@remnic/core 1.1.0 → 1.1.1

package/dist/{chunk-6ZH4TU6I.js → chunk-FAAFWE4G.js}

@@ -236,10 +236,11 @@ function relPath(pagePath, memoryDir) {
 }
 
 export {
+  sidecarKey,
   createVersion,
   listVersions,
   getVersion,
   revertToVersion,
   diffVersions
 };
-//# sourceMappingURL=chunk-6ZH4TU6I.js.map
+//# sourceMappingURL=chunk-FAAFWE4G.js.map

package/dist/chunk-FAAFWE4G.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/page-versioning.ts"],"sourcesContent":["/**\n * Page-level versioning with history and revert (issue #371).\n *\n * Provides snapshot-based versioning for memory files using a sidecar\n * directory layout.  Each memory page gets a `.versions/<pageName>/`\n * subdirectory containing numbered snapshots and a `manifest.json` that\n * records the version history.\n *\n * Storage layout:\n *   memoryDir/\n *     facts/preferences.md              <- current file\n *     .versions/\n *       facts__preferences/\n *         manifest.json                  <- VersionHistory\n *         1.md                           <- version 1 snapshot\n *         2.md                           <- version 2 snapshot\n */\n\nimport { createHash } from \"node:crypto\";\nimport path from \"node:path\";\nimport {\n  access,\n  mkdir,\n  readFile,\n  writeFile,\n  unlink,\n} from \"node:fs/promises\";\n\n// ---------------------------------------------------------------------------\n// Public interfaces\n// ---------------------------------------------------------------------------\n\nexport interface PageVersion {\n  versionId: string;\n  timestamp: string;\n  contentHash: string;\n  sizeBytes: number;\n  trigger: VersionTrigger;\n  note?: string;\n}\n\nexport type VersionTrigger = \"write\" | \"consolidation\" | \"revert\" | \"manual\";\n\nexport interface VersionHistory {\n  pagePath: string;\n  versions: PageVersion[];\n  currentVersion: string;\n}\n\nexport interface VersioningConfig {\n  enabled: boolean;\n  maxVersionsPerPage: number;\n  sidecarDir: string;\n}\n\n// ---------------------------------------------------------------------------\n// Logger interface (minimal, avoids coupling to the host logger)\n// ---------------------------------------------------------------------------\n\nexport interface VersioningLogger {\n  debug(msg: string): void;\n  warn(msg: string): void;\n}\n\nconst NOOP_LOGGER: VersioningLogger = {\n  debug: () => {},\n  warn: () => {},\n};\n\n// ---------------------------------------------------------------------------\n// Per-page write lock (promise-chain pattern, see gotcha #40)\n// ---------------------------------------------------------------------------\n\nconst writeLocks = new Map<string, Promise<void>>();\n\nfunction withPageLock<T>(pageKey: string, fn: () => Promise<T>): Promise<T> {\n  const prev = writeLocks.get(pageKey) ?? Promise.resolve();\n  const next = prev.then(fn, fn); // run fn after previous completes, even if previous failed\n  writeLocks.set(pageKey, next.then(() => {}, () => {})); // recover chain per gotcha #40\n  return next;\n}\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction contentHash(content: string): string {\n  return createHash(\"sha256\").update(content, \"utf-8\").digest(\"hex\");\n}\n\n/**\n * Derive a filesystem-safe sidecar key from a page path relative to memoryDir.\n *\n * `facts/2026-01-15/pref-001.md` -> `facts__2026-01-15__pref-001`\n *\n * Exported so the `remnic doctor` consolidation-provenance check (issue\n * #561 PR 4) resolves snapshot locations using the canonical algorithm\n * without re-implementing it — preventing silent drift if the key\n * format ever changes.\n */\nexport function sidecarKey(pagePath: string): string {\n  const withoutExt = pagePath.replace(/\\.md$/i, \"\");\n  return withoutExt.replace(/[\\\\/]/g, \"__\");\n}\n\nfunction sidecarDir(memoryDir: string, sidecar: string, pagePath: string): string {\n  return path.join(memoryDir, sidecar, sidecarKey(pagePath));\n}\n\nfunction manifestPath(memoryDir: string, sidecar: string, pagePath: string): string {\n  return path.join(sidecarDir(memoryDir, sidecar, pagePath), \"manifest.json\");\n}\n\nasync function fileExists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function readManifest(\n  memoryDir: string,\n  sidecar: string,\n  pagePath: string,\n): Promise<VersionHistory> {\n  const mp = manifestPath(memoryDir, sidecar, pagePath);\n  try {\n    const raw = await readFile(mp, \"utf-8\");\n    const parsed: unknown = JSON.parse(raw);\n    if (typeof parsed !== \"object\" || parsed === null) {\n      return { pagePath, versions: [], currentVersion: \"0\" };\n    }\n    const obj = parsed as Record<string, unknown>;\n    const versions = Array.isArray(obj.versions) ? (obj.versions as PageVersion[]) : [];\n    const currentVersion = typeof obj.currentVersion === \"string\" ? obj.currentVersion : \"0\";\n    return { pagePath: typeof obj.pagePath === \"string\" ? obj.pagePath : pagePath, versions, currentVersion };\n  } catch {\n    return { pagePath, versions: [], currentVersion: \"0\" };\n  }\n}\n\nasync function writeManifest(\n  memoryDir: string,\n  sidecar: string,\n  pagePath: string,\n  history: VersionHistory,\n): Promise<void> {\n  const dir = sidecarDir(memoryDir, sidecar, pagePath);\n  await mkdir(dir, { recursive: true });\n  const mp = manifestPath(memoryDir, sidecar, pagePath);\n  await writeFile(mp, JSON.stringify(history, null, 2) + \"\\n\", \"utf-8\");\n}\n\n// ---------------------------------------------------------------------------\n// Public API\n// ---------------------------------------------------------------------------\n\n/**\n * Create a new version snapshot for a page.