@remnic/core 9.6.1 → 9.6.3

package/dist/access-admin-ops-surface.d.ts

@@ -1,9 +1,9 @@
-import { E as EngramAccessReviewQueueResponse, A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, b as EngramAccessCapsuleListResponse, M as MemoryPromotionTargetKind, c as MemoryPromotionResult } from './access-service-CXJaql3A.js';
-import { D as DreamsPhase, a as DreamsRunResult } from './types-CGgcNWCG.js';
+import { E as EngramAccessReviewQueueResponse, A as AccessProfilingReportRequest, a as AccessProfilingReportResponse, b as EngramAccessCapsuleListResponse, M as MemoryPromotionTargetKind, c as MemoryPromotionResult } from './access-service-Bps_9G1t.js';
+import { D as DreamsPhase, a as DreamsRunResult } from './types-DDUDgd7T.js';
 import { GraphSnapshotRequest, GraphSnapshotResponse } from './graph-snapshot.js';
-import { O as Orchestrator } from './orchestrator-CWFrT8AF.js';
-import './catalog-C9cu67Ig.js';
-import './storage-C1maCNbc.js';
+import { O as Orchestrator } from './orchestrator-B0YrUl2H.js';
+import './catalog-9WanSGtt.js';
+import './storage-DxPDAiU9.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -30,7 +30,7 @@ import './local-llm.js';
 import './model-registry.js';
 import './fallback-llm.js';
 import './resolve-provider-secret.js';
-import './semantic-DJR8_DMQ.js';
+import './semantic-TddhF0y7.js';
 import './memory-worth-outcomes.js';
 import './transfer/capsule-import.js';
 import './transfer/types.js';
@@ -39,7 +39,6 @@ import './transfer/capsule-export.js';
 import './capsule-cli.js';
 import './offline-sync.js';
 import './action-confidence.js';
-import './types-gb_SNtjR.js';
 import './graph.js';
 import './capabilities.js';
 import './briefing.js';
@@ -56,7 +55,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-O5lMZ4LG.js';
+import './semantic-consolidation-BTShF2Fo.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';

package/dist/access-admin-ops-surface.js

@@ -1,6 +1,6 @@
 import {
   AccessAdminOpsSurface
-} from "./chunk-H2DXDQCQ.js";
+} from "./chunk-BT3PTVYZ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-CYWCKFCL.js";
@@ -12,9 +12,9 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-2KK5WNQB.js";
+import "./chunk-DQ42IQSK.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-6MMONPHM.js";
+import "./chunk-W2AHSCKY.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
@@ -31,7 +31,7 @@ import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-3XIY7MDQ.js";
+import "./chunk-O6YI4CVI.js";
 import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
@@ -45,7 +45,7 @@ import "./chunk-EI6V5UXY.js";
 import "./chunk-MTWKDOVO.js";
 import "./chunk-O75CRYGF.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-K5LLP4CY.js";
+import "./chunk-ZGPDSEKG.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
@@ -55,8 +55,8 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-TBBDFYXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-Y7UNNAZD.js";
-import "./chunk-SVOHGUMI.js";
+import "./chunk-7ZYBDQ7V.js";
+import "./chunk-H4FHR4UM.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -67,7 +67,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-JS2HKKOK.js";
+import "./chunk-3AC5UYKI.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/dist/access-boundary.d.ts

@@ -1,12 +1,11 @@
 import { z } from 'zod';
-import { F as EngramAccessService } from './access-service-CXJaql3A.js';
-import './catalog-C9cu67Ig.js';
-import './types-CGgcNWCG.js';
-import './types-gb_SNtjR.js';
+import { F as EngramAccessService } from './access-service-Bps_9G1t.js';
+import './catalog-9WanSGtt.js';
+import './types-DDUDgd7T.js';
 import './message-parts/index.js';
-import './orchestrator-CWFrT8AF.js';
+import './orchestrator-B0YrUl2H.js';
 import './briefing.js';
-import './storage-C1maCNbc.js';
+import './storage-DxPDAiU9.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -34,7 +33,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-O5lMZ4LG.js';
+import './semantic-consolidation-BTShF2Fo.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -68,7 +67,7 @@ import './framework-CNDn2164.js';
 import './relevance.js';
 import './negative.js';
 import './session-observer-state.js';
-import './semantic-DJR8_DMQ.js';
+import './semantic-TddhF0y7.js';
 import './replay/types.js';
 import './extraction-judge.js';
 import './lcm/engine.js';
@@ -139,6 +138,8 @@ interface OperationContext {
     readonly service: EngramAccessService;
     readonly authenticatedPrincipal?: string;
     readonly operatorPrincipal?: string;
+    /** Server-resolved connector identity (Phase 1 provenance). Set by the HTTP auth boundary from the matched token's connector; flows to write handlers so frontmatter records which connector submitted the memory. Client-supplied values are always overridden. */
+    readonly sourceConnector?: string;
     readonly hooks?: OperationHooks;
 }
 /**

