@remnic/core 9.17.0 → 9.17.1

package/dist/transfer/types.d.ts

@@ -20,26 +20,26 @@ declare const ExportManifestV1Schema: z.ZodObject<{
         bytes: number;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
+    schemaVersion: 1;
     includesTranscripts: boolean;
 }, {
-    schemaVersion: 1;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
+    schemaVersion: 1;
     includesTranscripts: boolean;
 }>;
 type ExportManifestV1 = z.infer<typeof ExportManifestV1Schema>;
@@ -75,26 +75,26 @@ declare const ExportBundleV1Schema: z.ZodObject<{
             bytes: number;
         }>, "many">;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     }, {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
@@ -109,15 +109,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     };
     records: {
@@ -126,15 +126,15 @@ declare const ExportBundleV1Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        schemaVersion: 1;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
+        schemaVersion: 1;
         includesTranscripts: boolean;
     };
     records: {
@@ -313,16 +313,16 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         peerProfiles: boolean;
     }>;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    description: string;
     id: string;
+    schemaVersion: string;
     version: string;
-    description: string;
     parentCapsule: string | null;
     parent: {
         version: string;
@@ -334,16 +334,16 @@ declare const CapsuleBlockSchema: z.ZodObject<{
         directAnswerEnabled: boolean;
     };
 }, {
-    schemaVersion: string;
     includes: {
         procedural: boolean;
         taxonomy: boolean;
         identityAnchors: boolean;
         peerProfiles: boolean;
     };
+    description: string;
     id: string;
+    schemaVersion: string;
     version: string;
-    description: string;
     parentCapsule: string | null;
     retrievalPolicy: {
         tierWeights: Record<string, number>;
@@ -464,16 +464,16 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             peerProfiles: boolean;
         }>;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -485,16 +485,16 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     }, {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -507,27 +507,25 @@ declare const ExportManifestV2Schema: z.ZodObject<{
         } | null | undefined;
     }>;
 }, "strip", z.ZodTypeAny, {
-    schemaVersion: 2;
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
-    includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         parent: {
             version: string;
@@ -539,28 +537,28 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             directAnswerEnabled: boolean;
         };
     };
-}, {
     schemaVersion: 2;
+    includesTranscripts: boolean;
+}, {
+    format: "openclaw-engram-export";
     createdAt: string;
+    pluginVersion: string;
     files: {
         path: string;
         sha256: string;
         bytes: number;
     }[];
-    format: "openclaw-engram-export";
-    pluginVersion: string;
-    includesTranscripts: boolean;
     capsule: {
-        schemaVersion: string;
         includes: {
             procedural: boolean;
             taxonomy: boolean;
             identityAnchors: boolean;
             peerProfiles: boolean;
         };
+        description: string;
         id: string;
+        schemaVersion: string;
         version: string;
-        description: string;
         parentCapsule: string | null;
         retrievalPolicy: {
             tierWeights: Record<string, number>;
@@ -572,6 +570,8 @@ declare const ExportManifestV2Schema: z.ZodObject<{
             forkRoot: string;
         } | null | undefined;
     };
+    schemaVersion: 2;
+    includesTranscripts: boolean;
 }>;
 type ExportManifestV2 = z.infer<typeof ExportManifestV2Schema>;
 declare const ExportBundleV2Schema: z.ZodObject<{
@@ -683,16 +683,16 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 peerProfiles: boolean;
             }>;
         }, "strip", z.ZodTypeAny, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -704,16 +704,16 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         }, {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -726,27 +726,25 @@ declare const ExportBundleV2Schema: z.ZodObject<{
             } | null | undefined;
         }>;
     }, "strip", z.ZodTypeAny, {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -758,28 +756,28 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
-    }, {
         schemaVersion: 2;
+        includesTranscripts: boolean;
+    }, {
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -791,6 +789,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     }>;
