@remnic/core 9.54.5 → 9.54.7

package/dist/{chunk-DDA55IVB.js → chunk-PT54WISF.js}

@@ -3,10 +3,19 @@ import {
 } from "./chunk-V7IZKJI3.js";
 import {
   AdapterRegistry
-} from "./chunk-AU7Q3LSC.js";
+} from "./chunk-2QSZNTDO.js";
 import {
   WriteRateLimiter
-} from "./chunk-MKQBXQKU.js";
+} from "./chunk-TB6CBZ5V.js";
+import {
+  serializeInlineScriptValue
+} from "./chunk-3HSRWJTC.js";
+import {
+  handleSupportPassportOwnerHttp
+} from "./chunk-NISZQW72.js";
+import {
+  buildSupportPassportPublicRequestHandler
+} from "./chunk-37DZZFFM.js";
 import {
   nonEmptyQueryParam,
   optionalQueryString,
@@ -21,13 +30,13 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-3SXLD5T3.js";
+} from "./chunk-7BD6O7ZV.js";
 import {
   RelayMissionStoreError
-} from "./chunk-CSY44OKU.js";
+} from "./chunk-26ZXBTYN.js";
 import {
   validateRequest
-} from "./chunk-JKW663ZN.js";
+} from "./chunk-CIAI24TQ.js";
 import {
   executeResolution,
   isValidResolutionVerb
@@ -49,13 +58,14 @@ import {
 } from "./chunk-CK5KOVHW.js";
 import {
   authorizationProbeNamespaces,
+  authorizationProbeRequiresPrincipalNamespace,
   probeOperationAuthorization
-} from "./chunk-QTO6BMQZ.js";
+} from "./chunk-I3MSGFGD.js";
 import {
   CorrectionContractError,
   getOperation,
   resolveQueryNamespaceWritablePreflight
-} from "./chunk-3WGI7F4V.js";
+} from "./chunk-D3LBIUWV.js";
 import {
   isTrustZoneName
 } from "./chunk-KQS72GCR.js";
@@ -64,7 +74,7 @@ import {
 } from "./chunk-DEUNUKTD.js";
 import {
   isRecallDisclosure
-} from "./chunk-BIF4SHMD.js";
+} from "./chunk-76JJSXK7.js";
 import {
   OFFLINE_SYNC_APPLY_MAX_BODY_BYTES,
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
@@ -101,8 +111,8 @@ import { randomUUID, timingSafeEqual } from "crypto";
 import { AsyncLocalStorage } from "async_hooks";
 import { existsSync } from "fs";
 import { readFile } from "fs/promises";
-import path from "path";
-import { fileURLToPath, URL } from "url";
+import path2 from "path";
+import { fileURLToPath, URL as URL2 } from "url";
 import { gunzipSync } from "zlib";
 
 // src/meetings/errors.ts
@@ -348,16 +358,116 @@ function respondJson(res, status, body) {
   res.end(json);
 }
 
+// src/support-passport/access-http-base.ts
+import path from "path";
+var SUPPORT_PASSPORT_QUOTA_LIMITED_WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "engram.support_passport_draft_create",
+  "remnic.support_passport_draft_create",
+  "engram.support_passport_drafts_generate",
+  "remnic.support_passport_drafts_generate",
+  "engram.support_passport_card_replace",
+  "remnic.support_passport_card_replace",
+  "engram.support_passport_card_approve",
+  "remnic.support_passport_card_approve",
+  "engram.support_passport_card_reject",
+  "remnic.support_passport_card_reject",
+  "engram.support_passport_card_withdraw",
+  "remnic.support_passport_card_withdraw",
+  "engram.support_passport_grant_create",
+  "remnic.support_passport_grant_create",
+  "engram.support_passport_grant_revoke",
+  "remnic.support_passport_grant_revoke"
+]);
+var SUPPORT_PASSPORT_ADMIN_CONSOLE_ASSETS = /* @__PURE__ */ new Map([
+  ["what-helps-me.css", "text/css; charset=utf-8"],
+  ["model.js", "application/javascript; charset=utf-8"],
+  ["app.js", "application/javascript; charset=utf-8"]
+]);
+var SupportPassportAccessHttpBase = class {
+  supportPassportPublicHandler;
+  handleSupportPassportOwnerRequest(req, res, pathname, hasQuery, abortSignal) {
+    return handleSupportPassportOwnerHttp({
+      req,
+      res,
+      pathname,
+      hasQuery,
+      service: this.service,
+      principal: this.resolveRequestPrincipal(req),
+      abortSignal,
+      readJsonBody: () => this.readJsonBody(req),
+      respondJson: (status, payload) => {
+        res.setHeader("cache-control", "private, no-store");
+        res.setHeader("vary", "Authorization");
+        this.respondJson(res, status, payload);
+      },
+      reserveWriteRateLimitSlot: () => this.reserveWriteRateLimitSlot(req)
