@remnic/core 1.1.11 → 1.1.13

package/dist/chunk-QDZ2RLEC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/trust-zones.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, writeFile } from \"node:fs/promises\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport { countRecallTokenOverlap, normalizeRecallTokens } from \"./recall-tokenization.js\";\nimport {\n  assertIsoRecordedAt,\n  assertSafePathSegment,\n  assertString,\n  isRecord,\n  optionalString,\n  optionalStringArray,\n  recordStoreDay,\n  validateStringRecord,\n} from \"./store-contract.js\";\n\nexport type TrustZoneName = \"quarantine\" | \"working\" | \"trusted\";\nexport type TrustZoneRecordKind = \"memory\" | \"artifact\" | \"state\" | \"trajectory\" | \"external\";\nexport type TrustZoneSourceClass =\n  | \"tool_output\"\n  | \"web_content\"\n  | \"subagent_trace\"\n  | \"system_memory\"\n  | \"user_input\"\n  | \"manual\";\n\nexport function isTrustZoneName(value: string): value is TrustZoneName {\n  return value === \"quarantine\" || value === \"working\" || value === \"trusted\";\n}\n\nexport interface TrustZoneProvenance {\n  sourceClass: TrustZoneSourceClass;\n  observedAt: string;\n  sessionKey?: string;\n  sourceId?: string;\n  evidenceHash?: string;\n}\n\nexport interface TrustZoneRecord {\n  schemaVersion: 1;\n  recordId: string;\n  zone: TrustZoneName;\n  recordedAt: string;\n  kind: TrustZoneRecordKind;\n  summary: string;\n  provenance: TrustZoneProvenance;\n  promotedFromZone?: TrustZoneName;\n  entityRefs?: string[];\n  tags?: string[];\n  metadata?: Record<string, string>;\n}\n\nexport type TrustZoneScoreBand = \"low\" | \"medium\" | \"high\";\n\nexport interface TrustZoneProvenanceScore {\n  total: number;\n  band: TrustZoneScoreBand;\n  anchored: boolean;\n  sourceClassWeight: number;\n  sourceIdBonus: number;\n  evidenceHashBonus: number;\n  sessionKeyBonus: number;\n}\n\nexport interface TrustZoneStoreStatus {\n  enabled: boolean;\n  promotionEnabled: boolean;\n  poisoningDefenseEnabled: boolean;\n  rootDir: string;\n  zonesDir: string;\n  records: {\n    total: number;\n    valid: number;\n    invalid: number;\n    byZone: Partial<Record<TrustZoneName, number>>;\n    byKind: Partial<Record<TrustZoneRecordKind, number>>;\n    latestRecordId?: string;\n    latestRecordedAt?: string;\n    latestZone?: TrustZoneName;\n    averageTrustScore?: number;\n    byTrustBand?: Partial<Record<TrustZoneScoreBand, number>>;\n  };\n  latestRecord?: TrustZoneRecord;\n  latestRecordTrustScore?: TrustZoneProvenanceScore;\n  invalidRecords: Array<{\n    path: string;\n    error: string;\n  }>;\n}\n\nexport interface TrustZonePromotionPlan {\n  allowed: boolean;\n  reasons: string[];\n  sourceRecordId: string;\n  sourceZone: TrustZoneName;\n  targetZone: TrustZoneName;\n  provenanceAnchored: boolean;\n}\n\nexport interface TrustZonePromotionResult {\n  plan: TrustZonePromotionPlan;\n  wroteRecord: boolean;\n  record: TrustZoneRecord;\n  filePath?: string;\n  sourceRecord: TrustZoneRecord;\n}\n\ninterface TrustZoneCorroborationSummary {\n  count: number;\n  sourceClasses: TrustZoneSourceClass[];\n}\n\nexport interface TrustZoneSearchResult {\n  record: TrustZoneRecord;\n  score: number;\n  matchedFields: string[];\n}\n\nexport interface TrustZoneRecordEntry {\n  filePath: string;\n  record: TrustZoneRecord;\n}\n\nexport interface TrustZoneListResult {\n  total: number;\n  count: number;\n  limit: number;\n  offset: number;\n  records: TrustZoneRecordEntry[];\n  allRecords: TrustZoneRecord[];\n}\n\nexport interface TrustZonePromotionReadiness {\n  nextTargetZone?: TrustZoneName;\n  allowed: boolean;\n  reasons: string[];\n  requiresCorroboration: boolean;\n  corroborationCount: number;\n  corroborationSourceClasses: TrustZoneSourceClass[];\n}\n\nexport interface TrustZoneDemoSeedResult {\n  scenario: TrustZoneDemoScenario;\n  dryRun: boolean;\n  recordsWritten: number;\n  records: TrustZoneRecord[];\n  filePaths: string[];\n}\n\nexport type TrustZoneDemoScenario = \"enterprise-buyer-v1\" | \"agentic-commerce-v1\";\n\nconst TRUST_ZONE_DEMO_SCENARIOS: TrustZoneDemoScenario[] = [\n  \"enterprise-buyer-v1\",\n  \"agentic-commerce-v1\",\n];\n\nfunction validateMetadata(raw: unknown): Record<string, string> | undefined {\n  return validateStringRecord(raw, \"metadata\");\n}\n\nfunction validateZone(raw: unknown, field: string): TrustZoneName {\n  const value = assertString(raw, field);\n  if (![\"quarantine\", \"working\", \"trusted\"].includes(value)) {\n    throw new Error(`${field} must be one of quarantine|working|trusted`);\n  }\n  return value as TrustZoneName;\n}\n\nfunction validateKind(raw: unknown): TrustZoneRecordKind {\n  const value = assertString(raw, \"kind\");\n  if (![\"memory\", \"artifact\", \"state\", \"trajectory\", \"external\"].includes(value)) {\n    throw new Error(\"kind must be one of memory|artifact|state|trajectory|external\");\n  }\n  return value as TrustZoneRecordKind;\n}\n\nfunction validateProvenance(raw: unknown): TrustZoneProvenance {\n  if (!isRecord(raw)) throw new Error(\"provenance must be an object\");\n  const sourceClass = assertString(raw.sourceClass, \"provenance.sourceClass\");\n  if (![\"tool_output\", \"web_content\", \"subagent_trace\", \"system_memory\", \"user_input\", \"manual\"].includes(sourceClass)) {\n    throw new Error(\"provenance.sourceClass must be one of tool_output|web_content|subagent_trace|system_memory|user_input|manual\");\n  }\n  return {\n    sourceClass: sourceClass as TrustZoneSourceClass,\n    observedAt: assertIsoRecordedAt(assertString(raw.observedAt, \"provenance.observedAt\"), \"provenance.observedAt\"),\n    sessionKey: optionalString(raw.sessionKey),\n    sourceId: optionalString(raw.sourceId),\n    evidenceHash: optionalString(raw.evidenceHash),\n  };\n}\n\nexport function resolveTrustZoneStoreDir(memoryDir: string, overrideDir?: string): string {\n  if (typeof overrideDir === \"string\" && overrideDir.trim().length > 0) {\n    return overrideDir.trim();\n  }\n  return path.join(memoryDir, \"state\", \"trust-zones\");\n}\n\nexport function validateTrustZoneRecord(raw: unknown): TrustZoneRecord {\n  if (!isRecord(raw)) throw new Error(\"trust-zone record must be an object\");\n  if (raw.schemaVersion !== 1) throw new Error(\"schemaVersion must be 1\");\n\n  return {\n    schemaVersion: 1,\n    recordId: assertSafePathSegment(assertString(raw.recordId, \"recordId\"), \"recordId\"),\n    zone: validateZone(raw.zone, \"zone\"),\n    recordedAt: assertIsoRecordedAt(assertString(raw.recordedAt, \"recordedAt\")),\n    kind: validateKind(raw.kind),\n    summary: assertString(raw.summary, \"summary\"),\n    provenance: validateProvenance(raw.provenance),\n    promotedFromZone: raw.promotedFromZone === undefined ? undefined : validateZone(raw.promotedFromZone, \"promotedFromZone\"),\n    entityRefs: optionalStringArray(raw.entityRefs, \"entityRefs\"),\n    tags: optionalStringArray(raw.tags, \"tags\"),\n    metadata: validateMetadata(raw.metadata),\n  };\n}\n\nexport async function recordTrustZoneRecord(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  record: TrustZoneRecord;\n}): Promise<string> {\n  const rootDir = resolveTrustZoneStoreDir(options.memoryDir, options.trustZoneStoreDir);\n  const validated = validateTrustZoneRecord(options.record);\n  const day = recordStoreDay(validated.recordedAt);\n  const zoneDir = path.join(rootDir, \"zones\", validated.zone, day);\n  const filePath = path.join(zoneDir, `${validated.recordId}.json`);\n  await mkdir(zoneDir, { recursive: true });\n  await writeFile(filePath, JSON.stringify(validated, null, 2), \"utf8\");\n  return filePath;\n}\n\nfunction hasAnchoredProvenance(record: TrustZoneRecord): boolean {\n  return Boolean(record.provenance.sourceId && record.provenance.evidenceHash);\n}\n\nfunction buildPromotionRecordId(sourceRecordId: string, targetZone: TrustZoneName, recordedAt: string): string {\n  const suffix = recordedAt.replace(/[^0-9]/g, \"\").slice(0, 14);\n  return `${sourceRecordId}-${targetZone}-${suffix}`;\n}\n\nfunction dedupeStrings(values: Array<string | undefined>): string[] | undefined {\n  const out = values.filter((value): value is string => typeof value === \"string\" && value.length > 0);\n  if (out.length === 0) return undefined;\n  return [...new Set(out)];\n}\n\nfunction hasOverlap(left: string[] | undefined, right: string[] | undefined): boolean {\n  if (!left || !right || left.length === 0 || right.length === 0) return false;\n  const rightSet = new Set(right);\n  return left.some((value) => rightSet.has(value));\n}\n\nfunction corroborationTags(record: TrustZoneRecord): string[] | undefined {\n  if (!record.tags || record.tags.length === 0) return undefined;\n  const filtered = record.tags.filter((tag) => tag !