@remnic/core 1.1.1 → 1.1.3

package/dist/connectors-cli-DFGtY2DB.d.ts

@@ -0,0 +1,257 @@
+import { b as ConnectorCursor, a as ConnectorDocument } from './framework-CyHYDcri.js';
+
+/**
+ * @remnic/core — Live Connectors State Store (issue #683 PR 1/N)
+ *
+ * Persists per-connector cursor + sync metadata to
+ *   `<memoryDir>/state/connectors/<id>.json`
+ *
+ * Reasons this lives next to memory data, not in user config:
+ *   - cursors are *operational* state that should travel with the memory
+ *     directory when a user moves it across machines;
+ *   - it keeps memory + ingest provenance co-located so tooling that backs up
+ *     the memory directory captures cursor state too.
+ *
+ * Atomic-write contract (CLAUDE.md gotcha #54):
+ *   - We NEVER `rmSync(target)` before `renameSync(tmp, target)`.
+ *   - Writes go to a sibling tmp file and `rename()` swaps it in.
+ *   - On error, the tmp file is best-effort cleaned up; the previous good
+ *     state file is left untouched.
+ *
+ * Privacy: cursors are opaque connector-defined strings. We do not log them
+ * and do not surface them through user-visible APIs. Document content NEVER
+ * touches this module.
+ */
+
+/**
+ * Status of the most recent sync attempt for a connector.
+ *
+ * `"never"` is distinct from `"success"` so callers can detect
+ * "registered but never run" without inspecting timestamps. Per CLAUDE.md
+ * gotcha #34, we deliberately distinguish empty/unknown from failure states.
+ */
+type ConnectorSyncStatus = "success" | "error" | "never";
+/**
+ * Persisted per-connector state.
+ *
+ * Stored as pretty-printed JSON for human inspection — the file is small
+ * (one record per connector) and operators may need to debug stuck cursors
+ * by hand.
+ */
+interface ConnectorState {
+    /** Connector id. Matches the filename stem. */
+    readonly id: string;
+    /** Last persisted cursor, or `null` if the connector has never synced. */
+    readonly cursor: ConnectorCursor | null;
+    /** ISO 8601 timestamp of the last completed sync attempt, or `null`. */
+    readonly lastSyncAt: string | null;
+    /** Status of the last completed sync attempt. */
+    readonly lastSyncStatus: ConnectorSyncStatus;
+    /** Optional error message from the last failed sync. Truncated to 1 KB. */
+    readonly lastSyncError?: string;
+    /** Cumulative count of documents successfully imported across all syncs. */
+    readonly totalDocsImported: number;
+    /** ISO 8601 timestamp of when this state record was last written. */
+    readonly updatedAt: string;
+}
+/**
+ * Read the persisted state for a single connector.
+ *
+ * Returns `null` if the file does not exist (ENOENT). Throws on any other
+ * I/O error or on shape mismatch — operators should see corruption loudly.
+ *
+ * Rejects symlinks anywhere on the path so a planted symlink can't redirect
+ * reads outside the memory root. (PR #724 review.)
+ */
+declare function readConnectorState(memoryDir: string, id: string): Promise<ConnectorState | null>;
+/**
+ * Write state atomically: create-tmp + rename. Never destroys the previous
+ * file before the new one is in place — see CLAUDE.md gotcha #54.
+ *
+ * We accept `Omit<ConnectorState, "updatedAt">` and stamp `updatedAt`
+ * ourselves so callers can't accidentally persist a stale timestamp.
+ */
+declare function writeConnectorState(memoryDir: string, id: string, state: Omit<ConnectorState, "updatedAt">): Promise<ConnectorState>;
+/**
+ * Enumerate every persisted connector state. Returns an empty array when
+ * the directory does not exist yet (clean install, no syncs ever run).
+ *
+ * Files that do not match the `<id>.json` naming rule are skipped — this
+ * keeps stray editor backups (`.json~`, `.swp`) from breaking enumeration.
+ *
+ * Corruption (unparseable JSON, shape mismatch, id mismatch) is also
+ * skipped so one bad file doesn't take down the listing. Operators
+ * inspecting `state/connectors/` can still see the offending file by hand.
+ *
+ * **Genuine I/O failures (`EACCES`, `EIO`, etc.) are NOT swallowed** —
+ * silently returning an incomplete state set would make active connectors
+ * appear missing and trigger duplicate ingestion on the next scheduler tick.
+ * (PR #724 review.)
+ */
+declare function listConnectorStates(memoryDir: string): Promise<ConnectorState[]>;
+
+/**
+ * `remnic connectors` CLI helpers (issue #683 PR 6/N).
+ *
+ * Three subcommands:
+ *
+ *   remnic connectors list
+ *     Lists all configured live connectors, their enabled state, last poll
+ *     time, and last error.  Output formats: text (default), markdown, json.
+ *
+ *   remnic connectors status
+ *     Identical data to `list` but defaults to JSON output so scripts can
+ *     reliably parse it.  Accepts `--format` to override.
+ *
+ *   remnic connectors run <name>
+ *     Manually triggers a single `syncIncremental()` pass for the named
+ *     connector.  Operator debug surface — useful when you want to test
+ *     credentials without waiting for the scheduler tick.  Prints the
+ *     number of new documents imported plus any error.
+ *
+ * Design decisions:
+ *
+ *   - Pure functions for list / status / run option parsing so they can be
+ *     unit-tested without booting an orchestrator (CLAUDE.md rules 14 + 51).
+ *   - Rendering lives here (not in cli.ts) so HTTP/MCP surfaces can reuse the
+ *     same output without forking formatting (CLAUDE.md rule 22).
+ *   - The `run` command requires the caller to pass a `pollFn` callback
+ *     (wrapping the actual connector's `syncIncremental`).  This keeps the
+ *     helper module free of direct orchestrator / live-connector imports while
+ *     still being testable (CLAUDE.md rule 33 — mock signatures must match
+ *     production).
+ *   - CLAUDE.md rule 51: invalid `--format` throws with listed options; unknown
+ *     connector name in `run` throws a descriptive error; `--format` without a
+ *     value is caught by Commander's built-in argument check.
+ *   - `runConnectorPollOnce` encapsulates the persist-before-cursor-advance
+ *     contract (CLAUDE.md gotcha #25, #43) so it can be unit-tested in
+ *     isolation without an orchestrator.
+ */
+
+/**
+ * A lightweight descriptor for one live connector, assembled from the parsed
+ * config and any persisted state.  The CLI handler builds this from
+ * `orchestrator.config.connectors` + `listConnectorStates(memoryDir)`.
+ */
+interface ConnectorRow {
+    /** Stable connector id (e.g. `"google-drive"`, `"notion"`). */
+    id: string;
+    /** Human-readable display name. */
+    displayName: string;
+    /** Whether the operator has enabled this connector in config. */
+    enabled: boolean;
+    /** Persisted sync state, or `null` if no sync has ever run. */
+    state: ConnectorState | null;
+}
+/**
+ * Result returned by the `run` command's poll function.
+ */
+interface ConnectorRunResult {
+    /** Number of new documents imported in this pass. */
+    docsImported: number;
+    /**
+     * Error message if the sync or ingest failed, undefined on full success.
+     * When only the cursor write failed after a successful ingest, this field is
+     * undefined and `stateWriteError` carries the failure. When persisting error
+     * state fails after a sync/ingest error, both fields are set so callers can
+     * preserve the primary failure while also reporting stale persisted state.
+     */
+    error?: string;
+    /**
+     * Set when cursor/error-state persistence fails. On the success path,
+     * `docsImported` reflects the actual count of successfully ingested docs so
+     * the operator knows data was persisted even though the cursor did not
+     * advance. On the error path, `error` preserves the primary sync/ingest
+     * failure and this field reports the secondary persistence failure.
+     */
+    stateWriteError?: string;
+}
+declare const CONNECTORS_OUTPUT_FORMATS: readonly ["text", "markdown", "json"];
+type ConnectorsOutputFormat = (typeof CONNECTORS_OUTPUT_FORMATS)[number];
+/**
+ * Validate `--format <fmt>`.  Throws a listed-options error for any value not
+ * in `CONNECTORS_OUTPUT_FORMATS`.  Returns the given default when the value is
+ * `undefined` (no flag supplied).
+ */
+declare function parseConnectorsFormat(value: unknown, defaultFormat?: ConnectorsOutputFormat): ConnectorsOutputFormat;
+interface ParsedConnectorsListOptions {
+    format: ConnectorsOutputFormat;
+}
+interface ParsedConnectorsStatusOptions {
+    /** `status` defaults to JSON for scripting; `--format` can override. */
+    format: ConnectorsOutputFormat;
+}
+/**
+ * Validate the option bag for `remnic connectors list`.
+ */
+declare function parseConnectorsListOptions(options: Record<string, unknown>): ParsedConnectorsListOptions;
+/**
+ * Validate the option bag for `remnic connectors status`.
+ * Defaults to `json` (machine-readable) unless `--format` overrides.
+ */
+declare function parseConnectorsStatusOptions(options: Record<string, unknown>): ParsedConnectorsStatusOptions;
+/**
+ * Validate the positional `<name>` argument for `remnic connectors run`.
+ */
+declare function parseConnectorsRunName(rawName: unknown): string;
+/**
+ * Render connector rows for `remnic connectors list` / `remnic connectors status`.
+ */
+declare function renderConnectorsList(rows: readonly ConnectorRow[], format: ConnectorsOutputFormat): string;
+/**
+ * Render the result of a manual `remnic connectors run <name>` invocation.
+ */
+declare function renderConnectorsRunResult(connectorId: string, result: ConnectorRunResult, format: ConnectorsOutputFormat): string;
+/**
+ * Arguments for a single connector poll pass.
+ *
+ * All I/O is injectable so callers (cli.ts) can supply real implementations
+ * and tests can supply lightweight stubs without booting an orchestrator.
+ */
+interface RunConnectorPollOnceArgs {
+    /** Connector identifier (used in error/success state writes). */
+    connectorId: string;
+    /** Prior persisted state, or `null` on the very first sync. */
+    priorState: ConnectorState | null;
+    /**
+     * Perform a single incremental sync.  Returns newly-fetched documents and
+     * the cursor that should be persisted on success.
+     */
+    syncFn: (cursor: ConnectorCursor | null) => Promise<{
+        newDocs: ConnectorDocument[];
+        nextCursor: ConnectorCursor;
+    }>;
+    /**
+     * Ingest fetched documents into the memory layer.  Called BEFORE the cursor
+     * is advanced.  If this throws the cursor is NOT advanced (CLAUDE.md gotcha
+     * #25 — don't destroy old state before confirming new state succeeds).
+     */
+    ingestFn: (docs: ConnectorDocument[]) => Promise<void>;
+    /**
+     * Persist connector state (cursor + metadata).  Called after `ingestFn`
+     * succeeds (success path) or when `syncFn` / `ingestFn` throws (error path,
+     * with old cursor retained).
+     */
+    writeCursorFn: (state: {
+        cursor: ConnectorCursor | null;
+        lastSyncStatus: ConnectorSyncStatus;
+        lastSyncError?: string;
+        totalDocsImported: number;
+    }) => Promise<void>;
+}
+/**
+ * Execute one `syncIncremental` pass for a live connector, enforcing the
+ * persist-before-advance-cursor contract.
+ *
+ * Invariant (CLAUDE.md gotcha #25 + #43):
+ *   1. `syncFn` fetches new docs and a next cursor.
+ *   2. `ingestFn` persists the docs into the memory layer.
+ *   3. Only if (2) succeeds does `writeCursorFn` advance the cursor.
+ *   4. If (1) or (2) throws, `writeCursorFn` is still called but retains the
+ *      **prior** cursor so the next poll re-fetches the same window.
+ *
+ * Returns the `ConnectorRunResult` that `cli.ts` uses for output rendering.
+ */
+declare function runConnectorPollOnce(args: RunConnectorPollOnceArgs): Promise<ConnectorRunResult>;
+
+export { CONNECTORS_OUTPUT_FORMATS as C, type ParsedConnectorsListOptions as P, type RunConnectorPollOnceArgs as R, type ConnectorRow as a, type ConnectorRunResult as b, type ConnectorState as c, type ConnectorSyncStatus as d, type ConnectorsOutputFormat as e, type ParsedConnectorsStatusOptions as f, parseConnectorsListOptions as g, parseConnectorsRunName as h, parseConnectorsStatusOptions as i, renderConnectorsList as j, renderConnectorsRunResult as k, listConnectorStates as l, runConnectorPollOnce as m, parseConnectorsFormat as p, readConnectorState as r, writeConnectorState as w };

package/dist/connectors-cli.d.ts

@@ -0,0 +1,2 @@
+import './framework-CyHYDcri.js';
+export { C as CONNECTORS_OUTPUT_FORMATS, a as ConnectorRow, b as ConnectorRunResult, e as ConnectorsOutputFormat, P as ParsedConnectorsListOptions, f as ParsedConnectorsStatusOptions, R as RunConnectorPollOnceArgs, p as parseConnectorsFormat, g as parseConnectorsListOptions, h as parseConnectorsRunName, i as parseConnectorsStatusOptions, j as renderConnectorsList, k as renderConnectorsRunResult, m as runConnectorPollOnce } from './connectors-cli-DFGtY2DB.js';

package/dist/connectors-cli.js

@@ -0,0 +1,22 @@
+import {
+  CONNECTORS_OUTPUT_FORMATS,
+  parseConnectorsFormat,
+  parseConnectorsListOptions,
+  parseConnectorsRunName,
+  parseConnectorsStatusOptions,
+  renderConnectorsList,
+  renderConnectorsRunResult,
+  runConnectorPollOnce
+} from "./chunk-OZHRDTDX.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  CONNECTORS_OUTPUT_FORMATS,
+  parseConnectorsFormat,
+  parseConnectorsListOptions,
+  parseConnectorsRunName,
+  parseConnectorsStatusOptions,
+  renderConnectorsList,
+  renderConnectorsRunResult,
+  runConnectorPollOnce
+};
+//# sourceMappingURL=connectors-cli.js.map

package/dist/connectors-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/consolidation-operator.d.ts

