neotoma 0.16.0 → 0.17.0

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AA2CpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA4CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AA4nB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AAq6CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAu5FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;qBAu1BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAlBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAvPV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAjVX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BAqUb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BA+JlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GAwW3B;AAk6GD,wBAAsB,eAAe;;;eAmOpC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAsC9B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAarC,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,4BAA4B,CAAC;AA4BpC,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,4BAA4B,CAAC;AA6CpC,OAAO,EAiCL,KAAK,wBAAwB,EAE9B,MAAM,4BAA4B,CAAC;AA4CpC,6FAA6F;AAC7F,wBAAgB,qBAAqB,IAAI,sBAAsB,GAAG,IAAI,CAErE;AAED,eAAO,MAAM,GAAG,6CAAY,CAAC;AAmqB7B,kFAAkF;AAClF,eAAO,MAAM,4BAA4B,QAAS,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAoBD,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,OAAQ,CAAC;AAE9C;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMlE;AAID;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GAC7F,IAAI,CA4IN;AAuBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CA+B1F;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CA2B5D;AA4PD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CA2BhD;AA47CD,KAAK,aAAa,GAAG;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,aAAa,CAAC;IACvB,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,KAAK,cAAc,GAAG,aAAa,GAAG,cAAc,CAAC;AA2CrD,4GAA4G;AAC5G,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAAG,OAAO,CAqBjG;AAED,oHAAoH;AACpH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC,GAC5C,OAAO,CAWT;AAED,mGAAmG;AACnG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,MAAM,CAanE;AA2FD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,SAAS,EAAE,cAAc,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoCxB;AAu5FD,KAAK,oBAAoB,GAAG;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,CAAC;AAuDF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,4BAA4B,EAAE,iBAAiB,CAAC;IAC3E,kFAAkF;IAClF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACvC,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;;;;;;;;;;;;;;qBA84BgB,MAAM;eACZ,MAAM;2BACM,MAAM;;;;;;cAlBnB,MAAM;iBACH,MAAM;2BACI,MAAM;qBACZ,MAAM;mBACR,MAAM;;;cA/BX,MAAM;gBACJ,MAAM;2BACK,MAAM;qBACZ,MAAM;mBACR,MAAM;wBACD,MAAM;uBACP,MAAM;;;;;mBAvPV,MAAM;qBACJ,MAAM;wBACH,MAAM,GAAG,IAAI;2BACV,MAAM;;wBAET,MAAM;uBACP,MAAM,EAAE;wBACP,MAAM;uBACP,MAAM;;kBAxYX,MAAM;oBACJ,MAAM;yBACD,MAAM;4BACH,MAAM;2BACP,MAAM;;;kBAQf,MAAM;yBACC,MAAM;iCACE,MAAM;sCACD,MAAM;;+BA4Xb,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;;;2BA+JlC,MAAM;0BACP,MAAM;0BACN,MAAM;;;;;;;;GAkZ3B;AAs7GD,wBAAsB,eAAe;;;eAmOpC"}

package/dist/actions.js

@@ -42,7 +42,9 @@ import { OAuthError } from "./services/mcp_oauth_errors.js";
 import { ensureLocalDevUser, ensureLocalSandboxUser, ensureSandboxAauthUser, ensureSandboxPublicUser, LOCAL_DEV_USER_ID, SANDBOX_PUBLIC_USER_ID, } from "./services/local_auth.js";
 import { buildSandboxBootBannerLines, isSandboxMode, resolveForceMode, resolveRefusePolicy, resolveSandboxMode, sandboxDestructiveGuard, sandboxHeaderMiddleware, } from "./services/sandbox_mode.js";
 import { createSandboxSession, redeemOneTimeCode, resolveSessionFromRequest, revokeSession, purgeSessionUserData, sweepExpiredSessions, SESSION_COOKIE_NAME, } from "./services/sandbox/sessions.js";
-import { buildEndpointsMap, buildLandingContext, buildRootLandingHtml, buildRootLandingJson, buildRootLandingMarkdown, buildRobotsTxt, readGitSha, readNeotomaConfigEnvironment, readPackageVersion, resolveLandingMode, wantsHtml as acceptWantsHtml, wantsMarkdown as acceptWantsMarkdown, } from "./services/root_landing/index.js";
+import { seedForSession } from "./services/sandbox/seeder.js";
+import { getSandboxPack } from "./services/sandbox/pack_registry.js";
+import { buildEndpointsMap, buildLandingContext, buildRootLandingJson, buildRootLandingMarkdown, buildRobotsTxt, readGitSha, readNeotomaConfigEnvironment, readPackageVersion, resolveLandingMode, wantsHtml as acceptWantsHtml, wantsMarkdown as acceptWantsMarkdown, } from "./services/root_landing/index.js";
