@remnic/core 9.54.5 → 9.54.7

package/dist/{chunk-YDWPYDML.js → chunk-EKTP7MNS.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-EQWEIIKQ.js";
 import {
   runContradictionScan
-} from "./chunk-QPW3PAIH.js";
+} from "./chunk-G6DFSS6A.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -28,10 +28,10 @@ import {
   defineOperation,
   parseNamespacePreflightWriteOp,
   resolveAuthorizedNamespaceWritablePreflight
-} from "./chunk-3WGI7F4V.js";
+} from "./chunk-D3LBIUWV.js";
 import {
   validateBriefingFormat
-} from "./chunk-UYOXFFEY.js";
+} from "./chunk-RUNORG2P.js";
 import {
   enforceNamespaceAllowList,
   tokenCapabilityStore
@@ -494,4 +494,4 @@ defineOperation({ name: "graph_events", description: "SSE graph events.", schema
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "adapters_status", description: "Adapter registry metadata (issue #1850 round 5). Marker op: the HTTP transport builds the response from its own adapterRegistry, but the op still must be registered so it appears in listRegisteredOperations and enforceTokenOp can gate it for scoped tokens.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
-//# sourceMappingURL=chunk-YDWPYDML.js.map
+//# sourceMappingURL=chunk-EKTP7MNS.js.map

package/dist/{chunk-6LEIWWAF.js → chunk-F2JRDPON.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-TBBDFYXW.js";
 import {
   hasLiveSupportPassportCard
-} from "./chunk-HNDIND7P.js";
+} from "./chunk-XX4HPFFM.js";
 
 // src/tier-routing.ts
 function requiresHotTier(memory) {
@@ -80,4 +80,4 @@ export {
   computeTierValueScore,
   decideTierTransition
 };
-//# sourceMappingURL=chunk-6LEIWWAF.js.map
+//# sourceMappingURL=chunk-F2JRDPON.js.map

package/dist/{chunk-VYQ4URQB.js → chunk-FFRTNF3L.js}

@@ -1,7 +1,7 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-VZRFGJCH.js";
+} from "./chunk-UPLZNJKN.js";
 import {
   getConfiguredNamespaces
 } from "./chunk-6QPI2ITJ.js";
@@ -2204,4 +2204,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-VYQ4URQB.js.map
+//# sourceMappingURL=chunk-FFRTNF3L.js.map

package/dist/{chunk-TY6MKIWP.js → chunk-FONWBCVY.js}

@@ -1,10 +1,10 @@
 import {
   parseXrayFormat
-} from "./chunk-RG426DJO.js";
+} from "./chunk-H7NAZ3UB.js";
 import {
   RECALL_DISCLOSURE_LEVELS,
   isRecallDisclosure
-} from "./chunk-BIF4SHMD.js";
+} from "./chunk-76JJSXK7.js";
 
 // src/recall-xray-cli.ts
 function parseXrayDisclosureFlag(value) {
@@ -50,4 +50,4 @@ export {
   parseXrayBudgetFlag,
   parseXrayCliOptions
 };
-//# sourceMappingURL=chunk-TY6MKIWP.js.map
+//# sourceMappingURL=chunk-FONWBCVY.js.map

package/dist/{chunk-XSV2YDCJ.js → chunk-FPLM2TKD.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2DQ2XREU.js";
 import {
   compareEntityTimestamps
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   normalizeEntityName
 } from "./chunk-YXZG5TVN.js";
@@ -887,4 +887,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-XSV2YDCJ.js.map
+//# sourceMappingURL=chunk-FPLM2TKD.js.map

package/dist/{chunk-VTU5IEKY.js → chunk-FTPONF6B.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-7T4TOGMS.js";
 import {
   defineOperation
-} from "./chunk-3WGI7F4V.js";
+} from "./chunk-D3LBIUWV.js";
 
