@remnic/core 9.7.9 → 9.7.11

package/dist/{chunk-EIKBKQ6L.js → chunk-QHT4W3RU.js}

@@ -13,7 +13,10 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-SKXBOZDF.js";
+} from "./chunk-GHVJASQ4.js";
+import {
+  RelayMissionStoreError
+} from "./chunk-7XRUYC6G.js";
 import {
   validateRequest
 } from "./chunk-2MR3MFQB.js";
@@ -28,7 +31,7 @@ import {
 } from "./chunk-35NN3ZFA.js";
 import {
   getOperation
-} from "./chunk-POUD5BLV.js";
+} from "./chunk-6LM6PPDX.js";
 import {
   assertOperationAllowed,
   enforceNamespaceAllowList,
@@ -38,7 +41,7 @@ import {
 import {
   CorrectionContractError,
   EngramAccessInputError
-} from "./chunk-MLT5EG6K.js";
+} from "./chunk-3OQ4IZJN.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
@@ -374,6 +377,20 @@ function decodePeerIdSegment(raw) {
     throw new EngramAccessInputError("peerId path segment is not valid percent-encoded input");
   }
 }
+function decodeRelayMissionIdSegment(raw) {
+  try {
+    return decodeURIComponent(raw);
+  } catch {
+    throw new EngramAccessInputError(
+      "missionId path segment is not valid percent-encoded input"
+    );
+  }
+}
+function rejectBlankRelayNamespace(value) {
+  if (value !== void 0 && value !== null && value.trim().length === 0) {
+    throw new EngramAccessInputError("Relay namespace must not be blank when provided");
+  }
+}
 function codingContextFromProjectTag(projectTag) {
   const projectId = projectTagProjectId(projectTag);
   return {
@@ -403,7 +420,7 @@ var EngramAccessHttpServer = class {
   readiness;
   resourceMetadataUrl;
   externalRequestHandler;
-  writeRequestTimestamps = [];
+  writeRequestSlots = [];
   writeRateLimitMaxRequests;
   writeRateLimitWindowMs;
   mcpServer;
@@ -504,6 +521,14 @@ var EngramAccessHttpServer = class {
             this.respondJson(res, 400, { error: err.message, code: "correction_contract_error" });
             return;
           }
+          if (err instanceof RelayMissionStoreError) {
+            const status = err.code === "idempotency_conflict" ? 409 : err.code === "limit_exceeded" ? 413 : err.code === "lock_unavailable" ? 503 : 500;
+            this.respondJson(res, status, {
+              error: status >= 500 ? "relay_backend_unavailable" : err.message,
+              code: `relay_${err.code}`
+            });
+            return;
+          }
           if (res.headersSent) {
             res.destroy(err);
             return;
@@ -1358,6 +1383,87 @@ var EngramAccessHttpServer = class {
       this.respondJson(res, 200, await this.service.lcmStatus());
       return;
     }
+    const relayEventMatch = /^\/engram\/v1\/relay\/missions\/([^/]+)\/events$/.exec(pathname);
+    if (req.method === "POST" && relayEventMatch) {
+      const missionId = decodeRelayMissionIdSegment(relayEventMatch[1] ?? "");
+      const body = await this.readJsonBody(req);
+      const unexpectedFields = Object.keys(body).filter(
+        (key) => key !== "namespace" && key !== "event"
+      );
+      if (unexpectedFields.length > 0) {
+        throw new EngramAccessInputError(
+          `Relay append body contains unexpected field(s): ${unexpectedFields.sort().join(", ")}`
+        );
+      }
+      if (!Object.prototype.hasOwnProperty.call(body, "event")) {
+        throw new EngramAccessInputError("Relay append body must contain an event object");
+      }
+      if (Object.prototype.hasOwnProperty.call(body, "namespace") && body.namespace !== void 0 && body.namespace !== null && typeof body.namespace !== "string") {
+        throw new EngramAccessInputError("namespace must be a string when provided");
+      }
+      rejectBlankRelayNamespace(
+        typeof body.namespace === "string" ? body.namespace : void 0
+      );
+      const namespace = this.resolveNamespace(
+        req,