== \"trust-zone-demo\" && tag !== \"enterprise-demo\" && tag !== \"commerce-demo\");\n  return filtered.length > 0 ? filtered : undefined;\n}\n\nfunction requiresCorroboration(record: TrustZoneRecord, targetZone: TrustZoneName, poisoningDefenseEnabled: boolean): boolean {\n  return (\n    poisoningDefenseEnabled === true\n    && targetZone === \"trusted\"\n    && record.zone === \"working\"\n    && [\"tool_output\", \"web_content\", \"subagent_trace\"].includes(record.provenance.sourceClass)\n  );\n}\n\nfunction summarizeCorroboration(options: {\n  sourceRecord: TrustZoneRecord;\n  records: TrustZoneRecord[];\n}): TrustZoneCorroborationSummary {\n  const corroborating = options.records.filter((candidate) => {\n    if (candidate.recordId === options.sourceRecord.recordId) return false;\n    if (candidate.zone === \"quarantine\") return false;\n    if (hasAnchoredProvenance(candidate) !== true) return false;\n    if (candidate.provenance.sourceClass === options.sourceRecord.provenance.sourceClass) return false;\n    return (\n      hasOverlap(candidate.entityRefs, options.sourceRecord.entityRefs)\n      || hasOverlap(corroborationTags(candidate), corroborationTags(options.sourceRecord))\n    );\n  });\n\n  return {\n    count: corroborating.length,\n    sourceClasses: [...new Set(corroborating.map((record) => record.provenance.sourceClass))],\n  };\n}\n\nconst SOURCE_CLASS_WEIGHTS: Record<TrustZoneSourceClass, number> = {\n  manual: 0.9,\n  system_memory: 0.85,\n  user_input: 0.75,\n  tool_output: 0.55,\n  subagent_trace: 0.45,\n  web_content: 0.35,\n};\n\nfunction roundTrustScore(value: number): number {\n  return Math.round(value * 1000) / 1000;\n}\n\nfunction trustScoreBand(total: number): TrustZoneScoreBand {\n  if (total >= 0.8) return \"high\";\n  if (total >= 0.5) return \"medium\";\n  return \"low\";\n}\n\nexport function scoreTrustZoneProvenance(record: TrustZoneRecord): TrustZoneProvenanceScore {\n  const sourceClassWeight = SOURCE_CLASS_WEIGHTS[record.provenance.sourceClass];\n  const sourceIdBonus = typeof record.provenance.sourceId === \"string\" ? 0.1 : 0;\n  const evidenceHashBonus = typeof record.provenance.evidenceHash === \"string\" ? 0.2 : 0;\n  const sessionKeyBonus = typeof record.provenance.sessionKey === \"string\" ? 0.05 : 0;\n  const total = roundTrustScore(\n    Math.min(1, sourceClassWeight + sourceIdBonus + evidenceHashBonus + sessionKeyBonus),\n  );\n\n  return {\n    total,\n    band: trustScoreBand(total),\n    anchored: hasAnchoredProvenance(record),\n    sourceClassWeight,\n    sourceIdBonus,\n    evidenceHashBonus,\n    sessionKeyBonus,\n  };\n}\n\nexport function planTrustZonePromotion(options: {\n  record: TrustZoneRecord;\n  targetZone: TrustZoneName;\n}): TrustZonePromotionPlan {\n  const { record, targetZone } = options;\n  const reasons: string[] = [];\n  const provenanceAnchored = hasAnchoredProvenance(record);\n\n  if (record.zone === targetZone) {\n    reasons.push(`record is already in the ${targetZone} zone`);\n  }\n  if (record.zone === \"trusted\") {\n    reasons.push(\"trusted records are terminal and cannot be promoted again\");\n  }\n  if (record.zone === \"quarantine\" && targetZone === \"trusted\") {\n    reasons.push(\"quarantine records must pass through working before trusted promotion\");\n  }\n  if (record.zone === \"working\" && targetZone === \"quarantine\") {\n    reasons.push(\"working records cannot be demoted back into quarantine in this promotion path\");\n  }\n  if (record.zone === \"quarantine\" && targetZone !== \"working\") {\n    reasons.push(\"quarantine promotions only support the working zone\");\n  }\n  if (record.zone === \"working\" && targetZone !== \"trusted\") {\n    reasons.push(\"working promotions only support the trusted zone\");\n  }\n  if (\n    targetZone === \"trusted\" &&\n    [\"tool_output\", \"web_content\", \"subagent_trace\"].includes(record.provenance.sourceClass) &&\n    provenanceAnchored !== true\n  ) {\n    reasons.push(\"trusted promotion for external/tool-derived provenance requires both provenance.sourceId and provenance.evidenceHash\");\n  }\n\n  return {\n    allowed: reasons.length === 0,\n    reasons,\n    sourceRecordId: record.recordId,\n    sourceZone: record.zone,\n    targetZone,\n    provenanceAnchored,\n  };\n}\n\nasync function findTrustZoneRecordById(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  recordId: string;\n}): Promise<TrustZoneRecord | null> {\n  const { entries } = await readTrustZoneRecordEntries(options);\n  entries.sort((a, b) => b.record.recordedAt.localeCompare(a.record.recordedAt));\n  return entries.find((entry) => entry.record.recordId === options.recordId)?.record ?? null;\n}\n\nexport async function promoteTrustZoneRecord(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  enabled: boolean;\n  promotionEnabled: boolean;\n  poisoningDefenseEnabled?: boolean;\n  sourceRecordId: string;\n  targetZone: TrustZoneName;\n  recordedAt: string;\n  promotionReason: string;\n  summary?: string;\n  dryRun?: boolean;\n}): Promise<TrustZonePromotionResult> {\n  if (options.enabled !== true) {\n    throw new Error(\"trust zone promotion requires trustZonesEnabled=true\");\n  }\n  if (options.promotionEnabled !== true) {\n    throw new Error(\"trust zone promotion requires quarantinePromotionEnabled=true\");\n  }\n\n  const sourceRecord = await findTrustZoneRecordById({\n    memoryDir: options.memoryDir,\n    trustZoneStoreDir: options.trustZoneStoreDir,\n    recordId: assertSafePathSegment(assertString(options.sourceRecordId, \"sourceRecordId\"), \"sourceRecordId\"),\n  });\n  if (!sourceRecord) {\n    throw new Error(`source trust-zone record not found: ${options.sourceRecordId}`);\n  }\n\n  const plan = planTrustZonePromotion({\n    record: sourceRecord,\n    targetZone: options.targetZone,\n  });\n  if (!plan.allowed) {\n    throw new Error(`trust-zone promotion denied: ${plan.reasons.join(\"; \")}`);\n  }\n\n  const corroboration = requiresCorroboration(sourceRecord, options.targetZone, options.poisoningDefenseEnabled === true)\n    ? summarizeCorroboration({\n        sourceRecord,\n        records: (await readTrustZoneRecordEntries({\n          memoryDir: options.memoryDir,\n          trustZoneStoreDir: options.trustZoneStoreDir,\n        })).entries.map((entry) => entry.record),\n      })\n    : null;\n\n  if (corroboration && corroboration.count === 0) {\n    throw new Error(\"trust-zone promotion denied: corroboration is required for risky trusted promotions\");\n  }\n\n  const recordedAt = assertIsoRecordedAt(assertString(options.recordedAt, \"recordedAt\"));\n  const promotionReason = assertString(options.promotionReason, \"promotionReason\");\n  const nextRecord: TrustZoneRecord = {\n    schemaVersion: 1,\n    recordId: buildPromotionRecordId(sourceRecord.recordId, options.targetZone, recordedAt),\n    zone: options.targetZone,\n    recordedAt,\n    kind: sourceRecord.kind,\n    summary: optionalString(options.summary) ?? sourceRecord.summary,\n    provenance: sourceRecord.provenance,\n    promotedFromZone: sourceRecord.zone,\n    entityRefs: sourceRecord.entityRefs,\n    tags: dedupeStrings([...(sourceRecord.tags ?? []), \"promotion\"]),\n    metadata: {\n      ...(sourceRecord.metadata ?? {}),\n      sourceRecordId: sourceRecord.recordId,\n      promotionReason,\n      ...