+    });
+  }
+  handleSupportPassportPublicRequest(req, res) {
+    this.supportPassportPublicHandler ??= buildSupportPassportPublicRequestHandler(this.service, {
+      trustedProxyAddresses: this.service.configRef?.supportPassport?.trustedProxyAddresses ?? []
+    });
+    return this.supportPassportPublicHandler(req, res, {
+      authorized: false,
+      tokenAuthorized: false
+    });
+  }
+  async enforceSupportPassportAuthorizationProbe(req) {
+    const principal = this.resolveRequestPrincipal(req)?.trim();
+    if (!principal) {
+      throw new EngramAccessForbiddenError("A trusted principal is required for support passport access.");
+    }
+    const owner = await this.service.getWritableStorageForNamespace(void 0, principal);
+    enforceNamespaceAllowList(
+      tokenCapabilityStore.getStore(),
+      owner.namespace,
+      this.service.configRef.defaultNamespace
+    );
+  }
+  isSupportPassportQuotaLimitedWriteTool(toolName) {
+    return SUPPORT_PASSPORT_QUOTA_LIMITED_WRITE_TOOLS.has(toolName);
+  }
+  async handleSupportPassportUi(req, res, pathname) {
+    if (req.method !== "GET") return false;
+    const isSupportPassportPath = pathname === "/remnic/ui/what-helps-me" || pathname === "/engram/ui/what-helps-me" || pathname.startsWith("/remnic/ui/what-helps-me/") || pathname.startsWith("/engram/ui/what-helps-me/");
+    if (!isSupportPassportPath) return false;
+    if (!this.service.supportPassportEnabled) {
+      this.respondJson(res, 404, { error: "not_found" });
+      return true;
+    }
+    if (pathname === "/remnic/ui/what-helps-me" || pathname === "/engram/ui/what-helps-me") {
+      const search = new URL(req.url ?? pathname, "http://placeholder").search;
+      res.statusCode = 301;
+      res.setHeader("location", `${pathname}/${search}`);
+      res.end();
+      return true;
+    }
+    if (pathname === "/remnic/ui/what-helps-me/" || pathname === "/engram/ui/what-helps-me/") {
+      const helperRequest = new URL(req.url ?? pathname, "http://placeholder").searchParams.has("grant");
+      res.setHeader("content-security-policy", "frame-ancestors 'none'");
+      res.setHeader("x-frame-options", "DENY");
+      await this.respondAdminConsoleShell(req, res, pathname, "what-helps-me/index.html", !helperRequest);
+      return true;
+    }
+    const fileName = pathname.split("/").at(-1) ?? "";
+    const assetType = SUPPORT_PASSPORT_ADMIN_CONSOLE_ASSETS.get(fileName);
+    if (assetType && pathname.split("/").length === 5) {
+      await this.respondStatic(res, path.join(this.adminConsolePublicDir, "what-helps-me", fileName), assetType);
+      return true;
+    }
+    this.respondJson(res, 404, { error: "not_found" });
+    return true;
+  }
+};
+
 // src/access-http.ts
-function resolveDefaultAdminConsolePublicDir() {
-  const thisDir = path.dirname(fileURLToPath(import.meta.url));
+function resolveDefaultAdminConsolePublicDir(sourceUrl = import.meta.url) {
+  const thisDir = path2.dirname(fileURLToPath(sourceUrl));
   const candidates = [
-    // Standard: admin-console sibling to src/ (development layout)
-    path.resolve(thisDir, "../admin-console/public"),
-    // Bundled: admin-console inside dist/ alongside the bundle
-    path.resolve(thisDir, "./admin-console/public"),
-    // Package root: walk up from dist/ to the package root
-    path.resolve(thisDir, "../../admin-console/public")
+    path2.resolve(thisDir, "../../../admin-console/public"),
+    path2.resolve(thisDir, "../dist/admin-console/public"),
+    path2.resolve(thisDir, "./admin-console/public"),
+    path2.resolve(thisDir, "../../admin-console/public")
   ];
   return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
 }
@@ -399,7 +509,7 @@ function assertResourceMetadataUrl(value) {
   if (value === void 0) return void 0;
   let parsed;
   try {
-    parsed = new URL(value);
+    parsed = new URL2(value);
   } catch {
     throw new Error(