 import { mountDocsRoutes } from "./services/docs/index.js";
 import { installInspectorLegacyRedirect, installInspectorRootStaticAssets, installInspectorSpaFallback, installInspectorSpaShellEarly, resolveBundledInspectorDir, } from "./services/inspector_mount.js";
 import { getSandboxTermsResponse } from "./services/sandbox/terms.js";
@@ -178,10 +180,34 @@ if (isSandboxMode()) {
         keyGenerator: (req) => `ip:${ipKeyGenerator(req.ip || "")}`,
         validate: { trustProxy: false },
     });
-    app.post("/sandbox/session/new", sessionRateLimit, (req, res) => {
+    const createAndSeedSession = async (packId) => {
+        const session = createSandboxSession(packId);
+        const pack = getSandboxPack(session.packId);
+        // Packs with seedPolicy "none" (e.g. the empty pack) legitimately seed
+        // nothing — that is "skipped", not a failure.
+        if (!pack || pack.seedPolicy === "none" || !pack.manifestPath) {
+            return { session, seedStatus: "skipped" };
+        }
+        try {
+            const baseUrl = process.env.NEOTOMA_SANDBOX_BASE_URL?.trim() ||
+                `http://127.0.0.1:${process.env.HTTP_PORT?.trim() || "3180"}`;
+            const seeded = await seedForSession({
+                packId: session.packId,
+                baseUrl,
+                bearer: session.bearerToken,
+                logger: (msg) => logger.info(`[Sandbox][seed] ${msg}`),
+            });
+            return { session, seedStatus: seeded ? "seeded" : "failed" };
+        }
+        catch (err) {
+            logger.error(`[Sandbox] seeding failed for session ${session.userId} (pack ${session.packId}): ${err.message}`);
+            return { session, seedStatus: "failed" };
+        }
+    };
+    app.post("/sandbox/session/new", sessionRateLimit, async (req, res) => {
         try {
             const packId = typeof req.body?.pack_id === "string" ? req.body.pack_id : "generic";
-            const session = createSandboxSession(packId);
+            const { session, seedStatus } = await createAndSeedSession(packId);
             res.cookie(SESSION_COOKIE_NAME, session.bearerToken, {
                 httpOnly: true,
                 sameSite: "lax",
@@ -192,6 +218,7 @@ if (isSandboxMode()) {
                 one_time_code: session.oneTimeCode,
                 expires_at: session.expiresAt,
                 pack_id: session.packId,
+                seed_status: seedStatus,
             });
         }
         catch (err) {
@@ -248,7 +275,7 @@ if (isSandboxMode()) {
             expires_at: session.expiresAt,
         });
     });
-    app.post("/sandbox/session/reset", (req, res) => {
+    app.post("/sandbox/session/reset", async (req, res) => {
         const session = resolveSessionFromRequest(req);
         if (!session) {
             res.status(401).json({ error_code: "NO_SESSION", message: "No active sandbox session" });
@@ -256,7 +283,7 @@ if (isSandboxMode()) {
         }
         const packId = typeof req.body?.pack_id === "string" ? req.body.pack_id : undefined;
         purgeSessionUserData(session.userId);
-        const newSession = createSandboxSession(packId ?? session.packId);
+        const { session: newSession, seedStatus } = await createAndSeedSession(packId ?? session.packId);
         res.cookie(SESSION_COOKIE_NAME, newSession.bearerToken, {
             httpOnly: true,
             sameSite: "lax",
@@ -267,6 +294,7 @@ if (isSandboxMode()) {
             user_id: newSession.userId,
             pack_id: newSession.packId,
             expires_at: newSession.expiresAt,
+            seed_status: seedStatus,
         });
     });
     app.delete("/sandbox/session", (req, res) => {
@@ -411,15 +439,13 @@ app.get("/", (req, res, next) => {
     try {
         const ctx = buildLandingContext(req);
         res.setHeader("Cache-Control", "public, max-age=60");
-        // For HTML requests, serve the server-rendered landing page only in
-        // hosted_sandbox mode (public funnel).  In all other modes (local, personal,
-        // prod) the Inspector SPA is the primary UI: fall through to the SPA
-        // fallback handler registered by installInspectorSpaFallback so the
-        // Inspector's HomePage loads instead.