 // src/external-wiki-access.ts
 import { z } from "zod";
@@ -26,4 +26,4 @@ var externalWikiSearchOperation = defineOperation({
 export {
   externalWikiSearchOperation
 };
-//# sourceMappingURL=chunk-VTU5IEKY.js.map
+//# sourceMappingURL=chunk-FTPONF6B.js.map

package/dist/{chunk-6PZGKGAO.js → chunk-FWX7W5PM.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -119,4 +119,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-6PZGKGAO.js.map
+//# sourceMappingURL=chunk-FWX7W5PM.js.map

package/dist/{chunk-QPW3PAIH.js → chunk-G6DFSS6A.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-RGMVMVMF.js";
 import {
   isSupportPassportPrivateMemory
-} from "./chunk-HNDIND7P.js";
+} from "./chunk-XX4HPFFM.js";
 import {
   resolveNamespaceCapabilities
 } from "./chunk-2XRE6FLM.js";
@@ -550,4 +550,4 @@ export {
   ACTIVE_STATUSES,
   runContradictionScan
 };
-//# sourceMappingURL=chunk-QPW3PAIH.js.map
+//# sourceMappingURL=chunk-G6DFSS6A.js.map

package/dist/{chunk-2DD6ZHOM.js → chunk-GJ776BC2.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   bumpMemoryCorpusVersionForDir
 } from "./chunk-KMAP7SNQ.js";
@@ -15,7 +15,7 @@ import {
 } from "./chunk-GCASGYIO.js";
 import {
   excludeSupportPassportPrivateMemories
-} from "./chunk-HNDIND7P.js";
+} from "./chunk-XX4HPFFM.js";
 import {
   RECALL_FALLBACK_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -764,4 +764,4 @@ export {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
 };
-//# sourceMappingURL=chunk-2DD6ZHOM.js.map
+//# sourceMappingURL=chunk-GJ776BC2.js.map

package/dist/{chunk-XKAR4RF6.js → chunk-GN3WRFJY.js}

@@ -6,7 +6,7 @@ import {
   headerConnector,
   renderExtractionConversation,
   resolveSourceConnector
-} from "./chunk-WM5LD6AT.js";
+} from "./chunk-6CYHUWCO.js";
 import {
   ConsolidationResultSchema,
   DaySummaryResultSchema,
@@ -25,9 +25,6 @@ import {
 import {
   ModelRegistry
 } from "./chunk-WLZYGLJ4.js";
-import {
-  LocalLlmClient
-} from "./chunk-L6CQ7WIW.js";
 import {
   containsExtractionPlaceholder,
   extractionAttributes,
@@ -66,6 +63,9 @@ import {
 import {
   ProfilingCollector
 } from "./chunk-NLE6TSLG.js";
+import {
+  LocalLlmClient
+} from "./chunk-KFBOPMF6.js";
 import {
   normalizeProcedureSteps
 } from "./chunk-QDW3E4RD.js";
@@ -76,7 +76,7 @@ import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig,
   gatewayTaskChainOptions
-} from "./chunk-C23BYTJV.js";
+} from "./chunk-UW5NPZJ2.js";
 import {
   buildChatCompletionTokenLimit,
   shouldAssumeOpenAiChatCompletions
@@ -2442,4 +2442,4 @@ export {
   shouldEnableLocalExtractionThinking,
   ExtractionEngine
 };
-//# sourceMappingURL=chunk-XKAR4RF6.js.map
+//# sourceMappingURL=chunk-GN3WRFJY.js.map

package/dist/{chunk-RG426DJO.js → chunk-H7NAZ3UB.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-SOBJ6NEY.js";
 import {
   summarizeDisclosureTokens
-} from "./chunk-QPAQSG3F.js";
+} from "./chunk-MK5VEWCR.js";
 import {
   summarizeRetrievedMemoryProvenance
 } from "./chunk-I4WBNM3M.js";
@@ -606,4 +606,4 @@ export {
   renderRecallExplain,
   parseRecallExplainFormat
 };
-//# sourceMappingURL=chunk-RG426DJO.js.map
+//# sourceMappingURL=chunk-H7NAZ3UB.js.map

package/dist/{chunk-BSXGTDVJ.js → chunk-HBUFQRIM.js}

@@ -1,6 +1,6 @@
 import {
   listNamespaces
-} from "./chunk-NGT35IGQ.js";
+} from "./chunk-MIH3CJPN.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-MZWSOLMT.js";
@@ -282,4 +282,4 @@ export {
   computeServiceCorpusWatermarks,
   computeServiceCorpusCensus
 };
-//# sourceMappingURL=chunk-BSXGTDVJ.js.map
+//# sourceMappingURL=chunk-HBUFQRIM.js.map

package/dist/{chunk-FFEBSFVT.js → chunk-HGJ6NJ4E.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-NOB2T2FC.js";
 import {
   parseConfig
-} from "./chunk-2INWPC6E.js";
+} from "./chunk-PG4QBPVG.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-FFEBSFVT.js.map
+//# sourceMappingURL=chunk-HGJ6NJ4E.js.map

