@remnic/core 9.3.684 → 9.3.685

package/dist/catalog-COqWZlZ6.d.ts

@@ -0,0 +1,456 @@
+import { P as PluginConfig } from './types-Dm5xxVrr.js';
+
+/**
+ * Rebuildable namespace catalog (issue #1499).
+ *
+ * Purpose: a downstream, rebuildable metadata index that lets Remnic ENUMERATE
+ * the configured and dynamically-created namespaces that exist or should be
+ * maintained. Filesystem memory remains the single source of truth; the catalog
+ * is derived metadata and can always be reconstructed from disk.
+ *
+ * Storage format: `<memoryDir>/state/namespaces.jsonl` — an append-and-compact
+ * JSON-lines log. We chose this over per-namespace sidecar files because:
+ *   - touches (markRead/markWrite/markMaintenance) are cheap single appends;
+ *   - it is naturally audit-friendly (the raw log preserves touch history);
+ *   - a single file makes enumeration trivial (no directory walk per call);
+ *   - last-record-wins compaction folds the log into the current state on read,
+ *     and `rebuildFromDisk` rewrites it atomically (temp file + rename).
+ *
+ * SECURITY:
+ *   - The catalog stores ONLY metadata (namespace names, kinds, timestamps,
+ *     resolved storage dirs). It NEVER holds raw memory content or secrets.
+ *   - Catalog presence grants NO authorization. Read/write access still flows
+ *     through the namespace policies in `principal.ts`; this module never makes
+ *     an access decision.
+ *   - All namespace tokens are validated with `isSafeRouteNamespace` (except the
+ *     configured default namespace, which is exempt at the routing layer) and
+ *     every storage dir is contained under `<memoryDir>/namespaces`.
+ *   - `rebuildFromDisk` rejects/reports symlinked roots that escape the memory
+ *     root rather than trusting them.
+ *
+ * LIFECYCLE: catalog write failures must NEVER crash a primary memory op.
+ * Callers should wrap touch calls in try/catch (or rely on the internal
+ * failure-tolerant append). The internal serialized write chain recovers from
+ * rejection so one failed append cannot poison subsequent writes.
+ */
+type NamespaceKind = "default" | "self" | "shared" | "project" | "branch" | "team-project" | "explicit" | "legacy";
+type NamespaceDiscoverySource = "config" | "write" | "read" | "scan" | "migration";
+interface NamespaceRecord {
+    namespace: string;
+    identityToken: string;
+    kind: NamespaceKind;
+    principal?: string;
+    projectId?: string;
+    branch?: string;
+    parentNamespace?: string;
+    createdAt: string;
+    lastReadAt?: string;
+    lastWriteAt?: string;
+    lastMaintenanceAt?: Record<string, string>;
+    storageDir: string;
+    discoveredBy: NamespaceDiscoverySource;
+}
+interface NamespaceCatalogFilter {
+    kind?: NamespaceKind;
+    discoveredBy?: NamespaceDiscoverySource;
+    /** Only include namespaces written since this instant (inclusive lower bound). */
+    writtenSince?: Date;
+}
+interface NamespaceTouchMetadata {
+    discoveredBy?: NamespaceDiscoverySource;
+    kind?: NamespaceKind;
+    principal?: string;
+    projectId?: string;
+    branch?: string;
+    parentNamespace?: string;
+    /** Explicit storage dir (when the caller already resolved it). */
+    storageDir?: string;
+    /** Override the touch timestamp (mainly for tests / migration replay). */
+    at?: Date;
+}
+interface NamespaceCatalogSkippedRoot {
+    token: string;
+    reason: "symlink" | "escape" | "unsafe" | "error";
+    detail?: string;
+}
+interface NamespaceCatalogRebuildResult {
+    dryRun: boolean;
+    records: NamespaceRecord[];
+    /** Roots reported as ambiguous/unsafe rather than silently misclassified. */
+    skipped: NamespaceCatalogSkippedRoot[];
+    /**
+     * Whether the rebuild actually rewrote the on-disk catalog (round 6, codex P2
+     * / cursor Medium — NBn3n/NBsGG). `false` for a dry-run, AND for an `--apply`
+     * that could NOT acquire the cross-process rebuild lock within the bounded wait
+     * (it ran compute-only to avoid clobbering a concurrent lock holder). Callers
+     * (CLI) must NOT report unqualified success when `applied` is false for a
+     * non-dry-run — the catalog was left unchanged and a retry is needed.
+     */
+    applied: boolean;
+}
+declare class NamespaceCatalog {
+    private readonly config;
+    private readonly memoryDir;
+    private readonly stateDir;
+    private readonly catalogPath;
+    private readonly rebuildLockPath;
+    private readonly lockOwnerId;