package/dist/access-boundary.js

@@ -8,9 +8,9 @@ import {
   getOperation,
   listRegisteredOperations,
   normalizeOptionalPath
-} from "./chunk-4GNEDXDI.js";
+} from "./chunk-WULTHJRU.js";
 import "./chunk-D7FOKIY5.js";
-import "./chunk-H2DXDQCQ.js";
+import "./chunk-BT3PTVYZ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-CYWCKFCL.js";
@@ -22,9 +22,9 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-2KK5WNQB.js";
+import "./chunk-DQ42IQSK.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-6MMONPHM.js";
+import "./chunk-W2AHSCKY.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
@@ -41,7 +41,7 @@ import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-3XIY7MDQ.js";
+import "./chunk-O6YI4CVI.js";
 import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
@@ -55,7 +55,7 @@ import "./chunk-EI6V5UXY.js";
 import "./chunk-MTWKDOVO.js";
 import "./chunk-O75CRYGF.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-K5LLP4CY.js";
+import "./chunk-ZGPDSEKG.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
@@ -65,8 +65,8 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-TBBDFYXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-Y7UNNAZD.js";
-import "./chunk-SVOHGUMI.js";
+import "./chunk-7ZYBDQ7V.js";
+import "./chunk-H4FHR4UM.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -77,7 +77,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-JS2HKKOK.js";
+import "./chunk-3AC5UYKI.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/dist/access-cli.js