package/dist/{chunk-WB7JSQCP.js → chunk-HIEWDJ2O.js}

@@ -48,10 +48,13 @@ var MCP_READ_ONLY_TOOL_SUFFIXES = {
   codegraph_get_schema: true,
   codegraph_get_snippet: true,
   codegraph_get_architecture: true,
-  codegraph_search_code: true
+  codegraph_search_code: true,
+  support_passport_memory_preview: true,
+  support_passport_cards_list: true,
+  support_passport_grants_list: true
 };
 
 export {
   MCP_READ_ONLY_TOOL_SUFFIXES
 };
-//# sourceMappingURL=chunk-WB7JSQCP.js.map
+//# sourceMappingURL=chunk-HIEWDJ2O.js.map

package/dist/{chunk-WB7JSQCP.js.map → chunk-HIEWDJ2O.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/mcp-read-only-tools.ts"],"sourcesContent":["/**\n * Conservative allowlist of canonical MCP tool suffixes that are\n * unambiguously read-only. Tools in this set are tagged with\n * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP\n * clients that honor the hint) can skip per-call confirmation.\n *\n * The list is suffix-based so it covers both the `remnic.*` and\n * `engram.*` naming forms. Anything not on it stays unannotated:\n * uncertainty is resolved as \"might mutate\".\n *\n * Excluded by construction: anything that writes, runs a pipeline,\n * flushes, applies, records, imports, or destructively deletes.\n */\nexport const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {\n  recall: true,\n  recall_explain: true,\n  recall_tier_explain: true,\n  recall_xray: true,\n  briefing: true,\n  wearables_status: true,\n  transcript_day: true,\n  transcript_search: true,\n  transcript_memories: true,\n  meetings_list: true,\n  meetings_get: true,\n  action_confidence: true,\n  capsule_list: true,\n  procedural_stats: true,\n  memory_get: true,\n  memory_timeline: true,\n  entity_get: true,\n  review_queue_list: true,\n  lcm_search: true,\n  continuity_incident_list: true,\n  identity_anchor_get: true,\n  memory_identity: true,\n  memory_search: true,\n  external_wiki_search: true,\n  memory_profile: true,\n  memory_entities_list: true,\n  memory_questions: true,\n  memory_last_recall: true,\n  memory_intent_debug: true,\n  memory_qmd_debug: true,\n  memory_graph_explain: true,\n  graph_snapshot: true,\n  review_list: true,\n  profiling_report: true,\n  peer_list: true,\n  peer_get: true,\n  peer_profile_get: true,\n  console_state: true,\n  dreams_status: true,\n  codegraph_list_projects: true,\n  codegraph_index_status: true,\n  codegraph_search_graph: true,\n  codegraph_trace_path: true,\n  codegraph_detect_changes: true,\n  codegraph_query_graph: true,\n  codegraph_get_schema: true,\n  codegraph_get_snippet: true,\n  codegraph_get_architecture: true,\n  codegraph_search_code: true,\n};\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,YAAY;AAAA,EACZ,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,4BAA4B;AAAA,EAC5B,uBAAuB;AACzB;","names":[]}
+{"version":3,"sources":["../src/mcp-read-only-tools.ts"],"sourcesContent":["/**\n * Conservative allowlist of canonical MCP tool suffixes that are\n * unambiguously read-only. Tools in this set are tagged with\n * `annotations: { readOnlyHint: true }` so ChatGPT (and other MCP\n * clients that honor the hint) can skip per-call confirmation.\n *\n * The list is suffix-based so it covers both the `remnic.*` and\n * `engram.*` naming forms. Anything not on it stays unannotated:\n * uncertainty is resolved as \"might mutate\".\n *\n * Excluded by construction: anything that writes, runs a pipeline,\n * flushes, applies, records, imports, or destructively deletes.\n */\nexport const MCP_READ_ONLY_TOOL_SUFFIXES: Readonly<Record<string, true>> = {\n  recall: true,\n  recall_explain: true,\n  recall_tier_explain: true,\n  recall_xray: true,\n  briefing: true,\n  wearables_status: true,\n  transcript_day: true,\n  transcript_search: true,\n  transcript_memories: true,\n  meetings_list: true,\n  meetings_get: true,\n  action_confidence: true,\n  capsule_list: true,\n  procedural_stats: true,\n  memory_get: true,\n  memory_timeline: true,\n  entity_get: true,\n  review_queue_list: true,\n  lcm_search: true,\n  continuity_incident_list: true,\n  identity_anchor_get: true,\n  memory_identity: true,\n  memory_search: true,\n  external_wiki_search: true,\n  memory_profile: true,\n  memory_entities_list: true,\n  memory_questions: true,\n  memory_last_recall: true,\n  memory_intent_debug: true,\n  memory_qmd_debug: true,\n  memory_graph_explain: true,\n  graph_snapshot: true,\n  review_list: true,\n  profiling_report: true,\n  peer_list: true,\n  peer_get: true,\n  peer_profile_get: true,\n  console_state: true,\n  dreams_status: true,\n  codegraph_list_projects: true,\n  codegraph_index_status: true,\n  codegraph_search_graph: true,\n  codegraph_trace_path: true,\n  codegraph_detect_changes: true,\n  codegraph_query_graph: true,\n  codegraph_get_schema: true,\n  codegraph_get_snippet: true,\n  codegraph_get_architecture: true,\n  codegraph_search_code: true,\n  support_passport_memory_preview: true,\n  support_passport_cards_list: true,\n  support_passport_grants_list: true,\n};\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,aAAa;AAAA,EACb,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,eAAe;AAAA,EACf,cAAc;AAAA,EACd,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,mBAAmB;AAAA,EACnB,YAAY;AAAA,EACZ,0BAA0B;AAAA,EAC1B,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,eAAe;AAAA,EACf,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,sBAAsB;AAAA,EACtB,gBAAgB;AAAA,EAChB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,UAAU;AAAA,EACV,kBAAkB;AAAA,EAClB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,wBAAwB;AAAA,EACxB,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,iCAAiC;AAAA,EACjC,6BAA6B;AAAA,EAC7B,8BAA8B;AAChC;","names":[]}

