@remnic/core 10.0.14 → 10.0.15

package/dist/{chunk-JYZSRNR7.js → chunk-PIITB2YZ.js}

@@ -16,7 +16,7 @@ import {
 } from "./chunk-ULM7JCDH.js";
 import {
   resolveEvalStoreDir
-} from "./chunk-4IHBN6WU.js";
+} from "./chunk-JKMIGCK6.js";
 
 // src/eval-trajectory-store.ts
 import { mkdir, readFile, rename, rm, writeFile } from "fs/promises";
@@ -237,4 +237,4 @@ export {
   writeEvalTrajectoryReport,
   readEvalTrajectoryReport
 };
-//# sourceMappingURL=chunk-JYZSRNR7.js.map
+//# sourceMappingURL=chunk-PIITB2YZ.js.map

package/dist/chunk-PPUNC7UX.js

@@ -0,0 +1,73 @@
+// src/utils/malformed-entity-record.ts
+function entityRecordFlags(content) {
+  const body = entityRecordBody(content);
+  let hasName = false;
+  let hasType = false;
+  let start = 0;
+  while (start <= body.length) {
+    const newline = body.indexOf("\n", start);
+    const end = newline === -1 ? body.length : newline;
+    let line = body.slice(start, end);
+    if (line.endsWith("\r")) line = line.slice(0, -1);
+    if (!hasName && line.startsWith("# ") && line.slice(2).trim().length > 0) hasName = true;
+    if (!hasType && line.startsWith("**Type:**") && line.slice("**Type:**".length).trim().length > 0) {
+      hasType = true;
+    }
+    if (hasName && hasType) return { hasName, hasType };
+    if (newline === -1) break;
+    start = newline + 1;
+  }
+  return { hasName, hasType };
+}
+function isUnnamedEntityRecord(content) {
+  return !entityRecordFlags(content).hasName;
+}
+function entityBodyHasText(content) {
+  const body = entityRecordBody(content);
+  for (let i = 0; i < body.length; i++) {
+    const char = body.charCodeAt(i);
+    if (char !== 32 && char !== 9 && char !== 10 && char !== 13) return true;
+  }
+  return false;
+}
+function isPopulatedUnnamedEntityRecord(content) {
+  return isUnnamedEntityRecord(content) && entityBodyHasText(content);
+}
+function isShapedUnnamedEntityRecord(content) {
+  if (!isUnnamedEntityRecord(content)) return false;
+  const body = entityRecordBody(content);
+  let start = 0;
+  while (start <= body.length) {
+    const newline = body.indexOf("\n", start);
+    const end = newline === -1 ? body.length : newline;
+    let line = body.slice(start, end);
+    if (line.endsWith("\r")) line = line.slice(0, -1);
+    if (line.startsWith("#") || line.startsWith("**Type:**")) return true;
+    if (newline === -1) break;
+    start = newline + 1;
+  }
+  return false;
+}
+function isMalformedEntityRecord(content) {
+  const flags = entityRecordFlags(content);
+  return !flags.hasName || !flags.hasType;
+}
+function entityRecordBody(content) {
+  const firstNewline = content.indexOf("\n");
+  if (firstNewline === -1) return content;
+  const firstLine = content.slice(0, firstNewline).endsWith("\r") ? content.slice(0, firstNewline - 1) : content.slice(0, firstNewline);
+  if (firstLine !== "---") return content;
+  const close = content.indexOf("\n---", firstNewline + 1);
+  if (close === -1) return content;
+  let rest = close + "\n---".length;
+  if (content.charAt(rest) === "\r") rest += 1;
+  if (content.charAt(rest) === "\n") rest += 1;
+  return content.slice(rest);
+}
+
+export {
+  isPopulatedUnnamedEntityRecord,
+  isShapedUnnamedEntityRecord,
+  isMalformedEntityRecord
+};
+//# sourceMappingURL=chunk-PPUNC7UX.js.map

package/dist/chunk-PPUNC7UX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/malformed-entity-record.ts"],"sourcesContent":["/**\n * Heading and type flags for an entity markdown body.\n *\n * The heading rule matches `parseEntityFile`: a line must start with `# `\n * (hash, space) and the remainder must contain a name. A tab after `#`\n * is not a heading. The type rule matches a `**Type:**` line with a\n * non-empty value. A missing type line is still readable: the parser\n * defaults the type to `other`.\n */\nfunction entityRecordFlags(content: string): { hasName: boolean; hasType: boolean } {\n  const body = entityRecordBody(content);\n  let hasName = false;\n  let hasType = false;\n  let start = 0;\n  while (start <= body.length) {\n    const newline = body.indexOf(\"\\n\", start);\n    const end = newline === -1 ? body.length : newline;\n    let line = body.slice(start, end);\n    if (line.endsWith(\"\\r\")) line = line.slice(0, -1);\n    if (!hasName && line.startsWith(\"# \") && line.slice(2).trim().length > 0) hasName = true;\n    if (!hasType && line.startsWith(\"**Type:**\") && line.slice(\"**Type:**\".length).trim().length > 0) {\n      hasType = true;\n    }\n    if (hasName && hasType) return { hasName, hasType };\n    if (newline === -1) break;\n    start = newline + 1;\n  }\n  return { hasName, hasType };\n}\n\n/**\n * No `# ` name. A named file whose type line is absent stays readable:\n * `parseEntityFile` defaults the type to `other`.\n */\nexport function isUnnamedEntityRecord(content: string): boolean {\n  return !entityRecordFlags(content).hasName;\n}\n\nfunction entityBodyHasText(content: string): boolean {\n  const body = entityRecordBody(content);\n  for (let i = 0; i < body.length; i++) {\n    const char = body.charCodeAt(i);\n    if (char !== 32 && char !== 9 && char !== 10 && char !== 13) return true;\n  }\n  return false;\n}\n\n/**\n * Unnamed entity body that still has text. An empty body under frontmatter\n * stays readable so a canonical filename can supply the type. A tab heading,\n * a blank `# ` heading, or prose with no name does not.\n */\nexport function isPopulatedUnnamedEntityRecord(content: string): boolean {\n  return isUnnamedEntityRecord(content) && entityBodyHasText(content);\n}\n\n/**\n * Unnamed file that still looks like an entity record (`#` or `**Type:**`).\n * Direct filename recall keeps unstructured placeholders such as \"content\".\n */\nexport function isShapedUnnamedEntityRecord(content: string): boolean {\n  if (!isUnnamedEntityRecord(content)) return false;\n  const body = entityRecordBody(content);\n  let start = 0;\n  while (start <= body.length) {\n    const newline = body.indexOf(\"\\n\", start);\n    const end = newline === -1 ? body.length : newline;\n    let line = body.slice(start, end);\n    if (line.endsWith(\"\\r\")) line = line.slice(0, -1);\n    if (line.startsWith(\"#\") || line.startsWith(\"**Type:**\")) return true;\n    if (newline === -1) break;\n    start = newline + 1;\n  }\n  return false;\n}\n\n/**\n * Migration gate. Canonical ids are derived from name and type, and the\n * old startup throw required an explicit `**Type:**` line. Files that\n * only have a heading stay on disk and are not renamed. Listing does not\n * use this predicate: `parseEntityFile` defaults a missing type to `other`.\n */\nexport function isMalformedEntityRecord(content: string): boolean {\n  const flags = entityRecordFlags(content);\n  return !flags.hasName || !flags.hasType;\n}\n\nfunction entityRecordBody(content: string): string {\n  const firstNewline = content.indexOf(\"\\n\");\n  if (firstNewline === -1) return content;\n  const firstLine = content.slice(0, firstNewline).endsWith(\"\\r\")\n    ? content.slice(0, firstNewline - 1)\n    : content.slice(0, firstNewline);\n  if (firstLine !== \"---\") return content;\n  const close = content.indexOf(\"\\n---\", firstNewline + 1);\n  if (close === -1) return content;\n  let rest = close + \"\\n---\".length;\n  if (content.charAt(rest) === \"\\r\") rest += 1;\n  if (content.charAt(rest) === \"\\n\") rest += 1;\n  return content.slice(rest);\n}\n"],"mappings":";AASA,SAAS,kBAAkB,SAAyD;AAClF,QAAM,OAAO,iBAAiB,OAAO;AACrC,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI,QAAQ;AACZ,SAAO,SAAS,KAAK,QAAQ;AAC3B,UAAM,UAAU,KAAK,QAAQ,MAAM,KAAK;AACxC,UAAM,MAAM,YAAY,KAAK,KAAK,SAAS;AAC3C,QAAI,OAAO,KAAK,MAAM,OAAO,GAAG;AAChC,QAAI,KAAK,SAAS,IAAI,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAChD,QAAI,CAAC,WAAW,KAAK,WAAW,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAG,WAAU;AACpF,QAAI,CAAC,WAAW,KAAK,WAAW,WAAW,KAAK,KAAK,MAAM,YAAY,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG;AAChG,gBAAU;AAAA,IACZ;AACA,QAAI,WAAW,QAAS,QAAO,EAAE,SAAS,QAAQ;AAClD,QAAI,YAAY,GAAI;AACpB,YAAQ,UAAU;AAAA,EACpB;AACA,SAAO,EAAE,SAAS,QAAQ;AAC5B;AAMO,SAAS,sBAAsB,SAA0B;AAC9D,SAAO,CAAC,kBAAkB,OAAO,EAAE;AACrC;AAEA,SAAS,kBAAkB,SAA0B;AACnD,QAAM,OAAO,iBAAiB,OAAO;AACrC,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,OAAO,KAAK,WAAW,CAAC;AAC9B,QAAI,SAAS,MAAM,SAAS,KAAK,SAAS,MAAM,SAAS,GAAI,QAAO;AAAA,EACtE;AACA,SAAO;AACT;AAOO,SAAS,+BAA+B,SAA0B;AACvE,SAAO,sBAAsB,OAAO,KAAK,kBAAkB,OAAO;AACpE;AAMO,SAAS,4BAA4B,SAA0B;AACpE,MAAI,CAAC,sBAAsB,OAAO,EAAG,QAAO;AAC5C,QAAM,OAAO,iBAAiB,OAAO;AACrC,MAAI,QAAQ;AACZ,SAAO,SAAS,KAAK,QAAQ;AAC3B,UAAM,UAAU,KAAK,QAAQ,MAAM,KAAK;AACxC,UAAM,MAAM,YAAY,KAAK,KAAK,SAAS;AAC3C,QAAI,OAAO,KAAK,MAAM,OAAO,GAAG;AAChC,QAAI,KAAK,SAAS,IAAI,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAChD,QAAI,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,WAAW,EAAG,QAAO;AACjE,QAAI,YAAY,GAAI;AACpB,YAAQ,UAAU;AAAA,EACpB;AACA,SAAO;AACT;AAQO,SAAS,wBAAwB,SAA0B;AAChE,QAAM,QAAQ,kBAAkB,OAAO;AACvC,SAAO,CAAC,MAAM,WAAW,CAAC,MAAM;AAClC;AAEA,SAAS,iBAAiB,SAAyB;AACjD,QAAM,eAAe,QAAQ,QAAQ,IAAI;AACzC,MAAI,iBAAiB,GAAI,QAAO;AAChC,QAAM,YAAY,QAAQ,MAAM,GAAG,YAAY,EAAE,SAAS,IAAI,IAC1D,QAAQ,MAAM,GAAG,eAAe,CAAC,IACjC,QAAQ,MAAM,GAAG,YAAY;AACjC,MAAI,cAAc,MAAO,QAAO;AAChC,QAAM,QAAQ,QAAQ,QAAQ,SAAS,eAAe,CAAC;AACvD,MAAI,UAAU,GAAI,QAAO;AACzB,MAAI,OAAO,QAAQ,QAAQ;AAC3B,MAAI,QAAQ,OAAO,IAAI,MAAM,KAAM,SAAQ;AAC3C,MAAI,QAAQ,OAAO,IAAI,MAAM,KAAM,SAAQ;AAC3C,SAAO,QAAQ,MAAM,IAAI;AAC3B;","names":[]}

