@mulmoclaude/core 0.1.0

package/dist/file-change/index.js

@@ -0,0 +1,66 @@
+import path from "node:path";
+import { stat } from "node:fs/promises";
+//#region src/file-change/index.ts
+var config = null;
+/** Wire the publisher to a host. Call once at startup, before any write route. */
+function configureFileChangePublisher(cfg) {
+	config = cfg;
+}
+/** Clear the binding — test-only. */
+function resetFileChangePublisher() {
+	config = null;
+}
+/** The plugin-scoped live-refresh channel a View subscribes to. */
+function pluginFileChannel(scope, posixPath) {
+	return `plugin:${scope}:file:${posixPath}`;
+}
+/** Publish a file-change for a workspace-relative path: the primary channel (if any)
+*  + every matching plugin scope, with the post-write mtime. No-op until configured. */
+async function publishFileChange(relativePath) {
+	const cfg = config;
+	if (!cfg) return;
+	const root = path.resolve(cfg.workspaceRoot) + path.sep;
+	const absPath = path.join(root, relativePath);
+	if (!absPath.startsWith(root)) {
+		cfg.warn?.("ignoring file-change for path outside workspace", { path: relativePath });
+		return;
+	}
+	let mtimeMs;
+	try {
+		({mtimeMs} = await stat(absPath));
+	} catch (err) {
+		cfg.warn?.("stat failed; falling back to Date.now()", {
+			path: relativePath,
+			error: errMsg(err)
+		});
+		mtimeMs = Date.now();
+	}
+	const posixPath = cfg.toPosix(relativePath);
+	const payload = {
+		path: posixPath,
+		mtimeMs
+	};
+	if (cfg.primaryChannel) safePublish(cfg, cfg.primaryChannel(posixPath), payload, "primary publish failed");
+	for (const { scope, matches } of cfg.pluginScopes ?? []) {
+		if (!matches(posixPath)) continue;
+		safePublish(cfg, pluginFileChannel(scope, posixPath), payload, `${scope} plugin forward failed`);
+	}
+	cfg.onPublished?.(posixPath, payload);
+}
+function safePublish(cfg, channel, payload, failMsg) {
+	try {
+		cfg.publish(channel, payload);
+	} catch (err) {
+		cfg.warn?.(`${failMsg}; subscribers will miss this event`, {
+			channel,
+			error: errMsg(err)
+		});
+	}
+}
+function errMsg(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+export { configureFileChangePublisher, pluginFileChannel, publishFileChange, resetFileChangePublisher };
+
+//# sourceMappingURL=index.js.map

package/dist/file-change/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/file-change/index.ts"],"sourcesContent":["// @mulmoclaude/core/file-change — shared \"this workspace file changed\"\n// broadcaster. A host write route calls `publishFileChange(relPath)` after a\n// successful write; subscribed UI tabs refetch. Extracted so MulmoClaude and\n// MulmoTerminal forward to the SAME plugin-scoped channels (the live-refresh\n// contract the markdown/html Views subscribe to) without duplicating the logic.\n//\n// Everything host-specific is INJECTED via `configureFileChangePublisher` (the\n// pubsub, the workspace root, the path→posix normaliser, the host's own primary\n// channel, the plugin-scope matchers, and any side-effect), so this package owns\n// only the orchestration + the `plugin:<scope>:file:<path>` channel format and\n// touches neither host's pubsub-channel config nor its frontend subscribers.