@remnic/core 9.3.733 → 9.3.735

package/dist/chunk-IXGXALRV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/orchestration/compression-guideline-coordinator.ts"],"sourcesContent":["/**\n * Compression-guideline learning coordinator — extracted from the\n * orchestrator (issue #1526, seam 4).\n *\n * Owns the compression-guideline learning lifecycle:\n *   - candidate computation from recorded memory-action events\n *   - optional LLM semantic refinement of the candidate\n *   - draft persistence + activation (optimizer/draft state files)\n *   - the recall section that surfaces active guidelines during recall\n *   - the consolidation-time learning pass that recomputes the draft\n *\n * The orchestrator constructs one instance and delegates the public\n * entrypoints (`optimizeCompressionGuidelines`,\n * `activateCompressionGuidelineDraft`) plus the two internal hooks\n * (`runCompressionGuidelineLearningPass`, called from the consolidation\n * loop; `buildCompressionGuidelineRecallSection`, called from the recall\n * pipeline) to it. Storage is the orchestrator's stable `this.storage`;\n * the fast-tier LLM call arrives as a callback so gateway routing stays\n * owned by the orchestrator.\n *\n * Behavior-preserving move from orchestrator.ts. No logic changes — the\n * orchestrator keeps thin delegating methods so existing call sites and\n * tests that exercise the public API continue to work.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { resolveCompressionCapabilities } from \"../capabilities.js\";\n\n// StorageManager type comes from the package barrel (type-only) so this\n// module does not add a direct storage.ts import (#1533 ratchet).\nimport type { StorageManager } from \"../index.js\";\nimport type { PluginConfig, MemoryActionType, MemoryActionEvent } from \"../types.js\";\nimport { log } from \"../logger.js\";\nimport {\n  computeCompressionGuidelineCandidate,\n  refineCompressionGuidelineCandidateSemantically,\n  renderCompressionGuidelinesMarkdown,\n} from \"../compression-optimizer.js\";\n\n/** Dependencies injected by the orchestrator. All stable references or\n *  live accessors. */\nexport interface CompressionGuidelineCoordinatorDeps {\n  config: PluginConfig;\n  /** Live accessor: the orchestrator's storage manager (stable post-ctor). */\n  getStorage: () => StorageManager;\n  /** Fast-tier LLM call used for optional semantic refinement. Routes\n   *  through the gateway chain when configured — owned by the\n   *  orchestrator, injected here so this module stays LLM-agnostic. */\n  fastChatCompletion: (\n    messages: Array<{ role: string; content: string }>,\n    options: {\n      temperature?: number;\n      maxTokens?: number;\n      timeoutMs?: number;\n      operation?: string;\n      priority?: \"background\" | \"recall-critical\";\n    },\n  ) => Promise<{ content: string } | null>;\n}\n\n/**\n * Coordinates compression-guideline learning. Holds no mutable state of\n * its own — all persistence flows through the injected storage manager.\n */\nexport class CompressionGuidelineCoordinator {\n  constructor(private readonly deps: CompressionGuidelineCoordinatorDeps) {}\n\n  private get storage(): StorageManager {\n    return this.deps.getStorage();\n  }\n\n  private get config(): PluginConfig {\n    return this.deps.config;\n  }\n\n  async optimizeCompressionGuidelines(options?: {\n    dryRun?: boolean;\n    eventLimit?: number;\n  }): Promise<{\n    enabled: boolean;\n    dryRun: boolean;\n    eventCount: number;\n    previousGuidelineVersion: number | null;\n    nextGuidelineVersion: number;\n    changedRules: number;\n    semanticRefinementApplied: boolean;\n    persisted: boolean;\n    draftContentHash: string | null;\n  }> {\n    const dryRun = options?.dryRun === true;\n    const eventLimit =\n      typeof options?.eventLimit === \"number\"\n        ? Math.max(0, Math.floor(options.eventLimit))\n        : 500;\n\n    const [activeState, draftState] = await Promise.all([\n      this.storage.readCompressionGuidelineOptimizerState(),\n      this.storage.readCompressionGuidelineDraftState().catch(() => null),\n    ]);\n    const previousState =\n      draftState &&\n      ((activeState?.guidelineVersion ?? 