@@ -20,22 +20,82 @@
  *   memory.
  * - `update` — a newer value supersedes an older value within the same
  *   logical fact.
+ * - `pattern-reinforcement` (issue #687 PR 2/4) — emitted by the
+ *   pattern-reinforcement maintenance job when it clusters duplicate
+ *   non-procedural memories and promotes the most recent member to
+ *   canonical.  Unlike the other operators, the job does not produce
+ *   page-versioning snapshots — it just stamps reinforcement metadata
+ *   on the canonical and points superseded duplicates at it.  See
+ *   `maintenance/pattern-reinforcement.ts`.
  */
-type ConsolidationOperator = "split" | "merge" | "update";
+type ConsolidationOperator = "split" | "merge" | "update" | "pattern-reinforcement";
 /**
  * Allowed values for the `derived_via` frontmatter field.  Used by storage
  * validation to reject unknown operator values on write.
  */
 declare const CONSOLIDATION_OPERATORS: readonly ConsolidationOperator[];
 /**
- * Validate a `derived_from` entry string.  Returns `true` if the entry
- * parses as `<non-empty path>:<integer >= 0>`.  Kept pure so storage and
- * future CLI/doctor paths can share the same validator.
+ * Regular expression for validating a memory-id `derived_from` entry
+ * (issue #687 PR 2/4).  Pattern reinforcement records source memory IDs
+ * directly rather than page-versioning snapshots, so we also need to
+ * accept that shape.
+ *
+ * Memory IDs are alphanumeric with hyphens, underscores, or COLONS —
+ * the namespace-prefixed form (e.g. `global:fact-abc-123`,
+ * `entity:person-alice`) is a legitimate ID format already used
+ * throughout the graph-retrieval code path (`stripDerivedFromVersion`).
+ * The disambiguation against `<path>:<version>` is *not* "no colons
+ * allowed" — it's "the segment after the last colon must NOT be a
+ * non-negative integer" (PR #730 review feedback, Codex P1).
+ *
+ * Slashes and dots remain forbidden so paths cannot accidentally pass
+ * as memory IDs.
+ *
+ * Exported so the consolidation-provenance integrity scanner (PR
+ * #730 review feedback) can recognize bare memory IDs instead of
+ * flagging them as malformed snapshot references.
+ */
+declare const DERIVED_FROM_MEMORY_ID_RE: RegExp;
+/**
+ * Validate a `derived_from` entry string.  Returns `true` for either
+ * - the snapshot format `<non-empty path>:<integer >= 0>` (issue #561), or
+ * - a memory-id of the form `[A-Za-z0-9][A-Za-z0-9_:-]*` (issue #687
+ *   PR 2/4 — used by pattern-reinforcement provenance).  Memory IDs
+ *   may include `:` for namespace-prefixed forms like
+ *   `global:fact-abc-123` (PR #730 review feedback, Codex P1).
+ *
+ * Disambiguation rule: only treat the entry as `<path>:<version>` when
+ * the trailing segment after the last `:` is a non-negative integer
+ * AND the left side looks like a path (contains `/` or `.`).
+ * Otherwise treat the entire string as a memory ID.  This is the same
+ * heuristic the graph retrieval path uses when splitting derived_from
+ * references back into a memory id.
+ *
+ * Kept pure so storage and future CLI/doctor paths can share the same
+ * validator.
  */
 declare function isValidDerivedFromEntry(entry: unknown): entry is string;
 /**
  * Type guard for `ConsolidationOperator`.
  */
 declare function isConsolidationOperator(value: unknown): value is ConsolidationOperator;
+/**
+ * Narrow operator vocabulary for the LLM-driven semantic-consolidation
+ * pass (issue #561 PR 3).  This explicitly excludes
+ * `"pattern-reinforcement"` (issue #687 PR 2/4), which is reserved for
+ * the maintenance job and must NEVER be emitted by the consolidation
+ * LLM.  Without this narrow gate, a hallucinated
+ * `{"operator":"pattern-reinforcement"}` response from the LLM would
+ * write misleading provenance on a semantic-consolidation memory
+ * (Cursor Bugbot review, PR #730 head `aa1c2a8`).
+ */
+type SemanticConsolidationLlmOperator = "split" | "merge" | "update";
+/**
+ * Type guard restricted to the operator subset the
+ * semantic-consolidation LLM is allowed to emit.  Use this in any
+ * code path that validates LLM output — `isConsolidationOperator` is
+ * for validating values that came from disk / internal callers.
+ */
+declare function isSemanticConsolidationLlmOperator(value: unknown): value is SemanticConsolidationLlmOperator;
 
-export { CONSOLIDATION_OPERATORS, type ConsolidationOperator, isConsolidationOperator, isValidDerivedFromEntry };
+export { CONSOLIDATION_OPERATORS, type ConsolidationOperator, DERIVED_FROM_MEMORY_ID_RE, type SemanticConsolidationLlmOperator, isConsolidationOperator, isSemanticConsolidationLlmOperator, isValidDerivedFromEntry };

package/dist/consolidation-operator.js

@@ -1,11 +1,16 @@
 import {
   CONSOLIDATION_OPERATORS,
+  DERIVED_FROM_MEMORY_ID_RE,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry
-} from "./chunk-X6GF3FX2.js";
+} from "./chunk-G7D6GZ5J.js";
+import "./chunk-PZ5AY32C.js";
 export {
   CONSOLIDATION_OPERATORS,
+  DERIVED_FROM_MEMORY_ID_RE,
   isConsolidationOperator,
+  isSemanticConsolidationLlmOperator,
   isValidDerivedFromEntry
 };
 //# sourceMappingURL=consolidation-operator.js.map

package/dist/consolidation-provenance-check.d.ts

@@ -2,7 +2,7 @@ import { StorageManager } from './storage.js';
 import './page-versioning.js';
 import './consolidation-operator.js';
 import './types.js';
-import './memory-projection-store-DeSXPh1j.js';
+import './memory-projection-store-D3vBHS4J.js';
 import 'better-sqlite3';
 
 /**

package/dist/consolidation-provenance-check.js

@@ -1,8 +1,9 @@
 import {
   runConsolidationProvenanceCheck
-} from "./chunk-ULYOGL6R.js";
-import "./chunk-X6GF3FX2.js";
+} from "./chunk-5HRY2WRF.js";
+import "./chunk-G7D6GZ5J.js";
 import "./chunk-FAAFWE4G.js";
+import "./chunk-PZ5AY32C.js";
 export {
   runConsolidationProvenanceCheck
 };

package/dist/consolidation-undo.d.ts

@@ -2,7 +2,7 @@ import { StorageManager } from './storage.js';
 import { VersioningConfig } from './page-versioning.js';
 import './consolidation-operator.js';
 import './types.js';
-import './memory-projection-store-DeSXPh1j.js';
+import './memory-projection-store-D3vBHS4J.js';
 import 'better-sqlite3';
 
 /**

package/dist/consolidation-undo.js

@@ -1,6 +1,7 @@
 import {
   getVersion
 } from "./chunk-FAAFWE4G.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/consolidation-undo.ts
 import path from "path";