+        // For HTML requests the Inspector SPA is the primary UI in EVERY mode,
+        // hosted_sandbox included: fall through to the SPA fallback handler
+        // (installInspectorSpaFallback) so the Inspector's HomePage loads at root.
+        // In sandbox the HomePage renders the pack picker (SandboxPackPicker) that
+        // previously lived on this server-rendered landing page. Agents/curl still
+        // get the structured JSON/Markdown payload below.
         if (acceptWantsHtml(req.headers.accept)) {
-            if (ctx.hostedSandbox) {
-                return res.type("html").send(buildRootLandingHtml(ctx));
-            }
             return next();
         }
         // JSON and Markdown consumers (agents, curl) always get the structured
@@ -1540,6 +1566,12 @@ app.all("/mcp", async (req, res) => {
         const aauthContext = getAAuthContextFromRequest(req);
         if (serverInstance) {
             serverInstance.setSessionAgentIdentity(aauthContext);
+            // Thread the admission (grant match) so the MCP initialize auth
+            // resolution and the per-tool capability gate can read it from the
+            // session. The transport runs inside a nested runWithRequestContext
+            // that does not re-carry the ALS admission, so the session field is the
+            // reliable channel. `aauthAdmissionForRequest` is resolved above.
+            serverInstance.setSessionAdmission(aauthAdmissionForRequest);
         }
         // Build the provenance attribution to propagate via AsyncLocalStorage so
         // write-path services (observations, relationships, sources, …) stamp
@@ -1576,8 +1608,24 @@ app.all("/mcp", async (req, res) => {
             attachMcpSseKeepalive(req, res);
         }
         // Handle request with the transport inside the attribution context.
+        // Include aauthAdmission in the outer context so the per-async-chain ALS
+        // isolation carries the correct per-request admission into the transport
+        // handler and all nested runWithRequestContext scopes (initialize,
+        // callTool). This replaces the previous single-field
+        // serverInstance.setSessionAdmission() pattern, which had a cross-request
+        // race: concurrent requests from different grant owners shared one mutable
+        // field on the NeotomaServer instance (one per MCP session), so request B's
+        // setSessionAdmission() could overwrite the field before request A read it,
+        // causing A to authenticate / dispatch as B's user_id. The ALS is
+        // per-async-chain: each HTTP POST to /mcp runs in its own chain and sees
+        // only its own aauthAdmission value. `aauthAdmissionForRequest` was already
+        // resolved above (from the aauthAdmission() middleware on req).
         const attributionDecision = getAttributionDecisionFromRequest(req);
-        await runWithRequestContext({ agentIdentity: fallbackIdentity, attributionDecision }, () => transport.handleRequest(req, res, req.body));
+        await runWithRequestContext({
+            agentIdentity: fallbackIdentity,
+            attributionDecision,
+            aauthAdmission: aauthAdmissionForRequest,
+        }, () => transport.handleRequest(req, res, req.body));
     }
     catch (error) {
         logger.error("[MCP HTTP] Request error:", error);
@@ -5537,6 +5585,46 @@ export async function storeStructuredForApi(params) {
         aggregate.issues = issues;
         throw aggregate;
     }
+    // Write-time value constraint enforcement (#1756).
+    // Run before any observation writes so a "reject" policy aborts the whole
+    // batch cleanly (mirrors the ERR_STORE_RESOLUTION_FAILED aggregate pattern).
+    // Constraint violations in "warn" mode are deferred to the schemaStoreWarnings
+    // pass below where the schema is re-loaded alongside the other warnings.
+    {
+        const { schemaRegistry: cvSchemaRegistry } = await import("./services/schema_registry.js");
+        const { collectConstraintViolations, ConstraintViolationError } = await import("./services/field_constraints.js");
+        const constraintIssues = [];
+        for (const r of resolved) {
+            let cvSchemaEntry;
+            try {
+                cvSchemaEntry = await cvSchemaRegistry.loadActiveSchema(r.entity_type, userId);
+            }
+            catch {
+                // Best-effort; never block store on registry IO failure.