\nimport { stat } from \"node:fs/promises\";\nimport path from \"node:path\";\n\n/** Payload published on every file-change channel. `mtimeMs` is the post-write\n *  modified time — monotonic, suitable for cache-busting (`?v=`) and out-of-order\n *  drops. */\nexport interface FileChannelPayload {\n  path: string;\n  mtimeMs: number;\n}\n\n/** A plugin View that wants live-refresh: when `matches(posixPath)` is true, the\n *  change is forwarded to `plugin:<scope>:file:<path>` (the channel the View's\n *  runtime subscribes to). */\nexport interface FileChangeScope {\n  scope: string;\n  matches: (posixPath: string) => boolean;\n}\n\nexport interface FileChangePublisherConfig {\n  /** Host pubsub publish. */\n  publish: (channel: string, payload: FileChannelPayload) => void;\n  /** Workspace root — joined with the relative path to stat the post-write mtime. */\n  workspaceRoot: string;\n  /** Normalise a workspace-relative path to POSIX (drives both `payload.path` and\n   *  every channel suffix, so they can't drift on mixed separators). */\n  toPosix: (relativePath: string) => string;\n  /** The host's primary file channel (e.g. a Files explorer's `file:<path>`).\n   *  Omit when the host has no general file subscriber (e.g. MulmoTerminal). */\n  primaryChannel?: (posixPath: string) => string;\n  /** Plugin Views to forward to. */\n  pluginScopes?: FileChangeScope[];\n  /** Optional side-effect after publishing (e.g. a topic-index regen). Receives the\n   *  posix path + payload; may itself call `publishFileChange` for derived files. */\n  onPublished?: (posixPath: string, payload: FileChannelPayload) => void;\n  /** Optional warn logger; a publish/stat failure logs but never throws (callers\n   *  fire-and-forget, so a throw would be an unhandled rejection). */\n  warn?: (message: string, data?: Record<string, unknown>) => void;\n}\n\nlet config: FileChangePublisherConfig | null = null;\n\n/** Wire the publisher to a host. Call once at startup, before any write route. */\nexport function configureFileChangePublisher(cfg: FileChangePublisherConfig): void {\n  config = cfg;\n}\n\n/** Clear the binding — test-only. */\nexport function resetFileChangePublisher(): void {\n  config = null;\n}\n\n/** The plugin-scoped live-refresh channel a View subscribes to. */\nexport function pluginFileChannel(scope: string, posixPath: string): string {\n  return `plugin:${scope}:file:${posixPath}`;\n}\n\n/** Publish a file-change for a workspace-relative path: the primary channel (if any)\n *  + every matching plugin scope, with the post-write mtime. No-op until configured. */\nexport async function publishFileChange(relativePath: string): Promise<void> {\n  const cfg = config;\n  if (!cfg) return;\n  // `relativePath` comes from the host's write routes. Contain it before doing\n  // anything: a path that escapes the workspace is dropped entirely — we\n  // neither stat an arbitrary file nor broadcast an out-of-workspace path to\n  // subscribers or host side-effects. Defence-in-depth, since this is the\n  // shared package both hosts use. `root` carries a trailing separator and the\n  // guard is a single `startsWith` early-return — the canonical containment\n  // shape (so the check is unambiguous for both readers and static analysis).\n  const root = path.resolve(cfg.workspaceRoot) + path.sep;\n  const absPath = path.join(root, relativePath);\n  if (!absPath.startsWith(root)) {\n    cfg.warn?.(\"ignoring file-change for path outside workspace\", { path: relativePath });\n    return;\n  }\n  let mtimeMs: number;\n  try {\n    ({ mtimeMs } = await stat(absPath));\n  } catch (err) {\n    cfg.warn?.