@remnic/core 9.3.699 → 9.3.700

package/src/storage.ts

@@ -38,6 +38,17 @@ import {
   stripCitationForTemplate,
   DEFAULT_CITATION_FORMAT,
 } from "./source-attribution.js";
+import {
+  TombstoneStore,
+  collectRetiredMemoriesForRebuild,
+  buildRetiredFactTombstoneInputs,
+  type TombstoneStoreOptions,
+  type TombstoneFileIo,
+  type TombstoneReason,
+  type TombstoneCreatedBy,
+  type TombstoneStats,
+} from "./lifecycle/tombstones.js";
+import { supersessionKeysForFact } from "./temporal-supersession.js";
 import type {
   AccessTrackingEntry,
   BufferState,
@@ -315,6 +326,11 @@ function serializeFrontmatter(fm: MemoryFrontmatter): string {
   }
   // Status management
   if (fm.status && fm.status !== "active") lines.push(`status: ${fm.status}`);
+  // Tombstone block visibility (issue #1579). Emit only when present so legacy
+  // memories round-trip unchanged; the review queue reads these to drive the
+  // automatic revocation on approval.
+  if (fm.blockedBy) lines.push(`blockedBy: ${fm.blockedBy}`);
+  if (fm.tombstoneBlockTier) lines.push(`tombstoneBlockTier: ${fm.tombstoneBlockTier}`);
   if (fm.supersededBy) lines.push(`supersededBy: ${fm.supersededBy}`);
   if (fm.supersededAt) lines.push(`supersededAt: ${fm.supersededAt}`);
   if (fm.archivedAt) lines.push(`archivedAt: ${fm.archivedAt}`);
@@ -820,6 +836,15 @@ function parseFrontmatter(
       lineage: lineage && lineage.length > 0 ? lineage : undefined,
       // Status management
       status: (fm.status as MemoryStatus) || "active",
+      // Tombstone block visibility (issue #1579) — read-through.
+      blockedBy: fm.blockedBy || undefined,
+      tombstoneBlockTier:
+        fm.tombstoneBlockTier === "exact" ||
+        fm.tombstoneBlockTier === "normalized" ||
+        fm.tombstoneBlockTier === "keyed" ||
+        fm.tombstoneBlockTier === "semantic"
+          ? fm.tombstoneBlockTier
+          : undefined,
       supersededBy: fm.supersededBy || undefined,
       supersededAt: fm.supersededAt || undefined,
       archivedAt: fm.archivedAt || undefined,
@@ -2294,6 +2319,19 @@ export class StorageManager {
     try { this.onCatalogWrite?.(); } catch { /* gotcha #13 */ }
   }
 
+  // ── Tombstone store (issue #1579) ───────────────────────────────────────
+  // Instance-scoped (rule 11) + namespace-scoped (rule 42) tombstone index.
+  // Lazily loaded from <stateDir>/tombstones.jsonl; invalidated together with
+  // every other cache layer via invalidateAllMemoriesCache (rule 25).
+  private tombstoneStore: TombstoneStore | null = null;
+  private tombstoneStoreLoadPromise: Promise<TombstoneStore> | null = null;
+  private tombstonesConfig: {
+    enabled: boolean;
+    semanticMatch: boolean;
+    semanticThreshold: number;
+    namespace: string;
+  } = { enabled: false, semanticMatch: false, semanticThreshold: 0.9, namespace: "default" };
+
   /** Page-versioning configuration.  Set by the orchestrator after construction. */
   private _versioningConfig: VersioningConfig | null = null;
 
@@ -2673,7 +2711,10 @@ export class StorageManager {
    * Promote a pending_review wearable memory to active in place,
    * merging updated trust evidence into structuredAttributes. Returns
    * false when the memory is missing or no longer pending_review (a
-   * concurrent review decision wins).
+   * concurrent review decision wins), or when the row is tombstone-blocked
+   * (`blockedBy` — issue #1579 threads OcuDx/Ocu1l): writeMemoryFrontmatter
+   * bypasses the writeMemory chokepoint, so a blocked row must first be
+   * cleared via revokeTombstone before promotion can proceed.
    */
   async promoteWearableMemory(
     id: string,
@@ -2684,6 +2725,8 @@ export class StorageManager {
     const memory = memories.find((entry) => entry.frontmatter.id === id);
     if (!memory) return false;
     if (memory.frontmatter.status !== "pending_review") return false;
+    // Tombstone-blocked rows need revokeTombstone first (issue #1579 OcuDx/Ocu1l).
+    if (memory.frontmatter.blockedBy) return false;
     return this.writeMemoryFrontmatter(memory, {
       status: "active",
       // Keep frontmatter confidence in step with the re-scored trust —
@@ -3047,6 +3090,178 @@ export class StorageManager {
     return path.join(this.stateDir, "fact-hashes.ready");
   }
 
