@mulmoclaude/core 0.1.0

package/dist/notifier/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../src/notifier/types.ts","../../src/notifier/store.ts","../../src/notifier/validate.ts","../../src/notifier/engine.ts"],"sourcesContent":["// Notifier value types. Kept dependency-free (no node, no fs, no\n// pubsub) so the host's API-route layer and any future browser\n// consumer can validate inbound payloads against the same enum\n// constants the engine accepts without pulling in the engine's I/O.\n\n/** Two notification shapes, distinguished by who fires the close call:\n *\n *    `fyi`    — informational. The host (bell panel) clears it when the\n *               user dismisses the row. No deep-link target.\n *    `action` — pending obligation. The plugin clears it when the\n *               underlying domain state changes (the user paid the tax,\n *               viewed the digest, etc.). The bell row navigates to\n *               `navigateTarget` on click.\n *\n *  The engine reads `lifecycle` only to enforce two publish-time rules\n *  (everything downstream — pubsub fan-out, persistence, history — is\n *  lifecycle-blind):\n *\n *    1. `action` requires a non-empty `navigateTarget`. Without one,\n *       clicking the row does nothing and the entry is a degraded fyi.\n *    2. `action` cannot use `info` severity. A low-priority obligation\n *       is incoherent — fyi if it's a ping, `nudge`/`urgent` if it's a\n *       real obligation worth a landing page.\n *\n *  Both rules are mirrored in the HTTP layer so plugin-runtime callers\n *  and HTTP callers hit the same wall. */\nexport const NOTIFIER_LIFECYCLES = [\"fyi\", \"action\"] as const;\nexport type NotifierLifecycle = (typeof NOTIFIER_LIFECYCLES)[number];\n\n/** Severity drives badge color (gray / amber / red, worst-wins) and\n *  in a future iteration channel routing. Mostly stored verbatim by\n *  the engine; the one engine-visible interaction is the rule that\n *  `action` lifecycle cannot pair with `info` severity (see\n *  `NotifierLifecycle` above). */\nexport const NOTIFIER_SEVERITIES = [\"info\", \"nudge\", \"urgent\"] as const;\nexport type NotifierSeverity = (typeof NOTIFIER_SEVERITIES)[number];\n\nexport interface NotifierEntry<TPluginData = unknown> {\n  /** Engine-assigned UUID. Generated synchronously inside `publish()`\n   *  so the caller can use it before persistence completes. */\n  id: string;\n  /** Plugin namespace (e.g. `\"encore\"`, `\"debug__system\"`). The\n   *  engine never inspects it — used only for `listFor()` filtering\n   *  and as a UI grouping key. */\n  pluginPkg: string;\n  severity: NotifierSeverity;\n  lifecycle?: NotifierLifecycle;\n  title: string;\n  body?: string;\n  /** Optional in-app deep-link target (relative URL). The bell popup\n   *  routes here on row click, with `&notificationId=<id>` appended\n   *  so the landing page can identify which entry to clear. The\n   *  engine doesn't read this — it's a UI hint stored on the entry. */\n  navigateTarget?: string;\n  /** Opaque to the engine. Round-trips through JSON unchanged; only\n   *  the originating plugin's UI knows the shape. */\n  pluginData?: TPluginData;\n  /** ISO-8601 timestamp set at `publish()` time. */\n  createdAt: string;\n}\n\n/** A history entry — a `NotifierEntry` after it has been cleared or\n *  cancelled, with the terminal type and timestamp recorded. The\n *  bell popup's \"History\" section renders these read-only. */\nexport interface NotifierHistoryEntry<TPluginData = unknown> extends NotifierEntry<TPluginData> {\n  terminalType: \"cleared\" | \"cancelled\";\n  terminalAt: string;\n}\n\n/** Caller-supplied input for `publish()`. The engine fills in `id`\n *  and `createdAt`; everything else flows through verbatim.\n *\n *  Two publish-time rules apply to `action` lifecycle (see\n *  `NotifierLifecycle`):\n *\n *    - `navigateTarget` MUST be a non-empty string.\n *    - `severity` MUST NOT be `\"info\"`.\n *\n *  Violations cause `publish()` to throw. Currently expressed as\n *  runtime validation rather than a discriminated-union type, so the\n *  fields below are all individually optional / loose at the\n *  type-level. */\nexport interface PublishInput<TPluginData = unknown> {\n  pluginPkg: string;\n  severity: NotifierSeverity;\n  title: string;\n  body?: string;\n  lifecycle?: NotifierLifecycle;\n  navigateTarget?: string;\n  pluginData?: TPluginData;\n}\n\n/** On-disk shape of `~/mulmoclaude/data/notifier/active.json`. Holds\n *  only entries that haven't been cleared or cancelled — the file is\n *  a snapshot, not an event log. */\nexport interface NotifierFile {\n  entries: Record<string, NotifierEntry>;\n}\n\n/** On-disk shape of `~/mulmoclaude/data/notifier/history.json`. Array\n *  of terminated entries newest-first, capped at `HISTORY_CAP` with\n *  FIFO eviction (push at index 0, slice from the tail). */\nexport interface NotifierHistoryFile {\n  entries: NotifierHistoryEntry[];\n}\n\n/** History size cap. The bell popup's History section renders this\n *  many entries; older ones fall off when new terminations land. */\nexport const HISTORY_CAP = 50;\n\n/** Pub-sub event published on the host's notifier channel after every\n *  successful state change. Discriminated union — subscribers switch\n *  on `type` to keep TypeScript narrowing the rest of the payload.\n *\n *  `updated` carries the post-mutation entry — the receiver swaps\n *  the matching `id` in their local active set. Reserved for in-\n *  place edits via `updateForPlugin`; no history record is written\n *  because the entry is still active, just with refreshed content. */\nexport type NotifierEvent =\n  | { type: \"published\"; entry: NotifierEntry }\n  | { type: \"cleared\"; id: string }\n  | { type: \"cancelled\"; id: string }\n  | { type: \"updated\"; entry: NotifierEntry };\n","// Low-level file I/O for the notifier. Reads use node:fs directly;\n// writes go through an injected atomic-JSON writer (the host owns the\n// rename-based atomic write so it stays single-sourced with its other\n// writers). Kept separate from `engine.ts` so the path can be\n// overridden in tests without monkey-patching.\n\nimport { promises as fsPromises } from \"node:fs\";\nimport type { NotifierFile, NotifierHistoryFile } from \"./types.js\";\n\n/** Injected atomic JSON writer — the host's `writeJsonAtomic`. */\nexport type WriteJson = (filePath: string, data: unknown) => Promise<void>;\n\nfunction isNotFoundError(err: unknown): boolean {\n  return typeof err === \"object\" && err !== null && (err as { code?: unknown }).code === \"ENOENT\";\n}\n\n/** Read the active-entries file. Returns an empty store when the file\n *  doesn't exist yet (first ever call on a fresh workspace). Any other\n *  read or parse failure throws — the caller has to decide whether to\n *  surface or recover, since silently treating \"malformed file\" as\n *  \"no entries\" would lose data. */\nexport async function loadActive(filePath: string): Promise<NotifierFile> {\n  let text: string;\n  try {\n    text = await fsPromises.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if (isNotFoundError(err)) return { entries: {} };\n    throw err;\n  }\n  const parsed: unknown = JSON.parse(text);\n  // `typeof null === \"object\"` and `Array.isArray([])` is also true,\n  // so a naive `typeof entries !== \"object\"` check would let\n  // `{ entries: null }` and `{ entries: [] }` through, which then\n  // crash downstream `engine.get` / `list*` mutations. Reject both\n  // shapes here at load time so the failure surfaces as a clear\n  // \"malformed file\" error.\n  if (typeof parsed !== \"object\" || parsed === null || !(\"entries\" in parsed)) {\n    throw new Error(`notifier: malformed active.json at ${filePath}`);\n  }\n  const { entries } = parsed as { entries: unknown };\n  if (typeof entries !== \"object\" || entries === null || Array.isArray(entries)) {\n    throw new Error(`notifier: malformed active.json at ${filePath}`);\n  }\n  return parsed as NotifierFile;\n}\n\n/** Write the active-entries file via the injected atomic writer so a\n *  half-written file is never visible to readers. The caller serialises\n *  writes (engine.ts queues mutations) — this function makes no\n *  concurrency guarantees of its own. */\nexport async function saveActive(writeJson: WriteJson, filePath: string, state: NotifierFile): Promise<void> {\n  await writeJson(filePath, state);\n}\n\n/** Read the history file. Empty array on first run. Same parse-error\n *  policy as `loadActive`. */\nexport async function loadHistory(filePath: string): Promise<NotifierHistoryFile> {\n  let text: string;\n  try {\n    text = await fsPromises.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if (isNotFoundError(err)) return { entries: [] };\n    throw err;\n  }\n  const parsed: unknown = JSON.parse(text);\n  if (typeof parsed !== \"object\" || parsed === null || !(\"entries\" in parsed) || !Array.isArray((parsed as { entries: unknown }).entries)) {\n    throw new Error(`notifier: malformed history.json at ${filePath}`);\n  }\n  return parsed as NotifierHistoryFile;\n}\n\nexport async function saveHistory(writeJson: WriteJson, filePath: string, state: NotifierHistoryFile): Promise<void> {\n  await writeJson(filePath, state);\n}\n","// Publish-input validation — pure, dependency-free. Shared by\n// `engine.publish` (throws on error) and the host's HTTP route\n// (returns 400 on error). Single source of truth so plugin-runtime\n// callers and HTTP callers can't drift.\n\nimport type { PublishInput } from \"./types.js\";\n\n/** Hard caps on publish-input fields. The engine reads each entry on\n *  every list/get call (no in-memory cache), so unbounded fields hurt\n *  every reader. Caps chosen to be generous for legitimate UX copy\n *  while bounding active.json growth: a notification fundamentally is\n *  a short blurb, not a document. */\nexport const NOTIFIER_LIMITS = {\n  titleMax: 200,\n  bodyMax: 4000,\n  navigateTargetMax: 1000,\n  pluginDataMaxBytes: 16 * 1024,\n} as const;\n\nfunction validateTitle(title: string): string | null {\n  if (typeof title !== \"string\" || title.length === 0) return \"title must be a non-empty string\";\n  if (title.length > NOTIFIER_LIMITS.titleMax) return `title exceeds max length of ${NOTIFIER_LIMITS.titleMax} chars`;\n  return null;\n}\n\nfunction validateBody(body: string | undefined): string | null {\n  if (body === undefined) return null;\n  if (body.length > NOTIFIER_LIMITS.bodyMax) return `body exceeds max length of ${NOTIFIER_LIMITS.bodyMax} chars`;\n  return null;\n}\n\nfunction validateNavigateTarget(target: string | undefined): string | null {\n  if (target === undefined) return null;\n  if (target.length === 0) return \"navigateTarget must be a non-empty relative path when set\";\n  if (target.length > NOTIFIER_LIMITS.navigateTargetMax) {\n    return `navigateTarget exceeds max length of ${NOTIFIER_LIMITS.navigateTargetMax} chars`;\n  }\n  // Must be a same-origin relative path. Reject schemes\n  // (`javascript:`, `https://...`) and scheme-relative URLs\n  // (`//evil.com/...`, which an `<a href>` would resolve to the\n  // attacker's origin). One leading \"/\" only.\n  if (!target.startsWith(\"/\") || target.startsWith(\"//\")) {\n    return \"navigateTarget must be a relative path beginning with a single '/' (no scheme, no '//')\";\n  }\n  return null;\n}\n\nfunction validatePluginData(pluginData: unknown): string | null {\n  if (pluginData === undefined) return null;\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(pluginData);\n  } catch (err) {\n    return `pluginData is not JSON-serialisable: ${String(err)}`;\n  }\n  // `JSON.stringify` returns `undefined` for non-serialisable roots\n  // (e.g. a bare function or symbol). Treat that as a serialisation\n  // failure so it doesn't slip through as an empty-string size.\n  if (typeof serialized !== \"string\") return \"pluginData is not JSON-serialisable\";\n  if (serialized.length > NOTIFIER_LIMITS.pluginDataMaxBytes) {\n    return `pluginData JSON exceeds ${NOTIFIER_LIMITS.pluginDataMaxBytes} bytes`;\n  }\n  return null;\n}\n\nfunction validateActionCoherence(input: PublishInput): string | null {\n  if (input.lifecycle !== \"action\") return null;\n  if (input.severity === \"info\") {\n    return \"action lifecycle is incompatible with info severity (use fyi for low-priority pings)\";\n  }\n  if (typeof input.navigateTarget !