     records: z.ZodArray<z.ZodObject<{
         path: z.ZodString;
@@ -804,27 +804,25 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     manifest: {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             parent: {
                 version: string;
@@ -836,6 +834,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 directAnswerEnabled: boolean;
             };
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     };
     records: {
         content: string;
@@ -843,27 +843,25 @@ declare const ExportBundleV2Schema: z.ZodObject<{
     }[];
 }, {
     manifest: {
-        schemaVersion: 2;
+        format: "openclaw-engram-export";
         createdAt: string;
+        pluginVersion: string;
         files: {
             path: string;
             sha256: string;
             bytes: number;
         }[];
-        format: "openclaw-engram-export";
-        pluginVersion: string;
-        includesTranscripts: boolean;
         capsule: {
-            schemaVersion: string;
             includes: {
                 procedural: boolean;
                 taxonomy: boolean;
                 identityAnchors: boolean;
                 peerProfiles: boolean;
             };
+            description: string;
             id: string;
+            schemaVersion: string;
             version: string;
-            description: string;
             parentCapsule: string | null;
             retrievalPolicy: {
                 tierWeights: Record<string, number>;
@@ -875,6 +873,8 @@ declare const ExportBundleV2Schema: z.ZodObject<{
                 forkRoot: string;
             } | null | undefined;
         };
+        schemaVersion: 2;
+        includesTranscripts: boolean;
     };
     records: {
         content: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@remnic/core",
-  "version": "9.17.0",
+  "version": "9.17.1",
   "description": "Framework-agnostic Remnic memory engine — orchestrator, storage, extraction, search, trust zones",
   "type": "module",
   "main": "dist/index.js",
@@ -3045,7 +3045,7 @@
     "core"
   ],
   "peerDependencies": {
-    "@remnic/coding-graph": "^9.17.0"
+    "@remnic/coding-graph": "^9.17.1"
   },
   "peerDependenciesMeta": {
     "@remnic/coding-graph": {

package/src/offline-sync-impression-drain.test.ts

@@ -8,7 +8,9 @@ import {
   drainPendingImpressionsForOfflineSync,
   drainPendingLifecycleForOfflineSync,
   getOfflineSyncStorage,
+  listOfflineSyncNamespaces,
 } from "./offline-sync-impression-drain.js";
+import { namespaceIdentityToken } from "./namespaces/identity.js";
 import { isEncryptedFile } from "./secure-store/secure-fs.js";
 import { StorageManager } from "./storage.js";
 
@@ -314,3 +316,55 @@ test("getOfflineSyncStorage never double-folds the root ledger when it is listed
 
   assert.deepEqual(lifecycleDrains, ["root", "team"], "root ledger is folded exactly once");
 });
+
+test("listOfflineSyncNamespaces decodes canonical token dirs and skips names the router would reject", async () => {
+  const root = await mkdtemp(path.join(os.tmpdir(), "remnic-offline-ns-enum-"));
+  try {
+    // A project namespace whose canonical token dir `ns-<hex>` exceeds the
+    // 64-char route-namespace cap: `getStorage` on the RAW basename throws
+    // `unsafe namespace` and 500s the whole root snapshot-stream (the regression).
+    const longName = "generalist-project-origin-6d1ad1f2";
+    const longToken = namespaceIdentityToken(longName); // ns-<hex>, 71 chars
+    assert.ok(longToken.length > 64, "token dir must exceed the route-namespace cap");
+    // A namespace whose DECODED name itself exceeds the 64-char route cap:
+    // decoding succeeds but isSafeRouteNamespace must still reject it.
+    const overCapName = `generalist-project-tag-${"x".repeat(60)}`;
+    const overCapToken = namespaceIdentityToken(overCapName);
+    assert.ok(overCapName.length > 64, "decoded name must exceed the route cap");
+    for (const dir of [longToken, overCapToken, "blend", "ns-default"]) {
+      await mkdir(path.join(root, "namespaces", dir, "state"), { recursive: true });
+      await writeFile(
+        path.join(root, "namespaces", dir, LIFECYCLE_LEDGER_REL),
+        "",
+        "utf-8",
+      );
+    }
+    const host = {
+      config: {
+        memoryDir: root,
+        defaultNamespace: "generalist",
+        sharedNamespace: "shared",
+        namespacePolicies: [],
+      },
+      namespaceCatalog: { listNamespaces: async () => [] },
+    } as unknown as Parameters<typeof listOfflineSyncNamespaces>[0];
+
+    const names = new Set(await listOfflineSyncNamespaces(host));
+
+    // The canonical token dir is decoded back to its namespace NAME...