package/dist/{chunk-EQWEIIKQ.js → chunk-PQM3B54K.js}

@@ -1,3 +1,7 @@
+import {
+  isMacOsReplicationJunkBasename
+} from "./chunk-QUIRIG2P.js";
+
 // src/maintenance/dreams-ledger.ts
 import path from "path";
 import { createReadStream } from "fs";
@@ -289,6 +293,7 @@ async function listMemoryFiles(memoryDir) {
     }
     for (const entry of entries) {
       if (entry.isSymbolicLink()) continue;
+      if (isMacOsReplicationJunkBasename(entry.name)) continue;
       const full = path.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name === "state" || entry.name === "archive" || entry.name === "namespaces" || entry.name === ".git") continue;
@@ -313,4 +318,4 @@ export {
   runDreamsPhase,
   summarizeGovernanceResultForDreams
 };
-//# sourceMappingURL=chunk-EQWEIIKQ.js.map
+//# sourceMappingURL=chunk-PQM3B54K.js.map

package/dist/chunk-PQM3B54K.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/maintenance/dreams-ledger.ts"],"sourcesContent":["/**\n * dreams-ledger.ts — per-phase telemetry for the Dreams consolidation pipeline.\n *\n * Every scheduled or manual phase run appends one JSONL entry to\n *   <memoryDir>/state/dreams-ledger.jsonl\n *\n * The entry records which phase ran, how long it took, and a small\n * itemsProcessed counter so `remnic dreams status` can aggregate the last\n * 24-hour window without scanning the full memory corpus.\n *\n * This module is intentionally side-effect-free on import (no fs calls at\n * module load time) so tests can import it without touching the filesystem.\n */\n\nimport path from \"node:path\";\nimport { createReadStream, type ReadStream } from \"node:fs\";\nimport { appendFile, lstat, mkdir, readdir, readFile } from \"node:fs/promises\";\nimport { createInterface } from \"node:readline\";\nimport { isMacOsReplicationJunkBasename } from \"../utils/macos-replication-junk.js\";\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/** The three named phases of the Dreams consolidation pipeline. */\nexport type DreamsPhase = \"lightSleep\" | \"rem\" | \"deepSleep\";\n\n/**\n * One entry written to the dreams ledger for every phase run.\n * Older entries that predate this field simply won't have it (no backfill).\n */\nexport interface DreamsLedgerEntry {\n  /** Schema version — always 1 for entries written by this module. */\n  schemaVersion: 1;\n  /** ISO-8601 timestamp when the phase run started. */\n  startedAt: string;\n  /** ISO-8601 timestamp when the phase run completed. */\n  completedAt: string;\n  /** Wall-clock duration in milliseconds. */\n  durationMs: number;\n  /**\n   * Which Dreams phase this entry represents.\n   * - `lightSleep` — recent activity scoring + clustering\n   * - `rem`        — cross-session synthesis, supersession, consolidation\n   * - `deepSleep`  — tier migration, page-version snapshots, archive\n   */\n  phase: DreamsPhase;\n  /** How many memory items were evaluated (scored / clustered / migrated). */\n  itemsProcessed: number;\n  /** Whether this was a dry-run (no writes committed). */\n  dryRun: boolean;\n  /**\n   * How the phase was triggered.\n   * - `scheduled` — invoked by the governance cron or orchestrator maintenance pass\n   * - `manual`    — invoked via `remnic dreams run`\n   */\n  trigger: \"scheduled\" | \"manual\";\n  /** Free-form notes for debugging (optional, never required). */\n  notes?: string;\n}\n\n/** Aggregated stats for a single phase over a time window. */\nexport interface DreamsPhaseStatus {\n  phase: DreamsPhase;\n  /** Number of phase runs in the window. */\n  runCount: number;\n  /** Total wall-clock milliseconds across all runs in the window. */\n  totalDurationMs: number;\n  /** Total items processed across all runs in the window. */\n  totalItemsProcessed: number;\n  /** ISO-8601 timestamp of the most recent completed run, or null if none. */\n  lastRunAt: string | null;\n  /** Duration of the most recent run in ms, or null if none. */\n  lastDurationMs: number | null;\n}\n\n/** Shape returned by `getDreamsStatus` — the canonical telemetry response. */\nexport interface DreamsStatusResult {\n  /** ISO-8601 start of the query window (inclusive). */\n  windowStart: string;\n  /** ISO-8601 end of the query window (exclusive). */\n  windowEnd: string;\n  /** Per-phase summaries, always present for all three phases. */\n  phases: {\n    lightSleep: DreamsPhaseStatus;\n    rem: DreamsPhaseStatus;\n    deepSleep: DreamsPhaseStatus;\n  };\n}\n\n// ── Path helpers ──────────────────────────────────────────────────────────────\n\nexport function dreamsLedgerPath(memoryDir: string): string {\n  return path.join(memoryDir, \"state\", \"dreams-ledger.jsonl\");\n}\n\n// ── Writer ────────────────────────────────────────────────────────────────────\n\n/**\n * Append a single entry to the dreams ledger.\n * Creates the file (and its parent directory) if needed.\n * Uses `appendFile` (O_APPEND) so concurrent callers never overwrite each other.\n */\nexport async function appendDreamsLedgerEntry(\n  memoryDir: string,\n  entry: DreamsLedgerEntry,\n): Promise<void> {\n  const ledgerPath = dreamsLedgerPath(memoryDir);\n  await mkdir(path.dirname(ledgerPath), { recursive: true });\n  await appendFile(ledgerPath, JSON.stringify(entry) + \"\\n\", \"utf-8\");\n}\n\n// ── Reader ────────────────────────────────────────────────────────────────────\n\n/**\n * Parse and validate one ledger line into a `DreamsLedgerEntry`, or `null` when\n * blank/malformed/incomplete. Shared by the streaming reader and the windowed\n * status aggregator so both apply the identical fail-open guard.\n */\nfunction parseDreamsLedgerLine(line: string): DreamsLedgerEntry | null {\n  const trimmed = line.trim();\n  if (!trimmed) return null;\n  let parsed: Record<string, unknown>;\n  try {\n    const raw = JSON.parse(trimmed);\n    if (typeof raw !== \"object\" || raw === null) return null;\n    parsed = raw as Record<string, unknown>;\n  } catch {\n    return null; // Malformed JSON — skip (fail-open).\n  }\n\n  // Required, strongly-typed fields. A row missing or mistyping any of these is\n  // not a usable telemetry entry.\n  const phase = parsed.phase;\n  if (phase !== \"lightSleep\" && phase !== \"rem\" && phase !== \"deepSleep\") return null;\n  if (\n    typeof parsed.startedAt !== \"string\" ||\n    typeof parsed.completedAt !== \"string\" ||\n    typeof parsed.durationMs !== \"number\" ||\n    typeof parsed.itemsProcessed !== \"number\"\n  ) {\n    return null;\n  }\n\n  // Optional fields: absence is tolerated (older entries predate them, no\n  // backfill), but a PRESENT value with the wrong type/value marks the row\n  // malformed and skips it — never silently coerced to a default (issue #1910).\n  if (\"schemaVersion\" in parsed && parsed.schemaVersion !== 1) return null;\n  if (\"dryRun\" in parsed && typeof parsed.dryRun !== \"boolean\") return null;\n  if (\"trigger\" in parsed && parsed.trigger !== \"manual\" && parsed.trigger !== \"scheduled\") {\n    return null;\n  }\n\n  return {\n    schemaVersion: 1,\n    startedAt: parsed.startedAt,\n    completedAt: parsed.completedAt,\n    durationMs: parsed.durationMs,\n    phase,\n    itemsProcessed: parsed.itemsProcessed,\n    dryRun: parsed.dryRun === true,\n    trigger: parsed.trigger === \"manual\" ? \"manual\" : \"scheduled\",\n    notes: typeof parsed.notes === \"string\" ? parsed.notes : undefined,\n  };\n}\n\n/**\n * Stream the dreams ledger line-by-line. The ledger is plaintext `appendFile`\n * (never encrypted), so a raw line stream is safe at any size — heap stays\n * O(1) in the file, unlike the previous whole-file `readFile` + `split`.\n * Yields nothing when the ledger does not exist yet.\n */\nexport async function* streamDreamsLedgerLines(memoryDir: string): AsyncGenerator<string> {\n  const ledgerPath = dreamsLedgerPath(memoryDir);\n  let input: ReadStream;\n  try {\n    input = createReadStream(ledgerPath, { encoding: \"utf8\" });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  }\n  const rl = createInterface({ input, crlfDelay: Infinity });\n  try {\n    for await (const line of rl) yield line;\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return;\n    throw err;\n  } finally {\n    // Close the readline interface AND destroy the underlying stream. When a\n    // consumer stops early (e.g. `getDreamsStatus` breaks out), the generator's\n    // `.return()` runs this finally; `rl.close()` alone leaves the file\n    // descriptor open, so destroy the stream to release it (issue #1910).\n    rl.close();\n    input.destroy();\n  }\n}\n\n/**\n * Parse all valid `DreamsLedgerEntry` rows from the ledger file. Thin wrapper\n * over the line stream so any caller that genuinely needs every row still\n * works; `getDreamsStatus` streams directly and filters in-window instead.\n * Malformed lines are silently skipped (resilience over strictness for\n * telemetry).\n */\nexport async function readDreamsLedgerEntries(memoryDir: string): Promise<DreamsLedgerEntry[]> {\n  const entries: DreamsLedgerEntry[] = [];\n  for await (const line of streamDreamsLedgerLines(memoryDir)) {\n    const entry = parseDreamsLedgerLine(line);\n    if (entry) entries.push(entry);\n  }\n  return entries;\n}\n\n// ── Aggregator ────────────────────────────────────────────────────────────────\n\nconst ALL_PHASES: DreamsPhase[] = [\"lightSleep\", \"rem\", \"deepSleep\"];\nconst MAX_WINDOW_HOURS = 24 * 365 * 100;\n\nexport function normalizeDreamsStatusWindowHours(value: unknown, fallback = 24): number {\n  const raw = value === undefined || value === null ? fallback : value;\n  if (\n    typeof raw !== \"number\" ||\n    !Number.isFinite(raw) ||\n    !Number.isInteger(raw) ||\n    raw < 1 ||\n    raw > MAX_WINDOW_HOURS\n  ) {\n    throw new RangeError(`windowHours must be a positive integer no greater than ${MAX_WINDOW_HOURS}`);\n  }\n  return raw;\n}\n\n/**\n * Build per-phase 24-hour summary.\n *\n * @param memoryDir   The memory directory (parent of `state/`).\n * @param windowHours How many hours to look back (default 24).\n * @param now         Reference time (default `new Date()`).