== \"string\" || input.navigateTarget.length === 0) {\n    return \"action lifecycle requires a non-empty navigateTarget\";\n  }\n  return null;\n}\n\n/** Validate a `PublishInput`. Returns `null` if OK, or a\n *  human-readable error string. Order matters — shape/size errors are\n *  reported before lifecycle/severity coherence errors so the message\n *  the caller sees points at the most fundamental problem first. */\nexport function validatePublishInput(input: PublishInput): string | null {\n  return (\n    validateTitle(input.title) ??\n    validateBody(input.body) ??\n    validateNavigateTarget(input.navigateTarget) ??\n    validatePluginData(input.pluginData) ??\n    validateActionCoherence(input)\n  );\n}\n","// Notifier engine — single-process, two-file (active + history),\n// single-channel. Host-agnostic: file paths, the atomic JSON writer,\n// the pub-sub event sink, and the logger are all injected via\n// `configureNotifier` + `setNotifierFilePaths` so MulmoClaude and\n// MulmoTerminal share one notification engine over their own\n// workspaces and pub-sub fabrics.\n//\n// API surface: publish / clear / cancel / get / listFor / listAll /\n// listHistory (+ plugin-scoped variants). Mutations queue through a\n// writing-flag + waiter-queue coordinator so concurrent callers can't\n// race on the atomic write's rename. Reads bypass the queue (rename\n// atomicity makes half-reads impossible) and trade strict\n// linearisability for simpler code: the contract is \"after\n// `await publish(x)` resolves, subsequent reads see x\" — which holds\n// because `publish` awaits the persist before returning.\n//\n// `clear` / `cancel` push to history *before* removing from active.\n// History persistence is best-effort: if it fails, the active write\n// still wins and the failure is logged. Active is the source of\n// truth; history is an audit aid.\n\nimport { randomUUID } from \"node:crypto\";\nimport { loadActive, loadHistory, saveActive, saveHistory, type WriteJson } from \"./store.js\";\nimport { validatePublishInput } from \"./validate.js\";\nimport {\n  HISTORY_CAP,\n  type NotifierEntry,\n  type NotifierEvent,\n  type NotifierFile,\n  type NotifierHistoryEntry,\n  type NotifierSeverity,\n  type PublishInput,\n} from \"./types.js\";\n\nexport { NOTIFIER_LIMITS, validatePublishInput } from \"./validate.js\";\n\n// ── Dependency injection ──────────────────────────────────────────\n\n/** Minimal logger the engine needs. The host passes its structured\n *  logger; absent one, failures are swallowed (the engine never throws\n *  on a fan-out/persist-best-effort path). */\nexport interface NotifierLogger {\n  warn: (message: string, data?: Record<string, unknown>) => void;\n  error: (message: string, data?: Record<string, unknown>) => void;\n}\n\nexport interface NotifierConfig {\n  /** Atomic JSON writer (the host's `writeJsonAtomic`). */\n  writeJson: WriteJson;\n  /** Fan-out sink — the host binds this to `pubsub.publish(channel, event)`. */\n  publishEvent: (event: NotifierEvent) => void;\n  /** Optional logger. */\n  log?: NotifierLogger;\n}\n\nconst NOOP_LOG: NotifierLogger = { warn: () => {}, error: () => {} };\n\nlet config: NotifierConfig | null = null;\nlet activeFilePath = \"\";\nlet historyFilePath = \"\";\n\nfunction logger(): NotifierLogger {\n  return config?.log ?? NOOP_LOG;\n}\n\n/** Wire the engine's I/O deps. Call once at startup, before the first\n *  mutation. Does NOT set file paths — those are set independently via\n *  `setNotifierFilePaths` so a host can bind production paths at module\n *  load and a test can override them without re-supplying the deps. */\nexport function configureNotifier(injected: NotifierConfig): void {\n  config = injected;\n}\n\n// ── In-process event listeners ────────────────────────────────────\n//\n// Separate from the socket.io pubsub so server-side adapters (macOS\n// push, future Encore) can react to state changes without going\n// through a websocket round-trip. The host's pubsub is fan-out-only\n// with no server-side subscribe, so this listener registry is the\n// in-process equivalent. Listeners run synchronously inside `emit`,\n// before the pubsub fan-out.\n\ntype NotifierEventListener = (event: NotifierEvent) => void;\nconst listeners: NotifierEventListener[] = [];\n\n/** Register an in-process listener for engine events. Returns an\n *  unsubscribe function the caller can use during teardown. */\nexport function onEvent(listener: NotifierEventListener): () => void {\n  listeners.push(listener);\n  return () => {\n    const idx = listeners.indexOf(listener);\n    if (idx >= 0) listeners.splice(idx, 1);\n  };\n}\n\nfunction emit(event: NotifierEvent): void {\n  // In-process fan-out first. Each listener is wrapped: a throwing\n  // listener must not poison the rest, and must not propagate out of\n  // `processBatch` and strand the still-unsettled waiters (their\n  // resolve/reject is called *after* this emit loop). Fan-out is\n  // best-effort by contract — losing one subscriber must not lose\n  // the write that already committed.\n  for (const listener of listeners) {\n    try {\n      listener(event);\n    } catch (err) {\n      logger().error(\"in-process listener failed\", { type: event.type, error: String(err) });\n    }\n  }\n  if (!config) {\n    logger().warn(\"emit before init\", { type: event.type });\n    return;\n  }\n  try {\n    config.publishEvent(event);\n  } catch (err) {\n    logger().error(\"emit failed\", { type: event.type, error: String(err) });\n  }\n}\n\n// ── Write coordinator ─────────────────────────────────────────────\n\n/** A mutation function applied to the in-memory state object during\n *  drain. Returns either:\n *\n *    - `null` — no state change (e.g., `clear` on an unknown id).\n *      The drainer skips the disk write and the emit if every\n *      mutation in a batch returned `null`.\n *    - `{ event, historyEntry? }` — state changed. The drainer emits\n *      the event after the active write succeeds, and prepends\n *      `historyEntry` to history (best-effort) when present.\n *\n *  Mutations MUST NOT modify state when returning `null`. Violating\n *  this invariant produces a write skip with stale on-disk state. */\ntype MutationOutcome = { event: NotifierEvent; historyEntry?: NotifierHistoryEntry } | null;\ntype Mutation = (state: NotifierFile) => MutationOutcome;\n\ninterface Waiter {\n  mutate: Mutation;\n  resolve: () => void;\n  reject: (err: unknown) => void;\n}\n\ntype MutationResult = { ok: true; outcome: MutationOutcome } | { ok: false; error: unknown };\n\nlet writing = false;\nlet waiters: Waiter[] = [];\n\n/** Point the engine at its active/history files. Resets the write\n *  queue, so callers must not have in-flight mutations. The host calls\n *  this once with the workspace paths; tests call it per-case with temp\n *  files. */\nexport function setNotifierFilePaths(paths: { active: string; history: string }): void {\n  activeFilePath = paths.active;\n  historyFilePath = paths.history;\n  writing = false;\n  waiters = [];\n}\n\n/** Test-only: clear config + queue so each suite starts clean. */\nexport function resetNotifier(): void {\n  config = null;\n  activeFilePath = \"\";\n  historyFilePath = \"\";\n  writing = false;\n  waiters = [];\n  listeners.length = 0;\n}\n\nfunction requireWriteJson(): WriteJson {\n  if (!config) throw new Error(\"notifier: configureNotifier() not called\");\n  return config.writeJson;\n}\n\nfunction applyBatchMutations(batch: Waiter[], state: NotifierFile): MutationResult[] {\n  return batch.map((waiter) => {\n    try {\n      return { ok: true, outcome: waiter.mutate(state) };\n    } catch (err) {\n      return { ok: false, error: err };\n    }\n  });\n}\n\nfunction collectEvents(results: MutationResult[]): NotifierEvent[] {\n  const events: NotifierEvent[] = [];\n  for (const result of results) {\n    if (result.ok && result.outcome !== null) events.push(result.outcome.event);\n  }\n  return events;\n}\n\nfunction collectHistoryEntries(results: MutationResult[]): NotifierHistoryEntry[] {\n  const entries: NotifierHistoryEntry[] = [];\n  for (const result of results) {\n    if (result.ok && result.outcome !== null && result.outcome.historyEntry) {\n      entries.push(result.outcome.historyEntry);\n    }\n  }\n  return entries;\n}\n\nfunction settleBatch(batch: Waiter[], results: MutationResult[]): void {\n  // Resolves come AFTER any emits so subscribers see the event\n  // before the caller's `await` returns.\n  for (let index = 0; index < batch.length; index += 1) {\n    const result = results[index];\n    if (result.ok) batch[index].resolve();\n    else batch[index].reject(result.error);\n  }\n}\n\nfunction rejectBatch(batch: Waiter[], err: unknown): void {\n  for (const waiter of batch) waiter.reject(err);\n}\n\nasync function persistHistory(newEntries: NotifierHistoryEntry[]): Promise<void> {\n  const existing = await loadHistory(historyFilePath);\n  // Newest-first ordering: a batch contains terminations in arrival\n  // order; we want the last one to land at index 0 of history.\n  const merged = [...newEntries.slice().reverse(), ...existing.entries].slice(0, HISTORY_CAP);\n  await saveHistory(requireWriteJson(), historyFilePath, { entries: merged });\n}\n\nasync function processBatch(batch: Waiter[]): Promise<void> {\n  let state: NotifierFile;\n  try {\n    state = await loadActive(activeFilePath);\n  } catch (err) {\n    logger().error(\"load failed\", { error: String(err) });\n    rejectBatch(batch, err);\n    return;\n  }\n  const results = applyBatchMutations(batch, state);\n  const events = collectEvents(results);\n  const historyEntries = collectHistoryEntries(results);\n\n  if (events.length > 0) {\n    try {\n      await saveActive(requireWriteJson(), activeFilePath, state);\n    } catch (err) {\n      logger().error(\"active write failed\", { error: String(err) });\n      rejectBatch(batch, err);\n      return;\n    }\n    if (historyEntries.length > 0) {\n      // Best-effort: active is the source of truth, history is an\n      // audit aid. A failed history write is logged but doesn't\n      // unwind the active commit.\n      try {\n        await persistHistory(historyEntries);\n      } catch (err) {\n        logger().error(\"history write failed\", { error: String(err) });\n      }\n    }\n    for (const event of events) emit(event);\n  }\n  settleBatch(batch, results);\n}\n\nasync function drain(): Promise<void> {\n  writing = true;\n  try {\n    while (waiters.length > 0) {\n      const batch = waiters;\n      waiters = [];\n      await processBatch(batch);\n    }\n  } finally {\n    writing = false;\n  }\n}\n\nfunction enqueue(mutate: Mutation): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    waiters.push({ mutate, resolve, reject });\n    if (!writing) void drain();\n  });\n}\n\nfunction removeEntry(state: NotifierFile, entryId: string): NotifierFile[\"entries\"] {\n  // Object-rest excludes the key without invoking `delete`.\n  const { [entryId]: __removed, ...remaining } = state.entries;\n  return remaining;\n}\n\nfunction buildHistoryEntry(entry: NotifierEntry, terminalType: \"cleared\" | \"cancelled\"): NotifierHistoryEntry {\n  return { ...entry, terminalType, terminalAt: new Date().toISOString() };\n}\n\n// ── Public API ────────────────────────────────────────────────────\n\nexport async function publish<TPluginData = unknown>(input: PublishInput<TPluginData>): Promise<{ id: string }> {\n  // Validate at the engine boundary so plugin-runtime callers and\n  // HTTP callers hit the same wall.\n  const validationError = validatePublishInput(input as PublishInput);\n  if (validationError) {\n    throw new Error(`notifier.publish: ${validationError}`);\n  }\n  const entryId = randomUUID();\n  const entry: NotifierEntry<TPluginData> = {\n    id: entryId,\n    pluginPkg: input.pluginPkg,\n    severity: input.severity,\n    lifecycle: input.lifecycle,\n    title: input.title,\n    body: input.body,\n    navigateTarget: input.navigateTarget,\n    pluginData: input.pluginData,\n    createdAt: new Date().toISOString(),\n  };\n  await enqueue((state) => {\n    state.entries[entryId] = entry as NotifierEntry;\n    return { event: { type: \"published\", entry: entry as NotifierEntry } };\n  });\n  return { id: entryId };\n}\n\nexport async function clear(entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cleared\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cleared\"),\n    };\n  });\n}\n\nexport async function cancel(entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cancelled\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cancelled\"),\n    };\n  });\n}\n\n/** In-place update for an active entry. Only the fields present on\n *  `patch` are rewritten; `id`, `pluginPkg`, `lifecycle`, and\n *  `createdAt` stay fixed. Emits a single `\"updated\"` event with the\n *  post-mutation entry — no history record is written because the\n *  entry is still active, just with refreshed content.