+    assert.ok(names.has(longName), "canonical token dir must be decoded to its namespace name");
+    // ...never surfaced as the raw >64-char token that getStorage would reject.
+    assert.ok(!names.has(longToken), "raw over-cap token must never be enumerated as a namespace");
+    // A decoded name that is ITSELF over the route cap is skipped entirely
+    // (the isSafeRouteNamespace rejection branch).
+    assert.ok(!names.has(overCapName), "over-cap decoded name must be skipped");
+    assert.ok(!names.has(overCapToken), "over-cap raw token must be skipped");
+    // A raw plain-named dir is used verbatim.
+    assert.ok(names.has("blend"), "plain namespace dir must be enumerated verbatim");
+    // The literal ns-default token decodes to the EMPTY default identity and
+    // must map to the configured default namespace, not be skipped as "".
+    assert.ok(names.has("generalist"), "ns-default dir maps to the configured default namespace");
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});

package/src/offline-sync-impression-drain.ts

@@ -12,6 +12,8 @@ import { isErrnoCode } from "./utils/errno.js";
 import { assertPathInsideRoot, pathIsInside } from "./utils/path-containment.js";
 import { displayErrorDetail } from "./runtime/better-sqlite.js";
 import { getConfiguredNamespaces } from "./scopes/scope-plan.js";
+import { isSafeRouteNamespace } from "./routing/engine.js";
+import { namespaceIdentityFromToken } from "./namespaces/identity.js";
 import type { PluginConfig } from "./types.js";
 
 type PendingImpressionDrain = () => Promise<{ pendingDeferred: boolean }>;
@@ -89,7 +91,17 @@ export async function getOfflineSyncStorage<T extends PendingLifecycleDrain & {
   if (path.resolve(storage.dir) === memoryRoot && orchestrator.listOfflineSyncNamespaces) {
     const drained = new Set<string>([memoryRoot]);
     for (const ns of await orchestrator.listOfflineSyncNamespaces()) {
-      const nsStorage = await orchestrator.getStorage(ns);
+      // A single unresolvable namespace (e.g. a legacy canonical token dir whose
+      // name exceeds the route-namespace length cap) must not abort the whole root
+      // snapshot — degrade to draining the rest. listOfflineSyncNamespaces already
+      // normalizes token dirs, so this is defense-in-depth.
+      let nsStorage: T;
+      try {
+        nsStorage = await orchestrator.getStorage(ns);
+      } catch (err) {
+        log.debug(`offline-sync root drain: skipping namespace ${ns} (non-fatal): ${err}`);
+        continue;
+      }
       const nsDir = path.resolve(nsStorage.dir);
       if (drained.has(nsDir)) continue;
       drained.add(nsDir);
@@ -114,8 +126,28 @@ export async function listOfflineSyncNamespaces(host: OfflineSyncNamespaceHost):
   try {
     for (const ledgerPath of await offlineSyncLifecycleLedgerPaths(host.config.memoryDir)) {
       const namespaceDir = path.dirname(path.dirname(ledgerPath));
-      if (path.basename(path.dirname(namespaceDir)) === "namespaces") {
-        names.add(path.basename(namespaceDir));
+      if (path.basename(path.dirname(namespaceDir)) !== "namespaces") continue;
+      // A namespace is stored under its canonical token dir `ns-<hex>`. Decode the
+      // token back to the namespace NAME so the drain fanout resolves the SAME
+      // storage the token dir belongs to (the catalog rebuild scanner decodes the
+      // same way, catalog.ts finishRebuild). A raw dir already named as a plain
+      // namespace is used verbatim. Skip any name the router would reject — e.g. a
+      // canonical token dir whose decoded-or-raw name exceeds isSafeRouteNamespace's
+      // 64-char cap — because getStorage() would throw `unsafe namespace` and 500
+      // the whole root snapshot-stream (the offline-sync regression this fixes).
