@remnic/core 9.3.663 → 9.3.664

package/dist/{capsule-merge-T2JRE46P.js.map → capsule-merge-GK5E647P.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/transfer/capsule-merge.ts"],"sourcesContent":["import { lstat, mkdir, readFile, realpath, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { gunzipSync } from \"node:zlib\";\nimport {\n  createVersion,\n  type VersioningConfig,\n  type VersioningLogger,\n} from \"../page-versioning.js\";\nimport {\n  assertIsDirectoryNotSymlink,\n  assertRealpathInsideRoot,\n  fromPosixRelPath,\n  isPathInsideRoot,\n  sha256String,\n} from \"./fs-utils.js\";\nimport {\n  parseExportBundle,\n  type CapsuleBlock,\n  type ExportManifestV2,\n  type ExportMemoryRecordV1,\n} from \"./types.js\";\n\n/**\n * Three-way conflict-resolution mode for {@link mergeCapsule}.\n *\n * A \"conflict\" is defined as: the same memory-file path exists in both the\n * source archive and the target directory AND the content hash of the local\n * file differs from the archive's manifest entry for that path.\n *\n * Files that exist only in the archive (no local counterpart) are always\n * written regardless of mode — there is no conflict to resolve.\n *\n * Files that are byte-identical (same content hash in both locations) are\n * recorded as {@link MergeCapsuleResult.skipped} with reason `\"identical\"` and\n * are never re-written regardless of mode; this is a no-op optimisation rather\n * than a conflict.\n *\n *  - `\"skip-conflicts\"` (default) — log the conflict, skip the conflicting\n *    archive entries, but continue importing non-conflicting entries. The\n *    resulting merge is the union of:\n *      - all non-conflicting archive files (written to target)\n *      - all pre-existing local files (left unchanged)\n *\n *  - `\"prefer-source\"` — for conflicting files, snapshot the local content via\n *    page-versioning (gotcha #54: snapshot before overwrite) then overwrite\n *    with the archive content.\n *\n *  - `\"prefer-local\"` — for conflicting files, keep the local content; the\n *    archive entry is skipped.\n */\nexport type MergeCapsuleConflictMode =\n  | \"skip-conflicts\"\n  | \"prefer-source\"\n  | \"prefer-local\";\n\n/**\n * Options accepted by {@link mergeCapsule}.\n *\n * `sourceArchive` — absolute or cwd-relative path to a `.capsule.json.gz`\n * archive produced by `exportCapsule`. Must be a V2 bundle.\n *\n * `targetRoot` — absolute or cwd-relative path to the memory directory that\n * receives the merged records. Must be an existing, non-symlink directory.\n *\n * `conflictMode` — see {@link MergeCapsuleConflictMode}. Defaults to\n * `\"skip-conflicts\"`.\n *\n * `versioning` — optional page-versioning config forwarded to\n * {@link createVersion} in `\"prefer-source\"` mode. When omitted or disabled,\n * overwrites proceed without snapshotting (not recommended for production).\n *\n * `log` — optional logger forwarded to {@link createVersion}.\n */\nexport interface MergeCapsuleOptions {\n  sourceArchive: string;\n  targetRoot: string;\n  conflictMode?: MergeCapsuleConflictMode;\n  versioning?: VersioningConfig;\n  log?: VersioningLogger;\n}\n\nexport interface MergeCapsuleWrittenRecord {\n  /** Capsule-relative posix path. */\n  sourcePath: string;\n  /** Memory-dir-relative posix path written on disk. */\n  targetPath: string;\n  /** Whether a page-versioning snapshot was taken before overwriting. */\n  snapshotted: boolean;\n}\n\nexport interface MergeCapsuleSkippedRecord {\n  /** Capsule-relative posix path. */\n  path: string;\n  /**\n   * Why the archive entry was not written.\n   *\n   * `\"conflict\"` — the entry existed locally with different content and the\n   * active mode did not resolve the conflict with a write (`\"skip-conflicts\"` /\n   * `\"prefer-local\"`).\n   *\n   * `\"identical\"` — the entry's content hash matches what is already on disk;\n   * no write is needed.\n   */\n  reason: \"conflict\" | \"identical\";\n}\n\nexport interface MergeCapsuleConflictRecord {\n  /** Capsule-relative posix path of the conflicting entry. */\n  path: string;\n  /** SHA-256 of the archive's copy. */\n  archiveSha256: string;\n  /** SHA-256 of the local copy. */\n  localSha256: string;\n}\n\nexport interface MergeCapsuleResult {\n  /** Records that were written to the target directory. */\n  merged: MergeCapsuleWrittenRecord[];\n  /**\n   * Records that were NOT written (conflict skipped, or byte-identical).\n   * Includes conflicts that were resolved by `\"prefer-local\"`.\n   */\n  skipped: MergeCapsuleSkippedRecord[];\n  /**\n   * Metadata about every detected conflict, regardless of which mode resolved\n   * it. Callers can use this to report \"N conflicts encountered; M overwritten\".\n   */\n  conflicts: MergeCapsuleConflictRecord[];\n  /** The manifest decoded from the archive. */\n  manifest: ExportManifestV2;\n}\n\n// ---------------------------------------------------------------------------\n// Main entry point\n// ---------------------------------------------------------------------------\n\n/**\n * Merge a V2 capsule archive into an existing memory directory using\n * three-way conflict semantics.\n *\n * Sequence:\n *   1. Read + gunzip + JSON.parse the archive.\n *   2. Validate through `parseExportBundle` (V1 rejected).\n *   3. Verify every record's content sha256 against the manifest.\n *      Any mismatch aborts BEFORE any file is written (gotcha #25).\n *   4. Classify each record as: new (no local copy), identical (same hash),\n *      or conflicting (different hash).\n *   5. Apply the selected {@link MergeCapsuleConflictMode} to conflicting\n *      entries; always write new entries; always skip identical entries.\n *\n * Determinism: `merged`, `skipped`, and `conflicts` are all returned sorted\n * by `path`/`sourcePath` so callers get stable output regardless of bundle\n * order.\n */\nexport async function mergeCapsule(\n  opts: MergeCapsuleOptions,\n): Promise<MergeCapsuleResult> {\n  const archiveAbs = path.resolve(opts.sourceArchive);\n  const rootAbs = path.resolve(opts.targetRoot);\n\n  await assertIsDirectoryNotSymlink(rootAbs, \"mergeCapsule\", \"targetRoot\");\n\n  const conflictMode: MergeCapsuleConflictMode =\n    opts.conflictMode ?? \"skip-conflicts\";\n\n  // Rule 51: reject invalid conflictMode values up-front before any I/O.\n  if (\n    conflictMode !== \"skip-conflicts\" &&\n    conflictMode !== \"prefer-source\" &&\n    conflictMode !== \"prefer-local\"\n  ) {\n    throw new Error(\n      `mergeCapsule: unknown conflictMode ${JSON.stringify(conflictMode)}; ` +\n        `expected \"skip-conflicts\", \"prefer-source\", or \"prefer-local\"`,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // Parse + validate archive\n  // ---------------------------------------------------------------------------\n\n  const raw = await readFile(archiveAbs);\n  let json: string;\n  try {\n    json = gunzipSync(raw).toString(\"utf-8\");\n  } catch (cause) {\n    throw new Error(\n      `mergeCapsule: archive is not a valid gzip file: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  let parsedJson: unknown;\n  try {\n    parsedJson = JSON.parse(json);\n  } catch (cause) {\n    throw new Error(\n      `mergeCapsule: archive is not valid JSON after gunzip: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  const parsed = parseExportBundle(parsedJson);\n  if (parsed.capsuleVersion !== 2) {\n    throw new Error(\n      \"mergeCapsule: archive is V1; only V2 capsule archives are supported\",\n    );\n  }\n\n  const bundle = parsed.bundle as {\n    manifest: ExportManifestV2;\n    records: ExportMemoryRecordV1[];\n  };\n  const manifest = bundle.manifest;\n  const capsule = manifest.capsule;\n\n  // Build path → manifest entry index for O(1) checksum lookup.\n  const manifestIndex = new Map<string, ExportManifestV2[\"files\"][number]>();\n  for (const f of manifest.files) {\n    manifestIndex.set(f.path, f);\n  }\n  if (manifestIndex.size !== manifest.files.length) {\n    throw new Error(\"mergeCapsule: manifest contains duplicate file paths\");\n  }\n\n  const recordPaths = new Set<string>();\n  for (const rec of bundle.records) {\n    if (recordPaths.has(rec.path)) {\n      throw new Error(\n        `mergeCapsule: bundle contains duplicate record path: ${rec.path}`,\n      );\n    }\n    recordPaths.add(rec.path);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Phase 1: verify checksums + validate paths before ANY filesystem mutation.\n  // (gotcha #25: don't destroy old state before confirming new state succeeds)\n  // ---------------------------------------------------------------------------\n\n  const rootReal = await realpath(rootAbs).catch(() => rootAbs);\n\n  // Tracks normalized, case-folded target paths seen so far in phase 1.  Maps\n  // targetAbs.toLowerCase() → first source path so the collision error can name\n  // both offending entries.  Two manifest entries whose computed target paths\n  // normalise to the same absolute path (e.g. `subdir/file.md` and\n  // `subdir/./file.md`, or differing case on case-insensitive filesystems such\n  // as macOS and Windows) would both refer to the same inode.  In\n  // `skip-conflicts`/`prefer-local` modes one entry would be misclassified as a\n  // local conflict against the OTHER entry's just-written content; in\n  // `prefer-source` the second entry would silently overwrite the first.  We\n  // reject the import up-front before any write (Codex P2 thread on PR #748,\n  // mirroring `capsule-import.ts`).\n  const seenTargetPaths = new Map<string, string>();\n\n  for (const rec of bundle.records) {\n    // Checksum validation.\n    const entry = manifestIndex.get(rec.path);\n    if (!entry) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch (record without manifest entry: ${rec.path})`,\n      );\n    }\n    const { sha256, bytes } = sha256String(rec.content);\n    if (sha256 !== entry.sha256 || bytes !== entry.bytes) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch for ${rec.path}: ` +\n          `expected sha256=${entry.sha256} bytes=${entry.bytes}, ` +\n          `got sha256=${sha256} bytes=${bytes}`,\n      );\n    }\n\n    // Path-traversal validation (mirrors capsule-import.ts).\n    if (rec.path.includes(\"\\\\\")) {\n      throw new Error(\n        `mergeCapsule: record path contains backslash separators (Windows-style paths are not allowed): ${rec.path}`,\n      );\n    }\n    const posixNormalized = path.posix.normalize(rec.path);\n    if (\n      rec.path.startsWith(\"/\") ||\n      rec.path.split(\"/\").some((seg) => seg === \"..\") ||\n      posixNormalized.startsWith(\"..\") ||\n      posixNormalized.startsWith(\"/\")\n    ) {\n      throw new Error(\n        `mergeCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Lexical root containment check.\n    const targetAbs = path.join(rootReal, fromPosixRelPath(rec.path));\n    if (!isPathInsideRoot(rootReal, targetAbs)) {\n      throw new Error(\n        `mergeCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Symlink-aware containment check (shared helper from fs-utils).\n    await assertRealpathInsideRoot(rootReal, targetAbs, rec.path, \"mergeCapsule\");\n\n    // Target-file symlink guard: if the target already exists as a symlink,\n    // reject — writes through symlinks can redirect to unexpected locations.\n    const targetLstat = await lstat(targetAbs).catch(() => null);\n    if (targetLstat !== null && targetLstat.isSymbolicLink()) {\n      throw new Error(\n        `mergeCapsule: record target is a symlink and cannot be written to safely: ${rec.path}`,\n      );\n    }\n\n    // Duplicate normalized target path detection (Codex P2 #748, mirrors\n    // capsule-import.ts).  `path.join` already normalises `.` segments\n    // (e.g. `subdir/./file.md` → `subdir/file.md`).  On case-insensitive\n    // filesystems (macOS default, Windows), two paths that differ only in case\n    // would resolve to the same inode.  We fold the dedup key to lowercase so\n    // that `subdir/File.md` and `subdir/file.md` are detected as duplicates\n    // before any write occurs.  This is intentionally unconditional: the cost\n    // of an extra `.toLowerCase()` on case-sensitive filesystems is negligible,\n    // and a defensive lowercase is far simpler than probing filesystem\n    // case-sensitivity at runtime.  Without this guard, prefer-source mode\n    // would silently overwrite one entry with the other, and skip-conflicts /\n    // prefer-local would misclassify the second entry as a local conflict\n    // against the first entry's freshly written content.\n    const dedupKey = targetAbs.toLowerCase();\n    const firstSourcePath = seenTargetPaths.get(dedupKey);\n    if (firstSourcePath !== undefined) {\n      throw new Error(\n        `mergeCapsule: manifest contains two entries that resolve to the same target path: ` +\n          `\"${firstSourcePath}\" and \"${rec.path}\" both map to \"${rec.path}\"`,\n      );\n    }\n    seenTargetPaths.set(dedupKey, rec.path);\n  }\n\n  // Detect manifest-only entries (missing record). Treat as corruption.\n  for (const f of manifest.files) {\n    if (!recordPaths.has(f.path)) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch (manifest entry without record: ${f.path})`,\n      );\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Phase 2: classify records and apply conflict mode.\n  // ---------------------------------------------------------------------------\n\n  const merged: MergeCapsuleWrittenRecord[] = [];\n  const skipped: MergeCapsuleSkippedRecord[] = [];\n  const conflicts: MergeCapsuleConflictRecord[] = [];\n\n  // Sort by source path for deterministic output (mirrors capsule-import.ts).\n  const sortedRecords = [...bundle.records].sort((a, b) =>\n    a.path.localeCompare(b.path),\n  );\n\n  for (const rec of sortedRecords) {\n    const targetAbs = path.join(rootReal, fromPosixRelPath(rec.path));\n    const entry = manifestIndex.get(rec.path)!; // validated above\n\n    const localContent = await readLocalFile(targetAbs);\n\n    if (localContent === null) {\n      // No local copy — always write regardless of mode.\n      await mkdir(path.dirname(targetAbs), { recursive: true });\n      await writeFile(targetAbs, rec.content, \"utf-8\");\n      merged.push({ sourcePath: rec.path, targetPath: rec.path, snapshotted: false });\n      continue;\n    }\n\n    // Local file exists. Check if it is byte-identical to the archive entry.\n    const { sha256: localSha256 } = sha256String(localContent);\n\n    if (localSha256 === entry.sha256) {\n      // Byte-identical — no write needed.\n      skipped.push({ path: rec.path, reason: \"identical\" });\n      continue;\n    }\n\n    // Content differs → conflict.\n    const { sha256: archiveSha256 } = sha256String(rec.content);\n    conflicts.push({\n      path: rec.path,\n      archiveSha256,\n      localSha256,\n    });\n\n    if (conflictMode === \"skip-conflicts\" || conflictMode === \"prefer-local\") {\n      // Keep local copy, skip archive entry.\n      skipped.push({ path: rec.path, reason: \"conflict\" });\n      continue;\n    }\n\n    // conflictMode === \"prefer-source\": snapshot local then overwrite.\n    let snapshotted = false;\n    if (opts.versioning && opts.versioning.enabled) {\n      // Gotcha #54: snapshot BEFORE overwriting.\n      await createVersion(\n        targetAbs,\n        localContent,\n        \"manual\",\n        opts.versioning,\n        opts.log,\n        `capsule-merge: ${capsule.id}`,\n        rootReal,\n      );\n      snapshotted = true;\n    }\n\n    await writeFile(targetAbs, rec.content, \"utf-8\");\n    merged.push({ sourcePath: rec.path, targetPath: rec.path, snapshotted });\n  }\n\n  // Sort output lists for determinism.\n  merged.sort((a, b) => a.sourcePath.localeCompare(b.sourcePath));\n  skipped.sort((a, b) => a.path.localeCompare(b.path));\n  conflicts.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { merged, skipped, conflicts, manifest };\n}\n\n// ---------------------------------------------------------------------------\n// Private helpers\n// ---------------------------------------------------------------------------\n\nasync function readLocalFile(absPath: string): Promise<string | null> {\n  const st = await stat(absPath).catch(() => null);\n  if (!st || !st.isFile()) return null;\n  return readFile(absPath, \"utf-8\");\n}\n\n// Re-export CapsuleBlock so callers don't need a deep import from types.ts.\nexport type { CapsuleBlock };\n"],"mappings":";;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,OAAO,UAAU,UAAU,MAAM,iBAAiB;AAClE,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAwJ3B,eAAsB,aACpB,MAC6B;AAC7B,QAAM,aAAa,KAAK,QAAQ,KAAK,aAAa;AAClD,QAAM,UAAU,KAAK,QAAQ,KAAK,UAAU;AAE5C,QAAM,4BAA4B,SAAS,gBAAgB,YAAY;AAEvE,QAAM,eACJ,KAAK,gBAAgB;AAGvB,MACE,iBAAiB,oBACjB,iBAAiB,mBACjB,iBAAiB,gBACjB;AACA,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,UAAU,YAAY,CAAC;AAAA,IAEpE;AAAA,EACF;AAMA,QAAM,MAAM,MAAM,SAAS,UAAU;AACrC,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,GAAG,EAAE,SAAS,OAAO;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mDAAmD,UAAU;AAAA,MAC7D,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,IAAI;AAAA,EAC9B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,yDAAyD,UAAU;AAAA,MACnE,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,OAAO,mBAAmB,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO;AAItB,QAAM,WAAW,OAAO;AACxB,QAAM,UAAU,SAAS;AAGzB,QAAM,gBAAgB,oBAAI,IAA+C;AACzE,aAAW,KAAK,SAAS,OAAO;AAC9B,kBAAc,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7B;AACA,MAAI,cAAc,SAAS,SAAS,MAAM,QAAQ;AAChD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,OAAO,OAAO,SAAS;AAChC,QAAI,YAAY,IAAI,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,wDAAwD,IAAI,IAAI;AAAA,MAClE;AAAA,IACF;AACA,gBAAY,IAAI,IAAI,IAAI;AAAA,EAC1B;AAOA,QAAM,WAAW,MAAM,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO;AAa5D,QAAM,kBAAkB,oBAAI,IAAoB;AAEhD,aAAW,OAAO,OAAO,SAAS;AAEhC,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,2EAA2E,IAAI,IAAI;AAAA,MACrF;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,aAAa,IAAI,OAAO;AAClD,QAAI,WAAW,MAAM,UAAU,UAAU,MAAM,OAAO;AACpD,YAAM,IAAI;AAAA,QACR,+CAA+C,IAAI,IAAI,qBAClC,MAAM,MAAM,UAAU,MAAM,KAAK,gBACtC,MAAM,UAAU,KAAK;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,IAAI,KAAK,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,kGAAkG,IAAI,IAAI;AAAA,MAC5G;AAAA,IACF;AACA,UAAM,kBAAkB,KAAK,MAAM,UAAU,IAAI,IAAI;AACrD,QACE,IAAI,KAAK,WAAW,GAAG,KACvB,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,KAC9C,gBAAgB,WAAW,IAAI,KAC/B,gBAAgB,WAAW,GAAG,GAC9B;AACA,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,IAAI;AAAA,MAC5D;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,IAAI,IAAI,CAAC;AAChE,QAAI,CAAC,iBAAiB,UAAU,SAAS,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,IAAI;AAAA,MAC5D;AAAA,IACF;AAGA,UAAM,yBAAyB,UAAU,WAAW,IAAI,MAAM,cAAc;AAI5E,UAAM,cAAc,MAAM,MAAM,SAAS,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,gBAAgB,QAAQ,YAAY,eAAe,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,6EAA6E,IAAI,IAAI;AAAA,MACvF;AAAA,IACF;AAeA,UAAM,WAAW,UAAU,YAAY;AACvC,UAAM,kBAAkB,gBAAgB,IAAI,QAAQ;AACpD,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI;AAAA,QACR,sFACM,eAAe,UAAU,IAAI,IAAI,kBAAkB,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AACA,oBAAgB,IAAI,UAAU,IAAI,IAAI;AAAA,EACxC;AAGA,aAAW,KAAK,SAAS,OAAO;AAC9B,QAAI,CAAC,YAAY,IAAI,EAAE,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,2EAA2E,EAAE,IAAI;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAMA,QAAM,SAAsC,CAAC;AAC7C,QAAM,UAAuC,CAAC;AAC9C,QAAM,YAA0C,CAAC;AAGjD,QAAM,gBAAgB,CAAC,GAAG,OAAO,OAAO,EAAE;AAAA,IAAK,CAAC,GAAG,MACjD,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EAC7B;AAEA,aAAW,OAAO,eAAe;AAC/B,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,IAAI,IAAI,CAAC;AAChE,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AAExC,UAAM,eAAe,MAAM,cAAc,SAAS;AAElD,QAAI,iBAAiB,MAAM;AAEzB,YAAM,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,YAAM,UAAU,WAAW,IAAI,SAAS,OAAO;AAC/C,aAAO,KAAK,EAAE,YAAY,IAAI,MAAM,YAAY,IAAI,MAAM,aAAa,MAAM,CAAC;AAC9E;AAAA,IACF;AAGA,UAAM,EAAE,QAAQ,YAAY,IAAI,aAAa,YAAY;AAEzD,QAAI,gBAAgB,MAAM,QAAQ;AAEhC,cAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,YAAY,CAAC;AACpD;AAAA,IACF;AAGA,UAAM,EAAE,QAAQ,cAAc,IAAI,aAAa,IAAI,OAAO;AAC1D,cAAU,KAAK;AAAA,MACb,MAAM,IAAI;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,iBAAiB,oBAAoB,iBAAiB,gBAAgB;AAExE,cAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,WAAW,CAAC;AACnD;AAAA,IACF;AAGA,QAAI,cAAc;AAClB,QAAI,KAAK,cAAc,KAAK,WAAW,SAAS;AAE9C,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,QACL,kBAAkB,QAAQ,EAAE;AAAA,QAC5B;AAAA,MACF;AACA,oBAAc;AAAA,IAChB;AAEA,UAAM,UAAU,WAAW,IAAI,SAAS,OAAO;AAC/C,WAAO,KAAK,EAAE,YAAY,IAAI,MAAM,YAAY,IAAI,MAAM,YAAY,CAAC;AAAA,EACzE;AAGA,SAAO,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AAC9D,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AACnD,YAAU,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAErD,SAAO,EAAE,QAAQ,SAAS,WAAW,SAAS;AAChD;AAMA,eAAe,cAAc,SAAyC;AACpE,QAAM,KAAK,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AAC/C,MAAI,CAAC,MAAM,CAAC,GAAG,OAAO,EAAG,QAAO;AAChC,SAAO,SAAS,SAAS,OAAO;AAClC;","names":[]}