(\"stat failed; falling back to Date.now()\", { path: relativePath, error: errMsg(err) });\n    mtimeMs = Date.now();\n  }\n  const posixPath = cfg.toPosix(relativePath);\n  const payload: FileChannelPayload = { path: posixPath, mtimeMs };\n\n  if (cfg.primaryChannel) {\n    safePublish(cfg, cfg.primaryChannel(posixPath), payload, \"primary publish failed\");\n  }\n  for (const { scope, matches } of cfg.pluginScopes ?? []) {\n    if (!matches(posixPath)) continue;\n    safePublish(cfg, pluginFileChannel(scope, posixPath), payload, `${scope} plugin forward failed`);\n  }\n  cfg.onPublished?.(posixPath, payload);\n}\n\nfunction safePublish(cfg: FileChangePublisherConfig, channel: string, payload: FileChannelPayload, failMsg: string): void {\n  try {\n    cfg.publish(channel, payload);\n  } catch (err) {\n    cfg.warn?.(`${failMsg}; subscribers will miss this event`, { channel, error: errMsg(err) });\n  }\n}\n\nfunction errMsg(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n"],"mappings":";;;AAmDA,IAAI,SAA2C;;AAG/C,SAAgB,6BAA6B,KAAsC;CACjF,SAAS;AACX;;AAGA,SAAgB,2BAAiC;CAC/C,SAAS;AACX;;AAGA,SAAgB,kBAAkB,OAAe,WAA2B;CAC1E,OAAO,UAAU,MAAM,QAAQ;AACjC;;;AAIA,eAAsB,kBAAkB,cAAqC;CAC3E,MAAM,MAAM;CACZ,IAAI,CAAC,KAAK;CAQV,MAAM,OAAO,KAAK,QAAQ,IAAI,aAAa,IAAI,KAAK;CACpD,MAAM,UAAU,KAAK,KAAK,MAAM,YAAY;CAC5C,IAAI,CAAC,QAAQ,WAAW,IAAI,GAAG;EAC7B,IAAI,OAAO,mDAAmD,EAAE,MAAM,aAAa,CAAC;EACpF;CACF;CACA,IAAI;CACJ,IAAI;EACF,CAAC,CAAE,WAAY,MAAM,KAAK,OAAO;CACnC,SAAS,KAAK;EACZ,IAAI,OAAO,2CAA2C;GAAE,MAAM;GAAc,OAAO,OAAO,GAAG;EAAE,CAAC;EAChG,UAAU,KAAK,IAAI;CACrB;CACA,MAAM,YAAY,IAAI,QAAQ,YAAY;CAC1C,MAAM,UAA8B;EAAE,MAAM;EAAW;CAAQ;CAE/D,IAAI,IAAI,gBACN,YAAY,KAAK,IAAI,eAAe,SAAS,GAAG,SAAS,wBAAwB;CAEnF,KAAK,MAAM,EAAE,OAAO,aAAa,IAAI,gBAAgB,CAAC,GAAG;EACvD,IAAI,CAAC,QAAQ,SAAS,GAAG;EACzB,YAAY,KAAK,kBAAkB,OAAO,SAAS,GAAG,SAAS,GAAG,MAAM,uBAAuB;CACjG;CACA,IAAI,cAAc,WAAW,OAAO;AACtC;AAEA,SAAS,YAAY,KAAgC,SAAiB,SAA6B,SAAuB;CACxH,IAAI;EACF,IAAI,QAAQ,SAAS,OAAO;CAC9B,SAAS,KAAK;EACZ,IAAI,OAAO,GAAG,QAAQ,qCAAqC;GAAE;GAAS,OAAO,OAAO,GAAG;EAAE,CAAC;CAC5F;AACF;AAEA,SAAS,OAAO,KAAsB;CACpC,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD"}

package/dist/notifier/engine.d.ts

@@ -0,0 +1,72 @@
+import { WriteJson } from './store.js';
+import { NotifierEntry, NotifierEvent, NotifierHistoryEntry, NotifierSeverity, PublishInput } from './types.js';
+export { NOTIFIER_LIMITS, validatePublishInput } from './validate.js';
+/** Minimal logger the engine needs. The host passes its structured
+ *  logger; absent one, failures are swallowed (the engine never throws
+ *  on a fan-out/persist-best-effort path). */
+export interface NotifierLogger {
+    warn: (message: string, data?: Record<string, unknown>) => void;
+    error: (message: string, data?: Record<string, unknown>) => void;
+}
+export interface NotifierConfig {
+    /** Atomic JSON writer (the host's `writeJsonAtomic`). */
+    writeJson: WriteJson;
+    /** Fan-out sink — the host binds this to `pubsub.publish(channel, event)`. */
+    publishEvent: (event: NotifierEvent) => void;
+    /** Optional logger. */
+    log?: NotifierLogger;
+}
+/** Wire the engine's I/O deps. Call once at startup, before the first
+ *  mutation. Does NOT set file paths — those are set independently via
+ *  `setNotifierFilePaths` so a host can bind production paths at module
+ *  load and a test can override them without re-supplying the deps. */
+export declare function configureNotifier(injected: NotifierConfig): void;
+type NotifierEventListener = (event: NotifierEvent) => void;
+/** Register an in-process listener for engine events. Returns an
+ *  unsubscribe function the caller can use during teardown. */
+export declare function onEvent(listener: NotifierEventListener): () => void;