0) < draftState.guidelineVersion ||\n        (activeState?.guidelineVersion ?? 0) === draftState.guidelineVersion)\n        ? draftState\n        : activeState;\n\n    if (!resolveCompressionCapabilities(this.config).compressionGuidelineLearning) {\n      return {\n        enabled: false,\n        dryRun,\n        eventCount: 0,\n        previousGuidelineVersion: previousState?.guidelineVersion ?? null,\n        nextGuidelineVersion: previousState?.guidelineVersion ?? 0,\n        changedRules: 0,\n        semanticRefinementApplied: false,\n        persisted: false,\n        draftContentHash: null,\n      };\n    }\n\n    let events = await this.storage.readMemoryActionEvents(eventLimit);\n    if (eventLimit > 0) {\n      let effectiveEvents = events.filter((event) => event.dryRun !== true);\n      let fetchLimit = eventLimit;\n      while (\n        effectiveEvents.length < eventLimit &&\n        events.length === fetchLimit\n      ) {\n        fetchLimit = Math.min(fetchLimit * 2, fetchLimit + 1000);\n        if (fetchLimit <= events.length) break;\n        events = await this.storage.readMemoryActionEvents(fetchLimit);\n        effectiveEvents = events.filter((event) => event.dryRun !== true);\n      }\n      events = effectiveEvents.slice(-eventLimit);\n    }\n    const generatedAt = new Date().toISOString();\n    const candidate = computeCompressionGuidelineCandidate(events, {\n      generatedAtIso: generatedAt,\n      previousState,\n    });\n    if (candidate.eventCounts.total === 0) {\n      return {\n        enabled: true,\n        dryRun,\n        eventCount: 0,\n        previousGuidelineVersion: previousState?.guidelineVersion ?? null,\n        nextGuidelineVersion: previousState?.guidelineVersion ?? 0,\n        changedRules: 0,\n        semanticRefinementApplied: false,\n        persisted: false,\n        draftContentHash: null,\n      };\n    }\n    const refinedCandidate =\n      await refineCompressionGuidelineCandidateSemantically(candidate, {\n        enabled: resolveCompressionCapabilities(this.config).compressionGuidelineSemanticRefinement,\n        timeoutMs: this.config.compressionGuidelineSemanticTimeoutMs,\n        runRefinement: async (baseline) => {\n          const prompt = [\n            \"You refine compression policy suggestions conservatively.\",\n            \"Return JSON only in this shape:\",\n            '{\"updates\":[{\"action\":\"summarize_node\",\"delta\":0.02,\"confidence\":\"medium\",\"note\":\"...\"}]}',\n            \"Constraints:\",\n            \"- Keep updates sparse and conservative.\",\n            \"- delta must stay between -0.15 and 0.15.\",\n            \"- Only include actions present in the input.\",\n            \"Input candidate:\",\n            JSON.stringify(baseline),\n          ].join(\"\\n\");\n\n          const response = await this.deps.fastChatCompletion(\n            [\n              {\n                role: \"system\",\n                content: \"Respond with strict JSON only. No markdown.\",\n              },\n              { role: \"user\", content: prompt },\n            ],\n            {\n              temperature: 0.1,\n              maxTokens: 400,\n              operation: \"compression_guideline_semantic_refinement\",\n              priority: \"background\",\n            },\n          );\n\n          return this.parseCompressionSemanticRefinement(\n            response?.content ?? \"\",\n          );\n        },\n      });\n\n    const content = renderCompressionGuidelinesMarkdown(refinedCandidate);\n    const contentHash = createHash(\"sha256\").update(content).digest(\"hex\");\n    const semanticRefinementApplied =\n      JSON.stringify(refinedCandidate.ruleUpdates) !