+{"version":3,"sources":["../src/transfer/capsule-merge.ts"],"sourcesContent":["import { lstat, mkdir, readFile, realpath, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { gunzipSync } from \"node:zlib\";\nimport {\n  createVersion,\n  type VersioningConfig,\n  type VersioningLogger,\n} from \"../page-versioning.js\";\nimport {\n  assertIsDirectoryNotSymlink,\n  assertRealpathInsideRoot,\n  fromPosixRelPath,\n  isPathInsideRoot,\n  sha256String,\n} from \"./fs-utils.js\";\nimport {\n  parseExportBundle,\n  type CapsuleBlock,\n  type ExportManifestV2,\n  type ExportMemoryRecordV1,\n} from \"./types.js\";\n\n/**\n * Three-way conflict-resolution mode for {@link mergeCapsule}.\n *\n * A \"conflict\" is defined as: the same memory-file path exists in both the\n * source archive and the target directory AND the content hash of the local\n * file differs from the archive's manifest entry for that path.\n *\n * Files that exist only in the archive (no local counterpart) are always\n * written regardless of mode — there is no conflict to resolve.\n *\n * Files that are byte-identical (same content hash in both locations) are\n * recorded as {@link MergeCapsuleResult.skipped} with reason `\"identical\"` and\n * are never re-written regardless of mode; this is a no-op optimisation rather\n * than a conflict.\n *\n *  - `\"skip-conflicts\"` (default) — log the conflict, skip the conflicting\n *    archive entries, but continue importing non-conflicting entries. The\n *    resulting merge is the union of:\n *      - all non-conflicting archive files (written to target)\n *      - all pre-existing local files (left unchanged)\n *\n *  - `\"prefer-source\"` — for conflicting files, snapshot the local content via\n *    page-versioning (gotcha #54: snapshot before overwrite) then overwrite\n *    with the archive content.\n *\n *  - `\"prefer-local\"` — for conflicting files, keep the local content; the\n *    archive entry is skipped.\n */\nexport type MergeCapsuleConflictMode =\n  | \"skip-conflicts\"\n  | \"prefer-source\"\n  | \"prefer-local\";\n\n/**\n * Options accepted by {@link mergeCapsule}.\n *\n * `sourceArchive` — absolute or cwd-relative path to a `.capsule.json.gz`\n * archive produced by `exportCapsule`. Must be a V2 bundle.\n *\n * `targetRoot` — absolute or cwd-relative path to the memory directory that\n * receives the merged records. Must be an existing, non-symlink directory.\n *\n * `conflictMode` — see {@link MergeCapsuleConflictMode}. Defaults to\n * `\"skip-conflicts\"`.\n *\n * `versioning` — optional page-versioning config forwarded to\n * {@link createVersion} in `\"prefer-source\"` mode. When omitted or disabled,\n * overwrites proceed without snapshotting (not recommended for production).\n *\n * `log` — optional logger forwarded to {@link createVersion}.\n */\nexport interface MergeCapsuleOptions {\n  sourceArchive: string;\n  targetRoot: string;\n  conflictMode?: MergeCapsuleConflictMode;\n  versioning?: VersioningConfig;\n  log?: VersioningLogger;\n}\n\nexport interface MergeCapsuleWrittenRecord {\n  /** Capsule-relative posix path. */\n  sourcePath: string;\n  /** Memory-dir-relative posix path written on disk. */\n  targetPath: string;\n  /** Whether a page-versioning snapshot was taken before overwriting. */\n  snapshotted: boolean;\n}\n\nexport interface MergeCapsuleSkippedRecord {\n  /** Capsule-relative posix path. */\n  path: string;\n  /**\n   * Why the archive entry was not written.\n   *\n   * `\"conflict\"` — the entry existed locally with different content and the\n   * active mode did not resolve the conflict with a write (`\"skip-conflicts\"` /\n   * `\"prefer-local\"`).\n   *\n   * `\"identical\"` — the entry's content hash matches what is already on disk;\n   * no write is needed.\n   */\n  reason: \"conflict\" | \"identical\";\n}\n\nexport interface MergeCapsuleConflictRecord {\n  /** Capsule-relative posix path of the conflicting entry. */\n  path: string;\n  /** SHA-256 of the archive's copy. */\n  archiveSha256: string;\n  /** SHA-256 of the local copy. */\n  localSha256: string;\n}\n\nexport interface MergeCapsuleResult {\n  /** Records that were written to the target directory. */\n  merged: MergeCapsuleWrittenRecord[];\n  /**\n   * Records that were NOT written (conflict skipped, or byte-identical).\n   * Includes conflicts that were resolved by `\"prefer-local\"`.\n   */\n  skipped: MergeCapsuleSkippedRecord[];\n  /**\n   * Metadata about every detected conflict, regardless of which mode resolved\n   * it. Callers can use this to report \"N conflicts encountered; M overwritten\".\n   */\n  conflicts: MergeCapsuleConflictRecord[];\n  /** The manifest decoded from the archive. */\n  manifest: ExportManifestV2;\n}\n\n// ---------------------------------------------------------------------------\n// Main entry point\n// ---------------------------------------------------------------------------\n\n/**\n * Merge a V2 capsule archive into an existing memory directory using\n * three-way conflict semantics.\n *\n * Sequence:\n *   1. Read + gunzip + JSON.parse the archive.\n *   2. Validate through `parseExportBundle` (V1 rejected).\n *   3. Verify every record's content sha256 against the manifest.\n *      Any mismatch aborts BEFORE any file is written (gotcha #25).\n *   4. Classify each record as: new (no local copy), identical (same hash),\n *      or conflicting (different hash).\n *   5. Apply the selected {@link MergeCapsuleConflictMode} to conflicting\n *      entries; always write new entries; always skip identical entries.\n *\n * Determinism: `merged`, `skipped`, and `conflicts` are all returned sorted\n * by `path`/`sourcePath` so callers get stable output regardless of bundle\n * order.\n */\nexport async function mergeCapsule(\n  opts: MergeCapsuleOptions,\n): Promise<MergeCapsuleResult> {\n  const archiveAbs = path.resolve(opts.sourceArchive);\n  const rootAbs = path.resolve(opts.targetRoot);\n\n  await assertIsDirectoryNotSymlink(rootAbs, \"mergeCapsule\", \"targetRoot\");\n\n  const conflictMode: MergeCapsuleConflictMode =\n    opts.conflictMode ?? \"skip-conflicts\";\n\n  // Rule 51: reject invalid conflictMode values up-front before any I/O.\n  if (\n    conflictMode !== \"skip-conflicts\" &&\n    conflictMode !== \"prefer-source\" &&\n    conflictMode !== \"prefer-local\"\n  ) {\n    throw new Error(\n      `mergeCapsule: unknown conflictMode ${JSON.stringify(conflictMode)}; ` +\n        `expected \"skip-conflicts\", \"prefer-source\", or \"prefer-local\"`,\n    );\n  }\n\n  // ---------------------------------------------------------------------------\n  // Parse + validate archive\n  // ---------------------------------------------------------------------------\n\n  const raw = await readFile(archiveAbs);\n  let json: string;\n  try {\n    json = gunzipSync(raw).toString(\"utf-8\");\n  } catch (cause) {\n    throw new Error(\n      `mergeCapsule: archive is not a valid gzip file: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  let parsedJson: unknown;\n  try {\n    parsedJson = JSON.parse(json);\n  } catch (cause) {\n    throw new Error(\n      `mergeCapsule: archive is not valid JSON after gunzip: ${archiveAbs}`,\n      { cause: cause as Error },\n    );\n  }\n\n  const parsed = parseExportBundle(parsedJson);\n  if (parsed.capsuleVersion !== 2) {\n    throw new Error(\n      \"mergeCapsule: archive is V1; only V2 capsule archives are supported\",\n    );\n  }\n\n  const bundle = parsed.bundle as {\n    manifest: ExportManifestV2;\n    records: ExportMemoryRecordV1[];\n  };\n  const manifest = bundle.manifest;\n  const capsule = manifest.capsule;\n\n  // Build path → manifest entry index for O(1) checksum lookup.\n  const manifestIndex = new Map<string, ExportManifestV2[\"files\"][number]>();\n  for (const f of manifest.files) {\n    manifestIndex.set(f.path, f);\n  }\n  if (manifestIndex.size !== manifest.files.length) {\n    throw new Error(\"mergeCapsule: manifest contains duplicate file paths\");\n  }\n\n  const recordPaths = new Set<string>();\n  for (const rec of bundle.records) {\n    if (recordPaths.has(rec.path)) {\n      throw new Error(\n        `mergeCapsule: bundle contains duplicate record path: ${rec.path}`,\n      );\n    }\n    recordPaths.add(rec.path);\n  }\n\n  // ---------------------------------------------------------------------------\n  // Phase 1: verify checksums + validate paths before ANY filesystem mutation.\n  // (gotcha #25: don't destroy old state before confirming new state succeeds)\n  // ---------------------------------------------------------------------------\n\n  const rootReal = await realpath(rootAbs).catch(() => rootAbs);\n\n  // Tracks normalized, case-folded target paths seen so far in phase 1.  Maps\n  // targetAbs.toLowerCase() → first source path so the collision error can name\n  // both offending entries.  Two manifest entries whose computed target paths\n  // normalise to the same absolute path (e.g. `subdir/file.md` and\n  // `subdir/./file.md`, or differing case on case-insensitive filesystems such\n  // as macOS and Windows) would both refer to the same inode.  In\n  // `skip-conflicts`/`prefer-local` modes one entry would be misclassified as a\n  // local conflict against the OTHER entry's just-written content; in\n  // `prefer-source` the second entry would silently overwrite the first.  We\n  // reject the import up-front before any write (Codex P2 thread on PR #748,\n  // mirroring `capsule-import.ts`).\n  const seenTargetPaths = new Map<string, string>();\n\n  for (const rec of bundle.records) {\n    // Checksum validation.\n    const entry = manifestIndex.get(rec.path);\n    if (!entry) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch (record without manifest entry: ${rec.path})`,\n      );\n    }\n    const { sha256, bytes } = sha256String(rec.content);\n    if (sha256 !== entry.sha256 || bytes !== entry.bytes) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch for ${rec.path}: ` +\n          `expected sha256=${entry.sha256} bytes=${entry.bytes}, ` +\n          `got sha256=${sha256} bytes=${bytes}`,\n      );\n    }\n\n    // Path-traversal validation (mirrors capsule-import.ts).\n    if (rec.path.includes(\"\\\\\")) {\n      throw new Error(\n        `mergeCapsule: record path contains backslash separators (Windows-style paths are not allowed): ${rec.path}`,\n      );\n    }\n    const posixNormalized = path.posix.normalize(rec.path);\n    if (\n      rec.path.startsWith(\"/\") ||\n      rec.path.split(\"/\").some((seg) => seg === \"..\") ||\n      posixNormalized.startsWith(\"..\") ||\n      posixNormalized.startsWith(\"/\")\n    ) {\n      throw new Error(\n        `mergeCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Lexical root containment check.\n    const targetAbs = path.join(rootReal, fromPosixRelPath(rec.path));\n    if (!isPathInsideRoot(rootReal, targetAbs)) {\n      throw new Error(\n        `mergeCapsule: record path escapes target root: ${rec.path}`,\n      );\n    }\n\n    // Symlink-aware containment check (shared helper from fs-utils).\n    await assertRealpathInsideRoot(rootReal, targetAbs, rec.path, \"mergeCapsule\");\n\n    // Target-file symlink guard: if the target already exists as a symlink,\n    // reject — writes through symlinks can redirect to unexpected locations.\n    const targetLstat = await lstat(targetAbs).catch(() => null);\n    if (targetLstat !== null && targetLstat.isSymbolicLink()) {\n      throw new Error(\n        `mergeCapsule: record target is a symlink and cannot be written to safely: ${rec.path}`,\n      );\n    }\n\n    // Duplicate normalized target path detection (Codex P2 #748, mirrors\n    // capsule-import.ts).  `path.join` already normalises `.` segments\n    // (e.g. `subdir/./file.md` → `subdir/file.md`).  On case-insensitive\n    // filesystems (macOS default, Windows), two paths that differ only in case\n    // would resolve to the same inode.  We fold the dedup key to lowercase so\n    // that `subdir/File.md` and `subdir/file.md` are detected as duplicates\n    // before any write occurs.  This is intentionally unconditional: the cost\n    // of an extra `.toLowerCase()` on case-sensitive filesystems is negligible,\n    // and a defensive lowercase is far simpler than probing filesystem\n    // case-sensitivity at runtime.  Without this guard, prefer-source mode\n    // would silently overwrite one entry with the other, and skip-conflicts /\n    // prefer-local would misclassify the second entry as a local conflict\n    // against the first entry's freshly written content.\n    const dedupKey = targetAbs.toLowerCase();\n    const firstSourcePath = seenTargetPaths.get(dedupKey);\n    if (firstSourcePath !== undefined) {\n      throw new Error(\n        `mergeCapsule: manifest contains two entries that resolve to the same target path: ` +\n          `\"${firstSourcePath}\" and \"${rec.path}\" both map to \"${rec.path}\"`,\n      );\n    }\n    seenTargetPaths.set(dedupKey, rec.path);\n  }\n\n  // Detect manifest-only entries (missing record). Treat as corruption.\n  for (const f of manifest.files) {\n    if (!recordPaths.has(f.path)) {\n      throw new Error(\n        `mergeCapsule: archive checksum mismatch (manifest entry without record: ${f.path})`,\n      );\n    }\n  }\n\n  // ---------------------------------------------------------------------------\n  // Phase 2: classify records and apply conflict mode.\n  // ---------------------------------------------------------------------------\n\n  const merged: MergeCapsuleWrittenRecord[] = [];\n  const skipped: MergeCapsuleSkippedRecord[] = [];\n  const conflicts: MergeCapsuleConflictRecord[] = [];\n\n  // Sort by source path for deterministic output (mirrors capsule-import.ts).\n  const sortedRecords = [...bundle.records].sort((a, b) =>\n    a.path.localeCompare(b.path),\n  );\n\n  for (const rec of sortedRecords) {\n    const targetAbs = path.join(rootReal, fromPosixRelPath(rec.path));\n    const entry = manifestIndex.get(rec.path)!; // validated above\n\n    const localContent = await readLocalFile(targetAbs);\n\n    if (localContent === null) {\n      // No local copy — always write regardless of mode.\n      await mkdir(path.dirname(targetAbs), { recursive: true });\n      await writeFile(targetAbs, rec.content, \"utf-8\");\n      merged.push({ sourcePath: rec.path, targetPath: rec.path, snapshotted: false });\n      continue;\n    }\n\n    // Local file exists. Check if it is byte-identical to the archive entry.\n    const { sha256: localSha256 } = sha256String(localContent);\n\n    if (localSha256 === entry.sha256) {\n      // Byte-identical — no write needed.\n      skipped.push({ path: rec.path, reason: \"identical\" });\n      continue;\n    }\n\n    // Content differs → conflict.\n    const { sha256: archiveSha256 } = sha256String(rec.content);\n    conflicts.push({\n      path: rec.path,\n      archiveSha256,\n      localSha256,\n    });\n\n    if (conflictMode === \"skip-conflicts\" || conflictMode === \"prefer-local\") {\n      // Keep local copy, skip archive entry.\n      skipped.push({ path: rec.path, reason: \"conflict\" });\n      continue;\n    }\n\n    // conflictMode === \"prefer-source\": snapshot local then overwrite.\n    let snapshotted = false;\n    if (opts.versioning && opts.versioning.enabled) {\n      // Gotcha #54: snapshot BEFORE overwriting.\n      await createVersion(\n        targetAbs,\n        localContent,\n        \"manual\",\n        opts.versioning,\n        opts.log,\n        `capsule-merge: ${capsule.id}`,\n        rootReal,\n      );\n      snapshotted = true;\n    }\n\n    await writeFile(targetAbs, rec.content, \"utf-8\");\n    merged.push({ sourcePath: rec.path, targetPath: rec.path, snapshotted });\n  }\n\n  // Sort output lists for determinism.\n  merged.sort((a, b) => a.sourcePath.localeCompare(b.sourcePath));\n  skipped.sort((a, b) => a.path.localeCompare(b.path));\n  conflicts.sort((a, b) => a.path.localeCompare(b.path));\n\n  return { merged, skipped, conflicts, manifest };\n}\n\n// ---------------------------------------------------------------------------\n// Private helpers\n// ---------------------------------------------------------------------------\n\nasync function readLocalFile(absPath: string): Promise<string | null> {\n  const st = await stat(absPath).catch(() => null);\n  if (!st || !st.isFile()) return null;\n  return readFile(absPath, \"utf-8\");\n}\n\n// Re-export CapsuleBlock so callers don't need a deep import from types.ts.\nexport type { CapsuleBlock };\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,OAAO,OAAO,UAAU,UAAU,MAAM,iBAAiB;AAClE,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAwJ3B,eAAsB,aACpB,MAC6B;AAC7B,QAAM,aAAa,KAAK,QAAQ,KAAK,aAAa;AAClD,QAAM,UAAU,KAAK,QAAQ,KAAK,UAAU;AAE5C,QAAM,4BAA4B,SAAS,gBAAgB,YAAY;AAEvE,QAAM,eACJ,KAAK,gBAAgB;AAGvB,MACE,iBAAiB,oBACjB,iBAAiB,mBACjB,iBAAiB,gBACjB;AACA,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,UAAU,YAAY,CAAC;AAAA,IAEpE;AAAA,EACF;AAMA,QAAM,MAAM,MAAM,SAAS,UAAU;AACrC,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,GAAG,EAAE,SAAS,OAAO;AAAA,EACzC,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mDAAmD,UAAU;AAAA,MAC7D,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,IAAI;AAAA,EAC9B,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,yDAAyD,UAAU;AAAA,MACnE,EAAE,MAAsB;AAAA,IAC1B;AAAA,EACF;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAC3C,MAAI,OAAO,mBAAmB,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO;AAItB,QAAM,WAAW,OAAO;AACxB,QAAM,UAAU,SAAS;AAGzB,QAAM,gBAAgB,oBAAI,IAA+C;AACzE,aAAW,KAAK,SAAS,OAAO;AAC9B,kBAAc,IAAI,EAAE,MAAM,CAAC;AAAA,EAC7B;AACA,MAAI,cAAc,SAAS,SAAS,MAAM,QAAQ;AAChD,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,OAAO,OAAO,SAAS;AAChC,QAAI,YAAY,IAAI,IAAI,IAAI,GAAG;AAC7B,YAAM,IAAI;AAAA,QACR,wDAAwD,IAAI,IAAI;AAAA,MAClE;AAAA,IACF;AACA,gBAAY,IAAI,IAAI,IAAI;AAAA,EAC1B;AAOA,QAAM,WAAW,MAAM,SAAS,OAAO,EAAE,MAAM,MAAM,OAAO;AAa5D,QAAM,kBAAkB,oBAAI,IAAoB;AAEhD,aAAW,OAAO,OAAO,SAAS;AAEhC,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AACxC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,2EAA2E,IAAI,IAAI;AAAA,MACrF;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,MAAM,IAAI,aAAa,IAAI,OAAO;AAClD,QAAI,WAAW,MAAM,UAAU,UAAU,MAAM,OAAO;AACpD,YAAM,IAAI;AAAA,QACR,+CAA+C,IAAI,IAAI,qBAClC,MAAM,MAAM,UAAU,MAAM,KAAK,gBACtC,MAAM,UAAU,KAAK;AAAA,MACvC;AAAA,IACF;AAGA,QAAI,IAAI,KAAK,SAAS,IAAI,GAAG;AAC3B,YAAM,IAAI;AAAA,QACR,kGAAkG,IAAI,IAAI;AAAA,MAC5G;AAAA,IACF;AACA,UAAM,kBAAkB,KAAK,MAAM,UAAU,IAAI,IAAI;AACrD,QACE,IAAI,KAAK,WAAW,GAAG,KACvB,IAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,QAAQ,IAAI,KAC9C,gBAAgB,WAAW,IAAI,KAC/B,gBAAgB,WAAW,GAAG,GAC9B;AACA,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,IAAI;AAAA,MAC5D;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,IAAI,IAAI,CAAC;AAChE,QAAI,CAAC,iBAAiB,UAAU,SAAS,GAAG;AAC1C,YAAM,IAAI;AAAA,QACR,kDAAkD,IAAI,IAAI;AAAA,MAC5D;AAAA,IACF;AAGA,UAAM,yBAAyB,UAAU,WAAW,IAAI,MAAM,cAAc;AAI5E,UAAM,cAAc,MAAM,MAAM,SAAS,EAAE,MAAM,MAAM,IAAI;AAC3D,QAAI,gBAAgB,QAAQ,YAAY,eAAe,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,6EAA6E,IAAI,IAAI;AAAA,MACvF;AAAA,IACF;AAeA,UAAM,WAAW,UAAU,YAAY;AACvC,UAAM,kBAAkB,gBAAgB,IAAI,QAAQ;AACpD,QAAI,oBAAoB,QAAW;AACjC,YAAM,IAAI;AAAA,QACR,sFACM,eAAe,UAAU,IAAI,IAAI,kBAAkB,IAAI,IAAI;AAAA,MACnE;AAAA,IACF;AACA,oBAAgB,IAAI,UAAU,IAAI,IAAI;AAAA,EACxC;AAGA,aAAW,KAAK,SAAS,OAAO;AAC9B,QAAI,CAAC,YAAY,IAAI,EAAE,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,2EAA2E,EAAE,IAAI;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AAMA,QAAM,SAAsC,CAAC;AAC7C,QAAM,UAAuC,CAAC;AAC9C,QAAM,YAA0C,CAAC;AAGjD,QAAM,gBAAgB,CAAC,GAAG,OAAO,OAAO,EAAE;AAAA,IAAK,CAAC,GAAG,MACjD,EAAE,KAAK,cAAc,EAAE,IAAI;AAAA,EAC7B;AAEA,aAAW,OAAO,eAAe;AAC/B,UAAM,YAAY,KAAK,KAAK,UAAU,iBAAiB,IAAI,IAAI,CAAC;AAChE,UAAM,QAAQ,cAAc,IAAI,IAAI,IAAI;AAExC,UAAM,eAAe,MAAM,cAAc,SAAS;AAElD,QAAI,iBAAiB,MAAM;AAEzB,YAAM,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AACxD,YAAM,UAAU,WAAW,IAAI,SAAS,OAAO;AAC/C,aAAO,KAAK,EAAE,YAAY,IAAI,MAAM,YAAY,IAAI,MAAM,aAAa,MAAM,CAAC;AAC9E;AAAA,IACF;AAGA,UAAM,EAAE,QAAQ,YAAY,IAAI,aAAa,YAAY;AAEzD,QAAI,gBAAgB,MAAM,QAAQ;AAEhC,cAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,YAAY,CAAC;AACpD;AAAA,IACF;AAGA,UAAM,EAAE,QAAQ,cAAc,IAAI,aAAa,IAAI,OAAO;AAC1D,cAAU,KAAK;AAAA,MACb,MAAM,IAAI;AAAA,MACV;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,iBAAiB,oBAAoB,iBAAiB,gBAAgB;AAExE,cAAQ,KAAK,EAAE,MAAM,IAAI,MAAM,QAAQ,WAAW,CAAC;AACnD;AAAA,IACF;AAGA,QAAI,cAAc;AAClB,QAAI,KAAK,cAAc,KAAK,WAAW,SAAS;AAE9C,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,QACL,kBAAkB,QAAQ,EAAE;AAAA,QAC5B;AAAA,MACF;AACA,oBAAc;AAAA,IAChB;AAEA,UAAM,UAAU,WAAW,IAAI,SAAS,OAAO;AAC/C,WAAO,KAAK,EAAE,YAAY,IAAI,MAAM,YAAY,IAAI,MAAM,YAAY,CAAC;AAAA,EACzE;AAGA,SAAO,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,cAAc,EAAE,UAAU,CAAC;AAC9D,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AACnD,YAAU,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAErD,SAAO,EAAE,QAAQ,SAAS,WAAW,SAAS;AAChD;AAMA,eAAe,cAAc,SAAyC;AACpE,QAAM,KAAK,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AAC/C,MAAI,CAAC,MAAM,CAAC,GAAG,OAAO,EAAG,QAAO;AAChC,SAAO,SAAS,SAAS,OAAO;AAClC;","names":[]}