+  // ── Tombstone store access (issue #1579) ─────────────────────────────────
+  /**
+   * The on-disk tombstone log path. Lives under `<stateDir>/tombstones.jsonl`
+   * so it is co-located with the fact-hash index and encrypted at rest when
+   * the secure-store is enabled (the StorageManager's secure read/write
+   * helpers are injected into the store).
+   */
+  private get tombstonesPath(): string {
+    return path.join(this.stateDir, "tombstones.jsonl");
+  }
+
+  /**
+   * Configure the tombstone invariant for this storage instance. Installed
+   * by the orchestrator after construction (same pattern as
+   * `setVersioningConfig` / `citationTemplate`). When `enabled` is false
+   * (default until the orchestrator wires config), the chokepoint check is a
+   * no-op — pre-feature behavior for rollback safety (rule 30).
+   */
+  setTombstonesConfig(config: {
+    enabled: boolean;
+    semanticMatch: boolean;
+    semanticThreshold: number;
+    namespace: string;
+  }): void {
+    this.tombstonesConfig = { ...config };
+    // Reset the store so the next access rebuilds with the new options.
+    if (this.tombstoneStore) {
+      this.tombstoneStore.invalidate();
+      this.tombstoneStore = null;
+      this.tombstoneStoreLoadPromise = null;
+    }
+  }
+
+  private buildTombstoneStore(): TombstoneStore {
+    const options: TombstoneStoreOptions = {
+      enabled: this.tombstonesConfig.enabled,
+      semanticMatch: this.tombstonesConfig.semanticMatch,
+      semanticThreshold: this.tombstonesConfig.semanticThreshold,
+      // Wire the SAME helpers the dedup index uses (rule 23 / checklist §13):
+      // hashContent = ContentHashIndex.computeHash, normalizeText =
+      // ContentHashIndex.normalizeContent. Importing them here (not copying)
+      // guarantees the tombstone tiers can never drift from dedup.
+      hashContent: ContentHashIndex.computeHash,
+      normalizeText: ContentHashIndex.normalizeContent,
+    };
+    const io: TombstoneFileIo = {
+      read: (filePath) => this.readStorageSecureFile(filePath),
+      append: (filePath, content) => this.appendStorageSecureFile(filePath, content),
+      write: (filePath, content) => this.writeStorageSecureFile(filePath, content),
+      // stat lets the store own its cross-process staleness probe (#1579).
+      stat: (filePath) => statSync(filePath),
+    };
+    return new TombstoneStore(
+      this.tombstonesPath,
+      this.tombstonesConfig.namespace,
+      options,
+      io,
+    );
+  }
+
+  /**
+   * Lazily load the tombstone store. Mirrors the fact-hash-index lazy-load
+   * pattern: a single in-flight load promise dedups concurrent first-access.
+   * The cross-process staleness probe lives inside the store now (#1579): on
+   * each cached access it stats its own file and invalidates if a peer process
+   * appended, so the next lookup reloads from disk. If the probe just
+   * invalidated the store, fall through to the reload branch — returning null
+   * here was the original regression (the chokepoint threw and failed OPEN).
+   */
+  getTombstoneStore(): Promise<TombstoneStore> {
+    if (this.tombstoneStore) {
+      // The store owns the staleness probe + reload (#1579): on a cached hit it
+      // stats its own file and, if a peer process appended, invalidates + reloads
+      // in place. We await it so the chokepoint's lookup always sees a fresh index.
+      const cached = this.tombstoneStore;
+      return cached.ensureFreshAgainstDisk().then(() => cached);
+    }
+    if (!this.tombstoneStoreLoadPromise) {
+      const store = this.buildTombstoneStore();
+      this.tombstoneStoreLoadPromise = store
+        .load()
+        .then(() => {
+          this.tombstoneStore = store;
+          return store;
+        })
+        .catch((err) => {
+          this.tombstoneStoreLoadPromise = null;
+          throw err;
+        });
+    }
+    return this.tombstoneStoreLoadPromise;
+  }
+
+  /**
+   * Append a tombstone for a retired memory (issue #1579 emitters).
+   * Best-effort: a tombstone append failure MUST NOT fail the supersession /
+   * correction that triggered it (gotcha #13 / rule 34). The memory is
+   * already retired on disk; the tombstone is the non-resurrection guard.
+   */
+  async appendTombstone(input: {
+    reason: TombstoneReason;
+    createdBy: TombstoneCreatedBy;
+    sourceMemoryId: string;
+    rawContent: string;
+    entityRef?: string;
+    supersessionKey?: string;
+    createdAt?: string;
+    /** Canonical contentHash from the retired memory's frontmatter (#1579). */
+    contentHash?: string;
+  }): Promise<string | null> {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      // Chokepoint citation strip (#1579 review): strip citation annotations
+      // from the raw body so BOTH the exact-tier hash (when the caller omits
+      // contentHash and the store computes it from rawContent) AND the
+      // normalized-text tier match re-extraction, which hashes/normalizes the
+      // citation-stripped contentHashSource. Idempotent on already-stripped
+      // text, so callers that pre-strip (e.g. recordSupersession) are unaffected.
+      const strippedRawContent = stripCitationForTemplate(input.rawContent, this.citationTemplate);
+      // The store records its own mtime after the append (markWritten) so the
+      // staleness probe does not treat this write as a peer append (#1579).
+      return await store.appendTombstone({ ...input, rawContent: strippedRawContent });
+    } catch (err) {
+      log.warn(`tombstone append failed (memory=${input.sourceMemoryId}): ${err}`);
+      return null;