package/dist/consolidation-undo.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/consolidation-undo.ts"],"sourcesContent":["/**\n * Consolidation undo (issue #561 PR 5).\n *\n * Reverts a consolidated memory by restoring each source memory from its\n * `derived_from` snapshot and archiving the target.\n *\n * Contract:\n *   - Load the target memory markdown file via its absolute path.\n *   - For every `\"<rel>:<version>\"` entry in `derived_from`, fetch the\n *     snapshot content via `page-versioning.getVersion` and restore it\n *     to the original relative path.  If the restore target file\n *     already exists, we skip overwriting it (the source was never\n *     archived, or was re-created since) and record the skip.\n *   - Archive the target with reason code `\"consolidation-undo\"` so the\n *     lifecycle ledger records the undo.\n *   - Dry-run mode produces the same plan without touching disk.\n *\n * The helper is kept pure over `StorageManager` so the CLI can reuse it\n * without additional wiring, and tests can exercise the plan logic\n * directly.\n */\n\nimport path from \"node:path\";\nimport { mkdir, writeFile, access, realpath, lstat } from \"node:fs/promises\";\nimport { constants as fsConstants } from \"node:fs\";\nimport type { StorageManager } from \"./storage.js\";\nimport type { VersioningConfig } from \"./page-versioning.js\";\nimport { getVersion } from \"./page-versioning.js\";\n\n/**\n * Outcome of restoring a single `derived_from` source.\n */\nexport interface ConsolidationUndoRestore {\n  /** The raw `\"<relpath>:<version>\"` entry from `derived_from`. */\n  entry: string;\n  /** Absolute path where the source would be / was restored. */\n  sourcePath: string;\n  /** What actually happened. */\n  outcome:\n    | \"restored\"\n    | \"skipped_file_exists\"\n    | \"skipped_non_regular_file\"\n    | \"skipped_snapshot_missing\"\n    | \"skipped_malformed_entry\"\n    | \"skipped_outside_memory_dir\"\n    | \"skipped_non_active_path\"\n    | \"skipped_self_referential\"\n    | \"skipped_write_failed\"\n    | \"skipped_blocked_by_other_failures\"\n    | \"skipped_dry_run\";\n  /** Human-readable detail. */\n  detail?: string;\n}\n\n/**\n * Plan + result of a `remnic consolidate undo` invocation.\n */\nexport interface ConsolidationUndoResult {\n  /** Absolute path to the target memory. */\n  targetPath: string;\n  /** True when the target was archived successfully. */\n  targetArchived: boolean;\n  /** Per-source restore outcomes. */\n  restores: ConsolidationUndoRestore[];\n  /** Whether the run was a dry-run plan only. */\n  dryRun: boolean;\n  /** Fatal error, if any — the run bails early. */\n  error?: string;\n}\n\nconst DERIVED_FROM_ENTRY_RE = /^(.+):(\\d+)$/;\n\nfunction parseEntry(entry: unknown): { pagePath: string; versionId: string } | null {\n  // Non-string entries (PR #637 round-3 review, cursor Low) can arrive\n  // from hostile on-disk frontmatter — guard against a .match() crash.\n  if (typeof entry !== \"string\") return null;\n  const match = entry.match(DERIVED_FROM_ENTRY_RE);\n  if (!match) return null;\n  return { pagePath: match[1], versionId: match[2] };\n}\n\n/**\n * Verify that `candidate` resolves inside `root` (defense against\n * path-traversal in `derived_from` entries and user-facing target\n * paths).  Path-string normalization only; for symlink-aware checks\n * use `isInsideDirectoryRealpath`.  Both paths are resolved to\n * absolute form before comparison so `..` segments, symlinks-as-\n * strings, and relative prefixes are normalized.\n */\nexport function isInsideDirectory(candidate: string, root: string): boolean {\n  const normRoot = path.resolve(root);\n  const normCandidate = path.resolve(candidate);\n  const rel = path.relative(normRoot, normCandidate);\n  if (rel.length === 0) return true;\n  if (rel.startsWith(\"..\")) return false;\n  if (path.isAbsolute(rel)) return false;\n  return true;\n}\n\n/**\n * Symlink-aware containment check (PR #637 round-2 review, codex P1).\n *\n * `isInsideDirectory` only normalizes path strings — if a `derived_from`\n * entry resolves through a symlink inside `memoryDir` that points\n * outside, the string check passes but the subsequent `writeFile` would\n * land outside the memory tree.  Use this guard for any path that is\n * about to be written.\n *\n * Walks every parent directory between `candidate` and `root`,\n * `realpath`-ing each segment that exists and rejecting when any\n * segment escapes `root`.  Non-existent parents are resolved as the\n * canonicalized deepest-existing ancestor plus the trailing segments,\n * so a not-yet-created target file still gets the symlink check on its\n * existing parent directories.\n */\nexport async function isInsideDirectoryRealpath(\n  candidate: string,\n  root: string,\n): Promise<boolean> {\n  if (!isInsideDirectory(candidate, root)) return false;\n  // Reject raw `..` segments before canonicalization so that symlinks\n  // cannot be hidden behind intermediate dot-dot components (PR #637\n  // round-14 review, codex P1).\n  const rawSegments = candidate.replace(/\\\\/g, \"/\").split(\"/\");\n  if (rawSegments.some((s) => s === \"..\")) return false;\n  let resolvedRoot: string;\n  try {\n    resolvedRoot = await realpath(path.resolve(root));\n  } catch {\n    return false;\n  }\n  const normCandidate = path.resolve(candidate);\n\n  // Reject dangling symlinks (PR #637 round-3 review, codex P1).\n  // If the candidate itself is a symlink (even if its target doesn't\n  // exist), Node will follow it when we later call `writeFile`.\n  // `lstat` inspects the link itself without dereferencing; if it\n  // succeeds and reports a symlink, we treat the candidate as\n  // unsafe.  We must check every non-root ancestor too — a symlink\n  // anywhere along the path lets an attacker redirect writes.\n  const normRoot = path.resolve(root);\n  const relFromRoot = path.relative(normRoot, normCandidate);\n  const segments = relFromRoot.length > 0 ? relFromRoot.split(path.sep) : [];\n  for (let i = 0; i <= segments.length; i++) {\n    const probe = i === 0 ? normRoot : path.join(normRoot, ...segments.slice(0, i));\n    try {\n      const st = await lstat(probe);\n      if (st.isSymbolicLink() && probe !== normRoot) {\n        // A symlink on the path — resolve THIS segment and bail out\n        // if the resolved target escapes `resolvedRoot`.\n        let target: string;\n        try {\n          target = await realpath(probe);\n        } catch {\n          // Dangling symlink inside memoryDir — always unsafe.\n          return false;\n        }\n        const rel = path.relative(resolvedRoot, target);\n        if (rel.length === 0) continue;\n        if (rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n      }\n    } catch {\n      // Segment doesn't exist yet — that's fine, fall through to the\n      // textual containment verification below.\n    }\n  }\n\n  // Walk up from the candidate until we hit a path that exists, then\n  // realpath THAT and re-apply the trailing segments textually.\n  const parts = normCandidate.split(path.sep);\n  for (let i = parts.length; i > 0; i--) {\n    const probe = parts.slice(0, i).join(path.sep) || path.sep;\n    try {\n      const resolved = await realpath(probe);\n      // Re-join any trailing segments that didn't exist yet.\n      const trailing = parts.slice(i).join(path.sep);\n      const final = trailing.length > 0 ? path.join(resolved, trailing) : resolved;\n      // Now apply the textual containment check against the canonical\n      // `resolvedRoot`.\n      const rel = path.relative(resolvedRoot, final);\n      if (rel.length === 0) return true;\n      if (rel.startsWith(\"..\")) return false;\n      if (path.isAbsolute(rel)) return false;\n      return true;\n    } catch {\n      continue;\n    }\n  }\n  // Nothing along the path resolvable — treat as outside by default.\n  return false;\n}\n\n/**\n * Directories under memoryDir that are NOT active memory locations.\n * A `derived_from` entry pointing into one of these should not be\n * counted as \"recovered_existing\" (PR #637 round-7 review, codex P2).\n * The versioning sidecar directory is included dynamically via the\n * `sidecarDir` parameter (PR #637 round-8 review, codex P2).\n */\nconst NON_ACTIVE_PREFIXES = [\"archive/\", \"state/\"];\n\n/**\n * Normalize a relative path by collapsing `.` and `..` segments so\n * that crafted entries like `\"facts/../archive/x.md\"` are reduced to\n * `\"archive/x.md\"` before the non-active-prefix check.\n */\nfunction normalizeRelativePath(p: string): string {\n  // Normalize separators, split into segments, then resolve.\n  const parts = p.replace(/\\\\/g, \"/\").split(\"/\");\n  const resolved: string[] = [];\n  for (const seg of parts) {\n    if (seg === \"\" || seg === \".\") continue;\n    if (seg === \"..\") {\n      if (resolved.length > 0) resolved.pop();\n      // If \"..\" pops past the root, we let the caller's containment\n      // check catch it — don't silently drop.\n    } else {\n      resolved.push(seg);\n    }\n  }\n  return resolved.join(\"/\");\n}\n\n/**\n * Check that a relative path (relative to memoryDir) points to an\n * active memory location rather than an internal/archive directory.\n * Returns `true` when the normalised `pagePath` does NOT start with\n * a known non-active prefix.\n *\n * @param pagePath   Relative path from `derived_from` entry.\n * @param sidecarDir Optional versioning sidecar directory name\n *                   (e.g. `\".versions\"`).  When provided, paths\n *                   under this directory are also rejected as\n *                   non-active.\n */\nexport function isActiveMemoryRelativePath(\n  pagePath: string,\n  sidecarDir?: string,\n): boolean {\n  const normalized = normalizeRelativePath(pagePath);\n  const prefixes = [...NON_ACTIVE_PREFIXES];\n  if (sidecarDir) {\n    const normSidecar = normalizeRelativePath(sidecarDir);\n    prefixes.push(normSidecar + \"/\");\n  }\n  for (const prefix of prefixes) {\n    if (normalized === prefix.slice(0, -1) || normalized.startsWith(prefix)) {\n      return false;\n    }\n  }\n  return true;\n}\n\nasync function isRegularFile(p: string): Promise<boolean> {\n  try {\n    const st = await lstat(p);\n    return st.isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function fileExists(p: string): Promise<boolean> {\n  try {\n    await access(p, fsConstants.F_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Perform a consolidation-undo operation.\n *\n * @param options.storage        Storage manager for the memory directory.\n * @param options.memoryDir      Absolute memory directory root.\n * @param options.targetPath     Absolute path to the consolidated memory.\n * @param options.versioning     Page-versioning config (sidecarDir must\n *                               match the sidecar layout used when the\n *                               snapshots were created).\n * @param options.dryRun         When true, compute the plan but do not\n *                               write or archive.\n */\nexport async function runConsolidationUndo(options: {\n  storage: StorageManager;\n  memoryDir: string;\n  targetPath: string;\n  versioning: VersioningConfig;\n  dryRun?: boolean;\n}): Promise<ConsolidationUndoResult> {\n  const { storage, memoryDir, targetPath, versioning } = options;\n  const dryRun = options.dryRun === true;\n\n  const result: ConsolidationUndoResult = {\n    targetPath,\n    targetArchived: false,\n    restores: [],\n    dryRun,\n  };\n\n  // Defense against path-traversal (PR #637 review, codex P1): refuse\n  // to operate on a target outside the configured memory directory.\n  // Archive moves and eventual unlink would otherwise let an operator\n  // accidentally destroy an unrelated file with memory-like\n  // frontmatter.  Uses the realpath-aware check so a symlinked\n  // directory inside `memoryDir` can't tunnel a target past the guard.\n  if (!(await isInsideDirectoryRealpath(targetPath, memoryDir))) {\n    result.error = `target path ${targetPath} is outside memory directory ${memoryDir}`;\n    return result;\n  }\n\n  // Reject targets in non-active directories (archive/, state/,\n  // versioning sidecar).  