\n *\n * Call this BEFORE overwriting the current file so the previous content is\n * preserved. If the file does not exist yet (first write), the provided\n * `content` is snapshotted as version 1.\n *\n * Pruning: when the number of versions exceeds `config.maxVersionsPerPage`,\n * the oldest snapshots (and their files) are removed.\n */\nexport async function createVersion(\n  pagePath: string,\n  content: string,\n  trigger: VersionTrigger,\n  config: VersioningConfig,\n  log: VersioningLogger = NOOP_LOGGER,\n  note?: string,\n  memoryDir?: string,\n): Promise<PageVersion> {\n  const { sidecarDir: sidecar, maxVersionsPerPage } = config;\n  const resolvedMemoryDir = memoryDir ?? resolveMemoryDir(pagePath);\n  const mPath = manifestPath(resolvedMemoryDir, sidecar, relPath(pagePath, resolvedMemoryDir));\n\n  return withPageLock(mPath, async () => {\n    const history = await readManifest(resolvedMemoryDir, sidecar, relPath(pagePath, resolvedMemoryDir));\n    const nextId = String(history.versions.length > 0\n      ? Math.max(...history.versions.map((v) => Number(v.versionId))) + 1\n      : 1);\n\n    const hash = contentHash(content);\n    const version: PageVersion = {\n      versionId: nextId,\n      timestamp: new Date().toISOString(),\n      contentHash: hash,\n      sizeBytes: Buffer.byteLength(content, \"utf-8\"),\n      trigger,\n      ...(note !== undefined ? { note } : {}),\n    };\n\n    // Write snapshot file\n    const dir = sidecarDir(resolvedMemoryDir, sidecar, relPath(pagePath, resolvedMemoryDir));\n    await mkdir(dir, { recursive: true });\n    const ext = path.extname(pagePath) || \".md\";\n    const snapshotPath = path.join(dir, `${nextId}${ext}`);\n    await writeFile(snapshotPath, content, \"utf-8\");\n\n    history.versions.push(version);\n    history.currentVersion = nextId;\n\n    // Prune old versions if exceeding max\n    if (maxVersionsPerPage > 0 && history.versions.length > maxVersionsPerPage) {\n      const toRemove = history.versions.splice(0, history.versions.length - maxVersionsPerPage);\n      for (const old of toRemove) {\n        const oldPath = path.join(dir, `${old.versionId}${ext}`);\n        try {\n          await unlink(oldPath);\n        } catch {\n          log.debug(`page-versioning: could not remove old snapshot ${oldPath}`);\n        }\n      }\n    }\n\n    await writeManifest(resolvedMemoryDir, sidecar, relPath(pagePath, resolvedMemoryDir), history);\n    log.debug(`page-versioning: created version ${nextId} for ${pagePath} (trigger=${trigger})`);\n\n    return version;\n  });\n}\n\n/**\n * List all versions for a page.\n */\nexport async function listVersions(\n  pagePath: string,\n  config: VersioningConfig,\n  memoryDir?: string,\n): Promise<VersionHistory> {\n  const resolvedMemoryDir = memoryDir ?? resolveMemoryDir(pagePath);\n  const rel = relPath(pagePath, resolvedMemoryDir);\n  const history = await readManifest(resolvedMemoryDir, config.sidecarDir, rel);\n  // Sort ascending by versionId (numeric)\n  history.versions.sort((a, b) => Number(a.versionId) - Number(b.versionId));\n  return history;\n}\n\n/**\n * Read the content of a specific version.\n */\nexport async function getVersion(\n  pagePath: string,\n  versionId: string,\n  config: VersioningConfig,\n  memoryDir?: string,\n): Promise<string> {\n  const resolvedMemoryDir = memoryDir ?? resolveMemoryDir(pagePath);\n  const rel = relPath(pagePath, resolvedMemoryDir);\n  const ext = path.extname(pagePath) || \".md\";\n  const dir = sidecarDir(resolvedMemoryDir, config.sidecarDir, rel);\n  const snapshotPath = path.join(dir, `${versionId}${ext}`);\n\n  if (!(await fileExists(snapshotPath))) {\n    throw new Error(`Version ${versionId} not found for ${pagePath}`);\n  }\n\n  return readFile(snapshotPath, \"utf-8\");\n}\n\n/**\n * Revert a page to a previous version.\n *\n * 1. Reads the target version's content.\n * 2. Snapshots the CURRENT content as a new version (trigger: \"revert\").\n * 3. Writes the reverted content to the page file.\n *\n * Returns the newly created version entry for the revert snapshot.\n */\nexport async function revertToVersion(\n  pagePath: string,\n  versionId: string,\n  config: VersioningConfig,\n  log: VersioningLogger = NOOP_LOGGER,\n  memoryDir?: string,\n): Promise<PageVersion> {\n  const resolvedMemoryDir = memoryDir ?? resolveMemoryDir(pagePath);\n\n  // Read target version content\n  const targetContent = await getVersion(pagePath, versionId, config, resolvedMemoryDir);\n\n  // Snapshot current content before overwriting\n  let currentContent = \"\";\n  try {\n    currentContent = await readFile(pagePath, \"utf-8\");\n  } catch {\n    // File may not exist; that's okay\n  }\n\n  const version = await createVersion(\n    pagePath,\n    currentContent,\n    \"revert\",\n    config,\n    log,\n    `reverted to version ${versionId}`,\n    resolvedMemoryDir,\n  );\n\n  // Write the reverted content to the actual page\n  await writeFile(pagePath, targetContent, \"utf-8\");\n  log.debug(`page-versioning: reverted ${pagePath} to version ${versionId}`);\n\n  return version;\n}\n\n/**\n * Simple line-based diff between two versions.\n *\n * Returns a unified-style diff string showing added (+) and removed (-) lines.