+    }
+  }
+
+  /**
+   * Revoke a tombstone (re-allow the content). Used by the review-queue
+   * approval path when an operator approves a blocked memory.
+   */
+  async revokeTombstone(tombstoneId: string, createdBy: TombstoneCreatedBy): Promise<string | null> {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      return await store.revoke(tombstoneId, createdBy);
+    } catch (err) {
+      log.warn(`tombstone revoke failed (id=${tombstoneId}): ${err}`);
+      return null;
+    }
+  }
+
+  /** Aggregate tombstone stats for `remnic doctor`. */
+  async getTombstoneStats(): Promise<TombstoneStats | null> {
+    if (!this.tombstonesConfig.enabled) return null;
+    try {
+      const store = await this.getTombstoneStore();
+      return store.stats();
+    } catch (err) {
+      log.warn(`tombstone stats failed: ${err}`);
+      return null;
+    }
+  }
+
+  /**
+   * Rebuild the tombstone log from retired memories on disk. Exposed for
+   * `remnic doctor --rebuild-tombstones` and tests.
+   */
+  async rebuildTombstonesFromFiles(): Promise<number> {
+    if (!this.tombstonesConfig.enabled) return 0;
+    const store = await this.getTombstoneStore();
+    const all = [...(await this.readAllMemories()), ...(await this.readAllColdMemories())];
+    // Pure projection (lifecycle/tombstones.ts) keeps this method thin (#1520).
+    const retired = collectRetiredMemoriesForRebuild(all, {
+      stripCitation: (text) => stripCitationForTemplate(text, this.citationTemplate),
+      supersessionKeysForFact,
+    });
+    return await store.rebuild(retired);
+  }
+
   private async getFactHashIndex(): Promise<ContentHashIndex> {
     if (this.factHashIndex) {
       return this.factHashIndex;
@@ -3486,12 +3701,72 @@ export class StorageManager {
     // consolidation paths can remove the correct hash from ContentHashIndex
     // regardless of what citation format (if any) has been appended to the
     // stored body. Mirrors the logic in the fact-hash-index update below.
+    let factHashSourceForTombstone: string | null = null;
     if (category === "fact") {
       const hashSource =
         options.contentHashSource !== undefined && options.contentHashSource.length > 0
           ? sanitizeMemoryContent(options.contentHashSource).text
           : sanitized.text;
       fm.contentHash = ContentHashIndex.computeHash(hashSource);
+      factHashSourceForTombstone = hashSource;
+    }
+
+    // ── Non-resurrection chokepoint (issue #1579) ────────────────────────
+    // Before a new fact becomes active, consult the tombstone index. If a
+    // retired fact matches (exact / normalized / keyed / semantic), persist
+    // the candidate as pending_review + blockedBy instead — VISIBLE, never a
+    // silent drop (rule 34) — and skip the active dedup/index registration
+    // (rule 44). This is the SINGLE storage persist path: every write
+    // (extraction, import, consolidation, dreams, pattern-reinforcement)
+    // funnels through writeMemory, so the five resurrection paths are blocked
+    // here without per-path code (rule 43).
+    let tombstoneBlocked = false;
+    if (
+      category === "fact" &&
+      this.tombstonesConfig.enabled &&
+      factHashSourceForTombstone !== null &&
+      // Block facts that would become ACTIVE or are already pending_review
+      // (issue #1579 thread ObteQ: wearable/native imports write fact
+      // candidates with status: pending_review; without checking them here,
+      // promoteWearableMemory could later flip a retired fact active without
+      // a tombstone check). A caller that explicitly requests a terminal
+      // non-active status (rejected/retracted/superseded) is respected.
+      (fm.status === undefined || fm.status === "active" || fm.status === "pending_review")
+    ) {
+      try {
+        const tombstoneStore = await this.getTombstoneStore();
+        // Derive the keyed-tier supersession key from structured attributes
+        // using the SAME helper write-time supersession uses (one helper).
+        const keyedSupersession =
+          options.entityRef && options.structuredAttributes
+            ? supersessionKeysForFact({
+                entityRef: options.entityRef,
+                structuredAttributes: options.structuredAttributes,
+              })
+            : [];
+        // Issue #1579 thread Ociag/Oci-W: pass EVERY key — emitters register one tombstone per key, so the block can be on any later key.
+        const match = tombstoneStore.lookup({
+          contentHash: fm.contentHash,
+          normalizedText: ContentHashIndex.normalizeContent(factHashSourceForTombstone),
+          ...(options.entityRef ? { entityRef: options.entityRef } : {}),
+          ...(keyedSupersession.length > 0 ? { supersessionKeys: keyedSupersession } : {}),
+          namespace: this.tombstonesConfig.namespace,
+        });
+        if (match) {
+          tombstoneBlocked = true;
+          fm.status = "pending_review";
+          fm.blockedBy = match.tombstoneId;
+          fm.tombstoneBlockTier = match.matchedTier;
+          log.info(
+            `tombstone: blocked resurrection of fact ${id} (tier=${match.matchedTier}, tombstone=${match.tombstoneId}, reason=${match.reason})`,
+          );
+        }
+      } catch (err) {
+        // Fail-open (rule 34 spirit): a tombstone lookup error must not block
+        // the write. The fact persists as active; the next lookup after the
+        // store recovers will catch a subsequent re-extraction.
+        log.warn(`tombstone lookup failed for fact ${id} (fail-open): ${err}`);
+      }
     }
 