A target inside `.versions/...` would be\n  // a sidecar snapshot, not a real consolidated memory; archiving\n  // it would silently delete version history (PR #637 round-8\n  // review, codex P2).\n  const targetRel = path.relative(memoryDir, targetPath);\n  if (!isActiveMemoryRelativePath(targetRel, versioning.sidecarDir)) {\n    result.error = `target path \"${targetRel}\" is inside a non-active directory — refusing to operate`;\n    return result;\n  }\n\n  // Load the target memory.  readMemoryByPath returns null when the file\n  // is absent or unparseable — surface that as a fatal error because the\n  // caller cannot continue without a derived_from list.\n  const target = await storage.readMemoryByPath(targetPath);\n  if (!target) {\n    result.error = `could not load target memory at ${targetPath}`;\n    return result;\n  }\n\n  const derivedFrom = target.frontmatter.derived_from;\n  if (!Array.isArray(derivedFrom) || derivedFrom.length === 0) {\n    result.error = \"target memory has no derived_from entries — nothing to undo\";\n    return result;\n  }\n\n  // Two-pass plan + execute (PR #637 round-4 review, cursor Medium):\n  // the undo is \"all-or-nothing\" both for the archive decision AND\n  // for the per-source writes.  First pass validates + loads every\n  // snapshot into memory; second pass writes only if every source\n  // would succeed.  This prevents the previous eager-write behaviour\n  // where a later-failing source would leave earlier sources already\n  // written to disk alongside an unarchived consolidated target.\n  type RestorePlan =\n    | { kind: \"skip\"; restore: ConsolidationUndoRestore }\n    | { kind: \"write\"; entry: string; sourcePath: string; content: string }\n    | { kind: \"recovered_existing\"; entry: string; sourcePath: string };\n\n  const plans: RestorePlan[] = [];\n  for (const rawEntry of derivedFrom) {\n    const entry = typeof rawEntry === \"string\" ? rawEntry : String(rawEntry);\n    const parsed = parseEntry(rawEntry);\n    if (!parsed) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath: \"\",\n          outcome: \"skipped_malformed_entry\",\n          detail: `expected \"<path>:<version>\" shape`,\n        },\n      });\n      continue;\n    }\n\n    // Reject absolute paths in derived_from entries (PR #637 round-10\n    // review, codex P1).  An absolute pagePath would cause path.join to\n    // ignore memoryDir, bypassing the active-directory guard downstream.\n    if (path.isAbsolute(parsed.pagePath)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath: parsed.pagePath,\n          outcome: \"skipped_malformed_entry\",\n          detail: `derived_from path must be relative, got absolute: \"${parsed.pagePath}\"`,\n        },\n      });\n      continue;\n    }\n\n    const sourcePath = path.join(memoryDir, parsed.pagePath);\n\n    if (!(await isInsideDirectoryRealpath(sourcePath, memoryDir))) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_outside_memory_dir\",\n          detail: `resolved path escapes memory directory ${memoryDir}`,\n        },\n      });\n      continue;\n    }\n\n    // Reject source paths inside non-active directories (archive/,\n    // state/, versioning sidecar).  A crafted or corrupted derived_from\n    // entry like \"archive/2024-01-01/x.md:1\" would otherwise be counted\n    // as \"recovered_existing\" even though no active memory was restored.\n    // Also resolve symlinks before checking — a derived_from entry like\n    // \"facts/link/stale.md:1\" where `facts/link` points to `archive/…`\n    // must be caught (PR #637 round-8 review, cursor+codex).\n    let resolvedRelative = parsed.pagePath;\n    try {\n      const realBase = await realpath(memoryDir);\n      try {\n        const realSource = await realpath(sourcePath);\n        const rel = path.relative(realBase, realSource);\n        if (!rel.startsWith(\"..\") && !path.isAbsolute(rel)) {\n          resolvedRelative = rel.replace(/\\\\/g, \"/\");\n        }\n      } catch {\n        // realpath on the leaf failed (file doesn't exist yet).  Try\n        // resolving the parent directory instead — if the parent is a\n        // symlink into archive/state, the leaf would be written there\n        // too (PR #637 round-12 review, codex P1).\n        const parentDir = path.dirname(sourcePath);\n        try {\n          const realParent = await realpath(parentDir);\n          const parentRel = path.relative(realBase, realParent);\n          if (!parentRel.startsWith(\"..\") && !path.isAbsolute(parentRel)) {\n            const leafName = path.basename(sourcePath);\n            resolvedRelative = path.join(parentRel, leafName).replace(/\\\\/g, \"/\");\n          }\n        } catch {\n          // Parent also doesn't exist — fall through to text path check\n        }\n      }\n    } catch {\n      // memoryDir realpath failed — use the text path\n    }\n    if (!isActiveMemoryRelativePath(parsed.pagePath, versioning.sidecarDir) ||\n        !isActiveMemoryRelativePath(resolvedRelative, versioning.sidecarDir)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_non_active_path\",\n          detail: `source path \"${parsed.pagePath}\" is inside a non-active directory (archive/state/versions)`,\n        },\n      });\n      continue;\n    }\n\n    // Reject self-referential derived_from entries (PR #637 round-9 review,\n    // codex P1).  If the source resolves to the same file as the target,\n    // counting it as \"recovered\" would let undo archive the target without\n    // restoring any independent source — leaving no active copy.  This\n    // guards against corrupted or manually-edited derived_from lists.\n    if (path.resolve(sourcePath) === path.resolve(targetPath)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_self_referential\",\n          detail: `derived_from entry \"${entry}\" resolves to the same file as the target — refusing to count as recovered`,\n        },\n      });\n      continue;\n    }\n\n    if (await isRegularFile(sourcePath)) {\n      // Source is still active (regular file present) — nothing to\n      // restore but this counts as \"recovered\" for the archive\n      // decision.  We require a regular file specifically (PR #637\n      // round-5 review, codex P2): a directory, device node, or\n      // symlink at the source path should not count as \"recovered\"\n      // because a later read won't find the expected memory content.\n      plans.push({ kind: \"recovered_existing\", entry, sourcePath });\n      continue;\n    }\n    if (await fileExists(sourcePath)) {\n      // Something other than a regular file is at the source path\n      // (directory, device node, symlink).  Refuse to overwrite AND\n      // refuse to count as recovered (PR #637 round-5 review, codex\n      // P2) — the operator needs to clean up manually.  This is a\n      // blocking skip: no source writes happen, target stays active.\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_non_regular_file\",\n          detail: \"source path is occupied by a non-regular-file; refusing to proceed\",\n        },\n      });\n      continue;\n    }\n\n    let snapshotContent: string;\n    try {\n      snapshotContent = await getVersion(\n        sourcePath,\n        parsed.versionId,\n        versioning,\n        memoryDir,\n      );\n    } catch {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_snapshot_missing\",\n          detail: `no snapshot for version ${parsed.versionId}`,\n        },\n      });\n      continue;\n    }\n\n    plans.push({ kind: \"write\", entry, sourcePath, content: snapshotContent });\n  }\n\n  // If any plan is a skip (anything other than \"write\" or\n  // \"recovered_existing\"), the undo is over before it starts — no\n  // writes happen.  Reveal every per-source skip reason in the\n  // result so operators can diagnose what went wrong.\n  const skipped = plans.filter((p) => p.kind === \"skip\");\n  if (skipped.length > 0) {\n    for (const p of plans) {\n      if (p.kind === \"skip\") {\n        result.restores.push(p.restore);\n      } else if (p.kind === \"write\") {\n        // Announced-but-not-executed write — still record it so the\n        // operator sees what would have been restored if the failed\n        // sources had been recoverable.\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: dryRun ? \"skipped_dry_run\" : \"skipped_blocked_by_other_failures\",\n          detail: dryRun\n            ? \"would restore from snapshot (blocked by other failures)\"\n            : \"snapshot available but undo aborted due to other failures\",\n        });\n      } else {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_file_exists\",\n          detail: \"source file already exists; no restore needed\",\n        });\n      }\n    }\n    const recovered = result.restores.filter(\n      (r) => r.outcome === \"restored\" || r.outcome === \"skipped_file_exists\",\n    ).length;\n    if (recovered === 0) {\n      result.error =\n        \"no sources could be recovered (all snapshots missing or paths unsafe); target not archived to preserve data\";\n    } else {\n      result.error = `${skipped.length} of ${plans.length} sources could not be recovered; target not archived (undo is all-or-nothing)`;\n    }\n    return result;\n  }\n\n  // Deduplicate plans by sourcePath: duplicate derived_from entries for\n  // the same source would cause the second wx-flagged write to fail with\n  // EEXIST after the first succeeds.  The first plan for each source wins;\n  // subsequent duplicates are recorded as skipped.  Applied before dry-run\n  // so the preview accurately reflects what execution would do.\n  const seenSourcePaths = new Set<string>();\n  const dedupedPlans: RestorePlan[] = [];\n  for (const p of plans) {\n    if (p.kind === \"write\" || p.kind === \"recovered_existing\") {\n      if (seenSourcePaths.has(p.sourcePath)) {\n        dedupedPlans.push({\n          kind: \"skip\",\n          restore: {\n            entry: p.kind === \"write\" ? p.entry : p.entry,\n            sourcePath: p.sourcePath,\n            outcome: \"skipped_file_exists\",\n            detail: \"duplicate derived_from entry — source already processed\",\n          },\n        });\n        continue;\n      }\n      seenSourcePaths.add(p.sourcePath);\n    }\n    dedupedPlans.push(p);\n  }\n\n  // Dry-run: report what each plan would do.\n  if (dryRun) {\n    for (const p of dedupedPlans) {\n      if (p.kind === \"write\") {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_dry_run\",\n          detail: \"would restore from snapshot\",\n        });\n      } else if (p.kind === \"recovered_existing\") {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_file_exists\",\n          detail: \"source file already exists; no restore needed\",\n        });\n      } else if (p.kind === \"skip\" && p.restore) {\n        result.restores.push(p.restore);\n      }\n    }\n    return result;\n  }\n\n  // All validations passed — execute writes.  A write failure here\n  // is a filesystem problem rather than a provenance problem, but\n  // any failure still aborts the archive.\n\n  let writeFailed = false;\n  for (const p of dedupedPlans) {\n    if (p.kind === \"skip\") {\n      // Dedup-generated skip entries and other pre-write skips.\n      if (p.restore) result.restores.push(p.restore);\n      continue;\n    }\n    if (p.kind === \"recovered_existing\") {\n      result.restores.push({\n        entry: p.entry,\n        sourcePath: p.sourcePath,\n        outcome: \"skipped_file_exists\",\n        detail: \"source file already exists; no restore needed\",\n      });\n      continue;\n    }\n    if (p.kind === \"write\") {\n      if (writeFailed) {\n        // All-or-nothing: once a write fails, skip all remaining writes\n        // so the target is not archived with partial source coverage.