package/dist/causal-consolidation.js

@@ -4,10 +4,10 @@ import {
 } from "./chunk-UXA5L2DZ.js";
 import {
   buildExtensionsBlockForConsolidation
-} from "./chunk-D2EFNQMY.js";
+} from "./chunk-XW3W4PV4.js";
 import {
   runPostConsolidationMaterialize
-} from "./chunk-ANJOULTP.js";
+} from "./chunk-C7AF236A.js";
 import "./chunk-LN4YGHTM.js";
 import "./chunk-JLNBQWZ2.js";
 import "./chunk-3UXOZBHV.js";
@@ -20,7 +20,7 @@ import "./chunk-L2EXJQJP.js";
 import "./chunk-7SI52C65.js";
 import "./chunk-RK6F44Y6.js";
 import "./chunk-HQ6NIBL6.js";
-import "./chunk-AX5O25EF.js";
+import "./chunk-VH6EIKVS.js";
 import "./chunk-M7XQSUBB.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-J6A3CX5N.js";
@@ -35,7 +35,7 @@ import "./chunk-DM2T26WE.js";
 import "./chunk-LDXUBPMO.js";
 import "./chunk-FVQJYWH7.js";
 import "./chunk-G7D6GZ5J.js";
-import "./chunk-ALEPI75L.js";
+import "./chunk-VF4XKTX3.js";
 import "./chunk-RGMVMVMF.js";
 import {
   resolveCausalTrajectoryStoreDir
@@ -55,9 +55,10 @@ import {
   listJsonFiles,
   readJsonFile
 } from "./chunk-LPSF4OQH.js";
-import "./chunk-ILXTATKK.js";
+import "./chunk-J2HSAU72.js";
 import "./chunk-A6XUJE5D.js";
 import "./chunk-P7FMDTKL.js";
+import "./chunk-VS2IYZRU.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/causal-consolidation.ts