(corroboration\n        ? {\n            corroborated: \"true\",\n            corroborationCount: String(corroboration.count),\n            corroborationSources: corroboration.sourceClasses.join(\",\"),\n          }\n        : {}),\n    },\n  };\n\n  if (options.dryRun === true) {\n    return {\n      plan,\n      wroteRecord: false,\n      record: nextRecord,\n      sourceRecord,\n    };\n  }\n\n  const filePath = await recordTrustZoneRecord({\n    memoryDir: options.memoryDir,\n    trustZoneStoreDir: options.trustZoneStoreDir,\n    record: nextRecord,\n  });\n\n  return {\n    plan,\n    wroteRecord: true,\n    record: nextRecord,\n    filePath,\n    sourceRecord,\n  };\n}\n\nasync function readTrustZoneRecordEntries(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n}): Promise<{\n  files: string[];\n  entries: TrustZoneRecordEntry[];\n  invalidRecords: Array<{ path: string; error: string }>;\n}> {\n  const rootDir = resolveTrustZoneStoreDir(options.memoryDir, options.trustZoneStoreDir);\n  const files = await listJsonFiles(path.join(rootDir, \"zones\"));\n  const entries: TrustZoneRecordEntry[] = [];\n  const invalidRecords: Array<{ path: string; error: string }> = [];\n  for (const filePath of files) {\n    try {\n      entries.push({\n        filePath,\n        record: validateTrustZoneRecord(await readJsonFile(filePath)),\n      });\n    } catch (error) {\n      invalidRecords.push({\n        path: filePath,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n  }\n  return { files, entries, invalidRecords };\n}\n\nfunction lexicalScoreTrustZoneRecord(\n  record: TrustZoneRecord,\n  queryTokens: Set<string>,\n): { score: number; matchedFields: string[] } {\n  const weightedFields: Array<[field: string, value: string | undefined, weight: number]> = [\n    [\"summary\", record.summary, 4],\n    [\"kind\", record.kind, 1],\n    [\"zone\", record.zone, 1],\n    [\"sourceClass\", record.provenance.sourceClass, 1],\n    [\"entityRefs\", record.entityRefs?.join(\" \"), 2],\n    [\"tags\", record.tags?.join(\" \"), 2],\n    [\"metadata\", record.metadata ? Object.values(record.metadata).join(\" \") : undefined, 1],\n  ];\n\n  let score = 0;\n  const matchedFields: string[] = [];\n  for (const [field, value, weight] of weightedFields) {\n    const matches = countRecallTokenOverlap(queryTokens, value, [\"what\"]);\n    if (matches > 0) matchedFields.push(field);\n    score += matches * weight;\n  }\n  return { score, matchedFields };\n}\n\nfunction zonePriority(zone: TrustZoneName): number {\n  switch (zone) {\n    case \"trusted\":\n      return 3;\n    case \"working\":\n      return 2;\n    case \"quarantine\":\n      return 1;\n  }\n}\n\nfunction scoreTrustZoneRecord(\n  record: TrustZoneRecord,\n  lexicalScore: number,\n  sessionKey?: string,\n): number {\n  let score = lexicalScore;\n  score += zonePriority(record.zone);\n  if (sessionKey && record.provenance.sessionKey === sessionKey) score += 1;\n\n  const recordedAtMs = Date.parse(record.recordedAt);\n  if (Number.isFinite(recordedAtMs)) {\n    const ageHours = Math.max(0, (Date.now() - recordedAtMs) / 3_600_000);\n    score += 1 / (1 + ageHours);\n  }\n  return score;\n}\n\nexport async function searchTrustZoneRecords(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  query: string;\n  maxResults: number;\n  sessionKey?: string;\n}): Promise<TrustZoneSearchResult[]> {\n  const maxResults = Math.max(0, Math.floor(options.maxResults));\n  if (maxResults === 0) return [];\n\n  const { entries } = await readTrustZoneRecordEntries(options);\n  const records = entries.map((entry) => entry.record);\n  const candidates = records.filter((record) => record.zone !== \"quarantine\");\n  if (candidates.length === 0) return [];\n\n  const queryTokens = new Set(normalizeRecallTokens(options.query, [\"what\"]));\n  if (queryTokens.size === 0) return [];\n\n  const scored = candidates.map((record) => {\n    const lexical = lexicalScoreTrustZoneRecord(record, queryTokens);\n    return {\n      record,\n      matchedFields: lexical.matchedFields,\n      lexicalScore: lexical.score,\n      score: scoreTrustZoneRecord(record, lexical.score, options.sessionKey),\n    };\n  });\n\n  const filtered = scored.filter((result) => result.lexicalScore > 0);\n  filtered.sort((left, right) => {\n    if (right.score !== left.score) return right.score - left.score;\n    return right.record.recordedAt.localeCompare(left.record.recordedAt);\n  });\n\n  return filtered.slice(0, maxResults).map(({ record, score, matchedFields }) => ({\n    record,\n    score,\n    matchedFields,\n  }));\n}\n\nexport async function listTrustZoneRecords(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  query?: string;\n  zone?: TrustZoneName;\n  kind?: TrustZoneRecordKind;\n  sourceClass?: TrustZoneSourceClass;\n  limit?: number;\n  offset?: number;\n}): Promise<TrustZoneListResult> {\n  const limit = Number.isFinite(options.limit) ? Math.max(1, Math.min(200, Math.floor(options.limit ?? 25))) : 25;\n  const offset = Number.isFinite(options.offset) ? Math.max(0, Math.floor(options.offset ?? 0)) : 0;\n  const zoneFilter = options.zone?.trim();\n  const kindFilter = options.kind?.trim();\n  const sourceClassFilter = options.sourceClass?.trim();\n  const queryTokens = new Set(normalizeRecallTokens(options.query ?? \"\", [\"what\"]));\n\n  const { entries } = await readTrustZoneRecordEntries(options);\n  const filtered = entries\n    .filter((entry) => !zoneFilter || entry.record.zone === zoneFilter)\n    .filter((entry) => !kindFilter || entry.record.kind === kindFilter)\n    .filter((entry) => !sourceClassFilter || entry.record.provenance.sourceClass === sourceClassFilter)\n    .map((entry) => ({\n      entry,\n      lexical: queryTokens.size > 0 ? lexicalScoreTrustZoneRecord(entry.record, queryTokens) : null,\n    }))\n    .filter((candidate) => queryTokens.size === 0 || (candidate.lexical?.score ?? 0) > 0);\n\n  filtered.sort((left, right) => {\n    const leftScore = left.lexical?.score ?? 0;\n    const rightScore = right.lexical?.score ?? 0;\n    if (rightScore !== leftScore) return rightScore - leftScore;\n    return right.entry.record.recordedAt.localeCompare(left.entry.record.recordedAt);\n  });\n\n  return {\n    total: filtered.length,\n    count: filtered.slice(offset, offset + limit).length,\n    limit,\n    offset,\n    records: filtered.slice(offset, offset + limit).map((candidate) => candidate.entry),\n    allRecords: entries.map((entry) => entry.record),\n  };\n}\n\nexport function summarizeTrustZonePromotionReadiness(options: {\n  record: TrustZoneRecord;\n  allRecords: TrustZoneRecord[];\n  poisoningDefenseEnabled: boolean;\n}): TrustZonePromotionReadiness {\n  if (options.record.zone === \"trusted\") {\n    return {\n      allowed: false,\n      reasons: [\"trusted records are terminal and do not have a next promotion step\"],\n      requiresCorroboration: false,\n      corroborationCount: 0,\n      corroborationSourceClasses: [],\n    };\n  }\n\n  const nextTargetZone: TrustZoneName = options.record.zone === \"quarantine\" ? \"working\" : \"trusted\";\n  const plan = planTrustZonePromotion({\n    record: options.record,\n    targetZone: nextTargetZone,\n  });\n  const requires = requiresCorroboration(options.record, nextTargetZone, options.poisoningDefenseEnabled);\n  const corroboration = requires\n    ? summarizeCorroboration({\n        sourceRecord: options.record,\n        records: options.allRecords,\n      })\n    : { count: 0, sourceClasses: [] };\n\n  const reasons = [...plan.reasons];\n  if (requires && corroboration.count === 0) {\n    reasons.push(\"trusted promotion requires corroboration from an independent non-quarantine source\");\n  }\n\n  return {\n    nextTargetZone,\n    allowed: plan.allowed && (!requires || corroboration.count > 0),\n    reasons,\n    requiresCorroboration: requires,\n    corroborationCount: corroboration.count,\n    corroborationSourceClasses: corroboration.sourceClasses,\n  };\n}\n\nfunction addMinutes(baseIso: string, minutes: number): string {\n  const baseMs = Date.parse(baseIso);\n  if (!Number.isFinite(baseMs)) {\n    throw new Error(\"recordedAt must be a valid ISO timestamp\");\n  }\n  return new Date(baseMs + minutes * 60_000).toISOString();\n}\n\nfunction buildTrustZoneDemoSeedRunId(baseRecordedAt: string): string {\n  return baseRecordedAt.replace(/[^0-9]/g, \"\");\n}\n\nfunction buildTrustZoneDemoRecordId(baseId: string, seedRunId: string): string {\n  return `${baseId}-${seedRunId}`;\n}\n\nfunction parseTrustZoneDemoScenario(raw: string | undefined): TrustZoneDemoScenario {\n  const scenario = (raw ?? \"enterprise-buyer-v1\").trim();\n  if (!TRUST_ZONE_DEMO_SCENARIOS.includes(scenario as TrustZoneDemoScenario)) {\n    throw new Error(`unsupported trust-zone demo scenario: ${scenario}`);\n  }\n  return scenario as TrustZoneDemoScenario;\n}\n\nfunction buildEnterpriseBuyerTrustZoneDemoRecords(baseRecordedAt: string, scenario: TrustZoneDemoScenario): TrustZoneRecord[] {\n  const demoTag = \"trust-zone-demo\";\n  const commonMetadata = {\n    demoScenario: scenario,\n    demoSeed: \"true\",\n  };\n  const seedRunId = buildTrustZoneDemoSeedRunId(baseRecordedAt);\n  return [\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-quarantine-ready\", seedRunId),\n      zone: \"quarantine\",\n      recordedAt: addMinutes(baseRecordedAt, 0),\n      kind: \"external\",\n      summary: \"Vendor portal policy excerpt captured before validation for Acme Industrial onboarding.