\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_blocked_by_other_failures\",\n          detail: \"a prior source write failed; skipping remaining writes to honor all-or-nothing contract\",\n        });\n        continue;\n      }\n      try {\n        await mkdir(path.dirname(p.sourcePath), { recursive: true });\n        // Use exclusive create (wx / O_EXCL) so that if another process\n        // recreates the source file between planning and execution, this\n        // write fails with EEXIST instead of silently overwriting the new\n        // file (PR #637 round-11 review, codex P1).\n        await writeFile(p.sourcePath, p.content, { encoding: \"utf-8\", flag: \"wx\" });\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"restored\",\n        });\n      } catch (err) {\n        writeFailed = true;\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_write_failed\",\n          detail: `write failed: ${err instanceof Error ? err.message : String(err)}`,\n        });\n      }\n    }\n  }\n\n  if (writeFailed) {\n    result.error =\n      \"one or more source writes failed mid-restore; target not archived to preserve data\";\n    return result;\n  }\n\n  // Archive the target memory.  archiveMemory returns null on\n  // failure — surface that as a fatal error (PR #637 round-5 review,\n  // codex P2) so automation doesn't mistake a half-undo for a clean\n  // run.  The already-completed restores still roll forward; the\n  // result.restores list records what was written.\n  const archivedAt = await storage.archiveMemory(target, {\n    actor: \"consolidate-undo\",\n    reasonCode: \"consolidation-undo\",\n  });\n  result.targetArchived = archivedAt !== null;\n  if (!result.targetArchived) {\n    result.error =\n      \"sources restored successfully but archiving the consolidated target failed; inspect storage for manual cleanup\";\n  }\n  return result;\n}\n\n/**\n * Render a consolidation-undo result as a human-readable multi-line\n * string for the CLI.  Extracted so tests can snapshot the formatting\n * without parsing stdout.\n */\nexport function formatConsolidationUndoResult(result: ConsolidationUndoResult): string {\n  const lines: string[] = [];\n  lines.push(`consolidate undo ${result.dryRun ? \"(dry run) \" : \"\"}→ ${result.targetPath}`);\n  // Emit per-restore details BEFORE the error (PR #637 review, cursor\n  // Medium): the \"no sources could be recovered\" error is set after\n  // the restore loop ran, so operators need the per-source skip\n  // reasons to diagnose which snapshots were missing / outside\n  // memoryDir / malformed.  Early-bail errors (unloadable target,\n  // target outside memoryDir, no derived_from) run before the loop,\n  // so `result.restores` is empty in those cases and this block is a\n  // no-op.\n  for (const r of result.restores) {\n    lines.push(`  - ${r.entry} → ${r.outcome}${r.detail ? ` (${r.detail})` : \"\"}`);\n  }\n  if (result.error) {\n    lines.push(`  ERROR: ${result.error}`);\n    return lines.join(\"\\n\");\n  }\n  lines.push(\n    result.dryRun\n      ? \"  (dry run — no files were modified, target not archived)\"\n      : `  target archived: ${result.targetArchived ? \"yes\" : \"no\"}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;AAsBA,OAAO,UAAU;AACjB,SAAS,OAAO,WAAW,QAAQ,UAAU,aAAa;AAC1D,SAAS,aAAa,mBAAmB;AA8CzC,IAAM,wBAAwB;AAE9B,SAAS,WAAW,OAAgE;AAGlF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,qBAAqB;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,UAAU,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AACnD;AAUO,SAAS,kBAAkB,WAAmB,MAAuB;AAC1E,QAAM,WAAW,KAAK,QAAQ,IAAI;AAClC,QAAM,gBAAgB,KAAK,QAAQ,SAAS;AAC5C,QAAM,MAAM,KAAK,SAAS,UAAU,aAAa;AACjD,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,MAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,SAAO;AACT;AAkBA,eAAsB,0BACpB,WACA,MACkB;AAClB,MAAI,CAAC,kBAAkB,WAAW,IAAI,EAAG,QAAO;AAIhD,QAAM,cAAc,UAAU,QAAQ,OAAO,GAAG,EAAE,MAAM,GAAG;AAC3D,MAAI,YAAY,KAAK,CAAC,MAAM,MAAM,IAAI,EAAG,QAAO;AAChD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,KAAK,QAAQ,SAAS;AAS5C,QAAM,WAAW,KAAK,QAAQ,IAAI;AAClC,QAAM,cAAc,KAAK,SAAS,UAAU,aAAa;AACzD,QAAM,WAAW,YAAY,SAAS,IAAI,YAAY,MAAM,KAAK,GAAG,IAAI,CAAC;AACzE,WAAS,IAAI,GAAG,KAAK,SAAS,QAAQ,KAAK;AACzC,UAAM,QAAQ,MAAM,IAAI,WAAW,KAAK,KAAK,UAAU,GAAG,SAAS,MAAM,GAAG,CAAC,CAAC;AAC9E,QAAI;AACF,YAAM,KAAK,MAAM,MAAM,KAAK;AAC5B,UAAI,GAAG,eAAe,KAAK,UAAU,UAAU;AAG7C,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,SAAS,KAAK;AAAA,QAC/B,QAAQ;AAEN,iBAAO;AAAA,QACT;AACA,cAAM,MAAM,KAAK,SAAS,cAAc,MAAM;AAC9C,YAAI,IAAI,WAAW,EAAG;AACtB,YAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AAAA,MAC3D;AAAA,IACF,QAAQ;AAAA,IAGR;AAAA,EACF;AAIA,QAAM,QAAQ,cAAc,MAAM,KAAK,GAAG;AAC1C,WAAS,IAAI,MAAM,QAAQ,IAAI,GAAG,KAAK;AACrC,UAAM,QAAQ,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,KAAK,GAAG,KAAK,KAAK;AACvD,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,KAAK;AAErC,YAAM,WAAW,MAAM,MAAM,CAAC,EAAE,KAAK,KAAK,GAAG;AAC7C,YAAM,QAAQ,SAAS,SAAS,IAAI,KAAK,KAAK,UAAU,QAAQ,IAAI;AAGpE,YAAM,MAAM,KAAK,SAAS,cAAc,KAAK;AAC7C,UAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,UAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,aAAO;AAAA,IACT,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,IAAM,sBAAsB,CAAC,YAAY,QAAQ;AAOjD,SAAS,sBAAsB,GAAmB;AAEhD,QAAM,QAAQ,EAAE,QAAQ,OAAO,GAAG,EAAE,MAAM,GAAG;AAC7C,QAAM,WAAqB,CAAC;AAC5B,aAAW,OAAO,OAAO;AACvB,QAAI,QAAQ,MAAM,QAAQ,IAAK;AAC/B,QAAI,QAAQ,MAAM;AAChB,UAAI,SAAS,SAAS,EAAG,UAAS,IAAI;AAAA,IAGxC,OAAO;AACL,eAAS,KAAK,GAAG;AAAA,IACnB;AAAA,EACF;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAcO,SAAS,2BACd,UACA,YACS;AACT,QAAM,aAAa,sBAAsB,QAAQ;AACjD,QAAM,WAAW,CAAC,GAAG,mBAAmB;AACxC,MAAI,YAAY;AACd,UAAM,cAAc,sBAAsB,UAAU;AACpD,aAAS,KAAK,cAAc,GAAG;AAAA,EACjC;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,eAAe,OAAO,MAAM,GAAG,EAAE,KAAK,WAAW,WAAW,MAAM,GAAG;AACvE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,GAA6B;AACxD,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,WAAO,GAAG,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,WAAW,GAA6B;AACrD,MAAI;AACF,UAAM,OAAO,GAAG,YAAY,IAAI;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAcA,eAAsB,qBAAqB,SAMN;AACnC,QAAM,EAAE,SAAS,WAAW,YAAY,WAAW,IAAI;AACvD,QAAM,SAAS,QAAQ,WAAW;AAElC,QAAM,SAAkC;AAAA,IACtC;AAAA,IACA,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,IACX;AAAA,EACF;AAQA,MAAI,CAAE,MAAM,0BAA0B,YAAY,SAAS,GAAI;AAC7D,WAAO,QAAQ,eAAe,UAAU,gCAAgC,SAAS;AACjF,WAAO;AAAA,EACT;AAOA,QAAM,YAAY,KAAK,SAAS,WAAW,UAAU;AACrD,MAAI,CAAC,2BAA2B,WAAW,WAAW,UAAU,GAAG;AACjE,WAAO,QAAQ,gBAAgB,SAAS;AACxC,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,MAAM,QAAQ,iBAAiB,UAAU;AACxD,MAAI,CAAC,QAAQ;AACX,WAAO,QAAQ,mCAAmC,UAAU;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,GAAG;AAC3D,WAAO,QAAQ;AACf,WAAO;AAAA,EACT;AAcA,QAAM,QAAuB,CAAC;AAC9B,aAAW,YAAY,aAAa;AAClC,UAAM,QAAQ,OAAO,aAAa,WAAW,WAAW,OAAO,QAAQ;AACvE,UAAM,SAAS,WAAW,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAKA,QAAI,KAAK,WAAW,OAAO,QAAQ,GAAG;AACpC,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,SAAS;AAAA,UACT,QAAQ,sDAAsD,OAAO,QAAQ;AAAA,QAC/E;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,KAAK,WAAW,OAAO,QAAQ;AAEvD,QAAI,CAAE,MAAM,0BAA0B,YAAY,SAAS,GAAI;AAC7D,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,0CAA0C,SAAS;AAAA,QAC7D;AAAA,MACF,CAAC;AACD;AAAA,IACF;AASA,QAAI,mBAAmB,OAAO;AAC9B,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,SAAS;AACzC,UAAI;AACF,cAAM,aAAa,MAAM,SAAS,UAAU;AAC5C,cAAM,MAAM,KAAK,SAAS,UAAU,UAAU;AAC9C,YAAI,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAClD,6BAAmB,IAAI,QAAQ,OAAO,GAAG;AAAA,QAC3C;AAAA,MACF,QAAQ;AAKN,cAAM,YAAY,KAAK,QAAQ,UAAU;AACzC,YAAI;AACF,gBAAM,aAAa,MAAM,SAAS,SAAS;AAC3C,gBAAM,YAAY,KAAK,SAAS,UAAU,UAAU;AACpD,cAAI,CAAC,UAAU,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,SAAS,GAAG;AAC9D,kBAAM,WAAW,KAAK,SAAS,UAAU;AACzC,+BAAmB,KAAK,KAAK,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAAA,UACtE;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,2BAA2B,OAAO,UAAU,WAAW,UAAU,KAClE,CAAC,2BAA2B,kBAAkB,WAAW,UAAU,GAAG;AACxE,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,gBAAgB,OAAO,QAAQ;AAAA,QACzC;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAOA,QAAI,KAAK,QAAQ,UAAU,MAAM,KAAK,QAAQ,UAAU,GAAG;AACzD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,uBAAuB,KAAK;AAAA,QACtC;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,QAAI,MAAM,cAAc,UAAU,GAAG;AAOnC,YAAM,KAAK,EAAE,MAAM,sBAAsB,OAAO,WAAW,CAAC;AAC5D;AAAA,IACF;AACA,QAAI,MAAM,WAAW,UAAU,GAAG;AAMhC,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,wBAAkB,MAAM;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,2BAA2B,OAAO,SAAS;AAAA,QACrD;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,UAAM,KAAK,EAAE,MAAM,SAAS,OAAO,YAAY,SAAS,gBAAgB,CAAC;AAAA,EAC3E;AAMA,QAAM,UAAU,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AACrD,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,KAAK,OAAO;AACrB,UAAI,EAAE,SAAS,QAAQ;AACrB,eAAO,SAAS,KAAK,EAAE,OAAO;AAAA,MAChC,WAAW,EAAE,SAAS,SAAS;AAI7B,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS,SAAS,oBAAoB;AAAA,UACtC,QAAQ,SACJ,4DACA;AAAA,QACN,CAAC;AAAA,MACH,OAAO;AACL,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,YAAY,OAAO,SAAS;AAAA,MAChC,CAAC,MAAM,EAAE,YAAY,cAAc,EAAE,YAAY;AAAA,IACnD,EAAE;AACF,QAAI,cAAc,GAAG;AACnB,aAAO,QACL;AAAA,IACJ,OAAO;AACL,aAAO,QAAQ,GAAG,QAAQ,MAAM,OAAO,MAAM,MAAM;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAOA,QAAM,kBAAkB,oBAAI,IAAY;AACxC,QAAM,eAA8B,CAAC;AACrC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,SAAS,WAAW,EAAE,SAAS,sBAAsB;AACzD,UAAI,gBAAgB,IAAI,EAAE,UAAU,GAAG;AACrC,qBAAa,KAAK;AAAA,UAChB,MAAM;AAAA,UACN,SAAS;AAAA,YACP,OAAO,EAAE,SAAS,UAAU,EAAE,QAAQ,EAAE;AAAA,YACxC,YAAY,EAAE;AAAA,YACd,SAAS;AAAA,YACT,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AACD;AAAA,MACF;AACA,sBAAgB,IAAI,EAAE,UAAU;AAAA,IAClC;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAGA,MAAI,QAAQ;AACV,eAAW,KAAK,cAAc;AAC5B,UAAI,EAAE,SAAS,SAAS;AACtB,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,WAAW,EAAE,SAAS,sBAAsB;AAC1C,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,WAAW,EAAE,SAAS,UAAU,EAAE,SAAS;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO;AAAA,MAChC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,MAAI,cAAc;AAClB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,QAAQ;AAErB,UAAI,EAAE,QAAS,QAAO,SAAS,KAAK,EAAE,OAAO;AAC7C;AAAA,IACF;AACA,QAAI,EAAE,SAAS,sBAAsB;AACnC,aAAO,SAAS,KAAK;AAAA,QACnB,OAAO,EAAE;AAAA,QACT,YAAY,EAAE;AAAA,QACd,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS;AACtB,UAAI,aAAa;AAGf,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AACD;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAM,KAAK,QAAQ,EAAE,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAK3D,cAAM,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,SAAS,MAAM,KAAK,CAAC;AAC1E,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,QACX,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,sBAAc;AACd,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAC3E,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa;AACf,WAAO,QACL;AACF,WAAO;AAAA,EACT;AAOA,QAAM,aAAa,MAAM,QAAQ,cAAc,QAAQ;AAAA,IACrD,OAAO;AAAA,IACP,YAAY;AAAA,EACd,CAAC;AACD,SAAO,iBAAiB,eAAe;AACvC,MAAI,CAAC,OAAO,gBAAgB;AAC1B,WAAO,QACL;AAAA,EACJ;AACA,SAAO;AACT;AAOO,SAAS,8BAA8B,QAAyC;AACrF,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,oBAAoB,OAAO,SAAS,eAAe,EAAE,UAAK,OAAO,UAAU,EAAE;AASxF,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,KAAK,OAAO,EAAE,KAAK,WAAM,EAAE,OAAO,GAAG,EAAE,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE,EAAE;AAAA,EAC/E;AACA,MAAI,OAAO,OAAO;AAChB,UAAM,KAAK,YAAY,OAAO,KAAK,EAAE;AACrC,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACA,QAAM;AAAA,IACJ,OAAO,SACH,mEACA,sBAAsB,OAAO,iBAAiB,QAAQ,IAAI;AAAA,EAChE;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}
