@remnic/core 9.54.5 → 9.54.6

package/dist/write-envelope.d.ts

@@ -1,4 +1,4 @@
-import { w as MemoryCategory } from './types-BnQza1y8.js';
+import { w as MemoryCategory } from './types-ed-SvS2t.js';
 import './message-parts/index.js';
 import './bounded-jsonl-state.js';
 import './operator-doctor-types.js';

package/dist/write-rate-limiter.d.ts

@@ -15,10 +15,15 @@
 type Slot = {
     readonly recordedAt: number;
 };
+interface WriteRateLimitReservation {
+    commit(): void;
+    release(): void;
+}
 declare class WriteRateLimiter {
     readonly maxRequests: number;
     readonly windowMs: number;
     private readonly buckets;
+    private readonly inFlight;
     private lastLogAt;
     private suppressed;
     constructor(maxRequests?: number, windowMs?: number);
@@ -26,8 +31,9 @@ declare class WriteRateLimiter {
     private prune;
     /** Prune every bucket to the current window; drop buckets that go empty. */
     private sweep;
-    /** Live reservation/record count for a principal (test/introspection). */
+    /** Committed slots for a principal (test/introspection). */
     slotsFor(principal?: string): ReadonlyArray<Slot>;
+    inFlightFor(principal?: string): number;
     /** Total live reservations across all principals (test/introspection). */
     totalSlots(): number;
     /** True if a write may proceed for the principal. Logs (sampled) when not. */
@@ -35,11 +41,11 @@ declare class WriteRateLimiter {
     /** Record a committed write against the principal's rolling window. */
     record(principal?: string): void;
     /**
-     * Reserve a slot for an in-flight write. Returns a release function, or
-     * `null` when the principal is already at the limit (caller raises its 429).
+     * Reserve a slot for an in-flight write. Commit starts the rolling window
+     * when persistence finishes. Release restores capacity after a failed write.
      */
-    reserve(principal?: string): (() => void) | null;
+    reserve(principal?: string): WriteRateLimitReservation | null;
     private logRejected;
 }
 
-export { WriteRateLimiter };
+export { type WriteRateLimitReservation, WriteRateLimiter };

package/dist/write-rate-limiter.js

@@ -1,6 +1,6 @@
 import {
   WriteRateLimiter
-} from "./chunk-MKQBXQKU.js";
+} from "./chunk-TB6CBZ5V.js";
 import "./chunk-3WCASNQZ.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.54.5",
+  "version": "9.54.6",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -2600,6 +2600,16 @@
       "remnic-source": "./src/summarizer.ts",
       "import": "./dist/summarizer.js"
     },
+    "./support-passport": {
+      "types": "./dist/support-passport/index.d.ts",
+      "remnic-source": "./src/support-passport/index.ts",
+      "import": "./dist/support-passport/index.js"
+    },
+    "./support-passport.js": {
+      "types": "./dist/support-passport/index.d.ts",
+      "remnic-source": "./src/support-passport/index.ts",
+      "import": "./dist/support-passport/index.js"
+    },
     "./summary-snapshot": {
       "types": "./dist/summary-snapshot.d.ts",
       "remnic-source": "./src/summary-snapshot.ts",
@@ -3126,7 +3136,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.54.5"
+    "@remnic/coding-graph": "^9.54.6"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/scripts/build-with-heap.mjs

@@ -5,6 +5,9 @@
 // A Node wrapper (not a NODE_OPTIONS= shell prefix) keeps the build
 // script portable to Windows' cmd.exe script shell.
 import { spawnSync } from "node:child_process";
+import { cp, mkdir, rm } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
 
 const HEAP_DEFAULT = "--max-old-space-size=8192";
 const existing = process.env.NODE_OPTIONS?.trim();
@@ -22,4 +25,11 @@ const result = spawnSync("tsup", process.argv.slice(2), {
 if (result.error) {
   console.error(`[build-with-heap] failed to launch tsup: ${result.error.message}`);
 }
-process.exit(result.status ?? 1);
+if (result.status !== 0) process.exit(result.status ?? 1);
+
+const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const sourceDir = path.resolve(packageRoot, "../../admin-console/public/what-helps-me");
+const targetDir = path.resolve(packageRoot, "dist/admin-console/public/what-helps-me");
+await rm(targetDir, { recursive: true, force: true });
+await mkdir(path.dirname(targetDir), { recursive: true });
+await cp(sourceDir, targetDir, { recursive: true });

package/src/access-authorization-probe.ts

@@ -1,6 +1,7 @@
 import {
   getOperation,
   operationRequiresAuthorizedNamespace,
+  operationUsesPrincipalNamespace,
   OPERATION_NAMES,
   type OperationName,
 } from "./access-boundary.js";
@@ -17,6 +18,11 @@ const UNRESOLVABLE_RESOURCE_OPERATIONS = new Set<OperationName>([
   "chat_events",
 ]);
 