\n */\nexport async function diffVersions(\n  pagePath: string,\n  v1: string,\n  v2: string,\n  config: VersioningConfig,\n  memoryDir?: string,\n): Promise<string> {\n  const resolvedMemoryDir = memoryDir ?? resolveMemoryDir(pagePath);\n  const content1 = await getVersion(pagePath, v1, config, resolvedMemoryDir);\n  const content2 = await getVersion(pagePath, v2, config, resolvedMemoryDir);\n\n  const lines1 = content1.split(\"\\n\");\n  const lines2 = content2.split(\"\\n\");\n\n  const result: string[] = [];\n  result.push(`--- version ${v1}`);\n  result.push(`+++ version ${v2}`);\n\n  // Simple LCS-based diff\n  const lcs = computeLCS(lines1, lines2);\n  let i = 0;\n  let j = 0;\n  let k = 0;\n\n  while (k < lcs.length) {\n    // Emit removed lines before the next common line\n    while (i < lines1.length && lines1[i] !== lcs[k]) {\n      result.push(`-${lines1[i]}`);\n      i++;\n    }\n    // Emit added lines before the next common line\n    while (j < lines2.length && lines2[j] !== lcs[k]) {\n      result.push(`+${lines2[j]}`);\n      j++;\n    }\n    // Common line\n    result.push(` ${lcs[k]}`);\n    i++;\n    j++;\n    k++;\n  }\n  // Remaining removed lines\n  while (i < lines1.length) {\n    result.push(`-${lines1[i]}`);\n    i++;\n  }\n  // Remaining added lines\n  while (j < lines2.length) {\n    result.push(`+${lines2[j]}`);\n    j++;\n  }\n\n  return result.join(\"\\n\");\n}\n\n// ---------------------------------------------------------------------------\n// LCS helper for diffVersions\n// ---------------------------------------------------------------------------\n\nfunction computeLCS(a: string[], b: string[]): string[] {\n  const m = a.length;\n  const n = b.length;\n  // Build DP table\n  const dp: number[][] = Array.from({ length: m + 1 }, () => new Array<number>(n + 1).fill(0));\n  for (let i = 1; i <= m; i++) {\n    for (let j = 1; j <= n; j++) {\n      if (a[i - 1] === b[j - 1]) {\n        dp[i][j] = dp[i - 1][j - 1] + 1;\n      } else {\n        dp[i][j] = Math.max(dp[i - 1][j], dp[i][j - 1]);\n      }\n    }\n  }\n  // Backtrack to build LCS\n  const result: string[] = [];\n  let i = m;\n  let j = n;\n  while (i > 0 && j > 0) {\n    if (a[i - 1] === b[j - 1]) {\n      result.unshift(a[i - 1]);\n      i--;\n      j--;\n    } else if (dp[i - 1][j] > dp[i][j - 1]) {\n      i--;\n    } else {\n      j--;\n    }\n  }\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// Path helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Legacy fallback: given an absolute page path, heuristically resolve the\n * memory directory by walking up past known subdirectory names.\n *\n * Callers should always pass an explicit `memoryDir` instead of relying on\n * this heuristic.  It is retained only for backward compatibility when the\n * optional `memoryDir` parameter is omitted.\n */\nfunction resolveMemoryDir(pagePath: string): string {\n  const knownSubdirs = new Set([\n    \"facts\",\n    \"corrections\",\n    \"entities\",\n    \"state\",\n    \"artifacts\",\n    \"questions\",\n    \"profiles\",\n  ]);\n\n  let dir = path.dirname(pagePath);\n  // Walk up past date directories (YYYY-MM-DD) and known subdirs\n  for (let depth = 0; depth < 5; depth++) {\n    const base = path.basename(dir);\n    if (knownSubdirs.has(base) || /^\\d{4}-\\d{2}-\\d{2}$/.test(base)) {\n      dir = path.dirname(dir);\n    } else {\n      break;\n    }\n  }\n  return dir;\n}\n\n/**\n * Compute relative path of a page within its memory directory.\n */\nfunction relPath(pagePath: string, memoryDir: string): string {\n  return path.relative(memoryDir, pagePath);\n}\n"],"mappings":";AAkBA,SAAS,kBAAkB;AAC3B,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAsCP,IAAM,cAAgC;AAAA,EACpC,OAAO,MAAM;AAAA,EAAC;AAAA,EACd,MAAM,MAAM;AAAA,EAAC;AACf;AAMA,IAAM,aAAa,oBAAI,IAA2B;AAElD,SAAS,aAAgB,SAAiB,IAAkC;AAC1E,QAAM,OAAO,WAAW,IAAI,OAAO,KAAK,QAAQ,QAAQ;AACxD,QAAM,OAAO,KAAK,KAAK,IAAI,EAAE;AAC7B,aAAW,IAAI,SAAS,KAAK,KAAK,MAAM;AAAA,EAAC,GAAG,MAAM;AAAA,EAAC,CAAC,CAAC;AACrD,SAAO;AACT;AAMA,SAAS,YAAY,SAAyB;AAC5C,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,OAAO,EAAE,OAAO,KAAK;AACnE;AAYO,SAAS,WAAW,UAA0B;AACnD,QAAM,aAAa,SAAS,QAAQ,UAAU,EAAE;AAChD,SAAO,WAAW,QAAQ,UAAU,IAAI;AAC1C;AAEA,SAAS,WAAW,WAAmB,SAAiB,UAA0B;AAChF,SAAO,KAAK,KAAK,WAAW,SAAS,WAAW,QAAQ,CAAC;AAC3D;AAEA,SAAS,aAAa,WAAmB,SAAiB,UAA0B;AAClF,SAAO,KAAK,KAAK,WAAW,WAAW,SAAS,QAAQ,GAAG,eAAe;AAC5E;AAEA,eAAe,WAAW,GAA6B;AACrD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,aACb,WACA,SACA,UACyB;AACzB,QAAM,KAAK,aAAa,WAAW,SAAS,QAAQ;AACpD,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,IAAI,OAAO;AACtC,UAAM,SAAkB,KAAK,MAAM,GAAG;AACtC,QAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,aAAO,EAAE,UAAU,UAAU,CAAC,GAAG,gBAAgB,IAAI;AAAA,IACvD;AACA,UAAM,MAAM;AACZ,UAAM,WAAW,MAAM,QAAQ,IAAI,QAAQ,IAAK,IAAI,WAA6B,CAAC;AAClF,UAAM,iBAAiB,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB;AACrF,WAAO,EAAE,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW,UAAU,UAAU,eAAe;AAAA,EAC1G,QAAQ;AACN,WAAO,EAAE,UAAU,UAAU,CAAC,GAAG,gBAAgB,IAAI;AAAA,EACvD;AACF;AAEA,eAAe,cACb,WACA,SACA,UACA,SACe;AACf,QAAM,MAAM,WAAW,WAAW,SAAS,QAAQ;AACnD,QAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,QAAM,KAAK,aAAa,WAAW,SAAS,QAAQ;AACpD,QAAM,UAAU,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,OAAO;AACtE;AAgBA,eAAsB,cACpB,UACA,SACA,SACA,QACA,MAAwB,aACxB,MACA,WACsB;AACtB,QAAM,EAAE,YAAY,SAAS,mBAAmB,IAAI;AACpD,QAAM,oBAAoB,aAAa,iBAAiB,QAAQ;AAChE,QAAM,QAAQ,aAAa,mBAAmB,SAAS,QAAQ,UAAU,iBAAiB,CAAC;AAE3F,SAAO,aAAa,OAAO,YAAY;AACrC,UAAM,UAAU,MAAM,aAAa,mBAAmB,SAAS,QAAQ,UAAU,iBAAiB,CAAC;AACnG,UAAM,SAAS,OAAO,QAAQ,SAAS,SAAS,IAC5C,KAAK,IAAI,GAAG,QAAQ,SAAS,IAAI,CAAC,MAAM,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,IAChE,CAAC;AAEL,UAAM,OAAO,YAAY,OAAO;AAChC,UAAM,UAAuB;AAAA,MAC3B,WAAW;AAAA,MACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,aAAa