     const fileContent = `${serializeFrontmatter(fm)}\n\n${sanitized.text}\n`;
@@ -3512,7 +3787,11 @@ export class StorageManager {
         ...((options.lineage ?? []).filter(Boolean)),
       ],
     });
-    if (category === "fact") {
+    if (category === "fact" && !tombstoneBlocked) {
+      // Rule 44 (#1579): a tombstone-blocked fact MUST NOT be registered as an
+      // active dedup/index entry — otherwise the block is invisible to dedup
+      // and the content is silently banned on the next extraction. Only active
+      // (un-blocked) facts enter the hash index.
       try {
         const factHashIndex = await this.getFactHashIndex();
         // When the caller provides a separate contentHashSource (e.g. the raw
@@ -3566,6 +3845,23 @@ export class StorageManager {
     await factHashIndex.save();
   }
 
+  /**
+   * Re-register a fact's contentHash in the dedup index after a tombstone
+   * block is lifted on approval (issue #1579 thread ObnTy). `writeMemory`
+   * skips hash-index registration for tombstone-blocked facts (rule 44); when
+   * the review queue later promotes such a fact back to `status: active`, the
+   * hash must enter the index or the next extraction of the same content
+   * creates a second active fact. Reads the memory by id so the caller (the
+   * review CLI) does not need to re-parse the file. No-op for non-facts or
+   * facts that are not active.
+   */
+  async restoreFactHashAfterApproval(memoryId: string): Promise<void> {
+    const all = await this.readAllMemories();
+    const memory = all.find((m) => m.frontmatter.id === memoryId);
+    if (!memory) return;
+    await this.addActiveFactContentHash(memory);
+  }
+
   private async syncFactHashIndexAfterRewrite(before: MemoryFile, after: MemoryFile): Promise<void> {
     if (before.frontmatter.category !== "fact" && after.frontmatter.category !== "fact") return;
 
@@ -4068,6 +4364,15 @@ export class StorageManager {
     // recall cache was never invalidated on mutations, so recall served
     // pre-edit bundles for the remainder of its fresh/stale TTL window.
     invalidateAllForDir(this.baseDir);
+    // Issue #1579 — tombstone store is a cache layer too (rule 25: clear ALL
+    // cache layers). A tombstone append from another path (supersession /
+    // correction) must be visible to the next writeMemory lookup on this
+    // instance without waiting for a process restart.
+    if (this.tombstoneStore) {
+      this.tombstoneStore.invalidate();
+      this.tombstoneStore = null;
+      this.tombstoneStoreLoadPromise = null;
+    }
   }
 