\n *\n *  No-ops (no throw) when the id is unknown, the entry belongs to a\n *  different plugin, or the merged shape would violate\n *  `validatePublishInput`. The silent skip matches `clearForPlugin`'s\n *  isolation semantics; validation failures are logged for diagnosis. */\nexport async function updateForPlugin<TPluginData = unknown>(\n  pluginPkg: string,\n  entryId: string,\n  patch: {\n    severity?: NotifierSeverity;\n    title?: string;\n    body?: string;\n    navigateTarget?: string;\n    pluginData?: TPluginData;\n  },\n): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    if (entry.pluginPkg !== pluginPkg) return null;\n    const next: NotifierEntry = {\n      ...entry,\n      ...(patch.severity !== undefined ? { severity: patch.severity } : {}),\n      ...(patch.title !== undefined ? { title: patch.title } : {}),\n      ...(patch.body !== undefined ? { body: patch.body } : {}),\n      ...(patch.navigateTarget !== undefined ? { navigateTarget: patch.navigateTarget } : {}),\n      ...(patch.pluginData !== undefined ? { pluginData: patch.pluginData } : {}),\n    };\n    // Re-validate the merged shape so an update can't degrade the\n    // entry below publish-time invariants.\n    const validationError = validatePublishInput({\n      pluginPkg: next.pluginPkg,\n      severity: next.severity,\n      title: next.title,\n      body: next.body,\n      lifecycle: next.lifecycle,\n      navigateTarget: next.navigateTarget,\n      pluginData: next.pluginData,\n    });\n    if (validationError) {\n      logger().warn(\"update rejected by validation\", { entryId, pluginPkg, error: validationError });\n      return null;\n    }\n    state.entries[entryId] = next;\n    return { event: { type: \"updated\", entry: next } };\n  });\n}\n\n/** Plugin-scoped point lookup. Returns the entry by id, but only if it\n *  belongs to the caller's plugin; otherwise undefined. Cross-plugin\n *  reads return undefined for isolation — same property as\n *  `clearForPlugin` / `updateForPlugin`. */\nexport async function getForPlugin(pluginPkg: string, entryId: string): Promise<NotifierEntry | undefined> {\n  const state = await loadActive(activeFilePath);\n  const entry = state.entries[entryId];\n  if (!entry) return undefined;\n  if (entry.pluginPkg !== pluginPkg) return undefined;\n  return entry;\n}\n\n/** Plugin-scoped clear. Same as `clear` but no-ops if the entry's\n *  `pluginPkg` doesn't match the caller's, so a plugin can't dismiss\n *  another plugin's notification by guessing or scraping its id. */\nexport async function clearForPlugin(pluginPkg: string, entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    if (entry.pluginPkg !== pluginPkg) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cleared\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cleared\"),\n    };\n  });\n}\n\nexport async function get(entryId: string): Promise<NotifierEntry | undefined> {\n  const state = await loadActive(activeFilePath);\n  return state.entries[entryId];\n}\n\nexport async function listFor(pluginPkg: string): Promise<NotifierEntry[]> {\n  const state = await loadActive(activeFilePath);\n  return Object.values(state.entries).filter((entry) => entry.pluginPkg === pluginPkg);\n}\n\nexport async function listAll(): Promise<NotifierEntry[]> {\n  const state = await loadActive(activeFilePath);\n  return Object.values(state.entries);\n}\n\nexport async function listHistory(): Promise<NotifierHistoryEntry[]> {\n  const state = await loadHistory(historyFilePath);\n  return state.entries;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAa,sBAAsB,CAAC,OAAO,QAAQ;;;;;;AAQnD,IAAa,sBAAsB;CAAC;CAAQ;CAAS;AAAQ;;;AA0E7D,IAAa,cAAc;;;AChG3B,SAAS,gBAAgB,KAAuB;CAC9C,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAS,IAA2B,SAAS;AACzF;;;;;;AAOA,eAAsB,WAAW,UAAyC;CACxE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAA,SAAW,SAAS,UAAU,OAAO;CACpD,SAAS,KAAK;EACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE;EAC/C,MAAM;CACR;CACA,MAAM,SAAkB,KAAK,MAAM,IAAI;CAOvC,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,SAClE,MAAM,IAAI,MAAM,sCAAsC,UAAU;CAElE,MAAM,EAAE,YAAY;CACpB,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAC1E,MAAM,IAAI,MAAM,sCAAsC,UAAU;CAElE,OAAO;AACT;;;;;AAMA,eAAsB,WAAW,WAAsB,UAAkB,OAAoC;CAC3G,MAAM,UAAU,UAAU,KAAK;AACjC;;;AAIA,eAAsB,YAAY,UAAgD;CAChF,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAA,SAAW,SAAS,UAAU,OAAO;CACpD,SAAS,KAAK;EACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE;EAC/C,MAAM;CACR;CACA,MAAM,SAAkB,KAAK,MAAM,IAAI;CACvC,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,WAAW,CAAC,MAAM,QAAS,OAAgC,OAAO,GACpI,MAAM,IAAI,MAAM,uCAAuC,UAAU;CAEnE,OAAO;AACT;AAEA,eAAsB,YAAY,WAAsB,UAAkB,OAA2C;CACnH,MAAM,UAAU,UAAU,KAAK;AACjC;;;;;;;;AC7DA,IAAa,kBAAkB;CAC7B,UAAU;CACV,SAAS;CACT,mBAAmB;CACnB,oBAAoB,KAAK;AAC3B;AAEA,SAAS,cAAc,OAA8B;CACnD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,OAAO;CAC5D,IAAI,MAAM,SAAS,gBAAgB,UAAU,OAAO,+BAA+B,gBAAgB,SAAS;CAC5G,OAAO;AACT;AAEA,SAAS,aAAa,MAAyC;CAC7D,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,IAAI,KAAK,SAAS,gBAAgB,SAAS,OAAO,8BAA8B,gBAAgB,QAAQ;CACxG,OAAO;AACT;AAEA,SAAS,uBAAuB,QAA2C;CACzE,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,IAAI,OAAO,SAAS,gBAAgB,mBAClC,OAAO,wCAAwC,gBAAgB,kBAAkB;CAMnF,IAAI,CAAC,OAAO,WAAW,GAAG,KAAK,OAAO,WAAW,IAAI,GACnD,OAAO;CAET,OAAO;AACT;AAEA,SAAS,mBAAmB,YAAoC;CAC9D,IAAI,eAAe,KAAA,GAAW,OAAO;CACrC,IAAI;CACJ,IAAI;EACF,aAAa,KAAK,UAAU,UAAU;CACxC,SAAS,KAAK;EACZ,OAAO,wCAAwC,OAAO,GAAG;CAC3D;CAIA,IAAI,OAAO,eAAe,UAAU,OAAO;CAC3C,IAAI,WAAW,SAAS,gBAAgB,oBACtC,OAAO,2BAA2B,gBAAgB,mBAAmB;CAEvE,OAAO;AACT;AAEA,SAAS,wBAAwB,OAAoC;CACnE,IAAI,MAAM,cAAc,UAAU,OAAO;CACzC,IAAI,MAAM,aAAa,QACrB,OAAO;CAET,IAAI,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe,WAAW,GAC9E,OAAO;CAET,OAAO;AACT;;;;;AAMA,SAAgB,qBAAqB,OAAoC;CACvE,OACE,cAAc,MAAM,KAAK,KACzB,aAAa,MAAM,IAAI,KACvB,uBAAuB,MAAM,cAAc,KAC3C,mBAAmB,MAAM,UAAU,KACnC,wBAAwB,KAAK;AAEjC;;;ACjCA,IAAM,WAA2B;CAAE,YAAY,CAAC;CAAG,aAAa,CAAC;AAAE;AAEnE,IAAI,SAAgC;AACpC,IAAI,iBAAiB;AACrB,IAAI,kBAAkB;AAEtB,SAAS,SAAyB;CAChC,OAAO,QAAQ,OAAO;AACxB;;;;;AAMA,SAAgB,kBAAkB,UAAgC;CAChE,SAAS;AACX;AAYA,IAAM,YAAqC,CAAC;;;AAI5C,SAAgB,QAAQ,UAA6C;CACnE,UAAU,KAAK,QAAQ;CACvB,aAAa;EACX,MAAM,MAAM,UAAU,QAAQ,QAAQ;EACtC,IAAI,OAAO,GAAG,UAAU,OAAO,KAAK,CAAC;CACvC;AACF;AAEA,SAAS,KAAK,OAA4B;CAOxC,KAAK,MAAM,YAAY,WACrB,IAAI;EACF,SAAS,KAAK;CAChB,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,8BAA8B;GAAE,MAAM,MAAM;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CACvF;CAEF,IAAI,CAAC,QAAQ;EACX,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,MAAM,KAAK,CAAC;EACtD;CACF;CACA,IAAI;EACF,OAAO,aAAa,KAAK;CAC3B,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,eAAe;GAAE,MAAM,MAAM;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CACxE;AACF;AA2BA,IAAI,UAAU;AACd,IAAI,UAAoB,CAAC;;;;;AAMzB,SAAgB,qBAAqB,OAAkD;CACrF,iBAAiB,MAAM;CACvB,kBAAkB,MAAM;CACxB,UAAU;CACV,UAAU,CAAC;AACb;;AAGA,SAAgB,gBAAsB;CACpC,SAAS;CACT,iBAAiB;CACjB,kBAAkB;CAClB,UAAU;CACV,UAAU,CAAC;CACX,UAAU,SAAS;AACrB;AAEA,SAAS,mBAA8B;CACrC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,0CAA0C;CACvE,OAAO,OAAO;AAChB;AAEA,SAAS,oBAAoB,OAAiB,OAAuC;CACnF,OAAO,MAAM,KAAK,WAAW;EAC3B,IAAI;GACF,OAAO;IAAE,IAAI;IAAM,SAAS,OAAO,OAAO,KAAK;GAAE;EACnD,SAAS,KAAK;GACZ,OAAO;IAAE,IAAI;IAAO,OAAO;GAAI;EACjC;CACF,CAAC;AACH;AAEA,SAAS,cAAc,SAA4C;CACjE,MAAM,SAA0B,CAAC;CACjC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK;CAE5E,OAAO;AACT;AAEA,SAAS,sBAAsB,SAAmD;CAChF,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,MAAM,OAAO,YAAY,QAAQ,OAAO,QAAQ,cACzD,QAAQ,KAAK,OAAO,QAAQ,YAAY;CAG5C,OAAO;AACT;AAEA,SAAS,YAAY,OAAiB,SAAiC;CAGrE,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;EACpD,MAAM,SAAS,QAAQ;EACvB,IAAI,OAAO,IAAI,MAAM,OAAO,QAAQ;OAC/B,MAAM,OAAO,OAAO,OAAO,KAAK;CACvC;AACF;AAEA,SAAS,YAAY,OAAiB,KAAoB;CACxD,KAAK,MAAM,UAAU,OAAO,OAAO,OAAO,GAAG;AAC/C;AAEA,eAAe,eAAe,YAAmD;CAC/E,MAAM,WAAW,MAAM,YAAY,eAAe;CAGlD,MAAM,SAAS,CAAC,GAAG,WAAW,MAAM,EAAE,QAAQ,GAAG,GAAG,SAAS,OAAO,EAAE,MAAM,GAAA,EAAc;CAC1F,MAAM,YAAY,iBAAiB,GAAG,iBAAiB,EAAE,SAAS,OAAO,CAAC;AAC5E;AAEA,eAAe,aAAa,OAAgC;CAC1D,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,WAAW,cAAc;CACzC,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,eAAe,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;EACpD,YAAY,OAAO,GAAG;EACtB;CACF;CACA,MAAM,UAAU,oBAAoB,OAAO,KAAK;CAChD,MAAM,SAAS,cAAc,OAAO;CACpC,MAAM,iBAAiB,sBAAsB,OAAO;CAEpD,IAAI,OAAO,SAAS,GAAG;EACrB,IAAI;GACF,MAAM,WAAW,iBAAiB,GAAG,gBAAgB,KAAK;EAC5D,SAAS,KAAK;GACZ,OAAO,EAAE,MAAM,uBAAuB,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;GAC5D,YAAY,OAAO,GAAG;GACtB;EACF;EACA,IAAI,eAAe,SAAS,GAI1B,IAAI;GACF,MAAM,eAAe,cAAc;EACrC,SAAS,KAAK;GACZ,OAAO,EAAE,MAAM,wBAAwB,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;EAC/D;EAEF,KAAK,MAAM,SAAS,QAAQ,KAAK,KAAK;CACxC;CACA,YAAY,OAAO,OAAO;AAC5B;AAEA,eAAe,QAAuB;CACpC,UAAU;CACV,IAAI;EACF,OAAO,QAAQ,SAAS,GAAG;GACzB,MAAM,QAAQ;GACd,UAAU,CAAC;GACX,MAAM,aAAa,KAAK;EAC1B;CACF,UAAU;EACR,UAAU;CACZ;AACF;AAEA,SAAS,QAAQ,QAAiC;CAChD,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,QAAQ,KAAK;GAAE;GAAQ;GAAS;EAAO,CAAC;EACxC,IAAI,CAAC,SAAS,MAAW;CAC3B,CAAC;AACH;AAEA,SAAS,YAAY,OAAqB,SAA0C;CAElF,MAAM,GAAG,UAAU,WAAW,GAAG,cAAc,MAAM;CACrD,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAsB,cAA6D;CAC5G,OAAO;EAAE,GAAG;EAAO;EAAc,6BAAY,IAAI,KAAK,GAAE,YAAY;CAAE;AACxE;AAIA,eAAsB,QAA+B,OAA2D;CAG9G,MAAM,kBAAkB,qBAAqB,KAAqB;CAClE,IAAI,iBACF,MAAM,IAAI,MAAM,qBAAqB,iBAAiB;CAExD,MAAM,WAAA,GAAA,YAAA,YAAqB;CAC3B,MAAM,QAAoC;EACxC,IAAI;EACJ,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,MAAM,MAAM;EACZ,gBAAgB,MAAM;EACtB,YAAY,MAAM;EAClB,4BAAW,IAAI,KAAK,GAAE,YAAY;CACpC;CACA,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,WAAW;EACzB,OAAO,EAAE,OAAO;GAAE,MAAM;GAAoB;EAAuB,EAAE;CACvE,CAAC;CACD,OAAO,EAAE,IAAI,QAAQ;AACvB;AAEA,eAAsB,MAAM,SAAgC;CAC1D,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAW,IAAI;GAAQ;GACtC,cAAc,kBAAkB,OAAO,SAAS;EAClD;CACF,CAAC;AACH;AAEA,eAAsB,OAAO,SAAgC;CAC3D,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAa,IAAI;GAAQ;GACxC,cAAc,kBAAkB,OAAO,WAAW;EACpD;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,gBACpB,WACA,SACA,OAOe;CACf,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,cAAc,WAAW,OAAO;EAC1C,MAAM,OAAsB;GAC1B,GAAG;GACH,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC1D,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;GACvD,GAAI,MAAM,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;GACrF,GAAI,MAAM,eAAe,KAAA,IAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;EAC3E;EAGA,MAAM,kBAAkB,qBAAqB;GAC3C,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,gBAAgB,KAAK;GACrB,YAAY,KAAK;EACnB,CAAC;EACD,IAAI,iBAAiB;GACnB,OAAO,EAAE,KAAK,iCAAiC;IAAE;IAAS;IAAW,OAAO;GAAgB,CAAC;GAC7F,OAAO;EACT;EACA,MAAM,QAAQ,WAAW;EACzB,OAAO,EAAE,OAAO;GAAE,MAAM;GAAW,OAAO;EAAK,EAAE;CACnD,CAAC;AACH;;;;;AAMA,eAAsB,aAAa,WAAmB,SAAqD;CAEzG,MAAM,SAAQ,MADM,WAAW,cAAc,GACzB,QAAQ;CAC5B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI,MAAM,cAAc,WAAW,OAAO,KAAA;CAC1C,OAAO;AACT;;;;AAKA,eAAsB,eAAe,WAAmB,SAAgC;CACtF,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,cAAc,WAAW,OAAO;EAC1C,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAW,IAAI;GAAQ;GACtC,cAAc,kBAAkB,OAAO,SAAS;EAClD;CACF,CAAC;AACH;AAEA,eAAsB,IAAI,SAAqD;CAE7E,QAAO,MADa,WAAW,cAAc,GAChC,QAAQ;AACvB;AAEA,eAAsB,QAAQ,WAA6C;CACzE,MAAM,QAAQ,MAAM,WAAW,cAAc;CAC7C,OAAO,OAAO,OAAO,MAAM,OAAO,EAAE,QAAQ,UAAU,MAAM,cAAc,SAAS;AACrF;AAEA,eAAsB,UAAoC;CACxD,MAAM,QAAQ,MAAM,WAAW,cAAc;CAC7C,OAAO,OAAO,OAAO,MAAM,OAAO;AACpC;AAEA,eAAsB,cAA+C;CAEnE,QAAO,MADa,YAAY,eAAe,GAClC;AACf"}

package/dist/notifier/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types.js';
+export * from './engine.js';
+export type { WriteJson } from './store.js';

package/dist/notifier/index.js

@@ -0,0 +1,464 @@
+import { promises } from "node:fs";
+import { randomUUID } from "node:crypto";
+//#region src/notifier/types.ts
+/** Two notification shapes, distinguished by who fires the close call:
+*
+*    `fyi`    — informational. The host (bell panel) clears it when the
+*               user dismisses the row. No deep-link target.