+      const dirName = path.basename(namespaceDir);
+      // namespaceIdentityFromToken returns "" for the ns-default token (the
+      // default-namespace identity) — map that to the configured default
+      // namespace instead of skipping the directory as an unsafe empty name.
+      const decoded = namespaceIdentityFromToken(dirName);
+      const name =
+        decoded === null
+          ? dirName
+          : decoded.length > 0
+            ? decoded
+            : host.config.defaultNamespace;
+      if (isSafeRouteNamespace(name)) {
+        names.add(name);
       }
     }
   } catch {

package/dist/chunk-DETNBTZS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/offline-sync-impression-drain.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { lstat, realpath } from \"node:fs/promises\";\nimport {\n  drainPendingLifecycleForSyncOrThrow,\n  drainPendingLifecycleLedgerForSync,\n  type LifecyclePendingIo,\n} from \"./storage/memory-lifecycle-ledger-access.js\";\nimport { writeFileAtomically } from \"./maintenance/atomic-file.js\";\nimport { log } from \"./logger.js\";\nimport { isErrnoCode } from \"./utils/errno.js\";\nimport { assertPathInsideRoot, pathIsInside } from \"./utils/path-containment.js\";\nimport { displayErrorDetail } from \"./runtime/better-sqlite.js\";\nimport { getConfiguredNamespaces } from \"./scopes/scope-plan.js\";\nimport type { PluginConfig } from \"./types.js\";\n\ntype PendingImpressionDrain = () => Promise<{ pendingDeferred: boolean }>;\n\ntype PendingLifecycleDrain = {\n  drainPendingMemoryLifecycleEventsForSync(): Promise<{ folded: boolean; pendingDeferred: boolean }>;\n};\n\ntype LifecycleDrainAtPath = (\n  ledgerPath: string,\n) => Promise<{ folded: boolean; pendingDeferred: boolean }>;\n\ntype PendingImpressionHost = {\n  drainPendingRecallImpressions(): Promise<{ pendingDeferred: boolean }>;\n};\n/**\n * Fold pending recall-impression spills before building an offline-sync snapshot.\n * A deferred or failed drain must abort the snapshot rather than silently omit\n * durable rows from the sync payload.\n */\nexport async function drainPendingImpressionsForOfflineSync(\n  host: PendingImpressionDrain,\n): Promise<void> {\n  const maxAttempts = 3;\n  let lastError: unknown;\n  for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n    try {\n      const result = await host();\n      if (!result.pendingDeferred) return;\n      lastError = undefined;\n    } catch (error) {\n      lastError = error;\n    }\n  }\n  const detail = lastError\n    ? `: ${displayErrorDetail(lastError) || \"unknown error\"}`\n    : \" (rotation lock held by a peer)\";\n  throw new Error(\n    `offline-sync impression drain could not fold pending recall impressions after ${maxAttempts} attempts${detail}; aborting snapshot so the pending rows are not silently excluded (#2033)`,\n  );\n}\n\n\nexport async function getOfflineSyncStorage<T extends PendingLifecycleDrain & { dir: string }>(\n  orchestrator: PendingImpressionHost & {\n    config: { memoryDir: string };\n    getStorage(namespace: string): Promise<T>;\n    listOfflineSyncNamespaces?