\",\n      provenance: {\n        sourceClass: \"web_content\",\n        observedAt: addMinutes(baseRecordedAt, -2),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n        sourceId: \"https://vendor.example.com/policies/acme-industrial.pdf\",\n        evidenceHash: \"sha256:vendor-portal-policy-proof\",\n      },\n      entityRefs: [\"account:acme-industrial\", \"policy:vendor-onboarding\"],\n      tags: [demoTag, \"enterprise-demo\", \"vendor-policy\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"captured-external-policy\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-working-blocked\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 2),\n      kind: \"external\",\n      summary: \"Unverified rumor about a production freeze captured without source evidence.\",\n      provenance: {\n        sourceClass: \"subagent_trace\",\n        observedAt: addMinutes(baseRecordedAt, 1),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n      },\n      entityRefs: [\"workspace:finance\", \"incident:freeze-rumor\"],\n      tags: [demoTag, \"enterprise-demo\", \"needs-evidence\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"working-missing-provenance\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-working-awaiting-corroboration\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 6),\n      kind: \"state\",\n      summary: \"Tool output says the finance SSO certificate rotation completed successfully.\",\n      provenance: {\n        sourceClass: \"tool_output\",\n        observedAt: addMinutes(baseRecordedAt, 5),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n        sourceId: \"tool:sso-rotation-run-42\",\n        evidenceHash: \"sha256:sso-rotation-log\",\n      },\n      entityRefs: [\"finding:finance-sso-certificate-rotation-tool-output-pending\"],\n      tags: [demoTag, \"enterprise-demo\", \"sso-rotation-pending\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"working-awaiting-corroboration\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-working-corroborated\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 7),\n      kind: \"state\",\n      summary: \"Tool output says the vendor onboarding policy sync completed with anchored evidence ready for promotion.\",\n      provenance: {\n        sourceClass: \"tool_output\",\n        observedAt: addMinutes(baseRecordedAt, 6),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n        sourceId: \"tool:vendor-policy-sync-run-9\",\n        evidenceHash: \"sha256:vendor-policy-sync-log\",\n      },\n      entityRefs: [\"account:acme-industrial\", \"policy:vendor-onboarding\"],\n      tags: [demoTag, \"enterprise-demo\", \"vendor-policy\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"working-with-corroboration\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-working-corroboration\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 9),\n      kind: \"external\",\n      summary: \"Change ticket confirms the same vendor onboarding policy sync with matching artifact hash.\",\n      provenance: {\n        sourceClass: \"web_content\",\n        observedAt: addMinutes(baseRecordedAt, 7),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n        sourceId: \"https://tickets.example.com/changes/CHG-4821\",\n        evidenceHash: \"sha256:sso-rotation-ticket-proof\",\n      },\n      entityRefs: [\"account:acme-industrial\", \"policy:vendor-onboarding\"],\n      tags: [demoTag, \"enterprise-demo\", \"vendor-policy\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"independent-corroboration\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-enterprise-buyer-v1-trusted-governance-rule\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 13),\n      kind: \"memory\",\n      summary: \"Trusted promotion requires a ticket id and artifact hash before shared recall can use operator actions.\",\n      provenance: {\n        sourceClass: \"manual\",\n        observedAt: addMinutes(baseRecordedAt, 11),\n        sessionKey: \"demo:enterprise-buyer-v1\",\n        sourceId: \"review:trust-zone-policy\",\n        evidenceHash: \"sha256:trust-zone-policy\",\n      },\n      promotedFromZone: \"working\",\n      entityRefs: [\"policy:trust-zone-promotion\"],\n      tags: [demoTag, \"enterprise-demo\", \"operator-policy\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-policy\",\n      },\n    },\n  ];\n}\n\nfunction buildAgenticCommerceTrustZoneDemoRecords(baseRecordedAt: string, scenario: TrustZoneDemoScenario): TrustZoneRecord[] {\n  const demoTag = \"trust-zone-demo\";\n  const commerceTag = \"commerce-demo\";\n  const commonMetadata = {\n    demoScenario: scenario,\n    demoSeed: \"true\",\n    category: \"user-aware-commerce\",\n  };\n  const seedRunId = buildTrustZoneDemoSeedRunId(baseRecordedAt);\n  return [\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-quarantine-catalog-rainshell\", seedRunId),\n      zone: \"quarantine\",\n      recordedAt: addMinutes(baseRecordedAt, 0),\n      kind: \"external\",\n      summary: \"Merchant catalog candidate: ArcTrail rain shell, price $148, recycled nylon, medium regular fit, two-day shipping eligible.\",\n      provenance: {\n        sourceClass: \"web_content\",\n        observedAt: addMinutes(baseRecordedAt, -3),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"acp-catalog:merchant.example/products/arctrail-rain-shell\",\n        evidenceHash: \"sha256:acp-catalog-arctrail-rain-shell\",\n      },\n      entityRefs: [\"product:arctrail-rain-shell\", \"merchant:trailhead-outfitters\"],\n      tags: [demoTag, commerceTag, \"catalog-product\", \"rain-shell\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"catalog-candidate-before-personalization\",\n        commerceFacet: \"product_discovery\",\n        scope: \"commerce/catalog\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-trusted-brand-preferences\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 2),\n      kind: \"memory\",\n      summary: \"Buyer prefers repairable outdoor brands such as Patagonia, REI, and Arc'teryx, and avoids fast-fashion marketplaces.\",\n      provenance: {\n        sourceClass: \"user_input\",\n        observedAt: addMinutes(baseRecordedAt, 1),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"conversation:buyer-preferences\",\n        evidenceHash: \"sha256:buyer-brand-preferences\",\n      },\n      entityRefs: [\"buyer:self\", \"preference:brand\"],\n      tags: [demoTag, commerceTag, \"brand-preference\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-brand-preferences\",\n        commerceFacet: \"brand_preferences\",\n        scope: \"personal/commerce\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-trusted-size-fit\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 4),\n      kind: \"memory\",\n      summary: \"Buyer wears medium tops, 32x32 pants, and prefers relaxed fit with an easy return window.\",\n      provenance: {\n        sourceClass: \"user_input\",\n        observedAt: addMinutes(baseRecordedAt, 3),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"conversation:size-fit\",\n        evidenceHash: \"sha256:buyer-size-fit\",\n      },\n      entityRefs: [\"buyer:self\", \"preference:size-fit\"],\n      tags: [demoTag, commerceTag, \"size-fit\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-size-fit\",\n        commerceFacet: \"size_fit\",\n        scope: \"personal/commerce\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-trusted-budget\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 6),\n      kind: \"memory\",\n      summary: \"Routine apparel recommendations should stay under $180, and any checkout above $75 requires an explicit ask before purchase.