+*    `action` — pending obligation. The plugin clears it when the
+*               underlying domain state changes (the user paid the tax,
+*               viewed the digest, etc.). The bell row navigates to
+*               `navigateTarget` on click.
+*
+*  The engine reads `lifecycle` only to enforce two publish-time rules
+*  (everything downstream — pubsub fan-out, persistence, history — is
+*  lifecycle-blind):
+*
+*    1. `action` requires a non-empty `navigateTarget`. Without one,
+*       clicking the row does nothing and the entry is a degraded fyi.
+*    2. `action` cannot use `info` severity. A low-priority obligation
+*       is incoherent — fyi if it's a ping, `nudge`/`urgent` if it's a
+*       real obligation worth a landing page.
+*
+*  Both rules are mirrored in the HTTP layer so plugin-runtime callers
+*  and HTTP callers hit the same wall. */
+var NOTIFIER_LIFECYCLES = ["fyi", "action"];
+/** Severity drives badge color (gray / amber / red, worst-wins) and
+*  in a future iteration channel routing. Mostly stored verbatim by
+*  the engine; the one engine-visible interaction is the rule that
+*  `action` lifecycle cannot pair with `info` severity (see
+*  `NotifierLifecycle` above). */
+var NOTIFIER_SEVERITIES = [
+	"info",
+	"nudge",
+	"urgent"
+];
+/** History size cap. The bell popup's History section renders this
+*  many entries; older ones fall off when new terminations land. */
+var HISTORY_CAP = 50;
+//#endregion
+//#region src/notifier/store.ts
+function isNotFoundError(err) {
+	return typeof err === "object" && err !== null && err.code === "ENOENT";
+}
+/** Read the active-entries file. Returns an empty store when the file
+*  doesn't exist yet (first ever call on a fresh workspace). Any other
+*  read or parse failure throws — the caller has to decide whether to
+*  surface or recover, since silently treating "malformed file" as
+*  "no entries" would lose data. */
+async function loadActive(filePath) {
+	let text;
+	try {
+		text = await promises.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (isNotFoundError(err)) return { entries: {} };
+		throw err;
+	}
+	const parsed = JSON.parse(text);
+	if (typeof parsed !== "object" || parsed === null || !("entries" in parsed)) throw new Error(`notifier: malformed active.json at ${filePath}`);
+	const { entries } = parsed;
+	if (typeof entries !== "object" || entries === null || Array.isArray(entries)) throw new Error(`notifier: malformed active.json at ${filePath}`);
+	return parsed;
+}
+/** Write the active-entries file via the injected atomic writer so a
+*  half-written file is never visible to readers. The caller serialises
+*  writes (engine.ts queues mutations) — this function makes no
+*  concurrency guarantees of its own. */
+async function saveActive(writeJson, filePath, state) {
+	await writeJson(filePath, state);
+}
+/** Read the history file. Empty array on first run. Same parse-error
+*  policy as `loadActive`. */
+async function loadHistory(filePath) {
+	let text;
+	try {
+		text = await promises.readFile(filePath, "utf-8");
+	} catch (err) {
+		if (isNotFoundError(err)) return { entries: [] };
+		throw err;
+	}
+	const parsed = JSON.parse(text);
+	if (typeof parsed !== "object" || parsed === null || !("entries" in parsed) || !Array.isArray(parsed.entries)) throw new Error(`notifier: malformed history.json at ${filePath}`);
+	return parsed;
+}
+async function saveHistory(writeJson, filePath, state) {
+	await writeJson(filePath, state);
+}
+//#endregion
+//#region src/notifier/validate.ts
+/** Hard caps on publish-input fields. The engine reads each entry on
+*  every list/get call (no in-memory cache), so unbounded fields hurt
+*  every reader. Caps chosen to be generous for legitimate UX copy
+*  while bounding active.json growth: a notification fundamentally is
+*  a short blurb, not a document. */
+var NOTIFIER_LIMITS = {
+	titleMax: 200,
+	bodyMax: 4e3,
+	navigateTargetMax: 1e3,
+	pluginDataMaxBytes: 16 * 1024
+};
+function validateTitle(title) {
+	if (typeof title !== "string" || title.length === 0) return "title must be a non-empty string";
+	if (title.length > NOTIFIER_LIMITS.titleMax) return `title exceeds max length of ${NOTIFIER_LIMITS.titleMax} chars`;
+	return null;
+}
+function validateBody(body) {
+	if (body === void 0) return null;
+	if (body.length > NOTIFIER_LIMITS.bodyMax) return `body exceeds max length of ${NOTIFIER_LIMITS.bodyMax} chars`;
+	return null;
+}
+function validateNavigateTarget(target) {
+	if (target === void 0) return null;
+	if (target.length === 0) return "navigateTarget must be a non-empty relative path when set";
+	if (target.length > NOTIFIER_LIMITS.navigateTargetMax) return `navigateTarget exceeds max length of ${NOTIFIER_LIMITS.navigateTargetMax} chars`;
+	if (!target.startsWith("/") || target.startsWith("//")) return "navigateTarget must be a relative path beginning with a single '/' (no scheme, no '//')";
+	return null;
+}
+function validatePluginData(pluginData) {
+	if (pluginData === void 0) return null;
+	let serialized;
+	try {
+		serialized = JSON.stringify(pluginData);
+	} catch (err) {
+		return `pluginData is not JSON-serialisable: ${String(err)}`;
+	}
+	if (typeof serialized !== "string") return "pluginData is not JSON-serialisable";
+	if (serialized.length > NOTIFIER_LIMITS.pluginDataMaxBytes) return `pluginData JSON exceeds ${NOTIFIER_LIMITS.pluginDataMaxBytes} bytes`;
+	return null;
+}
+function validateActionCoherence(input) {
+	if (input.lifecycle !== "action") return null;
+	if (input.severity === "info") return "action lifecycle is incompatible with info severity (use fyi for low-priority pings)";
+	if (typeof input.navigateTarget !== "string" || input.navigateTarget.length === 0) return "action lifecycle requires a non-empty navigateTarget";
+	return null;
+}
+/** Validate a `PublishInput`. Returns `null` if OK, or a
+*  human-readable error string. Order matters — shape/size errors are
+*  reported before lifecycle/severity coherence errors so the message
+*  the caller sees points at the most fundamental problem first. */
+function validatePublishInput(input) {
+	return validateTitle(input.title) ?? validateBody(input.body) ?? validateNavigateTarget(input.navigateTarget) ?? validatePluginData(input.pluginData) ?? validateActionCoherence(input);
+}
+//#endregion
+//#region src/notifier/engine.ts
+var NOOP_LOG = {
+	warn: () => {},
+	error: () => {}
+};
+var config = null;
+var activeFilePath = "";
+var historyFilePath = "";
+function logger() {
+	return config?.log ?? NOOP_LOG;
+}
+/** Wire the engine's I/O deps. Call once at startup, before the first
+*  mutation. Does NOT set file paths — those are set independently via
+*  `setNotifierFilePaths` so a host can bind production paths at module
+*  load and a test can override them without re-supplying the deps. */
+function configureNotifier(injected) {
+	config = injected;
+}
+var listeners = [];
+/** Register an in-process listener for engine events. Returns an
+*  unsubscribe function the caller can use during teardown. */
+function onEvent(listener) {
+	listeners.push(listener);
+	return () => {
+		const idx = listeners.indexOf(listener);
+		if (idx >= 0) listeners.splice(idx, 1);
+	};
+}
+function emit(event) {
+	for (const listener of listeners) try {
+		listener(event);
+	} catch (err) {
+		logger().error("in-process listener failed", {
+			type: event.type,
+			error: String(err)
+		});
+	}
+	if (!config) {
+		logger().warn("emit before init", { type: event.type });
+		return;
+	}
+	try {
+		config.publishEvent(event);
+	} catch (err) {
+		logger().error("emit failed", {
+			type: event.type,
+			error: String(err)
+		});
+	}
+}
+var writing = false;
+var waiters = [];
+/** Point the engine at its active/history files. Resets the write
+*  queue, so callers must not have in-flight mutations. The host calls
+*  this once with the workspace paths; tests call it per-case with temp
+*  files. */
+function setNotifierFilePaths(paths) {
+	activeFilePath = paths.active;
+	historyFilePath = paths.history;
+	writing = false;
+	waiters = [];
+}
+/** Test-only: clear config + queue so each suite starts clean. */
+function resetNotifier() {
+	config = null;
+	activeFilePath = "";
+	historyFilePath = "";
+	writing = false;
+	waiters = [];
+	listeners.length = 0;
+}
+function requireWriteJson() {
+	if (!config) throw new Error("notifier: configureNotifier() not called");
+	return config.writeJson;
+}
+function applyBatchMutations(batch, state) {
+	return batch.map((waiter) => {
+		try {
+			return {
+				ok: true,
+				outcome: waiter.mutate(state)
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: err
+			};
+		}
+	});
+}
+function collectEvents(results) {
+	const events = [];
+	for (const result of results) if (result.ok && result.outcome !== null) events.push(result.outcome.event);
+	return events;
+}
+function collectHistoryEntries(results) {
+	const entries = [];
+	for (const result of results) if (result.ok && result.outcome !== null && result.outcome.historyEntry) entries.push(result.outcome.historyEntry);
+	return entries;
+}
+function settleBatch(batch, results) {
+	for (let index = 0; index < batch.length; index += 1) {
+		const result = results[index];
+		if (result.ok) batch[index].resolve();
+		else batch[index].reject(result.error);
+	}
+}
+function rejectBatch(batch, err) {
+	for (const waiter of batch) waiter.reject(err);
+}
+async function persistHistory(newEntries) {
+	const existing = await loadHistory(historyFilePath);
+	const merged = [...newEntries.slice().reverse(), ...existing.entries].slice(0, 50);
+	await saveHistory(requireWriteJson(), historyFilePath, { entries: merged });
+}
+async function processBatch(batch) {
+	let state;
+	try {
+		state = await loadActive(activeFilePath);
+	} catch (err) {
+		logger().error("load failed", { error: String(err) });
+		rejectBatch(batch, err);
+		return;
+	}
+	const results = applyBatchMutations(batch, state);
+	const events = collectEvents(results);
+	const historyEntries = collectHistoryEntries(results);
+	if (events.length > 0) {
+		try {
+			await saveActive(requireWriteJson(), activeFilePath, state);
+		} catch (err) {
+			logger().error("active write failed", { error: String(err) });
+			rejectBatch(batch, err);
+			return;
+		}
+		if (historyEntries.length > 0) try {
+			await persistHistory(historyEntries);
+		} catch (err) {
+			logger().error("history write failed", { error: String(err) });
+		}
+		for (const event of events) emit(event);
+	}
+	settleBatch(batch, results);
+}
+async function drain() {
+	writing = true;
+	try {
+		while (waiters.length > 0) {
+			const batch = waiters;
+			waiters = [];
+			await processBatch(batch);
+		}
+	} finally {
+		writing = false;
+	}
+}
+function enqueue(mutate) {
+	return new Promise((resolve, reject) => {
+		waiters.push({
+			mutate,
+			resolve,
+			reject
+		});
+		if (!writing) drain();
+	});
+}
+function removeEntry(state, entryId) {
+	const { [entryId]: __removed, ...remaining } = state.entries;
+	return remaining;
+}
+function buildHistoryEntry(entry, terminalType) {
+	return {
+		...entry,
+		terminalType,
+		terminalAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+}
+async function publish(input) {
+	const validationError = validatePublishInput(input);
+	if (validationError) throw new Error(`notifier.publish: ${validationError}`);
+	const entryId = randomUUID();
+	const entry = {
+		id: entryId,
+		pluginPkg: input.pluginPkg,
+		severity: input.severity,
+		lifecycle: input.lifecycle,
+		title: input.title,
+		body: input.body,
+		navigateTarget: input.navigateTarget,
+		pluginData: input.pluginData,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await enqueue((state) => {
+		state.entries[entryId] = entry;
+		return { event: {
+			type: "published",
+			entry
+		} };
+	});
+	return { id: entryId };
+}
+async function clear(entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cleared",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cleared")
+		};
+	});
+}
+async function cancel(entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cancelled",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cancelled")
+		};
+	});
+}
+/** In-place update for an active entry. Only the fields present on
+*  `patch` are rewritten; `id`, `pluginPkg`, `lifecycle`, and
+*  `createdAt` stay fixed. Emits a single `"updated"` event with the
+*  post-mutation entry — no history record is written because the
+*  entry is still active, just with refreshed content.