(): Promise<string[]>;\n  },\n  namespace: string,\n): Promise<T> {\n  const storage = await orchestrator.getStorage(namespace);\n  const memoryRoot = path.resolve(orchestrator.config.memoryDir);\n  // Recall impressions are global: the orchestrator's single LastRecallStore\n  // roots at config.memoryDir, so the active recall_impressions.jsonl lives at\n  // <memoryDir>/state/. Fold the global pending queue ONLY when THIS snapshot's\n  // root actually contains that active file - a root snapshot. A namespace\n  // snapshot (storage.dir under namespaces/<token>/) cannot carry it, so\n  // draining there would empty the durable pending queue into a file this\n  // snapshot omits and strand the row until a root sync; leave it pending for\n  // the root sync instead (#2033).\n  const impressionsFile = path.join(memoryRoot, \"state\", \"recall_impressions.jsonl\");\n  if (pathIsInside(path.resolve(storage.dir), impressionsFile)) {\n    await drainPendingImpressionsForOfflineSync(() => orchestrator.drainPendingRecallImpressions());\n  }\n  await drainPendingLifecycleForSyncOrThrow(() => storage.drainPendingMemoryLifecycleEventsForSync());\n  // Root snapshot: buildOfflineSyncSnapshot walks `namespaces/<ns>/state/` for\n  // every namespace under the memory root and INCLUDES each namespace's active\n  // lifecycle ledger, but the per-namespace pending spill dirs are offline-sync\n  // EXCLUDED. Draining only the root ledger above would let a root snapshot omit\n  // append-only rows still sitting in a namespace's spill queue, so fold every\n  // namespace ledger too - each through its OWN namespace storage so secure-store\n  // AAD stays namespace-scoped (#2033, matching the CLI all-ledger drain). A\n  // namespace snapshot folds only its own ledger, already done above.\n  if (path.resolve(storage.dir) === memoryRoot && orchestrator.listOfflineSyncNamespaces) {\n    const drained = new Set<string>([memoryRoot]);\n    for (const ns of await orchestrator.listOfflineSyncNamespaces()) {\n      const nsStorage = await orchestrator.getStorage(ns);\n      const nsDir = path.resolve(nsStorage.dir);\n      if (drained.has(nsDir)) continue;\n      drained.add(nsDir);\n      await drainPendingLifecycleForSyncOrThrow(() => nsStorage.drainPendingMemoryLifecycleEventsForSync());\n    }\n  }\n  return storage;\n}\n\ntype OfflineSyncNamespaceHost = {\n  config: PluginConfig;\n  namespaceCatalog: { listNamespaces(): Promise<Array<{ namespace: string }>> };\n};\n\n/**\n * Every namespace whose lifecycle ledger a ROOT offline snapshot enumerates.\n * Configured namespaces plus catalog-discovered ones; the catalog is queried\n * best-effort so a catalog read failure still drains the configured set (#2033).