package/dist/{chunk-QTO6BMQZ.js → chunk-I3MSGFGD.js}

@@ -1,8 +1,9 @@
 import {
   OPERATION_NAMES,
   getOperation,
-  operationRequiresAuthorizedNamespace
-} from "./chunk-3WGI7F4V.js";
+  operationRequiresAuthorizedNamespace,
+  operationUsesPrincipalNamespace
+} from "./chunk-D3LBIUWV.js";
 import {
   assertOperationAuthorizationAllowed
 } from "./chunk-MZWSOLMT.js";
@@ -17,10 +18,14 @@ var UNRESOLVABLE_RESOURCE_OPERATIONS = /* @__PURE__ */ new Set([
   "chat_message",
   "chat_events"
 ]);
+var HELPER_ONLY_OPERATIONS = /* @__PURE__ */ new Set([
+  "support_passport_grant_read",
+  "support_passport_grant_ask"
+]);
 function probeOperationAuthorization(capabilities, requestedOperations) {
   const operations = [];
   for (const candidate of requestedOperations) {
-    if (!OPERATION_NAMES.includes(candidate)) {
+    if (!OPERATION_NAMES.includes(candidate) || HELPER_ONLY_OPERATIONS.has(candidate)) {
       throw new EngramAccessInputError(`unsupported operation: ${candidate}`);
     }
     const operation = candidate;
@@ -32,7 +37,9 @@ function probeOperationAuthorization(capabilities, requestedOperations) {
   for (const operation of operations) {
     const boundOperation = getOperation(operation);
     if (!boundOperation) {
-      throw new Error(`authorization probe operation is not registered: ${operation}`);
+      throw new Error(
+        `authorization probe operation is not registered: ${operation}`
+      );
     }
     assertOperationAuthorizationAllowed(capabilities, boundOperation.spec);
   }
@@ -44,9 +51,13 @@ function authorizationProbeNamespaces(operations, requestedNamespace) {
   );
   return namespaceOperations.length > 0 ? [requestedNamespace] : [];
 }
+function authorizationProbeRequiresPrincipalNamespace(operations) {
+  return operations.some(operationUsesPrincipalNamespace);
+}
 
 export {
   probeOperationAuthorization,
-  authorizationProbeNamespaces
+  authorizationProbeNamespaces,
+  authorizationProbeRequiresPrincipalNamespace
 };
-//# sourceMappingURL=chunk-QTO6BMQZ.js.map
+//# sourceMappingURL=chunk-I3MSGFGD.js.map