;AAAA,MACb,WAAW,OAAO,WAAW,SAAS,OAAO;AAAA,MAC7C;AAAA,MACA,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACvC;AAGA,UAAM,MAAM,WAAW,mBAAmB,SAAS,QAAQ,UAAU,iBAAiB,CAAC;AACvF,UAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AACpC,UAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AACtC,UAAM,eAAe,KAAK,KAAK,KAAK,GAAG,MAAM,GAAG,GAAG,EAAE;AACrD,UAAM,UAAU,cAAc,SAAS,OAAO;AAE9C,YAAQ,SAAS,KAAK,OAAO;AAC7B,YAAQ,iBAAiB;AAGzB,QAAI,qBAAqB,KAAK,QAAQ,SAAS,SAAS,oBAAoB;AAC1E,YAAM,WAAW,QAAQ,SAAS,OAAO,GAAG,QAAQ,SAAS,SAAS,kBAAkB;AACxF,iBAAW,OAAO,UAAU;AAC1B,cAAM,UAAU,KAAK,KAAK,KAAK,GAAG,IAAI,SAAS,GAAG,GAAG,EAAE;AACvD,YAAI;AACF,gBAAM,OAAO,OAAO;AAAA,QACtB,QAAQ;AACN,cAAI,MAAM,kDAAkD,OAAO,EAAE;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAEA,UAAM,cAAc,mBAAmB,SAAS,QAAQ,UAAU,iBAAiB,GAAG,OAAO;AAC7F,QAAI,MAAM,oCAAoC,MAAM,QAAQ,QAAQ,aAAa,OAAO,GAAG;AAE3F,WAAO;AAAA,EACT,CAAC;AACH;AAKA,eAAsB,aACpB,UACA,QACA,WACyB;AACzB,QAAM,oBAAoB,aAAa,iBAAiB,QAAQ;AAChE,QAAM,MAAM,QAAQ,UAAU,iBAAiB;AAC/C,QAAM,UAAU,MAAM,aAAa,mBAAmB,OAAO,YAAY,GAAG;AAE5E,UAAQ,SAAS,KAAK,CAAC,GAAG,MAAM,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,SAAS,CAAC;AACzE,SAAO;AACT;AAKA,eAAsB,WACpB,UACA,WACA,QACA,WACiB;AACjB,QAAM,oBAAoB,aAAa,iBAAiB,QAAQ;AAChE,QAAM,MAAM,QAAQ,UAAU,iBAAiB;AAC/C,QAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AACtC,QAAM,MAAM,WAAW,mBAAmB,OAAO,YAAY,GAAG;AAChE,QAAM,eAAe,KAAK,KAAK,KAAK,GAAG,SAAS,GAAG,GAAG,EAAE;AAExD,MAAI,CAAE,MAAM,WAAW,YAAY,GAAI;AACrC,UAAM,IAAI,MAAM,WAAW,SAAS,kBAAkB,QAAQ,EAAE;AAAA,EAClE;AAEA,SAAO,SAAS,cAAc,OAAO;AACvC;AAWA,eAAsB,gBACpB,UACA,WACA,QACA,MAAwB,aACxB,WACsB;AACtB,QAAM,oBAAoB,aAAa,iBAAiB,QAAQ;AAGhE,QAAM,gBAAgB,MAAM,WAAW,UAAU,WAAW,QAAQ,iBAAiB;AAGrF,MAAI,iBAAiB;AACrB,MAAI;AACF,qBAAiB,MAAM,SAAS,UAAU,OAAO;AAAA,EACnD,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,uBAAuB,SAAS;AAAA,IAChC;AAAA,EACF;AAGA,QAAM,UAAU,UAAU,eAAe,OAAO;AAChD,MAAI,MAAM,6BAA6B,QAAQ,eAAe,SAAS,EAAE;AAEzE,SAAO;AACT;AAOA,eAAsB,aACpB,UACA,IACA,IACA,QACA,WACiB;AACjB,QAAM,oBAAoB,aAAa,iBAAiB,QAAQ;AAChE,QAAM,WAAW,MAAM,WAAW,UAAU,IAAI,QAAQ,iBAAiB;AACzE,QAAM,WAAW,MAAM,WAAW,UAAU,IAAI,QAAQ,iBAAiB;AAEzE,QAAM,SAAS,SAAS,MAAM,IAAI;AAClC,QAAM,SAAS,SAAS,MAAM,IAAI;AAElC,QAAM,SAAmB,CAAC;AAC1B,SAAO,KAAK,eAAe,EAAE,EAAE;AAC/B,SAAO,KAAK,eAAe,EAAE,EAAE;AAG/B,QAAM,MAAM,WAAW,QAAQ,MAAM;AACrC,MAAI,IAAI;AACR,MAAI,IAAI;AACR,MAAI,IAAI;AAER,SAAO,IAAI,IAAI,QAAQ;AAErB,WAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG;AAChD,aAAO,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE;AAC3B;AAAA,IACF;AAEA,WAAO,IAAI,OAAO,UAAU,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG;AAChD,aAAO,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE;AAC3B;AAAA,IACF;AAEA,WAAO,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE;AACxB;AACA;AACA;AAAA,EACF;AAEA,SAAO,IAAI,OAAO,QAAQ;AACxB,WAAO,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE;AAC3B;AAAA,EACF;AAEA,SAAO,IAAI,OAAO,QAAQ;AACxB,WAAO,KAAK,IAAI,OAAO,CAAC,CAAC,EAAE;AAC3B;AAAA,EACF;AAEA,SAAO,OAAO,KAAK,IAAI;AACzB;AAMA,SAAS,WAAW,GAAa,GAAuB;AACtD,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AAEZ,QAAM,KAAiB,MAAM,KAAK,EAAE,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAc,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3F,WAASA,KAAI,GAAGA,MAAK,GAAGA,MAAK;AAC3B,aAASC,KAAI,GAAGA,MAAK,GAAGA,MAAK;AAC3B,UAAI,EAAED,KAAI,CAAC,MAAM,EAAEC,KAAI,CAAC,GAAG;AACzB,WAAGD,EAAC,EAAEC,EAAC,IAAI,GAAGD,KAAI,CAAC,EAAEC,KAAI,CAAC,IAAI;AAAA,MAChC,OAAO;AACL,WAAGD,EAAC,EAAEC,EAAC,IAAI,KAAK,IAAI,GAAGD,KAAI,CAAC,EAAEC,EAAC,GAAG,GAAGD,EAAC,EAAEC,KAAI,CAAC,CAAC;AAAA,MAChD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAmB,CAAC;AAC1B,MAAI,IAAI;AACR,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,IAAI,GAAG;AACrB,QAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG;AACzB,aAAO,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvB;AACA;AAAA,IACF,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG;AACtC;AAAA,IACF,OAAO;AACL;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAcA,SAAS,iBAAiB,UAA0B;AAClD,QAAM,eAAe,oBAAI,IAAI;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,MAAM,KAAK,QAAQ,QAAQ;AAE/B,WAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS;AACtC,UAAM,OAAO,KAAK,SAAS,GAAG;AAC9B,QAAI,aAAa,IAAI,IAAI,KAAK,sBAAsB,KAAK,IAAI,GAAG;AAC9D,YAAM,KAAK,QAAQ,GAAG;AAAA,IACxB,OAAO;AACL;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,QAAQ,UAAkB,WAA2B;AAC5D,SAAO,KAAK,SAAS,WAAW,QAAQ;AAC1C;","names":["i","j"]}

package/dist/{chunk-7WQ6SLIE.js → chunk-FVA6TGI3.js}

@@ -4,7 +4,7 @@ import {
 import {
   compareEntityTimestamps,
   normalizeEntityName
-} from "./chunk-GV6NLQ4X.js";
+} from "./chunk-F5VP6YCB.js";
 import {
   sanitizeMemoryContent
 } from "./chunk-M62O4P4T.js";
@@ -553,4 +553,4 @@ export {
   entityIndexVersion,
   entityRecentTranscriptLookbackHours
 };
-//# sourceMappingURL=chunk-7WQ6SLIE.js.map
+//# sourceMappingURL=chunk-FVA6TGI3.js.map

package/dist/chunk-GDFS42HT.js

@@ -0,0 +1,206 @@
+// src/cross-namespace-budget.ts
+var DEFAULT_CROSS_NAMESPACE_BUDGET = Object.freeze({
+  enabled: false,
+  windowMs: 6e4,
+  softLimit: 10,
+  hardLimit: 30
+});
+function effectiveConfig(raw) {
+  const base = { ...DEFAULT_CROSS_NAMESPACE_BUDGET };
+  if (!raw) return base;
+  const out = { ...base };
+  if (typeof raw.enabled === "boolean") out.enabled = raw.enabled;
+  if (typeof raw.windowMs === "number" && Number.isFinite(raw.windowMs) && raw.windowMs > 0) {
+    out.windowMs = raw.windowMs;
+  }
+  if (typeof raw.softLimit === "number" && Number.isFinite(raw.softLimit) && raw.softLimit >= 0) {
+    out.softLimit = Math.floor(raw.softLimit);
+  }