+/** Point the engine at its active/history files. Resets the write
+ *  queue, so callers must not have in-flight mutations. The host calls
+ *  this once with the workspace paths; tests call it per-case with temp
+ *  files. */
+export declare function setNotifierFilePaths(paths: {
+    active: string;
+    history: string;
+}): void;
+/** Test-only: clear config + queue so each suite starts clean. */
+export declare function resetNotifier(): void;
+export declare function publish<TPluginData = unknown>(input: PublishInput<TPluginData>): Promise<{
+    id: string;
+}>;
+export declare function clear(entryId: string): Promise<void>;
+export declare function cancel(entryId: string): Promise<void>;
+/** In-place update for an active entry. Only the fields present on
+ *  `patch` are rewritten; `id`, `pluginPkg`, `lifecycle`, and
+ *  `createdAt` stay fixed. Emits a single `"updated"` event with the
+ *  post-mutation entry — no history record is written because the
+ *  entry is still active, just with refreshed content.
+ *
+ *  No-ops (no throw) when the id is unknown, the entry belongs to a
+ *  different plugin, or the merged shape would violate
+ *  `validatePublishInput`. The silent skip matches `clearForPlugin`'s
+ *  isolation semantics; validation failures are logged for diagnosis. */
+export declare function updateForPlugin<TPluginData = unknown>(pluginPkg: string, entryId: string, patch: {
+    severity?: NotifierSeverity;
+    title?: string;
+    body?: string;
+    navigateTarget?: string;
+    pluginData?: TPluginData;
+}): Promise<void>;
+/** Plugin-scoped point lookup. Returns the entry by id, but only if it
+ *  belongs to the caller's plugin; otherwise undefined. Cross-plugin
+ *  reads return undefined for isolation — same property as
+ *  `clearForPlugin` / `updateForPlugin`. */
+export declare function getForPlugin(pluginPkg: string, entryId: string): Promise<NotifierEntry | undefined>;
+/** Plugin-scoped clear. Same as `clear` but no-ops if the entry's
+ *  `pluginPkg` doesn't match the caller's, so a plugin can't dismiss
+ *  another plugin's notification by guessing or scraping its id. */
+export declare function clearForPlugin(pluginPkg: string, entryId: string): Promise<void>;
+export declare function get(entryId: string): Promise<NotifierEntry | undefined>;
+export declare function listFor(pluginPkg: string): Promise<NotifierEntry[]>;
+export declare function listAll(): Promise<NotifierEntry[]>;
+export declare function listHistory(): Promise<NotifierHistoryEntry[]>;

package/dist/notifier/index.cjs

@@ -0,0 +1,484 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../chunk-CKQMccvm.cjs");
+let node_fs = require("node:fs");
+let node_crypto = require("node:crypto");
+//#region src/notifier/types.ts
+/** Two notification shapes, distinguished by who fires the close call:
+*
+*    `fyi`    — informational. The host (bell panel) clears it when the
+*               user dismisses the row. No deep-link target.
+*    `action` — pending obligation. The plugin clears it when the
+*               underlying domain state changes (the user paid the tax,
+*               viewed the digest, etc.). The bell row navigates to
+*               `navigateTarget` on click.
+*
+*  The engine reads `lifecycle` only to enforce two publish-time rules
+*  (everything downstream — pubsub fan-out, persistence, history — is
+*  lifecycle-blind):
+*
+*    1. `action` requires a non-empty `navigateTarget`. Without one,
+*       clicking the row does nothing and the entry is a degraded fyi.
