@remnic/core 9.45.3 → 9.45.5

package/dist/{chunk-VWAXN2BN.js → chunk-CX4ZUMC6.js}

@@ -1,12 +1,17 @@
 import {
   WearablesInputError
 } from "./chunk-V7IZKJI3.js";
+import {
+  AdapterRegistry
+} from "./chunk-RKNJBZ55.js";
 import {
   WriteRateLimiter
 } from "./chunk-MKQBXQKU.js";
 import {
-  AdapterRegistry
-} from "./chunk-JBPKEARU.js";
+  nonEmptyQueryParam,
+  optionalQueryString,
+  positiveIntQueryParam
+} from "./chunk-6ZYQ36IB.js";
 import {
   EngramMcpServer,
   MCP_SUPPORTED_PROTOCOL_VERSIONS,
@@ -16,10 +21,13 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-DL7ZD3JH.js";
+} from "./chunk-4FBVAGV3.js";
 import {
   RelayMissionStoreError
-} from "./chunk-XYTOI63Z.js";
+} from "./chunk-V2TNYF6Q.js";
+import {
+  validateRequest
+} from "./chunk-NIS256NW.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -29,55 +37,52 @@ import {
   listPairs,
   readPair
 } from "./chunk-35NN3ZFA.js";
-import {
-  validateRequest
-} from "./chunk-3F2LKUMU.js";
 import {
   maybeHandleLifecycleFlush
-} from "./chunk-5IVLTFOV.js";
+} from "./chunk-44N6ESJ4.js";
 import {
-  respondLcmCompactionCapabilitiesHttp
-} from "./chunk-VCD4PSK2.js";
+  respondAccessCapabilitiesHttp
+} from "./chunk-TQZ4DVBC.js";
 import {
-  nonEmptyQueryParam,
-  optionalQueryString,
-  positiveIntQueryParam
-} from "./chunk-6ZYQ36IB.js";
+  respondOfflineManifestStream,
+  respondOfflineSnapshotStream
+} from "./chunk-CK5KOVHW.js";
 import {
   authorizationProbeNamespaces,
   probeOperationAuthorization
-} from "./chunk-P4DRWEYC.js";
+} from "./chunk-3COYXTGM.js";
 import {
   CorrectionContractError,
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-CJ2ZR7UA.js";
+} from "./chunk-QUENPGWZ.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
 import {
   subscribeGraphEvents
 } from "./chunk-DEUNUKTD.js";
-import {
-  projectTagProjectId
-} from "./chunk-BUE5E2HL.js";
 import {
   isRecallDisclosure
-} from "./chunk-J7VGGECD.js";
+} from "./chunk-DZPFMQZ7.js";
+import {
+  OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
+  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
+  OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
+} from "./chunk-GYPQL6XN.js";
 import {
   assertOperationAllowed,
+  capabilityAllowsOp,
   enforceNamespaceAllowList,
   isCapabilityRestricted,
   tokenCapabilityStore
 } from "./chunk-MZWSOLMT.js";
+import {
+  projectTagProjectId
+} from "./chunk-J2WC5LF4.js";
 import {
   expandTildePath
 } from "./chunk-EYIEWJNI.js";
-import {
-  OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
-  OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
-  OFFLINE_SYNC_SNAPSHOT_BASE_MAX_BODY_BYTES
-} from "./chunk-7XC2HX75.js";
 import {
   EngramAccessForbiddenError,
   EngramAccessInputError
@@ -85,7 +90,7 @@ import {
 import {
   abortError,
   isAbortError
-} from "./chunk-PVGDJXVK.js";
+} from "./chunk-BTTPKDIL.js";
 import {
   log
 } from "./chunk-3WCASNQZ.js";
@@ -891,7 +896,7 @@ var EngramAccessHttpServer = class {
       });
       return;
     }
-    if (req.method === "GET" && pathname === "/engram/v1/capabilities") return respondLcmCompactionCapabilitiesHttp(res);
+    if (req.method === "GET" && pathname === "/engram/v1/capabilities") return respondAccessCapabilitiesHttp(res);
     if (req.method === "GET" && pathname === "/engram/v1/authorization") {
       res.setHeader("cache-control", "no-store");
       const probe = probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op"));
@@ -937,6 +942,17 @@ var EngramAccessHttpServer = class {
       }
       return;
     }
+    if (req.method === "POST" && (pathname === "/engram/v1/external-wikis/search" || pathname === "/remnic/v1/external-wikis/search")) {