package/dist/causal-consolidation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/causal-consolidation.ts"],"sourcesContent":["/**\n * causal-consolidation.ts — CMC Phase 2: LLM-Assisted Causal Consolidation\n *\n * Uses an LLM to analyze causal trajectory patterns across sessions.\n * The LLM receives the causal chain graph as context — connected trajectories\n * from different sessions — and identifies recurring behavioral patterns,\n * preference signals, and actionable rules.\n *\n * This is the core CMC innovation: the LLM gets cross-session causal context\n * that no other memory system provides. It can see that a user investigated\n * a bug in session 1, attempted a fix in session 2, and succeeded in session 3 —\n * and synthesize a rule or preference from that chain.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { resolveCausalTrajectoryStoreDir, type CausalTrajectoryRecord } from \"./causal-trajectory.js\";\nimport { readChainIndex, resolveChainsDir, type CausalChainIndex, type CausalEdge } from \"./causal-chain.js\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport { isRecord } from \"./store-contract.js\";\nimport { FallbackLlmClient, fallbackLlmRuntimeContextFromConfig } from \"./fallback-llm.js\";\nimport type { AgentPersonaModelConfig, GatewayConfig, MemoryFile, PluginConfig } from \"./types.js\";\nimport path from \"node:path\";\nimport { log } from \"./logger.js\";\nimport { runPostConsolidationMaterialize } from \"./connectors/codex-materialize-runner.js\";\nimport type { MaterializeResult, RolloutSummaryInput } from \"./connectors/codex-materialize.js\";\nimport { buildExtensionsBlockForConsolidation } from \"./semantic-consolidation.js\";\n\n// ─── Types ───────────────────────────────────────────────────────────────────\n\nexport interface CausalPatternCandidate {\n  id: string;\n  sourceType: \"causal-pattern\";\n  subject: string;\n  category: \"principle\" | \"rule\" | \"preference\";\n  content: string;\n  score: number;\n  rationale: string;\n  outcome: null;\n  provenance: string[];\n  agent: string | null;\n  workflow: string | null;\n}\n\nexport interface ConsolidationConfig {\n  minRecurrence: number;\n  minSessions: number;\n  successThreshold: number;\n}\n\nexport interface LlmConsolidationResult {\n  rules: Array<{\n    content: string;\n    category: \"rule\" | \"principle\" | \"preference\";\n    confidence: number;\n    evidence: string[];\n  }>;\n  preferences: Array<{\n    statement: string;\n    confidence: number;\n    evidence: string[];\n  }>;\n}\n\nconst CAUSAL_RULE_CATEGORIES = new Set([\"rule\", \"principle\", \"preference\"]);\n\ninterface ConsolidationLlmClient {\n  isAvailable(options?: { agentId?: string; modelChain?: AgentPersonaModelConfig }): boolean;\n  chatCompletion(\n    messages: Array<{ role: \"system\" | \"user\" | \"assistant\"; content: string }>,\n    options?: { temperature?: number; maxTokens?: number; agentId?: string; modelChain?: AgentPersonaModelConfig },\n  ): Promise<{ content: string } | null>;\n}\n\n// ─── Trajectory Reading ──────────────────────────────────────────────────────\n\nasync function readAllTrajectories(\n  memoryDir: string,\n  causalTrajectoryStoreDir?: string,\n): Promise<CausalTrajectoryRecord[]> {\n  const root = resolveCausalTrajectoryStoreDir(memoryDir, causalTrajectoryStoreDir);\n  const trajectoriesDir = path.join(root, \"trajectories\");\n\n  const files = await listJsonFiles(trajectoriesDir).catch(() => [] as string[]);\n  const results: CausalTrajectoryRecord[] = [];\n\n  for (const filePath of files) {\n    try {\n      const raw = await readJsonFile(filePath);\n      if (isRecord(raw) && typeof raw.trajectoryId === \"string\") {\n        results.push(raw as unknown as CausalTrajectoryRecord);\n      }\n    } catch {\n      // skip invalid\n    }\n  }\n\n  return results;\n}\n\n// ─── Context Formatting ──────────────────────────────────────────────────────\n\n/**\n * Format trajectories and their causal connections as a readable context\n * for the LLM. Groups by session and shows chain connections.\n */\nfunction formatCausalContext(\n  trajectories: CausalTrajectoryRecord[],\n  chainIndex: CausalChainIndex,\n  maxChars: number = 8000,\n): string {\n  // Group trajectories by session\n  const bySession = new Map<string, CausalTrajectoryRecord[]>();\n  for (const t of trajectories) {\n    const list = bySession.get(t.sessionKey) ?? [];\n    list.push(t);\n    bySession.set(t.sessionKey, list);\n  }\n\n  const lines: string[] = [];\n  lines.push(`## Causal Trajectories (${trajectories.length} across ${bySession.size} sessions)`);\n  lines.push(\"\");\n\n  // Format each session's trajectories\n  for (const [sessionKey, sessionTrajs] of bySession) {\n    lines.push(`### Session: ${sessionKey}`);\n    for (const t of sessionTrajs.slice(0, 5)) {\n      const outcome = t.outcomeKind === \"success\" ? \"+\" : t.outcomeKind === \"failure\" ? \"-\" : \"~\";\n      lines.push(`[${outcome}] Goal: ${t.goal}`);\n      lines.push(`    Action: ${t.actionSummary}`);\n      lines.push(`    Outcome: ${t.outcomeSummary}`);\n      if (t.followUpSummary) lines.push(`    Follow-up: ${t.followUpSummary}`);\n      if (t.entityRefs?.length) lines.push(`    Entities: ${t.entityRefs.join(\", \")}`);\n    }\n    lines.push(\"\");\n  }\n\n  // Format causal chain connections\n  const edgeCount = Object.keys(chainIndex.edges).length;\n  if (edgeCount > 0) {\n    lines.push(`## Cross-Session Causal Chains (${edgeCount} connections)`);\n    lines.push(\"\");\n\n    const trajectoryMap = new Map(trajectories.map((t) => [t.trajectoryId, t]));\n    const shown = new Set<string>();\n\n    for (const [edgeId, edge] of Object.entries(chainIndex.edges)) {\n      if (shown.size >= 10) break; // limit output size\n      const from = trajectoryMap.get(edge.fromTrajectoryId);\n      const to = trajectoryMap.get(edge.toTrajectoryId);\n      if (!from || !to) continue;\n\n      lines.push(`${edge.edgeType}: \"${from.goal}\" (${from.sessionKey}) → \"${to.goal}\" (${to.sessionKey})`);\n      shown.add(edgeId);\n    }\n    lines.push(\"\");\n  }\n\n  const result = lines.join(\"\\n\");\n  return result.length > maxChars ? result.slice(0, maxChars) + \"\\n[truncated]\" : result;\n}\n\n// ─── LLM Consolidation ──────────────────────────────────────────────────────\n\nconst CONSOLIDATION_PROMPT = `You are analyzing a user's causal trajectory history across multiple sessions. Trajectories record what the user tried to do (goal), what they did (action), and what happened (outcome).\n\nYour job is to identify:\n1. BEHAVIORAL RULES: Recurring patterns where the same approach consistently succeeds or fails. These should be actionable guidance for future sessions.\n2. PREFERENCES: What the user cares about, prefers, or consistently chooses — even if never explicitly stated. Infer preferences from what they repeatedly do, retry until successful, or always include in their workflow.\n\nIMPORTANT:\n- Look for CROSS-SESSION patterns — things that repeat across different sessions are more significant than within-session patterns.\n- A user who retries the same goal across sessions has a strong implicit preference for that outcome.\n- Consistent action choices reveal preferences even when the user never says \"I prefer X.\"\n- Frame preferences as \"The user would prefer responses that...\" when applicable.\n\nOutput valid JSON only:\n{\n  \"rules\": [\n    {\"content\": \"actionable rule text\", \"category\": \"rule|principle\", \"confidence\": 0.0-1.0, \"evidence\": [\"trajectory IDs\"]}\n  ],\n  \"preferences\": [\n    {\"statement\": \"The user would prefer...\", \"confidence\": 0.0-1.0, \"evidence\": [\"trajectory IDs\"]}\n  ]\n}\n\nIf no clear patterns exist, return {\"rules\": [], \"preferences\": []}.`;\n\nasync function consolidateWithLlm(\n  context: string,\n  llm: ConsolidationLlmClient,\n  options: { agentId?: string; modelChain?: AgentPersonaModelConfig } = {},\n): Promise<LlmConsolidationResult> {\n  const response = await llm.chatCompletion(\n    [\n      { role: \"system\", content: CONSOLIDATION_PROMPT },\n      { role: \"user\", content: context },\n    ],\n    { temperature: 0.2, maxTokens: 2000, agentId: options.agentId, modelChain: options.modelChain },\n  );\n\n  if (!response?.content) {\n    return { rules: [], preferences: [] };\n  }\n\n  try {\n    // Extract JSON from response (may have markdown code fences)\n    let jsonStr = response.content.trim();\n    const fenceMatch = jsonStr.match(/```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?\\s*```/);\n    if (fenceMatch) jsonStr = fenceMatch[1];\n\n    const parsed = JSON.parse(jsonStr);\n    const rawRules: unknown[] = Array.isArray(parsed.rules) ? parsed.rules : [];\n    const rawPreferences: unknown[] = Array.isArray(parsed.preferences) ? parsed.preferences : [];\n    return {\n      rules: rawRules\n        .map(parseLlmRule)\n        .filter((rule): rule is LlmConsolidationResult[\"rules\"][number] => !!rule),\n      preferences: rawPreferences\n        .map(parseLlmPreference)\n        .filter((pref): pref is LlmConsolidationResult[\"preferences\"][number] => !!pref),\n    };\n  } catch {\n    log.warn(\"[cmc] failed to parse LLM consolidation response\");\n    return { rules: [], preferences: [] };\n  }\n}\n\n// ─── Candidate Generation ────────────────────────────────────────────────────\n\nfunction stablePatternId(content: string): string {\n  const digest = createHash(\"sha256\")\n    .update(`causal-pattern\\0${content}`)\n    .digest(\"hex\")\n    .slice(0, 16);\n  return `causal-pattern:${digest}`;\n}\n\nfunction parseConfidence(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return undefined;\n  return Math.max(0, Math.min(1, value));\n}\n\nfunction parseEvidence(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\" && item.trim().length > 0);\n}\n\nfunction parseLlmRule(raw: unknown): LlmConsolidationResult[\"rules\"][number] | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const r = raw as Record<string, unknown>;\n  const content = typeof r.content === \"string\" ? r.content.trim() : \"\";\n  const category = typeof r.category === \"string\" ? r.category : \"\";\n  const confidence = parseConfidence(r.confidence);\n  if (content.length <= 5 || !CAUSAL_RULE_CATEGORIES.has(category) || confidence === undefined) {\n    return undefined;\n  }\n  return {\n    content,\n    category: category as \"rule\" | \"principle\" | \"preference\",\n    confidence,\n    evidence: parseEvidence(r.evidence),\n  };\n}\n\nfunction parseLlmPreference(raw: unknown): LlmConsolidationResult[\"preferences\"][number] | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  const statement = typeof p.statement === \"string\" ? p.statement.trim() : \"\";\n  const confidence = parseConfidence(p.confidence);\n  if (statement.length <= 5 || confidence === undefined) return undefined;\n  return {\n    statement,\n    confidence,\n    evidence: parseEvidence(p.evidence),\n  };\n}\n\nfunction llmResultToCandidates(result: LlmConsolidationResult): CausalPatternCandidate[] {\n  const candidates: CausalPatternCandidate[] = [];\n\n  for (const rule of result.rules) {\n    const category =\n      rule.category === \"principle\" || rule.category === \"preference\"\n        ? rule.category\n        : \"rule\";\n    candidates.push({\n      id: stablePatternId(rule.content),\n      sourceType: \"causal-pattern\",\n      subject: rule.content.slice(0, 80),\n      category,\n      content: rule.content,\n      score: Math.min(1, rule.confidence ?? 0.7),\n      rationale: \"LLM-identified causal pattern from cross-session trajectory analysis\",\n      outcome: null,\n      provenance: (rule.evidence ?? []).slice(0, 5),\n      agent: null,\n      workflow: null,\n    });\n  }\n\n  for (const preference of result.preferences) {\n    candidates.push({\n      id: stablePatternId(preference.statement),\n      sourceType: \"causal-pattern\",\n      subject: preference.statement.slice(0, 80),\n      category: \"preference\",\n      content: preference.statement,\n      score: Math.min(1, preference.confidence ?? 0.7),\n      rationale: \"LLM-identified preference from cross-session trajectory analysis\",\n      outcome: null,\n      provenance: (preference.evidence ?? []).slice(0, 5),\n      agent: null,\n      workflow: null,\n    });\n  }\n\n  return candidates;\n}\n\nfunction normalizePositiveInteger(value: number, fallback: number): number {\n  return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;\n}\n\nfunction normalizeSuccessThreshold(value: number): number {\n  if (!Number.isFinite(value) || value <= 0) return 0;\n  return Math.min(1, value);\n}\n\nfunction trajectorySuccessScore(trajectory: CausalTrajectoryRecord): number {\n  if (trajectory.outcomeKind === \"success\") return 1;\n  if (trajectory.outcomeKind === \"partial\") return 0.5;\n  return 0;\n}\n\nfunction averageSuccessScore(trajectories: CausalTrajectoryRecord[]): number {\n  if (trajectories.length === 0) return 0;\n  const total = trajectories.reduce((sum, trajectory) => sum + trajectorySuccessScore(trajectory), 0);\n  return total / trajectories.length;\n}\n\nfunction passesConsolidationGates(\n  trajectories: CausalTrajectoryRecord[],\n  config: ConsolidationConfig,\n): boolean {\n  const minRecurrence = normalizePositiveInteger(config.minRecurrence, 1);\n  if (trajectories.length < minRecurrence) return false;\n\n  const minSessions = normalizePositiveInteger(config.minSessions, 1);\n  const sessionCount = new Set(trajectories.map((trajectory) => trajectory.sessionKey)).size;\n  if (sessionCount < minSessions) return false;\n\n  const successThreshold = normalizeSuccessThreshold(config.successThreshold);\n  if (successThreshold > 0 && averageSuccessScore(trajectories) < successThreshold) {\n    return false;\n  }\n\n  return true;\n}\n\n// ─── Public API ──────────────────────────────────────────────────────────────\n\n/**\n * Run LLM-assisted consolidation: read trajectories, format causal context,\n * ask LLM to identify patterns and preferences.\n */\nexport async function deriveCausalPromotionCandidates(options: {\n  memoryDir: string;\n  causalTrajectoryStoreDir?: string;\n  config: ConsolidationConfig;\n  gatewayConfig?: GatewayConfig;\n  gatewayAgentId?: string;\n  modelChain?: AgentPersonaModelConfig;\n  workspaceDir?: string;\n  pluginConfig?: PluginConfig;\n  llmClient?: ConsolidationLlmClient;\n}): Promise<CausalPatternCandidate[]> {\n  try {\n    const trajectories = await readAllTrajectories(options.memoryDir, options.causalTrajectoryStoreDir);\n    if (!passesConsolidationGates(trajectories, options.config)) return [];\n\n    const chainsDir = resolveChainsDir(options.memoryDir, options.causalTrajectoryStoreDir);\n    const chainIndex = await readChainIndex(chainsDir);\n\n    // Format the causal context for the LLM\n    let context = formatCausalContext(trajectories, chainIndex);\n\n    // Append memory extensions block if available (#382)\n    if (options.pluginConfig) {\n      const extBlock = await buildExtensionsBlockForConsolidation(options.pluginConfig);\n      if (extBlock.length > 0) {\n        context += \"\\n\\n\" + extBlock;\n      }\n    }\n\n    // If no LLM available, fall back to empty (no deterministic fallback)\n    const llm = options.llmClient ?? new FallbackLlmClient(\n      options.gatewayConfig,\n      options.pluginConfig\n        ? fallbackLlmRuntimeContextFromConfig(options.pluginConfig, {\n            workspaceDir: options.workspaceDir ?? options.pluginConfig.workspaceDir,\n          })\n        : { workspaceDir: options.workspaceDir },\n    );\n    const llmOptions = { agentId: options.gatewayAgentId, modelChain: options.modelChain };\n    if (!llm.isAvailable(llmOptions)) {\n      log.debug(\"[cmc] no LLM available for consolidation — skipping\");\n      return [];\n    }\n\n    // Call LLM for pattern analysis\n    const result = await consolidateWithLlm(context, llm, llmOptions);\n    const candidates = llmResultToCandidates(result);\n\n    log.debug(`[cmc] LLM consolidation produced ${candidates.length} rule(s) and ${result.preferences.length} preference(s)`);\n    return candidates;\n  } catch (error) {\n    log.warn(`[cmc] consolidation failed (non-fatal): ${error instanceof Error ? error.message : String(error)}`);\n    return [];\n  }\n}\n\n/**\n * Get LLM-synthesized preferences from causal trajectory analysis.\n * Returns formatted preference statements for recall injection.\n */\nexport async function synthesizeCausalPreferencesViaLlm(options: {\n  memoryDir: string;\n  causalTrajectoryStoreDir?: string;\n  gatewayConfig?: GatewayConfig;\n  gatewayAgentId?: string;\n  modelChain?: AgentPersonaModelConfig;\n  workspaceDir?: string;\n  minTrajectories?: number;\n}): Promise<string | null> {\n  try {\n    const trajectories = await readAllTrajectories(options.memoryDir, options.causalTrajectoryStoreDir);\n    if (trajectories.length < (options.minTrajectories ?? 2)) return null;\n\n    const chainsDir = resolveChainsDir(options.memoryDir, options.causalTrajectoryStoreDir);\n    const chainIndex = await readChainIndex(chainsDir);\n    const context = formatCausalContext(trajectories, chainIndex);\n\n    const llm = new FallbackLlmClient(options.gatewayConfig, {\n      workspaceDir: options.workspaceDir,\n    });\n    const llmOptions = { agentId: options.gatewayAgentId, modelChain: options.modelChain };\n    if (!llm.isAvailable(llmOptions)) return null;\n\n    const result = await consolidateWithLlm(context, llm, llmOptions);\n    if (result.preferences.length === 0 && result.rules.length === 0) return null;\n\n    const lines: string[] = [\"## Behavioral Insights (from Causal Chain Analysis)\", \"\"];\n\n    for (const pref of result.preferences) {\n      lines.push(`- ${pref.statement}`);\n    }\n\n    for (const rule of result.rules) {\n      lines.push(`- ${rule.content}`);\n    }\n\n    lines.push(\"\");\n    return lines.join(\"\\n\");\n  } catch (error) {\n    log.warn(`[cmc] preference synthesis failed (non-fatal): ${error instanceof Error ? error.message : String(error)}`);\n    return null;\n  }\n}\n\n/**\n * Optional post-consolidation hook — materializes Codex-native memory artifacts\n * after a causal consolidation run. Guarded by `codexMaterializeMemories` and\n * `codexMaterializeOnConsolidation`. Returns `null` when disabled or when the\n * sentinel is missing (honors user hand-edits).