+    private writeChain;
+    protected onTouchCriticalSectionForTest?: () => Promise<void>;
+    protected onRebuildBeforeRenameForTest?: () => Promise<void>;
+    protected onRebuildAfterScanForTest?: () => Promise<void>;
+    protected onBeforeBreakStaleUnlinkForTest?: () => Promise<void>;
+    private readonly defaultNamespaceIdentity;
+    constructor(config: PluginConfig);
+    /** Whether the catalog is active (namespaces enabled and catalog not opted out). */
+    get enabled(): boolean;
+    /**
+     * Sanitize a record at the enumeration boundary (round 5, cursor Medium + codex
+     * P2; round 6 — NDXHe). Reads return whatever is in `namespaces.jsonl` after
+     * schema checks only, so a tampered or pre-fix row could surface unsafe data to
+     * maintenance/QMD until a rewrite occurs. Two distinct defenses:
+     *
+     *  1. UNSAFE NAMESPACE NAME (NGZqr, codex P2): an unsafe non-default namespace
+     *     (e.g. `../evil`, a name with separators, or >64 chars) is REJECTED outright
+     *     — return `null` so the caller drops it. The disk SCAN and the hot touch
+     *     path both reject such names with the SAME default-exempt `isSafeRouteNamespace`
+     *     gate, so the read boundary MUST agree, or `listNamespaces()`/`getNamespaceRecord()`
+     *     would expose a namespace those paths reject (note `isStorageDirForNamespace`
+     *     can still build a tokenized root even for `../evil`, so storageDir sanitation
+     *     alone does not catch it). The default namespace is exempt (it may be a
+     *     non-route literal), matching every other validation site.
+     *
+     *  2. UNSAFE storageDir: for an otherwise-valid namespace, apply the SAME contract
+     *     as the write path — full containment (`isContainedStorageDir`: lexical +
+     *     symlink/realpath) AND namespace ownership (`isStorageDirForNamespace`). When
+     *     a record fails EITHER check we substitute the trusted resolved-and-safe root
+     *     for that namespace (rule 42: read and write stay symmetric).
+     */
+    private sanitizeRecordForRead;
+    private storageRootOwnershipRank;
+    private configuredNamespaceIdentities;
+    private preferStorageRootOwner;
+    private dropDuplicateStorageRootAliases;
+    private loadSanitizedRecords;
+    listNamespaces(filter?: NamespaceCatalogFilter): Promise<NamespaceRecord[]>;
+    getNamespaceRecord(namespace: string): Promise<NamespaceRecord | null>;
+    markRead(namespace: string, metadata?: NamespaceTouchMetadata): Promise<void>;
+    markWrite(namespace: string, metadata?: NamespaceTouchMetadata): Promise<void>;
+    markMaintenance(namespace: string, jobName: string, at?: Date): Promise<void>;
+    /**
+     * Register namespaces known purely from config (default, shared, explicit
+     * policies). Source `config`. Cheap and idempotent.
+     */
+    registerConfiguredNamespaces(): Promise<void>;
+    /**
+     * Register a namespace whose storage was just resolved by the router. Used as
+     * the router's integration hook (`discoveredBy: config`). Storage dir is
+     * provided so we do not re-resolve it. Failure-tolerant. Returns whether the
+     * registration actually APPENDED (round 6, codex P2 — NEFoX), so the router's
+     * resolve-hook dedup only marks a namespace notified when it truly persisted —
+     * a dropped append (disabled catalog or rebuild-lock-timeout drop) returns
+     * `false` and is retried on the next resolve.
+     */
+    registerResolved(namespace: string, storageDir: string): Promise<boolean>;
+    /**
+     * Generic register/touch without changing read/write timestamps unless the
+     * source implies it. Validates the namespace and resolves a storage dir.
+     * Returns whether the touch actually appended.
+     */
+    private register;
+    private validateNamespace;
+    /**
+     * Resolve the on-disk storage dir for a namespace WITHOUT trusting caller
+     * input. The default namespace may use the legacy memoryDir root; everything
+     * else lives under `<memoryDir>/namespaces/<token>`. Containment is enforced
+     * by rejecting separators/parent-refs in the token.
+     */
+    private resolveStorageDir;
+    private namespaceTokenDir;
+    /**
+     * Whether a candidate storage dir is LEXICALLY contained: it is either the
+     * legacy default root (`memoryDir`) or a strict descendant of
+     * `<memoryDir>/namespaces/`. The router legitimately resolves a namespace to