\n */\nexport async function listOfflineSyncNamespaces(host: OfflineSyncNamespaceHost): Promise<string[]> {\n  const names = new Set<string>(getConfiguredNamespaces(host.config));\n  try {\n    for (const ledgerPath of await offlineSyncLifecycleLedgerPaths(host.config.memoryDir)) {\n      const namespaceDir = path.dirname(path.dirname(ledgerPath));\n      if (path.basename(path.dirname(namespaceDir)) === \"namespaces\") {\n        names.add(path.basename(namespaceDir));\n      }\n    }\n  } catch {\n    // best-effort: a filesystem scan failure must not block configured/catalog namespaces\n  }\n  try {\n    for (const record of await host.namespaceCatalog.listNamespaces()) {\n      names.add(record.namespace);\n    }\n  } catch {\n    // best-effort: fall back to the configured and filesystem namespace sets\n  }\n  return [...names];\n}\n\n/**\n * Resolve the offline-sync storage for a snapshot, folding pending spills first.\n * For a root snapshot this also folds every namespace lifecycle ledger the\n * snapshot will enumerate, so append-only rows in a namespace spill queue are\n * never omitted (#2033).\n */\nexport function offlineSyncStorageForSnapshot<T extends PendingLifecycleDrain & { dir: string }>(\n  host: PendingImpressionHost &\n    OfflineSyncNamespaceHost & {\n      getStorage(namespace: string): Promise<T>;\n    },\n  namespace: string,\n): Promise<T> {\n  return getOfflineSyncStorage(\n    {\n      config: { memoryDir: host.config.memoryDir },\n      drainPendingRecallImpressions: () => host.drainPendingRecallImpressions(),\n      getStorage: (ns: string) => host.getStorage(ns),\n      listOfflineSyncNamespaces: () => listOfflineSyncNamespaces(host),\n    },\n    namespace,\n  );\n}\n\nconst LIFECYCLE_LEDGER_FILE = \"memory-lifecycle-ledger.jsonl\";\n\n/**\n * Plaintext filesystem IO for a standalone (CLI) offline-sync lifecycle drain.\n * A standalone offline cache is plaintext - exactly like its LastRecallStore\n * impression drain - so spills read/append as UTF-8. `writeSecure` keeps the\n * atomic temp+rename the pending contract requires (#2033); a pure drain never\n * spills a new event, but the interface demands an atomic writer.\n */\nfunction plaintextLifecyclePendingIo(): LifecyclePendingIo {\n  return {\n    writeSecure: async (filePath, payload) => {\n      await writeFileAtomically(filePath, payload);\n    },\n    readSecure: (filePath) => fs.promises.readFile(filePath, \"utf8\"),\n  };\n}\n\n/**\n * Lifecycle ledger paths under a standalone memory dir: the root `state/` ledger\n * plus every per-namespace `namespaces/<ns>/state/` ledger (#2033). Offline sync\n * pushes the whole memory dir, so every namespace's ledger can carry pending\n * spills that must be folded first.\n */\nasync function offlineSyncLifecycleLedgerPaths(memoryDir: string): Promise<string[]> {\n  const paths = [path.join(memoryDir, \"state\", LIFECYCLE_LEDGER_FILE)];\n  const namespacesBase = path.join(memoryDir, \"namespaces\");\n  // Symlink/traversal containment (#2033): a symlinked <memoryDir>/namespaces\n  // (or a symlinked child) must not redirect the pre-sync drain - and the\n  // ledger appends/mkdirs it drives - outside memoryDir. Resolve the memory\n  // root and the scan base through realpath, reject a symlinked/escaping/\n  // non-directory base, and skip any symlinked/escaping child, mirroring the\n  // lifecycle-compaction scanner (orchestration/maintenance.ts) and the\n  // memory-store walkers (utils/path-containment). A rejected base is\n  // non-fatal: drain the root ledger only, never through the poisoned link.