+*
+*  No-ops (no throw) when the id is unknown, the entry belongs to a
+*  different plugin, or the merged shape would violate
+*  `validatePublishInput`. The silent skip matches `clearForPlugin`'s
+*  isolation semantics; validation failures are logged for diagnosis. */
+async function updateForPlugin(pluginPkg, entryId, patch) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		if (entry.pluginPkg !== pluginPkg) return null;
+		const next = {
+			...entry,
+			...patch.severity !== void 0 ? { severity: patch.severity } : {},
+			...patch.title !== void 0 ? { title: patch.title } : {},
+			...patch.body !== void 0 ? { body: patch.body } : {},
+			...patch.navigateTarget !== void 0 ? { navigateTarget: patch.navigateTarget } : {},
+			...patch.pluginData !== void 0 ? { pluginData: patch.pluginData } : {}
+		};
+		const validationError = validatePublishInput({
+			pluginPkg: next.pluginPkg,
+			severity: next.severity,
+			title: next.title,
+			body: next.body,
+			lifecycle: next.lifecycle,
+			navigateTarget: next.navigateTarget,
+			pluginData: next.pluginData
+		});
+		if (validationError) {
+			logger().warn("update rejected by validation", {
+				entryId,
+				pluginPkg,
+				error: validationError
+			});
+			return null;
+		}
+		state.entries[entryId] = next;
+		return { event: {
+			type: "updated",
+			entry: next
+		} };
+	});
+}
+/** Plugin-scoped point lookup. Returns the entry by id, but only if it
+*  belongs to the caller's plugin; otherwise undefined. Cross-plugin
+*  reads return undefined for isolation — same property as
+*  `clearForPlugin` / `updateForPlugin`. */
+async function getForPlugin(pluginPkg, entryId) {
+	const entry = (await loadActive(activeFilePath)).entries[entryId];
+	if (!entry) return void 0;
+	if (entry.pluginPkg !== pluginPkg) return void 0;
+	return entry;
+}
+/** Plugin-scoped clear. Same as `clear` but no-ops if the entry's
+*  `pluginPkg` doesn't match the caller's, so a plugin can't dismiss
+*  another plugin's notification by guessing or scraping its id. */
+async function clearForPlugin(pluginPkg, entryId) {
+	await enqueue((state) => {
+		const entry = state.entries[entryId];
+		if (!entry) return null;
+		if (entry.pluginPkg !== pluginPkg) return null;
+		state.entries = removeEntry(state, entryId);
+		return {
+			event: {
+				type: "cleared",
+				id: entryId
+			},
+			historyEntry: buildHistoryEntry(entry, "cleared")
+		};
+	});
+}
+async function get(entryId) {
+	return (await loadActive(activeFilePath)).entries[entryId];
+}
+async function listFor(pluginPkg) {
+	const state = await loadActive(activeFilePath);
+	return Object.values(state.entries).filter((entry) => entry.pluginPkg === pluginPkg);
+}
+async function listAll() {
+	const state = await loadActive(activeFilePath);
+	return Object.values(state.entries);
+}
+async function listHistory() {
+	return (await loadHistory(historyFilePath)).entries;
+}
+//#endregion
+export { HISTORY_CAP, NOTIFIER_LIFECYCLES, NOTIFIER_LIMITS, NOTIFIER_SEVERITIES, cancel, clear, clearForPlugin, configureNotifier, get, getForPlugin, listAll, listFor, listHistory, onEvent, publish, resetNotifier, setNotifierFilePaths, updateForPlugin, validatePublishInput };
+
+//# sourceMappingURL=index.js.map

package/dist/notifier/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/notifier/types.ts","../../src/notifier/store.ts","../../src/notifier/validate.ts","../../src/notifier/engine.ts"],"sourcesContent":["// Notifier value types. Kept dependency-free (no node, no fs, no\n// pubsub) so the host's API-route layer and any future browser\n// consumer can validate inbound payloads against the same enum\n// constants the engine accepts without pulling in the engine's I/O.\n\n/** Two notification shapes, distinguished by who fires the close call:\n *\n *    `fyi`    — informational. The host (bell panel) clears it when the\n *               user dismisses the row. No deep-link target.\n *    `action` — pending obligation. The plugin clears it when the\n *               underlying domain state changes (the user paid the tax,\n *               viewed the digest, etc.). The bell row navigates to\n *               `navigateTarget` on click.\n *\n *  The engine reads `lifecycle` only to enforce two publish-time rules\n *  (everything downstream — pubsub fan-out, persistence, history — is\n *  lifecycle-blind):\n *\n *    1. `action` requires a non-empty `navigateTarget`. Without one,\n *       clicking the row does nothing and the entry is a degraded fyi.\n *    2. `action` cannot use `info` severity. A low-priority obligation\n *       is incoherent — fyi if it's a ping, `nudge`/`urgent` if it's a\n *       real obligation worth a landing page.\n *\n *  Both rules are mirrored in the HTTP layer so plugin-runtime callers\n *  and HTTP callers hit the same wall. */\nexport const NOTIFIER_LIFECYCLES = [\"fyi\", \"action\"] as const;\nexport type NotifierLifecycle = (typeof NOTIFIER_LIFECYCLES)[number];\n\n/** Severity drives badge color (gray / amber / red, worst-wins) and\n *  in a future iteration channel routing. Mostly stored verbatim by\n *  the engine; the one engine-visible interaction is the rule that\n *  `action` lifecycle cannot pair with `info` severity (see\n *  `NotifierLifecycle` above). */\nexport const NOTIFIER_SEVERITIES = [\"info\", \"nudge\", \"urgent\"] as const;\nexport type NotifierSeverity = (typeof NOTIFIER_SEVERITIES)[number];\n\nexport interface NotifierEntry<TPluginData = unknown> {\n  /** Engine-assigned UUID. Generated synchronously inside `publish()`\n   *  so the caller can use it before persistence completes. */\n  id: string;\n  /** Plugin namespace (e.g. `\"encore\"`, `\"debug__system\"`). The\n   *  engine never inspects it — used only for `listFor()` filtering\n   *  and as a UI grouping key. */\n  pluginPkg: string;\n  severity: NotifierSeverity;\n  lifecycle?: NotifierLifecycle;\n  title: string;\n  body?: string;\n  /** Optional in-app deep-link target (relative URL). The bell popup\n   *  routes here on row click, with `&notificationId=<id>` appended\n   *  so the landing page can identify which entry to clear. The\n   *  engine doesn't read this — it's a UI hint stored on the entry. */\n  navigateTarget?: string;\n  /** Opaque to the engine. Round-trips through JSON unchanged; only\n   *  the originating plugin's UI knows the shape. */\n  pluginData?: TPluginData;\n  /** ISO-8601 timestamp set at `publish()` time. */\n  createdAt: string;\n}\n\n/** A history entry — a `NotifierEntry` after it has been cleared or\n *  cancelled, with the terminal type and timestamp recorded. The\n *  bell popup's \"History\" section renders these read-only. */\nexport interface NotifierHistoryEntry<TPluginData = unknown> extends NotifierEntry<TPluginData> {\n  terminalType: \"cleared\" | \"cancelled\";\n  terminalAt: string;\n}\n\n/** Caller-supplied input for `publish()`. The engine fills in `id`\n *  and `createdAt`; everything else flows through verbatim.\n *\n *  Two publish-time rules apply to `action` lifecycle (see\n *  `NotifierLifecycle`):\n *\n *    - `navigateTarget` MUST be a non-empty string.\n *    - `severity` MUST NOT be `\"info\"`.\n *\n *  Violations cause `publish()` to throw. Currently expressed as\n *  runtime validation rather than a discriminated-union type, so the\n *  fields below are all individually optional / loose at the\n *  type-level. */\nexport interface PublishInput<TPluginData = unknown> {\n  pluginPkg: string;\n  severity: NotifierSeverity;\n  title: string;\n  body?: string;\n  lifecycle?: NotifierLifecycle;\n  navigateTarget?: string;\n  pluginData?: TPluginData;\n}\n\n/** On-disk shape of `~/mulmoclaude/data/notifier/active.json`. Holds\n *  only entries that haven't been cleared or cancelled — the file is\n *  a snapshot, not an event log. */\nexport interface NotifierFile {\n  entries: Record<string, NotifierEntry>;\n}\n\n/** On-disk shape of `~/mulmoclaude/data/notifier/history.json`. Array\n *  of terminated entries newest-first, capped at `HISTORY_CAP` with\n *  FIFO eviction (push at index 0, slice from the tail). */\nexport interface NotifierHistoryFile {\n  entries: NotifierHistoryEntry[];\n}\n\n/** History size cap. The bell popup's History section renders this\n *  many entries; older ones fall off when new terminations land. */\nexport const HISTORY_CAP = 50;\n\n/** Pub-sub event published on the host's notifier channel after every\n *  successful state change. Discriminated union — subscribers switch\n *  on `type` to keep TypeScript narrowing the rest of the payload.\n *\n *  `updated` carries the post-mutation entry — the receiver swaps\n *  the matching `id` in their local active set. Reserved for in-\n *  place edits via `updateForPlugin`; no history record is written\n *  because the entry is still active, just with refreshed content. */\nexport type NotifierEvent =\n  | { type: \"published\"; entry: NotifierEntry }\n  | { type: \"cleared\"; id: string }\n  | { type: \"cancelled\"; id: string }\n  | { type: \"updated\"; entry: NotifierEntry };\n","// Low-level file I/O for the notifier. Reads use node:fs directly;\n// writes go through an injected atomic-JSON writer (the host owns the\n// rename-based atomic write so it stays single-sourced with its other\n// writers). Kept separate from `engine.ts` so the path can be\n// overridden in tests without monkey-patching.\n\nimport { promises as fsPromises } from \"node:fs\";\nimport type { NotifierFile, NotifierHistoryFile } from \"./types.js\";\n\n/** Injected atomic JSON writer — the host's `writeJsonAtomic`. */\nexport type WriteJson = (filePath: string, data: unknown) => Promise<void>;\n\nfunction isNotFoundError(err: unknown): boolean {\n  return typeof err === \"object\" && err !== null && (err as { code?: unknown }).code === \"ENOENT\";\n}\n\n/** Read the active-entries file. Returns an empty store when the file\n *  doesn't exist yet (first ever call on a fresh workspace). Any other\n *  read or parse failure throws — the caller has to decide whether to\n *  surface or recover, since silently treating \"malformed file\" as\n *  \"no entries\" would lose data. */\nexport async function loadActive(filePath: string): Promise<NotifierFile> {\n  let text: string;\n  try {\n    text = await fsPromises.