+{"version":3,"sources":["../src/consolidation-undo.ts"],"sourcesContent":["/**\n * Consolidation undo (issue #561 PR 5).\n *\n * Reverts a consolidated memory by restoring each source memory from its\n * `derived_from` snapshot and archiving the target.\n *\n * Contract:\n *   - Load the target memory markdown file via its absolute path.\n *   - For every `\"<rel>:<version>\"` entry in `derived_from`, fetch the\n *     snapshot content via `page-versioning.getVersion` and restore it\n *     to the original relative path.  If the restore target file\n *     already exists, we skip overwriting it (the source was never\n *     archived, or was re-created since) and record the skip.\n *   - Archive the target with reason code `\"consolidation-undo\"` so the\n *     lifecycle ledger records the undo.\n *   - Dry-run mode produces the same plan without touching disk.\n *\n * The helper is kept pure over `StorageManager` so the CLI can reuse it\n * without additional wiring, and tests can exercise the plan logic\n * directly.\n */\n\nimport path from \"node:path\";\nimport { mkdir, writeFile, access, realpath, lstat } from \"node:fs/promises\";\nimport { constants as fsConstants } from \"node:fs\";\nimport type { StorageManager } from \"./storage.js\";\nimport type { VersioningConfig } from \"./page-versioning.js\";\nimport { getVersion } from \"./page-versioning.js\";\n\n/**\n * Outcome of restoring a single `derived_from` source.\n */\nexport interface ConsolidationUndoRestore {\n  /** The raw `\"<relpath>:<version>\"` entry from `derived_from`. */\n  entry: string;\n  /** Absolute path where the source would be / was restored. */\n  sourcePath: string;\n  /** What actually happened. */\n  outcome:\n    | \"restored\"\n    | \"skipped_file_exists\"\n    | \"skipped_non_regular_file\"\n    | \"skipped_snapshot_missing\"\n    | \"skipped_malformed_entry\"\n    | \"skipped_outside_memory_dir\"\n    | \"skipped_non_active_path\"\n    | \"skipped_self_referential\"\n    | \"skipped_write_failed\"\n    | \"skipped_blocked_by_other_failures\"\n    | \"skipped_dry_run\";\n  /** Human-readable detail. */\n  detail?: string;\n}\n\n/**\n * Plan + result of a `remnic consolidate undo` invocation.\n */\nexport interface ConsolidationUndoResult {\n  /** Absolute path to the target memory. */\n  targetPath: string;\n  /** True when the target was archived successfully. */\n  targetArchived: boolean;\n  /** Per-source restore outcomes. */\n  restores: ConsolidationUndoRestore[];\n  /** Whether the run was a dry-run plan only. */\n  dryRun: boolean;\n  /** Fatal error, if any — the run bails early. */\n  error?: string;\n}\n\nconst DERIVED_FROM_ENTRY_RE = /^(.+):(\\d+)$/;\n\nfunction parseEntry(entry: unknown): { pagePath: string; versionId: string } | null {\n  // Non-string entries (PR #637 round-3 review, cursor Low) can arrive\n  // from hostile on-disk frontmatter — guard against a .match() crash.\n  if (typeof entry !== \"string\") return null;\n  const match = entry.match(DERIVED_FROM_ENTRY_RE);\n  if (!match) return null;\n  return { pagePath: match[1], versionId: match[2] };\n}\n\n/**\n * Verify that `candidate` resolves inside `root` (defense against\n * path-traversal in `derived_from` entries and user-facing target\n * paths).  Path-string normalization only; for symlink-aware checks\n * use `isInsideDirectoryRealpath`.  Both paths are resolved to\n * absolute form before comparison so `..` segments, symlinks-as-\n * strings, and relative prefixes are normalized.\n */\nexport function isInsideDirectory(candidate: string, root: string): boolean {\n  const normRoot = path.resolve(root);\n  const normCandidate = path.resolve(candidate);\n  const rel = path.relative(normRoot, normCandidate);\n  if (rel.length === 0) return true;\n  if (rel.startsWith(\"..\")) return false;\n  if (path.isAbsolute(rel)) return false;\n  return true;\n}\n\n/**\n * Symlink-aware containment check (PR #637 round-2 review, codex P1).\n *\n * `isInsideDirectory` only normalizes path strings — if a `derived_from`\n * entry resolves through a symlink inside `memoryDir` that points\n * outside, the string check passes but the subsequent `writeFile` would\n * land outside the memory tree.  Use this guard for any path that is\n * about to be written.\n *\n * Walks every parent directory between `candidate` and `root`,\n * `realpath`-ing each segment that exists and rejecting when any\n * segment escapes `root`.  Non-existent parents are resolved as the\n * canonicalized deepest-existing ancestor plus the trailing segments,\n * so a not-yet-created target file still gets the symlink check on its\n * existing parent directories.\n */\nexport async function isInsideDirectoryRealpath(\n  candidate: string,\n  root: string,\n): Promise<boolean> {\n  if (!isInsideDirectory(candidate, root)) return false;\n  // Reject raw `..` segments before canonicalization so that symlinks\n  // cannot be hidden behind intermediate dot-dot components (PR #637\n  // round-14 review, codex P1).\n  const rawSegments = candidate.replace(/\\\\/g, \"/\").split(\"/\");\n  if (rawSegments.some((s) => s === \"..\")) return false;\n  let resolvedRoot: string;\n  try {\n    resolvedRoot = await realpath(path.resolve(root));\n  } catch {\n    return false;\n  }\n  const normCandidate = path.resolve(candidate);\n\n  // Reject dangling symlinks (PR #637 round-3 review, codex P1).\n  // If the candidate itself is a symlink (even if its target doesn't\n  // exist), Node will follow it when we later call `writeFile`.\n  // `lstat` inspects the link itself without dereferencing; if it\n  // succeeds and reports a symlink, we treat the candidate as\n  // unsafe.  We must check every non-root ancestor too — a symlink\n  // anywhere along the path lets an attacker redirect writes.\n  const normRoot = path.resolve(root);\n  const relFromRoot = path.relative(normRoot, normCandidate);\n  const segments = relFromRoot.length > 0 ? relFromRoot.split(path.sep) : [];\n  for (let i = 0; i <= segments.length; i++) {\n    const probe = i === 0 ? normRoot : path.join(normRoot, ...segments.slice(0, i));\n    try {\n      const st = await lstat(probe);\n      if (st.isSymbolicLink() && probe !== normRoot) {\n        // A symlink on the path — resolve THIS segment and bail out\n        // if the resolved target escapes `resolvedRoot`.\n        let target: string;\n        try {\n          target = await realpath(probe);\n        } catch {\n          // Dangling symlink inside memoryDir — always unsafe.\n          return false;\n        }\n        const rel = path.relative(resolvedRoot, target);\n        if (rel.length === 0) continue;\n        if (rel.startsWith(\"..\") || path.isAbsolute(rel)) return false;\n      }\n    } catch {\n      // Segment doesn't exist yet — that's fine, fall through to the\n      // textual containment verification below.\n    }\n  }\n\n  // Walk up from the candidate until we hit a path that exists, then\n  // realpath THAT and re-apply the trailing segments textually.\n  const parts = normCandidate.split(path.sep);\n  for (let i = parts.length; i > 0; i--) {\n    const probe = parts.slice(0, i).join(path.sep) || path.sep;\n    try {\n      const resolved = await realpath(probe);\n      // Re-join any trailing segments that didn't exist yet.\n      const trailing = parts.slice(i).join(path.sep);\n      const final = trailing.length > 0 ? path.join(resolved, trailing) : resolved;\n      // Now apply the textual containment check against the canonical\n      // `resolvedRoot`.\n      const rel = path.relative(resolvedRoot, final);\n      if (rel.length === 0) return true;\n      if (rel.startsWith(\"..\")) return false;\n      if (path.isAbsolute(rel)) return false;\n      return true;\n    } catch {\n      continue;\n    }\n  }\n  // Nothing along the path resolvable — treat as outside by default.\n  return false;\n}\n\n/**\n * Directories under memoryDir that are NOT active memory locations.\n * A `derived_from` entry pointing into one of these should not be\n * counted as \"recovered_existing\" (PR #637 round-7 review, codex P2).\n * The versioning sidecar directory is included dynamically via the\n * `sidecarDir` parameter (PR #637 round-8 review, codex P2).\n */\nconst NON_ACTIVE_PREFIXES = [\"archive/\", \"state/\"];\n\n/**\n * Normalize a relative path by collapsing `.` and `..` segments so\n * that crafted entries like `\"facts/../archive/x.md\"` are reduced to\n * `\"archive/x.md\"` before the non-active-prefix check.\n */\nfunction normalizeRelativePath(p: string): string {\n  // Normalize separators, split into segments, then resolve.\n  const parts = p.replace(/\\\\/g, \"/\").split(\"/\");\n  const resolved: string[] = [];\n  for (const seg of parts) {\n    if (seg === \"\" || seg === \".\") continue;\n    if (seg === \"..\") {\n      if (resolved.length > 0) resolved.pop();\n      // If \"..\" pops past the root, we let the caller's containment\n      // check catch it — don't silently drop.\n    } else {\n      resolved.push(seg);\n    }\n  }\n  return resolved.join(\"/\");\n}\n\n/**\n * Check that a relative path (relative to memoryDir) points to an\n * active memory location rather than an internal/archive directory.\n * Returns `true` when the normalised `pagePath` does NOT start with\n * a known non-active prefix.\n *\n * @param pagePath   Relative path from `derived_from` entry.\n * @param sidecarDir Optional versioning sidecar directory name\n *                   (e.g. `\".versions\"`).  When provided, paths\n *                   under this directory are also rejected as\n *                   non-active.\n */\nexport function isActiveMemoryRelativePath(\n  pagePath: string,\n  sidecarDir?: string,\n): boolean {\n  const normalized = normalizeRelativePath(pagePath);\n  const prefixes = [...NON_ACTIVE_PREFIXES];\n  if (sidecarDir) {\n    const normSidecar = normalizeRelativePath(sidecarDir);\n    prefixes.push(normSidecar + \"/\");\n  }\n  for (const prefix of prefixes) {\n    if (normalized === prefix.slice(0, -1) || normalized.startsWith(prefix)) {\n      return false;\n    }\n  }\n  return true;\n}\n\nasync function isRegularFile(p: string): Promise<boolean> {\n  try {\n    const st = await lstat(p);\n    return st.isFile();\n  } catch {\n    return false;\n  }\n}\n\nasync function fileExists(p: string): Promise<boolean> {\n  try {\n    await access(p, fsConstants.F_OK);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Perform a consolidation-undo operation.\n *\n * @param options.storage        Storage manager for the memory directory.\n * @param options.memoryDir      Absolute memory directory root.\n * @param options.targetPath     Absolute path to the consolidated memory.\n * @param options.versioning     Page-versioning config (sidecarDir must\n *                               match the sidecar layout used when the\n *                               snapshots were created).\n * @param options.dryRun         When true, compute the plan but do not\n *                               write or archive.\n */\nexport async function runConsolidationUndo(options: {\n  storage: StorageManager;\n  memoryDir: string;\n  targetPath: string;\n  versioning: VersioningConfig;\n  dryRun?: boolean;\n}): Promise<ConsolidationUndoResult> {\n  const { storage, memoryDir, targetPath, versioning } = options;\n  const dryRun = options.dryRun === true;\n\n  const result: ConsolidationUndoResult = {\n    targetPath,\n    targetArchived: false,\n    restores: [],\n    dryRun,\n  };\n\n  // Defense against path-traversal (PR #637 review, codex P1): refuse\n  // to operate on a target outside the configured memory directory.\n  // Archive moves and eventual unlink would otherwise let an operator\n  // accidentally destroy an unrelated file with memory-like\n  // frontmatter.  Uses the realpath-aware check so a symlinked\n  // directory inside `memoryDir` can't tunnel a target past the guard.\n  if (!(await isInsideDirectoryRealpath(targetPath, memoryDir))) {\n    result.error = `target path ${targetPath} is outside memory directory ${memoryDir}`;\n    return result;\n  }\n\n  // Reject targets in non-active directories (archive/, state/,\n  // versioning sidecar).  A target inside `.versions/...` would be\n  // a sidecar snapshot, not a real consolidated memory; archiving\n  // it would silently delete version history (PR #637 round-8\n  // review, codex P2).\n  const targetRel = path.relative(memoryDir, targetPath);\n  if (!isActiveMemoryRelativePath(targetRel, versioning.sidecarDir)) {\n    result.error = `target path \"${targetRel}\" is inside a non-active directory — refusing to operate`;\n    return result;\n  }\n\n  // Load the target memory.  