+     * EITHER the tokenized dir or a legacy raw-name dir under `namespaces/`, so we
+     * accept any contained child rather than a single exact token path. This is a
+     * pure string check — symlink escape is checked separately via realpath.
+     */
+    private isLexicallyContained;
+    /**
+     * Whether a candidate storage dir satisfies the catalog containment contract,
+     * including SYMLINK-escape rejection (round 5, codex P2). A lexically-contained
+     * path that is actually a symlink to an outside directory would let maintenance
+     * or QMD follow it outside `memoryDir`. We mirror `rebuildFromDisk`'s posture:
+     * the path must be lexically contained AND, if it exists on disk, neither the
+     * path itself a symlink nor its realpath escaping the memory root. Non-existent
+     * paths pass the realpath stage (nothing to follow yet) but still must be
+     * lexically contained.
+     */
+    private isContainedStorageDir;
+    /**
+     * Reject a candidate whose path crosses a SYMLINKED ancestor strictly between
+     * memoryDir and the leaf (codex NVuq5). `realpath`-based containment accepts a
+     * symlinked `<memoryDir>/namespaces` that currently resolves back inside
+     * memoryDir, but the disk scanner rejects such a root and a later retarget would
+     * escape the memory tree — so refuse it here too. The leaf itself is
+     * symlink-checked by the caller; this walks only the intermediate ancestors.
+     */
+    private hasSymlinkedAncestor;
+    /**
+     * Walk up from a not-yet-existing candidate to the nearest ancestor that exists
+     * on disk and verify its realpath stays inside `memoryReal` (round 6, codex P2
+     * — NDo79). Rejects a non-existent leaf whose existing parent chain escapes
+     * memoryDir via a symlink. Stops at memoryDir's resolved root.
+     *
+     * The nearest existing ancestor must also be a DIRECTORY (NHIdt, codex P2): if
+     * an existing parent such as `<memoryDir>/namespaces` is a regular FILE (or
+     * socket/fifo), `realpath(parent)` still succeeds and resolves inside memoryDir,
+     * so a containment-only check would ACCEPT a leaf that can never be created — you
+     * cannot mkdir a child under a file. We `lstat` the nearest existing ancestor and
+     * reject when it is not a directory, mirroring the leaf non-directory rejection
+     * (NF21i) and the disk scan, so every containment consumer agrees.
+     */
+    private isNearestExistingAncestorContained;
+    /**
+     * Resolve the storage dir to persist for a touch, validating any caller-
+     * provided `metadata.storageDir` against the catalog containment contract
+     * (round 4 + round 5, codex P2). `markWrite`/`registerResolved` accept an
+     * explicit storageDir, but persisting it verbatim would let a bad hook or
+     * external consumer write an arbitrary path — including one outside `memoryDir`
+     * or a symlink that escapes it — into the catalog, handing maintenance/QMD an
+     * unsafe root. We accept an explicit (or previously-stored) dir ONLY when it
+     * stays contained under memoryDir (lexically AND via realpath); otherwise we
+     * drop it and fall back to the trusted resolved dir.
+     */
+    private resolveTouchStorageDir;
+    /**
+     * Whether `candidate` is a legitimate storage root FOR `namespace` (round 6,
+     * codex P2 — NDATT). Accepts the namespace's router-resolved root, its canonical
+     * lexical tokenized dir, and (for the default namespace only) memoryDir. This
+     * prevents a contained-but-CROSS-NAMESPACE path — another namespace's tree, or
+     * memoryDir for a non-default namespace — from being persisted as this
+     * namespace's root. Compared on resolved (absolute) paths.
+     */
+    private isStorageDirForNamespace;
+    /**
+     * Resolve the canonical storage dir for a namespace as the LIVE ROUTER would,
+     * but NEVER return a path that escapes the memory root.
+     *
+     * Router alignment (round 4, cursor Medium): a read/register touch with no
+     * explicit storageDir previously used the lexical `resolveStorageDir`, which
+     * always picks `<memoryDir>/namespaces/<token>` (or `memoryDir` for the
+     * default). That diverges from `NamespaceStorageRouter`, which can route to a
+     * legacy raw-name dir or a migrated default root — so a recall touch could
+     * record a contained-but-WRONG root that maintenance/rebuild then targets. We