+  if (typeof raw.hardLimit === "number" && Number.isFinite(raw.hardLimit) && raw.hardLimit >= 1) {
+    const floored = Math.floor(raw.hardLimit);
+    if (floored >= 1) out.hardLimit = floored;
+  }
+  if (out.softLimit > out.hardLimit) {
+    out.softLimit = out.hardLimit;
+  }
+  return out;
+}
+var CrossNamespaceBudget = class {
+  config;
+  buckets = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.config = effectiveConfig(config);
+  }
+  /** Exposed for tests / audit surfaces. Never mutate the returned value. */
+  getConfig() {
+    return this.config;
+  }
+  /**
+   * Check whether `principal` is allowed to issue another cross-namespace
+   * read. Call site is expected to compare `principalNamespace` against
+   * `queryNamespace` and only pass through reads where they differ — the
+   * limiter treats every call as a cross-namespace event.
+   *
+   * @param principal Stable identifier for the calling principal (token
+   *   subject, session principal, etc.). Must be non-empty.
+   * @param now Epoch-ms clock read. Defaults to `Date.now()`; tests pass a
+   *   fixed value to step time deterministically.
+   */
+  record(principal, now = Date.now()) {
+    const { enabled, windowMs, softLimit, hardLimit } = this.config;
+    const limit = { softLimit, hardLimit, windowMs };
+    if (!enabled) {
+      return {
+        allowed: true,
+        reason: "allowed-no-limit",
+        count: 0,
+        limit
+      };
+    }
+    if (typeof principal !== "string" || principal.length === 0) {
+      principal = "__anonymous__";
+    }
+    const bucket = this.buckets.get(principal) ?? { timestamps: [] };
+    const cutoff = now - windowMs;
+    while (bucket.timestamps.length > 0 && bucket.timestamps[0] < cutoff) {
+      bucket.timestamps.shift();
+    }
+    bucket.timestamps.push(now);
+    this.buckets.set(principal, bucket);
+    const count = bucket.timestamps.length;
+    if (count > hardLimit) {
+      bucket.timestamps.pop();
+      if (bucket.timestamps.length === 0) {
+        this.buckets.delete(principal);
+      }
+      return {
+        allowed: false,
+        reason: "deny-over-hard",
+        count: bucket.timestamps.length,
+        limit
+      };
+    }
+    if (count > softLimit) {
+      return {
+        allowed: true,
+        reason: "warn-over-soft",
+        count,
+        limit
+      };
+    }
+    return {
+      allowed: true,
+      reason: "allowed-under-soft",
+      count,
+      limit
+    };
+  }
+  /**
+   * Read-only peek at whether a call would be allowed, WITHOUT recording a
+   * timestamp. Useful when the caller must inspect multiple namespaces before
+   * deciding to record a single event. The returned `count` reflects the
+   * current window state at call time.
+   */
+  peek(args) {
+    const pn = args.principalNamespace;
+    const qn = args.queryNamespace;
+    const bothPresent = typeof pn === "string" && pn.length > 0 && typeof qn === "string" && qn.length > 0;
+    if (bothPresent && pn === qn) {
+      return {
+        allowed: true,
+        reason: "allowed-same-namespace",
+        count: 0,
+        limit: {
+          softLimit: this.config.softLimit,
+          hardLimit: this.config.hardLimit,
+          windowMs: this.config.windowMs
+        }
+      };
+    }
+    const { enabled, windowMs, softLimit, hardLimit } = this.config;
+    const limit = { softLimit, hardLimit, windowMs };
+    if (!enabled) {
+      return { allowed: true, reason: "allowed-no-limit", count: 0, limit };
+    }
+    let principal = args.principal;
+    if (typeof principal !== "string" || principal.length === 0) {
+      principal = "__anonymous__";
+    }
+    const now = args.now ?? Date.now();
+    const bucket = this.buckets.get(principal) ?? { timestamps: [] };
+    const cutoff = now - windowMs;
+    let liveCount = 0;
+    for (const ts of bucket.timestamps) {
+      if (ts >= cutoff) liveCount++;
+    }
+    const projected = liveCount + 1;
+    if (projected > hardLimit) {
+      return { allowed: false, reason: "deny-over-hard", count: liveCount, limit };
+    }
+    if (projected > softLimit) {
+      return { allowed: true, reason: "warn-over-soft", count: projected, limit };
+    }
+    return { allowed: true, reason: "allowed-under-soft", count: projected, limit };
+  }
+  /**
+   * Convenience guard that also skips the limiter when `principalNamespace`
+   * equals `queryNamespace` (same-namespace is never cross-namespace).
+   * Returns an `allowed-same-namespace` decision in that case.
+   */
+  check(args) {
+    const pn = args.principalNamespace;
+    const qn = args.queryNamespace;
+    const bothPresent = typeof pn === "string" && pn.length > 0 && typeof qn === "string" && qn.length > 0;
+    if (bothPresent && pn === qn) {
+      return {
+        allowed: true,
+        reason: "allowed-same-namespace",
+        count: 0,
+        limit: {
+          softLimit: this.config.softLimit,
+          hardLimit: this.config.hardLimit,
+          windowMs: this.config.windowMs
+        }
+      };
+    }
+    return this.record(args.principal, args.now ?? Date.now());
+  }
+  /**
+   * Clear all state. Intended for tests and for the orchestrator's
+   * lifecycle `before_reset` hook.
+   */
+  reset() {
+    this.buckets.clear();
+  }
+  /**
+   * Evict buckets whose entire timestamp list has slid out of the
+   * active window by `now`. Intended to be called periodically by a
+   * long-lived host process (e.g. from a maintenance cron) that sees
+   * many transient principals. Safe to call at any time; returns the
+   * number of buckets evicted.