   /**
@@ -7133,6 +7438,28 @@ export class StorageManager {
       this.bumpMemoryStatusVersion();
       log.debug(`superseded memory ${oldMemoryId} by ${newMemoryId}: ${reason}`);
 
+      // Issue #1579 — emit a tombstone so the superseded fact cannot
+      // resurrect. Contradiction resolution verbs (keep-a/keep-b/merge) all
+      // funnel through supersedeMemory, so emitting here covers every verb
+      // exactly once (rule 22). Only facts participate. Thread Oci-Y: emit
+      // one tombstone PER derived supersession key (buildRetiredFactTombstoneInputs)
+      // so a paraphrased re-write is caught on the keyed tier — a single
+      // entityRef-only record missed and the fact resurrected until rebuild.
+      if (oldMemory.frontmatter.category === "fact") {
+        for (const input of buildRetiredFactTombstoneInputs(
+          {
+            id: oldMemoryId,
+            content: stripCitationForTemplate(oldMemory.content, this.citationTemplate),
+            contentHash: oldMemory.frontmatter.contentHash,
+            entityRef: oldMemory.frontmatter.entityRef,
+            structuredAttributes: oldMemory.frontmatter.structuredAttributes,
+          },
+          { reason: "contradiction_resolution", createdBy: "contradiction_resolution", createdAt: now, supersessionKeysForFact },
+        )) {
+          await this.appendTombstone(input);
+        }
+      }
+
       // Also write a correction entry for the audit trail
       await this.writeMemory("correction", `Superseded: ${oldMemory.content}\n\nReason: ${reason}`, {
         confidence: 1.0,

package/src/temporal-supersession.ts

@@ -471,6 +471,44 @@ export async function applyTemporalSupersession(args: {
           supersededAt,
           invalidAt: invalidAtPatch ?? fresh.frontmatter.invalid_at,
         });
+        // Issue #1579 — emit a tombstone for the superseded memory so it
+        // cannot resurrect through re-extraction / import / consolidation /
+        // dreams / pattern-reinforcement. The supersession key is the first
+        // matched key (the write-time supersession identity). Best-effort:
+        // a tombstone append failure is logged but never fails supersession
+        // (gotcha #13).
+        // Issue #1579 thread ObteS: persist ALL matched supersession keys, not
+        // just the first. A later paraphrased re-observation may derive the
+        // same entity but place the tombstoned attribute at a different
+        // position in structuredAttributes; without an entry for every matched
+        // key, the keyed tier would miss and the fact could resurrect as
+        // active. Pass the canonical contentHash from the retired memory's
+        // frontmatter so the tombstone's exact tier matches re-extraction
+        // (review: citation-hash alignment). The rawContent is the stored body;
+        // the StorageManager.appendTombstone chokepoint strips citation
+        // annotations for the normalized-text tier.
+        const keysToTombstone =
+          decision.matchedKeys.length > 0 ? decision.matchedKeys : [undefined];
+        for (const key of keysToTombstone) {
+          try {
+            await args.storage.appendTombstone({
+              reason: "supersession",
+              createdBy: "supersession",
+              sourceMemoryId: fresh.frontmatter.id,
+              ...(fresh.frontmatter.contentHash
+                ? { contentHash: fresh.frontmatter.contentHash }
+                : {}),
+              rawContent: fresh.content,
+              ...(fresh.frontmatter.entityRef ? { entityRef: fresh.frontmatter.entityRef } : {}),
+              ...(key ? { supersessionKey: key } : {}),
+              createdAt: supersededAt,
+            });
+          } catch (tombErr) {
+            log.warn(
+              `temporal-supersession: tombstone emit failed for ${fresh.frontmatter.id}${key ? ` (key=${key})` : ""} : ${tombErr}`,
+            );
+          }
+        }
       }
     } catch (err) {
       log.warn(