@@ -1,8 +1,8 @@
 import {
   Orchestrator
-} from "./chunk-FKCRGLRD.js";
+} from "./chunk-T43VKQU3.js";
 import "./chunk-J3XHPFEU.js";
-import "./chunk-23JFRB73.js";
+import "./chunk-JODHPNLN.js";
 import "./chunk-I74SUMNI.js";
 import "./chunk-ILNPU5W5.js";
 import "./chunk-7HYPN2GC.js";
@@ -11,7 +11,7 @@ import "./chunk-666A3MOW.js";
 import "./chunk-HHLLAQGZ.js";
 import "./chunk-UWK5OXUJ.js";
 import "./chunk-KBL3JJR6.js";
-import "./chunk-ABP6QMVM.js";
+import "./chunk-FQ7HAWWC.js";
 import "./chunk-Y4RKAQZ7.js";
 import "./chunk-TPDBFYEG.js";
 import "./chunk-KCYE2MZM.js";
@@ -23,7 +23,7 @@ import "./chunk-VCW74PNH.js";
 import "./chunk-V5OCT34X.js";
 import "./chunk-TECVW3JP.js";
 import "./chunk-RP7YXA67.js";
-import "./chunk-AYZJID4S.js";
+import "./chunk-B5GBWBCZ.js";
 import "./chunk-UI4FVU6T.js";
 import "./chunk-LXOM6IQU.js";
 import "./chunk-S75M5ZRK.js";
@@ -79,12 +79,12 @@ import "./chunk-VEWZZM3H.js";
 import "./chunk-Q6IP2ARR.js";
 import "./chunk-6HEM6HTQ.js";
 import "./chunk-O2EL7EGG.js";
-import "./chunk-CYWA2CXR.js";
-import "./chunk-P454KXD6.js";
-import "./chunk-MC4FJXPA.js";
-import "./chunk-LQHDIS7L.js";
-import "./chunk-7F7Z6MOS.js";
-import "./chunk-JJEJJ7RK.js";
+import "./chunk-FVTLSFWU.js";
+import "./chunk-CJPVWAJF.js";
+import "./chunk-MMACM5G2.js";
+import "./chunk-54BGIBCR.js";
+import "./chunk-H4CKS5B2.js";
+import "./chunk-FXZTL7F7.js";
 import "./chunk-HDDRVXX4.js";
 import "./chunk-PYHOAXTI.js";
 import "./chunk-EEIROWEG.js";
@@ -95,39 +95,39 @@ import "./chunk-OZKVVUJB.js";
 import "./chunk-2DL3OFLD.js";
 import "./chunk-G4IAEX6D.js";
 import "./chunk-765K3SAT.js";
-import "./chunk-HOJZMQ4J.js";
-import "./chunk-2PRQG7PV.js";
+import "./chunk-FGDKJJZS.js";
+import "./chunk-AJVLDJU6.js";
 import "./chunk-KQPJLK3X.js";
 import "./chunk-EEC4PCG5.js";
 import "./chunk-PYIFUBRK.js";
 import "./chunk-D6RIFG4O.js";
-import "./chunk-TLUDFPZL.js";
-import "./chunk-BEM4D2QG.js";
+import "./chunk-CAZ3Z5M6.js";
+import "./chunk-KJIJNLXT.js";
 import "./chunk-LZZNTPLR.js";
 import "./chunk-JCK7V6SN.js";
 import "./chunk-WMWVO45V.js";
 import "./chunk-KJTKLXTH.js";
-import "./chunk-CKITWVWJ.js";
-import "./chunk-OUELRE5E.js";
+import "./chunk-HSSERO3E.js";
+import "./chunk-NOUJNHWG.js";
 import "./chunk-GQL52GQ5.js";
 import "./chunk-2F6NP3NT.js";
 import "./chunk-TERNBNJB.js";
-import "./chunk-SIRPLF54.js";
+import "./chunk-2K3OSLHE.js";
 import "./chunk-DBRYEIGY.js";
-import "./chunk-72WG5QKN.js";
-import "./chunk-RGK27ELN.js";
+import "./chunk-SDAXPXER.js";
+import "./chunk-DEKIXXIG.js";
 import "./chunk-TGQ2NTWH.js";
 import "./chunk-YQB32INI.js";
 import "./chunk-ZRWB5D4H.js";
 import "./chunk-5EZXHU36.js";
-import "./chunk-DANV2HTH.js";
+import "./chunk-GQGDRLDM.js";
 import "./chunk-SFQ6QNL7.js";
 import "./chunk-3T74IZB3.js";
 import "./chunk-33JBK2XP.js";
-import "./chunk-PVUJ6WVV.js";
-import "./chunk-4LV23CHK.js";
-import "./chunk-DS7MM2ES.js";
-import "./chunk-PNLFN2PZ.js";
+import "./chunk-5MH5NF3U.js";
+import "./chunk-VHJARF5R.js";
+import "./chunk-JZKR6ZAV.js";