\n */\nexport async function getDreamsStatus(\n  memoryDir: string,\n  windowHours = 24,\n  now: Date = new Date(),\n): Promise<DreamsStatusResult> {\n  const boundedWindowHours = normalizeDreamsStatusWindowHours(windowHours);\n  const nowMs = now.getTime();\n  if (!Number.isFinite(nowMs)) {\n    throw new RangeError(\"now must be a valid Date\");\n  }\n  const windowMs = boundedWindowHours * 60 * 60 * 1000;\n  const windowStart = new Date(nowMs - windowMs);\n  const windowEnd = now;\n  if (!Number.isFinite(windowStart.getTime())) {\n    throw new RangeError(\"windowHours produces an invalid status window\");\n  }\n\n  const windowStartMs = windowStart.getTime();\n  const windowEndMs = windowEnd.getTime();\n\n  const statusMap = new Map<DreamsPhase, DreamsPhaseStatus>();\n  for (const phase of ALL_PHASES) {\n    statusMap.set(phase, {\n      phase,\n      runCount: 0,\n      totalDurationMs: 0,\n      totalItemsProcessed: 0,\n      lastRunAt: null,\n      lastDurationMs: null,\n    });\n  }\n\n  // Stream the ledger and aggregate every in-window row inline, so heap use is\n  // O(number of phases) regardless of window or file size (issue #1910) — no\n  // per-row array and no row cap, so a large in-window window is still counted\n  // in full rather than truncated.\n  for await (const line of streamDreamsLedgerLines(memoryDir)) {\n    const entry = parseDreamsLedgerLine(line);\n    if (!entry) continue;\n    const ts = Date.parse(entry.completedAt);\n    if (!Number.isFinite(ts) || ts < windowStartMs || ts >= windowEndMs) continue;\n    const status = statusMap.get(entry.phase);\n    if (!status) continue;\n    status.runCount += 1;\n    status.totalDurationMs += entry.durationMs;\n    status.totalItemsProcessed += entry.itemsProcessed;\n    // Track the most recent run (by completedAt).\n    if (status.lastRunAt === null || ts > Date.parse(status.lastRunAt)) {\n      status.lastRunAt = entry.completedAt;\n      status.lastDurationMs = entry.durationMs;\n    }\n  }\n\n  return {\n    windowStart: windowStart.toISOString(),\n    windowEnd: windowEnd.toISOString(),\n    phases: {\n      lightSleep: statusMap.get(\"lightSleep\")!,\n      rem: statusMap.get(\"rem\")!,\n      deepSleep: statusMap.get(\"deepSleep\")!,\n    },\n  };\n}\n\n// ── Phase runner (PR 4/4: manual invocation) ─────────────────────────────────\n\nexport interface DreamsRunOptions {\n  memoryDir: string;\n  phase: DreamsPhase;\n  dryRun?: boolean;\n}\n\n/** Public result shape — identical to what HTTP, MCP, and CLI surfaces expose. */\nexport interface DreamsRunResult {\n  phase: DreamsPhase;\n  dryRun: boolean;\n  durationMs: number;\n  itemsProcessed: number;\n  notes?: string;\n}\n\n/** Internal result shape returned by `runDreamsPhase` — includes the raw ledger entry. */\nexport interface DreamsRunResultInternal extends DreamsRunResult {\n  ledgerEntry?: DreamsLedgerEntry;\n}\n\nexport async function recordDreamsPhaseRun(options: {\n  memoryDir: string;\n  phase: DreamsPhase;\n  trigger: DreamsLedgerEntry[\"trigger\"];\n  dryRun?: boolean;\n  itemsProcessed: number;\n  notes?: string;\n  startedAt?: string;\n  completedAt?: string;\n}): Promise<DreamsLedgerEntry> {\n  const startedAt = options.startedAt ?? new Date().toISOString();\n  const completedAt = options.completedAt ?? new Date().toISOString();\n  const durationMs = Math.max(0, Date.parse(completedAt) - Date.parse(startedAt));\n  const ledgerEntry: DreamsLedgerEntry = {\n    schemaVersion: 1,\n    startedAt,\n    completedAt,\n    durationMs: Number.isFinite(durationMs) ? durationMs : 0,\n    phase: options.phase,\n    itemsProcessed: Math.max(0, Math.floor(options.itemsProcessed)),\n    dryRun: options.dryRun === true,\n    trigger: options.trigger,\n    notes: options.notes,\n  };\n  if (!ledgerEntry.dryRun) {\n    await appendDreamsLedgerEntry(options.memoryDir, ledgerEntry);\n  }\n  return ledgerEntry;\n}\n\n/**\n * Manually invoke a single Dreams phase pass.\n *\n * For light sleep and REM: runs a lightweight scan against the observation\n * ledger and returns a count of items that would be (or were, if not dry-run)\n * processed.  The actual heavy consolidation is long-running and orchestrator-\n * bound; the manual surface delegates to existing ledger utilities and returns\n * the phase telemetry so callers get the same shape as a scheduled run.\n *\n * For deep sleep: delegates to the memory governance run (shadow mode when\n * dryRun is true, apply mode otherwise).\n */\nexport async function runDreamsPhase(\n  options: DreamsRunOptions,\n  governanceRunner?: (opts: { memoryDir: string; dryRun: boolean }) => Promise<{ scannedMemories: number; appliedActionCount: number; notes?: string }>,\n  phaseRunner?: (opts: { memoryDir: string; phase: Exclude<DreamsPhase, \"deepSleep\"> }) => Promise<{ itemsProcessed: number; notes?: string }>,\n): Promise<DreamsRunResultInternal> {\n  const { memoryDir, phase, dryRun = false } = options;\n  const startedAt = new Date().toISOString();\n\n  let itemsProcessed = 0;\n  let notes: string | undefined;\n\n  if (phase === \"lightSleep\") {\n    // Dry-run light sleep counts recent observation entries as a preview.\n    // Live runs must be backed by the orchestrator phase runner so the command\n    // never reports success without executing the phase.\n    if (!dryRun) {\n      if (!phaseRunner) {\n        throw new Error(\"light-sleep manual runs require a phase runner\");\n      }\n      const result = await phaseRunner({ memoryDir, phase });\n      itemsProcessed = Math.max(0, Math.floor(result.itemsProcessed));\n      notes = result.notes ?? `scored ${itemsProcessed} memories`;\n    } else {\n      // Light sleep: count observation ledger entries from the last 24h as a\n      // proxy for \"items scored\". The live value-scoring pass runs through the\n      // phase runner above.\n      try {\n        const ledgerPath = path.join(memoryDir, \"state\", \"observation-ledger\", \"rebuilt-observations.jsonl\");\n        let raw = \"\";\n        try {\n          raw = await readFile(ledgerPath, \"utf-8\");\n        } catch {\n          // No ledger yet — zero items.\n        }\n        const lines = raw.split(\"\\n\").filter((l) => l.trim().length > 0);\n        const nowMs = Date.now();\n        const cutoff = nowMs - 24 * 60 * 60 * 1000;\n        itemsProcessed = lines.filter((line) => {\n          try {\n            const obj = JSON.parse(line) as {\n              hour?: string;\n              timestamp?: string;\n              ts?: string;\n            };\n            const timestamp = typeof obj.hour === \"string\"\n              ? obj.hour\n              : typeof obj.ts === \"string\"\n                ? obj.ts\n                : typeof obj.timestamp === \"string\"\n                  ? obj.timestamp\n                  : null;\n            if (!timestamp) return false;\n            const ms = Date.parse(timestamp);\n            return Number.isFinite(ms) && ms >= cutoff && ms < nowMs;\n          } catch {\n            return false;\n          }\n        }).length;\n        notes = `dry-run: would score ${itemsProcessed} observation entries`;\n      } catch (err) {\n        throw new Error(`light-sleep scan failed: ${err instanceof Error ? err.message : String(err)}`);\n      }\n    }\n  } else if (phase === \"rem\") {\n    if (!dryRun) {\n      if (!phaseRunner) {\n        throw new Error(\"REM manual runs require a phase runner\");\n      }\n      const result = await phaseRunner({ memoryDir, phase });\n      itemsProcessed = Math.max(0, Math.floor(result.itemsProcessed));\n      notes = result.notes ?? `REM pass assessed ${itemsProcessed} memories`;\n    } else {\n      // REM dry-runs estimate candidates without synthesizing or archiving.\n      try {\n        const stateFilePath = path.join(memoryDir, \"state\", \"semantic-consolidation-last-run.json\");\n        let lastRunAt: string | null = null;\n        try {\n          const stateRaw = await readFile(stateFilePath, \"utf-8\");\n          const stateData = JSON.parse(stateRaw) as { lastRunAt?: string };\n          lastRunAt = stateData.lastRunAt ?? null;\n        } catch {\n          // No state file — never run.\n        }\n        const memFiles = await listMemoryFiles(memoryDir);\n        itemsProcessed = memFiles.length;\n        notes = `dry-run: ${itemsProcessed} memories would enter REM consolidation pass${lastRunAt ? ` (last run: ${lastRunAt})` : \" (never run)\"}`;\n      } catch (err) {\n        throw new Error(`REM scan failed: ${err instanceof Error ? err.message : String(err)}`);\n      }\n    }\n  } else {\n    // deep sleep\n    if (governanceRunner) {\n      try {\n        const result = await governanceRunner({ memoryDir, dryRun });\n        itemsProcessed = result.scannedMemories;\n        notes = result.notes ?? (dryRun ? `dry-run: ${result.appliedActionCount} actions proposed` : `${result.appliedActionCount} actions applied`);\n      } catch (err) {\n        throw new Error(`deep-sleep governance run failed: ${err instanceof Error ? err.message : String(err)}`);\n      }\n    } else {\n      // Fallback: count memory files.\n      const memFiles = await listMemoryFiles(memoryDir);\n      itemsProcessed = memFiles.length;\n      notes = dryRun\n        ? `dry-run: ${itemsProcessed} memories eligible for deep-sleep governance`\n        : `assessed ${itemsProcessed} memories for deep-sleep governance`;\n    }\n  }\n\n  const completedAt = new Date().toISOString();\n  const durationMs = Math.max(0, Date.parse(completedAt) - Date.parse(startedAt));\n  let ledgerEntry: DreamsLedgerEntry | undefined;\n  try {\n    ledgerEntry = await recordDreamsPhaseRun({\n      memoryDir,\n      startedAt,\n      completedAt,\n      phase,\n      itemsProcessed,\n      dryRun,\n      trigger: \"manual\",\n      notes,\n    });\n  } catch {\n    // Telemetry is best-effort: the phase work has already completed.