\n *\n * Split from the orchestrator-owned flow so #378 avoids touching\n * orchestrator.ts while Wave 1 edits are in flight.\n */\nexport async function materializeAfterCausalConsolidation(options: {\n  config: PluginConfig;\n  namespace?: string;\n  memories?: MemoryFile[];\n  memoryDir?: string;\n  codexHome?: string;\n  rolloutSummaries?: RolloutSummaryInput[];\n  now?: Date;\n}): Promise<MaterializeResult | null> {\n  // Delegates to the shared post-consolidation helper — see\n  // runPostConsolidationMaterialize in codex-materialize-runner.ts.\n  return runPostConsolidationMaterialize(\"[cmc]\", options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,SAAS,kBAAkB;AAO3B,OAAO,UAAU;AA0CjB,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,aAAa,YAAY,CAAC;AAY1E,eAAe,oBACb,WACA,0BACmC;AACnC,QAAM,OAAO,gCAAgC,WAAW,wBAAwB;AAChF,QAAM,kBAAkB,KAAK,KAAK,MAAM,cAAc;AAEtD,QAAM,QAAQ,MAAM,cAAc,eAAe,EAAE,MAAM,MAAM,CAAC,CAAa;AAC7E,QAAM,UAAoC,CAAC;AAE3C,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,aAAa,QAAQ;AACvC,UAAI,SAAS,GAAG,KAAK,OAAO,IAAI,iBAAiB,UAAU;AACzD,gBAAQ,KAAK,GAAwC;AAAA,MACvD;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAQA,SAAS,oBACP,cACA,YACA,WAAmB,KACX;AAER,QAAM,YAAY,oBAAI,IAAsC;AAC5D,aAAW,KAAK,cAAc;AAC5B,UAAM,OAAO,UAAU,IAAI,EAAE,UAAU,KAAK,CAAC;AAC7C,SAAK,KAAK,CAAC;AACX,cAAU,IAAI,EAAE,YAAY,IAAI;AAAA,EAClC;AAEA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,2BAA2B,aAAa,MAAM,WAAW,UAAU,IAAI,YAAY;AAC9F,QAAM,KAAK,EAAE;AAGb,aAAW,CAAC,YAAY,YAAY,KAAK,WAAW;AAClD,UAAM,KAAK,gBAAgB,UAAU,EAAE;AACvC,eAAW,KAAK,aAAa,MAAM,GAAG,CAAC,GAAG;AACxC,YAAM,UAAU,EAAE,gBAAgB,YAAY,MAAM,EAAE,gBAAgB,YAAY,MAAM;AACxF,YAAM,KAAK,IAAI,OAAO,WAAW,EAAE,IAAI,EAAE;AACzC,YAAM,KAAK,eAAe,EAAE,aAAa,EAAE;AAC3C,YAAM,KAAK,gBAAgB,EAAE,cAAc,EAAE;AAC7C,UAAI,EAAE,gBAAiB,OAAM,KAAK,kBAAkB,EAAE,eAAe,EAAE;AACvE,UAAI,EAAE,YAAY,OAAQ,OAAM,KAAK,iBAAiB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE;AAAA,IACjF;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAGA,QAAM,YAAY,OAAO,KAAK,WAAW,KAAK,EAAE;AAChD,MAAI,YAAY,GAAG;AACjB,UAAM,KAAK,mCAAmC,SAAS,eAAe;AACtE,UAAM,KAAK,EAAE;AAEb,UAAM,gBAAgB,IAAI,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1E,UAAM,QAAQ,oBAAI,IAAY;AAE9B,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,KAAK,GAAG;AAC7D,UAAI,MAAM,QAAQ,GAAI;AACtB,YAAM,OAAO,cAAc,IAAI,KAAK,gBAAgB;AACpD,YAAM,KAAK,cAAc,IAAI,KAAK,cAAc;AAChD,UAAI,CAAC,QAAQ,CAAC,GAAI;AAElB,YAAM,KAAK,GAAG,KAAK,QAAQ,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,aAAQ,GAAG,IAAI,MAAM,GAAG,UAAU,GAAG;AACpG,YAAM,IAAI,MAAM;AAAA,IAClB;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,SAAO,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG,QAAQ,IAAI,kBAAkB;AAClF;AAIA,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwB7B,eAAe,mBACb,SACA,KACA,UAAsE,CAAC,GACtC;AACjC,QAAM,WAAW,MAAM,IAAI;AAAA,IACzB;AAAA,MACE,EAAE,MAAM,UAAU,SAAS,qBAAqB;AAAA,MAChD,EAAE,MAAM,QAAQ,SAAS,QAAQ;AAAA,IACnC;AAAA,IACA,EAAE,aAAa,KAAK,WAAW,KAAM,SAAS,QAAQ,SAAS,YAAY,QAAQ,WAAW;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,SAAS;AACtB,WAAO,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAAA,EACtC;AAEA,MAAI;AAEF,QAAI,UAAU,SAAS,QAAQ,KAAK;AACpC,UAAM,aAAa,QAAQ,MAAM,uCAAuC;AACxE,QAAI,WAAY,WAAU,WAAW,CAAC;AAEtC,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAM,WAAsB,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAC1E,UAAM,iBAA4B,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,cAAc,CAAC;AAC5F,WAAO;AAAA,MACL,OAAO,SACJ,IAAI,YAAY,EAChB,OAAO,CAAC,SAA0D,CAAC,CAAC,IAAI;AAAA,MAC3E,aAAa,eACV,IAAI,kBAAkB,EACtB,OAAO,CAAC,SAAgE,CAAC,CAAC,IAAI;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,QAAI,KAAK,kDAAkD;AAC3D,WAAO,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAAA,EACtC;AACF;AAIA,SAAS,gBAAgB,SAAyB;AAChD,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,mBAAmB,OAAO,EAAE,EACnC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AACd,SAAO,kBAAkB,MAAM;AACjC;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACjE,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AACvC;AAEA,SAAS,cAAc,OAA0B;AAC/C,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAClG;AAEA,SAAS,aAAa,KAAmE;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,EAAE,YAAY,WAAW,EAAE,QAAQ,KAAK,IAAI;AACnE,QAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/D,QAAM,aAAa,gBAAgB,EAAE,UAAU;AAC/C,MAAI,QAAQ,UAAU,KAAK,CAAC,uBAAuB,IAAI,QAAQ,KAAK,eAAe,QAAW;AAC5F,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,cAAc,EAAE,QAAQ;AAAA,EACpC;AACF;AAEA,SAAS,mBAAmB,KAAyE;AACnG,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,cAAc,WAAW,EAAE,UAAU,KAAK,IAAI;AACzE,QAAM,aAAa,gBAAgB,EAAE,UAAU;AAC/C,MAAI,UAAU,UAAU,KAAK,eAAe,OAAW,QAAO;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,cAAc,EAAE,QAAQ;AAAA,EACpC;AACF;AAEA,SAAS,sBAAsB,QAA0D;AACvF,QAAM,aAAuC,CAAC;AAE9C,aAAW,QAAQ,OAAO,OAAO;AAC/B,UAAM,WACJ,KAAK,aAAa,eAAe,KAAK,aAAa,eAC/C,KAAK,WACL;AACN,eAAW,KAAK;AAAA,MACd,IAAI,gBAAgB,KAAK,OAAO;AAAA,MAChC,YAAY;AAAA,MACZ,SAAS,KAAK,QAAQ,MAAM,GAAG,EAAE;AAAA,MACjC;AAAA,MACA,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,KAAK,cAAc,GAAG;AAAA,MACzC,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa,KAAK,YAAY,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,MAC5C,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,aAAW,cAAc,OAAO,aAAa;AAC3C,eAAW,KAAK;AAAA,MACd,IAAI,gBAAgB,WAAW,SAAS;AAAA,MACxC,YAAY;AAAA,MACZ,SAAS,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,MACzC,UAAU;AAAA,MACV,SAAS,WAAW;AAAA,MACpB,OAAO,KAAK,IAAI,GAAG,WAAW,cAAc,GAAG;AAAA,MAC/C,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa,WAAW,YAAY,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,MAClD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAe,UAA0B;AACzE,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AACnE;AAEA,SAAS,0BAA0B,OAAuB;AACxD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,EAAG,QAAO;AAClD,SAAO,KAAK,IAAI,GAAG,KAAK;AAC1B;AAEA,SAAS,uBAAuB,YAA4C;AAC1E,MAAI,WAAW,gBAAgB,UAAW,QAAO;AACjD,MAAI,WAAW,gBAAgB,UAAW,QAAO;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,cAAgD;AAC3E,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,QAAQ,aAAa,OAAO,CAAC,KAAK,eAAe,MAAM,uBAAuB,UAAU,GAAG,CAAC;AAClG,SAAO,QAAQ,aAAa;AAC9B;AAEA,SAAS,yBACP,cACA,QACS;AACT,QAAM,gBAAgB,yBAAyB,OAAO,eAAe,CAAC;AACtE,MAAI,aAAa,SAAS,cAAe,QAAO;AAEhD,QAAM,cAAc,yBAAyB,OAAO,aAAa,CAAC;AAClE,QAAM,eAAe,IAAI,IAAI,aAAa,IAAI,CAAC,eAAe,WAAW,UAAU,CAAC,EAAE;AACtF,MAAI,eAAe,YAAa,QAAO;AAEvC,QAAM,mBAAmB,0BAA0B,OAAO,gBAAgB;AAC1E,MAAI,mBAAmB,KAAK,oBAAoB,YAAY,IAAI,kBAAkB;AAChF,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAQA,eAAsB,gCAAgC,SAUhB;AACpC,MAAI;AACF,UAAM,eAAe,MAAM,oBAAoB,QAAQ,WAAW,QAAQ,wBAAwB;AAClG,QAAI,CAAC,yBAAyB,cAAc,QAAQ,MAAM,EAAG,QAAO,CAAC;AAErE,UAAM,YAAY,iBAAiB,QAAQ,WAAW,QAAQ,wBAAwB;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS;AAGjD,QAAI,UAAU,oBAAoB,cAAc,UAAU;AAG1D,QAAI,QAAQ,cAAc;AACxB,YAAM,WAAW,MAAM,qCAAqC,QAAQ,YAAY;AAChF,UAAI,SAAS,SAAS,GAAG;AACvB,mBAAW,SAAS;AAAA,MACtB;AAAA,IACF;AAGA,UAAM,MAAM,QAAQ,aAAa,IAAI;AAAA,MACnC,QAAQ;AAAA,MACR,QAAQ,eACJ,oCAAoC,QAAQ,cAAc;AAAA,QACxD,cAAc,QAAQ,gBAAgB,QAAQ,aAAa;AAAA,MAC7D,CAAC,IACD,EAAE,cAAc,QAAQ,aAAa;AAAA,IAC3C;AACA,UAAM,aAAa,EAAE,SAAS,QAAQ,gBAAgB,YAAY,QAAQ,WAAW;AACrF,QAAI,CAAC,IAAI,YAAY,UAAU,GAAG;AAChC,UAAI,MAAM,0DAAqD;AAC/D,aAAO,CAAC;AAAA,IACV;AAGA,UAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK,UAAU;AAChE,UAAM,aAAa,sBAAsB,MAAM;AAE/C,QAAI,MAAM,oCAAoC,WAAW,MAAM,gBAAgB,OAAO,YAAY,MAAM,gBAAgB;AACxH,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,KAAK,2CAA2C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAC5G,WAAO,CAAC;AAAA,EACV;AACF;AAMA,eAAsB,kCAAkC,SAQ7B;AACzB,MAAI;AACF,UAAM,eAAe,MAAM,oBAAoB,QAAQ,WAAW,QAAQ,wBAAwB;AAClG,QAAI,aAAa,UAAU,QAAQ,mBAAmB,GAAI,QAAO;AAEjE,UAAM,YAAY,iBAAiB,QAAQ,WAAW,QAAQ,wBAAwB;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS;AACjD,UAAM,UAAU,oBAAoB,cAAc,UAAU;AAE5D,UAAM,MAAM,IAAI,kBAAkB,QAAQ,eAAe;AAAA,MACvD,cAAc,QAAQ;AAAA,IACxB,CAAC;AACD,UAAM,aAAa,EAAE,SAAS,QAAQ,gBAAgB,YAAY,QAAQ,WAAW;AACrF,QAAI,CAAC,IAAI,YAAY,UAAU,EAAG,QAAO;AAEzC,UAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK,UAAU;AAChE,QAAI,OAAO,YAAY,WAAW,KAAK,OAAO,MAAM,WAAW,EAAG,QAAO;AAEzE,UAAM,QAAkB,CAAC,uDAAuD,EAAE;AAElF,eAAW,QAAQ,OAAO,aAAa;AACrC,YAAM,KAAK,KAAK,KAAK,SAAS,EAAE;AAAA,IAClC;AAEA,eAAW,QAAQ,OAAO,OAAO;AAC/B,YAAM,KAAK,KAAK,KAAK,OAAO,EAAE;AAAA,IAChC;AAEA,UAAM,KAAK,EAAE;AACb,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,KAAK,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oCAAoC,SAQpB;AAGpC,SAAO,gCAAgC,SAAS,OAAO;AACzD;","names":[]}
+{"version":3,"sources":["../src/causal-consolidation.ts"],"sourcesContent":["/**\n * causal-consolidation.ts — CMC Phase 2: LLM-Assisted Causal Consolidation\n *\n * Uses an LLM to analyze causal trajectory patterns across sessions.\n * The LLM receives the causal chain graph as context — connected trajectories\n * from different sessions — and identifies recurring behavioral patterns,\n * preference signals, and actionable rules.\n *\n * This is the core CMC innovation: the LLM gets cross-session causal context\n * that no other memory system provides. It can see that a user investigated\n * a bug in session 1, attempted a fix in session 2, and succeeded in session 3 —\n * and synthesize a rule or preference from that chain.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { resolveCausalTrajectoryStoreDir, type CausalTrajectoryRecord } from \"./causal-trajectory.js\";\nimport { readChainIndex, resolveChainsDir, type CausalChainIndex, type CausalEdge } from \"./causal-chain.js\";\nimport { listJsonFiles, readJsonFile } from \"./json-store.js\";\nimport { isRecord } from \"./store-contract.js\";\nimport { FallbackLlmClient, fallbackLlmRuntimeContextFromConfig } from \"./fallback-llm.js\";\nimport type { AgentPersonaModelConfig, GatewayConfig, MemoryFile, PluginConfig } from \"./types.js\";\nimport path from \"node:path\";\nimport { log } from \"./logger.js\";\nimport { runPostConsolidationMaterialize } from \"./connectors/codex-materialize-runner.js\";\nimport type { MaterializeResult, RolloutSummaryInput } from \"./connectors/codex-materialize.js\";\nimport { buildExtensionsBlockForConsolidation } from \"./semantic-consolidation.js\";\n\n// ─── Types ───────────────────────────────────────────────────────────────────\n\nexport interface CausalPatternCandidate {\n  id: string;\n  sourceType: \"causal-pattern\";\n  subject: string;\n  category: \"principle\" | \"rule\" | \"preference\";\n  content: string;\n  score: number;\n  rationale: string;\n  outcome: null;\n  provenance: string[];\n  agent: string | null;\n  workflow: string | null;\n}\n\nexport interface ConsolidationConfig {\n  minRecurrence: number;\n  minSessions: number;\n  successThreshold: number;\n}\n\nexport interface LlmConsolidationResult {\n  rules: Array<{\n    content: string;\n    category: \"rule\" | \"principle\" | \"preference\";\n    confidence: number;\n    evidence: string[];\n  }>;\n  preferences: Array<{\n    statement: string;\n    confidence: number;\n    evidence: string[];\n  }>;\n}\n\nconst CAUSAL_RULE_CATEGORIES = new Set([\"rule\", \"principle\", \"preference\"]);\n\ninterface ConsolidationLlmClient {\n  isAvailable(options?: { agentId?: string; modelChain?: AgentPersonaModelConfig }): boolean;\n  chatCompletion(\n    messages: Array<{ role: \"system\" | \"user\" | \"assistant\"; content: string }>,\n    options?: { temperature?: number; maxTokens?: number; agentId?: string; modelChain?: AgentPersonaModelConfig },\n  ): Promise<{ content: string } | null>;\n}\n\n// ─── Trajectory Reading ──────────────────────────────────────────────────────\n\nasync function readAllTrajectories(\n  memoryDir: string,\n  causalTrajectoryStoreDir?: string,\n): Promise<CausalTrajectoryRecord[]> {\n  const root = resolveCausalTrajectoryStoreDir(memoryDir, causalTrajectoryStoreDir);\n  const trajectoriesDir = path.join(root, \"trajectories\");\n\n  const files = await listJsonFiles(trajectoriesDir).catch(() => [] as string[]);\n  const results: CausalTrajectoryRecord[] = [];\n\n  for (const filePath of files) {\n    try {\n      const raw = await readJsonFile(filePath);\n      if (isRecord(raw) && typeof raw.trajectoryId === \"string\") {\n        results.push(raw as unknown as CausalTrajectoryRecord);\n      }\n    } catch {\n      // skip invalid\n    }\n  }\n\n  return results;\n}\n\n// ─── Context Formatting ──────────────────────────────────────────────────────\n\n/**\n * Format trajectories and their causal connections as a readable context\n * for the LLM. Groups by session and shows chain connections.\n */\nfunction formatCausalContext(\n  trajectories: CausalTrajectoryRecord[],\n  chainIndex: CausalChainIndex,\n  maxChars: number = 8000,\n): string {\n  // Group trajectories by session\n  const bySession = new Map<string, CausalTrajectoryRecord[]>();\n  for (const t of trajectories) {\n    const list = bySession.get(t.sessionKey) ?? [];\n    list.push(t);\n    bySession.set(t.sessionKey, list);\n  }\n\n  const lines: string[] = [];\n  lines.push(`## Causal Trajectories (${trajectories.length} across ${bySession.size} sessions)`);\n  lines.push(\"\");\n\n  // Format each session's trajectories\n  for (const [sessionKey, sessionTrajs] of bySession) {\n    lines.push(`### Session: ${sessionKey}`);\n    for (const t of sessionTrajs.slice(0, 5)) {\n      const outcome = t.outcomeKind === \"success\" ? \"+\" : t.outcomeKind === \"failure\" ? \"-\" : \"~\";\n      lines.push(`[${outcome}] Goal: ${t.goal}`);\n      lines.push(`    Action: ${t.actionSummary}`);\n      lines.push(`    Outcome: ${t.outcomeSummary}`);\n      if (t.followUpSummary) lines.push(`    Follow-up: ${t.followUpSummary}`);\n      if (t.entityRefs?.length) lines.push(`    Entities: ${t.entityRefs.join(\", \")}`);\n    }\n    lines.push(\"\");\n  }\n\n  // Format causal chain connections\n  const edgeCount = Object.keys(chainIndex.edges).length;\n  if (edgeCount > 0) {\n    lines.push(`## Cross-Session Causal Chains (${edgeCount} connections)`);\n    lines.push(\"\");\n\n    const trajectoryMap = new Map(trajectories.map((t) => [t.trajectoryId, t]));\n    const shown = new Set<string>();\n\n    for (const [edgeId, edge] of Object.entries(chainIndex.edges)) {\n      if (shown.size >= 10) break; // limit output size\n      const from = trajectoryMap.get(edge.fromTrajectoryId);\n      const to = trajectoryMap.get(edge.toTrajectoryId);\n      if (!from || !to) continue;\n\n      lines.push(`${edge.edgeType}: \"${from.goal}\" (${from.sessionKey}) → \"${to.goal}\" (${to.sessionKey})`);\n      shown.add(edgeId);\n    }\n    lines.push(\"\");\n  }\n\n  const result = lines.join(\"\\n\");\n  return result.length > maxChars ? result.slice(0, maxChars) + \"\\n[truncated]\" : result;\n}\n\n// ─── LLM Consolidation ──────────────────────────────────────────────────────\n\nconst CONSOLIDATION_PROMPT = `You are analyzing a user's causal trajectory history across multiple sessions. Trajectories record what the user tried to do (goal), what they did (action), and what happened (outcome).\n\nYour job is to identify:\n1. BEHAVIORAL RULES: Recurring patterns where the same approach consistently succeeds or fails. These should be actionable guidance for future sessions.\n2. PREFERENCES: What the user cares about, prefers, or consistently chooses — even if never explicitly stated. Infer preferences from what they repeatedly do, retry until successful, or always include in their workflow.\n\nIMPORTANT:\n- Look for CROSS-SESSION patterns — things that repeat across different sessions are more significant than within-session patterns.\n- A user who retries the same goal across sessions has a strong implicit preference for that outcome.\n- Consistent action choices reveal preferences even when the user never says \"I prefer X.\"\n- Frame preferences as \"The user would prefer responses that...\" when applicable.\n\nOutput valid JSON only:\n{\n  \"rules\": [\n    {\"content\": \"actionable rule text\", \"category\": \"rule|principle\", \"confidence\": 0.0-1.0, \"evidence\": [\"trajectory IDs\"]}\n  ],\n  \"preferences\": [\n    {\"statement\": \"The user would prefer...\", \"confidence\": 0.0-1.0, \"evidence\": [\"trajectory IDs\"]}\n  ]\n}\n\nIf no clear patterns exist, return {\"rules\": [], \"preferences\": []}.`;\n\nasync function consolidateWithLlm(\n  context: string,\n  llm: ConsolidationLlmClient,\n  options: { agentId?: string; modelChain?: AgentPersonaModelConfig } = {},\n): Promise<LlmConsolidationResult> {\n  const response = await llm.chatCompletion(\n    [\n      { role: \"system\", content: CONSOLIDATION_PROMPT },\n      { role: \"user\", content: context },\n    ],\n    { temperature: 0.2, maxTokens: 2000, agentId: options.agentId, modelChain: options.modelChain },\n  );\n\n  if (!response?.content) {\n    return { rules: [], preferences: [] };\n  }\n\n  try {\n    // Extract JSON from response (may have markdown code fences)\n    let jsonStr = response.content.trim();\n    const fenceMatch = jsonStr.match(/```(?:json)?\\s*\\n?([\\s\\S]*?)\\n?