+     * now delegate to the shared `resolveNamespaceStorageRoot` (the very helper the
+     * router uses) so the catalog records the same on-disk root the router serves.
+     *
+     * Containment (round 5, codex P2): the resolved path can still be a symlink
+     * escaping memoryDir, so we run the full (lexical + realpath) containment
+     * contract. When it FAILS we fall back to a NAMESPACE-SPECIFIC safe root, NOT
+     * a blanket `memoryDir`. Recording `memoryDir` for a non-default namespace
+     * would point enumeration/maintenance at the DEFAULT namespace's tree (round 5,
+     * cursor/codex Medium/P2) — a cross-namespace fanout error. The correct safe
+     * root is the namespace's own lexical tokenized dir
+     * (`<memoryDir>/namespaces/<token>`), which is always contained and is that
+     * namespace's canonical location (we record the lexical PATH as metadata; we do
+     * not follow the escaping symlink). Only the default namespace — or a token so
+     * unsafe even the lexical dir cannot be built — falls back to `memoryDir`.
+     */
+    private resolveSafeStorageDir;
+    /**
+     * The namespace-specific contained fallback root, used when the router-resolved
+     * root fails containment (round 5, cursor/codex Medium/P2).
+     *
+     * Preference order:
+     *  1. The namespace's OWN lexical tokenized dir (`namespaces/<token>`) — so a
+     *     non-default namespace is NOT pointed at the DEFAULT namespace's `memoryDir`
+     *     tree (which would misdirect maintenance fanout). Returned only when the
+     *     token dir itself stays CONTAINED (it is not a symlink, and its realpath
+     *     does not escape memoryDir — e.g. via a symlinked `namespaces/` parent).
+     *  2. `memoryDir` as a LAST resort — for the default namespace, an unsafe token
+     *     that cannot build a contained path, OR the irreparable case where the
+     *     token dir's realpath escapes the root (so even its lexical path resolves
+     *     outside). NF21m note (codex P2): we deliberately do NOT record the lexical
+     *     token dir in that irreparable case — its realpath escapes memoryDir, and
+     *     the NDo79 contract REQUIRES that an escaping path is never persisted (a
+     *     later mkdir/maintenance/QMD op would follow it outside the root). Since no
+     *     contained namespace-specific path exists, containment wins: `memoryDir` is
+     *     the only safe root left. A namespace whose token dir's realpath escapes is
+     *     an irreparable on-disk state; recording the contained default root is
+     *     strictly safer than persisting an escaping one. The common case where the
+     *     token dir IS contained is handled by branch 1, so a healthy non-default
+     *     namespace never reaches `memoryDir`.
+     */
+    private safeFallbackStorageDir;
+    /**
+     * Re-check, NOW, whether a namespace's storage root currently EXISTS on disk
+     * with the SAME safety the directory scan uses (NFJV8, codex P2).
+     *
+     * The rebuild's final re-merge runs under the held lock and folds the freshly
+     * re-read log (`latest`) into the scanned `rebuilt` set. A namespace present in
+     * `latest` (a live touch row) but ABSENT from `rebuilt` is normally PURGED as
+     * deleted (the NATqU "disk scan is authoritative" rule). But there is a TOCTOU
+     * window: a dynamic namespace can be CREATED on disk AFTER `rebuildFromDisk()`
+     * already enumerated `namespaces/` but BEFORE this re-merge. The scan snapshot
+     * missed its new root, yet a gateway `markWrite` already appended a row for it.
+     * Blindly purging that row would rewrite the catalog WITHOUT a live namespace
+     * that now has data on disk, so `writtenSince`/maintenance/QMD consumers miss
+     * it until another touch or rebuild.
+     *
+     * So before purging, we re-resolve the namespace's safe storage root (the same
+     * router-aligned, containment-checked path the scan would have catalogued) and
+     * confirm it is a real, contained, non-symlink directory that actually holds
+     * memory data RIGHT NOW. If so the namespace was created-after-scan and is LIVE
+     * — KEEP its row. This is the precise inverse of NATqU and does NOT reintroduce
+     * it: a touch on a REMOVED root re-checks as ABSENT (no data on disk) and is
+     * still purged; only a root that EXISTS on a fresh re-check is kept.
+     *