==\n      JSON.stringify(candidate.ruleUpdates);\n    const changedRules = refinedCandidate.ruleUpdates.filter(\n      (rule) => rule.delta !== 0,\n    ).length;\n\n    if (!dryRun) {\n      await this.storage.writeCompressionGuidelineDraft(content);\n      await this.storage.writeCompressionGuidelineDraftState({\n        version: refinedCandidate.optimizerVersion,\n        updatedAt: refinedCandidate.generatedAt,\n        sourceWindow: refinedCandidate.sourceWindow,\n        eventCounts: refinedCandidate.eventCounts,\n        guidelineVersion: refinedCandidate.guidelineVersion,\n        contentHash,\n        activationState: \"draft\",\n        actionSummaries: refinedCandidate.actionSummaries,\n        ruleUpdates: refinedCandidate.ruleUpdates,\n      });\n    }\n\n    return {\n      enabled: true,\n      dryRun,\n      eventCount: candidate.eventCounts.total,\n      previousGuidelineVersion: previousState?.guidelineVersion ?? null,\n      nextGuidelineVersion: refinedCandidate.guidelineVersion,\n      changedRules,\n      semanticRefinementApplied,\n      persisted: !dryRun,\n      draftContentHash: dryRun ? null : contentHash,\n    };\n  }\n\n  async activateCompressionGuidelineDraft(options?: {\n    expectedContentHash?: string;\n    expectedGuidelineVersion?: number;\n  }): Promise<{\n    enabled: boolean;\n    activated: boolean;\n    guidelineVersion: number | null;\n    reason?:\n      | \"disabled\"\n      | \"missing_draft\"\n      | \"expected_revision_required\"\n      | \"content_hash_mismatch\"\n      | \"guideline_version_mismatch\"\n      | \"draft_changed\";\n  }> {\n    if (!resolveCompressionCapabilities(this.config).compressionGuidelineLearning) {\n      return {\n        enabled: false,\n        activated: false,\n        guidelineVersion: null,\n        reason: \"disabled\",\n      };\n    }\n\n    const draftState = await this.storage.readCompressionGuidelineDraftState();\n    if (!draftState) {\n      return {\n        enabled: true,\n        activated: false,\n        guidelineVersion: null,\n        reason: \"missing_draft\",\n      };\n    }\n\n    const expectedContentHash = options?.expectedContentHash?.trim();\n    const expectedGuidelineVersion = options?.expectedGuidelineVersion;\n\n    if (\n      (!expectedContentHash || expectedContentHash.length === 0) &&\n      typeof expectedGuidelineVersion !== \"number\"\n    ) {\n      return {\n        enabled: true,\n        activated: false,\n        guidelineVersion: null,\n        reason: \"expected_revision_required\",\n      };\n    }\n\n    if (expectedContentHash && draftState.contentHash !== expectedContentHash) {\n      return {\n        enabled: true,\n        activated: false,\n        guidelineVersion: null,\n        reason: \"content_hash_mismatch\",\n      };\n    }\n\n    if (\n      typeof expectedGuidelineVersion === \"number\" &&\n      draftState.guidelineVersion !== expectedGuidelineVersion\n    ) {\n      return {\n        enabled: true,\n        activated: false,\n        guidelineVersion: null,\n        reason: \"guideline_version_mismatch\",\n      };\n    }\n\n    const activated = await this.storage.activateCompressionGuidelineDraft({\n      ...(expectedContentHash ? { expectedContentHash } : {}),\n      ...(typeof expectedGuidelineVersion === \"number\"\n        ? { expectedGuidelineVersion }\n        : {}),\n    });\n    return {\n      enabled: true,\n      activated,\n      guidelineVersion: activated ? draftState.guidelineVersion : null,\n      ...