+*    2. `action` cannot use `info` severity. A low-priority obligation
+*       is incoherent — fyi if it's a ping, `nudge`/`urgent` if it's a
+*       real obligation worth a landing page.
+*
+*  Both rules are mirrored in the HTTP layer so plugin-runtime callers
+*  and HTTP callers hit the same wall. */
+var NOTIFIER_LIFECYCLES = ["fyi", "action"];
+/** Severity drives badge color (gray / amber / red, worst-wins) and
+*  in a future iteration channel routing. Mostly stored verbatim by
+*  the engine; the one engine-visible interaction is the rule that
+*  `action` lifecycle cannot pair with `info` severity (see
+*  `NotifierLifecycle` above). */
+var NOTIFIER_SEVERITIES = [
+	"info",
+	"nudge",
+	"urgent"
+];
+/** History size cap. The bell popup's History section renders this
+*  many entries; older ones fall off when new terminations land. */
+var HISTORY_CAP = 50;
+//#endregion
+//#region src/notifier/store.ts
+function isNotFoundError(err) {
+	return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+/** Read the active-entries file. Returns an empty store when the file
+*  doesn't exist yet (first ever call on a fresh workspace). Any other
+*  read or parse failure throws — the caller has to decide whether to
+*  surface or recover, since silently treating "malformed file" as
+*  "no entries" would lose data. */
+async function loadActive(filePath) {
+	let text;
+	try {
+		text = await node_fs.promises.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (isNotFoundError(err)) return { entries: {} };
+		throw err;
+	}
+	const parsed = JSON.parse(text);
+	if (typeof parsed !== "object" || parsed === null || !("entries" in parsed)) throw new Error(`notifier: malformed active.json at ${filePath}`);
+	const { entries } = parsed;
+	if (typeof entries !== "object" || entries === null || Array.isArray(entries)) throw new Error(`notifier: malformed active.json at ${filePath}`);
+	return parsed;
+}
+/** Write the active-entries file via the injected atomic writer so a
+*  half-written file is never visible to readers. The caller serialises
+*  writes (engine.ts queues mutations) — this function makes no
+*  concurrency guarantees of its own. */
+async function saveActive(writeJson, filePath, state) {
+	await writeJson(filePath, state);
+}
+/** Read the history file. Empty array on first run. Same parse-error
+*  policy as `loadActive`. */
+async function loadHistory(filePath) {
+	let text;
+	try {
+		text = await node_fs.promises.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (isNotFoundError(err)) return { entries: [] };
+		throw err;
+	}
+	const parsed = JSON.parse(text);
+	if (typeof parsed !== "object" || parsed === null || !("entries" in parsed) || !Array.isArray(parsed.entries)) throw new Error(`notifier: malformed history.json at ${filePath}`);
+	return parsed;
+}
+async function saveHistory(writeJson, filePath, state) {
+	await writeJson(filePath, state);
+}
+//#endregion
+//#region src/notifier/validate.ts
+/** Hard caps on publish-input fields. The engine reads each entry on
+*  every list/get call (no in-memory cache), so unbounded fields hurt
+*  every reader. Caps chosen to be generous for legitimate UX copy
+*  while bounding active.json growth: a notification fundamentally is
+*  a short blurb, not a document. */
+var NOTIFIER_LIMITS = {
+	titleMax: 200,
+	bodyMax: 4e3,
+	navigateTargetMax: 1e3,
+	pluginDataMaxBytes: 16 * 1024
+};
+function validateTitle(title) {
+	if (typeof title !== "string" || title.length === 0) return "title must be a non-empty string";
+	if (title.length > NOTIFIER_LIMITS.titleMax) return `title exceeds max length of ${NOTIFIER_LIMITS.titleMax} chars`;
+	return null;
+}
+function validateBody(body) {
+	if (body === void 0) return null;
+	if (body.length > NOTIFIER_LIMITS.bodyMax) return `body exceeds max length of ${NOTIFIER_LIMITS.bodyMax} chars`;
+	return null;
+}
+function validateNavigateTarget(target) {
+	if (target === void 0) return null;
