@remnic/core 9.7.1 → 9.7.3

package/dist/utility-runtime.d.ts

@@ -1,5 +1,5 @@
 import { TierRoutingPolicy } from './tier-routing.js';
-import './types-DgIkyAsK.js';
+import './types-DpxqC8dI.js';
 import './message-parts/index.js';
 import './lifecycle.js';
 

package/dist/verified-recall.js

@@ -1,10 +1,10 @@
 import {
   compareVerifiedEpisodeResults,
   searchVerifiedEpisodes
-} from "./chunk-FMECZFUT.js";
+} from "./chunk-R2SJDIPO.js";
 import "./chunk-2A3OXAP2.js";
 import "./chunk-ZBJMUXZH.js";
-import "./chunk-QRYNEVHP.js";
+import "./chunk-KTOH7EJE.js";
 import "./chunk-B3ABVQ36.js";
 import "./chunk-L2B3EE7B.js";
 import "./chunk-5UZXUTVO.js";
@@ -15,7 +15,7 @@ import "./chunk-J6A3CX5N.js";
 import "./chunk-4KJLYTLS.js";
 import "./chunk-SVOZFLIQ.js";
 import "./chunk-LTJAMRGI.js";
-import "./chunk-QMUERLZK.js";
+import "./chunk-JO5AT6QT.js";
 import "./chunk-RHOZ5LLO.js";
 import "./chunk-RL6NEVXT.js";
 import "./chunk-AWJ2FHCF.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.7.1",
+  "version": "9.7.3",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3000,7 +3000,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.7.1"
+    "@remnic/coding-graph": "^9.7.3"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/access-http.ts

@@ -86,6 +86,13 @@ export interface EngramAccessHttpServerOptions {
   tokenPathPolicy?: (connector: string, pathname: string | undefined) => boolean;
   principal?: string;
   maxBodyBytes?: number;
+  /**
+   * Max non-replayed write requests per rolling window before 429
+   * `write_rate_limited` (issue #1937). Positive integer; defaults to 30.
+   */
+  writeRateLimitMaxRequests?: number;
+  /** Rolling window for the write rate limit, in ms. Positive integer; defaults to 60000. */
+  writeRateLimitWindowMs?: number;
   adminConsoleEnabled?: boolean;
   adminConsolePublicDir?: string;
   /** Inject the primary auth token into the admin console shell for trusted launch surfaces. */
@@ -206,6 +213,8 @@ function resolveDefaultAdminConsolePublicDir(): string {
 const defaultAdminConsolePublicDir = resolveDefaultAdminConsolePublicDir();
 const correlationIdStore = new AsyncLocalStorage<string>();
 
+// Defaults for the write rate limit; overridable per instance via
+// `writeRateLimitWindowMs` / `writeRateLimitMaxRequests` (issue #1937).
 const WRITE_RATE_LIMIT_WINDOW_MS = 60_000;
 const WRITE_RATE_LIMIT_MAX_REQUESTS = 30;
 const TRUST_ZONE_RECORD_KINDS = ["memory", "artifact", "state", "trajectory", "external"] as const;
@@ -370,6 +379,8 @@ export class EngramAccessHttpServer {
     ctx: { authorized: boolean },
   ) => Promise<boolean>;
   private readonly writeRequestTimestamps: number[] = [];
+  private readonly writeRateLimitMaxRequests: number;
+  private readonly writeRateLimitWindowMs: number;
   private readonly mcpServer: EngramMcpServer;
   private server: Server | null = null;
   private boundPort = 0;
@@ -406,6 +417,20 @@ export class EngramAccessHttpServer {
     this.maxBodyBytes = Number.isFinite(options.maxBodyBytes)
       ? Math.max(1, Math.floor(options.maxBodyBytes ?? 131072))
       : 131072;
+    // Defensive inline validation (config parsers reject invalid values
+    // loudly upstream; this only guards direct programmatic constructions).
+    this.writeRateLimitMaxRequests =
+      typeof options.writeRateLimitMaxRequests === "number" &&
+      Number.isInteger(options.writeRateLimitMaxRequests) &&
+      options.writeRateLimitMaxRequests >= 1
+        ? options.writeRateLimitMaxRequests
+        : WRITE_RATE_LIMIT_MAX_REQUESTS;
+    this.writeRateLimitWindowMs =
+      typeof options.writeRateLimitWindowMs === "number" &&
+      Number.isInteger(options.writeRateLimitWindowMs) &&
+      options.writeRateLimitWindowMs >= 1
+        ? options.writeRateLimitWindowMs
+        : WRITE_RATE_LIMIT_WINDOW_MS;
     this.adminConsoleEnabled = options.adminConsoleEnabled !== false;
     this.adminConsolePublicDir = options.adminConsolePublicDir ?? defaultAdminConsolePublicDir;
     this.adminConsolePrefillToken = options.adminConsolePrefillToken === true ? this.authToken : undefined;
@@ -3674,11 +3699,11 @@ export class EngramAccessHttpServer {
     const now = Date.now();
     while (
       this.writeRequestTimestamps.length > 0 &&
-      now - (this.writeRequestTimestamps[0] ?? 0) > WRITE_RATE_LIMIT_WINDOW_MS
+      now - (this.writeRequestTimestamps[0] ?? 0) > this.writeRateLimitWindowMs
     ) {
       this.writeRequestTimestamps.shift();
     }
-    if (this.writeRequestTimestamps.length >= WRITE_RATE_LIMIT_MAX_REQUESTS) {
+    if (this.writeRequestTimestamps.length >= this.writeRateLimitMaxRequests) {
       throw new HttpError(429, "write_rate_limited", "write_rate_limited");
     }
   }