+     * Mirrors the per-entry scan checks (symlink rejection + realpath containment +
+     * `hasMemoryData`) so a symlinked/escaping root is never resurrected.
+     */
+    private liveStorageRootExistsForRebuild;
+    /**
+     * Record a namespace touch. Returns whether the touch actually APPENDED to the
+     * log (round 6, codex P2 — NEFoX): a disabled catalog or a dropped append (the
+     * NAUf7 rebuild-lock-timeout drop) returns `false`, so callers (e.g. the router
+     * resolve-hook dedup) can avoid marking a dropped registration as completed and
+     * suppressing its retry.
+     */
+    private touch;
+    rebuildFromDisk(options?: {
+        dryRun?: boolean;
+    }): Promise<NamespaceCatalogRebuildResult>;
+    /**
+     * Body of `rebuildFromDisk`, run inside a single `queueCritical` turn. MUST
+     * only be invoked from within the serialized chain so the load and the
+     * rewrite are atomic with respect to concurrent touches (in-process).
+     *
+     * `wantMutate` is true for an `--apply` (the caller intends to rewrite). The
+     * cross-process file lock is acquired LATE — only around the final
+     * load→merge→rename window (NFgCT, codex P2) — never across the disk scan, so a
+     * long scan does not force concurrent gateway touches to wait (and drop their
+     * append). Whether the rewrite actually happened is reported via the result's
+     * `applied`: true only when `wantMutate` AND the lock was acquired.
+     */
+    private rebuildInsideChain;
+    /**
+     * Final load→merge→rename window of a rebuild, factored out so the caller can
+     * run it WITHIN the cross-process file lock (NFgCT, codex P2) without holding
+     * that lock across the preceding disk scan. Re-reads the latest on-disk state,
+     * folds concurrent touches, then (when `canMutate`) atomically rewrites the log.
+     *
+     * `canMutate` records that the cross-process lock was actually held. The
+     * re-merge + rewrite run only when it is true — a dry-run, or an unlocked apply
+     * (lock-acquisition timeout), computes records but does NOT rename, so it can
+     * never clobber a concurrent lock holder's window. `applied` mirrors `canMutate`.
+     */
+    private finishRebuild;
+    /**
+     * Run `fn` while HOLDING the shared cross-process advisory lock (round 5, codex
+     * P2; generalized round 7 — NEZkA). This is the SINGLE mutex shared by BOTH the
+     * touch read→merge→append window AND the rebuild final load→merge→rename window,
+     * so a touch and a rebuild in different processes are mutually exclusive over
+     * their respective critical sections — closing the check-then-append gap where a
+     * polled-only touch could append into a rebuild's load→rename window.
+     *
+     * Acquisition is atomic via `open(..., "wx")`. A lock older than
+     * `REBUILD_LOCK_STALE_MS` is treated as a crashed holder and broken. After
+     * `REBUILD_LOCK_MAX_WAIT_MS` of contention we proceed best-effort WITHOUT the
+     * lock rather than block forever. The lock is always released in `finally`.
+     *
+     * IN-PROCESS SAFETY: every caller invokes this from inside (or wrapping) the
+     * per-process `queueCritical` chain, which serializes all catalog mutations in
+     * THIS process. So within one process only one logical holder attempts OS-lock
+     * acquisition at a time — the file lock is never self-contended in-process, and
+     * the lock is acquired and released within a single in-process turn. The file
+     * lock adds only the missing CROSS-process exclusion.
+     *
+     * HEARTBEAT (round 5, cursor/codex Medium/P2): while WE hold the lock a timer
+     * refreshes its mtime every `REBUILD_LOCK_HEARTBEAT_MS`, so a legitimately long
+     * holder (> `REBUILD_LOCK_STALE_MS`) is not treated as a crashed holder and
+     * unlinked by another process — which would let overlapping windows lose
+     * appends. Heartbeat failures are swallowed; the timer is always cleared in
+     * `finally`.
+     *
+     * ACQUISITION RESULT (round 6, codex P2 — NBPmY): `fn` receives whether WE
+     * actually hold the lock. When acquisition TIMED OUT (another holder is active),
+     * a MUTATING rebuild must NOT perform its load/rename window unlocked, and a
+     * touch must NOT append unlocked — both would recreate the lost-append race. The
+     * caller uses `acquired` to run compute-only (rebuild) or DROP the append
+     * (touch) when unlocked.
+     */
+    private withHeldCatalogLock;