(activated ? {} : { reason: \"draft_changed\" as const }),\n    };\n  }\n\n  /** Consolidation-time hook: recompute the draft from recent events. */\n  async runCompressionGuidelineLearningPass(): Promise<void> {\n    if (!resolveCompressionCapabilities(this.config).compressionGuidelineLearning) return;\n    try {\n      const result = await this.optimizeCompressionGuidelines({\n        dryRun: false,\n        eventLimit: 500,\n      });\n      log.info(\n        `compression guideline learning updated (${result.eventCount} events)`,\n      );\n    } catch (err) {\n      log.warn(`compression guideline learning failed (ignored): ${err}`);\n    }\n  }\n\n  /** Recall-time hook: surface active guidelines as a recall section. */\n  async buildCompressionGuidelineRecallSection(): Promise<string | null> {\n    if (!resolveCompressionCapabilities(this.config).contextCompressionActions) return null;\n    if (!resolveCompressionCapabilities(this.config).compressionGuidelineLearning) return null;\n\n    const state = await this.storage\n      .readCompressionGuidelineOptimizerState()\n      .catch(() => null);\n    if (!state || state.guidelineVersion <= 0) return null;\n\n    const raw = await this.storage\n      .readCompressionGuidelines()\n      .catch(() => null);\n    const summary = raw ? formatCompressionGuidelinesForRecall(raw, 5) : null;\n    if (!summary) return null;\n\n    return [\n      \"## Active Compression Guidelines\",\n      \"\",\n      `Guideline version: ${state.guidelineVersion}`,\n      `Updated: ${state.updatedAt}`,\n      \"\",\n      summary,\n    ].join(\"\\n\");\n  }\n\n  private parseCompressionSemanticRefinement(raw: string): {\n    updates: Array<{\n      action: MemoryActionType;\n      delta?: number;\n      confidence?: \"low\" | \"medium\" | \"high\";\n      note?: string;\n    }>;\n  } | null {\n    if (typeof raw !== \"string\" || raw.trim().length === 0) return null;\n    const trimmed = raw.trim();\n    const start = trimmed.indexOf(\"{\");\n    const end = trimmed.lastIndexOf(\"}\");\n    if (start === -1 || end === -1 || end <= start) return null;\n\n    try {\n      const parsed = JSON.parse(trimmed.slice(start, end + 1)) as {\n        updates?: Array<{\n          action?: unknown;\n          delta?: unknown;\n          confidence?: unknown;\n          note?: unknown;\n        }>;\n      };\n      if (!Array.isArray(parsed?.updates)) return null;\n\n      const validActions = new Set<MemoryActionType>([\n        \"store_episode\",\n        \"store_note\",\n        \"update_note\",\n        \"create_artifact\",\n        \"summarize_node\",\n        \"discard\",\n        \"link_graph\",\n      ]);\n\n      const updates = parsed.updates\n        .filter(\n          (item) =>\n            item &&\n            typeof item.action === \"string\" &&\n            validActions.has(item.action as MemoryActionType),\n        )\n        .map((item) => {\n          const confidence: \"low\" | \"medium\" | \"high\" | undefined =\n            item.confidence === \"low\" ||\n            item.confidence === \"medium\" ||\n            item.confidence === \"high\"\n              ? item.confidence\n              : undefined;\n          return {\n            action: item.action as MemoryActionType,\n            delta:\n              typeof item.delta === \"number\" && Number.isFinite(item.delta)\n                ? item.delta\n                : undefined,\n            confidence,\n            note: typeof item.note === \"string\" ? item.note : undefined,\n          };\n        });\n\n      return { updates };\n    } catch {\n      return null;\n    }\n  }\n}\n\n/**\n * Format the active compression-guidelines section for recall. Extracted\n * from the orchestrator (was a module-level export there); re-exported by\n * the orchestrator barrel to preserve the public API. Pure — no state.