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if (isNotFoundError(err)) return { entries: {} };\n    throw err;\n  }\n  const parsed: unknown = JSON.parse(text);\n  // `typeof null === \"object\"` and `Array.isArray([])` is also true,\n  // so a naive `typeof entries !== \"object\"` check would let\n  // `{ entries: null }` and `{ entries: [] }` through, which then\n  // crash downstream `engine.get` / `list*` mutations. Reject both\n  // shapes here at load time so the failure surfaces as a clear\n  // \"malformed file\" error.\n  if (typeof parsed !== \"object\" || parsed === null || !(\"entries\" in parsed)) {\n    throw new Error(`notifier: malformed active.json at ${filePath}`);\n  }\n  const { entries } = parsed as { entries: unknown };\n  if (typeof entries !== \"object\" || entries === null || Array.isArray(entries)) {\n    throw new Error(`notifier: malformed active.json at ${filePath}`);\n  }\n  return parsed as NotifierFile;\n}\n\n/** Write the active-entries file via the injected atomic writer so a\n *  half-written file is never visible to readers. The caller serialises\n *  writes (engine.ts queues mutations) — this function makes no\n *  concurrency guarantees of its own. */\nexport async function saveActive(writeJson: WriteJson, filePath: string, state: NotifierFile): Promise<void> {\n  await writeJson(filePath, state);\n}\n\n/** Read the history file. Empty array on first run. Same parse-error\n *  policy as `loadActive`. */\nexport async function loadHistory(filePath: string): Promise<NotifierHistoryFile> {\n  let text: string;\n  try {\n    text = await fsPromises.readFile(filePath, \"utf-8\");\n  } catch (err) {\n    if (isNotFoundError(err)) return { entries: [] };\n    throw err;\n  }\n  const parsed: unknown = JSON.parse(text);\n  if (typeof parsed !== \"object\" || parsed === null || !(\"entries\" in parsed) || !Array.isArray((parsed as { entries: unknown }).entries)) {\n    throw new Error(`notifier: malformed history.json at ${filePath}`);\n  }\n  return parsed as NotifierHistoryFile;\n}\n\nexport async function saveHistory(writeJson: WriteJson, filePath: string, state: NotifierHistoryFile): Promise<void> {\n  await writeJson(filePath, state);\n}\n","// Publish-input validation — pure, dependency-free. Shared by\n// `engine.publish` (throws on error) and the host's HTTP route\n// (returns 400 on error). Single source of truth so plugin-runtime\n// callers and HTTP callers can't drift.\n\nimport type { PublishInput } from \"./types.js\";\n\n/** Hard caps on publish-input fields. The engine reads each entry on\n *  every list/get call (no in-memory cache), so unbounded fields hurt\n *  every reader. Caps chosen to be generous for legitimate UX copy\n *  while bounding active.json growth: a notification fundamentally is\n *  a short blurb, not a document. */\nexport const NOTIFIER_LIMITS = {\n  titleMax: 200,\n  bodyMax: 4000,\n  navigateTargetMax: 1000,\n  pluginDataMaxBytes: 16 * 1024,\n} as const;\n\nfunction validateTitle(title: string): string | null {\n  if (typeof title !== \"string\" || title.length === 0) return \"title must be a non-empty string\";\n  if (title.length > NOTIFIER_LIMITS.titleMax) return `title exceeds max length of ${NOTIFIER_LIMITS.titleMax} chars`;\n  return null;\n}\n\nfunction validateBody(body: string | undefined): string | null {\n  if (body === undefined) return null;\n  if (body.length > NOTIFIER_LIMITS.bodyMax) return `body exceeds max length of ${NOTIFIER_LIMITS.bodyMax} chars`;\n  return null;\n}\n\nfunction validateNavigateTarget(target: string | undefined): string | null {\n  if (target === undefined) return null;\n  if (target.length === 0) return \"navigateTarget must be a non-empty relative path when set\";\n  if (target.length > NOTIFIER_LIMITS.navigateTargetMax) {\n    return `navigateTarget exceeds max length of ${NOTIFIER_LIMITS.navigateTargetMax} chars`;\n  }\n  // Must be a same-origin relative path. Reject schemes\n  // (`javascript:`, `https://...`) and scheme-relative URLs\n  // (`//evil.com/...`, which an `<a href>` would resolve to the\n  // attacker's origin). One leading \"/\" only.\n  if (!target.startsWith(\"/\") || target.startsWith(\"//\")) {\n    return \"navigateTarget must be a relative path beginning with a single '/' (no scheme, no '//')\";\n  }\n  return null;\n}\n\nfunction validatePluginData(pluginData: unknown): string | null {\n  if (pluginData === undefined) return null;\n  let serialized: string | undefined;\n  try {\n    serialized = JSON.stringify(pluginData);\n  } catch (err) {\n    return `pluginData is not JSON-serialisable: ${String(err)}`;\n  }\n  // `JSON.stringify` returns `undefined` for non-serialisable roots\n  // (e.g. a bare function or symbol). Treat that as a serialisation\n  // failure so it doesn't slip through as an empty-string size.\n  if (typeof serialized !== \"string\") return \"pluginData is not JSON-serialisable\";\n  if (serialized.length > NOTIFIER_LIMITS.pluginDataMaxBytes) {\n    return `pluginData JSON exceeds ${NOTIFIER_LIMITS.pluginDataMaxBytes} bytes`;\n  }\n  return null;\n}\n\nfunction validateActionCoherence(input: PublishInput): string | null {\n  if (input.lifecycle !== \"action\") return null;\n  if (input.severity === \"info\") {\n    return \"action lifecycle is incompatible with info severity (use fyi for low-priority pings)\";\n  }\n  if (typeof input.navigateTarget !== \"string\" || input.navigateTarget.length === 0) {\n    return \"action lifecycle requires a non-empty navigateTarget\";\n  }\n  return null;\n}\n\n/** Validate a `PublishInput`. Returns `null` if OK, or a\n *  human-readable error string. Order matters — shape/size errors are\n *  reported before lifecycle/severity coherence errors so the message\n *  the caller sees points at the most fundamental problem first. */\nexport function validatePublishInput(input: PublishInput): string | null {\n  return (\n    validateTitle(input.title) ??\n    validateBody(input.body) ??\n    validateNavigateTarget(input.navigateTarget) ??\n    validatePluginData(input.pluginData) ??\n    validateActionCoherence(input)\n  );\n}\n","// Notifier engine — single-process, two-file (active + history),\n// single-channel. Host-agnostic: file paths, the atomic JSON writer,\n// the pub-sub event sink, and the logger are all injected via\n// `configureNotifier` + `setNotifierFilePaths` so MulmoClaude and\n// MulmoTerminal share one notification engine over their own\n// workspaces and pub-sub fabrics.\n//\n// API surface: publish / clear / cancel / get / listFor / listAll /\n// listHistory (+ plugin-scoped variants). Mutations queue through a\n// writing-flag + waiter-queue coordinator so concurrent callers can't\n// race on the atomic write's rename. Reads bypass the queue (rename\n// atomicity makes half-reads impossible) and trade strict\n// linearisability for simpler code: the contract is \"after\n// `await publish(x)` resolves, subsequent reads see x\" — which holds\n// because `publish` awaits the persist before returning.\n//\n// `clear` / `cancel` push to history *before* removing from active.\n// History persistence is best-effort: if it fails, the active write\n// still wins and the failure is logged. Active is the source of\n// truth; history is an audit aid.\n\nimport { randomUUID } from \"node:crypto\";\nimport { loadActive, loadHistory, saveActive, saveHistory, type WriteJson } from \"./store.js\";\nimport { validatePublishInput } from \"./validate.js\";\nimport {\n  HISTORY_CAP,\n  type NotifierEntry,\n  type NotifierEvent,\n  type NotifierFile,\n  type NotifierHistoryEntry,\n  type NotifierSeverity,\n  type PublishInput,\n} from \"./types.js\";\n\nexport { NOTIFIER_LIMITS, validatePublishInput } from \"./validate.js\";\n\n// ── Dependency injection ──────────────────────────────────────────\n\n/** Minimal logger the engine needs. The host passes its structured\n *  logger; absent one, failures are swallowed (the engine never throws\n *  on a fan-out/persist-best-effort path). */\nexport interface NotifierLogger {\n  warn: (message: string, data?: Record<string, unknown>) => void;\n  error: (message: string, data?: Record<string, unknown>) => void;\n}\n\nexport interface NotifierConfig {\n  /** Atomic JSON writer (the host's `writeJsonAtomic`). */\n  writeJson: WriteJson;\n  /** Fan-out sink — the host binds this to `pubsub.publish(channel, event)`. */\n  publishEvent: (event: NotifierEvent) => void;\n  /** Optional logger. */\n  log?: NotifierLogger;\n}\n\nconst NOOP_LOG: NotifierLogger = { warn: () => {}, error: () => {} };\n\nlet config: NotifierConfig | null = null;\nlet activeFilePath = \"\";\nlet historyFilePath = \"\";\n\nfunction logger(): NotifierLogger {\n  return config?.log ?? NOOP_LOG;\n}\n\n/** Wire the engine's I/O deps. Call once at startup, before the first\n *  mutation. Does NOT set file paths — those are set independently via\n *  `setNotifierFilePaths` so a host can bind production paths at module\n *  load and a test can override them without re-supplying the deps. */\nexport function configureNotifier(injected: NotifierConfig): void {\n  config = injected;\n}\n\n// ── In-process event listeners ────────────────────────────────────\n//\n// Separate from the socket.io pubsub so server-side adapters (macOS\n// push, future Encore) can react to state changes without going\n// through a websocket round-trip. The host's pubsub is fan-out-only\n// with no server-side subscribe, so this listener registry is the\n// in-process equivalent. Listeners run synchronously inside `emit`,\n// before the pubsub fan-out.