+   */
+  gc(now = Date.now()) {
+    const cutoff = now - this.config.windowMs;
+    let evicted = 0;
+    for (const [principal, bucket] of this.buckets.entries()) {
+      while (bucket.timestamps.length > 0 && bucket.timestamps[0] < cutoff) {
+        bucket.timestamps.shift();
+      }
+      if (bucket.timestamps.length === 0) {
+        this.buckets.delete(principal);
+        evicted++;
+      }
+    }
+    return evicted;
+  }
+  /** For tests: current number of live buckets. */
+  bucketCount() {
+    return this.buckets.size;
+  }
+};
+
+export {
+  DEFAULT_CROSS_NAMESPACE_BUDGET,
+  CrossNamespaceBudget
+};
+//# sourceMappingURL=chunk-GDFS42HT.js.map

package/dist/chunk-GDFS42HT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cross-namespace-budget.ts"],"sourcesContent":["/**\n * Per-principal cross-namespace query-budget limiter (issue #565 PR 4/5).\n *\n * Detects and throttles bursts of recall-type operations that a principal\n * issues against namespaces *other than their own*. Thresholds come from the\n * memory-extraction threat model (`docs/security/memory-extraction-threat-model.md`\n * §6.2) and the ADAM baseline report (`docs/security/adam-baseline-2026-04.md`):\n * a T2-class same-namespace attacker plateaus at 61 queries in the published\n * baseline, so the default window is set well below that to force any\n * adaptive loop to noticeably slow down.\n *\n * Shape:\n * - Pure, in-process, per-principal sliding window. No persistence.\n * - Only cross-namespace reads count: a principal hitting only their own\n *   namespace is never throttled.\n * - The limiter is behind the `recallCrossNamespaceBudgetEnabled` feature\n *   flag (defaults to `false`) and is a no-op when disabled. This mirrors\n *   the canonical \"new filter/transform needs an enabled check\" pattern\n *   (see CLAUDE.md gotcha #30).\n *\n * The module has no side effects beyond incrementing its own counters, and\n * it does NOT take a clock dependency — callers pass the current epoch ms\n * (or let the default `Date.now()` do it) so tests can step time\n * deterministically.\n */\n\nexport interface CrossNamespaceBudgetConfig {\n  /** Feature flag. Defaults to false — a disabled limiter is always allow. */\n  enabled?: boolean;\n  /**\n   * Rolling window size in milliseconds. Counts decay out of the window\n   * as the clock advances. Default: 60_000 (1 minute).\n   */\n  windowMs?: number;\n  /**\n   * Soft cap. Once a principal has `softLimit` cross-namespace reads in the\n   * window, the limiter *records* a warning on the decision but still\n   * allows the call. Used by PR 5's anomaly detector to surface flags\n   * without blocking. Default: 10.\n   */\n  softLimit?: number;\n  /**\n   * Hard cap. Once `hardLimit` is reached, the limiter denies the call.\n   * Default: 30 — picked to be well below the T2 baseline of ~60 queries\n   * at half-plateau, so an ADAM-style adaptive loop is throttled before it\n   * meaningfully leaks.\n   */\n  hardLimit?: number;\n}\n\nexport const DEFAULT_CROSS_NAMESPACE_BUDGET: Required<CrossNamespaceBudgetConfig> =\n  Object.freeze({\n    enabled: false,\n    windowMs: 60_000,\n    softLimit: 10,\n    hardLimit: 30,\n  });\n\n/**\n * Why a call was denied / warned. Stable strings so callers can key log\n * lines and metrics on them.\n */\nexport type BudgetDecisionReason =\n  | \"allowed-same-namespace\"\n  | \"allowed-no-limit\"\n  | \"allowed-under-soft\"\n  | \"warn-over-soft\"\n  | \"deny-over-hard\";\n\nexport interface BudgetDecision {\n  allowed: boolean;\n  reason: BudgetDecisionReason;\n  /** Cross-namespace reads by this principal currently in the window. */\n  count: number;\n  /** Active config snapshot at decision time. */\n  limit: {\n    softLimit: number;\n    hardLimit: number;\n    windowMs: number;\n  };\n}\n\ninterface PrincipalBucket {\n  /** Epoch-ms timestamps of cross-namespace reads in the active window. */\n  timestamps: number[];\n}\n\n/**\n * Normalize the provided config against the defaults and reject clearly\n * invalid shapes (non-positive windows, inverted limits). Never throws —\n * returns a safe effective config the limiter can use.\n */\nfunction effectiveConfig(\n  raw: CrossNamespaceBudgetConfig | undefined,\n): Required<CrossNamespaceBudgetConfig> {\n  const base = { ...DEFAULT_CROSS_NAMESPACE_BUDGET };\n  if (!raw) return base;\n  const out = { ...base };\n  if (typeof raw.enabled === \"boolean\") out.enabled = raw.enabled;\n  if (\n    typeof raw.windowMs === \"number\" &&\n    Number.isFinite(raw.windowMs) &&\n    raw.windowMs > 0\n  ) {\n    out.windowMs = raw.windowMs;\n  }\n  if (\n    typeof raw.softLimit === \"number\" &&\n    Number.isFinite(raw.softLimit) &&\n    raw.softLimit >= 0\n  ) {\n    out.softLimit = Math.floor(raw.softLimit);\n  }\n  if (\n    typeof raw.hardLimit === \"number\" &&\n    Number.isFinite(raw.hardLimit) &&\n    raw.hardLimit >= 1\n  ) {\n    // Floor the value, then defensively require the floored result is\n    // still >= 1. `raw.hardLimit = 0.5` previously passed the `> 0`\n    // gate and floored to 0, turning a minor misconfiguration into a\n    // full denial of cross-namespace reads. Now we fall back to the\n    // default instead.\n    const floored = Math.floor(raw.hardLimit);\n    if (floored >= 1) out.hardLimit = floored;\n  }\n  if (out.softLimit > out.hardLimit) {\n    // Inverted limits -> treat soft = hard so we never warn past the deny\n    // threshold. Defensive, should never happen with well-formed config.\n    out.softLimit = out.hardLimit;\n  }\n  return out;\n}\n\n/**\n * In-process cross-namespace budget limiter. Instantiate once per\n * orchestrator / access-service.\n *\n * Threadsafe-by-construction: Node.js is single-threaded per process for\n * application code, and the limiter never awaits between read-modify-write\n * operations on its internal state.