+import "./chunk-23G3T2Q5.js";
 import "./chunk-KFY3SGN7.js";
 import {
   resolvePluginEntry
@@ -150,8 +150,8 @@ import "./chunk-FZZ2QTJI.js";
 import "./chunk-LMDRGRJ2.js";
 import "./chunk-OD4FM2U7.js";
 import "./chunk-3I4FUAVJ.js";
-import "./chunk-LR5DZ56F.js";
-import "./chunk-JSNVWNGX.js";
+import "./chunk-AXALUFAH.js";
+import "./chunk-KVSVVKHA.js";
 import "./chunk-QLULYKWZ.js";
 import "./chunk-JLNBQWZ2.js";
 import "./chunk-3UXOZBHV.js";
@@ -163,7 +163,7 @@ import "./chunk-YBPYIAA5.js";
 import "./chunk-66SLUXKM.js";
 import "./chunk-P4BC54KI.js";
 import "./chunk-UQ7RN5HK.js";
-import "./chunk-F53UF7CI.js";
+import "./chunk-QLVLW7UD.js";
 import "./chunk-H3FZVNRN.js";
 import "./chunk-PI23H7FV.js";
 import {
@@ -175,7 +175,7 @@ import "./chunk-G6NKALRN.js";
 import "./chunk-OO42R444.js";
 import "./chunk-K6MV3TRQ.js";
 import "./chunk-OADWQ5CR.js";
-import "./chunk-UFUKHGZD.js";
+import "./chunk-EIGE4IMQ.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-RKNJBZ55.js";
@@ -184,13 +184,13 @@ import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-TMSXWOBZ.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-PCLIWBGD.js";
+import "./chunk-N2RP4K5Q.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-5RUE3GHQ.js";
-import "./chunk-XCL57M6Q.js";
+import "./chunk-DPZKMGEP.js";
 import "./chunk-UPSAT4PY.js";
-import "./chunk-LADFWYHY.js";
+import "./chunk-QMC3BI3K.js";
 import "./chunk-HLTAPHZZ.js";
 import "./chunk-YF6FMLBT.js";
 import "./chunk-KQDNAXOM.js";
@@ -200,11 +200,11 @@ import "./chunk-FTYDWKO6.js";
 import "./chunk-T4WDJPEZ.js";
 import {
   getOperation
-} from "./chunk-4GNEDXDI.js";
+} from "./chunk-WULTHJRU.js";
 import "./chunk-D7FOKIY5.js";
 import {
   EngramAccessService
-} from "./chunk-H2DXDQCQ.js";
+} from "./chunk-BT3PTVYZ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-CYWCKFCL.js";
@@ -216,9 +216,9 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-2KK5WNQB.js";
+import "./chunk-DQ42IQSK.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-6MMONPHM.js";
+import "./chunk-W2AHSCKY.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
@@ -237,7 +237,7 @@ import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-3XIY7MDQ.js";
+import "./chunk-O6YI4CVI.js";
 import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
@@ -251,7 +251,7 @@ import "./chunk-EI6V5UXY.js";
 import "./chunk-MTWKDOVO.js";
 import "./chunk-O75CRYGF.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-K5LLP4CY.js";
+import "./chunk-ZGPDSEKG.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
@@ -261,8 +261,8 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-TBBDFYXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-Y7UNNAZD.js";
-import "./chunk-SVOHGUMI.js";
+import "./chunk-7ZYBDQ7V.js";
+import "./chunk-H4FHR4UM.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -273,7 +273,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-JS2HKKOK.js";
+import "./chunk-3AC5UYKI.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/dist/access-http.d.ts