readMemoryByPath returns null when the file\n  // is absent or unparseable — surface that as a fatal error because the\n  // caller cannot continue without a derived_from list.\n  const target = await storage.readMemoryByPath(targetPath);\n  if (!target) {\n    result.error = `could not load target memory at ${targetPath}`;\n    return result;\n  }\n\n  const derivedFrom = target.frontmatter.derived_from;\n  if (!Array.isArray(derivedFrom) || derivedFrom.length === 0) {\n    result.error = \"target memory has no derived_from entries — nothing to undo\";\n    return result;\n  }\n\n  // Two-pass plan + execute (PR #637 round-4 review, cursor Medium):\n  // the undo is \"all-or-nothing\" both for the archive decision AND\n  // for the per-source writes.  First pass validates + loads every\n  // snapshot into memory; second pass writes only if every source\n  // would succeed.  This prevents the previous eager-write behaviour\n  // where a later-failing source would leave earlier sources already\n  // written to disk alongside an unarchived consolidated target.\n  type RestorePlan =\n    | { kind: \"skip\"; restore: ConsolidationUndoRestore }\n    | { kind: \"write\"; entry: string; sourcePath: string; content: string }\n    | { kind: \"recovered_existing\"; entry: string; sourcePath: string };\n\n  const plans: RestorePlan[] = [];\n  for (const rawEntry of derivedFrom) {\n    const entry = typeof rawEntry === \"string\" ? rawEntry : String(rawEntry);\n    const parsed = parseEntry(rawEntry);\n    if (!parsed) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath: \"\",\n          outcome: \"skipped_malformed_entry\",\n          detail: `expected \"<path>:<version>\" shape`,\n        },\n      });\n      continue;\n    }\n\n    // Reject absolute paths in derived_from entries (PR #637 round-10\n    // review, codex P1).  An absolute pagePath would cause path.join to\n    // ignore memoryDir, bypassing the active-directory guard downstream.\n    if (path.isAbsolute(parsed.pagePath)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath: parsed.pagePath,\n          outcome: \"skipped_malformed_entry\",\n          detail: `derived_from path must be relative, got absolute: \"${parsed.pagePath}\"`,\n        },\n      });\n      continue;\n    }\n\n    const sourcePath = path.join(memoryDir, parsed.pagePath);\n\n    if (!(await isInsideDirectoryRealpath(sourcePath, memoryDir))) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_outside_memory_dir\",\n          detail: `resolved path escapes memory directory ${memoryDir}`,\n        },\n      });\n      continue;\n    }\n\n    // Reject source paths inside non-active directories (archive/,\n    // state/, versioning sidecar).  A crafted or corrupted derived_from\n    // entry like \"archive/2024-01-01/x.md:1\" would otherwise be counted\n    // as \"recovered_existing\" even though no active memory was restored.\n    // Also resolve symlinks before checking — a derived_from entry like\n    // \"facts/link/stale.md:1\" where `facts/link` points to `archive/…`\n    // must be caught (PR #637 round-8 review, cursor+codex).\n    let resolvedRelative = parsed.pagePath;\n    try {\n      const realBase = await realpath(memoryDir);\n      try {\n        const realSource = await realpath(sourcePath);\n        const rel = path.relative(realBase, realSource);\n        if (!rel.startsWith(\"..\") && !path.isAbsolute(rel)) {\n          resolvedRelative = rel.replace(/\\\\/g, \"/\");\n        }\n      } catch {\n        // realpath on the leaf failed (file doesn't exist yet).  Try\n        // resolving the parent directory instead — if the parent is a\n        // symlink into archive/state, the leaf would be written there\n        // too (PR #637 round-12 review, codex P1).\n        const parentDir = path.dirname(sourcePath);\n        try {\n          const realParent = await realpath(parentDir);\n          const parentRel = path.relative(realBase, realParent);\n          if (!parentRel.startsWith(\"..\") && !path.isAbsolute(parentRel)) {\n            const leafName = path.basename(sourcePath);\n            resolvedRelative = path.join(parentRel, leafName).replace(/\\\\/g, \"/\");\n          }\n        } catch {\n          // Parent also doesn't exist — fall through to text path check\n        }\n      }\n    } catch {\n      // memoryDir realpath failed — use the text path\n    }\n    if (!isActiveMemoryRelativePath(parsed.pagePath, versioning.sidecarDir) ||\n        !isActiveMemoryRelativePath(resolvedRelative, versioning.sidecarDir)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_non_active_path\",\n          detail: `source path \"${parsed.pagePath}\" is inside a non-active directory (archive/state/versions)`,\n        },\n      });\n      continue;\n    }\n\n    // Reject self-referential derived_from entries (PR #637 round-9 review,\n    // codex P1).  If the source resolves to the same file as the target,\n    // counting it as \"recovered\" would let undo archive the target without\n    // restoring any independent source — leaving no active copy.  This\n    // guards against corrupted or manually-edited derived_from lists.\n    if (path.resolve(sourcePath) === path.resolve(targetPath)) {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_self_referential\",\n          detail: `derived_from entry \"${entry}\" resolves to the same file as the target — refusing to count as recovered`,\n        },\n      });\n      continue;\n    }\n\n    if (await isRegularFile(sourcePath)) {\n      // Source is still active (regular file present) — nothing to\n      // restore but this counts as \"recovered\" for the archive\n      // decision.  We require a regular file specifically (PR #637\n      // round-5 review, codex P2): a directory, device node, or\n      // symlink at the source path should not count as \"recovered\"\n      // because a later read won't find the expected memory content.\n      plans.push({ kind: \"recovered_existing\", entry, sourcePath });\n      continue;\n    }\n    if (await fileExists(sourcePath)) {\n      // Something other than a regular file is at the source path\n      // (directory, device node, symlink).  Refuse to overwrite AND\n      // refuse to count as recovered (PR #637 round-5 review, codex\n      // P2) — the operator needs to clean up manually.  This is a\n      // blocking skip: no source writes happen, target stays active.\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_non_regular_file\",\n          detail: \"source path is occupied by a non-regular-file; refusing to proceed\",\n        },\n      });\n      continue;\n    }\n\n    let snapshotContent: string;\n    try {\n      snapshotContent = await getVersion(\n        sourcePath,\n        parsed.versionId,\n        versioning,\n        memoryDir,\n      );\n    } catch {\n      plans.push({\n        kind: \"skip\",\n        restore: {\n          entry,\n          sourcePath,\n          outcome: \"skipped_snapshot_missing\",\n          detail: `no snapshot for version ${parsed.versionId}`,\n        },\n      });\n      continue;\n    }\n\n    plans.push({ kind: \"write\", entry, sourcePath, content: snapshotContent });\n  }\n\n  // If any plan is a skip (anything other than \"write\" or\n  // \"recovered_existing\"), the undo is over before it starts — no\n  // writes happen.  Reveal every per-source skip reason in the\n  // result so operators can diagnose what went wrong.\n  const skipped = plans.filter((p) => p.kind === \"skip\");\n  if (skipped.length > 0) {\n    for (const p of plans) {\n      if (p.kind === \"skip\") {\n        result.restores.push(p.restore);\n      } else if (p.kind === \"write\") {\n        // Announced-but-not-executed write — still record it so the\n        // operator sees what would have been restored if the failed\n        // sources had been recoverable.\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: dryRun ? \"skipped_dry_run\" : \"skipped_blocked_by_other_failures\",\n          detail: dryRun\n            ? \"would restore from snapshot (blocked by other failures)\"\n            : \"snapshot available but undo aborted due to other failures\",\n        });\n      } else {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_file_exists\",\n          detail: \"source file already exists; no restore needed\",\n        });\n      }\n    }\n    const recovered = result.restores.filter(\n      (r) => r.outcome === \"restored\" || r.outcome === \"skipped_file_exists\",\n    ).length;\n    if (recovered === 0) {\n      result.error =\n        \"no sources could be recovered (all snapshots missing or paths unsafe); target not archived to preserve data\";\n    } else {\n      result.error = `${skipped.length} of ${plans.length} sources could not be recovered; target not archived (undo is all-or-nothing)`;\n    }\n    return result;\n  }\n\n  // Deduplicate plans by sourcePath: duplicate derived_from entries for\n  // the same source would cause the second wx-flagged write to fail with\n  // EEXIST after the first succeeds.  The first plan for each source wins;\n  // subsequent duplicates are recorded as skipped.  Applied before dry-run\n  // so the preview accurately reflects what execution would do.\n  const seenSourcePaths = new Set<string>();\n  const dedupedPlans: RestorePlan[] = [];\n  for (const p of plans) {\n    if (p.kind === \"write\" || p.kind === \"recovered_existing\") {\n      if (seenSourcePaths.has(p.sourcePath)) {\n        dedupedPlans.push({\n          kind: \"skip\",\n          restore: {\n            entry: p.kind === \"write\" ? p.entry : p.entry,\n            sourcePath: p.sourcePath,\n            outcome: \"skipped_file_exists\",\n            detail: \"duplicate derived_from entry — source already processed\",\n          },\n        });\n        continue;\n      }\n      seenSourcePaths.add(p.sourcePath);\n    }\n    dedupedPlans.push(p);\n  }\n\n  // Dry-run: report what each plan would do.\n  if (dryRun) {\n    for (const p of dedupedPlans) {\n      if (p.kind === \"write\") {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_dry_run\",\n          detail: \"would restore from snapshot\",\n        });\n      } else if (p.kind === \"recovered_existing\") {\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_file_exists\",\n          detail: \"source file already exists; no restore needed\",\n        });\n      } else if (p.kind === \"skip\" && p.restore) {\n        result.restores.push(p.restore);\n      }\n    }\n    return result;\n  }\n\n  // All validations passed — execute writes.  A write failure here\n  // is a filesystem problem rather than a provenance problem, but\n  // any failure still aborts the archive.\n\n  let writeFailed = false;\n  for (const p of dedupedPlans) {\n    if (p.kind === \"skip\") {\n      // Dedup-generated skip entries and other pre-write skips.\n      if (p.restore) result.restores.push(p.restore);\n      continue;\n    }\n    if (p.kind === \"recovered_existing\") {\n      result.restores.push({\n        entry: p.entry,\n        sourcePath: p.sourcePath,\n        outcome: \"skipped_file_exists\",\n        detail: \"source file already exists; no restore needed\",\n      });\n      continue;\n    }\n    if (p.kind === \"write\") {\n      if (writeFailed) {\n        // All-or-nothing: once a write fails, skip all remaining writes\n        // so the target is not archived with partial source coverage.\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_blocked_by_other_failures\",\n          detail: \"a prior source write failed; skipping remaining writes to honor all-or-nothing contract\",\n        });\n        continue;\n      }\n      try {\n        await mkdir(path.dirname(p.sourcePath), { recursive: true });\n        // Use exclusive create (wx / O_EXCL) so that if another process\n        // recreates the source file between planning and execution, this\n        // write fails with EEXIST instead of silently overwriting the new\n        // file (PR #637 round-11 review, codex P1).