\n */\nexport class CrossNamespaceBudget {\n  private readonly config: Required<CrossNamespaceBudgetConfig>;\n  private readonly buckets = new Map<string, PrincipalBucket>();\n\n  constructor(config?: CrossNamespaceBudgetConfig) {\n    this.config = effectiveConfig(config);\n  }\n\n  /** Exposed for tests / audit surfaces. Never mutate the returned value. */\n  getConfig(): Required<CrossNamespaceBudgetConfig> {\n    return this.config;\n  }\n\n  /**\n   * Check whether `principal` is allowed to issue another cross-namespace\n   * read. Call site is expected to compare `principalNamespace` against\n   * `queryNamespace` and only pass through reads where they differ — the\n   * limiter treats every call as a cross-namespace event.\n   *\n   * @param principal Stable identifier for the calling principal (token\n   *   subject, session principal, etc.). Must be non-empty.\n   * @param now Epoch-ms clock read. Defaults to `Date.now()`; tests pass a\n   *   fixed value to step time deterministically.\n   */\n  record(principal: string, now: number = Date.now()): BudgetDecision {\n    const { enabled, windowMs, softLimit, hardLimit } = this.config;\n    const limit = { softLimit, hardLimit, windowMs };\n\n    if (!enabled) {\n      return {\n        allowed: true,\n        reason: \"allowed-no-limit\",\n        count: 0,\n        limit,\n      };\n    }\n\n    if (typeof principal !== \"string\" || principal.length === 0) {\n      // A missing principal means \"we can't attribute this call\". Rather\n      // than fail open, treat it as a cross-namespace event against a\n      // shared bucket — denial-of-service risk is bounded because the\n      // bucket is scoped per-process.\n      principal = \"__anonymous__\";\n    }\n\n    const bucket = this.buckets.get(principal) ?? { timestamps: [] };\n    const cutoff = now - windowMs;\n    // Drop timestamps that slid out of the window.\n    while (bucket.timestamps.length > 0 && bucket.timestamps[0]! < cutoff) {\n      bucket.timestamps.shift();\n    }\n\n    // Count the current call against the window BEFORE deciding — a call\n    // that crosses the deny threshold should itself be denied, not the\n    // next one. This is what the threat model calls \"fail at the Nth,\n    // not the (N+1)th\".\n    bucket.timestamps.push(now);\n    this.buckets.set(principal, bucket);\n    const count = bucket.timestamps.length;\n\n    if (count > hardLimit) {\n      // Denied: roll back the timestamp we just added so a repeated denied\n      // call does not push the bucket further into the future. This keeps\n      // the limiter stateless with respect to denied attempts.\n      bucket.timestamps.pop();\n      // Evict empty buckets (e.g. the first record after a long idle\n      // rolled the only timestamp out, then got denied and rolled back).\n      // Prevents unbounded map growth across many transient principals.\n      if (bucket.timestamps.length === 0) {\n        this.buckets.delete(principal);\n      }\n      return {\n        allowed: false,\n        reason: \"deny-over-hard\",\n        count: bucket.timestamps.length,\n        limit,\n      };\n    }\n\n    if (count > softLimit) {\n      return {\n        allowed: true,\n        reason: \"warn-over-soft\",\n        count,\n        limit,\n      };\n    }\n\n    return {\n      allowed: true,\n      reason: \"allowed-under-soft\",\n      count,\n      limit,\n    };\n  }\n\n  /**\n   * Read-only peek at whether a call would be allowed, WITHOUT recording a\n   * timestamp. Useful when the caller must inspect multiple namespaces before\n   * deciding to record a single event. The returned `count` reflects the\n   * current window state at call time.\n   */\n  peek(args: {\n    principal: string;\n    principalNamespace: string;\n    queryNamespace: string;\n    now?: number;\n  }): BudgetDecision {\n    const pn = args.principalNamespace;\n    const qn = args.queryNamespace;\n    const bothPresent =\n      typeof pn === \"string\" && pn.length > 0 &&\n      typeof qn === \"string\" && qn.length > 0;\n    if (bothPresent && pn === qn) {\n      return {\n        allowed: true,\n        reason: \"allowed-same-namespace\",\n        count: 0,\n        limit: {\n          softLimit: this.config.softLimit,\n          hardLimit: this.config.hardLimit,\n          windowMs: this.config.windowMs,\n        },\n      };\n    }\n    // Cross-namespace: simulate what record() would do without the push.\n    const { enabled, windowMs, softLimit, hardLimit } = this.config;\n    const limit = { softLimit, hardLimit, windowMs };\n    if (!enabled) {\n      return { allowed: true, reason: \"allowed-no-limit\", count: 0, limit };\n    }\n    let principal = args.principal;\n    if (typeof principal !== \"string\" || principal.length === 0) {\n      principal = \"__anonymous__\";\n    }\n    const now = args.now ?? Date.now();\n    const bucket = this.buckets.get(principal) ?? { timestamps: [] };\n    const cutoff = now - windowMs;\n    let liveCount = 0;\n    for (const ts of bucket.timestamps) {\n      if (ts >= cutoff) liveCount++;\n    }\n    const projected = liveCount + 1; // +1 for the current call\n    if (projected > hardLimit) {\n      return { allowed: false, reason: \"deny-over-hard\", count: liveCount, limit };\n    }\n    if (projected > softLimit) {\n      return { allowed: true, reason: \"warn-over-soft\", count: projected, limit };\n    }\n    return { allowed: true, reason: \"allowed-under-soft\", count: projected, limit };\n  }\n\n  /**\n   * Convenience guard that also skips the limiter when `principalNamespace`\n   * equals `queryNamespace` (same-namespace is never cross-namespace).\n   * Returns an `allowed-same-namespace` decision in that case.