+	if (target.length === 0) return "navigateTarget must be a non-empty relative path when set";
+	if (target.length > NOTIFIER_LIMITS.navigateTargetMax) return `navigateTarget exceeds max length of ${NOTIFIER_LIMITS.navigateTargetMax} chars`;
+	if (!target.startsWith("/") || target.startsWith("//")) return "navigateTarget must be a relative path beginning with a single '/' (no scheme, no '//')";
+	return null;
+}
+function validatePluginData(pluginData) {
+	if (pluginData === void 0) return null;
+	let serialized;
+	try {
+		serialized = JSON.stringify(pluginData);
+	} catch (err) {
+		return `pluginData is not JSON-serialisable: ${String(err)}`;
+	}
+	if (typeof serialized !== "string") return "pluginData is not JSON-serialisable";
+	if (serialized.length > NOTIFIER_LIMITS.pluginDataMaxBytes) return `pluginData JSON exceeds ${NOTIFIER_LIMITS.pluginDataMaxBytes} bytes`;
+	return null;
+}
+function validateActionCoherence(input) {
+	if (input.lifecycle !== "action") return null;
+	if (input.severity === "info") return "action lifecycle is incompatible with info severity (use fyi for low-priority pings)";
+	if (typeof input.navigateTarget !== "string" || input.navigateTarget.length === 0) return "action lifecycle requires a non-empty navigateTarget";
+	return null;
+}
+/** Validate a `PublishInput`. Returns `null` if OK, or a
+*  human-readable error string. Order matters — shape/size errors are
+*  reported before lifecycle/severity coherence errors so the message
+*  the caller sees points at the most fundamental problem first. */
+function validatePublishInput(input) {
+	return validateTitle(input.title) ?? validateBody(input.body) ?? validateNavigateTarget(input.navigateTarget) ?? validatePluginData(input.pluginData) ?? validateActionCoherence(input);
+}
+//#endregion
+//#region src/notifier/engine.ts
+var NOOP_LOG = {
+	warn: () => {},
+	error: () => {}
+};
+var config = null;
+var activeFilePath = "";
+var historyFilePath = "";
+function logger() {
+	return config?.log ?? NOOP_LOG;
+}
+/** Wire the engine's I/O deps. Call once at startup, before the first
+*  mutation. Does NOT set file paths — those are set independently via
+*  `setNotifierFilePaths` so a host can bind production paths at module
+*  load and a test can override them without re-supplying the deps. */
+function configureNotifier(injected) {
+	config = injected;
+}
+var listeners = [];
+/** Register an in-process listener for engine events. Returns an
+*  unsubscribe function the caller can use during teardown. */
+function onEvent(listener) {
+	listeners.push(listener);
+	return () => {
+		const idx = listeners.indexOf(listener);
+		if (idx >= 0) listeners.splice(idx, 1);
+	};
+}
+function emit(event) {
+	for (const listener of listeners) try {
+		listener(event);
+	} catch (err) {
+		logger().error("in-process listener failed", {
+			type: event.type,
+			error: String(err)
+		});
+	}
+	if (!config) {
+		logger().warn("emit before init", { type: event.type });
+		return;
+	}
+	try {
+		config.publishEvent(event);
+	} catch (err) {
+		logger().error("emit failed", {
+			type: event.type,
+			error: String(err)
+		});
+	}
+}
+var writing = false;
+var waiters = [];
+/** Point the engine at its active/history files. Resets the write
+*  queue, so callers must not have in-flight mutations. The host calls
+*  this once with the workspace paths; tests call it per-case with temp
+*  files. */
+function setNotifierFilePaths(paths) {
+	activeFilePath = paths.active;
+	historyFilePath = paths.history;
+	writing = false;
+	waiters = [];
+}
+/** Test-only: clear config + queue so each suite starts clean. */
+function resetNotifier() {
+	config = null;
+	activeFilePath = "";
+	historyFilePath = "";
+	writing = false;
+	waiters = [];
+	listeners.length = 0;
+}
+function requireWriteJson() {
+	if (!config) throw new Error("notifier: configureNotifier() not called");
+	return config.writeJson;
+}
+function applyBatchMutations(batch, state) {
+	return batch.map((waiter) => {
+		try {