\\s*```/);\n    if (fenceMatch) jsonStr = fenceMatch[1];\n\n    const parsed = JSON.parse(jsonStr);\n    const rawRules: unknown[] = Array.isArray(parsed.rules) ? parsed.rules : [];\n    const rawPreferences: unknown[] = Array.isArray(parsed.preferences) ? parsed.preferences : [];\n    return {\n      rules: rawRules\n        .map(parseLlmRule)\n        .filter((rule): rule is LlmConsolidationResult[\"rules\"][number] => !!rule),\n      preferences: rawPreferences\n        .map(parseLlmPreference)\n        .filter((pref): pref is LlmConsolidationResult[\"preferences\"][number] => !!pref),\n    };\n  } catch {\n    log.warn(\"[cmc] failed to parse LLM consolidation response\");\n    return { rules: [], preferences: [] };\n  }\n}\n\n// ─── Candidate Generation ────────────────────────────────────────────────────\n\nfunction stablePatternId(content: string): string {\n  const digest = createHash(\"sha256\")\n    .update(`causal-pattern\\0${content}`)\n    .digest(\"hex\")\n    .slice(0, 16);\n  return `causal-pattern:${digest}`;\n}\n\nfunction parseConfidence(value: unknown): number | undefined {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return undefined;\n  return Math.max(0, Math.min(1, value));\n}\n\nfunction parseEvidence(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\" && item.trim().length > 0);\n}\n\nfunction parseLlmRule(raw: unknown): LlmConsolidationResult[\"rules\"][number] | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const r = raw as Record<string, unknown>;\n  const content = typeof r.content === \"string\" ? r.content.trim() : \"\";\n  const category = typeof r.category === \"string\" ? r.category : \"\";\n  const confidence = parseConfidence(r.confidence);\n  if (content.length <= 5 || !CAUSAL_RULE_CATEGORIES.has(category) || confidence === undefined) {\n    return undefined;\n  }\n  return {\n    content,\n    category: category as \"rule\" | \"principle\" | \"preference\",\n    confidence,\n    evidence: parseEvidence(r.evidence),\n  };\n}\n\nfunction parseLlmPreference(raw: unknown): LlmConsolidationResult[\"preferences\"][number] | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const p = raw as Record<string, unknown>;\n  const statement = typeof p.statement === \"string\" ? p.statement.trim() : \"\";\n  const confidence = parseConfidence(p.confidence);\n  if (statement.length <= 5 || confidence === undefined) return undefined;\n  return {\n    statement,\n    confidence,\n    evidence: parseEvidence(p.evidence),\n  };\n}\n\nfunction llmResultToCandidates(result: LlmConsolidationResult): CausalPatternCandidate[] {\n  const candidates: CausalPatternCandidate[] = [];\n\n  for (const rule of result.rules) {\n    const category =\n      rule.category === \"principle\" || rule.category === \"preference\"\n        ? rule.category\n        : \"rule\";\n    candidates.push({\n      id: stablePatternId(rule.content),\n      sourceType: \"causal-pattern\",\n      subject: rule.content.slice(0, 80),\n      category,\n      content: rule.content,\n      score: Math.min(1, rule.confidence ?? 0.7),\n      rationale: \"LLM-identified causal pattern from cross-session trajectory analysis\",\n      outcome: null,\n      provenance: (rule.evidence ?? []).slice(0, 5),\n      agent: null,\n      workflow: null,\n    });\n  }\n\n  for (const preference of result.preferences) {\n    candidates.push({\n      id: stablePatternId(preference.statement),\n      sourceType: \"causal-pattern\",\n      subject: preference.statement.slice(0, 80),\n      category: \"preference\",\n      content: preference.statement,\n      score: Math.min(1, preference.confidence ?? 0.7),\n      rationale: \"LLM-identified preference from cross-session trajectory analysis\",\n      outcome: null,\n      provenance: (preference.evidence ?? []).slice(0, 5),\n      agent: null,\n      workflow: null,\n    });\n  }\n\n  return candidates;\n}\n\nfunction normalizePositiveInteger(value: number, fallback: number): number {\n  return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;\n}\n\nfunction normalizeSuccessThreshold(value: number): number {\n  if (!Number.isFinite(value) || value <= 0) return 0;\n  return Math.min(1, value);\n}\n\nfunction trajectorySuccessScore(trajectory: CausalTrajectoryRecord): number {\n  if (trajectory.outcomeKind === \"success\") return 1;\n  if (trajectory.outcomeKind === \"partial\") return 0.5;\n  return 0;\n}\n\nfunction averageSuccessScore(trajectories: CausalTrajectoryRecord[]): number {\n  if (trajectories.length === 0) return 0;\n  const total = trajectories.reduce((sum, trajectory) => sum + trajectorySuccessScore(trajectory), 0);\n  return total / trajectories.length;\n}\n\nfunction passesConsolidationGates(\n  trajectories: CausalTrajectoryRecord[],\n  config: ConsolidationConfig,\n): boolean {\n  const minRecurrence = normalizePositiveInteger(config.minRecurrence, 1);\n  if (trajectories.length < minRecurrence) return false;\n\n  const minSessions = normalizePositiveInteger(config.minSessions, 1);\n  const sessionCount = new Set(trajectories.map((trajectory) => trajectory.sessionKey)).size;\n  if (sessionCount < minSessions) return false;\n\n  const successThreshold = normalizeSuccessThreshold(config.successThreshold);\n  if (successThreshold > 0 && averageSuccessScore(trajectories) < successThreshold) {\n    return false;\n  }\n\n  return true;\n}\n\n// ─── Public API ──────────────────────────────────────────────────────────────\n\n/**\n * Run LLM-assisted consolidation: read trajectories, format causal context,\n * ask LLM to identify patterns and preferences.\n */\nexport async function deriveCausalPromotionCandidates(options: {\n  memoryDir: string;\n  causalTrajectoryStoreDir?: string;\n  config: ConsolidationConfig;\n  gatewayConfig?: GatewayConfig;\n  gatewayAgentId?: string;\n  modelChain?: AgentPersonaModelConfig;\n  workspaceDir?: string;\n  pluginConfig?: PluginConfig;\n  llmClient?: ConsolidationLlmClient;\n}): Promise<CausalPatternCandidate[]> {\n  try {\n    const trajectories = await readAllTrajectories(options.memoryDir, options.causalTrajectoryStoreDir);\n    if (!passesConsolidationGates(trajectories, options.config)) return [];\n\n    const chainsDir = resolveChainsDir(options.memoryDir, options.causalTrajectoryStoreDir);\n    const chainIndex = await readChainIndex(chainsDir);\n\n    // Format the causal context for the LLM\n    let context = formatCausalContext(trajectories, chainIndex);\n\n    // Append memory extensions block if available (#382)\n    if (options.pluginConfig) {\n      const extBlock = await buildExtensionsBlockForConsolidation(options.pluginConfig);\n      if (extBlock.length > 0) {\n        context += \"\\n\\n\" + extBlock;\n      }\n    }\n\n    // If no LLM available, fall back to empty (no deterministic fallback)\n    const llm = options.llmClient ?? new FallbackLlmClient(\n      options.gatewayConfig,\n      options.pluginConfig\n        ? fallbackLlmRuntimeContextFromConfig(options.pluginConfig, {\n            workspaceDir: options.workspaceDir ?? options.pluginConfig.workspaceDir,\n          })\n        : { workspaceDir: options.workspaceDir },\n    );\n    const llmOptions = { agentId: options.gatewayAgentId, modelChain: options.modelChain };\n    if (!llm.isAvailable(llmOptions)) {\n      log.debug(\"[cmc] no LLM available for consolidation — skipping\");\n      return [];\n    }\n\n    // Call LLM for pattern analysis\n    const result = await consolidateWithLlm(context, llm, llmOptions);\n    const candidates = llmResultToCandidates(result);\n\n    log.debug(`[cmc] LLM consolidation produced ${candidates.length} rule(s) and ${result.preferences.length} preference(s)`);\n    return candidates;\n  } catch (error) {\n    log.warn(`[cmc] consolidation failed (non-fatal): ${error instanceof Error ? error.message : String(error)}`);\n    return [];\n  }\n}\n\n/**\n * Get LLM-synthesized preferences from causal trajectory analysis.\n * Returns formatted preference statements for recall injection.\n */\nexport async function synthesizeCausalPreferencesViaLlm(options: {\n  memoryDir: string;\n  causalTrajectoryStoreDir?: string;\n  gatewayConfig?: GatewayConfig;\n  gatewayAgentId?: string;\n  modelChain?: AgentPersonaModelConfig;\n  workspaceDir?: string;\n  minTrajectories?: number;\n}): Promise<string | null> {\n  try {\n    const trajectories = await readAllTrajectories(options.memoryDir, options.causalTrajectoryStoreDir);\n    if (trajectories.length < (options.minTrajectories ?? 2)) return null;\n\n    const chainsDir = resolveChainsDir(options.memoryDir, options.causalTrajectoryStoreDir);\n    const chainIndex = await readChainIndex(chainsDir);\n    const context = formatCausalContext(trajectories, chainIndex);\n\n    const llm = new FallbackLlmClient(options.gatewayConfig, {\n      workspaceDir: options.workspaceDir,\n    });\n    const llmOptions = { agentId: options.gatewayAgentId, modelChain: options.modelChain };\n    if (!llm.isAvailable(llmOptions)) return null;\n\n    const result = await consolidateWithLlm(context, llm, llmOptions);\n    if (result.preferences.length === 0 && result.rules.length === 0) return null;\n\n    const lines: string[] = [\"## Behavioral Insights (from Causal Chain Analysis)\", \"\"];\n\n    for (const pref of result.preferences) {\n      lines.push(`- ${pref.statement}`);\n    }\n\n    for (const rule of result.rules) {\n      lines.push(`- ${rule.content}`);\n    }\n\n    lines.push(\"\");\n    return lines.join(\"\\n\");\n  } catch (error) {\n    log.warn(`[cmc] preference synthesis failed (non-fatal): ${error instanceof Error ? error.message : String(error)}`);\n    return null;\n  }\n}\n\n/**\n * Optional post-consolidation hook — materializes Codex-native memory artifacts\n * after a causal consolidation run. Guarded by `codexMaterializeMemories` and\n * `codexMaterializeOnConsolidation`. Returns `null` when disabled or when the\n * sentinel is missing (honors user hand-edits).\n *\n * Split from the orchestrator-owned flow so #378 avoids touching\n * orchestrator.ts while Wave 1 edits are in flight.\n */\nexport async function materializeAfterCausalConsolidation(options: {\n  config: PluginConfig;\n  namespace?: string;\n  memories?: MemoryFile[];\n  memoryDir?: string;\n  codexHome?: string;\n  rolloutSummaries?: RolloutSummaryInput[];\n  now?: Date;\n}): Promise<MaterializeResult | null> {\n  // Delegates to the shared post-consolidation helper — see\n  // runPostConsolidationMaterialize in codex-materialize-runner.ts.\n  return runPostConsolidationMaterialize(\"[cmc]\", options);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,SAAS,kBAAkB;AAO3B,OAAO,UAAU;AA0CjB,IAAM,yBAAyB,oBAAI,IAAI,CAAC,QAAQ,aAAa,YAAY,CAAC;AAY1E,eAAe,oBACb,WACA,0BACmC;AACnC,QAAM,OAAO,gCAAgC,WAAW,wBAAwB;AAChF,QAAM,kBAAkB,KAAK,KAAK,MAAM,cAAc;AAEtD,QAAM,QAAQ,MAAM,cAAc,eAAe,EAAE,MAAM,MAAM,CAAC,CAAa;AAC7E,QAAM,UAAoC,CAAC;AAE3C,aAAW,YAAY,OAAO;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM,aAAa,QAAQ;AACvC,UAAI,SAAS,GAAG,KAAK,OAAO,IAAI,iBAAiB,UAAU;AACzD,gBAAQ,KAAK,GAAwC;AAAA,MACvD;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAQA,SAAS,oBACP,cACA,YACA,WAAmB,KACX;AAER,QAAM,YAAY,oBAAI,IAAsC;AAC5D,aAAW,KAAK,cAAc;AAC5B,UAAM,OAAO,UAAU,IAAI,EAAE,UAAU,KAAK,CAAC;AAC7C,SAAK,KAAK,CAAC;AACX,cAAU,IAAI,EAAE,YAAY,IAAI;AAAA,EAClC;AAEA,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,2BAA2B,aAAa,MAAM,WAAW,UAAU,IAAI,YAAY;AAC9F,QAAM,KAAK,EAAE;AAGb,aAAW,CAAC,YAAY,YAAY,KAAK,WAAW;AAClD,UAAM,KAAK,gBAAgB,UAAU,EAAE;AACvC,eAAW,KAAK,aAAa,MAAM,GAAG,CAAC,GAAG;AACxC,YAAM,UAAU,EAAE,gBAAgB,YAAY,MAAM,EAAE,gBAAgB,YAAY,MAAM;AACxF,YAAM,KAAK,IAAI,OAAO,WAAW,EAAE,IAAI,EAAE;AACzC,YAAM,KAAK,eAAe,EAAE,aAAa,EAAE;AAC3C,YAAM,KAAK,gBAAgB,EAAE,cAAc,EAAE;AAC7C,UAAI,EAAE,gBAAiB,OAAM,KAAK,kBAAkB,EAAE,eAAe,EAAE;AACvE,UAAI,EAAE,YAAY,OAAQ,OAAM,KAAK,iBAAiB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE;AAAA,IACjF;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAGA,QAAM,YAAY,OAAO,KAAK,WAAW,KAAK,EAAE;AAChD,MAAI,YAAY,GAAG;AACjB,UAAM,KAAK,mCAAmC,SAAS,eAAe;AACtE,UAAM,KAAK,EAAE;AAEb,UAAM,gBAAgB,IAAI,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;AAC1E,UAAM,QAAQ,oBAAI,IAAY;AAE9B,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,WAAW,KAAK,GAAG;AAC7D,UAAI,MAAM,QAAQ,GAAI;AACtB,YAAM,OAAO,cAAc,IAAI,KAAK,gBAAgB;AACpD,YAAM,KAAK,cAAc,IAAI,KAAK,cAAc;AAChD,UAAI,CAAC,QAAQ,CAAC,GAAI;AAElB,YAAM,KAAK,GAAG,KAAK,QAAQ,MAAM,KAAK,IAAI,MAAM,KAAK,UAAU,aAAQ,GAAG,IAAI,MAAM,GAAG,UAAU,GAAG;AACpG,YAAM,IAAI,MAAM;AAAA,IAClB;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,QAAM,SAAS,MAAM,KAAK,IAAI;AAC9B,SAAO,OAAO,SAAS,WAAW,OAAO,MAAM,GAAG,QAAQ,IAAI,kBAAkB;AAClF;AAIA,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAwB7B,eAAe,mBACb,SACA,KACA,UAAsE,CAAC,GACtC;AACjC,QAAM,WAAW,MAAM,IAAI;AAAA,IACzB;AAAA,MACE,EAAE,MAAM,UAAU,SAAS,qBAAqB;AAAA,MAChD,EAAE,MAAM,QAAQ,SAAS,QAAQ;AAAA,IACnC;AAAA,IACA,EAAE,aAAa,KAAK,WAAW,KAAM,SAAS,QAAQ,SAAS,YAAY,QAAQ,WAAW;AAAA,EAChG;AAEA,MAAI,CAAC,UAAU,SAAS;AACtB,WAAO,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAAA,EACtC;AAEA,MAAI;AAEF,QAAI,UAAU,SAAS,QAAQ,KAAK;AACpC,UAAM,aAAa,QAAQ,MAAM,uCAAuC;AACxE,QAAI,WAAY,WAAU,WAAW,CAAC;AAEtC,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAM,WAAsB,MAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,QAAQ,CAAC;AAC1E,UAAM,iBAA4B,MAAM,QAAQ,OAAO,WAAW,IAAI,OAAO,cAAc,CAAC;AAC5F,WAAO;AAAA,MACL,OAAO,SACJ,IAAI,YAAY,EAChB,OAAO,CAAC,SAA0D,CAAC,CAAC,IAAI;AAAA,MAC3E,aAAa,eACV,IAAI,kBAAkB,EACtB,OAAO,CAAC,SAAgE,CAAC,CAAC,IAAI;AAAA,IACnF;AAAA,EACF,QAAQ;AACN,QAAI,KAAK,kDAAkD;AAC3D,WAAO,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,EAAE;AAAA,EACtC;AACF;AAIA,SAAS,gBAAgB,SAAyB;AAChD,QAAM,SAAS,WAAW,QAAQ,EAC/B,OAAO,mBAAmB,OAAO,EAAE,EACnC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AACd,SAAO,kBAAkB,MAAM;AACjC;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACjE,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AACvC;AAEA,SAAS,cAAc,OAA0B;AAC/C,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAClG;AAEA,SAAS,aAAa,KAAmE;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,IAAI;AACV,QAAM,UAAU,OAAO,EAAE,YAAY,WAAW,EAAE,QAAQ,KAAK,IAAI;AACnE,QAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/D,QAAM,aAAa,gBAAgB,EAAE,UAAU;AAC/C,MAAI,QAAQ,UAAU,KAAK,CAAC,uBAAuB,IAAI,QAAQ,KAAK,eAAe,QAAW;AAC5F,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,cAAc,EAAE,QAAQ;AAAA,EACpC;AACF;AAEA,SAAS,mBAAmB,KAAyE;AACnG,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,QAAO;AAClE,QAAM,IAAI;AACV,QAAM,YAAY,OAAO,EAAE,cAAc,WAAW,EAAE,UAAU,KAAK,IAAI;AACzE,QAAM,aAAa,gBAAgB,EAAE,UAAU;AAC/C,MAAI,UAAU,UAAU,KAAK,eAAe,OAAW,QAAO;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU,cAAc,EAAE,QAAQ;AAAA,EACpC;AACF;AAEA,SAAS,sBAAsB,QAA0D;AACvF,QAAM,aAAuC,CAAC;AAE9C,aAAW,QAAQ,OAAO,OAAO;AAC/B,UAAM,WACJ,KAAK,aAAa,eAAe,KAAK,aAAa,eAC/C,KAAK,WACL;AACN,eAAW,KAAK;AAAA,MACd,IAAI,gBAAgB,KAAK,OAAO;AAAA,MAChC,YAAY;AAAA,MACZ,SAAS,KAAK,QAAQ,MAAM,GAAG,EAAE;AAAA,MACjC;AAAA,MACA,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,IAAI,GAAG,KAAK,cAAc,GAAG;AAAA,MACzC,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa,KAAK,YAAY,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,MAC5C,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,aAAW,cAAc,OAAO,aAAa;AAC3C,eAAW,KAAK;AAAA,MACd,IAAI,gBAAgB,WAAW,SAAS;AAAA,MACxC,YAAY;AAAA,MACZ,SAAS,WAAW,UAAU,MAAM,GAAG,EAAE;AAAA,MACzC,UAAU;AAAA,MACV,SAAS,WAAW;AAAA,MACpB,OAAO,KAAK,IAAI,GAAG,WAAW,cAAc,GAAG;AAAA,MAC/C,WAAW;AAAA,MACX,SAAS;AAAA,MACT,aAAa,WAAW,YAAY,CAAC,GAAG,MAAM,GAAG,CAAC;AAAA,MAClD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,yBAAyB,OAAe,UAA0B;AACzE,SAAO,OAAO,SAAS,KAAK,KAAK,QAAQ,IAAI,KAAK,MAAM,KAAK,IAAI;AACnE;AAEA,SAAS,0BAA0B,OAAuB;AACxD,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,SAAS,EAAG,QAAO;AAClD,SAAO,KAAK,IAAI,GAAG,KAAK;AAC1B;AAEA,SAAS,uBAAuB,YAA4C;AAC1E,MAAI,WAAW,gBAAgB,UAAW,QAAO;AACjD,MAAI,WAAW,gBAAgB,UAAW,QAAO;AACjD,SAAO;AACT;AAEA,SAAS,oBAAoB,cAAgD;AAC3E,MAAI,aAAa,WAAW,EAAG,QAAO;AACtC,QAAM,QAAQ,aAAa,OAAO,CAAC,KAAK,eAAe,MAAM,uBAAuB,UAAU,GAAG,CAAC;AAClG,SAAO,QAAQ,aAAa;AAC9B;AAEA,SAAS,yBACP,cACA,QACS;AACT,QAAM,gBAAgB,yBAAyB,OAAO,eAAe,CAAC;AACtE,MAAI,aAAa,SAAS,cAAe,QAAO;AAEhD,QAAM,cAAc,yBAAyB,OAAO,aAAa,CAAC;AAClE,QAAM,eAAe,IAAI,IAAI,aAAa,IAAI,CAAC,eAAe,WAAW,UAAU,CAAC,EAAE;AACtF,MAAI,eAAe,YAAa,QAAO;AAEvC,QAAM,mBAAmB,0BAA0B,OAAO,gBAAgB;AAC1E,MAAI,mBAAmB,KAAK,oBAAoB,YAAY,IAAI,kBAAkB;AAChF,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAQA,eAAsB,gCAAgC,SAUhB;AACpC,MAAI;AACF,UAAM,eAAe,MAAM,oBAAoB,QAAQ,WAAW,QAAQ,wBAAwB;AAClG,QAAI,CAAC,yBAAyB,cAAc,QAAQ,MAAM,EAAG,QAAO,CAAC;AAErE,UAAM,YAAY,iBAAiB,QAAQ,WAAW,QAAQ,wBAAwB;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS;AAGjD,QAAI,UAAU,oBAAoB,cAAc,UAAU;AAG1D,QAAI,QAAQ,cAAc;AACxB,YAAM,WAAW,MAAM,qCAAqC,QAAQ,YAAY;AAChF,UAAI,SAAS,SAAS,GAAG;AACvB,mBAAW,SAAS;AAAA,MACtB;AAAA,IACF;AAGA,UAAM,MAAM,QAAQ,aAAa,IAAI;AAAA,MACnC,QAAQ;AAAA,MACR,QAAQ,eACJ,oCAAoC,QAAQ,cAAc;AAAA,QACxD,cAAc,QAAQ,gBAAgB,QAAQ,aAAa;AAAA,MAC7D,CAAC,IACD,EAAE,cAAc,QAAQ,aAAa;AAAA,IAC3C;AACA,UAAM,aAAa,EAAE,SAAS,QAAQ,gBAAgB,YAAY,QAAQ,WAAW;AACrF,QAAI,CAAC,IAAI,YAAY,UAAU,GAAG;AAChC,UAAI,MAAM,0DAAqD;AAC/D,aAAO,CAAC;AAAA,IACV;AAGA,UAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK,UAAU;AAChE,UAAM,aAAa,sBAAsB,MAAM;AAE/C,QAAI,MAAM,oCAAoC,WAAW,MAAM,gBAAgB,OAAO,YAAY,MAAM,gBAAgB;AACxH,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,KAAK,2CAA2C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAC5G,WAAO,CAAC;AAAA,EACV;AACF;AAMA,eAAsB,kCAAkC,SAQ7B;AACzB,MAAI;AACF,UAAM,eAAe,MAAM,oBAAoB,QAAQ,WAAW,QAAQ,wBAAwB;AAClG,QAAI,aAAa,UAAU,QAAQ,mBAAmB,GAAI,QAAO;AAEjE,UAAM,YAAY,iBAAiB,QAAQ,WAAW,QAAQ,wBAAwB;AACtF,UAAM,aAAa,MAAM,eAAe,SAAS;AACjD,UAAM,UAAU,oBAAoB,cAAc,UAAU;AAE5D,UAAM,MAAM,IAAI,kBAAkB,QAAQ,eAAe;AAAA,MACvD,cAAc,QAAQ;AAAA,IACxB,CAAC;AACD,UAAM,aAAa,EAAE,SAAS,QAAQ,gBAAgB,YAAY,QAAQ,WAAW;AACrF,QAAI,CAAC,IAAI,YAAY,UAAU,EAAG,QAAO;AAEzC,UAAM,SAAS,MAAM,mBAAmB,SAAS,KAAK,UAAU;AAChE,QAAI,OAAO,YAAY,WAAW,KAAK,OAAO,MAAM,WAAW,EAAG,QAAO;AAEzE,UAAM,QAAkB,CAAC,uDAAuD,EAAE;AAElF,eAAW,QAAQ,OAAO,aAAa;AACrC,YAAM,KAAK,KAAK,KAAK,SAAS,EAAE;AAAA,IAClC;AAEA,eAAW,QAAQ,OAAO,OAAO;AAC/B,YAAM,KAAK,KAAK,KAAK,OAAO,EAAE;AAAA,IAChC;AAEA,UAAM,KAAK,EAAE;AACb,WAAO,MAAM,KAAK,IAAI;AAAA,EACxB,SAAS,OAAO;AACd,QAAI,KAAK,kDAAkD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnH,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oCAAoC,SAQpB;AAGpC,SAAO,gCAAgC,SAAS,OAAO;AACzD;","names":[]}