\n  }\n\n  return {\n    phase,\n    dryRun,\n    durationMs: ledgerEntry?.durationMs ?? durationMs,\n    itemsProcessed,\n    notes,\n    ledgerEntry,\n  };\n}\n\n// ── Shared governance result mapping ──────────────────────────────────────────\n\nexport function summarizeGovernanceResultForDreams(\n  govResult: {\n    summary?: { scannedMemories?: number };\n    proposedActions: unknown[];\n    appliedActions: unknown[];\n    reviewQueue: unknown[];\n  },\n  dryRun: boolean,\n): { scannedMemories: number; appliedActionCount: number; notes?: string } {\n  const proposedCount = govResult.proposedActions.length;\n  const appliedCount = govResult.appliedActions.length;\n  const scannedCount =\n    typeof govResult.summary?.scannedMemories === \"number\" &&\n    Number.isFinite(govResult.summary.scannedMemories)\n      ? Math.max(0, Math.floor(govResult.summary.scannedMemories))\n      : govResult.reviewQueue.length;\n  return {\n    scannedMemories: scannedCount,\n    appliedActionCount: appliedCount,\n    notes: dryRun\n      ? `shadow mode: ${proposedCount} actions proposed`\n      : `applied ${appliedCount} actions`,\n  };\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\nasync function listMemoryFiles(memoryDir: string): Promise<string[]> {\n  const out: string[] = [];\n  try {\n    const root = await lstat(memoryDir);\n    if (root.isSymbolicLink()) {\n      throw new Error(`memoryDir must not be a symlink: ${memoryDir}`);\n    }\n    if (!root.isDirectory()) return out;\n  } catch (err) {\n    if (err instanceof Error && /must not be a symlink/.test(err.message)) {\n      throw err;\n    }\n    return out;\n  }\n\n  async function walk(dir: string): Promise<void> {\n    let entries: Array<{ name: string; isDirectory(): boolean; isFile(): boolean; isSymbolicLink(): boolean }>;\n    try {\n      entries = (await readdir(dir, { withFileTypes: true })) as typeof entries;\n    } catch {\n      return;\n    }\n    for (const entry of entries) {\n      if (entry.isSymbolicLink()) continue;\n      if (isMacOsReplicationJunkBasename(entry.name)) continue;\n      const full = path.join(dir, entry.name);\n      if (entry.isDirectory()) {\n        // Skip state/ and archive/ subdirs.\n        if (\n          entry.name === \"state\" ||\n          entry.name === \"archive\" ||\n          entry.name === \"namespaces\" ||\n          entry.name === \".git\"\n        ) continue;\n        await walk(full);\n      } else if (entry.isFile() && entry.name.endsWith(\".md\")) {\n        out.push(full);\n      }\n    }\n  }\n\n  await walk(memoryDir);\n  return out;\n}\n"],"mappings":";;;;;AAcA,OAAO,UAAU;AACjB,SAAS,wBAAyC;AAClD,SAAS,YAAY,OAAO,OAAO,SAAS,gBAAgB;AAC5D,SAAS,uBAAuB;AAyEzB,SAAS,iBAAiB,WAA2B;AAC1D,SAAO,KAAK,KAAK,WAAW,SAAS,qBAAqB;AAC5D;AASA,eAAsB,wBACpB,WACA,OACe;AACf,QAAM,aAAa,iBAAiB,SAAS;AAC7C,QAAM,MAAM,KAAK,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AACzD,QAAM,WAAW,YAAY,KAAK,UAAU,KAAK,IAAI,MAAM,OAAO;AACpE;AASA,SAAS,sBAAsB,MAAwC;AACrE,QAAM,UAAU,KAAK,KAAK;AAC1B,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,OAAO;AAC9B,QAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,aAAS;AAAA,EACX,QAAQ;AACN,WAAO;AAAA,EACT;AAIA,QAAM,QAAQ,OAAO;AACrB,MAAI,UAAU,gBAAgB,UAAU,SAAS,UAAU,YAAa,QAAO;AAC/E,MACE,OAAO,OAAO,cAAc,YAC5B,OAAO,OAAO,gBAAgB,YAC9B,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,mBAAmB,UACjC;AACA,WAAO;AAAA,EACT;AAKA,MAAI,mBAAmB,UAAU,OAAO,kBAAkB,EAAG,QAAO;AACpE,MAAI,YAAY,UAAU,OAAO,OAAO,WAAW,UAAW,QAAO;AACrE,MAAI,aAAa,UAAU,OAAO,YAAY,YAAY,OAAO,YAAY,aAAa;AACxF,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,WAAW,OAAO;AAAA,IAClB,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,QAAQ,OAAO,WAAW;AAAA,IAC1B,SAAS,OAAO,YAAY,WAAW,WAAW;AAAA,IAClD,OAAO,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAAA,EAC3D;AACF;AAQA,gBAAuB,wBAAwB,WAA2C;AACxF,QAAM,aAAa,iBAAiB,SAAS;AAC7C,MAAI;AACJ,MAAI;AACF,YAAQ,iBAAiB,YAAY,EAAE,UAAU,OAAO,CAAC;AAAA,EAC3D,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR;AACA,QAAM,KAAK,gBAAgB,EAAE,OAAO,WAAW,SAAS,CAAC;AACzD,MAAI;AACF,qBAAiB,QAAQ,GAAI,OAAM;AAAA,EACrC,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU;AACtD,UAAM;AAAA,EACR,UAAE;AAKA,OAAG,MAAM;AACT,UAAM,QAAQ;AAAA,EAChB;AACF;AASA,eAAsB,wBAAwB,WAAiD;AAC7F,QAAM,UAA+B,CAAC;AACtC,mBAAiB,QAAQ,wBAAwB,SAAS,GAAG;AAC3D,UAAM,QAAQ,sBAAsB,IAAI;AACxC,QAAI,MAAO,SAAQ,KAAK,KAAK;AAAA,EAC/B;AACA,SAAO;AACT;AAIA,IAAM,aAA4B,CAAC,cAAc,OAAO,WAAW;AACnE,IAAM,mBAAmB,KAAK,MAAM;AAE7B,SAAS,iCAAiC,OAAgB,WAAW,IAAY;AACtF,QAAM,MAAM,UAAU,UAAa,UAAU,OAAO,WAAW;AAC/D,MACE,OAAO,QAAQ,YACf,CAAC,OAAO,SAAS,GAAG,KACpB,CAAC,OAAO,UAAU,GAAG,KACrB,MAAM,KACN,MAAM,kBACN;AACA,UAAM,IAAI,WAAW,0DAA0D,gBAAgB,EAAE;AAAA,EACnG;AACA,SAAO;AACT;AASA,eAAsB,gBACpB,WACA,cAAc,IACd,MAAY,oBAAI,KAAK,GACQ;AAC7B,QAAM,qBAAqB,iCAAiC,WAAW;AACvE,QAAM,QAAQ,IAAI,QAAQ;AAC1B,MAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,UAAM,IAAI,WAAW,0BAA0B;AAAA,EACjD;AACA,QAAM,WAAW,qBAAqB,KAAK,KAAK;AAChD,QAAM,cAAc,IAAI,KAAK,QAAQ,QAAQ;AAC7C,QAAM,YAAY;AAClB,MAAI,CAAC,OAAO,SAAS,YAAY,QAAQ,CAAC,GAAG;AAC3C,UAAM,IAAI,WAAW,+CAA+C;AAAA,EACtE;AAEA,QAAM,gBAAgB,YAAY,QAAQ;AAC1C,QAAM,cAAc,UAAU,QAAQ;AAEtC,QAAM,YAAY,oBAAI,IAAoC;AAC1D,aAAW,SAAS,YAAY;AAC9B,cAAU,IAAI,OAAO;AAAA,MACnB;AAAA,MACA,UAAU;AAAA,MACV,iBAAiB;AAAA,MACjB,qBAAqB;AAAA,MACrB,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAMA,mBAAiB,QAAQ,wBAAwB,SAAS,GAAG;AAC3D,UAAM,QAAQ,sBAAsB,IAAI;AACxC,QAAI,CAAC,MAAO;AACZ,UAAM,KAAK,KAAK,MAAM,MAAM,WAAW;AACvC,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,iBAAiB,MAAM,YAAa;AACrE,UAAM,SAAS,UAAU,IAAI,MAAM,KAAK;AACxC,QAAI,CAAC,OAAQ;AACb,WAAO,YAAY;AACnB,WAAO,mBAAmB,MAAM;AAChC,WAAO,uBAAuB,MAAM;AAEpC,QAAI,OAAO,cAAc,QAAQ,KAAK,KAAK,MAAM,OAAO,SAAS,GAAG;AAClE,aAAO,YAAY,MAAM;AACzB,aAAO,iBAAiB,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AAAA,IACL,aAAa,YAAY,YAAY;AAAA,IACrC,WAAW,UAAU,YAAY;AAAA,IACjC,QAAQ;AAAA,MACN,YAAY,UAAU,IAAI,YAAY;AAAA,MACtC,KAAK,UAAU,IAAI,KAAK;AAAA,MACxB,WAAW,UAAU,IAAI,WAAW;AAAA,IACtC;AAAA,EACF;AACF;AAwBA,eAAsB,qBAAqB,SASZ;AAC7B,QAAM,YAAY,QAAQ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC9D,QAAM,cAAc,QAAQ,gBAAe,oBAAI,KAAK,GAAE,YAAY;AAClE,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,CAAC;AAC9E,QAAM,cAAiC;AAAA,IACrC,eAAe;AAAA,IACf;AAAA,IACA;AAAA,IACA,YAAY,OAAO,SAAS,UAAU,IAAI,aAAa;AAAA,IACvD,OAAO,QAAQ;AAAA,IACf,gBAAgB,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,cAAc,CAAC;AAAA,IAC9D,QAAQ,QAAQ,WAAW;AAAA,IAC3B,SAAS,QAAQ;AAAA,IACjB,OAAO,QAAQ;AAAA,EACjB;AACA,MAAI,CAAC,YAAY,QAAQ;AACvB,UAAM,wBAAwB,QAAQ,WAAW,WAAW;AAAA,EAC9D;AACA,SAAO;AACT;AAcA,eAAsB,eACpB,SACA,kBACA,aACkC;AAClC,QAAM,EAAE,WAAW,OAAO,SAAS,MAAM,IAAI;AAC7C,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,MAAI,iBAAiB;AACrB,MAAI;AAEJ,MAAI,UAAU,cAAc;AAI1B,QAAI,CAAC,QAAQ;AACX,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AACA,YAAM,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,CAAC;AACrD,uBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,cAAc,CAAC;AAC9D,cAAQ,OAAO,SAAS,UAAU,cAAc;AAAA,IAClD,OAAO;AAIL,UAAI;AACF,cAAM,aAAa,KAAK,KAAK,WAAW,SAAS,sBAAsB,4BAA4B;AACnG,YAAI,MAAM;AACV,YAAI;AACF,gBAAM,MAAM,SAAS,YAAY,OAAO;AAAA,QAC1C,QAAQ;AAAA,QAER;AACA,cAAM,QAAQ,IAAI,MAAM,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC;AAC/D,cAAM,QAAQ,KAAK,IAAI;AACvB,cAAM,SAAS,QAAQ,KAAK,KAAK,KAAK;AACtC,yBAAiB,MAAM,OAAO,CAAC,SAAS;AACtC,cAAI;AACF,kBAAM,MAAM,KAAK,MAAM,IAAI;AAK3B,kBAAM,YAAY,OAAO,IAAI,SAAS,WAClC,IAAI,OACJ,OAAO,IAAI,OAAO,WAChB,IAAI,KACJ,OAAO,IAAI,cAAc,WACvB,IAAI,YACJ;AACR,gBAAI,CAAC,UAAW,QAAO;AACvB,kBAAM,KAAK,KAAK,MAAM,SAAS;AAC/B,mBAAO,OAAO,SAAS,EAAE,KAAK,MAAM,UAAU,KAAK;AAAA,UACrD,QAAQ;AACN,mBAAO;AAAA,UACT;AAAA,QACF,CAAC,EAAE;AACH,gBAAQ,wBAAwB,cAAc;AAAA,MAChD,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,4BAA4B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF,WAAW,UAAU,OAAO;AAC1B,QAAI,CAAC,QAAQ;AACX,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AACA,YAAM,SAAS,MAAM,YAAY,EAAE,WAAW,MAAM,CAAC;AACrD,uBAAiB,KAAK,IAAI,GAAG,KAAK,MAAM,OAAO,cAAc,CAAC;AAC9D,cAAQ,OAAO,SAAS,qBAAqB,cAAc;AAAA,IAC7D,OAAO;AAEL,UAAI;AACF,cAAM,gBAAgB,KAAK,KAAK,WAAW,SAAS,sCAAsC;AAC1F,YAAI,YAA2B;AAC/B,YAAI;AACF,gBAAM,WAAW,MAAM,SAAS,eAAe,OAAO;AACtD,gBAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,sBAAY,UAAU,aAAa;AAAA,QACrC,QAAQ;AAAA,QAER;AACA,cAAM,WAAW,MAAM,gBAAgB,SAAS;AAChD,yBAAiB,SAAS;AAC1B,gBAAQ,YAAY,cAAc,+CAA+C,YAAY,eAAe,SAAS,MAAM,cAAc;AAAA,MAC3I,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,EACF,OAAO;AAEL,QAAI,kBAAkB;AACpB,UAAI;AACF,cAAM,SAAS,MAAM,iBAAiB,EAAE,WAAW,OAAO,CAAC;AAC3D,yBAAiB,OAAO;AACxB,gBAAQ,OAAO,UAAU,SAAS,YAAY,OAAO,kBAAkB,sBAAsB,GAAG,OAAO,kBAAkB;AAAA,MAC3H,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,qCAAqC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,MACzG;AAAA,IACF,OAAO;AAEL,YAAM,WAAW,MAAM,gBAAgB,SAAS;AAChD,uBAAiB,SAAS;AAC1B,cAAQ,SACJ,YAAY,cAAc,iDAC1B,YAAY,cAAc;AAAA,IAChC;AAAA,EACF;AAEA,QAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,CAAC;AAC9E,MAAI;AACJ,MAAI;AACF,kBAAc,MAAM,qBAAqB;AAAA,MACvC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAY,aAAa,cAAc;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAIO,SAAS,mCACd,WAMA,QACyE;AACzE,QAAM,gBAAgB,UAAU,gBAAgB;AAChD,QAAM,eAAe,UAAU,eAAe;AAC9C,QAAM,eACJ,OAAO,UAAU,SAAS,oBAAoB,YAC9C,OAAO,SAAS,UAAU,QAAQ,eAAe,IAC7C,KAAK,IAAI,GAAG,KAAK,MAAM,UAAU,QAAQ,eAAe,CAAC,IACzD,UAAU,YAAY;AAC5B,SAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,oBAAoB;AAAA,IACpB,OAAO,SACH,gBAAgB,aAAa,sBAC7B,WAAW,YAAY;AAAA,EAC7B;AACF;AAIA,eAAe,gBAAgB,WAAsC;AACnE,QAAM,MAAgB,CAAC;AACvB,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,SAAS;AAClC,QAAI,KAAK,eAAe,GAAG;AACzB,YAAM,IAAI,MAAM,oCAAoC,SAAS,EAAE;AAAA,IACjE;AACA,QAAI,CAAC,KAAK,YAAY,EAAG,QAAO;AAAA,EAClC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAS,wBAAwB,KAAK,IAAI,OAAO,GAAG;AACrE,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,KAAK,KAA4B;AAC9C,QAAI;AACJ,QAAI;AACF,gBAAW,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACvD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,SAAS,SAAS;AAC3B,UAAI,MAAM,eAAe,EAAG;AAC5B,UAAI,+BAA+B,MAAM,IAAI,EAAG;AAChD,YAAM,OAAO,KAAK,KAAK,KAAK,MAAM,IAAI;AACtC,UAAI,MAAM,YAAY,GAAG;AAEvB,YACE,MAAM,SAAS,WACf,MAAM,SAAS,aACf,MAAM,SAAS,gBACf,MAAM,SAAS,OACf;AACF,cAAM,KAAK,IAAI;AAAA,MACjB,WAAW,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG;AACvD,YAAI,KAAK,IAAI;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,SAAS;AACpB,SAAO;AACT;","names":[]}