package/src/types.ts

@@ -821,6 +821,29 @@ export interface PluginConfig {
    * deployments prefer the older (always-inject) behavior. Default `false`.
    */
   temporalExpiredInInjection: boolean;
+  // Tombstones — non-resurrection invariant (issue #1579).
+  /**
+   * Master gate for the tombstone non-resurrection invariant. When `true`
+   * (default), a fact that matches an active tombstone at the storage
+   * chokepoint is persisted as `status: "pending_review"` + `blockedBy`
+   * instead of becoming active — visible, never a silent drop (rule 34).
+   * When `false`, pre-feature behavior: the chokepoint check is a no-op and
+   * retired facts can resurrect through re-extraction / import / consolidation
+   * / dreams / pattern-reinforcement. Off = rollback safety (rule 30).
+   */
+  tombstonesEnabled: boolean;
+  /**
+   * Tier-4 semantic tombstone matching (issue #1579). Off by default — ships
+   * dark until MemCorrect (#1584) shows an acceptable false-block rate
+   * (rule 48). When `true`, the tombstone lookup also checks embedding cosine
+   * similarity against tombstoned normalized text.
+   */
+  tombstonesSemanticMatch: boolean;
+  /**
+   * Cosine threshold for tier-4 semantic tombstone matching. Default `0.9`.
+   * Only consulted when `tombstonesSemanticMatch` is `true`.
+   */
+  tombstonesSemanticThreshold: number;
   // Direct-answer retrieval tier (issue #518)
   /**
    * When true, recall checks whether a single validated memory in a
@@ -2441,6 +2464,17 @@ export interface MemoryFrontmatter {
   lineage?: string[];
   /** Memory status: active (default), pending_review, rejected, quarantined, superseded, archived, or forgotten */
   status?: MemoryStatus;
+  /**
+   * Tombstone block marker (issue #1579). When a new fact matches an active
+   * tombstone at the storage chokepoint, it is persisted with
+   * `status: "pending_review"` and this field set to the tombstone id — making
+   * the block VISIBLE (rule 34: never a silent drop) rather than silently
+   * discarding the extraction. Approving the memory through the review queue
+   * emits a revocation that re-allows the content.
+   */
+  blockedBy?: string;
+  /** Which tombstone tier matched (`exact`/`normalized`/`keyed`/`semantic`). */
+  tombstoneBlockTier?: "exact" | "normalized" | "keyed" | "semantic";
   /** ID of memory that superseded this one */
   supersededBy?: string;
   /** Timestamp when superseded */