package/dist/{chunk-2KDQI363.js → chunk-2HEZXPYU.js}

@@ -11,13 +11,13 @@ import {
 } from "./chunk-D24OXEPB.js";
 import {
   EngramAccessInputError
-} from "./chunk-DFAXGZKI.js";
+} from "./chunk-JIX3ZL2J.js";
 import {
   projectTagProjectId
 } from "./chunk-GYSYLGNE.js";
 import {
   validateBriefingFormat
-} from "./chunk-GY3V3SUI.js";
+} from "./chunk-KHGE6PMF.js";
 import {
   resolvePrincipal
 } from "./chunk-UZYLX7M6.js";
@@ -29,7 +29,7 @@ import {
 } from "./chunk-JUC24CTX.js";
 import {
   validateRequest
-} from "./chunk-UAU5U5ML.js";
+} from "./chunk-UDJLF3BO.js";
 
 // src/access-mcp.ts
 import { readFile } from "fs/promises";
@@ -3117,4 +3117,4 @@ ${body}`;
 export {
   EngramMcpServer
 };
-//# sourceMappingURL=chunk-2KDQI363.js.map
+//# sourceMappingURL=chunk-2HEZXPYU.js.map

package/dist/chunk-5GPPACXK.js

@@ -0,0 +1,16 @@
+// src/utils/path-containment.ts
+import path from "path";
+function pathIsInside(parent, child) {
+  const relative = path.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+function assertPathInsideRoot(rootReal, candidateReal, originalPath) {
+  if (!pathIsInside(rootReal, candidateReal)) {
+    throw new Error(`Refusing to scan memory path outside memoryDir: ${originalPath}`);
+  }
+}
+
+export {
+  assertPathInsideRoot
+};
+//# sourceMappingURL=chunk-5GPPACXK.js.map

package/dist/chunk-5GPPACXK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/path-containment.ts"],"sourcesContent":["/**\n * @remnic/core — Path Containment Guards\n *\n * Shared symlink/traversal containment helpers for filesystem walkers that\n * scan the memory store. Extracted from search/document-scanner.ts so every\n * walker (the search index scanner, the CLI dedupe walker, ...) enforces the\n * SAME containment semantics instead of forking the check (CLAUDE.md rule 22).\n *\n * Both helpers operate on realpath()-resolved absolute paths: callers resolve\n * symlinks first, then assert the resolved target is still inside the (also\n * realpath-resolved) memory root. This blocks a symlinked category directory\n * (e.g. decisions/ → /etc) from redirecting a scan — or a destructive dedupe\n * unlink — outside the memory store.\n */\n\nimport path from \"node:path\";\n\n/**\n * True when `child` is `parent` itself or nested underneath it. Both arguments\n * must already be resolved (realpath) absolute paths.\n */\nexport function pathIsInside(parent: string, child: string): boolean {\n  const relative = path.relative(parent, child);\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n\n/**\n * Throw if the realpath-resolved `candidateReal` escapes `rootReal`. The\n * message references the original (pre-realpath) path so operators can locate\n * the offending symlink/entry.\n */\nexport function assertPathInsideRoot(\n  rootReal: string,\n  candidateReal: string,\n  originalPath: string,\n): void {\n  if (!pathIsInside(rootReal, candidateReal)) {\n    throw new Error(`Refusing to scan memory path outside memoryDir: ${originalPath}`);\n  }\n}\n"],"mappings":";AAeA,OAAO,UAAU;AAMV,SAAS,aAAa,QAAgB,OAAwB;AACnE,QAAM,WAAW,KAAK,SAAS,QAAQ,KAAK;AAC5C,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;AAOO,SAAS,qBACd,UACA,eACA,cACM;AACN,MAAI,CAAC,aAAa,UAAU,aAAa,GAAG;AAC1C,UAAM,IAAI,MAAM,mDAAmD,YAAY,EAAE;AAAA,EACnF;AACF;","names":[]}

package/dist/{chunk-F6O7IOS3.js → chunk-6JBKHTQD.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-SFQ6QNL7.js";
 import {
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   buildLifecycleEventsForMemory,
   sortMemoryLifecycleEvents
@@ -74,4 +74,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-F6O7IOS3.js.map
+//# sourceMappingURL=chunk-6JBKHTQD.js.map

package/dist/{chunk-TBLGI2LT.js → chunk-7ILWCUWH.js}

@@ -3,12 +3,14 @@ import {
   normalizeNamespaceIdentity
 } from "./chunk-ZFXCQPNO.js";
 import {
-  ALL_CATEGORY_DIRS,
   StorageManager
-} from "./chunk-AX5O25EF.js";
+} from "./chunk-VH6EIKVS.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
+import {
+  ALL_CATEGORY_DIRS
+} from "./chunk-VS2IYZRU.js";
 
 // src/namespaces/storage.ts
 import path from "path";
@@ -209,4 +211,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-TBLGI2LT.js.map
+//# sourceMappingURL=chunk-7ILWCUWH.js.map

package/dist/{chunk-TBLGI2LT.js.map → chunk-7ILWCUWH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!config.namespacesEnabled) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(config.defaultNamespace),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : (await exists(legacyNsDir))\n      ? legacyNsDir\n      : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!config.namespacesEnabled) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));\n  if (\n    (await exists(tokenizedRoot)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))\n  ) {\n    return tokenizedRoot;\n  }\n  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // In-flight resolve-hook dedup (NFJV-, codex P2). The catalog's `onResolve`\n  // hook is ASYNC (it returns `registerResolved(...)`), so `notifiedResolved` is\n  // only set after the hook's promise SETTLES. Without tracking the in-flight\n  // window, a burst of `storageFor()` cache hits for the SAME namespace before\n  // the first registration finishes would each pass the `notifiedResolved` guard\n  // and fire their OWN `onResolve` — queueing N duplicate catalog touches + lock\n  // acquisitions despite the once-per-namespace intent. We therefore record the\n  // (namespace → storageDir) being registered BEFORE awaiting the hook so a\n  // concurrent call for the same pair skips firing. On SUCCESS the pair is\n  // promoted to `notifiedResolved` (future calls skip permanently); on `false`\n  // (dropped touch — e.g. rebuild-lock timeout) OR rejection the in-flight marker\n  // is CLEARED so a later `storageFor()` can RETRY the dropped registration. The\n  // entry is always removed when the promise settles, so the map cannot grow\n  // unbounded (one transient entry per concurrently-resolving namespace).\n  private readonly inFlightResolved = new Map<string, string>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    this.cache.set(ns, sm);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Skip when we've already SUCCESSFULLY notified this exact (namespace,\n    // storageDir) — a steady-state cache hit must not re-append to the catalog\n    // log (NCNL2). A changed dir (rare: migration/realignment) still re-fires\n    // once. We mark the pair as notified ONLY AFTER the hook succeeds, and CLEAR\n    // it on failure, so a dropped registration (e.g. rebuild-lock timeout) is\n    // RETRIED on the next cache hit instead of being suppressed forever (round 6,\n    // cursor Medium — ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (NFJV-, codex P2): if a registration for this exact\n    // (namespace, storageDir) is already AWAITING its async hook, do not fire a\n    // second one. Without this, concurrent cache-hit bursts before the first\n    // append settles each pass the `notifiedResolved` guard above and queue\n    // duplicate catalog touches/lock acquisitions. A pair with a DIFFERENT\n    // in-flight dir (rare mid-migration realignment) still fires once.\n    if (this.inFlightResolved.get(namespace) === storageDir) return;\n    try {\n      // Handle BOTH synchronous throws and asynchronous rejections (round 6,\n      // codex P2 — NDo8C). The hook may be `async`; its rejected promise would\n      // bypass this try/catch and, where unhandled rejections are fatal, crash\n      // storage resolution. Mark the dedup pair as notified ONLY when the hook\n      // resolves to a PERSISTED result (round 6, codex P2 — NEFoX): a result of\n      // `false` means the registration was dropped/no-op (e.g. rebuild-lock\n      // timeout), so we must NOT suppress its retry. `void`/`undefined` is treated\n      // as success for legacy hooks. On rejection we leave it un-notified to retry.\n      //\n      // Record the in-flight marker BEFORE awaiting so concurrent calls for the\n      // same pair skip (NFJV-). It is always cleared once the promise settles, so\n      // the map holds at most one transient entry per concurrently-resolving\n      // namespace and cannot grow unbounded.\n      this.inFlightResolved.set(namespace, storageDir);\n      Promise.resolve(hook(namespace, storageDir)).then(\n        (persisted) => {\n          // Clear the in-flight marker ONLY if it is still ours (a newer resolve\n          // for a different dir may have replaced it).\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (persisted !== false) {\n            this.notifiedResolved.set(namespace, storageDir);\n          }\n          // On `false` (dropped touch) we intentionally do NOT mark notified, so\n          // a later `storageFor()` retries the registration. Clearing the\n          // in-flight marker above is what re-enables that retry.\n        },\n        () => {\n          // Registration failed — clear in-flight AND do NOT mark as notified, so\n          // it is retried on the next cache hit.\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (this.notifiedResolved.get(namespace) === storageDir) {\n            this.notifiedResolved.delete(namespace);\n          }\n        },\n      );\n    } catch {\n      // Synchronous throw: clear any in-flight marker we just set and leave the\n      // pair un-notified so a later resolve retries.\n      if (this.inFlightResolved.get(namespace) === storageDir) {\n        this.inFlightResolved.delete(namespace);\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AAOvC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,OAAO,mBAAmB;AAC7B,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,OAAO,gBAAgB;AAAA,EAChD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IACvB,cACA;AACN,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,OAAO,kBAAmB,QAAO,OAAO;AAI7C,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,oBAAoB,OAAO,WAAW,SAAS;AAClE,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAC7F,MACG,MAAM,OAAO,aAAa,KAC1B,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAChF;AACA,WAAO;AAAA,EACT;AACA,SAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AACnD;AAEO,IAAM,yBAAN,MAA6B;AAAA,EA+BlC,YACmB,QACA,QAAqC,CAAC,GACvD;AAFiB;AACA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EAJmB;AAAA,EACA;AAAA,EAhCF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAe3C,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3C;AAAA,EASjB,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAClC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAQX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAOzD,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,QAAI;AAcF,WAAK,iBAAiB,IAAI,WAAW,UAAU;AAC/C,cAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC,EAAE;AAAA,QAC3C,CAAC,cAAc;AAGb,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,cAAc,OAAO;AACvB,iBAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,UACjD;AAAA,QAIF;AAAA,QACA,MAAM;AAGJ,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAGN,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,aAAK,iBAAiB,OAAO,SAAS;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!config.namespacesEnabled) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(config.defaultNamespace),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : (await exists(legacyNsDir))\n      ? legacyNsDir\n      : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!config.namespacesEnabled) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));\n  if (\n    (await exists(tokenizedRoot)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))\n  ) {\n    return tokenizedRoot;\n  }\n  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // In-flight resolve-hook dedup (NFJV-, codex P2). The catalog's `onResolve`\n  // hook is ASYNC (it returns `registerResolved(...)`), so `notifiedResolved` is\n  // only set after the hook's promise SETTLES. Without tracking the in-flight\n  // window, a burst of `storageFor()` cache hits for the SAME namespace before\n  // the first registration finishes would each pass the `notifiedResolved` guard\n  // and fire their OWN `onResolve` — queueing N duplicate catalog touches + lock\n  // acquisitions despite the once-per-namespace intent. We therefore record the\n  // (namespace → storageDir) being registered BEFORE awaiting the hook so a\n  // concurrent call for the same pair skips firing. On SUCCESS the pair is\n  // promoted to `notifiedResolved` (future calls skip permanently); on `false`\n  // (dropped touch — e.g. rebuild-lock timeout) OR rejection the in-flight marker\n  // is CLEARED so a later `storageFor()` can RETRY the dropped registration. The\n  // entry is always removed when the promise settles, so the map cannot grow\n  // unbounded (one transient entry per concurrently-resolving namespace).\n  private readonly inFlightResolved = new Map<string, string>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    this.cache.set(ns, sm);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Skip when we've already SUCCESSFULLY notified this exact (namespace,\n    // storageDir) — a steady-state cache hit must not re-append to the catalog\n    // log (NCNL2). A changed dir (rare: migration/realignment) still re-fires\n    // once. We mark the pair as notified ONLY AFTER the hook succeeds, and CLEAR\n    // it on failure, so a dropped registration (e.g. rebuild-lock timeout) is\n    // RETRIED on the next cache hit instead of being suppressed forever (round 6,\n    // cursor Medium — ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (NFJV-, codex P2): if a registration for this exact\n    // (namespace, storageDir) is already AWAITING its async hook, do not fire a\n    // second one. Without this, concurrent cache-hit bursts before the first\n    // append settles each pass the `notifiedResolved` guard above and queue\n    // duplicate catalog touches/lock acquisitions. A pair with a DIFFERENT\n    // in-flight dir (rare mid-migration realignment) still fires once.\n    if (this.inFlightResolved.get(namespace) === storageDir) return;\n    try {\n      // Handle BOTH synchronous throws and asynchronous rejections (round 6,\n      // codex P2 — NDo8C). The hook may be `async`; its rejected promise would\n      // bypass this try/catch and, where unhandled rejections are fatal, crash\n      // storage resolution. Mark the dedup pair as notified ONLY when the hook\n      // resolves to a PERSISTED result (round 6, codex P2 — NEFoX): a result of\n      // `false` means the registration was dropped/no-op (e.g. rebuild-lock\n      // timeout), so we must NOT suppress its retry. `void`/`undefined` is treated\n      // as success for legacy hooks. On rejection we leave it un-notified to retry.\n      //\n      // Record the in-flight marker BEFORE awaiting so concurrent calls for the\n      // same pair skip (NFJV-). It is always cleared once the promise settles, so\n      // the map holds at most one transient entry per concurrently-resolving\n      // namespace and cannot grow unbounded.\n      this.inFlightResolved.set(namespace, storageDir);\n      Promise.resolve(hook(namespace, storageDir)).then(\n        (persisted) => {\n          // Clear the in-flight marker ONLY if it is still ours (a newer resolve\n          // for a different dir may have replaced it).\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (persisted !== false) {\n            this.notifiedResolved.set(namespace, storageDir);\n          }\n          // On `false` (dropped touch) we intentionally do NOT mark notified, so\n          // a later `storageFor()` retries the registration. Clearing the\n          // in-flight marker above is what re-enables that retry.\n        },\n        () => {\n          // Registration failed — clear in-flight AND do NOT mark as notified, so\n          // it is retried on the next cache hit.\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (this.notifiedResolved.get(namespace) === storageDir) {\n            this.notifiedResolved.delete(namespace);\n          }\n        },\n      );\n    } catch {\n      // Synchronous throw: clear any in-flight marker we just set and leave the\n      // pair un-notified so a later resolve retries.\n      if (this.inFlightResolved.get(namespace) === storageDir) {\n        this.inFlightResolved.delete(namespace);\n      }\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AAOvC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,OAAO,mBAAmB;AAC7B,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,OAAO,gBAAgB;AAAA,EAChD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IACvB,cACA;AACN,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,OAAO,kBAAmB,QAAO,OAAO;AAI7C,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,oBAAoB,OAAO,WAAW,SAAS;AAClE,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAC7F,MACG,MAAM,OAAO,aAAa,KAC1B,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAChF;AACA,WAAO;AAAA,EACT;AACA,SAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AACnD;AAEO,IAAM,yBAAN,MAA6B;AAAA,EA+BlC,YACmB,QACA,QAAqC,CAAC,GACvD;AAFiB;AACA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EAJmB;AAAA,EACA;AAAA,EAhCF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAe3C,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAM3C;AAAA,EASjB,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAClC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAQX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAOzD,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,QAAI;AAcF,WAAK,iBAAiB,IAAI,WAAW,UAAU;AAC/C,cAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC,EAAE;AAAA,QAC3C,CAAC,cAAc;AAGb,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,cAAc,OAAO;AACvB,iBAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,UACjD;AAAA,QAIF;AAAA,QACA,MAAM;AAGJ,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,IACF,QAAQ;AAGN,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,aAAK,iBAAiB,OAAO,SAAS;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-AL4RAJL5.js → chunk-7XH7VJN4.js}