\n  let memoryDirReal: string;\n  try {\n    memoryDirReal = await realpath(memoryDir);\n    const baseStat = await lstat(namespacesBase);\n    if (baseStat.isSymbolicLink() || !baseStat.isDirectory()) {\n      throw new Error(\"namespaces base is a symlink or not a directory\");\n    }\n    assertPathInsideRoot(memoryDirReal, await realpath(namespacesBase), namespacesBase);\n  } catch (err) {\n    if (!isErrnoCode(err, \"ENOENT\")) {\n      log.debug(`offline-sync lifecycle drain: namespaces base rejected (non-fatal): ${err}`);\n    }\n    return paths;\n  }\n  let entries: fs.Dirent[];\n  try {\n    entries = fs.readdirSync(namespacesBase, { withFileTypes: true });\n  } catch (err) {\n    if (!isErrnoCode(err, \"ENOENT\")) {\n      log.debug(`offline-sync lifecycle drain: namespaces dir scan failed (non-fatal): ${err}`);\n    }\n    return paths;\n  }\n  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n    if (!entry.isDirectory() || entry.isSymbolicLink()) continue;\n    const childPath = path.join(namespacesBase, entry.name);\n    try {\n      assertPathInsideRoot(memoryDirReal, await realpath(childPath), childPath);\n    } catch (err) {\n      log.debug(`offline-sync lifecycle drain: skipping out-of-root namespace dir ${childPath}: ${err}`);\n      continue;\n    }\n    paths.push(path.join(childPath, \"state\", LIFECYCLE_LEDGER_FILE));\n  }\n  return paths;\n}\n\n/**\n * Fold pending memory-lifecycle spills into each active ledger under `memoryDir`\n * before a standalone (CLI) offline-sync snapshot (#2033). Mirrors the\n * access-service snapshot entrypoints, which drain lifecycle pending first: the\n * default sync exclude globs keep `memory-lifecycle-ledger.jsonl.pending.d` out\n * of the push, so an append-only row (promotion/import/explicit capture) that\n * spilled while the ledger lock was held would be silently dropped if the local\n * node were discarded before maintenance folds it. A deferred drain (lock held\n * by a peer) or a repeatedly failing fold ABORTS via\n * {@link drainPendingLifecycleForSyncOrThrow} rather than building/pushing a\n * snapshot that omits durable rows. Fast no-op per ledger with no pending dir.\n */\nexport async function drainPendingLifecycleForOfflineSync(\n  memoryDir: string,\n  drainAtPath: LifecycleDrainAtPath = (ledgerPath) => {\n    const io = plaintextLifecyclePendingIo();\n    const stateDir = path.dirname(ledgerPath);\n    return drainPendingLifecycleLedgerForSync(\n      ledgerPath,\n      io,\n      (payload) => fs.promises.appendFile(ledgerPath, payload),\n      async () => {\n        await fs.promises.mkdir(stateDir, { recursive: true });\n      },\n    );\n  },\n): Promise<void> {\n  for (const ledgerPath of await offlineSyncLifecycleLedgerPaths(memoryDir)) {\n    await