\",\n      provenance: {\n        sourceClass: \"manual\",\n        observedAt: addMinutes(baseRecordedAt, 5),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"review:buyer-commerce-rules\",\n        evidenceHash: \"sha256:buyer-budget-thresholds\",\n      },\n      entityRefs: [\"buyer:self\", \"rule:ask-before-checkout\", \"constraint:budget\"],\n      tags: [demoTag, commerceTag, \"budget-threshold\", \"ask-before-checkout\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-budget-and-ask-before-checkout\",\n        commerceFacet: \"budget_thresholds\",\n        askBefore: \"checkout-over-75\",\n        scope: \"personal/commerce\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-trusted-exclusions\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 8),\n      kind: \"memory\",\n      summary: \"Never suggest leather goods, fragrances, or final-sale shoes for this buyer.\",\n      provenance: {\n        sourceClass: \"user_input\",\n        observedAt: addMinutes(baseRecordedAt, 7),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"conversation:excluded-products\",\n        evidenceHash: \"sha256:buyer-exclusions\",\n      },\n      entityRefs: [\"buyer:self\", \"rule:never-suggest\", \"constraint:excluded-products\"],\n      tags: [demoTag, commerceTag, \"excluded-products\", \"never-suggest\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-excluded-products\",\n        commerceFacet: \"excluded_products\",\n        neverSuggest: \"leather,fragrance,final-sale-shoes\",\n        scope: \"personal/commerce\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-working-shipping-estimate\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 10),\n      kind: \"state\",\n      summary: \"Shipping estimator says the weekend-trip gift can arrive before Friday with two-day delivery.\",\n      provenance: {\n        sourceClass: \"tool_output\",\n        observedAt: addMinutes(baseRecordedAt, 9),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"tool:shipping-estimate-run-17\",\n        evidenceHash: \"sha256:shipping-estimate-weekend-trip\",\n      },\n      entityRefs: [\"purchase:weekend-trip-gift\", \"constraint:shipping-urgency\"],\n      tags: [demoTag, commerceTag, \"shipping-urgency\", \"gift-purchase\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"working-shipping-urgency\",\n        commerceFacet: \"shipping_urgency\",\n        scope: \"commerce/session\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-working-shipping-corroboration\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 12),\n      kind: \"external\",\n      summary: \"Merchant shipping policy independently confirms two-day delivery cutoff for the same weekend-trip gift window.\",\n      provenance: {\n        sourceClass: \"web_content\",\n        observedAt: addMinutes(baseRecordedAt, 11),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"https://merchant.example/shipping/two-day-cutoff\",\n        evidenceHash: \"sha256:merchant-two-day-cutoff\",\n      },\n      entityRefs: [\"purchase:weekend-trip-gift\", \"constraint:shipping-urgency\"],\n      tags: [demoTag, commerceTag, \"shipping-urgency\", \"gift-purchase\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"working-shipping-corroboration\",\n        commerceFacet: \"shipping_urgency\",\n        scope: \"commerce/session\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-working-blocked-upsell\", seedRunId),\n      zone: \"working\",\n      recordedAt: addMinutes(baseRecordedAt, 14),\n      kind: \"external\",\n      summary: \"Unverified influencer note claims the buyer wants luxury watch gifts over $500.\",\n      provenance: {\n        sourceClass: \"subagent_trace\",\n        observedAt: addMinutes(baseRecordedAt, 13),\n        sessionKey: \"demo:agentic-commerce-v1\",\n      },\n      entityRefs: [\"buyer:self\", \"risk:upsell\"],\n      tags: [demoTag, commerceTag, \"blocked-upsell\", \"needs-evidence\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"commerce-blocked-unverified-upsell\",\n        commerceFacet: \"risk_tolerance\",\n        scope: \"commerce/session\",\n      },\n    },\n    {\n      schemaVersion: 1,\n      recordId: buildTrustZoneDemoRecordId(\"tz-demo-agentic-commerce-v1-trusted-checkout-boundary\", seedRunId),\n      zone: \"trusted\",\n      recordedAt: addMinutes(baseRecordedAt, 16),\n      kind: \"memory\",\n      summary: \"The agent may recommend products and draft a cart, but must ask before checkout, subscription enrollment, or irreversible purchase actions.\",\n      provenance: {\n        sourceClass: \"manual\",\n        observedAt: addMinutes(baseRecordedAt, 15),\n        sessionKey: \"demo:agentic-commerce-v1\",\n        sourceId: \"review:commerce-action-boundaries\",\n        evidenceHash: \"sha256:commerce-action-boundaries\",\n      },\n      entityRefs: [\"buyer:self\", \"rule:ask-before-checkout\", \"policy:action-confidence\"],\n      tags: [demoTag, commerceTag, \"ask-before-checkout\", \"action-confidence\"],\n      metadata: {\n        ...commonMetadata,\n        story: \"trusted-checkout-boundary\",\n        commerceFacet: \"ask_before_checkout\",\n        riskTolerance: \"low-for-irreversible-purchase-actions\",\n        scope: \"personal/commerce\",\n      },\n    },\n  ];\n}\n\nfunction buildTrustZoneDemoRecords(baseRecordedAt: string, scenario: TrustZoneDemoScenario): TrustZoneRecord[] {\n  switch (scenario) {\n    case \"enterprise-buyer-v1\":\n      return buildEnterpriseBuyerTrustZoneDemoRecords(baseRecordedAt, scenario);\n    case \"agentic-commerce-v1\":\n      return buildAgenticCommerceTrustZoneDemoRecords(baseRecordedAt, scenario);\n  }\n}\n\nexport async function seedTrustZoneDemoDataset(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  enabled: boolean;\n  scenario?: string;\n  recordedAt?: string;\n  dryRun?: boolean;\n}): Promise<TrustZoneDemoSeedResult> {\n  if (options.enabled !== true) {\n    throw new Error(\"trust zone demo seed requires trustZonesEnabled=true\");\n  }\n\n  const scenario = parseTrustZoneDemoScenario(options.scenario);\n\n  const baseRecordedAt = assertIsoRecordedAt(options.recordedAt ?? new Date().toISOString(), \"recordedAt\");\n  if (!Number.isFinite(Date.parse(baseRecordedAt))) {\n    throw new Error(\"recordedAt must be a valid ISO timestamp\");\n  }\n  const records = buildTrustZoneDemoRecords(baseRecordedAt, scenario);\n  if (options.dryRun === true) {\n    return {\n      scenario,\n      dryRun: true,\n      recordsWritten: 0,\n      records,\n      filePaths: [],\n    };\n  }\n\n  const filePaths: string[] = [];\n  for (const record of records) {\n    filePaths.push(await recordTrustZoneRecord({\n      memoryDir: options.memoryDir,\n      trustZoneStoreDir: options.trustZoneStoreDir,\n      record,\n    }));\n  }\n\n  return {\n    scenario,\n    dryRun: false,\n    recordsWritten: filePaths.length,\n    records,\n    filePaths,\n  };\n}\n\nexport async function getTrustZoneStoreStatus(options: {\n  memoryDir: string;\n  trustZoneStoreDir?: string;\n  enabled: boolean;\n  promotionEnabled: boolean;\n  poisoningDefenseEnabled: boolean;\n}): Promise<TrustZoneStoreStatus> {\n  const rootDir = resolveTrustZoneStoreDir(options.memoryDir, options.trustZoneStoreDir);\n  const zonesDir = path.join(rootDir, \"zones\");\n  const { files, entries, invalidRecords } = await readTrustZoneRecordEntries(options);\n  const records = entries.map((entry) => entry.record);\n  records.sort((a, b) => b.recordedAt.localeCompare(a.recordedAt));\n\n  const byZone: Partial<Record<TrustZoneName, number>> = {};\n  const byKind: Partial<Record<TrustZoneRecordKind, number>> = {};\n  const byTrustBand: Partial<Record<TrustZoneScoreBand, number>> = {};\n  let trustScoreTotal = 0;\n  for (const record of records) {\n    byZone[record.zone] = (byZone[record.zone] ?? 0) + 1;\n    byKind[record.kind] = (byKind[record.kind] ?? 0) + 1;\n    if (options.poisoningDefenseEnabled === true) {\n      const score = scoreTrustZoneProvenance(record);\n      byTrustBand[score.band] = (byTrustBand[score.band] ?? 