package/dist/{chunk-UQDG3YLN.js → chunk-PRU7OF3Y.js}

@@ -8,11 +8,11 @@ import {
 } from "./chunk-OQJKY3Z5.js";
 import {
   resolveDefaultNamespaceRoot
-} from "./chunk-FUFAXVBA.js";
+} from "./chunk-RI2KCQHP.js";
 import {
   StorageManager,
   readRawMemoryDocument
-} from "./chunk-PAZ35RJ4.js";
+} from "./chunk-4SCZZ3U7.js";
 import {
   parseContinuityImprovementLoops
 } from "./chunk-LDXUBPMO.js";
@@ -1869,4 +1869,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-UQDG3YLN.js.map
+//# sourceMappingURL=chunk-PRU7OF3Y.js.map

package/dist/{chunk-EU534WGS.js → chunk-PVHQSLNN.js}

@@ -1,21 +1,21 @@
 import {
   resolveWorkProductLedgerDir,
   validateWorkProductLedgerEntry
-} from "./chunk-G7NYVKD6.js";
+} from "./chunk-B2NXOVZN.js";
 import {
   TranscriptManager
-} from "./chunk-Q4E24IRR.js";
+} from "./chunk-HDN7IVIO.js";
 import {
   resolveCommitmentLedgerDir,
   validateCommitmentLedgerEntry
-} from "./chunk-NHLLKEKK.js";
+} from "./chunk-ZAJLJ35W.js";
 import {
   parseConfig
-} from "./chunk-JPTPS4OB.js";
+} from "./chunk-VPXIKBPX.js";
 import {
   resolveObjectiveStateStoreDir,
   validateObjectiveStateSnapshot
-} from "./chunk-HM7RHKS4.js";
+} from "./chunk-4RNBLLZR.js";
 import {
   assertIsoRecordedAt,
   assertSafePathSegment,
@@ -28,7 +28,7 @@ import {
 import {
   listJsonFiles,
   readJsonFile
-} from "./chunk-B6O2YLUR.js";
+} from "./chunk-2Z5DIDQD.js";
 
 // src/resume-bundles.ts
 import path from "path";
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-EU534WGS.js.map
+//# sourceMappingURL=chunk-PVHQSLNN.js.map

package/dist/{chunk-5VC7J76U.js → chunk-QPH52AZB.js}

@@ -10,7 +10,7 @@ import {
 import {
   readJsonFile,
   writeJsonFileAtomic
-} from "./chunk-B6O2YLUR.js";
+} from "./chunk-2Z5DIDQD.js";
 import {
   isPathInsideStorageRoot,
   isSafeLegacyPathSegment
@@ -131,4 +131,4 @@ export {
   readHarmonicSourceMemory,
   readUnresolvedHarmonicSources
 };
-//# sourceMappingURL=chunk-5VC7J76U.js.map
+//# sourceMappingURL=chunk-QPH52AZB.js.map

package/dist/{chunk-XISROV24.js → chunk-QSEUUQUF.js}

@@ -1,6 +1,6 @@
 import {
   listNamespaces
-} from "./chunk-GELS5Z5Z.js";
+} from "./chunk-V3TXIXXY.js";
 import {
   capabilityAllowsNamespace
 } from "./chunk-IG747LRN.js";
@@ -282,4 +282,4 @@ export {
   computeServiceCorpusWatermarks,
   computeServiceCorpusCensus
 };
-//# sourceMappingURL=chunk-XISROV24.js.map
+//# sourceMappingURL=chunk-QSEUUQUF.js.map

package/dist/chunk-QUIRIG2P.js

@@ -0,0 +1,31 @@
+// src/utils/macos-replication-junk.ts
+var warnedJunkDirectories = /* @__PURE__ */ new Set();
+function isMacOsReplicationJunkBasename(basename) {
+  return basename === ".DS_Store" || basename.startsWith("._");
+}
+function withoutMacOsReplicationJunk(entries, basenameOf) {
+  const kept = [];
+  let ignored = 0;
+  for (const entry of entries) {
+    if (isMacOsReplicationJunkBasename(basenameOf(entry))) {
+      ignored += 1;
+      continue;
+    }
+    kept.push(entry);
+  }
+  return { kept, ignored };
+}
+function warnIgnoredMacOsReplicationJunk(directoryKey, count, warn) {
+  if (count <= 0) return;
+  const key = `${directoryKey}\0${count}`;
+  if (warnedJunkDirectories.has(key)) return;
+  warnedJunkDirectories.add(key);
+  warn(`ignored ${count} macOS replication junk file(s) (._* and .DS_Store)`);
+}
+
+export {
+  isMacOsReplicationJunkBasename,
+  withoutMacOsReplicationJunk,
+  warnIgnoredMacOsReplicationJunk
+};
+//# sourceMappingURL=chunk-QUIRIG2P.js.map

package/dist/chunk-QUIRIG2P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/macos-replication-junk.ts"],"sourcesContent":["/**\n * macOS Finder metadata that arrives through Mac-to-Linux copies.\n *\n * AppleDouble sidecars are named `._` plus the real file's basename\n * (`._project-notes.md` beside `project-notes.md`). Finder also writes\n * `.DS_Store` into any directory it opens. Neither is a Remnic record.\n * Directory scanners and replication must ignore them so they are never\n * parsed as entities, memories, or sync objects.\n *\n * QMD's own indexer already drops every hidden path (`dot: false` plus a\n * hidden-segment filter). Callers that build index inputs themselves still\n * use this helper so the non-QMD scanners stay in parity.\n */\n\nconst warnedJunkDirectories = new Set<string>();\n\n/** True for an AppleDouble sidecar or a Finder `.DS_Store` file. */\nexport function isMacOsReplicationJunkBasename(basename: string): boolean {\n  return basename === \".DS_Store\" || basename.startsWith(\"._\");\n}\n\n/** True when the final path segment is macOS replication junk. */\nexport function isMacOsReplicationJunkRelativePath(relPath: string): boolean {\n  const normalized = relPath.includes(\"\\\\\") ? relPath.replaceAll(\"\\\\\", \"/\") : relPath;\n  const slash = normalized.lastIndexOf(\"/\");\n  const basename = slash === -1 ? normalized : normalized.slice(slash + 1);\n  return isMacOsReplicationJunkBasename(basename);\n}\n\n/**\n * Drop junk names from a directory listing. `ignored` is the count of\n * names removed, so the caller can emit one summary warning.\n */\nexport function withoutMacOsReplicationJunk<T>(\n  entries: readonly T[],\n  basenameOf: (entry: T) => string\n): { kept: T[]; ignored: number } {\n  const kept: T[] = [];\n  let ignored = 0;\n  for (const entry of entries) {\n    if (isMacOsReplicationJunkBasename(basenameOf(entry))) {\n      ignored += 1;\n      continue;\n    }\n    kept.push(entry);\n  }\n  return { kept, ignored };\n}\n\n/**\n * Emit at most one junk warning per directory and count. A later scan of\n * the same directory (entity migration, then entity load) stays quiet\n * instead of repeating the same summary.\n */\nexport function warnIgnoredMacOsReplicationJunk(\n  directoryKey: string,\n  count: number,\n  warn: (message: string) => void\n): void {\n  if (count <= 0) return;\n  const key = `${directoryKey}\\0${count}`;\n  if (warnedJunkDirectories.has(key)) return;\n  warnedJunkDirectories.add(key);\n  warn(`ignored ${count} macOS replication junk file(s) (._* and .DS_Store)`);\n}\n"],"mappings":";AAcA,IAAM,wBAAwB,oBAAI,IAAY;AAGvC,SAAS,+BAA+B,UAA2B;AACxE,SAAO,aAAa,eAAe,SAAS,WAAW,IAAI;AAC7D;AAcO,SAAS,4BACd,SACA,YACgC;AAChC,QAAM,OAAY,CAAC;AACnB,MAAI,UAAU;AACd,aAAW,SAAS,SAAS;AAC3B,QAAI,+BAA+B,WAAW,KAAK,CAAC,GAAG;AACrD,iBAAW;AACX;AAAA,IACF;AACA,SAAK,KAAK,KAAK;AAAA,EACjB;AACA,SAAO,EAAE,MAAM,QAAQ;AACzB;AAOO,SAAS,gCACd,cACA,OACA,MACM;AACN,MAAI,SAAS,EAAG;AAChB,QAAM,MAAM,GAAG,YAAY,KAAK,KAAK;AACrC,MAAI,sBAAsB,IAAI,GAAG,EAAG;AACpC,wBAAsB,IAAI,GAAG;AAC7B,OAAK,WAAW,KAAK,qDAAqD;AAC5E;","names":[]}