       `access HTTP resourceMetadataUrl must be an absolute http(s) URL, got: ${value}`
@@ -436,7 +546,7 @@ function parseTrustZoneFilter(raw) {
 function summarizeHttpRequest(req) {
   const method = req.method ?? "UNKNOWN";
   try {
-    const parsed = new URL(req.url ?? "/", "http://localhost");
+    const parsed = new URL2(req.url ?? "/", "http://localhost");
     return `${method} ${parsed.pathname}`;
   } catch {
     return `${method} ${(req.url ?? "/").split("?")[0]}`;
@@ -488,7 +598,7 @@ function codingContextFromProjectTag(projectTag) {
     defaultBranch: null
   };
 }
-var EngramAccessHttpServer = class {
+var EngramAccessHttpServer = class extends SupportPassportAccessHttpBase {
   service;
   host;
   requestedPort;
@@ -531,6 +641,7 @@ var EngramAccessHttpServer = class {
    */
   chatTtlTimer = null;
   constructor(options) {
+    super();
     this.service = options.service;
     this.host = options.host?.trim() || "127.0.0.1";
     this.requestedPort = parseHttpServerPort(options.port);
@@ -840,11 +951,10 @@ var EngramAccessHttpServer = class {
     return queryDisclosure;
   }
   async handle(req, res, correlationId, abortSignal) {
-    const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
+    const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
     const pathname = parsed.pathname;
-    if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) {
-      return;
-    }
+    if (await this.handleSupportPassportUi(req, res, pathname)) return;
+    if (this.adminConsoleEnabled && await this.handleAdminConsole(req, res, pathname)) return;
     if (req.method === "GET" && (pathname === "/engram/v1/live" || pathname === "/engram/v1/health")) {
       const { ready, warmupAttempts, lastError } = this.readiness();
       if (!ready) {
@@ -858,11 +968,15 @@ var EngramAccessHttpServer = class {
         return;
       }
     }
+    if (await this.handleSupportPassportPublicRequest(req, res)) return;
     if (this.externalRequestHandler) {
-      const authorized = this.isAuthorized(req, pathname) && !isCapabilityRestricted(this.resolveTokenCapabilities(req, pathname));
-      if (await this.externalRequestHandler(req, res, { authorized })) {
-        return;
-      }
+      const tokenAuthorized = this.isAuthorized(req, pathname);
+      const capabilities = this.resolveTokenCapabilities(req, pathname);
+      const authorized = tokenAuthorized && !isCapabilityRestricted(capabilities);
+      if (await this.externalRequestHandler(req, res, {
+        authorized,
+        tokenAuthorized
+      })) return;
     }
     if (!this.isAuthorized(req, pathname)) {
       const body = JSON.stringify({ error: "unauthorized", code: "unauthorized" });
@@ -890,10 +1004,8 @@ var EngramAccessHttpServer = class {
       res.end(body);
       return;
     }
-    if (req.method === "POST" && pathname === "/mcp") {
-      await this.handleMcpRequest(req, res, abortSignal);
-      return;
-    }
+    if (req.method === "POST" && pathname === "/mcp") return this.handleMcpRequest(req, res, abortSignal);
+    if (await this.handleSupportPassportOwnerRequest(req, res, pathname, parsed.search.length > 0, abortSignal)) return;
     if (req.method === "GET" && pathname === "/engram/v1/live") return this.respondJson(res, 200, { ok: true, ready: true });
     if (req.method === "GET" && pathname === "/engram/v1/health") {
       const { degraded, warmupAttempts, lastError } = this.readiness();
@@ -910,9 +1022,10 @@ var EngramAccessHttpServer = class {
     if (req.method === "GET" && pathname === "/engram/v1/authorization") {
       res.setHeader("cache-control", "no-store");
       const probe = probeOperationAuthorization(tokenCapabilityStore.getStore(), parsed.searchParams.getAll("op"));
-      const namespaceParam = parsed.searchParams.get("namespace") ?? void 0;
-      for (const namespace of authorizationProbeNamespaces(probe.operations, namespaceParam))