package/dist/chunk-I3MSGFGD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-authorization-probe.ts"],"sourcesContent":["import {\n  getOperation,\n  operationRequiresAuthorizedNamespace,\n  operationUsesPrincipalNamespace,\n  OPERATION_NAMES,\n  type OperationName,\n} from \"./access-boundary.js\";\nimport { EngramAccessInputError } from \"./access-errors.js\";\nimport {\n  assertOperationAuthorizationAllowed,\n  type TokenCapabilities,\n} from \"./access-token-capabilities.js\";\n\nconst UNRESOLVABLE_RESOURCE_OPERATIONS = new Set<OperationName>([\n  \"review_resolve\",\n  \"contradiction_detail\",\n  \"chat_message\",\n  \"chat_events\",\n]);\n\nconst HELPER_ONLY_OPERATIONS = new Set<OperationName>([\n  \"support_passport_grant_read\",\n  \"support_passport_grant_ask\",\n]);\n\nexport interface AuthorizationProbeResponse {\n  readonly authorized: true;\n  readonly operations: readonly OperationName[];\n}\n\n/**\n * Verify that the presenting token may call every requested operation without\n * invoking any operation handler.\n */\nexport function probeOperationAuthorization(\n  capabilities: TokenCapabilities | undefined | null,\n  requestedOperations: readonly string[],\n): AuthorizationProbeResponse {\n  const operations: OperationName[] = [];\n  for (const candidate of requestedOperations) {\n    if (\n      !OPERATION_NAMES.includes(candidate as OperationName) ||\n      HELPER_ONLY_OPERATIONS.has(candidate as OperationName)\n    ) {\n      throw new EngramAccessInputError(`unsupported operation: ${candidate}`);\n    }\n    const operation = candidate as OperationName;\n    if (!operations.includes(operation)) operations.push(operation);\n  }\n\n  if (operations.length === 0) {\n    throw new EngramAccessInputError(\"at least one operation is required\");\n  }\n\n  for (const operation of operations) {\n    const boundOperation = getOperation(operation);\n    if (!boundOperation) {\n      throw new Error(\n        `authorization probe operation is not registered: ${operation}`,\n      );\n    }\n    assertOperationAuthorizationAllowed(capabilities, boundOperation.spec);\n  }\n\n  return { authorized: true, operations };\n}\n\n/**\n * Resolve every namespace an authorization probe can verify from the request.\n * Resource-scoped routes resolve their stored target only after a resource id\n * is supplied, so probes validate only request-resolvable namespaces.\n */\nexport function authorizationProbeNamespaces(\n  operations: readonly OperationName[],\n  requestedNamespace: string | undefined,\n): readonly (string | undefined)[] {\n  const namespaceOperations = operations.filter(\n    (operation) =>\n      operationRequiresAuthorizedNamespace(operation) &&\n      !UNRESOLVABLE_RESOURCE_OPERATIONS.has(operation),\n  );\n  return namespaceOperations.length > 0 ? [requestedNamespace] : [];\n}\n\n/** Whether a probe must resolve the authenticated principal's owner namespace. */\nexport function authorizationProbeRequiresPrincipalNamespace(\n  operations: readonly OperationName[],\n): boolean {\n  return operations.some(operationUsesPrincipalNamespace);\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,IAAM,mCAAmC,oBAAI,IAAmB;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,yBAAyB,oBAAI,IAAmB;AAAA,EACpD;AAAA,EACA;AACF,CAAC;AAWM,SAAS,4BACd,cACA,qBAC4B;AAC5B,QAAM,aAA8B,CAAC;AACrC,aAAW,aAAa,qBAAqB;AAC3C,QACE,CAAC,gBAAgB,SAAS,SAA0B,KACpD,uBAAuB,IAAI,SAA0B,GACrD;AACA,YAAM,IAAI,uBAAuB,0BAA0B,SAAS,EAAE;AAAA,IACxE;AACA,UAAM,YAAY;AAClB,QAAI,CAAC,WAAW,SAAS,SAAS,EAAG,YAAW,KAAK,SAAS;AAAA,EAChE;AAEA,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,IAAI,uBAAuB,oCAAoC;AAAA,EACvE;AAEA,aAAW,aAAa,YAAY;AAClC,UAAM,iBAAiB,aAAa,SAAS;AAC7C,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI;AAAA,QACR,oDAAoD,SAAS;AAAA,MAC/D;AAAA,IACF;AACA,wCAAoC,cAAc,eAAe,IAAI;AAAA,EACvE;AAEA,SAAO,EAAE,YAAY,MAAM,WAAW;AACxC;AAOO,SAAS,6BACd,YACA,oBACiC;AACjC,QAAM,sBAAsB,WAAW;AAAA,IACrC,CAAC,cACC,qCAAqC,SAAS,KAC9C,CAAC,iCAAiC,IAAI,SAAS;AAAA,EACnD;AACA,SAAO,oBAAoB,SAAS,IAAI,CAAC,kBAAkB,IAAI,CAAC;AAClE;AAGO,SAAS,6CACd,YACS;AACT,SAAO,WAAW,KAAK,+BAA+B;AACxD;","names":[]}