package/dist/{chunk-FUFAXVBA.js → chunk-RI2KCQHP.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-PAZ35RJ4.js";
+} from "./chunk-4SCZZ3U7.js";
 import {
   keyring_exports,
   secureStoreDir
@@ -20,6 +20,9 @@ import {
   resolveNamespaceCapabilities,
   resolveRecallAuxiliaryCapabilities
 } from "./chunk-C5LWPYS3.js";
+import {
+  isMacOsReplicationJunkBasename
+} from "./chunk-QUIRIG2P.js";
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
@@ -42,6 +45,7 @@ async function hasStoredEntries(p) {
     if (!entry.isDirectory()) return true;
     const children = await readdir(p, { withFileTypes: true });
     for (const child of children) {
+      if (isMacOsReplicationJunkBasename(child.name)) continue;
       const childPath = path.join(p, child.name);
       if (child.isSymbolicLink() || child.isFile()) return true;
       if (child.isDirectory() && await hasStoredEntries(childPath)) return true;
@@ -412,4 +416,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-FUFAXVBA.js.map
+//# sourceMappingURL=chunk-RI2KCQHP.js.map

package/dist/chunk-RI2KCQHP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import { resolveNamespaceCapabilities, resolveRecallAuxiliaryCapabilities } from \"../capabilities.js\";\nimport path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport { keyring, secureStoreDir } from \"../secure-store/index.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { isMacOsReplicationJunkBasename } from \"../utils/macos-replication-junk.js\";\nimport {\n  namespaceIdentityLegacyToken,\n  namespaceIdentityToken,\n  normalizeNamespaceIdentity,\n} from \"./identity.js\";\nimport type { NamespaceCatalog } from \"./catalog.js\";\nimport { MutationSerializer } from \"../utils/serialize-mutations.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      if (isMacOsReplicationJunkBasename(child.name)) continue;\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!resolveNamespaceCapabilities(config).namespaces) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const defaultNfdIdentity = defaultIdentity.normalize(\"NFD\");\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const legacyNfdNsDir = resolveNamespaceDir(config.memoryDir, defaultNfdIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(defaultIdentity),\n  );\n  const legacyTokenNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityLegacyToken(defaultNfdIdentity),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const legacyTokenHasData =\n    (await exists(legacyTokenNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(legacyTokenNsDir, { includeRuntimeState: true }));\n  const legacyHasData =\n    (await exists(legacyNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(legacyNsDir, { includeRuntimeState: true }));\n  const legacyNfdHasData =\n    legacyNfdNsDir !== legacyNsDir &&\n    (await exists(legacyNfdNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(legacyNfdNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : legacyTokenHasData\n      ? legacyTokenNsDir\n      : legacyHasData\n        ? legacyNsDir\n        : legacyNfdHasData\n          ? legacyNfdNsDir\n          : (await exists(legacyNsDir))\n            ? legacyNsDir\n            : legacyNfdNsDir !== legacyNsDir && (await exists(legacyNfdNsDir))\n              ? legacyNfdNsDir\n              : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!resolveNamespaceCapabilities(config).namespaces) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const normalized = normalizeNamespaceIdentity(namespace);\n  const legacyExactNamespace = namespace.trim();\n  const legacyNfdNamespace = normalized.normalize(\"NFD\");\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, normalized);\n  const legacyExactRoot =\n    legacyExactNamespace !== normalized && isSafeRouteNamespace(legacyExactNamespace)\n      ? resolveNamespaceDir(config.memoryDir, legacyExactNamespace)\n      : null;\n  const legacyNfdRoot =\n    legacyNfdNamespace !== normalized\n      ? resolveNamespaceDir(config.memoryDir, legacyNfdNamespace)\n      : null;\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(normalized));\n  const legacyTokenRoots = [\n    namespaceIdentityLegacyToken(legacyExactNamespace),\n    namespaceIdentityLegacyToken(legacyNfdNamespace),\n  ]\n    .filter((token, index, tokens) => tokens.indexOf(token) === index)\n    .map((token) => resolveNamespaceDir(config.memoryDir, token));\n  for (const candidate of [tokenizedRoot, ...legacyTokenRoots]) {\n    if (\n      (await exists(candidate)) &&\n      (await hasAnyNamespaceStorageMarker(candidate, { includeRuntimeState: true }))\n    ) {\n      return candidate;\n    }\n  }\n  for (const candidate of [legacyRoot, legacyExactRoot, legacyNfdRoot]) {\n    if (candidate && (await exists(candidate))) return candidate;\n  }\n  return tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // Instance-scoped serializer for the resolve hook (issue #1524 adoption).\n  // Replaces the bespoke `inFlightResolved` marker-then-clear pattern: the\n  // serializer's per-key chain strictly orders concurrent notifications for the\n  // SAME namespace, and the task re-checks `notifiedResolved` once it runs, so a\n  // burst of cache hits before the first hook settles collapses to a single\n  // hook invocation (the once-per-namespace intent). Recovery is preserved —\n  // one rejected hook never poisons subsequent notifications for that key.\n  private readonly resolveSerializer = new MutationSerializer();\n  // (namespace, storageDir) pairs whose resolve hook is currently pending. Set SYNCHRONOUSLY in\n  // notifyResolved (before queueing) so a burst of concurrent storageFor()\n  // cache hits collapses onto the one in-flight hook instead of each enqueuing\n  // its own task. Cleared when the queued hook settles. Without this, a dropped\n  // hook (returns false on a rebuild-lock timeout) leaves notifiedResolved\n  // unset, so every queued sibling task would re-run the hook — N serial lock\n  // waits (cursor Medium 06f58a7c, codex P2).\n  private readonly inFlightResolveHooks = new Set<string>();\n  // Tracks every in-flight resolve-hook promise so callers can deterministically\n  // await the fire-and-forget registrations that `storageFor()` kicks off (see\n  // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the\n  // set holds at most one promise per concurrently-resolving namespace.\n  private readonly pendingResolveHooks = new Set<Promise<unknown>>();\n  // Pending post-write catalog touch promises (#1522). Like pendingResolveHooks,\n  // lets tests await fire-and-forget write touches deterministically.\n  private readonly pendingWriteTouches = new Set<Promise<unknown>>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  /** #2019: hook fired when a new namespace storage is created via storageFor. */\n  onStorageCreated?: (storage: StorageManager, namespace: string) => void;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n    /** Catalog reference for post-write/read touches (issue #1522 chokepoint). */\n    private readonly catalog?: NamespaceCatalog,\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!resolveNamespaceCapabilities(this.config).namespaces) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        await this.applySecureStoreConfig(cached);\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        await this.applySecureStoreConfig(cached);\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    // Pass the hot-memories cache gate explicitly (issue #1902, Codex P2): a\n    // per-namespace child root is never registered in the per-dir default map,\n    // so without this it would fall back to the process-wide default and ignore\n    // THIS daemon's hotMemoriesCacheEnabled config. Threading it from config\n    // keeps every namespace storage aligned with its owning orchestrator.\n    const sm = new StorageManager(\n      root,\n      this.config.entitySchemas,\n      this.config.hotMemoriesCacheEnabled,\n    );\n    // Register this child root's gate AND TTL in the per-dir maps (issue #1902,\n    // Codex P2). The constructor override above fixes the child's own gate, but\n    // its TTL is resolved via the per-dir map (hotCacheTtlMs); an unregistered\n    // child root would fall back to the last process-wide TTL and could inherit\n    // another daemon's value. Registering keyed by root keeps both per-dir.\n    StorageManager.setHotMemoriesCacheDefault(\n      root,\n      this.config.hotMemoriesCacheEnabled,\n      this.config.hotMemoriesCacheTtlMs,\n    );\n    const { scopedCacheInvalidationEnabled } = this.config;\n    StorageManager.setScopedCacheInvalidationDefault(root, scopedCacheInvalidationEnabled);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    // #1522: install the post-write catalog touch at the chokepoint — every\n    // successful write on this StorageManager records the namespace touch.\n    this.bindCatalogWriteHook(sm, ns);\n    // #1579: apply the tombstone non-resurrection config so every namespace\n    // storage enforces the invariant at its own writeMemory chokepoint.\n    this.applyTombstonesConfig(sm, ns);\n    // #2033: install the secure-store context on router-created stores. The\n    // orchestrator keys ONLY its primary default-namespace storage; without\n    // this, a store resolved through the router reads isSecureStoreUnlocked()\n    // === false even after the operator unlocked the keyring, so secure-store\n    // recovery paths (e.g. the CLI lifecycle-ledger rebuild) refuse an encrypted\n    // ledger they could actually rewrite, and namespace writes could silently\n    // fall back to plaintext. Mirror the orchestrator's setup exactly.\n    await this.applySecureStoreConfig(sm);\n    this.cache.set(ns, sm);\n    // #2019: let the orchestrator wire write-triggered prioritized embedding on\n    // every router-created namespace storage, not just the primary default store.\n    this.onStorageCreated?.(sm, ns);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   *\n   * Issue #1524 adoption: hook invocations for the SAME namespace are now\n   * strictly ordered through the shared `MutationSerializer` rather than the\n   * bespoke `inFlightResolved` marker-then-clear pattern. The serializer\n   * guarantees one in-flight hook per namespace; a concurrent burst of\n   * `storageFor()` cache hits collapses to a single hook invocation because\n   * each queued task re-checks `notifiedResolved` before invoking the hook. A\n   * dropped (`false`) or rejected hook leaves `notifiedResolved` unset so the\n   * next `storageFor()` retries — the serializer recovers from the rejection,\n   * so a failed hook never poisons later notifications.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Permanent dedup: skip once we've SUCCESSFULLY notified this exact\n    // (namespace, storageDir). A changed dir (rare: migration/realignment)\n    // still re-fires once. The mark is set ONLY AFTER the hook succeeds, so a\n    // dropped registration (e.g. rebuild-lock timeout) is RETRIED on the next\n    // cache hit instead of being suppressed forever (round 6, cursor Medium —\n    // ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (cursor Medium 06f58a7c, codex P2): if a hook for THIS\n    // namespace is already pending, collapse this call onto it instead of\n    // enqueueing another task. The serializer strictly orders queued tasks, but\n    // ordering alone is not enough — when the first hook returns `false`\n    // (dropped touch, e.g. rebuild-lock timeout), `notifiedResolved` stays\n    // unset, so each queued sibling task would pass its re-check and re-run the\n    // hook. With the real catalog hook each retry can spend the full lock wait,\n    // so N cache hits during a rebuild leave N serial background lock attempts.\n    // Collapsing here means at most ONE hook runs per in-flight registration;\n    // its result (set `notifiedResolved` on success, leave unset on drop)\n    // decides whether a LATER `storageFor()` retries — collapsing loses\n    // nothing because the drop is already retried on the next cache hit.\n    // Keyed by the composite (namespace, storageDir) so a CHANGED dir\n    // (migration/realignment) for the same namespace still gets its own hook —\n    // it is NOT collapsed onto the old dir's pending registration (cursor\n    // Medium, codex P2).\n    const inFlightKey = namespace + \"\\u0000\" + storageDir;\n    if (this.inFlightResolveHooks.has(inFlightKey)) return;\n    this.inFlightResolveHooks.add(inFlightKey);\n    // Queue through the serializer. Concurrent calls for the same namespace\n    // strictly order here; the 2nd call's task runs only after the 1st's hook\n    // settles, by which point `notifiedResolved` is either set (no-op) or still\n    // unset (retry). The returned promise is tracked for\n    // `whenResolveHooksSettled()`. Rejections from the task body are caught so\n    // they never reach the caller (best-effort hook contract); the serializer's\n    // recovered tail still lets subsequent notifications run.\n    const task = async (): Promise<void> => {\n      // Re-check after queueing: a prior task in this same chain may have just\n      // marked the pair as notified.