drainPendingLifecycleForSyncOrThrow(() => drainAtPath(ledgerPath));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,OAAO,gBAAgB;AAgChC,eAAsB,sCACpB,MACe;AACf,QAAM,cAAc;AACpB,MAAI;AACJ,WAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,QAAI;AACF,YAAM,SAAS,MAAM,KAAK;AAC1B,UAAI,CAAC,OAAO,gBAAiB;AAC7B,kBAAY;AAAA,IACd,SAAS,OAAO;AACd,kBAAY;AAAA,IACd;AAAA,EACF;AACA,QAAM,SAAS,YACX,KAAK,mBAAmB,SAAS,KAAK,eAAe,KACrD;AACJ,QAAM,IAAI;AAAA,IACR,iFAAiF,WAAW,YAAY,MAAM;AAAA,EAChH;AACF;AAGA,eAAsB,sBACpB,cAKA,WACY;AACZ,QAAM,UAAU,MAAM,aAAa,WAAW,SAAS;AACvD,QAAM,aAAa,KAAK,QAAQ,aAAa,OAAO,SAAS;AAS7D,QAAM,kBAAkB,KAAK,KAAK,YAAY,SAAS,0BAA0B;AACjF,MAAI,aAAa,KAAK,QAAQ,QAAQ,GAAG,GAAG,eAAe,GAAG;AAC5D,UAAM,sCAAsC,MAAM,aAAa,8BAA8B,CAAC;AAAA,EAChG;AACA,QAAM,oCAAoC,MAAM,QAAQ,yCAAyC,CAAC;AASlG,MAAI,KAAK,QAAQ,QAAQ,GAAG,MAAM,cAAc,aAAa,2BAA2B;AACtF,UAAM,UAAU,oBAAI,IAAY,CAAC,UAAU,CAAC;AAC5C,eAAW,MAAM,MAAM,aAAa,0BAA0B,GAAG;AAC/D,YAAM,YAAY,MAAM,aAAa,WAAW,EAAE;AAClD,YAAM,QAAQ,KAAK,QAAQ,UAAU,GAAG;AACxC,UAAI,QAAQ,IAAI,KAAK,EAAG;AACxB,cAAQ,IAAI,KAAK;AACjB,YAAM,oCAAoC,MAAM,UAAU,yCAAyC,CAAC;AAAA,IACtG;AAAA,EACF;AACA,SAAO;AACT;AAYA,eAAsB,0BAA0B,MAAmD;AACjG,QAAM,QAAQ,IAAI,IAAY,wBAAwB,KAAK,MAAM,CAAC;AAClE,MAAI;AACF,eAAW,cAAc,MAAM,gCAAgC,KAAK,OAAO,SAAS,GAAG;AACrF,YAAM,eAAe,KAAK,QAAQ,KAAK,QAAQ,UAAU,CAAC;AAC1D,UAAI,KAAK,SAAS,KAAK,QAAQ,YAAY,CAAC,MAAM,cAAc;AAC9D,cAAM,IAAI,KAAK,SAAS,YAAY,CAAC;AAAA,MACvC;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,MAAI;AACF,eAAW,UAAU,MAAM,KAAK,iBAAiB,eAAe,GAAG;AACjE,YAAM,IAAI,OAAO,SAAS;AAAA,IAC5B;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAQO,SAAS,8BACd,MAIA,WACY;AACZ,SAAO;AAAA,IACL;AAAA,MACE,QAAQ,EAAE,WAAW,KAAK,OAAO,UAAU;AAAA,MAC3C,+BAA+B,MAAM,KAAK,8BAA8B;AAAA,MACxE,YAAY,CAAC,OAAe,KAAK,WAAW,EAAE;AAAA,MAC9C,2BAA2B,MAAM,0BAA0B,IAAI;AAAA,IACjE;AAAA,IACA;AAAA,EACF;AACF;AAEA,IAAM,wBAAwB;AAS9B,SAAS,8BAAkD;AACzD,SAAO;AAAA,IACL,aAAa,OAAO,UAAU,YAAY;AACxC,YAAM,oBAAoB,UAAU,OAAO;AAAA,IAC7C;AAAA,IACA,YAAY,CAAC,aAAa,GAAG,SAAS,SAAS,UAAU,MAAM;AAAA,EACjE;AACF;AAQA,eAAe,gCAAgC,WAAsC;AACnF,QAAM,QAAQ,CAAC,KAAK,KAAK,WAAW,SAAS,qBAAqB,CAAC;AACnE,QAAM,iBAAiB,KAAK,KAAK,WAAW,YAAY;AASxD,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,SAAS,SAAS;AACxC,UAAM,WAAW,MAAM,MAAM,cAAc;AAC3C,QAAI,SAAS,eAAe,KAAK,CAAC,SAAS,YAAY,GAAG;AACxD,YAAM,IAAI,MAAM,iDAAiD;AAAA,IACnE;AACA,yBAAqB,eAAe,MAAM,SAAS,cAAc,GAAG,cAAc;AAAA,EACpF,SAAS,KAAK;AACZ,QAAI,CAAC,YAAY,KAAK,QAAQ,GAAG;AAC/B,UAAI,MAAM,uEAAuE,GAAG,EAAE;AAAA,IACxF;AACA,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,GAAG,YAAY,gBAAgB,EAAE,eAAe,KAAK,CAAC;AAAA,EAClE,SAAS,KAAK;AACZ,QAAI,CAAC,YAAY,KAAK,QAAQ,GAAG;AAC/B,UAAI,MAAM,yEAAyE,GAAG,EAAE;AAAA,IAC1F;AACA,WAAO;AAAA,EACT;AACA,aAAW,SAAS,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;AACxE,QAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,EAAG;AACpD,UAAM,YAAY,KAAK,KAAK,gBAAgB,MAAM,IAAI;AACtD,QAAI;AACF,2BAAqB,eAAe,MAAM,SAAS,SAAS,GAAG,SAAS;AAAA,IAC1E,SAAS,KAAK;AACZ,UAAI,MAAM,oEAAoE,SAAS,KAAK,GAAG,EAAE;AACjG;AAAA,IACF;AACA,UAAM,KAAK,KAAK,KAAK,WAAW,SAAS,qBAAqB,CAAC;AAAA,EACjE;AACA,SAAO;AACT;AAcA,eAAsB,oCACpB,WACA,cAAoC,CAAC,eAAe;AAClD,QAAM,KAAK,4BAA4B;AACvC,QAAM,WAAW,KAAK,QAAQ,UAAU;AACxC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,CAAC,YAAY,GAAG,SAAS,WAAW,YAAY,OAAO;AAAA,IACvD,YAAY;AACV,YAAM,GAAG,SAAS,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;AAAA,IACvD;AAAA,EACF;AACF,GACe;AACf,aAAW,cAAc,MAAM,gCAAgC,SAAS,GAAG;AACzE,UAAM,oCAAoC,MAAM,YAAY,UAAU,CAAC;AAAA,EACzE;AACF;","names":[]}