+    /** Try to acquire the rebuild lock; returns true if WE created it. */
+    private acquireRebuildLock;
+    /**
+     * Remove the lock file if its mtime is older than the stale threshold.
+     *
+     * REPLACEMENT-SAFE (NG7Bg, codex P2): a plain `stat` → `unlink` has a TOCTOU
+     * window — two processes can both observe the SAME stale lock; one removes it and
+     * creates a FRESH lock, and the other's later `unlink` then deletes that fresh
+     * holder's ACTIVE lock based on the stale identity it read earlier, leaving the
+     * fresh holder running its critical section with no visible lock and reopening the
+     * lost-update race the mutex prevents. We therefore capture the lock's IDENTITY
+     * (its full content line: `<pid> <owner-uuid> <iso>`) when we judge it stale, then
+     * RE-READ immediately before unlinking and only remove it when the content is
+     * byte-identical AND still stale. A replacement lock has a different owner id /
+     * timestamp, so its content differs and we leave it untouched. We never unlink a
+     * lock whose mtime is now fresh (a heartbeat refreshed it) or whose identity
+     * changed (a replacement was created). This is best-effort: any mismatch/vanish
+     * simply skips the break and the caller polls again.
+     */
+    private breakStaleRebuildLock;
+    /**
+     * Whether the rebuild lock file was written by THIS instance (round 6, codex
+     * P2 — NBsGP). Matches the per-instance owner id, NOT just `process.pid`: two
+     * NamespaceCatalog instances in the same process share a PID, so a PID-only
+     * check would wrongly treat instance A's lock as self-held by instance B and
+     * let B's touch skip the wait and append into A's rebuild window. Falls back to
+     * the legacy PID-only form for lock files written before owner ids existed.
+     */
+    private rebuildLockHeldBySelf;
+    /**
+     * Merge a prior record's preserved metadata (timestamps, principal hints)
+     * onto a freshly-discovered record. Disk-derived fields (storageDir, kind)
+     * take precedence from the new record.
+     *
+     * PROVENANCE (round 3, cursor Low): `discoveredBy` and `createdAt` are
+     * CREATION-ONLY — identical to the touch path's invariant. A rebuild must NOT
+     * reset a namespace first seen via a `write`/`read` touch back to `config`
+     * just because it is also listed in policies. So when a prior record exists we
+     * carry its `discoveredBy` forward; only brand-new records keep the fresh
+     * (config/scan) provenance.
+     */
+    private mergeForRebuild;
+    /** Load the JSONL log and fold it into current state (last-record-wins). */
+    private loadCompacted;
+    /**
+     * Serialize an arbitrary read-modify-write critical section through the single
+     * write chain. Every catalog mutation (touch read+merge+append, full rewrite)
+     * runs through this so they are mutually exclusive: a touch always reads the
+     * latest persisted state before appending, and a rebuild rewrite cannot
+     * interleave with a touch's append. The chain recovers from rejection
+     * (CLAUDE.md rule #40) — one failed section never poisons subsequent ones —
+     * while still surfacing the error to that section's awaited promise.
+     */
+    private queueCritical;
+    /**
+     * Append a single record to the JSONL log WITHOUT re-serializing through the
+     * write chain. MUST only be called from inside a `queueCritical(...)` section
+     * (which already holds the serialized turn); calling it directly would bypass
+     * the read-before-append ordering that prevents lost-field races.
+     */
+    private appendUnchained;
+    /**
+     * Atomic temp-file + rename rewrite (CLAUDE.md rule #54: write temp, then
+     * rename — never delete-before-write) WITHOUT re-entering the write chain.
+     * MUST only be called from inside a `queueCritical(...)` turn (e.g. the
+     * rebuild critical section, which already holds the serialized turn so its
+     * load and rewrite are atomic against concurrent touches). Re-entering the
+     * chain from within a held turn would deadlock.
+     */
+    private rewriteUnchained;
+}
+
+export { NamespaceCatalog as N, type NamespaceCatalogFilter as a, type NamespaceCatalogRebuildResult as b, type NamespaceCatalogSkippedRoot as c, type NamespaceDiscoverySource as d, type NamespaceKind as e, type NamespaceRecord as f, type NamespaceTouchMetadata as g };