\n   */\n  check(args: {\n    principal: string;\n    principalNamespace: string;\n    queryNamespace: string;\n    now?: number;\n  }): BudgetDecision {\n    // Same-namespace short-circuit requires BOTH namespaces to be\n    // non-empty strings. Two empty/undefined namespaces at runtime\n    // would otherwise compare equal and fail-open — a critical bypass\n    // in a security-critical module. Force the limiter to engage when\n    // either side is missing so we never silently skip enforcement.\n    const pn = args.principalNamespace;\n    const qn = args.queryNamespace;\n    const bothPresent =\n      typeof pn === \"string\" && pn.length > 0 &&\n      typeof qn === \"string\" && qn.length > 0;\n    if (bothPresent && pn === qn) {\n      return {\n        allowed: true,\n        reason: \"allowed-same-namespace\",\n        count: 0,\n        limit: {\n          softLimit: this.config.softLimit,\n          hardLimit: this.config.hardLimit,\n          windowMs: this.config.windowMs,\n        },\n      };\n    }\n    return this.record(args.principal, args.now ?? Date.now());\n  }\n\n  /**\n   * Clear all state. Intended for tests and for the orchestrator's\n   * lifecycle `before_reset` hook.\n   */\n  reset(): void {\n    this.buckets.clear();\n  }\n\n  /**\n   * Evict buckets whose entire timestamp list has slid out of the\n   * active window by `now`. Intended to be called periodically by a\n   * long-lived host process (e.g. from a maintenance cron) that sees\n   * many transient principals. Safe to call at any time; returns the\n   * number of buckets evicted.\n   */\n  gc(now: number = Date.now()): number {\n    const cutoff = now - this.config.windowMs;\n    let evicted = 0;\n    for (const [principal, bucket] of this.buckets.entries()) {\n      while (bucket.timestamps.length > 0 && bucket.timestamps[0]! < cutoff) {\n        bucket.timestamps.shift();\n      }\n      if (bucket.timestamps.length === 0) {\n        this.buckets.delete(principal);\n        evicted++;\n      }\n    }\n    return evicted;\n  }\n\n  /** For tests: current number of live buckets. */\n  bucketCount(): number {\n    return this.buckets.size;\n  }\n}\n"],"mappings":";AAkDO,IAAM,iCACX,OAAO,OAAO;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,WAAW;AAAA,EACX,WAAW;AACb,CAAC;AAoCH,SAAS,gBACP,KACsC;AACtC,QAAM,OAAO,EAAE,GAAG,+BAA+B;AACjD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAM,EAAE,GAAG,KAAK;AACtB,MAAI,OAAO,IAAI,YAAY,UAAW,KAAI,UAAU,IAAI;AACxD,MACE,OAAO,IAAI,aAAa,YACxB,OAAO,SAAS,IAAI,QAAQ,KAC5B,IAAI,WAAW,GACf;AACA,QAAI,WAAW,IAAI;AAAA,EACrB;AACA,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,SAAS,IAAI,SAAS,KAC7B,IAAI,aAAa,GACjB;AACA,QAAI,YAAY,KAAK,MAAM,IAAI,SAAS;AAAA,EAC1C;AACA,MACE,OAAO,IAAI,cAAc,YACzB,OAAO,SAAS,IAAI,SAAS,KAC7B,IAAI,aAAa,GACjB;AAMA,UAAM,UAAU,KAAK,MAAM,IAAI,SAAS;AACxC,QAAI,WAAW,EAAG,KAAI,YAAY;AAAA,EACpC;AACA,MAAI,IAAI,YAAY,IAAI,WAAW;AAGjC,QAAI,YAAY,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAUO,IAAM,uBAAN,MAA2B;AAAA,EACf;AAAA,EACA,UAAU,oBAAI,IAA6B;AAAA,EAE5D,YAAY,QAAqC;AAC/C,SAAK,SAAS,gBAAgB,MAAM;AAAA,EACtC;AAAA;AAAA,EAGA,YAAkD;AAChD,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,OAAO,WAAmB,MAAc,KAAK,IAAI,GAAmB;AAClE,UAAM,EAAE,SAAS,UAAU,WAAW,UAAU,IAAI,KAAK;AACzD,UAAM,QAAQ,EAAE,WAAW,WAAW,SAAS;AAE/C,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP;AAAA,MACF;AAAA,IACF;AAEA,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAK3D,kBAAY;AAAA,IACd;AAEA,UAAM,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE;AAC/D,UAAM,SAAS,MAAM;AAErB,WAAO,OAAO,WAAW,SAAS,KAAK,OAAO,WAAW,CAAC,IAAK,QAAQ;AACrE,aAAO,WAAW,MAAM;AAAA,IAC1B;AAMA,WAAO,WAAW,KAAK,GAAG;AAC1B,SAAK,QAAQ,IAAI,WAAW,MAAM;AAClC,UAAM,QAAQ,OAAO,WAAW;AAEhC,QAAI,QAAQ,WAAW;AAIrB,aAAO,WAAW,IAAI;AAItB,UAAI,OAAO,WAAW,WAAW,GAAG;AAClC,aAAK,QAAQ,OAAO,SAAS;AAAA,MAC/B;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO,OAAO,WAAW;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW;AACrB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,KAAK,MAKc;AACjB,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,KAAK;AAChB,UAAM,cACJ,OAAO,OAAO,YAAY,GAAG,SAAS,KACtC,OAAO,OAAO,YAAY,GAAG,SAAS;AACxC,QAAI,eAAe,OAAO,IAAI;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,UACL,WAAW,KAAK,OAAO;AAAA,UACvB,WAAW,KAAK,OAAO;AAAA,UACvB,UAAU,KAAK,OAAO;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,UAAU,WAAW,UAAU,IAAI,KAAK;AACzD,UAAM,QAAQ,EAAE,WAAW,WAAW,SAAS;AAC/C,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,SAAS,MAAM,QAAQ,oBAAoB,OAAO,GAAG,MAAM;AAAA,IACtE;AACA,QAAI,YAAY,KAAK;AACrB,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,kBAAY;AAAA,IACd;AACA,UAAM,MAAM,KAAK,OAAO,KAAK,IAAI;AACjC,UAAM,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE,YAAY,CAAC,EAAE;AAC/D,UAAM,SAAS,MAAM;AACrB,QAAI,YAAY;AAChB,eAAW,MAAM,OAAO,YAAY;AAClC,UAAI,MAAM,OAAQ;AAAA,IACpB;AACA,UAAM,YAAY,YAAY;AAC9B,QAAI,YAAY,WAAW;AACzB,aAAO,EAAE,SAAS,OAAO,QAAQ,kBAAkB,OAAO,WAAW,MAAM;AAAA,IAC7E;AACA,QAAI,YAAY,WAAW;AACzB,aAAO,EAAE,SAAS,MAAM,QAAQ,kBAAkB,OAAO,WAAW,MAAM;AAAA,IAC5E;AACA,WAAO,EAAE,SAAS,MAAM,QAAQ,sBAAsB,OAAO,WAAW,MAAM;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAKa;AAMjB,UAAM,KAAK,KAAK;AAChB,UAAM,KAAK,KAAK;AAChB,UAAM,cACJ,OAAO,OAAO,YAAY,GAAG,SAAS,KACtC,OAAO,OAAO,YAAY,GAAG,SAAS;AACxC,QAAI,eAAe,OAAO,IAAI;AAC5B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,OAAO;AAAA,UACL,WAAW,KAAK,OAAO;AAAA,UACvB,WAAW,KAAK,OAAO;AAAA,UACvB,UAAU,KAAK,OAAO;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK,OAAO,KAAK,WAAW,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAc;AACZ,SAAK,QAAQ,MAAM;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,GAAG,MAAc,KAAK,IAAI,GAAW;AACnC,UAAM,SAAS,MAAM,KAAK,OAAO;AACjC,QAAI,UAAU;AACd,eAAW,CAAC,WAAW,MAAM,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACxD,aAAO,OAAO,WAAW,SAAS,KAAK,OAAO,WAAW,CAAC,IAAK,QAAQ;AACrE,eAAO,WAAW,MAAM;AAAA,MAC1B;AACA,UAAI,OAAO,WAAW,WAAW,GAAG;AAClC,aAAK,QAAQ,OAAO,SAAS;AAC7B;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,cAAsB;AACpB,WAAO,KAAK,QAAQ;AAAA,EACtB;AACF;","names":[]}