+      for (const namespace of authorizationProbeNamespaces(probe.operations, parsed.searchParams.get("namespace") ?? void 0))
         this.resolveNamespace(req, namespace);
+      if (authorizationProbeRequiresPrincipalNamespace(probe.operations))
+        await this.enforceSupportPassportAuthorizationProbe(req);
       this.respondJson(res, 200, probe);
       return;
     }
@@ -1605,7 +1718,7 @@ var EngramAccessHttpServer = class {
       if (!op) {
         throw new Error("access-boundary: operation not registered: relay_mission_append");
       }
-      let releaseWriteQuota;
+      let writeQuota;
       try {
         const output = await op.run(
           { missionId, namespace, event: body.event },
@@ -1614,17 +1727,18 @@ var EngramAccessHttpServer = class {
             authenticatedPrincipal: this.resolveRequestPrincipal(req),
             hooks: {
               enforceWriteQuota: () => {
-                releaseWriteQuota ??= this.reserveWriteRateLimitSlot(req);
+                writeQuota ??= this.reserveWriteRateLimitSlot(req);
               }
             }
           }
         );
         if (output.result.appended) {
-          releaseWriteQuota = void 0;
+          writeQuota?.commit();
+          writeQuota = void 0;
         }
         this.respondJson(res, output.result.appended ? 201 : 200, output.result);
       } finally {
-        releaseWriteQuota?.();
+        writeQuota?.release();
       }
       return;
     }
@@ -2255,7 +2369,7 @@ var EngramAccessHttpServer = class {
     if (req.method === "POST" && pathname === "/engram/v1/contradiction-scan") {
       this.enforceTokenOp("contradiction_scan_run");
       const body = await this.readJsonBody(req);
-      const { runContradictionScan } = await import("./contradiction-scan-KCADHXPE.js");
+      const { runContradictionScan } = await import("./contradiction-scan-JDTBXRGW.js");
       const principal = this.resolveRequestPrincipal(req);
       const result = await runContradictionScan({
         storage: this.service.storageRef,
@@ -2655,7 +2769,7 @@ var EngramAccessHttpServer = class {
    *     client never disconnects (Cursor review thread `access-http.ts:232`).
    */
   async handleGraphEventsSSE(req, res) {
-    const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
+    const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
     const namespaceParam = parsed.searchParams.get("namespace");
     const namespace = this.resolveNamespace(req, namespaceParam && namespaceParam.length > 0 ? namespaceParam : void 0);
     const principal = this.resolveRequestPrincipal(req);
@@ -2753,17 +2867,25 @@ var EngramAccessHttpServer = class {
     ]);
     const isCodegraphManageAdr = toolName === "engram.codegraph_manage_adr" || toolName === "remnic.codegraph_manage_adr";
     const codegraphWrite = CODEGRAPH_WRITE_TOOLS.has(toolName) || isCodegraphManageAdr && (toolArgsSubcommand === "record" || toolArgsSubcommand === "supersede");
-    const isMcpWrite = request.method === "tools/call" && (toolName === "engram.memory_store" || toolName === "remnic.memory_store" || toolName === "engram.suggestion_submit" || toolName === "remnic.suggestion_submit" || toolName === "engram.observe" || toolName === "remnic.observe" || toolName === "engram.lcm_compaction_flush" || toolName === "remnic.lcm_compaction_flush" || toolName === "engram.extraction_force_flush" || toolName === "remnic.extraction_force_flush" || toolName === "engram.lcm_compaction_record" || toolName === "remnic.lcm_compaction_record" || toolName === "engram.capsule_export" || toolName === "remnic.capsule_export" || toolName === "engram.capsule_import" || toolName === "remnic.capsule_import" || toolName === "engram.entity_synthesis_run" || toolName === "remnic.entity_synthesis_run" || !dreamsRunDryRun && (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") || !memoryActionApplyDryRun && (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply") || (toolName === "engram.memory_correct_apply" || toolName === "remnic.memory_correct_apply" || toolName === "engram.memory_correct_plan" || toolName === "remnic.memory_correct_plan") || codingDecisionWrite || codingArchitectureWrite || codegraphWrite);