+			return {
+				ok: true,
+				outcome: waiter.mutate(state)
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: err
+			};
+		}
+	});
+}
+function collectEvents(results) {
+	const events = [];
+	for (const result of results) if (result.ok && result.outcome !== null) events.push(result.outcome.event);
+	return events;
+}
+function collectHistoryEntries(results) {
+	const entries = [];
+	for (const result of results) if (result.ok && result.outcome !== null && result.outcome.historyEntry) entries.push(result.outcome.historyEntry);
+	return entries;
+}
+function settleBatch(batch, results) {
+	for (let index = 0; index < batch.length; index += 1) {
+		const result = results[index];
+		if (result.ok) batch[index].resolve();
+		else batch[index].reject(result.error);
+	}
+}
+function rejectBatch(batch, err) {
+	for (const waiter of batch) waiter.reject(err);
+}
+async function persistHistory(newEntries) {
+	const existing = await loadHistory(historyFilePath);
+	const merged = [...newEntries.slice().reverse(), ...existing.entries].slice(0, 50);
+	await saveHistory(requireWriteJson(), historyFilePath, { entries: merged });
+}
+async function processBatch(batch) {
+	let state;
+	try {
+		state = await loadActive(activeFilePath);
+	} catch (err) {
+		logger().error("load failed", { error: String(err) });
+		rejectBatch(batch, err);
+		return;
+	}
+	const results = applyBatchMutations(batch, state);
+	const events = collectEvents(results);
+	const historyEntries = collectHistoryEntries(results);
+	if (events.length > 0) {
+		try {
+			await saveActive(requireWriteJson(), activeFilePath, state);
+		} catch (err) {
+			logger().error("active write failed", { error: String(err) });
+			rejectBatch(batch, err);
+			return;
+		}
+		if (historyEntries.length > 0) try {
+			await persistHistory(historyEntries);
+		} catch (err) {
+			logger().error("history write failed", { error: String(err) });
+		}
+		for (const event of events) emit(event);
+	}
+	settleBatch(batch, results);
+}
+async function drain() {
+	writing = true;
+	try {
+		while (waiters.length > 0) {
+			const batch = waiters;
+			waiters = [];
+			await processBatch(batch);
+		}
+	} finally {
+		writing = false;
+	}
+}
+function enqueue(mutate) {
+	return new Promise((resolve, reject) => {
+		waiters.push({
+			mutate,
+			resolve,
+			reject
+		});
+		if (!writing) drain();
+	});
+}
+function removeEntry(state, entryId) {
+	const { [entryId]: __removed, ...remaining } = state.entries;
+	return remaining;
+}
+function buildHistoryEntry(entry, terminalType) {
+	return {
+		...entry,
+		terminalType,
+		terminalAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+async function publish(input) {
+	const validationError = validatePublishInput(input);
+	if (validationError) throw new Error(`notifier.publish: ${validationError}`);
+	const entryId = (0, node_crypto.randomUUID)();
+	const entry = {
+		id: entryId,
+		pluginPkg: input.pluginPkg,
+		severity: input.severity,
+		lifecycle: input.lifecycle,
+		title: input.title,
+		body: input.body,
+		navigateTarget: input.navigateTarget,
+		pluginData: input.pluginData,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await enqueue((state) => {
+		state.entries[entryId] = entry;
+		return { event: {
+			type: "published",
+			entry
+		} };
+	});
+	return { id: entryId };
+}
+async function clear(entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cleared",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cleared")
+		};
+	});
+}
+async function cancel(entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cancelled",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cancelled")
+		};
+	});
+}
+/** In-place update for an active entry. Only the fields present on
+*  `patch` are rewritten; `id`, `pluginPkg`, `lifecycle`, and
+*  `createdAt` stay fixed. Emits a single `"updated"` event with the
+*  post-mutation entry — no history record is written because the
+*  entry is still active, just with refreshed content.