package/dist/chunk-2K64VH66.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\nimport type { NamespaceCatalog } from \"./catalog.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!config.namespacesEnabled) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(config.defaultNamespace),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : (await exists(legacyNsDir))\n      ? legacyNsDir\n      : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!config.namespacesEnabled) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));\n  if (\n    (await exists(tokenizedRoot)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))\n  ) {\n    return tokenizedRoot;\n  }\n  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // In-flight resolve-hook dedup (NFJV-, codex P2). The catalog's `onResolve`\n  // hook is ASYNC (it returns `registerResolved(...)`), so `notifiedResolved` is\n  // only set after the hook's promise SETTLES. Without tracking the in-flight\n  // window, a burst of `storageFor()` cache hits for the SAME namespace before\n  // the first registration finishes would each pass the `notifiedResolved` guard\n  // and fire their OWN `onResolve` — queueing N duplicate catalog touches + lock\n  // acquisitions despite the once-per-namespace intent. We therefore record the\n  // (namespace → storageDir) being registered BEFORE awaiting the hook so a\n  // concurrent call for the same pair skips firing. On SUCCESS the pair is\n  // promoted to `notifiedResolved` (future calls skip permanently); on `false`\n  // (dropped touch — e.g. rebuild-lock timeout) OR rejection the in-flight marker\n  // is CLEARED so a later `storageFor()` can RETRY the dropped registration. The\n  // entry is always removed when the promise settles, so the map cannot grow\n  // unbounded (one transient entry per concurrently-resolving namespace).\n  private readonly inFlightResolved = new Map<string, string>();\n  // Tracks every in-flight resolve-hook promise so callers can deterministically\n  // await the fire-and-forget registrations that `storageFor()` kicks off (see\n  // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the\n  // set holds at most one promise per concurrently-resolving namespace.\n  private readonly pendingResolveHooks = new Set<Promise<unknown>>();\n  // Pending post-write catalog touch promises (#1522). Like pendingResolveHooks,\n  // lets tests await fire-and-forget write touches deterministically.\n  private readonly pendingWriteTouches = new Set<Promise<unknown>>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n    /** Catalog reference for post-write/read touches (issue #1522 chokepoint). */\n    private readonly catalog?: NamespaceCatalog,\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!this.config.namespacesEnabled) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    // #1522: install the post-write catalog touch at the chokepoint — every\n    // successful write on this StorageManager records the namespace touch.\n    this.bindCatalogWriteHook(sm, ns);\n    this.cache.set(ns, sm);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Skip when we've already SUCCESSFULLY notified this exact (namespace,\n    // storageDir) — a steady-state cache hit must not re-append to the catalog\n    // log (NCNL2). A changed dir (rare: migration/realignment) still re-fires\n    // once. We mark the pair as notified ONLY AFTER the hook succeeds, and CLEAR\n    // it on failure, so a dropped registration (e.g. rebuild-lock timeout) is\n    // RETRIED on the next cache hit instead of being suppressed forever (round 6,\n    // cursor Medium — ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (NFJV-, codex P2): if a registration for this exact\n    // (namespace, storageDir) is already AWAITING its async hook, do not fire a\n    // second one. Without this, concurrent cache-hit bursts before the first\n    // append settles each pass the `notifiedResolved` guard above and queue\n    // duplicate catalog touches/lock acquisitions. A pair with a DIFFERENT\n    // in-flight dir (rare mid-migration realignment) still fires once.\n    if (this.inFlightResolved.get(namespace) === storageDir) return;\n    try {\n      // Handle BOTH synchronous throws and asynchronous rejections (round 6,\n      // codex P2 — NDo8C). The hook may be `async`; its rejected promise would\n      // bypass this try/catch and, where unhandled rejections are fatal, crash\n      // storage resolution. Mark the dedup pair as notified ONLY when the hook\n      // resolves to a PERSISTED result (round 6, codex P2 — NEFoX): a result of\n      // `false` means the registration was dropped/no-op (e.g. rebuild-lock\n      // timeout), so we must NOT suppress its retry. `void`/`undefined` is treated\n      // as success for legacy hooks. On rejection we leave it un-notified to retry.\n      //\n      // Record the in-flight marker BEFORE awaiting so concurrent calls for the\n      // same pair skip (NFJV-). It is always cleared once the promise settles, so\n      // the map holds at most one transient entry per concurrently-resolving\n      // namespace and cannot grow unbounded.\n      this.inFlightResolved.set(namespace, storageDir);\n      const hookResult = Promise.resolve(hook(namespace, storageDir));\n      // Track the in-flight promise so `whenResolveHooksSettled()` can await it.\n      this.pendingResolveHooks.add(hookResult);\n      hookResult.then(\n        (persisted) => {\n          // Clear the in-flight marker ONLY if it is still ours (a newer resolve\n          // for a different dir may have replaced it).\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (persisted !== false) {\n            this.notifiedResolved.set(namespace, storageDir);\n          }\n          // On `false` (dropped touch) we intentionally do NOT mark notified, so\n          // a later `storageFor()` retries the registration. Clearing the\n          // in-flight marker above is what re-enables that retry.\n          this.pendingResolveHooks.delete(hookResult);\n        },\n        () => {\n          // Registration failed — clear in-flight AND do NOT mark as notified, so\n          // it is retried on the next cache hit.