\n      if (this.notifiedResolved.get(namespace) === storageDir) return;\n      try {\n        // Hook may be sync or async; Promise.resolve normalizes both. A result\n        // of `false` means the registration was dropped/no-op (e.g. rebuild-lock\n        // timeout) — leave notifiedResolved UNSET so the next storageFor retries\n        // (round 6, codex P2 — NEFoX). `void`/`undefined` is success for legacy\n        // hooks. A rejection leaves notifiedResolved unset for the same reason.\n        const persisted = await Promise.resolve(hook(namespace, storageDir));\n        if (persisted !== false) {\n          this.notifiedResolved.set(namespace, storageDir);\n        }\n      } catch {\n        // Best-effort: a hook failure MUST NOT crash storage resolution. Leave\n        // notifiedResolved unset so a later storageFor retries the registration.\n      }\n    };\n    const queued = this.resolveSerializer.serialize(namespace, task);\n    this.pendingResolveHooks.add(queued);\n    // Clear the in-flight marker when the hook settles so a subsequent\n    // storageFor() can retry after a drop, or short-circuit via notifiedResolved\n    // after a success.\n    const cleanup = (): void => {\n      this.inFlightResolveHooks.delete(inFlightKey);\n      this.pendingResolveHooks.delete(queued);\n    };\n    void queued.then(cleanup, cleanup);\n  }\n\n  /**\n   * Install the post-write catalog touch hook on an externally-constructed\n   * StorageManager (issue #1522). Used by the orchestrator for the legacy\n   * default-namespace storage (`this.storage`) that bypasses the router.\n   */\n  bindCatalogWriteHook(sm: StorageManager, namespace: string): void {\n    // Issue #1903: pure state-file writes only touch the catalog when explicitly\n    // opted in. Router-created storages (storageFor) and the legacy default\n    // storage both flow through here, so this is the single wiring point.\n    sm.touchStateWrites = this.config.namespacesCatalogTouchStateWrites === true;\n    sm.onCatalogWrite = () => this.touchCatalogWrite(namespace, sm.dir);\n  }\n\n  /**\n   * Install the tombstone config on an externally-constructed StorageManager\n   * (issue #1579). Mirrors `bindCatalogWriteHook` — used for the legacy\n   * default-namespace storage that bypasses the router. Router-created\n   * storages are wired inline in `storageFor()` via `applyTombstonesConfig`.\n   */\n  bindTombstonesConfig(\n    sm: StorageManager,\n    namespace: string,\n    config: { enabled: boolean; semanticMatch: boolean; semanticThreshold: number },\n  ): void {\n    this.tombstonesGlobalConfig = { ...config };\n    sm.setTombstonesConfig({ ...config, namespace });\n  }\n\n  private tombstonesGlobalConfig: {\n    enabled: boolean;\n    semanticMatch: boolean;\n    semanticThreshold: number;\n  } = { enabled: false, semanticMatch: false, semanticThreshold: 0.9 };\n\n  /**\n   * Apply the tombstone config to a router-created StorageManager. Called\n   * inline in `storageFor()` so every namespace storage enforces the\n   * non-resurrection invariant, namespace-scoped (rule 42).\n   */\n  private applyTombstonesConfig(sm: StorageManager, namespace: string): void {\n    sm.setTombstonesConfig({ ...this.tombstonesGlobalConfig, namespace });\n  }\n\n  /**\n   * Install the at-rest secure-store context on a router-created StorageManager\n   * (#2033). Mirrors the orchestrator's primary-storage setup: mark the store\n   * required so a locked store throws instead of silently writing plaintext, and\n   * install the master key when the process-local keyring already holds it (the\n   * operator unlocked). The secure store is one key per memory ROOT (single\n   * header + per-file path-bound AAD), so every namespace store keys off the\n   * root keyring id — exactly the id the orchestrator and `secure-store unlock`\n   * register under. No-op when secure-store is disabled.\n   */\n  private async applySecureStoreConfig(sm: StorageManager): Promise<void> {\n    if (!resolveRecallAuxiliaryCapabilities(this.config).secureStore) return;\n    sm.setSecureStoreRequired(true);\n    const existingKey = keyring.getKey(secureStoreDir(this.config.memoryDir));\n    if (existingKey) {\n      await sm.setSecureStoreKeyAndWait(existingKey, this.config.secureStoreEncryptOnWrite);\n    }\n  }\n\n  /**\n   * Post-write catalog touch (issue #1522 chokepoint). Called by every\n   * StorageManager's post-write hook AFTER a successful write. Best-effort\n   * and failure-tolerant — a catalog error MUST NOT affect the primary write\n   * (gotcha #13, rule #40). Fire-and-forget by design.\n   */\n  private touchCatalogWrite(namespace: string, storageDir: string): void {\n    if (!this.catalog) return;\n    const touch = this.catalog\n      .markWrite(namespace, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Record a namespace read in the catalog (issue #1522 chokepoint move).\n   * Best-effort and failure-tolerant. Used by recall paths so the read touch\n   * lives in the storage layer, not at the caller.\n   */\n  recordRead(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    void this.catalog\n      .markRead(ns, { discoveredBy: \"read\", storageDir })\n      .catch(() => undefined);\n  }\n  /**\n   * Record a namespace write touch in the catalog (issue #1522). Best-effort\n   * and failure-tolerant. Used by consolidation/cleanup passes that may mutate\n   * the store via delete-only paths (e.g. entity-file merges, TTL cleanup) so\n   * the namespace's lastWriteAt stays fresh even when no explicit write went\n   * through the storage chokepoint. This is NOT a substitute for the chokepoint\n   * — it's a belt-and-suspenders for paths the chokepoint doesn't cover.\n   */\n  recordWrite(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    const touch = this.catalog\n      .markWrite(ns, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Resolve once every in-flight post-write catalog touch has settled (#1522).\n   * Mirrors `whenResolveHooksSettled()`: the StorageManager's post-write hook\n   * fires the catalog touch fire-and-forget, so tests asserting lastWriteAt\n   * moved should await this instead of racing a timer.\n   */\n  async whenWriteTouchesSettled(): Promise<void> {\n    // Flush any coalesced (buffered) touches first so their appends join the\n    // pending set below — otherwise this could resolve while a buffered touch's\n    // lastWriteAt is still unwritten on disk (#1903, Cursor). No-op when\n    // coalescing is disabled (window 0) or the catalog is inert.\n    await this.catalog?.flushPendingTouches().catch(() => undefined);\n    while (this.pendingWriteTouches.size > 0) {\n      await Promise.allSettled([...this.pendingWriteTouches]);\n    }\n  }\n\n  /**\n   * Resolve once every in-flight `onResolve` registration has settled.\n   *\n   * `storageFor()` fires the resolve hook fire-and-forget, so its catalog side\n   * effect (e.g. `registerResolved(...)`) is not observable the moment\n   * `storageFor()` returns. Callers that must act on that side effect — notably\n   * tests asserting the catalog was updated — should await this instead of\n   * racing a timer. Resolves immediately when no hook is registered or nothing\n   * is in flight. The loop re-checks because a settling hook could, in\n   * principle, trigger a follow-on resolution.\n   */\n  async whenResolveHooksSettled(): Promise<void> {\n    while (this.pendingResolveHooks.size > 0) {\n      await Promise.allSettled([...this.pendingResolveHooks]);\n    }\n  }\n\n  /**\n   * #2019: iterate the currently cached router storages with their namespace so\n   * callers can wire hooks on stores resolved before the hook was installed.\n   */\n  forEachCachedStorage(fn: (storage: StorageManager, namespace: string) => void): void {\n    for (const [namespace, storage] of this.cache) fn(storage, namespace);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AAevC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,UAAI,+BAA+B,MAAM,IAAI,EAAG;AAChD,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,6BAA6B,MAAM,EAAE,YAAY;AACpD,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,qBAAqB,gBAAgB,UAAU,KAAK;AAC1D,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB,oBAAoB,OAAO,WAAW,kBAAkB;AAC/E,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,eAAe;AAAA,EACxC;AACA,QAAM,mBAAmB;AAAA,IACvB,OAAO;AAAA,IACP,6BAA6B,kBAAkB;AAAA,EACjD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,qBACH,MAAM,OAAO,gBAAgB,KAC7B,MAAM,6BAA6B,kBAAkB,EAAE,qBAAqB,KAAK,CAAC;AACrF,QAAM,gBACH,MAAM,OAAO,WAAW,KACxB,MAAM,6BAA6B,aAAa,EAAE,qBAAqB,KAAK,CAAC;AAChF,QAAM,mBACJ,mBAAmB,eAClB,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACA,qBACE,mBACA,gBACE,cACA,mBACE,iBACC,MAAM,OAAO,WAAW,IACvB,cACA,mBAAmB,eAAgB,MAAM,OAAO,cAAc,IAC5D,iBACA;AACd,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO,OAAO;AAIpE,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,2BAA2B,SAAS;AACvD,QAAM,uBAAuB,UAAU,KAAK;AAC5C,QAAM,qBAAqB,WAAW,UAAU,KAAK;AACrD,QAAM,aAAa,oBAAoB,OAAO,WAAW,UAAU;AACnE,QAAM,kBACJ,yBAAyB,cAAc,qBAAqB,oBAAoB,IAC5E,oBAAoB,OAAO,WAAW,oBAAoB,IAC1D;AACN,QAAM,gBACJ,uBAAuB,aACnB,oBAAoB,OAAO,WAAW,kBAAkB,IACxD;AACN,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,UAAU,CAAC;AAC9F,QAAM,mBAAmB;AAAA,IACvB,6BAA6B,oBAAoB;AAAA,IACjD,6BAA6B,kBAAkB;AAAA,EACjD,EACG,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,QAAQ,KAAK,MAAM,KAAK,EAChE,IAAI,CAAC,UAAU,oBAAoB,OAAO,WAAW,KAAK,CAAC;AAC9D,aAAW,aAAa,CAAC,eAAe,GAAG,gBAAgB,GAAG;AAC5D,QACG,MAAM,OAAO,SAAS,KACtB,MAAM,6BAA6B,WAAW,EAAE,qBAAqB,KAAK,CAAC,GAC5E;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACA,aAAW,aAAa,CAAC,YAAY,iBAAiB,aAAa,GAAG;AACpE,QAAI,aAAc,MAAM,OAAO,SAAS,EAAI,QAAO;AAAA,EACrD;AACA,SAAO;AACT;AAEO,IAAM,yBAAN,MAA6B;AAAA,EA2ClC,YACmB,QACA,QAAqC,CAAC,GAEtC,SACjB;AAJiB;AACA;AAEA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EANmB;AAAA,EACA;AAAA,EAEA;AAAA,EA9CF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,oBAAoB,IAAI,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,uBAAuB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvC,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA,EAGhD,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD;AAAA;AAAA,EAGjB;AAAA,EAWA,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,6BAA6B,KAAK,MAAM,EAAE,WAAY,QAAO,KAAK,OAAO;AAC9E,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,cAAM,KAAK,uBAAuB,MAAM;AACxC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,cAAM,KAAK,uBAAuB,MAAM;AACxC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAOA,UAAM,KAAK,IAAI;AAAA,MACb;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AAMA,mBAAe;AAAA,MACb;AAAA,MACA,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO;AAAA,IACd;AACA,UAAM,EAAE,+BAA+B,IAAI,KAAK;AAChD,mBAAe,kCAAkC,MAAM,8BAA8B;AAIrF,OAAG,mBAAmB,KAAK,OAAO;AAGlC,SAAK,qBAAqB,IAAI,EAAE;AAGhC,SAAK,sBAAsB,IAAI,EAAE;AAQjC,UAAM,KAAK,uBAAuB,EAAE;AACpC,SAAK,MAAM,IAAI,IAAI,EAAE;AAGrB,SAAK,mBAAmB,IAAI,EAAE;AAC9B,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAOX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAiBzD,UAAM,cAAc,YAAY,OAAW;AAC3C,QAAI,KAAK,qBAAqB,IAAI,WAAW,EAAG;AAChD,SAAK,qBAAqB,IAAI,WAAW;AAQzC,UAAM,OAAO,YAA2B;AAGtC,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,UAAI;AAMF,cAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC;AACnE,YAAI,cAAc,OAAO;AACvB,eAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,QACjD;AAAA,MACF,QAAQ;AAAA,MAGR;AAAA,IACF;AACA,UAAM,SAAS,KAAK,kBAAkB,UAAU,WAAW,IAAI;AAC/D,SAAK,oBAAoB,IAAI,MAAM;AAInC,UAAM,UAAU,MAAY;AAC1B,WAAK,qBAAqB,OAAO,WAAW;AAC5C,WAAK,oBAAoB,OAAO,MAAM;AAAA,IACxC;AACA,SAAK,OAAO,KAAK,SAAS,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,IAAoB,WAAyB;AAIhE,OAAG,mBAAmB,KAAK,OAAO,sCAAsC;AACxE,OAAG,iBAAiB,MAAM,KAAK,kBAAkB,WAAW,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,qBACE,IACA,WACA,QACM;AACN,SAAK,yBAAyB,EAAE,GAAG,OAAO;AAC1C,OAAG,oBAAoB,EAAE,GAAG,QAAQ,UAAU,CAAC;AAAA,EACjD;AAAA,EAEQ,yBAIJ,EAAE,SAAS,OAAO,eAAe,OAAO,mBAAmB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3D,sBAAsB,IAAoB,WAAyB;AACzE,OAAG,oBAAoB,EAAE,GAAG,KAAK,wBAAwB,UAAU,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,uBAAuB,IAAmC;AACtE,QAAI,CAAC,mCAAmC,KAAK,MAAM,EAAE,YAAa;AAClE,OAAG,uBAAuB,IAAI;AAC9B,UAAM,cAAc,gBAAQ,OAAO,eAAe,KAAK,OAAO,SAAS,CAAC;AACxE,QAAI,aAAa;AACf,YAAM,GAAG,yBAAyB,aAAa,KAAK,OAAO,yBAAyB;AAAA,IACtF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,WAAmB,YAA0B;AACrE,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,QAAQ,KAAK,QAChB,UAAU,WAAW,EAAE,cAAc,SAAS,WAAW,CAAC,EAC1D,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAmB,YAA2B;AACvD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,SAAK,KAAK,QACP,SAAS,IAAI,EAAE,cAAc,QAAQ,WAAW,CAAC,EACjD,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,WAAmB,YAA2B;AACxD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,UAAM,QAAQ,KAAK,QAChB,UAAU,IAAI,EAAE,cAAc,SAAS,WAAW,CAAC,EACnD,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,0BAAyC;AAK7C,UAAM,KAAK,SAAS,oBAAoB,EAAE,MAAM,MAAM,MAAS;AAC/D,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAqB,IAAgE;AACnF,eAAW,CAAC,WAAW,OAAO,KAAK,KAAK,MAAO,IAAG,SAAS,SAAS;AAAA,EACtE;AACF;","names":[]}