@@ -1,15 +1,14 @@
 import { IncomingMessage, ServerResponse } from 'node:http';
-import { F as EngramAccessService } from './access-service-CXJaql3A.js';
+import { F as EngramAccessService } from './access-service-Bps_9G1t.js';
 import { ResolvedIdentity } from './adapters/types.js';
 import { AdapterRegistry } from './adapters/registry.js';
 import { TokenCapabilities } from './access-token-capabilities.js';
-import './catalog-C9cu67Ig.js';
-import './types-CGgcNWCG.js';
-import './types-gb_SNtjR.js';
+import './catalog-9WanSGtt.js';
+import './types-DDUDgd7T.js';
 import './message-parts/index.js';
-import './orchestrator-CWFrT8AF.js';
+import './orchestrator-B0YrUl2H.js';
 import './briefing.js';
-import './storage-C1maCNbc.js';
+import './storage-DxPDAiU9.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './memory-projection-store.js';
@@ -38,7 +37,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-O5lMZ4LG.js';
+import './semantic-consolidation-BTShF2Fo.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -72,7 +71,7 @@ import './framework-CNDn2164.js';
 import './relevance.js';
 import './negative.js';
 import './session-observer-state.js';
-import './semantic-DJR8_DMQ.js';
+import './semantic-TddhF0y7.js';
 import './replay/types.js';
 import './extraction-judge.js';
 import './lcm/engine.js';
@@ -363,21 +362,44 @@ declare class EngramAccessHttpServer {
      */
     private bearerChallenge;
     private isAuthorized;
+    /**
+     * Per-request cache of the matched token entry (the entry whose token
+     * matched the bearer credential, BEFORE any path-policy check). Pinning
+     * the entry to the first read means authorization, capability
+     * enforcement, and connector provenance all observe the SAME token-store
+     * snapshot — a rotation between the auth check and the write handler can
+     * no longer stamp the wrong connector (PR #1852 race).
+     */
+    private matchedEntryCache;
+    /**
+     * Resolve the matched token entry for this request, caching the result so
+     * every downstream consumer (authorization, capability enforcement,
+     * connector provenance) sees the same snapshot entry (PR #1852).
+     */
+    private resolveMatchedEntry;
+    /**
+     * Find the entry whose token matches the request's bearer credential.
+     * Static operator tokens (`authToken`/`authTokens`) and the string-token
+     * getter carry no capabilities ⇒ unrestricted. Dynamic entry-based tokens
+     * capture connector identity and capabilities. A corrupt or unreadable
+     * token store returns null rather than propagating an error — provenance
+     * must never block an already-authenticated request.
+     */
+    private computeMatchedEntry;
     /**
      * Resolve the presenting token's entry for an authorized request, or null.
-     * Captures the matched entry — including its capabilities record — so the
-     * op/namespace capability enforcement (issue #1837) uses the SAME entry
-     * that validated. Static operator tokens (`authToken`/`authTokens`) and
-     * the string-token getter carry no capabilities ⇒ unrestricted.
+     * Applies the path-policy gate (if configured) on top of the per-request
+     * cached matched entry so the identity that is authorized is the same one
+     * whose connector later stamps frontmatter. Static operator tokens and the
+     * string-token getter carry no capabilities ⇒ unrestricted.
      */
     private resolveAuthorizedEntry;
-    /** Cache for per-request capability resolution (avoids re-resolving). */
-    private capabilityCache;
     /**
      * Resolve the presenting token's capabilities for this request, or
      * undefined when the token is unrestricted (legacy / static operator /
-     * explicit-unrestricted record). Cached per-request. `null` sentinel
-     * distinguishes "resolved as unrestricted" from "not yet resolved".
+     * explicit-unrestricted record). Reads from the per-request cached matched
+     * entry so capabilities come from the same snapshot as authorization and
+     * connector provenance (PR #1852).
      */
     private resolveTokenCapabilities;
     /**
@@ -394,6 +416,15 @@ declare class EngramAccessHttpServer {
      * explicit-unrestricted tokens pass. Throws EngramAccessForbiddenError (→403).
      */
     private requireOperatorToken;
+    /**
+     * Resolve the connector identity for the request's bearer token (Phase 1
+     * provenance). Reuses the per-request cached matched entry so a token
+     * rotation between the auth check and the write handler cannot stamp the
+     * wrong connector (PR #1852 race). Returns `undefined` for operator-
+     * supplied static tokens or when no entry getter is configured — those
+     * writes are operator-initiated.
+     */
+    private resolveConnector;
     private timingSafeStringEqual;
     private encodeSecret;
     private writeResponseStatus;