package/dist/causal-behavior.js

@@ -1,14 +1,14 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-BTVX7ZXZ.js";
-import "./chunk-HQ6NIBL6.js";
+} from "./chunk-4NFVPDIL.js";
+import "./chunk-7FL4CNPV.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-JD4SCARD.js";
+} from "./chunk-YN4ZT4CW.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 import {
   normalizeRecallTokens
 } from "./chunk-ZBJMUXZH.js";

package/dist/causal-chain.js

@@ -6,10 +6,10 @@ import {
   stitchCausalChain,
   validateCausalEdge,
   writeChainIndex
-} from "./chunk-BTVX7ZXZ.js";
-import "./chunk-HQ6NIBL6.js";
-import "./chunk-JD4SCARD.js";
-import "./chunk-2ODBA7MQ.js";
+} from "./chunk-4NFVPDIL.js";
+import "./chunk-7FL4CNPV.js";
+import "./chunk-YN4ZT4CW.js";
+import "./chunk-NU3CSQ4H.js";
 import "./chunk-ZBJMUXZH.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-LPSF4OQH.js";

package/dist/causal-consolidation.js

@@ -1,29 +1,29 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-BTVX7ZXZ.js";
+} from "./chunk-4NFVPDIL.js";
 import {
   buildExtensionsBlockForConsolidation
-} from "./chunk-2IBGHRIO.js";
+} from "./chunk-GS55WYRL.js";
 import {
   runPostConsolidationMaterialize
-} from "./chunk-XWEXT4XU.js";
-import "./chunk-LN4YGHTM.js";
+} from "./chunk-QANVLERJ.js";
+import "./chunk-UUH4YQOF.js";
 import "./chunk-JLNBQWZ2.js";
 import "./chunk-3UXOZBHV.js";
-import "./chunk-HQ6NIBL6.js";
+import "./chunk-7FL4CNPV.js";
 import {
   FallbackLlmClient,
   fallbackLlmRuntimeContextFromConfig
-} from "./chunk-LCC5EZTT.js";
-import "./chunk-B5XMS73R.js";
+} from "./chunk-FIVDN2SM.js";
+import "./chunk-IQVQJJL7.js";
 import "./chunk-L2EXJQJP.js";
-import "./chunk-7SI52C65.js";
+import "./chunk-VL7DP3OW.js";
 import "./chunk-RK6F44Y6.js";
 import {
   resolveCausalTrajectoryStoreDir
-} from "./chunk-JD4SCARD.js";
-import "./chunk-53FDU4CE.js";
+} from "./chunk-YN4ZT4CW.js";
+import "./chunk-BLIWOONZ.js";
 import "./chunk-M7XQSUBB.js";
 import "./chunk-5UZXUTVO.js";
 import "./chunk-5GPPACXK.js";
@@ -52,7 +52,7 @@ import "./chunk-EYIEWJNI.js";
 import "./chunk-JUC24CTX.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 import "./chunk-ZBJMUXZH.js";
 import {
   isRecord