+            }
+            if (!cvSchemaEntry?.schema_definition?.fields)
+                continue;
+            const cvPolicy = cvSchemaEntry.schema_definition.constraint_violation_policy ?? "reject";
+            const violations = collectConstraintViolations(r.fields, cvSchemaEntry.schema_definition.fields);
+            if (violations.length === 0)
+                continue;
+            if (cvPolicy === "reject") {
+                const cvErr = new ConstraintViolationError(violations);
+                constraintIssues.push({
+                    observation_index: r.observation_index,
+                    entity_type: r.entity_type,
+                    message: cvErr.message,
+                });
+            }
+            // "warn" mode violations are surfaced in the schemaStoreWarnings pass below.
+        }
+        if (constraintIssues.length > 0) {
+            const cvAggregate = new Error(`Structured store refused: ${constraintIssues.length} observation(s) failed constraint validation.`);
+            cvAggregate.code = "ERR_CONSTRAINT_VIOLATION";
+            cvAggregate.issues = constraintIssues;
+            throw cvAggregate;
+        }
+    }
     const createdEntities = [];
     for (const r of resolved) {
         let observation_id = null;
@@ -5872,6 +5960,45 @@ export async function storeStructuredForApi(params) {
                     anyUnknownFieldSchemaHasIdentityConfig = true;
                 }
             }
+            // Write-time constraint violations in "warn" mode (#1756).
+            // "reject" violations were already handled before the observation write
+            // loop; only "warn" policies reach this point.
+            if (schemaDef?.fields) {
+                const cvPolicy = schemaDef.constraint_violation_policy ?? "reject";
+                if (cvPolicy === "warn") {
+                    const { collectConstraintViolations: _cvCollect } = await import("./services/field_constraints.js");
+                    const warnViolations = _cvCollect(r.fields, schemaDef.fields);
+                    for (const v of warnViolations) {
+                        schemaStoreWarnings.push({
+                            code: "CONSTRAINT_VIOLATION",
+                            message: `${r.entity_type} field "${v.field}" failed constraint "${v.constraint}": ${v.message}`,
+                            observation_index: r.observation_index,
+                            entity_type: r.entity_type,
+                            entity_id: r.entity_id,
+                        });
+                    }
+                }
+            }
+            // Issue #1755: SOURCE_PRIORITY_IGNORED — non-blocking advisory warning
+            // when the caller sets a non-default source_priority but none of the
+            // fields being written will actually honour it. This happens when every
+            // field's merge policy is `last_write` (the auto-discovered-schema
+            // default) or `merge_array` — both ignore source_priority entirely.
+            // The warning is emitted regardless of whether the entity has a
+            // registered schema (no schema → all fields effectively last_write).
+            {
+                const { buildSourcePriorityIgnoredWarning } = await import("./services/source_priority_warning.js");
+                const spWarn = buildSourcePriorityIgnoredWarning({
+                    sourcePriority,
+                    writtenFields: r.fields,
+                    mergePolicies: schemaEntry?.reducer_config?.merge_policies,
+                    observationIndex: r.observation_index,
+                    entityType: r.entity_type,
+                    entityId: r.entity_id,
+                });
+                if (spWarn)
+                    schemaStoreWarnings.push(spWarn);
+            }
         }
     }
     const unknownFieldNames = Array.from(unknownFieldNamesSet).sort();
@@ -6160,6 +6287,19 @@ async function handleStorePost(req, res) {
                 },
             });
         }
+        if (error && typeof error === "object" && errCode === "ERR_CONSTRAINT_VIOLATION") {
+            const err = error;
+            logWarn("ConstraintViolationError:store", req, {
+                issue_count: err.issues?.length ?? 0,
+            });
+            return res.status(400).json({
+                error: {
+                    code: "ERR_CONSTRAINT_VIOLATION",
+                    message: err.message,
+                    issues: err.issues ?? [],
+                },
+            });
+        }
         if (error && typeof error === "object" && errCode === "ERR_FLAT_PACKED_ROWS") {
             const err = error;
             logWarn("FlatPackedRowsError:store", req, {