+    const supportPassportQuotaLimitedWrite = this.isSupportPassportQuotaLimitedWriteTool(toolName);
+    const isMcpWrite = request.method === "tools/call" && (toolName === "engram.memory_store" || toolName === "remnic.memory_store" || toolName === "engram.suggestion_submit" || toolName === "remnic.suggestion_submit" || toolName === "engram.observe" || toolName === "remnic.observe" || toolName === "engram.lcm_compaction_flush" || toolName === "remnic.lcm_compaction_flush" || toolName === "engram.extraction_force_flush" || toolName === "remnic.extraction_force_flush" || toolName === "engram.lcm_compaction_record" || toolName === "remnic.lcm_compaction_record" || toolName === "engram.capsule_export" || toolName === "remnic.capsule_export" || toolName === "engram.capsule_import" || toolName === "remnic.capsule_import" || toolName === "engram.entity_synthesis_run" || toolName === "remnic.entity_synthesis_run" || !dreamsRunDryRun && (toolName === "engram.dreams_run" || toolName === "remnic.dreams_run") || !memoryActionApplyDryRun && (toolName === "engram.memory_action_apply" || toolName === "remnic.memory_action_apply") || (toolName === "engram.memory_correct_apply" || toolName === "remnic.memory_correct_apply" || toolName === "engram.memory_correct_plan" || toolName === "remnic.memory_correct_plan") || codingDecisionWrite || codingArchitectureWrite || codegraphWrite || supportPassportQuotaLimitedWrite);
     const observeSelfEnforcesQuota = toolName === "engram.observe" || toolName === "remnic.observe";
     const extractionForceFlushWrite = toolName === "engram.extraction_force_flush" || toolName === "remnic.extraction_force_flush";
     let writeRateLimitRecorded = false;
+    let supportPassportQuota;
     const recordCommittedMcpWrite = extractionForceFlushWrite ? () => {
       if (writeRateLimitRecorded) return;
       writeRateLimitRecorded = true;
       this.recordWriteRateLimitHit(req);
+    } : supportPassportQuotaLimitedWrite ? () => {
+      if (writeRateLimitRecorded) return;
+      writeRateLimitRecorded = true;
+      supportPassportQuota?.commit();
+      supportPassportQuota = void 0;
     } : void 0;
     if (isMcpWrite && !observeSelfEnforcesQuota) {
-      this.ensureWriteRateLimitAvailable(req);
+      if (supportPassportQuotaLimitedWrite) supportPassportQuota = this.reserveWriteRateLimitSlot(req);
+      else this.ensureWriteRateLimitAvailable(req);
     }
     const sessionId = (() => {
       const raw = req.headers["mcp-session-id"];
@@ -2789,6 +2911,9 @@ var EngramAccessHttpServer = class {
       recordWriteCommit: recordCommittedMcpWrite,
       sourceConnector: this.resolveConnector(req),
       abortSignal
+    }).catch((error) => {
+      supportPassportQuota?.release();
+      throw error;
     });
     if (isMcpWrite && response !== null) {
       const result = response.result;
@@ -2797,10 +2922,16 @@ var EngramAccessHttpServer = class {
       const isRejectedCodegraph = structured?.ok === false;
       const counts = structured ? this.shouldCountWriteRateLimit(structured) : true;
       if (!writeRateLimitRecorded && !isError && !isRejectedCodegraph && counts) {
-        this.recordWriteRateLimitHit(req);
+        if (supportPassportQuota) {
+          supportPassportQuota.commit();
+          supportPassportQuota = void 0;
+        } else {
+          this.recordWriteRateLimitHit(req);
+        }
         writeRateLimitRecorded = true;
       }
     }
+    supportPassportQuota?.release();
     if (abortSignal.aborted) {
       throw isAbortError(abortSignal.reason) ? abortSignal.reason : abortError("HTTP client disconnected");
     }
@@ -2862,7 +2993,7 @@ var EngramAccessHttpServer = class {
       return true;
     }
     if (pathname === "/remnic/ui/app.js" || pathname === "/engram/ui/app.js") {