\n\ntype NotifierEventListener = (event: NotifierEvent) => void;\nconst listeners: NotifierEventListener[] = [];\n\n/** Register an in-process listener for engine events. Returns an\n *  unsubscribe function the caller can use during teardown. */\nexport function onEvent(listener: NotifierEventListener): () => void {\n  listeners.push(listener);\n  return () => {\n    const idx = listeners.indexOf(listener);\n    if (idx >= 0) listeners.splice(idx, 1);\n  };\n}\n\nfunction emit(event: NotifierEvent): void {\n  // In-process fan-out first. Each listener is wrapped: a throwing\n  // listener must not poison the rest, and must not propagate out of\n  // `processBatch` and strand the still-unsettled waiters (their\n  // resolve/reject is called *after* this emit loop). Fan-out is\n  // best-effort by contract — losing one subscriber must not lose\n  // the write that already committed.\n  for (const listener of listeners) {\n    try {\n      listener(event);\n    } catch (err) {\n      logger().error(\"in-process listener failed\", { type: event.type, error: String(err) });\n    }\n  }\n  if (!config) {\n    logger().warn(\"emit before init\", { type: event.type });\n    return;\n  }\n  try {\n    config.publishEvent(event);\n  } catch (err) {\n    logger().error(\"emit failed\", { type: event.type, error: String(err) });\n  }\n}\n\n// ── Write coordinator ─────────────────────────────────────────────\n\n/** A mutation function applied to the in-memory state object during\n *  drain. Returns either:\n *\n *    - `null` — no state change (e.g., `clear` on an unknown id).\n *      The drainer skips the disk write and the emit if every\n *      mutation in a batch returned `null`.\n *    - `{ event, historyEntry? }` — state changed. The drainer emits\n *      the event after the active write succeeds, and prepends\n *      `historyEntry` to history (best-effort) when present.\n *\n *  Mutations MUST NOT modify state when returning `null`. Violating\n *  this invariant produces a write skip with stale on-disk state. */\ntype MutationOutcome = { event: NotifierEvent; historyEntry?: NotifierHistoryEntry } | null;\ntype Mutation = (state: NotifierFile) => MutationOutcome;\n\ninterface Waiter {\n  mutate: Mutation;\n  resolve: () => void;\n  reject: (err: unknown) => void;\n}\n\ntype MutationResult = { ok: true; outcome: MutationOutcome } | { ok: false; error: unknown };\n\nlet writing = false;\nlet waiters: Waiter[] = [];\n\n/** Point the engine at its active/history files. Resets the write\n *  queue, so callers must not have in-flight mutations. The host calls\n *  this once with the workspace paths; tests call it per-case with temp\n *  files. */\nexport function setNotifierFilePaths(paths: { active: string; history: string }): void {\n  activeFilePath = paths.active;\n  historyFilePath = paths.history;\n  writing = false;\n  waiters = [];\n}\n\n/** Test-only: clear config + queue so each suite starts clean. */\nexport function resetNotifier(): void {\n  config = null;\n  activeFilePath = \"\";\n  historyFilePath = \"\";\n  writing = false;\n  waiters = [];\n  listeners.length = 0;\n}\n\nfunction requireWriteJson(): WriteJson {\n  if (!config) throw new Error(\"notifier: configureNotifier() not called\");\n  return config.writeJson;\n}\n\nfunction applyBatchMutations(batch: Waiter[], state: NotifierFile): MutationResult[] {\n  return batch.map((waiter) => {\n    try {\n      return { ok: true, outcome: waiter.mutate(state) };\n    } catch (err) {\n      return { ok: false, error: err };\n    }\n  });\n}\n\nfunction collectEvents(results: MutationResult[]): NotifierEvent[] {\n  const events: NotifierEvent[] = [];\n  for (const result of results) {\n    if (result.ok && result.outcome !== null) events.push(result.outcome.event);\n  }\n  return events;\n}\n\nfunction collectHistoryEntries(results: MutationResult[]): NotifierHistoryEntry[] {\n  const entries: NotifierHistoryEntry[] = [];\n  for (const result of results) {\n    if (result.ok && result.outcome !== null && result.outcome.historyEntry) {\n      entries.push(result.outcome.historyEntry);\n    }\n  }\n  return entries;\n}\n\nfunction settleBatch(batch: Waiter[], results: MutationResult[]): void {\n  // Resolves come AFTER any emits so subscribers see the event\n  // before the caller's `await` returns.\n  for (let index = 0; index < batch.length; index += 1) {\n    const result = results[index];\n    if (result.ok) batch[index].resolve();\n    else batch[index].reject(result.error);\n  }\n}\n\nfunction rejectBatch(batch: Waiter[], err: unknown): void {\n  for (const waiter of batch) waiter.reject(err);\n}\n\nasync function persistHistory(newEntries: NotifierHistoryEntry[]): Promise<void> {\n  const existing = await loadHistory(historyFilePath);\n  // Newest-first ordering: a batch contains terminations in arrival\n  // order; we want the last one to land at index 0 of history.\n  const merged = [...newEntries.slice().reverse(), ...existing.entries].slice(0, HISTORY_CAP);\n  await saveHistory(requireWriteJson(), historyFilePath, { entries: merged });\n}\n\nasync function processBatch(batch: Waiter[]): Promise<void> {\n  let state: NotifierFile;\n  try {\n    state = await loadActive(activeFilePath);\n  } catch (err) {\n    logger().error(\"load failed\", { error: String(err) });\n    rejectBatch(batch, err);\n    return;\n  }\n  const results = applyBatchMutations(batch, state);\n  const events = collectEvents(results);\n  const historyEntries = collectHistoryEntries(results);\n\n  if (events.length > 0) {\n    try {\n      await saveActive(requireWriteJson(), activeFilePath, state);\n    } catch (err) {\n      logger().error(\"active write failed\", { error: String(err) });\n      rejectBatch(batch, err);\n      return;\n    }\n    if (historyEntries.length > 0) {\n      // Best-effort: active is the source of truth, history is an\n      // audit aid. A failed history write is logged but doesn't\n      // unwind the active commit.\n      try {\n        await persistHistory(historyEntries);\n      } catch (err) {\n        logger().error(\"history write failed\", { error: String(err) });\n      }\n    }\n    for (const event of events) emit(event);\n  }\n  settleBatch(batch, results);\n}\n\nasync function drain(): Promise<void> {\n  writing = true;\n  try {\n    while (waiters.length > 0) {\n      const batch = waiters;\n      waiters = [];\n      await processBatch(batch);\n    }\n  } finally {\n    writing = false;\n  }\n}\n\nfunction enqueue(mutate: Mutation): Promise<void> {\n  return new Promise<void>((resolve, reject) => {\n    waiters.push({ mutate, resolve, reject });\n    if (!writing) void drain();\n  });\n}\n\nfunction removeEntry(state: NotifierFile, entryId: string): NotifierFile[\"entries\"] {\n  // Object-rest excludes the key without invoking `delete`.\n  const { [entryId]: __removed, ...remaining } = state.entries;\n  return remaining;\n}\n\nfunction buildHistoryEntry(entry: NotifierEntry, terminalType: \"cleared\" | \"cancelled\"): NotifierHistoryEntry {\n  return { ...entry, terminalType, terminalAt: new Date().toISOString() };\n}\n\n// ── Public API ────────────────────────────────────────────────────\n\nexport async function publish<TPluginData = unknown>(input: PublishInput<TPluginData>): Promise<{ id: string }> {\n  // Validate at the engine boundary so plugin-runtime callers and\n  // HTTP callers hit the same wall.\n  const validationError = validatePublishInput(input as PublishInput);\n  if (validationError) {\n    throw new Error(`notifier.publish: ${validationError}`);\n  }\n  const entryId = randomUUID();\n  const entry: NotifierEntry<TPluginData> = {\n    id: entryId,\n    pluginPkg: input.pluginPkg,\n    severity: input.severity,\n    lifecycle: input.lifecycle,\n    title: input.title,\n    body: input.body,\n    navigateTarget: input.navigateTarget,\n    pluginData: input.pluginData,\n    createdAt: new Date().toISOString(),\n  };\n  await enqueue((state) => {\n    state.entries[entryId] = entry as NotifierEntry;\n    return { event: { type: \"published\", entry: entry as NotifierEntry } };\n  });\n  return { id: entryId };\n}\n\nexport async function clear(entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cleared\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cleared\"),\n    };\n  });\n}\n\nexport async function cancel(entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cancelled\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cancelled\"),\n    };\n  });\n}\n\n/** In-place update for an active entry. Only the fields present on\n *  `patch` are rewritten; `id`, `pluginPkg`, `lifecycle`, and\n *  `createdAt` stay fixed. Emits a single `\"updated\"` event with the\n *  post-mutation entry — no history record is written because the\n *  entry is still active, just with refreshed content.\n *\n *  No-ops (no throw) when the id is unknown, the entry belongs to a\n *  different plugin, or the merged shape would violate\n *  `validatePublishInput`. The silent skip matches `clearForPlugin`'s\n *  isolation semantics; validation failures are logged for diagnosis. */\nexport async function updateForPlugin<TPluginData = unknown>(\n  pluginPkg: string,\n  entryId: string,\n  patch: {\n    severity?: NotifierSeverity;\n    title?: string;\n    body?: string;\n    navigateTarget?: string;\n    pluginData?: TPluginData;\n  },\n): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    if (entry.pluginPkg !== pluginPkg) return null;\n    const next: NotifierEntry = {\n      ...entry,\n      ...(patch.severity !== undefined ? { severity: patch.severity } : {}),\n      ...(patch.title !== undefined ? { title: patch.title } : {}),\n      ...(patch.body !== undefined ? { body: patch.body } : {}),\n      ...(patch.navigateTarget !== undefined ? { navigateTarget: patch.navigateTarget } : {}),\n      ...(patch.pluginData !== undefined ? { pluginData: patch.pluginData } : {}),\n    };\n    // Re-validate the merged shape so an update can't degrade the\n    // entry below publish-time invariants.