+const HELPER_ONLY_OPERATIONS = new Set<OperationName>([
+  "support_passport_grant_read",
+  "support_passport_grant_ask",
+]);
+
 export interface AuthorizationProbeResponse {
   readonly authorized: true;
   readonly operations: readonly OperationName[];
@@ -32,7 +38,10 @@ export function probeOperationAuthorization(
 ): AuthorizationProbeResponse {
   const operations: OperationName[] = [];
   for (const candidate of requestedOperations) {
-    if (!OPERATION_NAMES.includes(candidate as OperationName)) {
+    if (
+      !OPERATION_NAMES.includes(candidate as OperationName) ||
+      HELPER_ONLY_OPERATIONS.has(candidate as OperationName)
+    ) {
       throw new EngramAccessInputError(`unsupported operation: ${candidate}`);
     }
     const operation = candidate as OperationName;
@@ -46,7 +55,9 @@ export function probeOperationAuthorization(
   for (const operation of operations) {
     const boundOperation = getOperation(operation);
     if (!boundOperation) {
-      throw new Error(`authorization probe operation is not registered: ${operation}`);
+      throw new Error(
+        `authorization probe operation is not registered: ${operation}`,
+      );
     }
     assertOperationAuthorizationAllowed(capabilities, boundOperation.spec);
   }
@@ -70,3 +81,10 @@ export function authorizationProbeNamespaces(
   );
   return namespaceOperations.length > 0 ? [requestedNamespace] : [];
 }
+
+/** Whether a probe must resolve the authenticated principal's owner namespace. */
+export function authorizationProbeRequiresPrincipalNamespace(
+  operations: readonly OperationName[],
+): boolean {
+  return operations.some(operationUsesPrincipalNamespace);
+}

package/src/access-boundary.ts

@@ -151,6 +151,19 @@ export const OPERATION_NAMES = [
   "console_state",
   "dreams_status",
   "dreams_run",
+  "support_passport_memory_preview",
+  "support_passport_cards_list",
+  "support_passport_draft_create",
+  "support_passport_drafts_generate",
+  "support_passport_card_replace",
+  "support_passport_card_approve",
+  "support_passport_card_reject",
+  "support_passport_card_withdraw",
+  "support_passport_grant_create",
+  "support_passport_grants_list",
+  "support_passport_grant_revoke",
+  "support_passport_grant_read",
+  "support_passport_grant_ask",
   // HTTP-only routes (no direct MCP tool equivalent).
   "adapters_status",
   "offline_sync_snapshot",
@@ -200,6 +213,20 @@ const IMPLICIT_HTTP_NAMESPACE_OPERATIONS = new Set<OperationName>([
   "citations_observed",
 ]);
 
+const PRINCIPAL_NAMESPACE_OPERATIONS = new Set<OperationName>([
+  "support_passport_memory_preview",
+  "support_passport_cards_list",
+  "support_passport_draft_create",
+  "support_passport_drafts_generate",
+  "support_passport_card_replace",
+  "support_passport_card_approve",
+  "support_passport_card_reject",
+  "support_passport_card_withdraw",
+  "support_passport_grant_create",
+  "support_passport_grants_list",
+  "support_passport_grant_revoke",
+]);
+
 // ---------------------------------------------------------------------------
 // Operation context — what every handler receives
 // ---------------------------------------------------------------------------
@@ -460,6 +487,11 @@ export function operationRequiresAuthorizedNamespace(name: OperationName): boole
   return objectSchema instanceof z.ZodObject && Object.hasOwn(objectSchema.shape, "namespace");
 }
 
+/** Whether an operation resolves its namespace from the authenticated principal. */
+export function operationUsesPrincipalNamespace(name: OperationName): boolean {
+  return PRINCIPAL_NAMESPACE_OPERATIONS.has(name);
+}
+
 /** All registered operation names. */
 export function listRegisteredOperations(): readonly OperationName[] {
   return [...registry.keys()];