package/dist/{chunk-5JKUSBMX.js → chunk-IKP5OYQQ.js}

@@ -1,6 +1,6 @@
 import {
   rebuildMemoryProjection
-} from "./chunk-TKFGFDPJ.js";
+} from "./chunk-3TIZPSJC.js";
 
 // src/convergence-refresh.ts
 async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, getStorage, searchEnabled) {
@@ -32,4 +32,4 @@ async function refreshConvergedNamespaces(namespaces, namespaceSearchRouter, get
 export {
   refreshConvergedNamespaces
 };
-//# sourceMappingURL=chunk-5JKUSBMX.js.map
+//# sourceMappingURL=chunk-IKP5OYQQ.js.map

package/dist/{chunk-KQAFEZQX.js → chunk-IPLYGWQF.js}

@@ -1,3 +1,7 @@
+import {
+  CAPSULE_SCHEMA_VERSION,
+  EXPORT_FORMAT
+} from "./chunk-J4EB7DNW.js";
 import {
   CAPSULE_ID_PATTERN,
   CapsuleBlockSchema,
@@ -7,10 +11,6 @@ import {
 import {
   encryptCapsuleFile
 } from "./chunk-X7Y7WX73.js";
-import {
-  CAPSULE_SCHEMA_VERSION,
-  EXPORT_FORMAT
-} from "./chunk-J4EB7DNW.js";
 import {
   DEFAULT_TRANSFER_EXCLUDE_DIRS,
   computeTransferOutputRel
@@ -261,4 +261,4 @@ export {
   exportCapsule,
   isValidCapsuleSince
 };
-//# sourceMappingURL=chunk-KQAFEZQX.js.map
+//# sourceMappingURL=chunk-IPLYGWQF.js.map

package/dist/{chunk-DBY26JJJ.js → chunk-IQ4NVWEF.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-QQXWFDRD.js";
+} from "./chunk-M4YHAODQ.js";
 import {
   composeMemoryEnvelope
 } from "./chunk-NSVDUN76.js";
@@ -546,4 +546,4 @@ export {
   setSemanticRulePromotionTestHooks,
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-DBY26JJJ.js.map
+//# sourceMappingURL=chunk-IQ4NVWEF.js.map

package/dist/{chunk-7Q7JWLQ4.js → chunk-JYG4OLWH.js}

@@ -1,6 +1,6 @@
 import {
   resolveCorpusNamespaceRoots
-} from "./chunk-BSXGTDVJ.js";
+} from "./chunk-HBUFQRIM.js";
 import {
   normalizeNamespaceIdentity
 } from "./chunk-EGGE52UU.js";
@@ -200,4 +200,4 @@ async function readAggregateExtractionWatermark(options) {
 export {
   readAggregateExtractionWatermark
 };
-//# sourceMappingURL=chunk-7Q7JWLQ4.js.map
+//# sourceMappingURL=chunk-JYG4OLWH.js.map

package/dist/{chunk-3OTSVCPK.js → chunk-K26NWEOC.js}

@@ -9,14 +9,14 @@ import {
 } from "./chunk-666A3MOW.js";
 import {
   rebuildMemoryLifecycleLedger
-} from "./chunk-LVKYLMSM.js";
+} from "./chunk-46SZBVDS.js";
 import {
   planNamespaceMaintenance,
   runNamespaceMaintenanceBatchPlan
-} from "./chunk-VYQ4URQB.js";
+} from "./chunk-FFRTNF3L.js";
 import {
   rebuildMemoryProjection
-} from "./chunk-TKFGFDPJ.js";
+} from "./chunk-3TIZPSJC.js";
 import {
   activityDayWindow,
   activityDigestPath,
@@ -1719,4 +1719,4 @@ export {
   ActivitySyncScheduler,
   MaintenanceScheduler
 };
-//# sourceMappingURL=chunk-3OTSVCPK.js.map
+//# sourceMappingURL=chunk-K26NWEOC.js.map