,SAA4B,EAAE,SAAS,2BAA2B;AACxE,MAAI,QAAQ,UAAa,QAAQ,MAAM;AACrC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;AACjD,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,QAAM,MAAM;AACZ,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,SAAS,KAAK,IAAI,YAAY,QAAW;AACrF,QAAI,IAAI,YAAY,4BAA4B;AAC9C,YAAM,IAAI,MAAM,gCAAgC,0BAA0B,EAAE;AAAA,IAC9E;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,QAAQ;AAEnC,MAAI,OAAO,UAAU,eAAe,KAAK,KAAK,KAAK,KAAK,IAAI,QAAQ,UAAa,IAAI,QAAQ,MAAM;AACjG,QAAI,CAAC,cAAc,IAAI,GAAG,GAAG;AAC3B,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,MAAM,IAAI;AAChB,eAAW,KAAK,KAAK;AACnB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,wDAAwD;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,CAAC,WAAW,IAAI,EAAE,CAAC;AAChF,QAAI,QAAQ,SAAS,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,wDAAwD,QAAQ,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,IACF;AAEA,WAAO,MAAM,WAAW,GAAe;AAAA,EACzC;AAEA,MACE,OAAO,UAAU,eAAe,KAAK,KAAK,YAAY,KACtD,IAAI,eAAe,UACnB,IAAI,eAAe,MACnB;AACA,QAAI,CAAC,cAAc,IAAI,UAAU,GAAG;AAClC,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,UAAM,aAAa,IAAI;AACvB,eAAW,KAAK,YAAY;AAC1B,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,GAAG;AAC3C,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,UAAI,CAAC,sBAAsB,CAAC,GAAG;AAC7B,cAAM,IAAI,MAAM,2DAA2D,KAAK,UAAU,CAAC,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AACA,WAAO,aAAa,WAAW,UAAsB;AAAA,EACvD;AAEA,SAAO;AACT;AAQO,SAAS,uBAAuB,MAAqD;AAC1F,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,KAAK,QAAQ,UAAa,KAAK,eAAe;AACvD;AAQO,SAAS,mBAAmB,MAA4C,IAAqB;AAClG,MAAI,MAAM,QAAQ,OAAW,QAAO;AACpC,SAAO,KAAK,IAAI,SAAS,EAAE;AAC7B;AAQO,SAAS,0BACd,MACA,WACS;AACT,MAAI,MAAM,eAAe,OAAW,QAAO;AAC3C,MAAI,cAAc,OAAW,QAAO;AACpC,SAAO,KAAK,WAAW,SAAS,SAAS;AAC3C;AAMO,SAAS,uBACd,MACA,IACM;AACN,MAAI,CAAC,mBAAmB,MAAM,EAAE,GAAG;AACjC,UAAM,IAAI;AAAA,MACR,6CAA6C,EAAE;AAAA,IACjD;AAAA,EACF;AACF;AAMO,SAAS,uBACd,MACA,WACM;AACN,MAAI,CAAC,0BAA0B,MAAM,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6FACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAYO,SAAS,0BACd,WACA,kBACoB;AACpB,QAAM,aAAa,cAAc,UAAa,UAAU,SAAS,IAAI,YAAY;AACjF,SAAO,cAAc;AACvB;AAeO,SAAS,0BACd,MACA,WACA,kBACM;AACN,MAAI,MAAM,eAAe,OAAW;AACpC,QAAM,YAAY,0BAA0B,WAAW,gBAAgB;AACvE,MAAI,cAAc,UAAa,CAAC,KAAK,WAAW,SAAS,SAAS,GAAG;AACnE,UAAM,IAAI;AAAA,MACR,cAAc,SACV,6HACA,+CAA+C,SAAS;AAAA,IAC9D;AAAA,EACF;AACF;AAsBO,SAAS,gCACd,MACM;AAIN,MAAI,CAAC,0BAA0B,MAAM,MAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,IAAI,kBAAiD;","names":[]}

package/dist/{chunk-4BFRBP45.js → chunk-DEG5ULFJ.js}

@@ -1,6 +1,6 @@
 import {
   createSearchBackend
-} from "./chunk-27FLVMDC.js";
+} from "./chunk-HLN7RROI.js";
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
@@ -404,4 +404,4 @@ export {
   namespaceCollectionName,
   NamespaceSearchRouter
 };
-//# sourceMappingURL=chunk-4BFRBP45.js.map
+//# sourceMappingURL=chunk-DEG5ULFJ.js.map

package/dist/{chunk-JLR3JSTL.js → chunk-DS7MM2ES.js}

@@ -1,9 +1,9 @@
 import {
   NamespaceStorageRouter
-} from "./chunk-BGTAL46Y.js";
+} from "./chunk-PNLFN2PZ.js";
 import {
   namespaceCollectionName
-} from "./chunk-4BFRBP45.js";
+} from "./chunk-DEG5ULFJ.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -207,4 +207,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-JLR3JSTL.js.map
+//# sourceMappingURL=chunk-DS7MM2ES.js.map

package/dist/{chunk-2BFLDH5F.js → chunk-EEIROWEG.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-765K3SAT.js";
 import {
   encryptCapsuleFile
-} from "./chunk-437S3G37.js";
+} from "./chunk-LNQUAJNC.js";
 import {
   computeTransferOutputRel,
   isTransferPathExcluded
@@ -109,4 +109,4 @@ async function enforceRetention(outDirAbs, retentionDays) {
 export {
   backupMemoryDir
 };
-//# sourceMappingURL=chunk-2BFLDH5F.js.map
+//# sourceMappingURL=chunk-EEIROWEG.js.map