@@ -4,7 +4,10 @@ import {
 } from "./chunk-G7D6GZ5J.js";
 import {
   sidecarKey
-} from "./chunk-ALEPI75L.js";
+} from "./chunk-VF4XKTX3.js";
+import {
+  RECALL_FALLBACK_DIRS
+} from "./chunk-VS2IYZRU.js";
 
 // src/consolidation-provenance-check.ts
 import path from "path";
@@ -279,8 +282,7 @@ async function runConsolidationProvenanceCheck(options) {
   }
   try {
     const seenPaths = new Set(memories.map((m) => m.path));
-    const scanRoots = ["facts", "corrections", "procedures", "reasoning-traces"];
-    for (const rootName of scanRoots) {
+    for (const rootName of RECALL_FALLBACK_DIRS) {
       const rootPath = path.join(memoryDir, rootName);
       for await (const file of walkMarkdownFiles(rootPath, memoryDir)) {
         if (seenPaths.has(file)) continue;
@@ -340,4 +342,4 @@ function isPathWithin(candidate, root) {
 export {
   runConsolidationProvenanceCheck
 };
-//# sourceMappingURL=chunk-AL4RAJL5.js.map
+//# sourceMappingURL=chunk-7XH7VJN4.js.map

package/dist/chunk-7XH7VJN4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/consolidation-provenance-check.ts"],"sourcesContent":["/**\n * Consolidation provenance integrity check (issue #561 PR 4).\n *\n * Validates that every memory carrying consolidation provenance frontmatter\n * (`derived_from`, `derived_via`) resolves to real data:\n *\n *   - Each `derived_from` entry `\"<path>:<version>\"` must name a\n *     page-version snapshot that exists on disk (via the sidecar layout\n *     documented in `page-versioning.ts`).\n *   - Each `derived_via` must be one of the known\n *     `ConsolidationOperator` values — malformed values are surfaced as\n *     warnings rather than crashes so legacy or future operators survive a\n *     rollback.\n *\n * Non-fatal: every failure renders a warning with the offending file path\n * and a human-readable reason.  Integrity problems are informational for\n * now — we do not auto-heal or archive broken memories.\n */\n\nimport path from \"node:path\";\nimport { lstat, readdir, readFile, realpath, stat } from \"node:fs/promises\";\nimport { constants as fsConstants } from \"node:fs\";\nimport type { StorageManager } from \"./storage.js\";\nimport {\n  DERIVED_FROM_MEMORY_ID_RE,\n  isConsolidationOperator,\n} from \"./consolidation-operator.js\";\n// Import the canonical `sidecarKey` from page-versioning (PR #634\n// review, cursor Medium) so a future key-format change stays in\n// lock-step with the doctor scan.\nimport { sidecarKey } from \"./page-versioning.js\";\nimport { RECALL_FALLBACK_DIRS } from \"./utils/category-dir.js\";\n\n/**\n * Regex to spot a `derived_via: <value>` line in the raw YAML frontmatter\n * between the opening and first closing `---` delimiters.  We use the raw\n * text rather than the parsed `frontmatter.derived_via` because the\n * read-path parser coerces unknown values back to `undefined` — that\n * would silently hide corrupted-or-future operators from the doctor scan\n * (PR #634 review feedback, codex P2).\n */\n// Allow empty capture groups so truncated/blank `derived_via:` and\n// `derived_from:` lines (key present, no value) are distinguishable\n// from \"key missing entirely\" (regex returns null).  Optional\n// leading whitespace accepts indented keys which `parseFrontmatter`\n// also accepts (PR #634 round-6 review, codex P2).\nconst DERIVED_VIA_RAW_RE = /^[\\t ]*derived_via:[\\t ]*(.*)$/mu;\nconst DERIVED_FROM_RAW_RE = /^[\\t ]*derived_from:[\\t ]*(.*)$/mu;\n\n/**\n * Tokenize a YAML-block-style list under `key:` in the given\n * frontmatter slice.  Looks for lines matching `^  - <value>` after a\n * `key:` line and before the next non-list line.  Returns `null` when\n * the key is missing or the value is a scalar / flow list (no block\n * entries found).\n *\n * Only used for the mixed-list malformed-entry detection — it does\n * not try to decode YAML escape sequences since we only need the\n * entry count + raw token text to compare against the parsed array.\n */\nfunction tokenizeRawBlockList(fmSlice: string, key: string): string[] | null {\n  const lines = fmSlice.split(\"\\n\");\n  // Accept indented keys too — parseFrontmatter does (PR #634 round-7\n  // review, codex P2 / cursor Low).\n  const keyRe = new RegExp(`^[\\\\t ]*${key}:[\\\\t ]*(.*)$`, \"u\");\n  let startIdx = -1;\n  for (let i = 0; i < lines.length; i++) {\n    const m = lines[i].match(keyRe);\n    if (m) {\n      if (m[1].trim().length === 0) {\n        startIdx = i + 1;\n      }\n      break;\n    }\n  }\n  if (startIdx < 0) return null;\n  const items: string[] = [];\n  for (let i = startIdx; i < lines.length; i++) {\n    const line = lines[i];\n    if (!/^\\s+-/.test(line)) break; // not a block-list entry\n    const m = line.match(/^\\s+-\\s*(.*)$/u);\n    if (!m) break;\n    let tok = m[1].trim();\n    if (\n      (tok.startsWith('\"') && tok.endsWith('\"') && tok.length >= 2) ||\n      (tok.startsWith(\"'\") && tok.endsWith(\"'\") && tok.length >= 2)\n    ) {\n      tok = tok.slice(1, -1);\n    }\n    items.push(tok);\n  }\n  return items.length > 0 ? items : null;\n}\n\n/**\n * Tokenize a YAML-flow-style list (`[\"a\", \"b\", ...]`) into a flat\n * string array.  Returns `null` when the input isn't a flow list.\n * Best-effort — we don't implement a full YAML parser, just enough to\n * detect mixed valid/invalid entries for the doctor integrity check.\n */\nfunction tokenizeRawFlowList(raw: string): string[] | null {\n  const trimmed = raw.trim();\n  if (!trimmed.startsWith(\"[\") || !trimmed.endsWith(\"]\")) return null;\n  const inner = trimmed.slice(1, -1);\n  const parts: string[] = [];\n  let current = \"\";\n  let inSingle = false;\n  let inDouble = false;\n  for (let i = 0; i < inner.length; i++) {\n    const ch = inner[i];\n    if (inDouble) {\n      if (ch === \"\\\\\" && i + 1 < inner.length) {\n        current += inner[++i];\n        continue;\n      }\n      if (ch === '\"') {\n        inDouble = false;\n        continue;\n      }\n      current += ch;\n    } else if (inSingle) {\n      if (ch === \"'\" && inner[i + 1] === \"'\") {\n        current += \"'\";\n        i++;\n        continue;\n      }\n      if (ch === \"'\") {\n        inSingle = false;\n        continue;\n      }\n      current += ch;\n    } else if (ch === '\"') {\n      inDouble = true;\n    } else if (ch === \"'\") {\n      inSingle = true;\n    } else if (ch === \",\") {\n      parts.push(current.trim());\n      current = \"\";\n    } else {\n      current += ch;\n    }\n  }\n  if (current.trim().length > 0 || parts.length > 0) {\n    parts.push(current.trim());\n  }\n  return parts;\n}\n\n/**\n * One integrity warning attached to a specific memory.\n */\nexport interface ConsolidationProvenanceIssue {\n  /** Absolute path to the memory markdown file. */\n  memoryPath: string;\n  /** Memory id from frontmatter. */\n  memoryId: string;\n  /** Type of integrity issue. */\n  kind:\n    | \"derived_from_missing_snapshot\"\n    | \"derived_from_malformed_entry\"\n    | \"derived_via_unknown_operator\";\n  /** Human-readable detail — includes the offending value when relevant. */\n  detail: string;\n}\n\n/**\n * Summary of a provenance-integrity scan.  Used by the operator-doctor\n * report and surfaced in the CLI output.\n */\nexport interface ConsolidationProvenanceReport {\n  /** Total memories inspected. */\n  scanned: number;\n  /** Memories that carry `derived_from` and/or `derived_via`. */\n  withProvenance: number;\n  /** One entry per problem detected (may be empty). */\n  issues: ConsolidationProvenanceIssue[];\n}\n\nconst DERIVED_FROM_ENTRY_RE = /^(.+):(\\d+)$/;\n\n/**\n * Build the on-disk snapshot path for a `\"<relpath>:<version>\"` entry,\n * relative to the given memory directory.  Mirrors the layout documented\n * in `page-versioning.ts`:\n *\n *   memoryDir/<sidecarDir>/<sidecarKey>/<version><ext>\n */\nfunction resolveSnapshotPath(\n  memoryDir: string,\n  sidecarDir: string,\n  entry: string,\n): { ok: true; snapshotPath: string } | { ok: false; reason: string } {\n  const match = entry.match(DERIVED_FROM_ENTRY_RE);\n  if (!match) {\n    return { ok: false, reason: `malformed entry (expected \"<path>:<version>\")` };\n  }\n  const pagePath = match[1];\n  const versionId = match[2];\n  const ext = path.extname(pagePath) || \".md\";\n  const key = sidecarKey(pagePath);\n  const snapshotPath = path.join(memoryDir, sidecarDir, key, `${versionId}${ext}`);\n  return { ok: true, snapshotPath };\n}\n\n/**\n * Scan every memory under `storage` and flag consolidation-provenance\n * problems.  Does not throw on individual failures — collects them in the\n * returned report.\n */\nexport async function runConsolidationProvenanceCheck(options: {\n  storage: StorageManager;\n  memoryDir: string;\n  /**\n   * Page-versioning sidecar directory name.  Defaults to `.versions` —\n   * matches the baked-in default used by `setVersioningConfig` when\n   * versioning is enabled via config.\n   */\n  sidecarDir?: string;\n}): Promise<ConsolidationProvenanceReport> {\n  const { storage, memoryDir } = options;\n  const sidecarDir = options.sidecarDir ?? \".versions\";\n\n  const report: ConsolidationProvenanceReport = {\n    scanned: 0,\n    withProvenance: 0,\n    issues: [],\n  };\n\n  let memories;\n  try {\n    memories = await storage.readAllMemories();\n  } catch {\n    // If we can't enumerate memories at all, surface a single synthetic\n    // issue rather than throwing — the doctor wrapper treats an empty\n    // issues list as \"ok\" and we don't want a filesystem hiccup to crash\n    // the whole diagnostic.\n    return {\n      scanned: 0,\n      withProvenance: 0,\n      issues: [\n        {\n          memoryPath: memoryDir,\n          memoryId: \"(unreadable)\",\n          kind: \"derived_from_malformed_entry\",\n          detail: \"Could not enumerate memory directory to scan provenance.\",\n        },\n      ],\n    };\n  }\n\n  for (const memory of memories) {\n    report.scanned += 1;\n    const fm = memory.frontmatter;\n    const derivedFrom = fm.derived_from;\n    const derivedVia = fm.derived_via;\n\n    // Raw frontmatter values from disk — the read-path parser coerces\n    // malformed `derived_from` and unknown `derived_via` back to\n    // `undefined`, which would silently hide on-disk corruption from\n    // the doctor scan (PR #634 review feedback, codex P2).  We\n    // re-extract both via regex so integrity issues are reported even\n    // when the parser normalized them away.  `rawDerivedVia` /\n    // `rawDerivedFrom` being `\"\"` (empty string) represents a\n    // corrupted file with the key present but the value truncated —\n    // that's distinct from \"key missing entirely\" (undefined).\n    let rawDerivedVia: string | undefined;\n    let rawDerivedFrom: string | undefined;\n    let rawDerivedViaKeyPresent = false;\n    let rawDerivedFromKeyPresent = false;\n    let duplicateViaKeys = false;\n    let duplicateFromKeys = false;\n    let viaMatchCount = 0;\n    let fromMatchCount = 0;\n    let fmSlice = \"\";\n    try {\n      const raw = await readFile(memory.path, \"utf-8\");\n      const frontmatterEnd = raw.indexOf(\"\\n---\", raw.indexOf(\"---\") + 3);\n      fmSlice = frontmatterEnd > 0 ? raw.slice(0, frontmatterEnd) : raw;\n      // Use matchAll to find ALL occurrences of `derived_via` / `derived_from`\n      // in the raw YAML.  `parseFrontmatter` keeps the LAST assignment when\n      // duplicate keys appear, so the doctor must read the last occurrence\n      // to match what the storage reader actually uses (PR #634 review,\n      // codex P2 — duplicate `derived_via` keys caused false-clean or\n      // false-unknown-operator warnings depending on order).\n      const viaMatches = [...fmSlice.matchAll(new RegExp(DERIVED_VIA_RAW_RE.source, DERIVED_VIA_RAW_RE.flags + \"g\"))];\n      viaMatchCount = viaMatches.length;\n      duplicateViaKeys = viaMatches.length > 1;\n      if (viaMatches.length > 0) {\n        rawDerivedViaKeyPresent = true;\n        // Use the last occurrence — `parseFrontmatter` keeps the last\n        // assignment when duplicate keys appear, so the doctor must\n        // match that behavior to produce accurate warnings (PR #634\n        // review, codex P2).\n        const lastVia = viaMatches[viaMatches.length - 1];\n        let val = lastVia[1].trim();\n        if (\n          (val.startsWith('\"') && val.endsWith('\"')) ||\n          (val.startsWith(\"'\") && val.endsWith(\"'\"))\n        ) {\n          val = val.slice(1, -1);\n        }\n        rawDerivedVia = val;\n      }\n      const fromMatches = [...fmSlice.matchAll(new RegExp(DERIVED_FROM_RAW_RE.source, DERIVED_FROM_RAW_RE.flags + \"g\"))];\n      fromMatchCount = fromMatches.length;\n      duplicateFromKeys = fromMatches.length > 1;\n      if (fromMatches.length > 0) {\n        rawDerivedFromKeyPresent = true;\n        const lastFrom = fromMatches[fromMatches.length - 1];\n        rawDerivedFrom = lastFrom[1].trim();\n      }\n    } catch {\n      // Fall through to the parsed values.\n    }\n\n    const hasFrom = Array.isArray(derivedFrom) && derivedFrom.length > 0;\n    const hasVia = derivedVia !== undefined && derivedVia !== null;\n    const hasRawVia = rawDerivedVia !== undefined && rawDerivedVia.length > 0;\n    // A raw `derived_from` that the parser dropped indicates on-disk\n    // corruption we must surface.  We detect this by: (a) the raw YAML\n    // contains a `derived_from:` key, AND (b) the parsed frontmatter\n    // has no valid array.  A scalar like `derived_from: facts/a.md:7`\n    // (list brackets omitted) or a blank `derived_from:` both hit this\n    // branch.\n    const hasRawMalformedFrom = rawDerivedFromKeyPresent && !hasFrom;\n    // A blank `derived_via:` with no value is also corrupt — the\n    // parser drops it to undefined, but the raw key is still present\n    // on disk (PR #634 round-3 review, codex P2).\n    const hasBlankRawVia =\n      rawDerivedViaKeyPresent &&\n      (rawDerivedVia === undefined || rawDerivedVia.length === 0) &&\n      !hasVia;\n    if (\n      !hasFrom && !hasVia && !hasRawVia &&\n      !hasRawMalformedFrom && !hasBlankRawVia\n    ) continue;\n    report.withProvenance += 1;\n\n    // Duplicate-key detection (PR #634 review, codex P2): when the raw\n    // YAML contains multiple `derived_via` or `derived_from` lines,\n    // `parseFrontmatter` silently uses the last one.  Flag this as a\n    // malformed entry so operators can inspect and fix the file.\n    if (duplicateViaKeys) {\n      report.issues.push({\n        memoryPath: memory.path,\n        memoryId: fm.id,\n        kind: \"derived_via_unknown_operator\",\n        detail: `raw YAML contains ${viaMatchCount} \"derived_via\" keys; parseFrontmatter uses the last occurrence`,\n      });\n    }\n    if (duplicateFromKeys) {\n      report.issues.push({\n        memoryPath: memory.path,\n        memoryId: fm.id,\n        kind: \"derived_from_malformed_entry\",\n        detail: `raw YAML contains ${fromMatchCount} \"derived_from\" keys; parseFrontmatter uses the last occurrence`,\n      });\n    }\n\n    if (hasRawMalformedFrom) {\n      const display = rawDerivedFrom ?? \"(blank)\";\n      report.issues.push({\n        memoryPath: memory.path,\n        memoryId: fm.id,\n        kind: \"derived_from_malformed_entry\",\n        detail: `raw YAML \"derived_from: ${display}\" could not be parsed as a list`,\n      });\n    }\n\n    // Mixed-list detection (PR #634 round-4 + round-5 review, codex\n    // P2): when the parser DID return a valid list but the raw YAML\n    // includes additional tokens that got dropped, flag those as\n    // malformed.  Handles both flow-style (`[\"a\", \"\", \"b\"]`) and\n    // block-style (`\\n  - a\\n  - \\n  - b`) YAML lists.\n    if (hasFrom && rawDerivedFromKeyPresent) {\n      let rawList: string[] | null = null;\n      if (rawDerivedFrom && rawDerivedFrom.length > 0) {\n        rawList = tokenizeRawFlowList(rawDerivedFrom);\n      }\n      if (rawList === null) {\n        // Fall back to block-list tokenization by re-reading the full\n        // frontmatter (already loaded above as `raw`) and scanning\n        // the lines following `derived_from:`.\n        rawList = tokenizeRawBlockList(fmSlice, \"derived_from\");\n      }\n      if (rawList !== null && rawList.length > derivedFrom!.length) {\n        for (const tok of rawList) {\n          if (tok.length === 0) {\n            report.issues.push({\n              memoryPath: memory.path,\n              memoryId: fm.id,\n              kind: \"derived_from_malformed_entry\",\n              detail: `raw YAML derived_from contains an empty entry (mixed list)`,\n            });\n            continue;\n          }\n          if (!derivedFrom!.includes(tok)) {\n            // Accept either the snapshot format `<path>:<version>` or\n            // a bare memory id (issue #687 PR 2/4 — pattern\n            // reinforcement uses ID-shaped entries).  PR #730\n            // review feedback, Codex P2.\n            if (\n              !/^(.+):(\\d+)$/u.test(tok) &&\n              !DERIVED_FROM_MEMORY_ID_RE.test(tok)\n            ) {\n              report.issues.push({\n                memoryPath: memory.path,\n                memoryId: fm.id,\n                kind: \"derived_from_malformed_entry\",\n                detail: `raw YAML derived_from contains a malformed entry: ${JSON.stringify(tok)}`,\n              });\n            }\n          }\n        }\n      }\n    }\n    if (hasBlankRawVia) {\n      report.issues.push({\n        memoryPath: memory.path,\n        memoryId: fm.id,\n        kind: \"derived_via_unknown_operator\",\n        detail: \"raw YAML has `derived_via:` key with empty value\",\n      });\n    }\n\n    if (hasFrom) {\n      for (const entry of derivedFrom!) {\n        // Pattern-reinforcement (issue #687 PR 2/4) records source\n        // memory IDs directly in `derived_from` rather than\n        // page-versioning snapshot references.  Memory IDs may\n        // contain `:` for namespace-prefixed forms like\n        // `global:fact-abc-123`, but never `/` or `.` — those remain\n        // exclusive to snapshot paths (PR #730 review feedback,\n        // Codex P1).  For ID-shaped entries we skip the snapshot\n        // file check entirely — but ONLY when the operator is\n        // `pattern-reinforcement`, which is the sole operator that\n        // legitimately stores IDs rather than snapshot references.\n        // Allowing the bypass for split/merge/update would weaken\n        // validation on those existing consolidation paths (PR #730\n        // review, Codex P2).\n        if (\n          derivedVia === \"pattern-reinforcement\" &&\n          DERIVED_FROM_MEMORY_ID_RE.test(entry)\n        ) {\n          continue;\n        }\n        const resolved = resolveSnapshotPath(memoryDir, sidecarDir, entry);\n        if (!resolved.ok) {\n          report.issues.push({\n            memoryPath: memory.path,\n            memoryId: fm.id,\n            kind: \"derived_from_malformed_entry\",\n            detail: `${JSON.stringify(entry)}: ${resolved.reason}`,\n          });\n          continue;\n        }\n        // Require a regular file at the snapshot path (PR #634\n        // round-8 review, codex P2) — a directory or device node at\n        // that path means the sidecar was corrupted and the snapshot\n        // is effectively missing.\n        let snapshotOk = false;\n        try {\n          const st = await stat(resolved.snapshotPath);\n          snapshotOk = st.isFile();\n        } catch {\n          snapshotOk = false;\n        }\n        if (!snapshotOk) {\n          report.issues.push({\n            memoryPath: memory.path,\n            memoryId: fm.id,\n            kind: \"derived_from_missing_snapshot\",\n            detail: `${entry} → ${resolved.snapshotPath} (not a regular file)`,\n          });\n        }\n      }\n    }\n\n    // Check the RAW YAML value for unknown operators.  The parsed value\n    // (`fm.derived_via`) is always known-good because the read-path\n    // normalizer dropped anything else to undefined.\n    if (hasRawVia && !isConsolidationOperator(rawDerivedVia)) {\n      report.issues.push({\n        memoryPath: memory.path,\n        memoryId: fm.id,\n        kind: \"derived_via_unknown_operator\",\n        detail: `unknown operator: ${JSON.stringify(rawDerivedVia)}`,\n      });\n    }\n  }\n\n  // Parse-failure detection (PR #634 round-4 review, codex P2):\n  // `readAllMemories()` silently drops files whose frontmatter\n  // doesn't parse.  Walk every recall category directory for `.md` files\n  // that DO reference provenance frontmatter but didn't come back from the\n  // reader — those are the corruption cases the doctor is meant to surface.\n  // Uses RECALL_FALLBACK_DIRS (the single source of truth) so newly-routed\n  // categories (decisions/, preferences/, ...) are scanned too (#1546).\n  try {\n    const seenPaths = new Set(memories.map((m) => m.path));\n    for (const rootName of RECALL_FALLBACK_DIRS) {\n      const rootPath = path.join(memoryDir, rootName);\n      for await (const file of walkMarkdownFiles(rootPath, memoryDir)) {\n        if (seenPaths.has(file)) continue;\n        try {\n          const raw = await readFile(file, \"utf-8\");\n          if (\n            DERIVED_FROM_RAW_RE.test(raw) ||\n            DERIVED_VIA_RAW_RE.test(raw)\n          ) {\n            report.withProvenance += 1;\n            report.issues.push({\n              memoryPath: file,\n              memoryId: \"(parse failed)\",\n              kind: \"derived_from_malformed_entry\",\n              detail:\n                \"frontmatter could not be parsed by storage reader; provenance fields visible in raw YAML\",\n            });\n          }\n        } catch {\n          // Unreadable file — skip.\n        }\n      }\n    }\n  } catch {\n    // Best-effort; don't fail the whole scan on a filesystem hiccup.\n  }\n\n  return report;\n}\n\n/**\n * Recursively yield all `.md` file paths under `root`.  Silent on\n * missing directories — the facts/corrections dirs may not exist in\n * fresh installs.  Symlinked roots/directories are skipped so the\n * best-effort parse-failure pass cannot escape `memoryDir`.\n */\nasync function* walkMarkdownFiles(root: string, memoryDir: string): AsyncGenerator<string> {\n  let entries;\n  let memoryDirReal: string;\n  try {\n    const rootStat = await lstat(root);\n    if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) return;\n    memoryDirReal = await realpath(memoryDir);\n    const rootReal = await realpath(root);\n    if (!isPathWithin(rootReal, memoryDirReal)) return;\n    entries = await readdir(root, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const entry of entries) {\n    const full = path.join(root, entry.name);\n    if (entry.isSymbolicLink()) continue;\n    if (entry.isDirectory()) {\n      yield* walkMarkdownFiles(full, memoryDirReal);\n    } else if (entry.isFile() && entry.name.endsWith(\".md\")) {\n      try {\n        const fileReal = await realpath(full);\n        if (!isPathWithin(fileReal, memoryDirReal)) continue;\n      } catch {\n        continue;\n      }\n      yield full;\n    }\n  }\n}\n\nfunction isPathWithin(candidate: string, root: string): boolean {\n  const relative = path.relative(root, candidate);\n  return relative === \"\" || (!!relative && !relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;;;;;;;;;AAmBA,OAAO,UAAU;AACjB,SAAS,OAAO,SAAS,UAAU,UAAU,YAAY;AA0BzD,IAAM,qBAAqB;AAC3B,IAAM,sBAAsB;AAa5B,SAAS,qBAAqB,SAAiB,KAA8B;AAC3E,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAGhC,QAAM,QAAQ,IAAI,OAAO,WAAW,GAAG,iBAAiB,GAAG;AAC3D,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,IAAI,MAAM,CAAC,EAAE,MAAM,KAAK;AAC9B,QAAI,GAAG;AACL,UAAI,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG;AAC5B,mBAAW,IAAI;AAAA,MACjB;AACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,WAAW,EAAG,QAAO;AACzB,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,UAAU,IAAI,MAAM,QAAQ,KAAK;AAC5C,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,CAAC,QAAQ,KAAK,IAAI,EAAG;AACzB,UAAM,IAAI,KAAK,MAAM,gBAAgB;AACrC,QAAI,CAAC,EAAG;AACR,QAAI,MAAM,EAAE,CAAC,EAAE,KAAK;AACpB,QACG,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,KAAK,IAAI,UAAU,KAC1D,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,KAAK,IAAI,UAAU,GAC3D;AACA,YAAM,IAAI,MAAM,GAAG,EAAE;AAAA,IACvB;AACA,UAAM,KAAK,GAAG;AAAA,EAChB;AACA,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAQA,SAAS,oBAAoB,KAA8B;AACzD,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAQ,WAAW,GAAG,KAAK,CAAC,QAAQ,SAAS,GAAG,EAAG,QAAO;AAC/D,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE;AACjC,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,MAAI,WAAW;AACf,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,KAAK,MAAM,CAAC;AAClB,QAAI,UAAU;AACZ,UAAI,OAAO,QAAQ,IAAI,IAAI,MAAM,QAAQ;AACvC,mBAAW,MAAM,EAAE,CAAC;AACpB;AAAA,MACF;AACA,UAAI,OAAO,KAAK;AACd,mBAAW;AACX;AAAA,MACF;AACA,iBAAW;AAAA,IACb,WAAW,UAAU;AACnB,UAAI,OAAO,OAAO,MAAM,IAAI,CAAC,MAAM,KAAK;AACtC,mBAAW;AACX;AACA;AAAA,MACF;AACA,UAAI,OAAO,KAAK;AACd,mBAAW;AACX;AAAA,MACF;AACA,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB,iBAAW;AAAA,IACb,WAAW,OAAO,KAAK;AACrB,YAAM,KAAK,QAAQ,KAAK,CAAC;AACzB,gBAAU;AAAA,IACZ,OAAO;AACL,iBAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,EAAE,SAAS,KAAK,MAAM,SAAS,GAAG;AACjD,UAAM,KAAK,QAAQ,KAAK,CAAC;AAAA,EAC3B;AACA,SAAO;AACT;AAgCA,IAAM,wBAAwB;AAS9B,SAAS,oBACP,WACA,YACA,OACoE;AACpE,QAAM,QAAQ,MAAM,MAAM,qBAAqB;AAC/C,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,QAAQ,gDAAgD;AAAA,EAC9E;AACA,QAAM,WAAW,MAAM,CAAC;AACxB,QAAM,YAAY,MAAM,CAAC;AACzB,QAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AACtC,QAAM,MAAM,WAAW,QAAQ;AAC/B,QAAM,eAAe,KAAK,KAAK,WAAW,YAAY,KAAK,GAAG,SAAS,GAAG,GAAG,EAAE;AAC/E,SAAO,EAAE,IAAI,MAAM,aAAa;AAClC;AAOA,eAAsB,gCAAgC,SASX;AACzC,QAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAM,aAAa,QAAQ,cAAc;AAEzC,QAAM,SAAwC;AAAA,IAC5C,SAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,QAAQ,CAAC;AAAA,EACX;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,gBAAgB;AAAA,EAC3C,QAAQ;AAKN,WAAO;AAAA,MACL,SAAS;AAAA,MACT,gBAAgB;AAAA,MAChB,QAAQ;AAAA,QACN;AAAA,UACE,YAAY;AAAA,UACZ,UAAU;AAAA,UACV,MAAM;AAAA,UACN,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,aAAW,UAAU,UAAU;AAC7B,WAAO,WAAW;AAClB,UAAM,KAAK,OAAO;AAClB,UAAM,cAAc,GAAG;AACvB,UAAM,aAAa,GAAG;AAWtB,QAAI;AACJ,QAAI;AACJ,QAAI,0BAA0B;AAC9B,QAAI,2BAA2B;AAC/B,QAAI,mBAAmB;AACvB,QAAI,oBAAoB;AACxB,QAAI,gBAAgB;AACpB,QAAI,iBAAiB;AACrB,QAAI,UAAU;AACd,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,OAAO,MAAM,OAAO;AAC/C,YAAM,iBAAiB,IAAI,QAAQ,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;AAClE,gBAAU,iBAAiB,IAAI,IAAI,MAAM,GAAG,cAAc,IAAI;AAO9D,YAAM,aAAa,CAAC,GAAG,QAAQ,SAAS,IAAI,OAAO,mBAAmB,QAAQ,mBAAmB,QAAQ,GAAG,CAAC,CAAC;AAC9G,sBAAgB,WAAW;AAC3B,yBAAmB,WAAW,SAAS;AACvC,UAAI,WAAW,SAAS,GAAG;AACzB,kCAA0B;AAK1B,cAAM,UAAU,WAAW,WAAW,SAAS,CAAC;AAChD,YAAI,MAAM,QAAQ,CAAC,EAAE,KAAK;AAC1B,YACG,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,KACvC,IAAI,WAAW,GAAG,KAAK,IAAI,SAAS,GAAG,GACxC;AACA,gBAAM,IAAI,MAAM,GAAG,EAAE;AAAA,QACvB;AACA,wBAAgB;AAAA,MAClB;AACA,YAAM,cAAc,CAAC,GAAG,QAAQ,SAAS,IAAI,OAAO,oBAAoB,QAAQ,oBAAoB,QAAQ,GAAG,CAAC,CAAC;AACjH,uBAAiB,YAAY;AAC7B,0BAAoB,YAAY,SAAS;AACzC,UAAI,YAAY,SAAS,GAAG;AAC1B,mCAA2B;AAC3B,cAAM,WAAW,YAAY,YAAY,SAAS,CAAC;AACnD,yBAAiB,SAAS,CAAC,EAAE,KAAK;AAAA,MACpC;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,UAAM,UAAU,MAAM,QAAQ,WAAW,KAAK,YAAY,SAAS;AACnE,UAAM,SAAS,eAAe,UAAa,eAAe;AAC1D,UAAM,YAAY,kBAAkB,UAAa,cAAc,SAAS;AAOxE,UAAM,sBAAsB,4BAA4B,CAAC;AAIzD,UAAM,iBACJ,4BACC,kBAAkB,UAAa,cAAc,WAAW,MACzD,CAAC;AACH,QACE,CAAC,WAAW,CAAC,UAAU,CAAC,aACxB,CAAC,uBAAuB,CAAC,eACzB;AACF,WAAO,kBAAkB;AAMzB,QAAI,kBAAkB;AACpB,aAAO,OAAO,KAAK;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,GAAG;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,qBAAqB,aAAa;AAAA,MAC5C,CAAC;AAAA,IACH;AACA,QAAI,mBAAmB;AACrB,aAAO,OAAO,KAAK;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,GAAG;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,qBAAqB,cAAc;AAAA,MAC7C,CAAC;AAAA,IACH;AAEA,QAAI,qBAAqB;AACvB,YAAM,UAAU,kBAAkB;AAClC,aAAO,OAAO,KAAK;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,GAAG;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,2BAA2B,OAAO;AAAA,MAC5C,CAAC;AAAA,IACH;AAOA,QAAI,WAAW,0BAA0B;AACvC,UAAI,UAA2B;AAC/B,UAAI,kBAAkB,eAAe,SAAS,GAAG;AAC/C,kBAAU,oBAAoB,cAAc;AAAA,MAC9C;AACA,UAAI,YAAY,MAAM;AAIpB,kBAAU,qBAAqB,SAAS,cAAc;AAAA,MACxD;AACA,UAAI,YAAY,QAAQ,QAAQ,SAAS,YAAa,QAAQ;AAC5D,mBAAW,OAAO,SAAS;AACzB,cAAI,IAAI,WAAW,GAAG;AACpB,mBAAO,OAAO,KAAK;AAAA,cACjB,YAAY,OAAO;AAAA,cACnB,UAAU,GAAG;AAAA,cACb,MAAM;AAAA,cACN,QAAQ;AAAA,YACV,CAAC;AACD;AAAA,UACF;AACA,cAAI,CAAC,YAAa,SAAS,GAAG,GAAG;AAK/B,gBACE,CAAC,gBAAgB,KAAK,GAAG,KACzB,CAAC,0BAA0B,KAAK,GAAG,GACnC;AACA,qBAAO,OAAO,KAAK;AAAA,gBACjB,YAAY,OAAO;AAAA,gBACnB,UAAU,GAAG;AAAA,gBACb,MAAM;AAAA,gBACN,QAAQ,qDAAqD,KAAK,UAAU,GAAG,CAAC;AAAA,cAClF,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,gBAAgB;AAClB,aAAO,OAAO,KAAK;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,GAAG;AAAA,QACb,MAAM;AAAA,QACN,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAEA,QAAI,SAAS;AACX,iBAAW,SAAS,aAAc;AAchC,YACE,eAAe,2BACf,0BAA0B,KAAK,KAAK,GACpC;AACA;AAAA,QACF;AACA,cAAM,WAAW,oBAAoB,WAAW,YAAY,KAAK;AACjE,YAAI,CAAC,SAAS,IAAI;AAChB,iBAAO,OAAO,KAAK;AAAA,YACjB,YAAY,OAAO;AAAA,YACnB,UAAU,GAAG;AAAA,YACb,MAAM;AAAA,YACN,QAAQ,GAAG,KAAK,UAAU,KAAK,CAAC,KAAK,SAAS,MAAM;AAAA,UACtD,CAAC;AACD;AAAA,QACF;AAKA,YAAI,aAAa;AACjB,YAAI;AACF,gBAAM,KAAK,MAAM,KAAK,SAAS,YAAY;AAC3C,uBAAa,GAAG,OAAO;AAAA,QACzB,QAAQ;AACN,uBAAa;AAAA,QACf;AACA,YAAI,CAAC,YAAY;AACf,iBAAO,OAAO,KAAK;AAAA,YACjB,YAAY,OAAO;AAAA,YACnB,UAAU,GAAG;AAAA,YACb,MAAM;AAAA,YACN,QAAQ,GAAG,KAAK,WAAM,SAAS,YAAY;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAKA,QAAI,aAAa,CAAC,wBAAwB,aAAa,GAAG;AACxD,aAAO,OAAO,KAAK;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,UAAU,GAAG;AAAA,QACb,MAAM;AAAA,QACN,QAAQ,qBAAqB,KAAK,UAAU,aAAa,CAAC;AAAA,MAC5D,CAAC;AAAA,IACH;AAAA,EACF;AASA,MAAI;AACF,UAAM,YAAY,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACrD,eAAW,YAAY,sBAAsB;AAC3C,YAAM,WAAW,KAAK,KAAK,WAAW,QAAQ;AAC9C,uBAAiB,QAAQ,kBAAkB,UAAU,SAAS,GAAG;AAC/D,YAAI,UAAU,IAAI,IAAI,EAAG;AACzB,YAAI;AACF,gBAAM,MAAM,MAAM,SAAS,MAAM,OAAO;AACxC,cACE,oBAAoB,KAAK,GAAG,KAC5B,mBAAmB,KAAK,GAAG,GAC3B;AACA,mBAAO,kBAAkB;AACzB,mBAAO,OAAO,KAAK;AAAA,cACjB,YAAY;AAAA,cACZ,UAAU;AAAA,cACV,MAAM;AAAA,cACN,QACE;AAAA,YACJ,CAAC;AAAA,UACH;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO;AACT;AAQA,gBAAgB,kBAAkB,MAAc,WAA2C;AACzF,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,IAAI;AACjC,QAAI,CAAC,SAAS,YAAY,KAAK,SAAS,eAAe,EAAG;AAC1D,oBAAgB,MAAM,SAAS,SAAS;AACxC,UAAM,WAAW,MAAM,SAAS,IAAI;AACpC,QAAI,CAAC,aAAa,UAAU,aAAa,EAAG;AAC5C,cAAU,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,EACvD,QAAQ;AACN;AAAA,EACF;AACA,aAAW,SAAS,SAAS;AAC3B,UAAM,OAAO,KAAK,KAAK,MAAM,MAAM,IAAI;AACvC,QAAI,MAAM,eAAe,EAAG;AAC5B,QAAI,MAAM,YAAY,GAAG;AACvB,aAAO,kBAAkB,MAAM,aAAa;AAAA,IAC9C,WAAW,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,KAAK,GAAG;AACvD,UAAI;AACF,cAAM,WAAW,MAAM,SAAS,IAAI;AACpC,YAAI,CAAC,aAAa,UAAU,aAAa,EAAG;AAAA,MAC9C,QAAQ;AACN;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,aAAa,WAAmB,MAAuB;AAC9D,QAAM,WAAW,KAAK,SAAS,MAAM,SAAS;AAC9C,SAAO,aAAa,MAAO,CAAC,CAAC,YAAY,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AAClG;","names":[]}