\n */\nexport function formatCompressionGuidelinesForRecall(\n  raw: string,\n  maxLines: number = 5,\n): string | null {\n  if (typeof raw !== \"string\" || raw.trim().length === 0) return null;\n  const sectionMatch = raw.match(\n    // End the section at `\\n## ` or end-of-string. Plain $ (not \\s*$): the\n    // \\s* branch overlapped the lazy body and backtracked polynomially\n    // (CodeQL js/polynomial-redos). Captured lines are trimmed/filtered below,\n    // so trailing whitespace handling is unchanged.\n    /## Suggested Guidelines\\s*\\n([\\s\\S]*?)(?:\\n##\\s+|$)/i,\n  );\n  if (!sectionMatch) return null;\n\n  const lines = sectionMatch[1]\n    .split(\"\\n\")\n    .map((line) => line.trim())\n    .filter((line) => line.startsWith(\"- \"))\n    .slice(0, Math.max(1, Math.floor(maxLines)));\n  if (lines.length === 0) return null;\n\n  return lines.join(\"\\n\");\n}\n"],"mappings":";;;;;;;;;;;;;AAyBA,SAAS,kBAAkB;AAuCpB,IAAM,kCAAN,MAAsC;AAAA,EAC3C,YAA6B,MAA2C;AAA3C;AAAA,EAA4C;AAAA,EAA5C;AAAA,EAE7B,IAAY,UAA0B;AACpC,WAAO,KAAK,KAAK,WAAW;AAAA,EAC9B;AAAA,EAEA,IAAY,SAAuB;AACjC,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA,EAEA,MAAM,8BAA8B,SAajC;AACD,UAAM,SAAS,SAAS,WAAW;AACnC,UAAM,aACJ,OAAO,SAAS,eAAe,WAC3B,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,UAAU,CAAC,IAC1C;AAEN,UAAM,CAAC,aAAa,UAAU,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClD,KAAK,QAAQ,uCAAuC;AAAA,MACpD,KAAK,QAAQ,mCAAmC,EAAE,MAAM,MAAM,IAAI;AAAA,IACpE,CAAC;AACD,UAAM,gBACJ,gBACE,aAAa,oBAAoB,KAAK,WAAW,qBAChD,aAAa,oBAAoB,OAAO,WAAW,oBAClD,aACA;AAEN,QAAI,CAAC,+BAA+B,KAAK,MAAM,EAAE,8BAA8B;AAC7E,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ,0BAA0B,eAAe,oBAAoB;AAAA,QAC7D,sBAAsB,eAAe,oBAAoB;AAAA,QACzD,cAAc;AAAA,QACd,2BAA2B;AAAA,QAC3B,WAAW;AAAA,QACX,kBAAkB;AAAA,MACpB;AAAA,IACF;AAEA,QAAI,SAAS,MAAM,KAAK,QAAQ,uBAAuB,UAAU;AACjE,QAAI,aAAa,GAAG;AAClB,UAAI,kBAAkB,OAAO,OAAO,CAAC,UAAU,MAAM,WAAW,IAAI;AACpE,UAAI,aAAa;AACjB,aACE,gBAAgB,SAAS,cACzB,OAAO,WAAW,YAClB;AACA,qBAAa,KAAK,IAAI,aAAa,GAAG,aAAa,GAAI;AACvD,YAAI,cAAc,OAAO,OAAQ;AACjC,iBAAS,MAAM,KAAK,QAAQ,uBAAuB,UAAU;AAC7D,0BAAkB,OAAO,OAAO,CAAC,UAAU,MAAM,WAAW,IAAI;AAAA,MAClE;AACA,eAAS,gBAAgB,MAAM,CAAC,UAAU;AAAA,IAC5C;AACA,UAAM,eAAc,oBAAI,KAAK,GAAE,YAAY;AAC3C,UAAM,YAAY,qCAAqC,QAAQ;AAAA,MAC7D,gBAAgB;AAAA,MAChB;AAAA,IACF,CAAC;AACD,QAAI,UAAU,YAAY,UAAU,GAAG;AACrC,aAAO;AAAA,QACL,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ,0BAA0B,eAAe,oBAAoB;AAAA,QAC7D,sBAAsB,eAAe,oBAAoB;AAAA,QACzD,cAAc;AAAA,QACd,2BAA2B;AAAA,QAC3B,WAAW;AAAA,QACX,kBAAkB;AAAA,MACpB;AAAA,IACF;AACA,UAAM,mBACJ,MAAM,gDAAgD,WAAW;AAAA,MAC/D,SAAS,+BAA+B,KAAK,MAAM,EAAE;AAAA,MACrD,WAAW,KAAK,OAAO;AAAA,MACvB,eAAe,OAAO,aAAa;AACjC,cAAM,SAAS;AAAA,UACb;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,UAAU,QAAQ;AAAA,QACzB,EAAE,KAAK,IAAI;AAEX,cAAM,WAAW,MAAM,KAAK,KAAK;AAAA,UAC/B;AAAA,YACE;AAAA,cACE,MAAM;AAAA,cACN,SAAS;AAAA,YACX;AAAA,YACA,EAAE,MAAM,QAAQ,SAAS,OAAO;AAAA,UAClC;AAAA,UACA;AAAA,YACE,aAAa;AAAA,YACb,WAAW;AAAA,YACX,WAAW;AAAA,YACX,UAAU;AAAA,UACZ;AAAA,QACF;AAEA,eAAO,KAAK;AAAA,UACV,UAAU,WAAW;AAAA,QACvB;AAAA,MACF;AAAA,IACF,CAAC;AAEH,UAAM,UAAU,oCAAoC,gBAAgB;AACpE,UAAM,cAAc,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACrE,UAAM,4BACJ,KAAK,UAAU,iBAAiB,WAAW,MAC3C,KAAK,UAAU,UAAU,WAAW;AACtC,UAAM,eAAe,iBAAiB,YAAY;AAAA,MAChD,CAAC,SAAS,KAAK,UAAU;AAAA,IAC3B,EAAE;AAEF,QAAI,CAAC,QAAQ;AACX,YAAM,KAAK,QAAQ,+BAA+B,OAAO;AACzD,YAAM,KAAK,QAAQ,oCAAoC;AAAA,QACrD,SAAS,iBAAiB;AAAA,QAC1B,WAAW,iBAAiB;AAAA,QAC5B,cAAc,iBAAiB;AAAA,QAC/B,aAAa,iBAAiB;AAAA,QAC9B,kBAAkB,iBAAiB;AAAA,QACnC;AAAA,QACA,iBAAiB;AAAA,QACjB,iBAAiB,iBAAiB;AAAA,QAClC,aAAa,iBAAiB;AAAA,MAChC,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA,YAAY,UAAU,YAAY;AAAA,MAClC,0BAA0B,eAAe,oBAAoB;AAAA,MAC7D,sBAAsB,iBAAiB;AAAA,MACvC;AAAA,MACA;AAAA,MACA,WAAW,CAAC;AAAA,MACZ,kBAAkB,SAAS,OAAO;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,MAAM,kCAAkC,SAcrC;AACD,QAAI,CAAC,+BAA+B,KAAK,MAAM,EAAE,8BAA8B;AAC7E,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,KAAK,QAAQ,mCAAmC;AACzE,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAM,sBAAsB,SAAS,qBAAqB,KAAK;AAC/D,UAAM,2BAA2B,SAAS;AAE1C,SACG,CAAC,uBAAuB,oBAAoB,WAAW,MACxD,OAAO,6BAA6B,UACpC;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,QAAI,uBAAuB,WAAW,gBAAgB,qBAAqB;AACzE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,QACE,OAAO,6BAA6B,YACpC,WAAW,qBAAqB,0BAChC;AACA,aAAO;AAAA,QACL,SAAS;AAAA,QACT,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,QAAQ;AAAA,MACV;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,KAAK,QAAQ,kCAAkC;AAAA,MACrE,GAAI,sBAAsB,EAAE,oBAAoB,IAAI,CAAC;AAAA,MACrD,GAAI,OAAO,6BAA6B,WACpC,EAAE,yBAAyB,IAC3B,CAAC;AAAA,IACP,CAAC;AACD,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA,kBAAkB,YAAY,WAAW,mBAAmB;AAAA,MAC5D,GAAI,YAAY,CAAC,IAAI,EAAE,QAAQ,gBAAyB;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,sCAAqD;AACzD,QAAI,CAAC,+BAA+B,KAAK,MAAM,EAAE,6BAA8B;AAC/E,QAAI;AACF,YAAM,SAAS,MAAM,KAAK,8BAA8B;AAAA,QACtD,QAAQ;AAAA,QACR,YAAY;AAAA,MACd,CAAC;AACD,UAAI;AAAA,QACF,2CAA2C,OAAO,UAAU;AAAA,MAC9D;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,KAAK,oDAAoD,GAAG,EAAE;AAAA,IACpE;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,yCAAiE;AACrE,QAAI,CAAC,+BAA+B,KAAK,MAAM,EAAE,0BAA2B,QAAO;AACnF,QAAI,CAAC,+BAA+B,KAAK,MAAM,EAAE,6BAA8B,QAAO;AAEtF,UAAM,QAAQ,MAAM,KAAK,QACtB,uCAAuC,EACvC,MAAM,MAAM,IAAI;AACnB,QAAI,CAAC,SAAS,MAAM,oBAAoB,EAAG,QAAO;AAElD,UAAM,MAAM,MAAM,KAAK,QACpB,0BAA0B,EAC1B,MAAM,MAAM,IAAI;AACnB,UAAM,UAAU,MAAM,qCAAqC,KAAK,CAAC,IAAI;AACrE,QAAI,CAAC,QAAS,QAAO;AAErB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,sBAAsB,MAAM,gBAAgB;AAAA,MAC5C,YAAY,MAAM,SAAS;AAAA,MAC3B;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EAEQ,mCAAmC,KAOlC;AACP,QAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AAC/D,UAAM,UAAU,IAAI,KAAK;AACzB,UAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,UAAM,MAAM,QAAQ,YAAY,GAAG;AACnC,QAAI,UAAU,MAAM,QAAQ,MAAM,OAAO,MAAO,QAAO;AAEvD,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,OAAO,MAAM,CAAC,CAAC;AAQvD,UAAI,CAAC,MAAM,QAAQ,QAAQ,OAAO,EAAG,QAAO;AAE5C,YAAM,eAAe,oBAAI,IAAsB;AAAA,QAC7C;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,UAAU,OAAO,QACpB;AAAA,QACC,CAAC,SACC,QACA,OAAO,KAAK,WAAW,YACvB,aAAa,IAAI,KAAK,MAA0B;AAAA,MACpD,EACC,IAAI,CAAC,SAAS;AACb,cAAM,aACJ,KAAK,eAAe,SACpB,KAAK,eAAe,YACpB,KAAK,eAAe,SAChB,KAAK,aACL;AACN,eAAO;AAAA,UACL,QAAQ,KAAK;AAAA,UACb,OACE,OAAO,KAAK,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,IACxD,KAAK,QACL;AAAA,UACN;AAAA,UACA,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,QACpD;AAAA,MACF,CAAC;AAEH,aAAO,EAAE,QAAQ;AAAA,IACnB,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,qCACd,KACA,WAAmB,GACJ;AACf,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO;AAC/D,QAAM,eAAe,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,IAKvB;AAAA,EACF;AACA,MAAI,CAAC,aAAc,QAAO;AAE1B,QAAM,QAAQ,aAAa,CAAC,EACzB,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,CAAC,SAAS,KAAK,WAAW,IAAI,CAAC,EACtC,MAAM,GAAG,KAAK,IAAI,GAAG,KAAK,MAAM,QAAQ,CAAC,CAAC;AAC7C,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,SAAO,MAAM,KAAK,IAAI;AACxB;","names":[]}

package/dist/{chunk-ESF7TRYJ.js → chunk-JWDE7OVJ.js}

@@ -70,6 +70,74 @@ function resolveCreationMemoryCapabilities(config) {
     commitmentLifecycle: config.commitmentLifecycleEnabled
   });
 }
+function resolveNamespaceCapabilities(config) {
+  return Object.freeze({
+    namespaces: config.namespacesEnabled
+  });
+}
+function resolveQmdCapabilities(config) {
+  return Object.freeze({
+    qmd: config.qmdEnabled,
+    qmdTierMigration: config.qmdTierMigrationEnabled,
+    qmdTierAutoBackfill: config.qmdTierAutoBackfillEnabled,