package/dist/access-http.js

@@ -1,6 +1,6 @@
 import {
   EngramAccessHttpServer
-} from "./chunk-UFUKHGZD.js";
+} from "./chunk-EIGE4IMQ.js";
 import "./chunk-V7IZKJI3.js";
 import "./chunk-SEDEKFYQ.js";
 import "./chunk-RKNJBZ55.js";
@@ -9,13 +9,13 @@ import "./chunk-RSUYKGGZ.js";
 import "./chunk-42NQ7AVG.js";
 import "./chunk-TMSXWOBZ.js";
 import "./chunk-7RXCMVFQ.js";
-import "./chunk-PCLIWBGD.js";
+import "./chunk-N2RP4K5Q.js";
 import "./chunk-IC2TCZJ2.js";
 import "./chunk-D24OXEPB.js";
 import "./chunk-5RUE3GHQ.js";
-import "./chunk-XCL57M6Q.js";
+import "./chunk-DPZKMGEP.js";
 import "./chunk-UPSAT4PY.js";
-import "./chunk-LADFWYHY.js";
+import "./chunk-QMC3BI3K.js";
 import "./chunk-HLTAPHZZ.js";
 import "./chunk-YF6FMLBT.js";
 import "./chunk-KQDNAXOM.js";
@@ -23,9 +23,9 @@ import "./chunk-PRTA6444.js";
 import "./chunk-35NN3ZFA.js";
 import "./chunk-FTYDWKO6.js";
 import "./chunk-T4WDJPEZ.js";
-import "./chunk-4GNEDXDI.js";
+import "./chunk-WULTHJRU.js";
 import "./chunk-D7FOKIY5.js";
-import "./chunk-H2DXDQCQ.js";
+import "./chunk-BT3PTVYZ.js";
 import "./chunk-GDASG7NC.js";
 import "./chunk-GDB4J2H3.js";
 import "./chunk-CYWCKFCL.js";
@@ -37,9 +37,9 @@ import "./chunk-PUBTHW5O.js";
 import "./chunk-S4DDLTPX.js";
 import "./chunk-FF4KLI5W.js";
 import "./chunk-BT7NVCML.js";
-import "./chunk-2KK5WNQB.js";
+import "./chunk-DQ42IQSK.js";
 import "./chunk-SOBJ6NEY.js";
-import "./chunk-6MMONPHM.js";
+import "./chunk-W2AHSCKY.js";
 import "./chunk-H7XKCNR6.js";
 import "./chunk-ICP53SKG.js";
 import "./chunk-AQEJKOKI.js";
@@ -56,7 +56,7 @@ import "./chunk-6SXVCD7W.js";
 import "./chunk-CINZGPSJ.js";
 import "./chunk-CYEPCZN5.js";
 import "./chunk-EGGE52UU.js";
-import "./chunk-3XIY7MDQ.js";
+import "./chunk-O6YI4CVI.js";
 import "./chunk-JI5AVXYO.js";
 import "./chunk-TN7THW5U.js";
 import "./chunk-R5VAVVHP.js";
@@ -70,7 +70,7 @@ import "./chunk-EI6V5UXY.js";
 import "./chunk-MTWKDOVO.js";
 import "./chunk-O75CRYGF.js";
 import "./chunk-QDW3E4RD.js";
-import "./chunk-K5LLP4CY.js";
+import "./chunk-ZGPDSEKG.js";
 import "./chunk-3ONXXHQO.js";
 import "./chunk-ODPLEWB6.js";
 import "./chunk-ZY2MNJR6.js";
@@ -80,8 +80,8 @@ import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-TBBDFYXW.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-Y7UNNAZD.js";
-import "./chunk-SVOHGUMI.js";
+import "./chunk-7ZYBDQ7V.js";
+import "./chunk-H4FHR4UM.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -92,7 +92,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-JS2HKKOK.js";
+import "./chunk-3AC5UYKI.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/dist/access-identity-continuity-surface.d.ts

@@ -1,8 +1,7 @@
-import { O as Orchestrator } from './orchestrator-CWFrT8AF.js';
+import { O as Orchestrator } from './orchestrator-B0YrUl2H.js';
 import './briefing.js';
-import './storage-C1maCNbc.js';
-import './types-CGgcNWCG.js';
-import './types-gb_SNtjR.js';
+import './storage-DxPDAiU9.js';
+import './types-DDUDgd7T.js';
 import './message-parts/index.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
@@ -23,7 +22,7 @@ import './session-integrity.js';
 import './summarizer.js';
 import './orchestration/maintenance.js';
 import './namespaces/search.js';
-import './catalog-C9cu67Ig.js';
+import './catalog-9WanSGtt.js';
 import './recall-state.js';
 import './compounding/engine.js';
 import './shared-context/manager.js';
@@ -33,7 +32,7 @@ import './utility-runtime.js';
 import './tier-routing.js';
 import './lifecycle.js';
 import './orchestration/compression-guideline-coordinator.js';
-import './semantic-consolidation-O5lMZ4LG.js';
+import './semantic-consolidation-BTShF2Fo.js';
 import './connectors/codex-materialize.js';
 import './logger.js';
 import './embedding-fallback.js';
@@ -67,7 +66,7 @@ import './framework-CNDn2164.js';
 import './relevance.js';
 import './negative.js';
 import './session-observer-state.js';
-import './semantic-DJR8_DMQ.js';
+import './semantic-TddhF0y7.js';
 import './replay/types.js';
 import './extraction-judge.js';
 import './lcm/engine.js';