-      await this.respondStatic(res, path.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
+      await this.respondStatic(res, path2.join(this.adminConsolePublicDir, "app.js"), "application/javascript; charset=utf-8");
       return true;
     }
     const relayAsset = RELAY_ADMIN_CONSOLE_ASSETS.get(pathname.split("/").at(-1) ?? "");
@@ -2870,18 +3001,20 @@ var EngramAccessHttpServer = class {
     if (isRelayAsset && relayAsset && pathname.split("/").length === 5) {
       const fileName = pathname.split("/").at(-1);
       if (fileName) {
-        await this.respondStatic(res, path.join(this.adminConsolePublicDir, "relay", fileName), relayAsset);
+        await this.respondStatic(res, path2.join(this.adminConsolePublicDir, "relay", fileName), relayAsset);
         return true;
       }
     }
     return false;
   }
-  async respondAdminConsoleShell(req, res, pathname, relativePath = "index.html") {
+  async respondAdminConsoleShell(req, res, pathname, relativePath = "index.html", allowPrefill = true) {
     try {
-      let body = await readFile(path.join(this.adminConsolePublicDir, relativePath), "utf-8");
-      const canPrefillToken = this.adminConsolePrefillToken && this.isAuthorized(req, pathname);
+      let body = await readFile(path2.join(this.adminConsolePublicDir, relativePath), "utf-8");
+      const matched = this.resolveAuthorizedEntry(req, pathname);
+      const canPrefillToken = allowPrefill && this.adminConsolePrefillToken && matched !== null && matched.capabilities === void 0 && this.timingSafeStringEqual(matched.token, this.adminConsolePrefillToken);
       if (canPrefillToken) {
-        const script = `<script>window.__REMNIC_ADMIN_CONSOLE_PREFILL_TOKEN__=${JSON.stringify(this.adminConsolePrefillToken)};</script>`;
+        const serializedToken = serializeInlineScriptValue(this.adminConsolePrefillToken);
+        const script = `<script>(function(token,script){const key="__REMNIC_ADMIN_CONSOLE_PREFILL_TOKEN__";const clear=function(){token="";try{delete window[key]}catch{window[key]=""}};window.addEventListener("pagehide",clear,{once:true});window.addEventListener("beforeunload",clear,{once:true});try{if(new URLSearchParams(location.hash.slice(1)).has("secret")){clear();return}Object.defineProperty(window,key,{configurable:true,get:function(){const value=token;clear();return value}})}finally{if(script){script.textContent="";script.remove()}}})(${serializedToken},document.currentScript);</script>`;
         body = body.includes("</head>") ? body.replace("</head>", `${script}</head>`) : `${script}${body}`;
         res.setHeader("cache-control", "private, no-store");
       }
@@ -3098,7 +3231,7 @@ var EngramAccessHttpServer = class {
     }
     if (!candidate && pathname === "/engram/v1/graph/events") {
       try {
-        const parsed = new URL(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
+        const parsed = new URL2(req.url ?? "/", `http://${hostToUrlAuthority(this.host)}`);
         const queryToken = parsed.searchParams.get("token");
         if (queryToken && queryToken.length > 0) {
           candidate = queryToken;
@@ -3227,11 +3360,11 @@ var EngramAccessHttpServer = class {
     this.writeLimiter.record(this.principalForRateLimit(req));
   }
   reserveWriteRateLimitSlot(req) {
-    const release = this.writeLimiter.reserve(this.principalForRateLimit(req));
-    if (!release) {
+    const reservation = this.writeLimiter.reserve(this.principalForRateLimit(req));
+    if (!reservation) {
       throw new HttpError(429, "write_rate_limited", "write_rate_limited");
     }
-    return release;
+    return reservation;
   }
   principalForRateLimit(req) {
     if (!req) return void 0;
@@ -3261,6 +3394,7 @@ var EngramAccessHttpServer = class {
 
 export {
   MeetingsInputError,
+  resolveDefaultAdminConsolePublicDir,
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-DDA55IVB.js.map
+//# sourceMappingURL=chunk-PT54WISF.js.map