+        typeof body.namespace === "string" ? body.namespace : void 0
+      );
+      const op = getOperation("relay_mission_append");
+      if (!op) {
+        throw new Error("access-boundary: operation not registered: relay_mission_append");
+      }
+      let releaseWriteQuota;
+      try {
+        const output = await op.run(
+          { missionId, namespace, event: body.event },
+          {
+            service: this.service,
+            authenticatedPrincipal: this.resolveRequestPrincipal(req),
+            hooks: {
+              enforceWriteQuota: () => {
+                releaseWriteQuota ??= this.reserveWriteRateLimitSlot();
+              }
+            }
+          }
+        );
+        if (output.result.appended) {
+          releaseWriteQuota = void 0;
+        }
+        this.respondJson(res, output.result.appended ? 201 : 200, output.result);
+      } finally {
+        releaseWriteQuota?.();
+      }
+      return;
+    }
+    const relayMissionMatch = /^\/engram\/v1\/relay\/missions\/([^/]+)$/.exec(pathname);
+    if (req.method === "GET" && relayMissionMatch) {
+      const missionId = decodeRelayMissionIdSegment(relayMissionMatch[1] ?? "");
+      rejectBlankRelayNamespace(parsed.searchParams.get("namespace"));
+      const namespace = this.resolveNamespace(
+        req,
+        parsed.searchParams.get("namespace") ?? void 0
+      );
+      const op = getOperation("relay_mission_read");
+      if (!op) {
+        throw new Error("access-boundary: operation not registered: relay_mission_read");
+      }
+      const output = await op.run(
+        {
+          missionId,
+          namespace,
+          since: parsed.searchParams.get("since") ?? void 0,
+          until: parsed.searchParams.get("until") ?? void 0,
+          limit: parsed.searchParams.get("limit") ?? void 0
+        },
+        {
+          service: this.service,
+          authenticatedPrincipal: this.resolveRequestPrincipal(req)
+        }
+      );
+      res.setHeader("cache-control", "no-store");
+      this.respondJson(res, 200, output.result);
+      return;
+    }
     if (req.method === "POST" && pathname === "/engram/v1/memories") {
       const body = await this.readValidatedBody(req, "memoryStore");
       const envelope = {
@@ -2917,15 +3023,27 @@ var EngramAccessHttpServer = class {
   }
   ensureWriteRateLimitAvailable() {
     const now = Date.now();
-    while (this.writeRequestTimestamps.length > 0 && now - (this.writeRequestTimestamps[0] ?? 0) > this.writeRateLimitWindowMs) {
-      this.writeRequestTimestamps.shift();
+    while (this.writeRequestSlots.length > 0 && now - (this.writeRequestSlots[0]?.recordedAt ?? 0) > this.writeRateLimitWindowMs) {
+      this.writeRequestSlots.shift();
     }
-    if (this.writeRequestTimestamps.length >= this.writeRateLimitMaxRequests) {
+    if (this.writeRequestSlots.length >= this.writeRateLimitMaxRequests) {
       throw new HttpError(429, "write_rate_limited", "write_rate_limited");
     }
   }
   recordWriteRateLimitHit() {
-    this.writeRequestTimestamps.push(Date.now());
+    this.writeRequestSlots.push({ recordedAt: Date.now() });
+  }
+  reserveWriteRateLimitSlot() {
+    this.ensureWriteRateLimitAvailable();
+    const slot = { recordedAt: Date.now() };
+    this.writeRequestSlots.push(slot);
+    let active = true;
+    return () => {
+      if (!active) return;
+      active = false;
+      const index = this.writeRequestSlots.indexOf(slot);
+      if (index >= 0) this.writeRequestSlots.splice(index, 1);
+    };
   }
   shouldCountWriteRateLimit(response) {
     return response.dryRun !== true && response.idempotencyReplay !== true;
@@ -2972,4 +3090,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-EIKBKQ6L.js.map
+//# sourceMappingURL=chunk-QHT4W3RU.js.map