+    qmdAutoEmbed: config.qmdAutoEmbedEnabled,
+    qmdMaintenance: config.qmdMaintenanceEnabled,
+    qmdColdTier: config.qmdColdTierEnabled === true,
+    qmdDaemon: config.qmdDaemonEnabled,
+    qmdTierParityGraph: config.qmdTierParityGraphEnabled,
+    qmdQueryRerank: config.qmdQueryRerankEnabled,
+    qmdIntentHints: config.qmdIntentHintsEnabled,
+    qmdExplain: config.qmdExplainEnabled,
+    qmdAutoUpgrade: config.qmdAutoUpgradeEnabled
+  });
+}
+function resolveIdentityContinuityCapabilities(config) {
+  return Object.freeze({
+    identityContinuity: config.identityContinuityEnabled
+  });
+}
+function resolveLocalLlmCapabilities(config) {
+  return Object.freeze({
+    localLlm: config.localLlmEnabled
+  });
+}
+function resolveSecurityCapabilities(config) {
+  return Object.freeze({
+    trustZones: config.trustZonesEnabled,
+    quarantinePromotion: config.quarantinePromotionEnabled,
+    memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,
+    trustZoneRecall: config.trustZoneRecallEnabled
+  });
+}
+function resolveEvalCapabilities(config) {
+  return Object.freeze({
+    evalHarness: config.evalHarnessEnabled,
+    evalShadowMode: config.evalShadowModeEnabled,
+    benchmarkBaselineSnapshots: config.benchmarkBaselineSnapshotsEnabled,
+    benchmarkDeltaReporter: config.benchmarkDeltaReporterEnabled,
+    memoryRedTeamBench: config.memoryRedTeamBenchEnabled
+  });
+}
+function resolveUtilityLearningCapabilities(config) {
+  return Object.freeze({
+    memoryUtilityLearning: config.memoryUtilityLearningEnabled,
+    promotionByOutcome: config.promotionByOutcomeEnabled
+  });
+}
+function resolveObjectiveStateCapabilities(config) {
+  return Object.freeze({
+    objectiveStateMemory: config.objectiveStateMemoryEnabled,
+    objectiveStateSnapshotWrites: config.objectiveStateSnapshotWritesEnabled,
+    objectiveStateRecall: config.objectiveStateRecallEnabled
+  });
+}
+function resolveCompressionCapabilities(config) {
+  return Object.freeze({
+    compressionGuidelineLearning: config.compressionGuidelineLearningEnabled,
+    compressionGuidelineSemanticRefinement: config.compressionGuidelineSemanticRefinementEnabled,
+    contextCompressionActions: config.contextCompressionActionsEnabled
+  });
+}
 
 export {
   resolveCapabilities,
@@ -77,6 +145,15 @@ export {
   resolveAccessSetupCapabilities,
   resolveMemoryLifecycleCapabilities,
   resolveIndexingCapabilities,
-  resolveCreationMemoryCapabilities
+  resolveCreationMemoryCapabilities,
+  resolveNamespaceCapabilities,
+  resolveQmdCapabilities,
+  resolveIdentityContinuityCapabilities,
+  resolveLocalLlmCapabilities,
+  resolveSecurityCapabilities,
+  resolveEvalCapabilities,
+  resolveUtilityLearningCapabilities,
+  resolveObjectiveStateCapabilities,
+  resolveCompressionCapabilities
 };
-//# sourceMappingURL=chunk-ESF7TRYJ.js.map
+//# sourceMappingURL=chunk-JWDE7OVJ.js.map

package/dist/chunk-JWDE7OVJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/capabilities.ts"],"sourcesContent":["/**\n * CapabilitySet — recall-operation feature gates resolved once, then threaded.\n *\n * Issue #1523 (Phase 1 of epic #1520). Root cause this addresses: 161+\n * scattered `config.<flag>Enabled` reads mean each gate is re-derived at every\n * call site, and reviews keep finding parallel code paths where one branch\n * checks a gate the other forgot (CLAUDE.md rule 39 — the \"gate divergence\"\n * defect class). The fix is to resolve a frozen capability projection ONCE at\n * the top of the recall operation and pass it down explicitly.\n *\n * Scope of THIS module (first migration PR): only the recall-operation-scoped\n * flags below. Flags that are also read in graph construction, writes, CLI, or\n * the summarizer are deliberately deferred to a follow-up so we never leave a\n * single flag half-migrated (some sites on `caps.