\n    const validationError = validatePublishInput({\n      pluginPkg: next.pluginPkg,\n      severity: next.severity,\n      title: next.title,\n      body: next.body,\n      lifecycle: next.lifecycle,\n      navigateTarget: next.navigateTarget,\n      pluginData: next.pluginData,\n    });\n    if (validationError) {\n      logger().warn(\"update rejected by validation\", { entryId, pluginPkg, error: validationError });\n      return null;\n    }\n    state.entries[entryId] = next;\n    return { event: { type: \"updated\", entry: next } };\n  });\n}\n\n/** Plugin-scoped point lookup. Returns the entry by id, but only if it\n *  belongs to the caller's plugin; otherwise undefined. Cross-plugin\n *  reads return undefined for isolation — same property as\n *  `clearForPlugin` / `updateForPlugin`. */\nexport async function getForPlugin(pluginPkg: string, entryId: string): Promise<NotifierEntry | undefined> {\n  const state = await loadActive(activeFilePath);\n  const entry = state.entries[entryId];\n  if (!entry) return undefined;\n  if (entry.pluginPkg !== pluginPkg) return undefined;\n  return entry;\n}\n\n/** Plugin-scoped clear. Same as `clear` but no-ops if the entry's\n *  `pluginPkg` doesn't match the caller's, so a plugin can't dismiss\n *  another plugin's notification by guessing or scraping its id. */\nexport async function clearForPlugin(pluginPkg: string, entryId: string): Promise<void> {\n  await enqueue((state) => {\n    const entry = state.entries[entryId];\n    if (!entry) return null;\n    if (entry.pluginPkg !== pluginPkg) return null;\n    state.entries = removeEntry(state, entryId);\n    return {\n      event: { type: \"cleared\", id: entryId },\n      historyEntry: buildHistoryEntry(entry, \"cleared\"),\n    };\n  });\n}\n\nexport async function get(entryId: string): Promise<NotifierEntry | undefined> {\n  const state = await loadActive(activeFilePath);\n  return state.entries[entryId];\n}\n\nexport async function listFor(pluginPkg: string): Promise<NotifierEntry[]> {\n  const state = await loadActive(activeFilePath);\n  return Object.values(state.entries).filter((entry) => entry.pluginPkg === pluginPkg);\n}\n\nexport async function listAll(): Promise<NotifierEntry[]> {\n  const state = await loadActive(activeFilePath);\n  return Object.values(state.entries);\n}\n\nexport async function listHistory(): Promise<NotifierHistoryEntry[]> {\n  const state = await loadHistory(historyFilePath);\n  return state.entries;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA0BA,IAAa,sBAAsB,CAAC,OAAO,QAAQ;;;;;;AAQnD,IAAa,sBAAsB;CAAC;CAAQ;CAAS;AAAQ;;;AA0E7D,IAAa,cAAc;;;AChG3B,SAAS,gBAAgB,KAAuB;CAC9C,OAAO,OAAO,QAAQ,YAAY,QAAQ,QAAS,IAA2B,SAAS;AACzF;;;;;;AAOA,eAAsB,WAAW,UAAyC;CACxE,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,SAAW,SAAS,UAAU,OAAO;CACpD,SAAS,KAAK;EACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE;EAC/C,MAAM;CACR;CACA,MAAM,SAAkB,KAAK,MAAM,IAAI;CAOvC,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,SAClE,MAAM,IAAI,MAAM,sCAAsC,UAAU;CAElE,MAAM,EAAE,YAAY;CACpB,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAC1E,MAAM,IAAI,MAAM,sCAAsC,UAAU;CAElE,OAAO;AACT;;;;;AAMA,eAAsB,WAAW,WAAsB,UAAkB,OAAoC;CAC3G,MAAM,UAAU,UAAU,KAAK;AACjC;;;AAIA,eAAsB,YAAY,UAAgD;CAChF,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,SAAW,SAAS,UAAU,OAAO;CACpD,SAAS,KAAK;EACZ,IAAI,gBAAgB,GAAG,GAAG,OAAO,EAAE,SAAS,CAAC,EAAE;EAC/C,MAAM;CACR;CACA,MAAM,SAAkB,KAAK,MAAM,IAAI;CACvC,IAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,EAAE,aAAa,WAAW,CAAC,MAAM,QAAS,OAAgC,OAAO,GACpI,MAAM,IAAI,MAAM,uCAAuC,UAAU;CAEnE,OAAO;AACT;AAEA,eAAsB,YAAY,WAAsB,UAAkB,OAA2C;CACnH,MAAM,UAAU,UAAU,KAAK;AACjC;;;;;;;;AC7DA,IAAa,kBAAkB;CAC7B,UAAU;CACV,SAAS;CACT,mBAAmB;CACnB,oBAAoB,KAAK;AAC3B;AAEA,SAAS,cAAc,OAA8B;CACnD,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,OAAO;CAC5D,IAAI,MAAM,SAAS,gBAAgB,UAAU,OAAO,+BAA+B,gBAAgB,SAAS;CAC5G,OAAO;AACT;AAEA,SAAS,aAAa,MAAyC;CAC7D,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,IAAI,KAAK,SAAS,gBAAgB,SAAS,OAAO,8BAA8B,gBAAgB,QAAQ;CACxG,OAAO;AACT;AAEA,SAAS,uBAAuB,QAA2C;CACzE,IAAI,WAAW,KAAA,GAAW,OAAO;CACjC,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,IAAI,OAAO,SAAS,gBAAgB,mBAClC,OAAO,wCAAwC,gBAAgB,kBAAkB;CAMnF,IAAI,CAAC,OAAO,WAAW,GAAG,KAAK,OAAO,WAAW,IAAI,GACnD,OAAO;CAET,OAAO;AACT;AAEA,SAAS,mBAAmB,YAAoC;CAC9D,IAAI,eAAe,KAAA,GAAW,OAAO;CACrC,IAAI;CACJ,IAAI;EACF,aAAa,KAAK,UAAU,UAAU;CACxC,SAAS,KAAK;EACZ,OAAO,wCAAwC,OAAO,GAAG;CAC3D;CAIA,IAAI,OAAO,eAAe,UAAU,OAAO;CAC3C,IAAI,WAAW,SAAS,gBAAgB,oBACtC,OAAO,2BAA2B,gBAAgB,mBAAmB;CAEvE,OAAO;AACT;AAEA,SAAS,wBAAwB,OAAoC;CACnE,IAAI,MAAM,cAAc,UAAU,OAAO;CACzC,IAAI,MAAM,aAAa,QACrB,OAAO;CAET,IAAI,OAAO,MAAM,mBAAmB,YAAY,MAAM,eAAe,WAAW,GAC9E,OAAO;CAET,OAAO;AACT;;;;;AAMA,SAAgB,qBAAqB,OAAoC;CACvE,OACE,cAAc,MAAM,KAAK,KACzB,aAAa,MAAM,IAAI,KACvB,uBAAuB,MAAM,cAAc,KAC3C,mBAAmB,MAAM,UAAU,KACnC,wBAAwB,KAAK;AAEjC;;;ACjCA,IAAM,WAA2B;CAAE,YAAY,CAAC;CAAG,aAAa,CAAC;AAAE;AAEnE,IAAI,SAAgC;AACpC,IAAI,iBAAiB;AACrB,IAAI,kBAAkB;AAEtB,SAAS,SAAyB;CAChC,OAAO,QAAQ,OAAO;AACxB;;;;;AAMA,SAAgB,kBAAkB,UAAgC;CAChE,SAAS;AACX;AAYA,IAAM,YAAqC,CAAC;;;AAI5C,SAAgB,QAAQ,UAA6C;CACnE,UAAU,KAAK,QAAQ;CACvB,aAAa;EACX,MAAM,MAAM,UAAU,QAAQ,QAAQ;EACtC,IAAI,OAAO,GAAG,UAAU,OAAO,KAAK,CAAC;CACvC;AACF;AAEA,SAAS,KAAK,OAA4B;CAOxC,KAAK,MAAM,YAAY,WACrB,IAAI;EACF,SAAS,KAAK;CAChB,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,8BAA8B;GAAE,MAAM,MAAM;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CACvF;CAEF,IAAI,CAAC,QAAQ;EACX,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,MAAM,KAAK,CAAC;EACtD;CACF;CACA,IAAI;EACF,OAAO,aAAa,KAAK;CAC3B,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,eAAe;GAAE,MAAM,MAAM;GAAM,OAAO,OAAO,GAAG;EAAE,CAAC;CACxE;AACF;AA2BA,IAAI,UAAU;AACd,IAAI,UAAoB,CAAC;;;;;AAMzB,SAAgB,qBAAqB,OAAkD;CACrF,iBAAiB,MAAM;CACvB,kBAAkB,MAAM;CACxB,UAAU;CACV,UAAU,CAAC;AACb;;AAGA,SAAgB,gBAAsB;CACpC,SAAS;CACT,iBAAiB;CACjB,kBAAkB;CAClB,UAAU;CACV,UAAU,CAAC;CACX,UAAU,SAAS;AACrB;AAEA,SAAS,mBAA8B;CACrC,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,0CAA0C;CACvE,OAAO,OAAO;AAChB;AAEA,SAAS,oBAAoB,OAAiB,OAAuC;CACnF,OAAO,MAAM,KAAK,WAAW;EAC3B,IAAI;GACF,OAAO;IAAE,IAAI;IAAM,SAAS,OAAO,OAAO,KAAK;GAAE;EACnD,SAAS,KAAK;GACZ,OAAO;IAAE,IAAI;IAAO,OAAO;GAAI;EACjC;CACF,CAAC;AACH;AAEA,SAAS,cAAc,SAA4C;CACjE,MAAM,SAA0B,CAAC;CACjC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,MAAM,OAAO,YAAY,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK;CAE5E,OAAO;AACT;AAEA,SAAS,sBAAsB,SAAmD;CAChF,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,MAAM,OAAO,YAAY,QAAQ,OAAO,QAAQ,cACzD,QAAQ,KAAK,OAAO,QAAQ,YAAY;CAG5C,OAAO;AACT;AAEA,SAAS,YAAY,OAAiB,SAAiC;CAGrE,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;EACpD,MAAM,SAAS,QAAQ;EACvB,IAAI,OAAO,IAAI,MAAM,OAAO,QAAQ;OAC/B,MAAM,OAAO,OAAO,OAAO,KAAK;CACvC;AACF;AAEA,SAAS,YAAY,OAAiB,KAAoB;CACxD,KAAK,MAAM,UAAU,OAAO,OAAO,OAAO,GAAG;AAC/C;AAEA,eAAe,eAAe,YAAmD;CAC/E,MAAM,WAAW,MAAM,YAAY,eAAe;CAGlD,MAAM,SAAS,CAAC,GAAG,WAAW,MAAM,EAAE,QAAQ,GAAG,GAAG,SAAS,OAAO,EAAE,MAAM,GAAA,EAAc;CAC1F,MAAM,YAAY,iBAAiB,GAAG,iBAAiB,EAAE,SAAS,OAAO,CAAC;AAC5E;AAEA,eAAe,aAAa,OAAgC;CAC1D,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,WAAW,cAAc;CACzC,SAAS,KAAK;EACZ,OAAO,EAAE,MAAM,eAAe,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;EACpD,YAAY,OAAO,GAAG;EACtB;CACF;CACA,MAAM,UAAU,oBAAoB,OAAO,KAAK;CAChD,MAAM,SAAS,cAAc,OAAO;CACpC,MAAM,iBAAiB,sBAAsB,OAAO;CAEpD,IAAI,OAAO,SAAS,GAAG;EACrB,IAAI;GACF,MAAM,WAAW,iBAAiB,GAAG,gBAAgB,KAAK;EAC5D,SAAS,KAAK;GACZ,OAAO,EAAE,MAAM,uBAAuB,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;GAC5D,YAAY,OAAO,GAAG;GACtB;EACF;EACA,IAAI,eAAe,SAAS,GAI1B,IAAI;GACF,MAAM,eAAe,cAAc;EACrC,SAAS,KAAK;GACZ,OAAO,EAAE,MAAM,wBAAwB,EAAE,OAAO,OAAO,GAAG,EAAE,CAAC;EAC/D;EAEF,KAAK,MAAM,SAAS,QAAQ,KAAK,KAAK;CACxC;CACA,YAAY,OAAO,OAAO;AAC5B;AAEA,eAAe,QAAuB;CACpC,UAAU;CACV,IAAI;EACF,OAAO,QAAQ,SAAS,GAAG;GACzB,MAAM,QAAQ;GACd,UAAU,CAAC;GACX,MAAM,aAAa,KAAK;EAC1B;CACF,UAAU;EACR,UAAU;CACZ;AACF;AAEA,SAAS,QAAQ,QAAiC;CAChD,OAAO,IAAI,SAAe,SAAS,WAAW;EAC5C,QAAQ,KAAK;GAAE;GAAQ;GAAS;EAAO,CAAC;EACxC,IAAI,CAAC,SAAS,MAAW;CAC3B,CAAC;AACH;AAEA,SAAS,YAAY,OAAqB,SAA0C;CAElF,MAAM,GAAG,UAAU,WAAW,GAAG,cAAc,MAAM;CACrD,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAsB,cAA6D;CAC5G,OAAO;EAAE,GAAG;EAAO;EAAc,6BAAY,IAAI,KAAK,GAAE,YAAY;CAAE;AACxE;AAIA,eAAsB,QAA+B,OAA2D;CAG9G,MAAM,kBAAkB,qBAAqB,KAAqB;CAClE,IAAI,iBACF,MAAM,IAAI,MAAM,qBAAqB,iBAAiB;CAExD,MAAM,UAAU,WAAW;CAC3B,MAAM,QAAoC;EACxC,IAAI;EACJ,WAAW,MAAM;EACjB,UAAU,MAAM;EAChB,WAAW,MAAM;EACjB,OAAO,MAAM;EACb,MAAM,MAAM;EACZ,gBAAgB,MAAM;EACtB,YAAY,MAAM;EAClB,4BAAW,IAAI,KAAK,GAAE,YAAY;CACpC;CACA,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,WAAW;EACzB,OAAO,EAAE,OAAO;GAAE,MAAM;GAAoB;EAAuB,EAAE;CACvE,CAAC;CACD,OAAO,EAAE,IAAI,QAAQ;AACvB;AAEA,eAAsB,MAAM,SAAgC;CAC1D,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAW,IAAI;GAAQ;GACtC,cAAc,kBAAkB,OAAO,SAAS;EAClD;CACF,CAAC;AACH;AAEA,eAAsB,OAAO,SAAgC;CAC3D,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAa,IAAI;GAAQ;GACxC,cAAc,kBAAkB,OAAO,WAAW;EACpD;CACF,CAAC;AACH;;;;;;;;;;;AAYA,eAAsB,gBACpB,WACA,SACA,OAOe;CACf,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,cAAc,WAAW,OAAO;EAC1C,MAAM,OAAsB;GAC1B,GAAG;GACH,GAAI,MAAM,aAAa,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;GACnE,GAAI,MAAM,UAAU,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC1D,GAAI,MAAM,SAAS,KAAA,IAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;GACvD,GAAI,MAAM,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;GACrF,GAAI,MAAM,eAAe,KAAA,IAAY,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;EAC3E;EAGA,MAAM,kBAAkB,qBAAqB;GAC3C,WAAW,KAAK;GAChB,UAAU,KAAK;GACf,OAAO,KAAK;GACZ,MAAM,KAAK;GACX,WAAW,KAAK;GAChB,gBAAgB,KAAK;GACrB,YAAY,KAAK;EACnB,CAAC;EACD,IAAI,iBAAiB;GACnB,OAAO,EAAE,KAAK,iCAAiC;IAAE;IAAS;IAAW,OAAO;GAAgB,CAAC;GAC7F,OAAO;EACT;EACA,MAAM,QAAQ,WAAW;EACzB,OAAO,EAAE,OAAO;GAAE,MAAM;GAAW,OAAO;EAAK,EAAE;CACnD,CAAC;AACH;;;;;AAMA,eAAsB,aAAa,WAAmB,SAAqD;CAEzG,MAAM,SAAQ,MADM,WAAW,cAAc,GACzB,QAAQ;CAC5B,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,IAAI,MAAM,cAAc,WAAW,OAAO,KAAA;CAC1C,OAAO;AACT;;;;AAKA,eAAsB,eAAe,WAAmB,SAAgC;CACtF,MAAM,SAAS,UAAU;EACvB,MAAM,QAAQ,MAAM,QAAQ;EAC5B,IAAI,CAAC,OAAO,OAAO;EACnB,IAAI,MAAM,cAAc,WAAW,OAAO;EAC1C,MAAM,UAAU,YAAY,OAAO,OAAO;EAC1C,OAAO;GACL,OAAO;IAAE,MAAM;IAAW,IAAI;GAAQ;GACtC,cAAc,kBAAkB,OAAO,SAAS;EAClD;CACF,CAAC;AACH;AAEA,eAAsB,IAAI,SAAqD;CAE7E,QAAO,MADa,WAAW,cAAc,GAChC,QAAQ;AACvB;AAEA,eAAsB,QAAQ,WAA6C;CACzE,MAAM,QAAQ,MAAM,WAAW,cAAc;CAC7C,OAAO,OAAO,OAAO,MAAM,OAAO,EAAE,QAAQ,UAAU,MAAM,cAAc,SAAS;AACrF;AAEA,eAAsB,UAAoC;CACxD,MAAM,QAAQ,MAAM,WAAW,cAAc;CAC7C,OAAO,OAAO,OAAO,MAAM,OAAO;AACpC;AAEA,eAAsB,cAA+C;CAEnE,QAAO,MADa,YAAY,eAAe,GAClC;AACf"}