package/src/cli.ts

@@ -747,6 +747,8 @@ export interface AccessHttpServeCliCommandOptions {
   authToken?: string;
   principal?: string;
   maxBodyBytes?: number;
+  writeRateLimitMaxRequests?: number;
+  writeRateLimitWindowMs?: number;
   trustPrincipalHeader?: boolean;
   citationsEnabled?: boolean;
   citationsAutoDetect?: boolean;
@@ -758,6 +760,8 @@ export interface AccessHttpServeCliCommandOptions {
     authToken?: string;
     principal?: string;
     maxBodyBytes?: number;
+    writeRateLimitMaxRequests?: number;
+    writeRateLimitWindowMs?: number;
     trustPrincipalHeader?: boolean;
     citationsEnabled?: boolean;
     citationsAutoDetect?: boolean;
@@ -2749,6 +2753,8 @@ export async function runAccessHttpServeCliCommand(
         authToken: input.authToken,
         principal: input.principal,
         maxBodyBytes: input.maxBodyBytes,
+        writeRateLimitMaxRequests: input.writeRateLimitMaxRequests,
+        writeRateLimitWindowMs: input.writeRateLimitWindowMs,
         trustPrincipalHeader: input.trustPrincipalHeader,
         citationsEnabled: input.citationsEnabled,
         citationsAutoDetect: input.citationsAutoDetect,
@@ -6821,6 +6827,8 @@ export function registerCli(
             authToken: cliTokenOverride ?? resolvedConfigAuthToken,
             principal: resolveAccessPrincipalOverride(options.principal, orchestrator.config.agentAccessHttp.principal),
             maxBodyBytes: Number.isFinite(maxBodyBytesRaw) ? maxBodyBytesRaw : 131072,
+            writeRateLimitMaxRequests: orchestrator.config.agentAccessHttp.writeRateLimitMaxRequests,
+            writeRateLimitWindowMs: orchestrator.config.agentAccessHttp.writeRateLimitWindowMs,
             trustPrincipalHeader: options.trustPrincipalHeader === true,
             citationsEnabled: resolveConversationContextCapabilities(orchestrator.config).citations,
             citationsAutoDetect: orchestrator.config.citationsAutoDetect,

package/src/config.ts

@@ -1515,6 +1515,16 @@ export function parseConfig(
       typeof rawAgentAccessHttp?.maxBodyBytes === "number"
         ? Math.max(1, Math.floor(rawAgentAccessHttp.maxBodyBytes))
         : 131072,
+    writeRateLimitMaxRequests: resolvePositiveIntegerConfig(
+      rawAgentAccessHttp?.writeRateLimitMaxRequests,
+      30,
+      "agentAccessHttp.writeRateLimitMaxRequests",
+    ),
+    writeRateLimitWindowMs: resolvePositiveIntegerConfig(
+      rawAgentAccessHttp?.writeRateLimitWindowMs,
+      60_000,
+      "agentAccessHttp.writeRateLimitWindowMs",
+    ),
   };
 
   let baseUrl: string | undefined;

package/src/types.ts

@@ -255,6 +255,10 @@ export interface AgentAccessHttpConfig {
   authToken?: AgentAccessAuthToken;
   principal?: string;
   maxBodyBytes: number;
+  /** Max write requests per rolling window before 429 write_rate_limited (issue #1937). */
+  writeRateLimitMaxRequests: number;
+  /** Rolling window for the write rate limit, in ms (issue #1937). */
+  writeRateLimitWindowMs: number;
 }
 
 export interface DreamingConfig {