+      this.enforceTokenOp("external_wiki_search");
+      const operation = getOperation("external_wiki_search");
+      if (!operation) throw new EngramAccessInputError("external_wiki_search operation is not registered");
+      const output = await operation.run(await this.readJsonBody(req), { service: this.service });
+      if (!output || typeof output !== "object" || !("result" in output)) {
+        throw new Error("external_wiki_search returned an invalid operation result");
+      }
+      this.respondJson(res, 200, output.result);
+      return;
+    }
     if (req.method === "POST" && pathname === "/engram/v1/recall") {
       this.enforceTokenOp("recall");
       const body = await this.readValidatedBody(req, "recall");
@@ -984,6 +1000,7 @@ var EngramAccessHttpServer = class {
         query: body.query ?? "",
         sessionKey: body.sessionKey,
         authenticatedPrincipal: this.resolveRequestPrincipal(req),
+        sourceConnector: this.resolveConnector(req),
         idempotencyKey: body.idempotencyKey,
         namespace: this.resolveNamespace(req, body.namespace),
         topK: body.topK,
@@ -1052,6 +1069,15 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, result);
       return;
     }
+    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/capabilities" || pathname === "/remnic/v1/offline-sync/capabilities")) {
+      this.enforceTokenOp("offline_sync_snapshot");
+      this.respondJson(res, 200, {
+        version: 1,
+        convergenceFinalization: true,
+        manifestStream: true
+      });
+      return;
+    }
     if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
       this.enforceTokenOp("offline_sync_snapshot");
       const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
@@ -1102,7 +1128,32 @@ var EngramAccessHttpServer = class {
         includeContent: false,
         signal: this.createRequestAbortSignal(req, res)
       });
-      await this.respondOfflineSnapshotStream(res, result);
+      await respondOfflineSnapshotStream(res, result, correlationIdStore.getStore());
+      return;
+    }
+    if (req.method === "GET" && (pathname === "/engram/v1/offline-sync/manifest-stream" || pathname === "/remnic/v1/offline-sync/manifest-stream")) {
+      this.enforceTokenOp("offline_sync_snapshot_stream");
+      const includeTranscriptsRaw = parsed.searchParams.get("include_transcripts");
+      const includeContentRaw = parsed.searchParams.get("content");
+      if (includeTranscriptsRaw !== null && includeTranscriptsRaw !== "true" && includeTranscriptsRaw !== "false") {
+        throw new EngramAccessInputError(
+          `include_transcripts must be one of: true, false (got: ${includeTranscriptsRaw})`
+        );
+      }
+      if (includeContentRaw !== null && includeContentRaw !== "false") {
+        throw new EngramAccessInputError("manifest-stream content must be false");
+      }
+      const namespaceParam = parsed.searchParams.get("namespace");
+      const result = await this.service.offlineSyncManifestStream({
+        namespace: this.resolveNamespace(
+          req,
+          namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0
+        ),
+        principal: this.resolveRequestPrincipal(req),
+        includeTranscripts: includeTranscriptsRaw !== "false",
+        signal: this.createRequestAbortSignal(req, res)
+      });
+      await respondOfflineManifestStream(res, result, correlationIdStore.getStore());
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/snapshot" || pathname === "/remnic/v1/offline-sync/snapshot")) {
@@ -1188,7 +1239,8 @@ var EngramAccessHttpServer = class {
       return;
     }
     if (req.method === "POST" && (pathname === "/engram/v1/offline-sync/convergence-complete" || pathname === "/remnic/v1/offline-sync/convergence-complete")) {