0) + 1;\n      trustScoreTotal += score.total;\n    }\n  }\n\n  const averageTrustScore =\n    options.poisoningDefenseEnabled === true && records.length > 0\n      ? roundTrustScore(trustScoreTotal / records.length)\n      : undefined;\n  const latestRecordTrustScore =\n    options.poisoningDefenseEnabled === true && records[0] ? scoreTrustZoneProvenance(records[0]) : undefined;\n\n  return {\n    enabled: options.enabled,\n    promotionEnabled: options.promotionEnabled,\n    poisoningDefenseEnabled: options.poisoningDefenseEnabled,\n    rootDir,\n    zonesDir,\n    records: {\n      total: files.length,\n      valid: records.length,\n      invalid: invalidRecords.length,\n      byZone,\n      byKind,\n      latestRecordId: records[0]?.recordId,\n      latestRecordedAt: records[0]?.recordedAt,\n      latestZone: records[0]?.zone,\n      averageTrustScore,\n      byTrustBand: options.poisoningDefenseEnabled === true ? byTrustBand : undefined,\n    },\n    latestRecord: records[0],\n    latestRecordTrustScore,\n    invalidRecords,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,iBAAiB;AAwB1B,SAAS,gBAAgB,OAAuC;AACrE,SAAO,UAAU,gBAAgB,UAAU,aAAa,UAAU;AACpE;AA2HA,IAAM,4BAAqD;AAAA,EACzD;AAAA,EACA;AACF;AAEA,SAAS,iBAAiB,KAAkD;AAC1E,SAAO,qBAAqB,KAAK,UAAU;AAC7C;AAEA,SAAS,aAAa,KAAc,OAA8B;AAChE,QAAM,QAAQ,aAAa,KAAK,KAAK;AACrC,MAAI,CAAC,CAAC,cAAc,WAAW,SAAS,EAAE,SAAS,KAAK,GAAG;AACzD,UAAM,IAAI,MAAM,GAAG,KAAK,4CAA4C;AAAA,EACtE;AACA,SAAO;AACT;AAEA,SAAS,aAAa,KAAmC;AACvD,QAAM,QAAQ,aAAa,KAAK,MAAM;AACtC,MAAI,CAAC,CAAC,UAAU,YAAY,SAAS,cAAc,UAAU,EAAE,SAAS,KAAK,GAAG;AAC9E,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,KAAmC;AAC7D,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,8BAA8B;AAClE,QAAM,cAAc,aAAa,IAAI,aAAa,wBAAwB;AAC1E,MAAI,CAAC,CAAC,eAAe,eAAe,kBAAkB,iBAAiB,cAAc,QAAQ,EAAE,SAAS,WAAW,GAAG;AACpH,UAAM,IAAI,MAAM,8GAA8G;AAAA,EAChI;AACA,SAAO;AAAA,IACL;AAAA,IACA,YAAY,oBAAoB,aAAa,IAAI,YAAY,uBAAuB,GAAG,uBAAuB;AAAA,IAC9G,YAAY,eAAe,IAAI,UAAU;AAAA,IACzC,UAAU,eAAe,IAAI,QAAQ;AAAA,IACrC,cAAc,eAAe,IAAI,YAAY;AAAA,EAC/C;AACF;AAEO,SAAS,yBAAyB,WAAmB,aAA8B;AACxF,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AACpE,WAAO,YAAY,KAAK;AAAA,EAC1B;AACA,SAAO,KAAK,KAAK,WAAW,SAAS,aAAa;AACpD;AAEO,SAAS,wBAAwB,KAA+B;AACrE,MAAI,CAAC,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,qCAAqC;AACzE,MAAI,IAAI,kBAAkB,EAAG,OAAM,IAAI,MAAM,yBAAyB;AAEtE,SAAO;AAAA,IACL,eAAe;AAAA,IACf,UAAU,sBAAsB,aAAa,IAAI,UAAU,UAAU,GAAG,UAAU;AAAA,IAClF,MAAM,aAAa,IAAI,MAAM,MAAM;AAAA,IACnC,YAAY,oBAAoB,aAAa,IAAI,YAAY,YAAY,CAAC;AAAA,IAC1E,MAAM,aAAa,IAAI,IAAI;AAAA,IAC3B,SAAS,aAAa,IAAI,SAAS,SAAS;AAAA,IAC5C,YAAY,mBAAmB,IAAI,UAAU;AAAA,IAC7C,kBAAkB,IAAI,qBAAqB,SAAY,SAAY,aAAa,IAAI,kBAAkB,kBAAkB;AAAA,IACxH,YAAY,oBAAoB,IAAI,YAAY,YAAY;AAAA,IAC5D,MAAM,oBAAoB,IAAI,MAAM,MAAM;AAAA,IAC1C,UAAU,iBAAiB,IAAI,QAAQ;AAAA,EACzC;AACF;AAEA,eAAsB,sBAAsB,SAIxB;AAClB,QAAM,UAAU,yBAAyB,QAAQ,WAAW,QAAQ,iBAAiB;AACrF,QAAM,YAAY,wBAAwB,QAAQ,MAAM;AACxD,QAAM,MAAM,eAAe,UAAU,UAAU;AAC/C,QAAM,UAAU,KAAK,KAAK,SAAS,SAAS,UAAU,MAAM,GAAG;AAC/D,QAAM,WAAW,KAAK,KAAK,SAAS,GAAG,UAAU,QAAQ,OAAO;AAChE,QAAM,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;AACxC,QAAM,UAAU,UAAU,KAAK,UAAU,WAAW,MAAM,CAAC,GAAG,MAAM;AACpE,SAAO;AACT;AAEA,SAAS,sBAAsB,QAAkC;AAC/D,SAAO,QAAQ,OAAO,WAAW,YAAY,OAAO,WAAW,YAAY;AAC7E;AAEA,SAAS,uBAAuB,gBAAwB,YAA2B,YAA4B;AAC7G,QAAM,SAAS,WAAW,QAAQ,WAAW,EAAE,EAAE,MAAM,GAAG,EAAE;AAC5D,SAAO,GAAG,cAAc,IAAI,UAAU,IAAI,MAAM;AAClD;AAEA,SAAS,cAAc,QAAyD;AAC9E,QAAM,MAAM,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AACnG,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACzB;AAEA,SAAS,WAAW,MAA4B,OAAsC;AACpF,MAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,WAAW,KAAK,MAAM,WAAW,EAAG,QAAO;AACvE,QAAM,WAAW,IAAI,IAAI,KAAK;AAC9B,SAAO,KAAK,KAAK,CAAC,UAAU,SAAS,IAAI,KAAK,CAAC;AACjD;AAEA,SAAS,kBAAkB,QAA+C;AACxE,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,WAAW,EAAG,QAAO;AACrD,QAAM,WAAW,OAAO,KAAK,OAAO,CAAC,QAAQ,QAAQ,qBAAqB,QAAQ,qBAAqB,QAAQ,eAAe;AAC9H,SAAO,SAAS,SAAS,IAAI,WAAW;AAC1C;AAEA,SAAS,sBAAsB,QAAyB,YAA2B,yBAA2C;AAC5H,SACE,4BAA4B,QACzB,eAAe,aACf,OAAO,SAAS,aAChB,CAAC,eAAe,eAAe,gBAAgB,EAAE,SAAS,OAAO,WAAW,WAAW;AAE9F;AAEA,SAAS,uBAAuB,SAGE;AAChC,QAAM,gBAAgB,QAAQ,QAAQ,OAAO,CAAC,cAAc;AAC1D,QAAI,UAAU,aAAa,QAAQ,aAAa,SAAU,QAAO;AACjE,QAAI,UAAU,SAAS,aAAc,QAAO;AAC5C,QAAI,sBAAsB,SAAS,MAAM,KAAM,QAAO;AACtD,QAAI,UAAU,WAAW,gBAAgB,QAAQ,aAAa,WAAW,YAAa,QAAO;AAC7F,WACE,WAAW,UAAU,YAAY,QAAQ,aAAa,UAAU,KAC7D,WAAW,kBAAkB,SAAS,GAAG,kBAAkB,QAAQ,YAAY,CAAC;AAAA,EAEvF,CAAC;AAED,SAAO;AAAA,IACL,OAAO,cAAc;AAAA,IACrB,eAAe,CAAC,GAAG,IAAI,IAAI,cAAc,IAAI,CAAC,WAAW,OAAO,WAAW,WAAW,CAAC,CAAC;AAAA,EAC1F;AACF;AAEA,IAAM,uBAA6D;AAAA,EACjE,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,aAAa;AACf;AAEA,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,KAAK,MAAM,QAAQ,GAAI,IAAI;AACpC;AAEA,SAAS,eAAe,OAAmC;AACzD,MAAI,SAAS,IAAK,QAAO;AACzB,MAAI,SAAS,IAAK,QAAO;AACzB,SAAO;AACT;AAEO,SAAS,yBAAyB,QAAmD;AAC1F,QAAM,oBAAoB,qBAAqB,OAAO,WAAW,WAAW;AAC5E,QAAM,gBAAgB,OAAO,OAAO,WAAW,aAAa,WAAW,MAAM;AAC7E,QAAM,oBAAoB,OAAO,OAAO,WAAW,iBAAiB,WAAW,MAAM;AACrF,QAAM,kBAAkB,OAAO,OAAO,WAAW,eAAe,WAAW,OAAO;AAClF,QAAM,QAAQ;AAAA,IACZ,KAAK,IAAI,GAAG,oBAAoB,gBAAgB,oBAAoB,eAAe;AAAA,EACrF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,eAAe,KAAK;AAAA,IAC1B,UAAU,sBAAsB,MAAM;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,uBAAuB,SAGZ;AACzB,QAAM,EAAE,QAAQ,WAAW,IAAI;AAC/B,QAAM,UAAoB,CAAC;AAC3B,QAAM,qBAAqB,sBAAsB,MAAM;AAEvD,MAAI,OAAO,SAAS,YAAY;AAC9B,YAAQ,KAAK,4BAA4B,UAAU,OAAO;AAAA,EAC5D;AACA,MAAI,OAAO,SAAS,WAAW;AAC7B,YAAQ,KAAK,2DAA2D;AAAA,EAC1E;AACA,MAAI,OAAO,SAAS,gBAAgB,eAAe,WAAW;AAC5D,YAAQ,KAAK,uEAAuE;AAAA,EACtF;AACA,MAAI,OAAO,SAAS,aAAa,eAAe,cAAc;AAC5D,YAAQ,KAAK,+EAA+E;AAAA,EAC9F;AACA,MAAI,OAAO,SAAS,gBAAgB,eAAe,WAAW;AAC5D,YAAQ,KAAK,qDAAqD;AAAA,EACpE;AACA,MAAI,OAAO,SAAS,aAAa,eAAe,WAAW;AACzD,YAAQ,KAAK,kDAAkD;AAAA,EACjE;AACA,MACE,eAAe,aACf,CAAC,eAAe,eAAe,gBAAgB,EAAE,SAAS,OAAO,WAAW,WAAW,KACvF,uBAAuB,MACvB;AACA,YAAQ,KAAK,sHAAsH;AAAA,EACrI;AAEA,SAAO;AAAA,IACL,SAAS,QAAQ,WAAW;AAAA,IAC5B;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,wBAAwB,SAIH;AAClC,QAAM,EAAE,QAAQ,IAAI,MAAM,2BAA2B,OAAO;AAC5D,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,WAAW,cAAc,EAAE,OAAO,UAAU,CAAC;AAC7E,SAAO,QAAQ,KAAK,CAAC,UAAU,MAAM,OAAO,aAAa,QAAQ,QAAQ,GAAG,UAAU;AACxF;AAEA,eAAsB,uBAAuB,SAYP;AACpC,MAAI,QAAQ,YAAY,MAAM;AAC5B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,MAAI,QAAQ,qBAAqB,MAAM;AACrC,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,QAAM,eAAe,MAAM,wBAAwB;AAAA,IACjD,WAAW,QAAQ;AAAA,IACnB,mBAAmB,QAAQ;AAAA,IAC3B,UAAU,sBAAsB,aAAa,QAAQ,gBAAgB,gBAAgB,GAAG,gBAAgB;AAAA,EAC1G,CAAC;AACD,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,uCAAuC,QAAQ,cAAc,EAAE;AAAA,EACjF;AAEA,QAAM,OAAO,uBAAuB;AAAA,IAClC,QAAQ;AAAA,IACR,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,KAAK,SAAS;AACjB,UAAM,IAAI,MAAM,gCAAgC,KAAK,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EAC3E;AAEA,QAAM,gBAAgB,sBAAsB,cAAc,QAAQ,YAAY,QAAQ,4BAA4B,IAAI,IAClH,uBAAuB;AAAA,IACrB;AAAA,IACA,UAAU,MAAM,2BAA2B;AAAA,MACzC,WAAW,QAAQ;AAAA,MACnB,mBAAmB,QAAQ;AAAA,IAC7B,CAAC,GAAG,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM;AAAA,EACzC,CAAC,IACD;AAEJ,MAAI,iBAAiB,cAAc,UAAU,GAAG;AAC9C,UAAM,IAAI,MAAM,qFAAqF;AAAA,EACvG;AAEA,QAAM,aAAa,oBAAoB,aAAa,QAAQ,YAAY,YAAY,CAAC;AACrF,QAAM,kBAAkB,aAAa,QAAQ,iBAAiB,iBAAiB;AAC/E,QAAM,aAA8B;AAAA,IAClC,eAAe;AAAA,IACf,UAAU,uBAAuB,aAAa,UAAU,QAAQ,YAAY,UAAU;AAAA,IACtF,MAAM,QAAQ;AAAA,IACd;AAAA,IACA,MAAM,aAAa;AAAA,IACnB,SAAS,eAAe,QAAQ,OAAO,KAAK,aAAa;AAAA,IACzD,YAAY,aAAa;AAAA,IACzB,kBAAkB,aAAa;AAAA,IAC/B,YAAY,aAAa;AAAA,IACzB,MAAM,cAAc,CAAC,GAAI,aAAa,QAAQ,CAAC,GAAI,WAAW,CAAC;AAAA,IAC/D,UAAU;AAAA,MACR,GAAI,aAAa,YAAY,CAAC;AAAA,MAC9B,gBAAgB,aAAa;AAAA,MAC7B;AAAA,MACA,GAAI,gBACA;AAAA,QACE,cAAc;AAAA,QACd,oBAAoB,OAAO,cAAc,KAAK;AAAA,QAC9C,sBAAsB,cAAc,cAAc,KAAK,GAAG;AAAA,MAC5D,IACA,CAAC;AAAA,IACP;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,MAAM;AAC3B,WAAO;AAAA,MACL;AAAA,MACA,aAAa;AAAA,MACb,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,sBAAsB;AAAA,IAC3C,WAAW,QAAQ;AAAA,IACnB,mBAAmB,QAAQ;AAAA,IAC3B,QAAQ;AAAA,EACV,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,2BAA2B,SAOvC;AACD,QAAM,UAAU,yBAAyB,QAAQ,WAAW,QAAQ,iBAAiB;AACrF,QAAM,QAAQ,MAAM,cAAc,KAAK,KAAK,SAAS,OAAO,CAAC;AAC7D,QAAM,UAAkC,CAAC;AACzC,QAAM,iBAAyD,CAAC;AAChE,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,cAAQ,KAAK;AAAA,QACX;AAAA,QACA,QAAQ,wBAAwB,MAAM,aAAa,QAAQ,CAAC;AAAA,MAC9D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,qBAAe,KAAK;AAAA,QAClB,MAAM;AAAA,QACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AACA,SAAO,EAAE,OAAO,SAAS,eAAe;AAC1C;AAEA,SAAS,4BACP,QACA,aAC4C;AAC5C,QAAM,iBAAoF;AAAA,IACxF,CAAC,WAAW,OAAO,SAAS,CAAC;AAAA,IAC7B,CAAC,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvB,CAAC,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvB,CAAC,eAAe,OAAO,WAAW,aAAa,CAAC;AAAA,IAChD,CAAC,cAAc,OAAO,YAAY,KAAK,GAAG,GAAG,CAAC;AAAA,IAC9C,CAAC,QAAQ,OAAO,MAAM,KAAK,GAAG,GAAG,CAAC;AAAA,IAClC,CAAC,YAAY,OAAO,WAAW,OAAO,OAAO,OAAO,QAAQ,EAAE,KAAK,GAAG,IAAI,QAAW,CAAC;AAAA,EACxF;AAEA,MAAI,QAAQ;AACZ,QAAM,gBAA0B,CAAC;AACjC,aAAW,CAAC,OAAO,OAAO,MAAM,KAAK,gBAAgB;AACnD,UAAM,UAAU,wBAAwB,aAAa,OAAO,CAAC,MAAM,CAAC;AACpE,QAAI,UAAU,EAAG,eAAc,KAAK,KAAK;AACzC,aAAS,UAAU;AAAA,EACrB;AACA,SAAO,EAAE,OAAO,cAAc;AAChC;AAEA,SAAS,aAAa,MAA6B;AACjD,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,EACX;AACF;AAEA,SAAS,qBACP,QACA,cACA,YACQ;AACR,MAAI,QAAQ;AACZ,WAAS,aAAa,OAAO,IAAI;AACjC,MAAI,cAAc,OAAO,WAAW,eAAe,WAAY,UAAS;AAExE,QAAM,eAAe,KAAK,MAAM,OAAO,UAAU;AACjD,MAAI,OAAO,SAAS,YAAY,GAAG;AACjC,UAAM,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,gBAAgB,IAAS;AACpE,aAAS,KAAK,IAAI;AAAA,EACpB;AACA,SAAO;AACT;AAEA,eAAsB,uBAAuB,SAMR;AACnC,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,UAAU,CAAC;AAC7D,MAAI,eAAe,EAAG,QAAO,CAAC;AAE9B,QAAM,EAAE,QAAQ,IAAI,MAAM,2BAA2B,OAAO;AAC5D,QAAM,UAAU,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM;AACnD,QAAM,aAAa,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,YAAY;AAC1E,MAAI,WAAW,WAAW,EAAG,QAAO,CAAC;AAErC,QAAM,cAAc,IAAI,IAAI,sBAAsB,QAAQ,OAAO,CAAC,MAAM,CAAC,CAAC;AAC1E,MAAI,YAAY,SAAS,EAAG,QAAO,CAAC;AAEpC,QAAM,SAAS,WAAW,IAAI,CAAC,WAAW;AACxC,UAAM,UAAU,4BAA4B,QAAQ,WAAW;AAC/D,WAAO;AAAA,MACL;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,cAAc,QAAQ;AAAA,MACtB,OAAO,qBAAqB,QAAQ,QAAQ,OAAO,QAAQ,UAAU;AAAA,IACvE;AAAA,EACF,CAAC;AAED,QAAM,WAAW,OAAO,OAAO,CAAC,WAAW,OAAO,eAAe,CAAC;AAClE,WAAS,KAAK,CAAC,MAAM,UAAU;AAC7B,QAAI,MAAM,UAAU,KAAK,MAAO,QAAO,MAAM,QAAQ,KAAK;AAC1D,WAAO,MAAM,OAAO,WAAW,cAAc,KAAK,OAAO,UAAU;AAAA,EACrE,CAAC;AAED,SAAO,SAAS,MAAM,GAAG,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,OAAO,cAAc,OAAO;AAAA,IAC9E;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE;AACJ;AAEA,eAAsB,qBAAqB,SASV;AAC/B,QAAM,QAAQ,OAAO,SAAS,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,QAAQ,SAAS,EAAE,CAAC,CAAC,IAAI;AAC7G,QAAM,SAAS,OAAO,SAAS,QAAQ,MAAM,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,UAAU,CAAC,CAAC,IAAI;AAChG,QAAM,aAAa,QAAQ,MAAM,KAAK;AACtC,QAAM,aAAa,QAAQ,MAAM,KAAK;AACtC,QAAM,oBAAoB,QAAQ,aAAa,KAAK;AACpD,QAAM,cAAc,IAAI,IAAI,sBAAsB,QAAQ,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC;AAEhF,QAAM,EAAE,QAAQ,IAAI,MAAM,2BAA2B,OAAO;AAC5D,QAAM,WAAW,QACd,OAAO,CAAC,UAAU,CAAC,cAAc,MAAM,OAAO,SAAS,UAAU,EACjE,OAAO,CAAC,UAAU,CAAC,cAAc,MAAM,OAAO,SAAS,UAAU,EACjE,OAAO,CAAC,UAAU,CAAC,qBAAqB,MAAM,OAAO,WAAW,gBAAgB,iBAAiB,EACjG,IAAI,CAAC,WAAW;AAAA,IACf;AAAA,IACA,SAAS,YAAY,OAAO,IAAI,4BAA4B,MAAM,QAAQ,WAAW,IAAI;AAAA,EAC3F,EAAE,EACD,OAAO,CAAC,cAAc,YAAY,SAAS,MAAM,UAAU,SAAS,SAAS,KAAK,CAAC;AAEtF,WAAS,KAAK,CAAC,MAAM,UAAU;AAC7B,UAAM,YAAY,KAAK,SAAS,SAAS;AACzC,UAAM,aAAa,MAAM,SAAS,SAAS;AAC3C,QAAI,eAAe,UAAW,QAAO,aAAa;AAClD,WAAO,MAAM,MAAM,OAAO,WAAW,cAAc,KAAK,MAAM,OAAO,UAAU;AAAA,EACjF,CAAC;AAED,SAAO;AAAA,IACL,OAAO,SAAS;AAAA,IAChB,OAAO,SAAS,MAAM,QAAQ,SAAS,KAAK,EAAE;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,SAAS,SAAS,MAAM,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC,cAAc,UAAU,KAAK;AAAA,IAClF,YAAY,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM;AAAA,EACjD;AACF;AAEO,SAAS,qCAAqC,SAIrB;AAC9B,MAAI,QAAQ,OAAO,SAAS,WAAW;AACrC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,CAAC,oEAAoE;AAAA,MAC9E,uBAAuB;AAAA,MACvB,oBAAoB;AAAA,MACpB,4BAA4B,CAAC;AAAA,IAC/B;AAAA,EACF;AAEA,QAAM,iBAAgC,QAAQ,OAAO,SAAS,eAAe,YAAY;AACzF,QAAM,OAAO,uBAAuB;AAAA,IAClC,QAAQ,QAAQ;AAAA,IAChB,YAAY;AAAA,EACd,CAAC;AACD,QAAM,WAAW,sBAAsB,QAAQ,QAAQ,gBAAgB,QAAQ,uBAAuB;AACtG,QAAM,gBAAgB,WAClB,uBAAuB;AAAA,IACrB,cAAc,QAAQ;AAAA,IACtB,SAAS,QAAQ;AAAA,EACnB,CAAC,IACD,EAAE,OAAO,GAAG,eAAe,CAAC,EAAE;AAElC,QAAM,UAAU,CAAC,GAAG,KAAK,OAAO;AAChC,MAAI,YAAY,cAAc,UAAU,GAAG;AACzC,YAAQ,KAAK,oFAAoF;AAAA,EACnG;AAEA,SAAO;AAAA,IACL;AAAA,IACA,SAAS,KAAK,YAAY,CAAC,YAAY,cAAc,QAAQ;AAAA,IAC7D;AAAA,IACA,uBAAuB;AAAA,IACvB,oBAAoB,cAAc;AAAA,IAClC,4BAA4B,cAAc;AAAA,EAC5C;AACF;AAEA,SAAS,WAAW,SAAiB,SAAyB;AAC5D,QAAM,SAAS,KAAK,MAAM,OAAO;AACjC,MAAI,CAAC,OAAO,SAAS,MAAM,GAAG;AAC5B,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,SAAO,IAAI,KAAK,SAAS,UAAU,GAAM,EAAE,YAAY;AACzD;AAEA,SAAS,4BAA4B,gBAAgC;AACnE,SAAO,eAAe,QAAQ,WAAW,EAAE;AAC7C;AAEA,SAAS,2BAA2B,QAAgB,WAA2B;AAC7E,SAAO,GAAG,MAAM,IAAI,SAAS;AAC/B;AAEA,SAAS,2BAA2B,KAAgD;AAClF,QAAM,YAAY,OAAO,uBAAuB,KAAK;AACrD,MAAI,CAAC,0BAA0B,SAAS,QAAiC,GAAG;AAC1E,UAAM,IAAI,MAAM,yCAAyC,QAAQ,EAAE;AAAA,EACrE;AACA,SAAO;AACT;AAEA,SAAS,yCAAyC,gBAAwB,UAAoD;AAC5H,QAAM,UAAU;AAChB,QAAM,iBAAiB;AAAA,IACrB,cAAc;AAAA,IACd,UAAU;AAAA,EACZ;AACA,QAAM,YAAY,4BAA4B,cAAc;AAC5D,SAAO;AAAA,IACL;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,gDAAgD,SAAS;AAAA,MAC9F,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,2BAA2B,0BAA0B;AAAA,MAClE,MAAM,CAAC,SAAS,mBAAmB,eAAe;AAAA,MAClD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,+CAA+C,SAAS;AAAA,MAC7F,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,MACd;AAAA,MACA,YAAY,CAAC,qBAAqB,uBAAuB;AAAA,MACzD,MAAM,CAAC,SAAS,mBAAmB,gBAAgB;AAAA,MACnD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,8DAA8D,SAAS;AAAA,MAC5G,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,8DAA8D;AAAA,MAC3E,MAAM,CAAC,SAAS,mBAAmB,sBAAsB;AAAA,MACzD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,oDAAoD,SAAS;AAAA,MAClG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,2BAA2B,0BAA0B;AAAA,MAClE,MAAM,CAAC,SAAS,mBAAmB,eAAe;AAAA,MAClD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,qDAAqD,SAAS;AAAA,MACnG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,2BAA2B,0BAA0B;AAAA,MAClE,MAAM,CAAC,SAAS,mBAAmB,eAAe;AAAA,MAClD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,uDAAuD,SAAS;AAAA,MACrG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,EAAE;AAAA,MACzC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,kBAAkB;AAAA,MAClB,YAAY,CAAC,6BAA6B;AAAA,MAC1C,MAAM,CAAC,SAAS,mBAAmB,iBAAiB;AAAA,MACpD,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,yCAAyC,gBAAwB,UAAoD;AAC5H,QAAM,UAAU;AAChB,QAAM,cAAc;AACpB,QAAM,iBAAiB;AAAA,IACrB,cAAc;AAAA,IACd,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACA,QAAM,YAAY,4BAA4B,cAAc;AAC5D,SAAO;AAAA,IACL;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,4DAA4D,SAAS;AAAA,MAC1G,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,+BAA+B,+BAA+B;AAAA,MAC3E,MAAM,CAAC,SAAS,aAAa,mBAAmB,YAAY;AAAA,MAC5D,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,yDAAyD,SAAS;AAAA,MACvG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,cAAc,kBAAkB;AAAA,MAC7C,MAAM,CAAC,SAAS,aAAa,kBAAkB;AAAA,MAC/C,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,gDAAgD,SAAS;AAAA,MAC9F,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,cAAc,qBAAqB;AAAA,MAChD,MAAM,CAAC,SAAS,aAAa,UAAU;AAAA,MACvC,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,8CAA8C,SAAS;AAAA,MAC5F,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,cAAc,4BAA4B,mBAAmB;AAAA,MAC1E,MAAM,CAAC,SAAS,aAAa,oBAAoB,qBAAqB;AAAA,MACtE,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,WAAW;AAAA,QACX,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,kDAAkD,SAAS;AAAA,MAChG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,CAAC;AAAA,MACxC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,cAAc,sBAAsB,8BAA8B;AAAA,MAC/E,MAAM,CAAC,SAAS,aAAa,qBAAqB,eAAe;AAAA,MACjE,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,cAAc;AAAA,QACd,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,yDAAyD,SAAS;AAAA,MACvG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,EAAE;AAAA,MACzC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,CAAC;AAAA,QACxC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,8BAA8B,6BAA6B;AAAA,MACxE,MAAM,CAAC,SAAS,aAAa,oBAAoB,eAAe;AAAA,MAChE,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,8DAA8D,SAAS;AAAA,MAC5G,