package/dist/causal-retrieval.js

@@ -1,15 +1,15 @@
 import {
   readChainIndex,
   resolveChainsDir
-} from "./chunk-BTVX7ZXZ.js";
-import "./chunk-HQ6NIBL6.js";
+} from "./chunk-4NFVPDIL.js";
+import "./chunk-7FL4CNPV.js";
 import {
   readCausalTrajectoryRecords,
   searchCausalTrajectories
-} from "./chunk-JD4SCARD.js";
+} from "./chunk-YN4ZT4CW.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 import "./chunk-ZBJMUXZH.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-LPSF4OQH.js";

package/dist/causal-trajectory-graph.js

@@ -1,6 +1,6 @@
 import {
   appendEdge
-} from "./chunk-2LDBXPLB.js";
+} from "./chunk-KF74X62T.js";
 import "./chunk-2LSZVONP.js";
 import "./chunk-DEUNUKTD.js";
 import "./chunk-PZ5AY32C.js";

package/dist/causal-trajectory.js

@@ -6,7 +6,7 @@ import {
   resolveCausalTrajectoryStoreDir,
   searchCausalTrajectories,
   validateCausalTrajectoryRecord
-} from "./chunk-JD4SCARD.js";
+} from "./chunk-YN4ZT4CW.js";
 import "./chunk-ZBJMUXZH.js";
 import "./chunk-A2IYSXDQ.js";
 import "./chunk-LPSF4OQH.js";

package/dist/{chunk-ROHLEUTH.js → chunk-2KAYTPPT.js}

@@ -1,33 +1,33 @@
 import {
   MeilisearchBackend
-} from "./chunk-DOCTITOP.js";
+} from "./chunk-WRFKZEO6.js";
 import {
   NoopSearchBackend
 } from "./chunk-CYEPCZN5.js";
 import {
   OramaBackend
-} from "./chunk-Q5ZU3RNY.js";
+} from "./chunk-LQ6JI4VH.js";
 import {
   RemoteSearchBackend
-} from "./chunk-JOASJWQR.js";
+} from "./chunk-SANZHXY2.js";
 import {
   EmbedHelper
-} from "./chunk-RN7MUWON.js";
+} from "./chunk-EHISUJFN.js";
 import {
   LanceDbBackend
-} from "./chunk-OUWAQVDJ.js";
+} from "./chunk-5CEJH5ZN.js";
 import {
   createConversationIndexBackend
-} from "./chunk-7OGJQP7T.js";
+} from "./chunk-DCWIQFNA.js";
 import {
   FaissConversationIndexAdapter
-} from "./chunk-E6ZDCOHM.js";
+} from "./chunk-XBZQRZ6G.js";
 import {
   QmdClient
-} from "./chunk-6RHNCKHG.js";
+} from "./chunk-K43PI6DQ.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 
 // src/search/factory.ts
 import path from "path";
@@ -170,4 +170,4 @@ export {
   createConversationSearchBackend,
   createConversationIndexRuntime
 };
-//# sourceMappingURL=chunk-ROHLEUTH.js.map
+//# sourceMappingURL=chunk-2KAYTPPT.js.map

package/dist/{chunk-NHQGDVJF.js → chunk-2SJCWLQD.js}

@@ -1,9 +1,9 @@
 import {
   NamespaceStorageRouter
-} from "./chunk-FMEKEF47.js";
+} from "./chunk-WIHPNY65.js";
 import {
   namespaceCollectionName
-} from "./chunk-DQY7NJ5L.js";
+} from "./chunk-CTOQEZSN.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -204,4 +204,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-NHQGDVJF.js.map
+//# sourceMappingURL=chunk-2SJCWLQD.js.map

package/dist/{chunk-YTWNKQ2G.js → chunk-3FC6LW6T.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-MDYG7VI7.js";
 import {
   log
-} from "./chunk-2ODBA7MQ.js";
+} from "./chunk-NU3CSQ4H.js";
 
 // src/temporal-supersession.ts
 function normalizeSupersessionKey(raw) {
@@ -238,4 +238,4 @@ export {
   applyTemporalSupersession,
   shouldFilterSupersededFromRecall
 };
-//# sourceMappingURL=chunk-YTWNKQ2G.js.map
+//# sourceMappingURL=chunk-3FC6LW6T.js.map