+*
+*  No-ops (no throw) when the id is unknown, the entry belongs to a
+*  different plugin, or the merged shape would violate
+*  `validatePublishInput`. The silent skip matches `clearForPlugin`'s
+*  isolation semantics; validation failures are logged for diagnosis. */
+async function updateForPlugin(pluginPkg, entryId, patch) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		if (entry.pluginPkg !== pluginPkg) return null;
+		const next = {
+			...entry,
+			...patch.severity !== void 0 ? { severity: patch.severity } : {},
+			...patch.title !== void 0 ? { title: patch.title } : {},
+			...patch.body !== void 0 ? { body: patch.body } : {},
+			...patch.navigateTarget !== void 0 ? { navigateTarget: patch.navigateTarget } : {},
+			...patch.pluginData !== void 0 ? { pluginData: patch.pluginData } : {}
+		};
+		const validationError = validatePublishInput({
+			pluginPkg: next.pluginPkg,
+			severity: next.severity,
+			title: next.title,
+			body: next.body,
+			lifecycle: next.lifecycle,
+			navigateTarget: next.navigateTarget,
+			pluginData: next.pluginData
+		});
+		if (validationError) {
+			logger().warn("update rejected by validation", {
+				entryId,
+				pluginPkg,
+				error: validationError
+			});
+			return null;
+		}
+		state.entries[entryId] = next;
+		return { event: {
+			type: "updated",
+			entry: next
+		} };
+	});
+}
+/** Plugin-scoped point lookup. Returns the entry by id, but only if it
+*  belongs to the caller's plugin; otherwise undefined. Cross-plugin
+*  reads return undefined for isolation — same property as
+*  `clearForPlugin` / `updateForPlugin`. */
+async function getForPlugin(pluginPkg, entryId) {
+	const entry = (await loadActive(activeFilePath)).entries[entryId];
+	if (!entry) return void 0;
+	if (entry.pluginPkg !== pluginPkg) return void 0;
+	return entry;
+}
+/** Plugin-scoped clear. Same as `clear` but no-ops if the entry's
+*  `pluginPkg` doesn't match the caller's, so a plugin can't dismiss
+*  another plugin's notification by guessing or scraping its id. */
+async function clearForPlugin(pluginPkg, entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		if (entry.pluginPkg !== pluginPkg) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cleared",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cleared")
+		};
+	});
+}
+async function get(entryId) {
+	return (await loadActive(activeFilePath)).entries[entryId];
+}
+async function listFor(pluginPkg) {
+	const state = await loadActive(activeFilePath);
+	return Object.values(state.entries).filter((entry) => entry.pluginPkg === pluginPkg);
+}
+async function listAll() {
+	const state = await loadActive(activeFilePath);
+	return Object.values(state.entries);
+}
+async function listHistory() {
+	return (await loadHistory(historyFilePath)).entries;
+}
+//#endregion
+exports.HISTORY_CAP = HISTORY_CAP;
+exports.NOTIFIER_LIFECYCLES = NOTIFIER_LIFECYCLES;
+exports.NOTIFIER_LIMITS = NOTIFIER_LIMITS;
+exports.NOTIFIER_SEVERITIES = NOTIFIER_SEVERITIES;
+exports.cancel = cancel;
+exports.clear = clear;
+exports.clearForPlugin = clearForPlugin;
+exports.configureNotifier = configureNotifier;
+exports.get = get;
+exports.getForPlugin = getForPlugin;
+exports.listAll = listAll;
+exports.listFor = listFor;
+exports.listHistory = listHistory;
+exports.onEvent = onEvent;
+exports.publish = publish;
+exports.resetNotifier = resetNotifier;
+exports.setNotifierFilePaths = setNotifierFilePaths;
+exports.updateForPlugin = updateForPlugin;
+exports.validatePublishInput = validatePublishInput;
+
+//# sourceMappingURL=index.cjs.map