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,EAAE;AAAA,MACzC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,8BAA8B,6BAA6B;AAAA,MACxE,MAAM,CAAC,SAAS,aAAa,oBAAoB,eAAe;AAAA,MAChE,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,sDAAsD,SAAS;AAAA,MACpG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,EAAE;AAAA,MACzC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,MACd;AAAA,MACA,YAAY,CAAC,cAAc,aAAa;AAAA,MACxC,MAAM,CAAC,SAAS,aAAa,kBAAkB,gBAAgB;AAAA,MAC/D,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA;AAAA,MACE,eAAe;AAAA,MACf,UAAU,2BAA2B,yDAAyD,SAAS;AAAA,MACvG,MAAM;AAAA,MACN,YAAY,WAAW,gBAAgB,EAAE;AAAA,MACzC,MAAM;AAAA,MACN,SAAS;AAAA,MACT,YAAY;AAAA,QACV,aAAa;AAAA,QACb,YAAY,WAAW,gBAAgB,EAAE;AAAA,QACzC,YAAY;AAAA,QACZ,UAAU;AAAA,QACV,cAAc;AAAA,MAChB;AAAA,MACA,YAAY,CAAC,cAAc,4BAA4B,0BAA0B;AAAA,MACjF,MAAM,CAAC,SAAS,aAAa,uBAAuB,mBAAmB;AAAA,MACvE,UAAU;AAAA,QACR,GAAG;AAAA,QACH,OAAO;AAAA,QACP,eAAe;AAAA,QACf,eAAe;AAAA,QACf,OAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,gBAAwB,UAAoD;AAC7G,UAAQ,UAAU;AAAA,IAChB,KAAK;AACH,aAAO,yCAAyC,gBAAgB,QAAQ;AAAA,IAC1E,KAAK;AACH,aAAO,yCAAyC,gBAAgB,QAAQ;AAAA,EAC5E;AACF;AAEA,eAAsB,yBAAyB,SAOV;AACnC,MAAI,QAAQ,YAAY,MAAM;AAC5B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,QAAM,WAAW,2BAA2B,QAAQ,QAAQ;AAE5D,QAAM,iBAAiB,oBAAoB,QAAQ,eAAc,oBAAI,KAAK,GAAE,YAAY,GAAG,YAAY;AACvG,MAAI,CAAC,OAAO,SAAS,KAAK,MAAM,cAAc,CAAC,GAAG;AAChD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AACA,QAAM,UAAU,0BAA0B,gBAAgB,QAAQ;AAClE,MAAI,QAAQ,WAAW,MAAM;AAC3B,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB;AAAA,MACA,WAAW,CAAC;AAAA,IACd;AAAA,EACF;AAEA,QAAM,YAAsB,CAAC;AAC7B,aAAW,UAAU,SAAS;AAC5B,cAAU,KAAK,MAAM,sBAAsB;AAAA,MACzC,WAAW,QAAQ;AAAA,MACnB,mBAAmB,QAAQ;AAAA,MAC3B;AAAA,IACF,CAAC,CAAC;AAAA,EACJ;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,gBAAgB,UAAU;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,wBAAwB,SAMZ;AAChC,QAAM,UAAU,yBAAyB,QAAQ,WAAW,QAAQ,iBAAiB;AACrF,QAAM,WAAW,KAAK,KAAK,SAAS,OAAO;AAC3C,QAAM,EAAE,OAAO,SAAS,eAAe,IAAI,MAAM,2BAA2B,OAAO;AACnF,QAAM,UAAU,QAAQ,IAAI,CAAC,UAAU,MAAM,MAAM;AACnD,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AAE/D,QAAM,SAAiD,CAAC;AACxD,QAAM,SAAuD,CAAC;AAC9D,QAAM,cAA2D,CAAC;AAClE,MAAI,kBAAkB;AACtB,aAAW,UAAU,SAAS;AAC5B,WAAO,OAAO,IAAI,KAAK,OAAO,OAAO,IAAI,KAAK,KAAK;AACnD,WAAO,OAAO,IAAI,KAAK,OAAO,OAAO,IAAI,KAAK,KAAK;AACnD,QAAI,QAAQ,4BAA4B,MAAM;AAC5C,YAAM,QAAQ,yBAAyB,MAAM;AAC7C,kBAAY,MAAM,IAAI,KAAK,YAAY,MAAM,IAAI,KAAK,KAAK;AAC3D,yBAAmB,MAAM;AAAA,IAC3B;AAAA,EACF;AAEA,QAAM,oBACJ,QAAQ,4BAA4B,QAAQ,QAAQ,SAAS,IACzD,gBAAgB,kBAAkB,QAAQ,MAAM,IAChD;AACN,QAAM,yBACJ,QAAQ,4BAA4B,QAAQ,QAAQ,CAAC,IAAI,yBAAyB,QAAQ,CAAC,CAAC,IAAI;AAElG,SAAO;AAAA,IACL,SAAS,QAAQ;AAAA,IACjB,kBAAkB,QAAQ;AAAA,IAC1B,yBAAyB,QAAQ;AAAA,IACjC;AAAA,IACA;AAAA,IACA,SAAS;AAAA,MACP,OAAO,MAAM;AAAA,MACb,OAAO,QAAQ;AAAA,MACf,SAAS,eAAe;AAAA,MACxB;AAAA,MACA;AAAA,MACA,gBAAgB,QAAQ,CAAC,GAAG;AAAA,MAC5B,kBAAkB,QAAQ,CAAC,GAAG;AAAA,MAC9B,YAAY,QAAQ,CAAC,GAAG;AAAA,MACxB;AAAA,MACA,aAAa,QAAQ,4BAA4B,OAAO,cAAc;AAAA,IACxE;AAAA,IACA,cAAc,QAAQ,CAAC;AAAA,IACvB;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-QQUAB63I.js

@@ -0,0 +1,63 @@
+import {
+  isSafeRouteNamespace
+} from "./chunk-U3PN77QT.js";
+import {
+  StorageManager
+} from "./chunk-7AAT6G4Q.js";
+
+// src/namespaces/storage.ts
+import path from "path";
+import { access } from "fs/promises";
+async function exists(p) {
+  try {
+    await access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var NamespaceStorageRouter = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  cache = /* @__PURE__ */ new Map();
+  defaultNsRootResolved = null;
+  async defaultNamespaceRoot() {
+    if (this.defaultNsRootResolved) return this.defaultNsRootResolved;
+    if (!this.config.namespacesEnabled) {
+      this.defaultNsRootResolved = this.config.memoryDir;
+      return this.defaultNsRootResolved;
+    }
+    const nsDir = path.join(this.config.memoryDir, "namespaces", this.config.defaultNamespace);
+    this.defaultNsRootResolved = await exists(nsDir) ? nsDir : this.config.memoryDir;
+    return this.defaultNsRootResolved;
+  }
+  namespaceRootSync(namespace) {
+    if (!this.config.namespacesEnabled) return this.config.memoryDir;
+    if (namespace === this.config.defaultNamespace) {
+      return this.defaultNsRootResolved ?? this.config.memoryDir;
+    }
+    return path.join(this.config.memoryDir, "namespaces", namespace);
+  }
+  async storageFor(namespace) {
+    const ns = namespace || this.config.defaultNamespace;
+    if (ns !== this.config.defaultNamespace && !isSafeRouteNamespace(ns)) {
+      throw new Error(`unsafe namespace: ${ns}`);
+    }
+    if (this.cache.has(ns)) return this.cache.get(ns);
+    if (ns === this.config.defaultNamespace) {
+      await this.defaultNamespaceRoot();
+    }
+    const root = this.namespaceRootSync(ns);
+    const sm = new StorageManager(root, this.config.entitySchemas);
+    sm.citationTemplate = this.config.inlineSourceAttributionFormat;
+    this.cache.set(ns, sm);
+    return sm;
+  }
+};
+
+export {
+  NamespaceStorageRouter
+};
+//# sourceMappingURL=chunk-QQUAB63I.js.map

package/dist/chunk-QQUAB63I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, non-default namespaces live under `memoryDir/namespaces/<ns>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n\n  constructor(private readonly config: PluginConfig) {}\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    if (this.defaultNsRootResolved) return this.defaultNsRootResolved;\n    if (!this.config.namespacesEnabled) {\n      this.defaultNsRootResolved = this.config.memoryDir;\n      return this.defaultNsRootResolved;\n    }\n\n    const nsDir = path.join(this.config.memoryDir, \"namespaces\", this.config.defaultNamespace);\n    this.defaultNsRootResolved = (await exists(nsDir)) ? nsDir : this.config.memoryDir;\n    return this.defaultNsRootResolved;\n  }\n\n  private namespaceRootSync(namespace: string): string {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (namespace === this.config.defaultNamespace) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return path.join(this.config.memoryDir, \"namespaces\", namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = namespace || this.config.defaultNamespace;\n    if (ns !== this.config.defaultNamespace && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    if (this.cache.has(ns)) return this.cache.get(ns)!;\n\n    if (ns === this.config.defaultNamespace) {\n      await this.defaultNamespaceRoot();\n    }\n\n    const root = this.namespaceRootSync(ns);\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    this.cache.set(ns, sm);\n    return sm;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,cAAc;AAKvB,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAaO,IAAM,yBAAN,MAA6B;AAAA,EAIlC,YAA6B,QAAsB;AAAtB;AAAA,EAAuB;AAAA,EAAvB;AAAA,EAHZ,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA,EAI/C,MAAc,uBAAwC;AACpD,QAAI,KAAK,sBAAuB,QAAO,KAAK;AAC5C,QAAI,CAAC,KAAK,OAAO,mBAAmB;AAClC,WAAK,wBAAwB,KAAK,OAAO;AACzC,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,QAAQ,KAAK,KAAK,KAAK,OAAO,WAAW,cAAc,KAAK,OAAO,gBAAgB;AACzF,SAAK,wBAAyB,MAAM,OAAO,KAAK,IAAK,QAAQ,KAAK,OAAO;AACzE,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,kBAAkB,WAA2B;AAEnD,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,cAAc,KAAK,OAAO,kBAAkB;AAC9C,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,KAAK,KAAK,KAAK,OAAO,WAAW,cAAc,SAAS;AAAA,EACjE;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,aAAa,KAAK,OAAO;AACpC,QAAI,OAAO,KAAK,OAAO,oBAAoB,CAAC,qBAAqB,EAAE,GAAG;AACpE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AACA,QAAI,KAAK,MAAM,IAAI,EAAE,EAAG,QAAO,KAAK,MAAM,IAAI,EAAE;AAEhD,QAAI,OAAO,KAAK,OAAO,kBAAkB;AACvC,YAAM,KAAK,qBAAqB;AAAA,IAClC;AAEA,UAAM,OAAO,KAAK,kBAAkB,EAAE;AACtC,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAClC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-QRNI5JBH.js

@@ -0,0 +1,18 @@
+import {
+  resolveHomeDir
+} from "./chunk-XIG5PDM7.js";
+
+// src/utils/path.ts
+import path from "path";
+function expandTildePath(p) {
+  if (p === "~") return resolveHomeDir();
+  if (p.startsWith("~/") || p.startsWith("~\\")) {
+    return path.join(resolveHomeDir(), p.slice(2));
+  }
+  return p;
+}
+
+export {
+  expandTildePath
+};
+//# sourceMappingURL=chunk-QRNI5JBH.js.map