-      this.enforceTokenOp("offline_sync_apply_file_content");
+      void getOperation("offline_sync_apply_file_content");
+      this.enforceTokenAnyOf(["offline_sync_apply_file_content", "offline_sync_apply"]);
       const namespaceParams = parsed.searchParams.getAll("namespace").filter(Boolean);
       const requestedNamespaces = namespaceParams.length > 0 ? namespaceParams : [void 0];
       const namespaces = requestedNamespaces.map((namespace) => this.resolveNamespace(req, namespace)).filter((namespace) => namespace !== void 0);
@@ -1297,6 +1349,7 @@ var EngramAccessHttpServer = class {
           namespace,
           budget,
           authenticatedPrincipal: this.resolveRequestPrincipal(req),
+          sourceConnector: this.resolveConnector(req),
           ...disclosure !== void 0 ? { disclosure } : {}
         });
       } catch (err) {
@@ -2744,59 +2797,6 @@ var EngramAccessHttpServer = class {
     }
     res.end(body);
   }
-  async respondOfflineSnapshotStream(res, snapshot) {
-    res.statusCode = 200;
-    res.setHeader("content-type", "application/x-ndjson; charset=utf-8");
-    res.setHeader("cache-control", "no-store");
-    const cid = correlationIdStore.getStore();
-    if (cid) {
-      res.setHeader("x-request-id", cid);
-    }
-    const waitForDrainOrClose = async () => new Promise((resolve, reject) => {
-      const cleanup = () => {
-        res.off("drain", onDrain);
-        res.off("close", onClose);
-        res.off("error", onError);
-      };
-      const onDrain = () => {
-        cleanup();
-        resolve(true);
-      };
-      const onClose = () => {
-        cleanup();
-        resolve(false);
-      };
-      const onError = (error) => {
-        cleanup();
-        reject(error);
-      };
-      res.once("drain", onDrain);
-      res.once("close", onClose);
-      res.once("error", onError);
-    });
-    const writeLine = async (payload) => {
-      if (res.destroyed || res.writableEnded) return false;
-      if (res.write(`${JSON.stringify(payload)}
-`)) return true;
-      if (res.destroyed || res.writableEnded) return false;
-      return waitForDrainOrClose();
-    };
-    if (!await writeLine({
-      type: "snapshot",
-      namespace: snapshot.namespace,
-      format: snapshot.format,
-      schemaVersion: snapshot.schemaVersion,
-      createdAt: snapshot.createdAt,
-      sourceId: snapshot.sourceId,
-      includeTranscripts: snapshot.includeTranscripts
-    })) return;
-    for await (const file of snapshot.files) {
-      if (!await writeLine({ type: "file", file })) return;
-    }
-    if (!res.destroyed && !res.writableEnded) {
-      res.end();
-    }
-  }
   respondBinary(res, status, body, headers = {}) {
     res.statusCode = status;
     res.setHeader("content-type", "application/octet-stream");
@@ -3139,6 +3139,14 @@ var EngramAccessHttpServer = class {
     void getOperation(op);
     assertOperationAllowed(tokenCapabilityStore.getStore(), op);
   }
+  enforceTokenAnyOf(ops) {
+    for (const op of ops) void getOperation(op);
+    const capabilities = tokenCapabilityStore.getStore();
+    if (ops.some((op) => capabilityAllowsOp(capabilities, op))) return;
+    throw new EngramAccessForbiddenError(
+      `token is not permitted to call any required operation: ${ops.join(", ")}`
+    );
+  }
   /**
    * Operator/admin routes are unrestricted-only surfaces: a scoped
    * (least-privileged) token must NOT reach them (issue #1837). Legacy and
@@ -3226,4 +3234,4 @@ export {
   MeetingsInputError,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-VWAXN2BN.js.map
+//# sourceMappingURL=chunk-CX4ZUMC6.js.map