\n        await writeFile(p.sourcePath, p.content, { encoding: \"utf-8\", flag: \"wx\" });\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"restored\",\n        });\n      } catch (err) {\n        writeFailed = true;\n        result.restores.push({\n          entry: p.entry,\n          sourcePath: p.sourcePath,\n          outcome: \"skipped_write_failed\",\n          detail: `write failed: ${err instanceof Error ? err.message : String(err)}`,\n        });\n      }\n    }\n  }\n\n  if (writeFailed) {\n    result.error =\n      \"one or more source writes failed mid-restore; target not archived to preserve data\";\n    return result;\n  }\n\n  // Archive the target memory.  archiveMemory returns null on\n  // failure — surface that as a fatal error (PR #637 round-5 review,\n  // codex P2) so automation doesn't mistake a half-undo for a clean\n  // run.  The already-completed restores still roll forward; the\n  // result.restores list records what was written.\n  const archivedAt = await storage.archiveMemory(target, {\n    actor: \"consolidate-undo\",\n    reasonCode: \"consolidation-undo\",\n  });\n  result.targetArchived = archivedAt !== null;\n  if (!result.targetArchived) {\n    result.error =\n      \"sources restored successfully but archiving the consolidated target failed; inspect storage for manual cleanup\";\n  }\n  return result;\n}\n\n/**\n * Render a consolidation-undo result as a human-readable multi-line\n * string for the CLI.  Extracted so tests can snapshot the formatting\n * without parsing stdout.\n */\nexport function formatConsolidationUndoResult(result: ConsolidationUndoResult): string {\n  const lines: string[] = [];\n  lines.push(`consolidate undo ${result.dryRun ? \"(dry run) \" : \"\"}→ ${result.targetPath}`);\n  // Emit per-restore details BEFORE the error (PR #637 review, cursor\n  // Medium): the \"no sources could be recovered\" error is set after\n  // the restore loop ran, so operators need the per-source skip\n  // reasons to diagnose which snapshots were missing / outside\n  // memoryDir / malformed.  Early-bail errors (unloadable target,\n  // target outside memoryDir, no derived_from) run before the loop,\n  // so `result.restores` is empty in those cases and this block is a\n  // no-op.\n  for (const r of result.restores) {\n    lines.push(`  - ${r.entry} → ${r.outcome}${r.detail ? ` (${r.detail})` : \"\"}`);\n  }\n  if (result.error) {\n    lines.push(`  ERROR: ${result.error}`);\n    return lines.join(\"\\n\");\n  }\n  lines.push(\n    result.dryRun\n      ? \"  (dry run — no files were modified, target not archived)\"\n      : `  target archived: ${result.targetArchived ? \"yes\" : \"no\"}`,\n  );\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;;AAsBA,OAAO,UAAU;AACjB,SAAS,OAAO,WAAW,QAAQ,UAAU,aAAa;AAC1D,SAAS,aAAa,mBAAmB;AA8CzC,IAAM,wBAAwB;AAE9B,SAAS,WAAW,OAAgE;AAGlF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,qBAAqB;AAC/C,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,EAAE,UAAU,MAAM,CAAC,GAAG,WAAW,MAAM,CAAC,EAAE;AACnD;AAUO,SAAS,kBAAkB,WAAmB,MAAuB;AAC1E,QAAM,WAAW,KAAK,QAAQ,IAAI;AAClC,QAAM,gBAAgB,KAAK,QAAQ,SAAS;AAC5C,QAAM,MAAM,KAAK,SAAS,UAAU,aAAa;AACjD,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,MAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,MAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,SAAO;AACT;AAkBA,eAAsB,0BACpB,WACA,MACkB;AAClB,MAAI,CAAC,kBAAkB,WAAW,IAAI,EAAG,QAAO;AAIhD,QAAM,cAAc,UAAU,QAAQ,OAAO,GAAG,EAAE,MAAM,GAAG;AAC3D,MAAI,YAAY,KAAK,CAAC,MAAM,MAAM,IAAI,EAAG,QAAO;AAChD,MAAI;AACJ,MAAI;AACF,mBAAe,MAAM,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,gBAAgB,KAAK,QAAQ,SAAS;AAS5C,QAAM,WAAW,KAAK,QAAQ,IAAI;AAClC,QAAM,cAAc,KAAK,SAAS,UAAU,aAAa;AACzD,QAAM,WAAW,YAAY,SAAS,IAAI,YAAY,MAAM,KAAK,GAAG,IAAI,CAAC;AACzE,WAAS,IAAI,GAAG,KAAK,SAAS,QAAQ,KAAK;AACzC,UAAM,QAAQ,MAAM,IAAI,WAAW,KAAK,KAAK,UAAU,GAAG,SAAS,MAAM,GAAG,CAAC,CAAC;AAC9E,QAAI;AACF,YAAM,KAAK,MAAM,MAAM,KAAK;AAC5B,UAAI,GAAG,eAAe,KAAK,UAAU,UAAU;AAG7C,YAAI;AACJ,YAAI;AACF,mBAAS,MAAM,SAAS,KAAK;AAAA,QAC/B,QAAQ;AAEN,iBAAO;AAAA,QACT;AACA,cAAM,MAAM,KAAK,SAAS,cAAc,MAAM;AAC9C,YAAI,IAAI,WAAW,EAAG;AACtB,YAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,EAAG,QAAO;AAAA,MAC3D;AAAA,IACF,QAAQ;AAAA,IAGR;AAAA,EACF;AAIA,QAAM,QAAQ,cAAc,MAAM,KAAK,GAAG;AAC1C,WAAS,IAAI,MAAM,QAAQ,IAAI,GAAG,KAAK;AACrC,UAAM,QAAQ,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,KAAK,GAAG,KAAK,KAAK;AACvD,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,KAAK;AAErC,YAAM,WAAW,MAAM,MAAM,CAAC,EAAE,KAAK,KAAK,GAAG;AAC7C,YAAM,QAAQ,SAAS,SAAS,IAAI,KAAK,KAAK,UAAU,QAAQ,IAAI;AAGpE,YAAM,MAAM,KAAK,SAAS,cAAc,KAAK;AAC7C,UAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,UAAI,IAAI,WAAW,IAAI,EAAG,QAAO;AACjC,UAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,aAAO;AAAA,IACT,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,IAAM,sBAAsB,CAAC,YAAY,QAAQ;AAOjD,SAAS,sBAAsB,GAAmB;AAEhD,QAAM,QAAQ,EAAE,QAAQ,OAAO,GAAG,EAAE,MAAM,GAAG;AAC7C,QAAM,WAAqB,CAAC;AAC5B,aAAW,OAAO,OAAO;AACvB,QAAI,QAAQ,MAAM,QAAQ,IAAK;AAC/B,QAAI,QAAQ,MAAM;AAChB,UAAI,SAAS,SAAS,EAAG,UAAS,IAAI;AAAA,IAGxC,OAAO;AACL,eAAS,KAAK,GAAG;AAAA,IACnB;AAAA,EACF;AACA,SAAO,SAAS,KAAK,GAAG;AAC1B;AAcO,SAAS,2BACd,UACA,YACS;AACT,QAAM,aAAa,sBAAsB,QAAQ;AACjD,QAAM,WAAW,CAAC,GAAG,mBAAmB;AACxC,MAAI,YAAY;AACd,UAAM,cAAc,sBAAsB,UAAU;AACpD,aAAS,KAAK,cAAc,GAAG;AAAA,EACjC;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,eAAe,OAAO,MAAM,GAAG,EAAE,KAAK,WAAW,WAAW,MAAM,GAAG;AACvE,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,cAAc,GAA6B;AACxD,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,WAAO,GAAG,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,WAAW,GAA6B;AACrD,MAAI;AACF,UAAM,OAAO,GAAG,YAAY,IAAI;AAChC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAcA,eAAsB,qBAAqB,SAMN;AACnC,QAAM,EAAE,SAAS,WAAW,YAAY,WAAW,IAAI;AACvD,QAAM,SAAS,QAAQ,WAAW;AAElC,QAAM,SAAkC;AAAA,IACtC;AAAA,IACA,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,IACX;AAAA,EACF;AAQA,MAAI,CAAE,MAAM,0BAA0B,YAAY,SAAS,GAAI;AAC7D,WAAO,QAAQ,eAAe,UAAU,gCAAgC,SAAS;AACjF,WAAO;AAAA,EACT;AAOA,QAAM,YAAY,KAAK,SAAS,WAAW,UAAU;AACrD,MAAI,CAAC,2BAA2B,WAAW,WAAW,UAAU,GAAG;AACjE,WAAO,QAAQ,gBAAgB,SAAS;AACxC,WAAO;AAAA,EACT;AAKA,QAAM,SAAS,MAAM,QAAQ,iBAAiB,UAAU;AACxD,MAAI,CAAC,QAAQ;AACX,WAAO,QAAQ,mCAAmC,UAAU;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,OAAO,YAAY;AACvC,MAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,YAAY,WAAW,GAAG;AAC3D,WAAO,QAAQ;AACf,WAAO;AAAA,EACT;AAcA,QAAM,QAAuB,CAAC;AAC9B,aAAW,YAAY,aAAa;AAClC,UAAM,QAAQ,OAAO,aAAa,WAAW,WAAW,OAAO,QAAQ;AACvE,UAAM,SAAS,WAAW,QAAQ;AAClC,QAAI,CAAC,QAAQ;AACX,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA,YAAY;AAAA,UACZ,SAAS;AAAA,UACT,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAKA,QAAI,KAAK,WAAW,OAAO,QAAQ,GAAG;AACpC,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA,YAAY,OAAO;AAAA,UACnB,SAAS;AAAA,UACT,QAAQ,sDAAsD,OAAO,QAAQ;AAAA,QAC/E;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,UAAM,aAAa,KAAK,KAAK,WAAW,OAAO,QAAQ;AAEvD,QAAI,CAAE,MAAM,0BAA0B,YAAY,SAAS,GAAI;AAC7D,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,0CAA0C,SAAS;AAAA,QAC7D;AAAA,MACF,CAAC;AACD;AAAA,IACF;AASA,QAAI,mBAAmB,OAAO;AAC9B,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,SAAS;AACzC,UAAI;AACF,cAAM,aAAa,MAAM,SAAS,UAAU;AAC5C,cAAM,MAAM,KAAK,SAAS,UAAU,UAAU;AAC9C,YAAI,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,GAAG,GAAG;AAClD,6BAAmB,IAAI,QAAQ,OAAO,GAAG;AAAA,QAC3C;AAAA,MACF,QAAQ;AAKN,cAAM,YAAY,KAAK,QAAQ,UAAU;AACzC,YAAI;AACF,gBAAM,aAAa,MAAM,SAAS,SAAS;AAC3C,gBAAM,YAAY,KAAK,SAAS,UAAU,UAAU;AACpD,cAAI,CAAC,UAAU,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,SAAS,GAAG;AAC9D,kBAAM,WAAW,KAAK,SAAS,UAAU;AACzC,+BAAmB,KAAK,KAAK,WAAW,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAAA,UACtE;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,2BAA2B,OAAO,UAAU,WAAW,UAAU,KAClE,CAAC,2BAA2B,kBAAkB,WAAW,UAAU,GAAG;AACxE,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,gBAAgB,OAAO,QAAQ;AAAA,QACzC;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAOA,QAAI,KAAK,QAAQ,UAAU,MAAM,KAAK,QAAQ,UAAU,GAAG;AACzD,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,uBAAuB,KAAK;AAAA,QACtC;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,QAAI,MAAM,cAAc,UAAU,GAAG;AAOnC,YAAM,KAAK,EAAE,MAAM,sBAAsB,OAAO,WAAW,CAAC;AAC5D;AAAA,IACF;AACA,QAAI,MAAM,WAAW,UAAU,GAAG;AAMhC,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ;AAAA,QACV;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,wBAAkB,MAAM;AAAA,QACtB;AAAA,QACA,OAAO;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,KAAK;AAAA,QACT,MAAM;AAAA,QACN,SAAS;AAAA,UACP;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,QAAQ,2BAA2B,OAAO,SAAS;AAAA,QACrD;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAEA,UAAM,KAAK,EAAE,MAAM,SAAS,OAAO,YAAY,SAAS,gBAAgB,CAAC;AAAA,EAC3E;AAMA,QAAM,UAAU,MAAM,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM;AACrD,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,KAAK,OAAO;AACrB,UAAI,EAAE,SAAS,QAAQ;AACrB,eAAO,SAAS,KAAK,EAAE,OAAO;AAAA,MAChC,WAAW,EAAE,SAAS,SAAS;AAI7B,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS,SAAS,oBAAoB;AAAA,UACtC,QAAQ,SACJ,4DACA;AAAA,QACN,CAAC;AAAA,MACH,OAAO;AACL,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF;AACA,UAAM,YAAY,OAAO,SAAS;AAAA,MAChC,CAAC,MAAM,EAAE,YAAY,cAAc,EAAE,YAAY;AAAA,IACnD,EAAE;AACF,QAAI,cAAc,GAAG;AACnB,aAAO,QACL;AAAA,IACJ,OAAO;AACL,aAAO,QAAQ,GAAG,QAAQ,MAAM,OAAO,MAAM,MAAM;AAAA,IACrD;AACA,WAAO;AAAA,EACT;AAOA,QAAM,kBAAkB,oBAAI,IAAY;AACxC,QAAM,eAA8B,CAAC;AACrC,aAAW,KAAK,OAAO;AACrB,QAAI,EAAE,SAAS,WAAW,EAAE,SAAS,sBAAsB;AACzD,UAAI,gBAAgB,IAAI,EAAE,UAAU,GAAG;AACrC,qBAAa,KAAK;AAAA,UAChB,MAAM;AAAA,UACN,SAAS;AAAA,YACP,OAAO,EAAE,SAAS,UAAU,EAAE,QAAQ,EAAE;AAAA,YACxC,YAAY,EAAE;AAAA,YACd,SAAS;AAAA,YACT,QAAQ;AAAA,UACV;AAAA,QACF,CAAC;AACD;AAAA,MACF;AACA,sBAAgB,IAAI,EAAE,UAAU;AAAA,IAClC;AACA,iBAAa,KAAK,CAAC;AAAA,EACrB;AAGA,MAAI,QAAQ;AACV,eAAW,KAAK,cAAc;AAC5B,UAAI,EAAE,SAAS,SAAS;AACtB,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,WAAW,EAAE,SAAS,sBAAsB;AAC1C,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,WAAW,EAAE,SAAS,UAAU,EAAE,SAAS;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO;AAAA,MAChC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,MAAI,cAAc;AAClB,aAAW,KAAK,cAAc;AAC5B,QAAI,EAAE,SAAS,QAAQ;AAErB,UAAI,EAAE,QAAS,QAAO,SAAS,KAAK,EAAE,OAAO;AAC7C;AAAA,IACF;AACA,QAAI,EAAE,SAAS,sBAAsB;AACnC,aAAO,SAAS,KAAK;AAAA,QACnB,OAAO,EAAE;AAAA,QACT,YAAY,EAAE;AAAA,QACd,SAAS;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AACD;AAAA,IACF;AACA,QAAI,EAAE,SAAS,SAAS;AACtB,UAAI,aAAa;AAGf,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ;AAAA,QACV,CAAC;AACD;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAM,KAAK,QAAQ,EAAE,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAK3D,cAAM,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,SAAS,MAAM,KAAK,CAAC;AAC1E,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,QACX,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,sBAAc;AACd,eAAO,SAAS,KAAK;AAAA,UACnB,OAAO,EAAE;AAAA,UACT,YAAY,EAAE;AAAA,UACd,SAAS;AAAA,UACT,QAAQ,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAC3E,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa;AACf,WAAO,QACL;AACF,WAAO;AAAA,EACT;AAOA,QAAM,aAAa,MAAM,QAAQ,cAAc,QAAQ;AAAA,IACrD,OAAO;AAAA,IACP,YAAY;AAAA,EACd,CAAC;AACD,SAAO,iBAAiB,eAAe;AACvC,MAAI,CAAC,OAAO,gBAAgB;AAC1B,WAAO,QACL;AAAA,EACJ;AACA,SAAO;AACT;AAOO,SAAS,8BAA8B,QAAyC;AACrF,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,oBAAoB,OAAO,SAAS,eAAe,EAAE,UAAK,OAAO,UAAU,EAAE;AASxF,aAAW,KAAK,OAAO,UAAU;AAC/B,UAAM,KAAK,OAAO,EAAE,KAAK,WAAM,EAAE,OAAO,GAAG,EAAE,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE,EAAE;AAAA,EAC/E;AACA,MAAI,OAAO,OAAO;AAChB,UAAM,KAAK,YAAY,OAAO,KAAK,EAAE;AACrC,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB;AACA,QAAM;AAAA,IACJ,OAAO,SACH,mEACA,sBAAsB,OAAO,iBAAiB,QAAQ,IAAI;AAAA,EAChE;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{contradiction-review-WIUBAR52.js → contradiction-review-5LTTVDQV.js}

@@ -8,6 +8,7 @@ import {
   writePair,
   writePairs
 } from "./chunk-YNB73F22.js";
+import "./chunk-PZ5AY32C.js";
 export {
   computePairId,
   isCoolingDown,
@@ -18,4 +19,4 @@ export {
   writePair,
   writePairs
 };
-//# sourceMappingURL=contradiction-review-WIUBAR52.js.map
+//# sourceMappingURL=contradiction-review-5LTTVDQV.js.map

package/dist/contradiction-review-5LTTVDQV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}