package/dist/{chunk-QX6JN3O4.js → chunk-RP7PQWZM.js}

@@ -1,7 +1,7 @@
 import {
   buildStandup,
   parseStandupDate
-} from "./chunk-JDZFIR2S.js";
+} from "./chunk-5KGYTX5O.js";
 import {
   backfillMemoryStorage,
   runLocationBackfill,
@@ -9,23 +9,23 @@ import {
   runLocationDay,
   runLocationStatus,
   runLocationSync
-} from "./chunk-KR6ZKECI.js";
+} from "./chunk-XYGQSDTH.js";
 import {
   externalWikiSearchOperation
-} from "./chunk-4OSG5Y6M.js";
+} from "./chunk-DPSOFK4D.js";
 import {
   DECISION_SUBCOMMANDS,
   DELTA_SUBCOMMANDS,
   defineOperation,
   isCodegraphToolName
-} from "./chunk-ZV65I6ME.js";
+} from "./chunk-XLBFX63V.js";
 import {
   CorrectionContractError
 } from "./chunk-ETSJD5IV.js";
 import {
   memoryStoreRequestSchema,
   retainedCategoryAlias
-} from "./chunk-W5MCEVUS.js";
+} from "./chunk-RYYVMZBR.js";
 import {
   serializeMutations,
   withHeldFileLock
@@ -1916,4 +1916,4 @@ export {
   codegraphIngestTracesOperation,
   REGISTERED_OPERATIONS
 };
-//# sourceMappingURL=chunk-QX6JN3O4.js.map
+//# sourceMappingURL=chunk-RP7PQWZM.js.map

package/dist/{chunk-O2IPAX26.js → chunk-RTTPBBAN.js}

@@ -1,15 +1,15 @@
 import {
   LanceDbBackend
-} from "./chunk-S7LWX2PQ.js";
+} from "./chunk-655FVTCD.js";
 import {
   MeilisearchBackend
-} from "./chunk-T2YX56QI.js";
+} from "./chunk-GQJKVQJR.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
 import {
   OramaBackend
-} from "./chunk-T3FMRLWQ.js";
+} from "./chunk-HFSPY26A.js";
 import {
   RemoteSearchBackend
 } from "./chunk-7VO6E5UD.js";
@@ -179,4 +179,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-O2IPAX26.js.map
+//# sourceMappingURL=chunk-RTTPBBAN.js.map

package/dist/{chunk-W5MCEVUS.js → chunk-RYYVMZBR.js}

@@ -12,7 +12,7 @@ import {
 import {
   OFFLINE_SYNC_FILE_CONTENT_MAX_CHUNK_BYTES,
   OFFLINE_SYNC_MAX_MTIME_MS
-} from "./chunk-63B2IZYE.js";
+} from "./chunk-23ZQPP2G.js";
 import {
   validateArchiveRelativePath
 } from "./chunk-GCGJW34D.js";
@@ -563,4 +563,4 @@ export {
   actionConfidenceRequestSchema,
   validateRequest
 };
-//# sourceMappingURL=chunk-W5MCEVUS.js.map
+//# sourceMappingURL=chunk-RYYVMZBR.js.map

package/dist/{chunk-WLMZ2L5P.js → chunk-T7ASDYNK.js}

@@ -1,6 +1,6 @@
 import {
   defineOperation
-} from "./chunk-ZV65I6ME.js";
+} from "./chunk-XLBFX63V.js";
 import {
   EngramAccessInputError
 } from "./chunk-3MUKQQ7A.js";
@@ -71,4 +71,4 @@ defineOperation({
     })
   })
 });
-//# sourceMappingURL=chunk-WLMZ2L5P.js.map
+//# sourceMappingURL=chunk-T7ASDYNK.js.map

package/dist/{chunk-P7TOIOT7.js → chunk-THEPGZBM.js}

@@ -3,7 +3,7 @@ import {
   getOperation,
   operationRequiresAuthorizedNamespace,
   operationUsesPrincipalNamespace
-} from "./chunk-ZV65I6ME.js";
+} from "./chunk-XLBFX63V.js";
 import {
   assertOperationAuthorizationAllowed
 } from "./chunk-IG747LRN.js";
@@ -60,4 +60,4 @@ export {
   authorizationProbeNamespaces,
   authorizationProbeRequiresPrincipalNamespace
 };
-//# sourceMappingURL=chunk-P7TOIOT7.js.map
+//# sourceMappingURL=chunk-THEPGZBM.js.map

package/dist/{chunk-QODKDRSP.js → chunk-TMC7HBED.js}

@@ -49,16 +49,16 @@ import {
 } from "./chunk-KIUVEMBI.js";
 import {
   getOperation
-} from "./chunk-ZV65I6ME.js";
+} from "./chunk-XLBFX63V.js";
 import {
   WHO_KNOWS_MCP_TOOLS
-} from "./chunk-4KY5GSMB.js";
+} from "./chunk-4PDTVVSW.js";
 import {
   PROMOTION_CANDIDATES_MCP_TOOLS
 } from "./chunk-STBX5X6B.js";
 import {
   validateRequest
-} from "./chunk-W5MCEVUS.js";
+} from "./chunk-RYYVMZBR.js";
 import {
   SUPPORT_PASSPORT_SOURCE_MEMORY_ID_MAX_LENGTH
 } from "./chunk-PWPIERBM.js";
@@ -3986,4 +3986,4 @@ export {
   MCP_MIGRATED_OPERATIONS,
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-QODKDRSP.js.map
+//# sourceMappingURL=chunk-TMC7HBED.js.map

package/dist/{chunk-I7S55EOB.js → chunk-TPNCXSXP.js}

@@ -2,7 +2,7 @@ import {
   SupportPassportError,
   SupportPassportOwnerCreateGrantRequestSchema,
   getOperation
-} from "./chunk-ZV65I6ME.js";
+} from "./chunk-XLBFX63V.js";
 
 // src/support-passport/access-http.ts
 var OWNER_ROOT = "/engram/v1/support-passport";
@@ -137,4 +137,4 @@ export {
   SUPPORT_PASSPORT_OWNER_HTTP_ROUTES,
   handleSupportPassportOwnerHttp
 };
-//# sourceMappingURL=chunk-I7S55EOB.js.map
+//# sourceMappingURL=chunk-TPNCXSXP.js.map

package/dist/{chunk-SS3IS2JR.js → chunk-UGYUBENJ.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-PAZ35RJ4.js";
+} from "./chunk-4SCZZ3U7.js";
 import {
   composeMemoryEnvelope
 } from "./chunk-5LRV557D.js";
@@ -546,4 +546,4 @@ export {
   setSemanticRulePromotionTestHooks,
   promoteSemanticRuleFromMemory
 };
-//# sourceMappingURL=chunk-SS3IS2JR.js.map
+//# sourceMappingURL=chunk-UGYUBENJ.js.map