\n          if (this.inFlightResolved.get(namespace) === storageDir) {\n            this.inFlightResolved.delete(namespace);\n          }\n          if (this.notifiedResolved.get(namespace) === storageDir) {\n            this.notifiedResolved.delete(namespace);\n          }\n          this.pendingResolveHooks.delete(hookResult);\n        },\n      );\n    } catch {\n      // Synchronous throw: clear any in-flight marker we just set and leave the\n      // pair un-notified so a later resolve retries.\n      if (this.inFlightResolved.get(namespace) === storageDir) {\n        this.inFlightResolved.delete(namespace);\n      }\n    }\n  }\n\n  /**\n   * Install the post-write catalog touch hook on an externally-constructed\n   * StorageManager (issue #1522). Used by the orchestrator for the legacy\n   * default-namespace storage (`this.storage`) that bypasses the router.\n   */\n  bindCatalogWriteHook(sm: StorageManager, namespace: string): void {\n    sm.onCatalogWrite = () => this.touchCatalogWrite(namespace, sm.dir);\n  }\n\n  /**\n   * Post-write catalog touch (issue #1522 chokepoint). Called by every\n   * StorageManager's post-write hook AFTER a successful write. Best-effort\n   * and failure-tolerant — a catalog error MUST NOT affect the primary write\n   * (gotcha #13, rule #40). Fire-and-forget by design.\n   */\n  private touchCatalogWrite(namespace: string, storageDir: string): void {\n    if (!this.catalog) return;\n    const touch = this.catalog\n      .markWrite(namespace, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Record a namespace read in the catalog (issue #1522 chokepoint move).\n   * Best-effort and failure-tolerant. Used by recall paths so the read touch\n   * lives in the storage layer, not at the caller.\n   */\n  recordRead(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    void this.catalog\n      .markRead(ns, { discoveredBy: \"read\", storageDir })\n      .catch(() => undefined);\n  }\n  /**\n   * Record a namespace write touch in the catalog (issue #1522). Best-effort\n   * and failure-tolerant. Used by consolidation/cleanup passes that may mutate\n   * the store via delete-only paths (e.g. entity-file merges, TTL cleanup) so\n   * the namespace's lastWriteAt stays fresh even when no explicit write went\n   * through the storage chokepoint. This is NOT a substitute for the chokepoint\n   * — it's a belt-and-suspenders for paths the chokepoint doesn't cover.\n   */\n  recordWrite(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    const touch = this.catalog\n      .markWrite(ns, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Resolve once every in-flight post-write catalog touch has settled (#1522).\n   * Mirrors `whenResolveHooksSettled()`: the StorageManager's post-write hook\n   * fires the catalog touch fire-and-forget, so tests asserting lastWriteAt\n   * moved should await this instead of racing a timer.\n   */\n  async whenWriteTouchesSettled(): Promise<void> {\n    while (this.pendingWriteTouches.size > 0) {\n      await Promise.allSettled([...this.pendingWriteTouches]);\n    }\n  }\n\n  /**\n   * Resolve once every in-flight `onResolve` registration has settled.\n   *\n   * `storageFor()` fires the resolve hook fire-and-forget, so its catalog side\n   * effect (e.g. `registerResolved(...)`) is not observable the moment\n   * `storageFor()` returns. Callers that must act on that side effect — notably\n   * tests asserting the catalog was updated — should await this instead of\n   * racing a timer. Resolves immediately when no hook is registered or nothing\n   * is in flight. The loop re-checks because a settling hook could, in\n   * principle, trigger a follow-on resolution.\n   */\n  async whenResolveHooksSettled(): Promise<void> {\n    while (this.pendingResolveHooks.size > 0) {\n      await Promise.allSettled([...this.pendingResolveHooks]);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AAQvC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,OAAO,mBAAmB;AAC7B,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,OAAO,gBAAgB;AAAA,EAChD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IACvB,cACA;AACN,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,OAAO,kBAAmB,QAAO,OAAO;AAI7C,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,oBAAoB,OAAO,WAAW,SAAS;AAClE,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAC7F,MACG,MAAM,OAAO,aAAa,KAC1B,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAChF;AACA,WAAO;AAAA,EACT;AACA,SAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AACnD;AAEO,IAAM,yBAAN,MAA6B;AAAA,EAuClC,YACmB,QACA,QAAqC,CAAC,GAEtC,SACjB;AAJiB;AACA;AAEA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EANmB;AAAA,EACA;AAAA,EAEA;AAAA,EA1CF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAe3C,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3C,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA,EAGhD,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD;AAAA,EAWjB,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,KAAK,OAAO,kBAAmB,QAAO,KAAK,OAAO;AACvD,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAGlC,SAAK,qBAAqB,IAAI,EAAE;AAChC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAQX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAOzD,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,QAAI;AAcF,WAAK,iBAAiB,IAAI,WAAW,UAAU;AAC/C,YAAM,aAAa,QAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC;AAE9D,WAAK,oBAAoB,IAAI,UAAU;AACvC,iBAAW;AAAA,QACT,CAAC,cAAc;AAGb,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,cAAc,OAAO;AACvB,iBAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,UACjD;AAIA,eAAK,oBAAoB,OAAO,UAAU;AAAA,QAC5C;AAAA,QACA,MAAM;AAGJ,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,cAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,iBAAK,iBAAiB,OAAO,SAAS;AAAA,UACxC;AACA,eAAK,oBAAoB,OAAO,UAAU;AAAA,QAC5C;AAAA,MACF;AAAA,IACF,QAAQ;AAGN,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,YAAY;AACvD,aAAK,iBAAiB,OAAO,SAAS;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,IAAoB,WAAyB;AAChE,OAAG,iBAAiB,MAAM,KAAK,kBAAkB,WAAW,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,WAAmB,YAA0B;AACrE,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,QAAQ,KAAK,QAChB,UAAU,WAAW,EAAE,cAAc,SAAS,WAAW,CAAC,EAC1D,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAmB,YAA2B;AACvD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,SAAK,KAAK,QACP,SAAS,IAAI,EAAE,cAAc,QAAQ,WAAW,CAAC,EACjD,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,WAAmB,YAA2B;AACxD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,UAAM,QAAQ,KAAK,QAChB,UAAU,IAAI,EAAE,cAAc,SAAS,WAAW,CAAC,EACnD,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}