`, some on `config.`).\n *\n * Field naming: each field is the config flag name with the trailing `Enabled`\n * removed (`recallMmrEnabled` → `recallMmr`).\n *\n * This is plumbing, not a feature — there is deliberately NO `enabled` gate for\n * the CapabilitySet itself (rule 30 governs behavior changes; resolving and\n * threading a capability projection must stay behavior-preserving).\n */\n\nimport type { PluginConfig } from \"./types.js\";\n\n/**\n * Frozen projection of recall-operation feature gates.\n *\n * Every field is `readonly boolean`. The composition that maps a config flag to\n * a capability (including default-when-undefined semantics for optional flags)\n * lives ONLY in {@link resolveCapabilities} — call sites must read the\n * capability, never re-derive it from raw config.\n */\nexport interface CapabilitySet {\n  /** `rerankCacheEnabled` — cache reranker scores across recall passes. */\n  readonly rerankCache: boolean;\n  /** `recallDirectAnswerEnabled` — observation-mode direct-answer tier. */\n  readonly recallDirectAnswer: boolean;\n  /** `recallMemoryWorthFilterEnabled` — Memory-Worth score reweighting. */\n  readonly recallMemoryWorthFilter: boolean;\n  /** `trustScoreEnabled` — unified TrustScore recall stage (issue #1577). */\n  readonly recallTrustScore: boolean;\n  /** `recallMmrEnabled` — maximal-marginal-relevance diversification. */\n  readonly recallMmr: boolean;\n  /** `recallReasoningTraceBoostEnabled` — boost reasoning-trace memories. */\n  readonly recallReasoningTraceBoost: boolean;\n  /** `recallPlannerLlmEnabled` — LLM-backed recall-mode planner. */\n  readonly recallPlannerLlm: boolean;\n  /** `recallPlannerEnabled` — recall-mode planner (heuristic + optional LLM). */\n  readonly recallPlanner: boolean;\n  /** `recallConfidenceGateEnabled` — Synapse-style confidence gate. */\n  readonly recallConfidenceGate: boolean;\n  /** `graphRecallEnabled` — graph-mode recall tier (gates planner graph mode). */\n  readonly graphRecall: boolean;\n  /** `graphAssistInFullModeEnabled` — graph-assist overlay in full mode. */\n  readonly graphAssistInFullMode: boolean;\n  /** `graphExpandedIntentEnabled` — promote broad-intent asks to graph mode. */\n  readonly graphExpandedIntent: boolean;\n  // --- Issue #1566 Cluster C: mixed-operation flags (recall + summarizer/CLI/writes) ---\n  /** `rerankEnabled` — optional LLM reranking of recall candidates. */\n  readonly rerank: boolean;\n  /** `harmonicRetrievalEnabled` — abstraction-node harmonic retrieval tier. */\n  readonly harmonicRetrieval: boolean;\n  /** `parallelRetrievalEnabled` — three-agent parallel retrieval (DirectFact + Contextual + Temporal). */\n  readonly parallelRetrieval: boolean;\n}\n\n/**\n * Resolve the recall-operation {@link CapabilitySet} from parsed config.\n *\n * Call this ONCE per recall operation (at the `recall()` / `recallInternal`\n * entry) and thread the result down. Composition lives here and only here.\n *\n * Session toggles are intentionally not a parameter yet: `session-toggles.ts`\n * is agent-scoped (per session/agent enable-disable of the whole plugin), not\n * flag-scoped — none of the flags projected here have a per-session override,\n * so there is nothing for a toggle argument to compose at this layer.\n */\nexport function resolveCapabilities(config: PluginConfig): CapabilitySet {\n  return Object.freeze({\n    rerankCache: config.rerankCacheEnabled,\n    recallDirectAnswer: config.recallDirectAnswerEnabled,\n    recallMemoryWorthFilter: config.recallMemoryWorthFilterEnabled,\n    // Issue #1577: TrustScore subsumes the Memory Worth multiplier when on;\n    // the orchestrator runs exactly one of the two (mutual exclusion, rule 39).\n    recallTrustScore: config.trustScoreEnabled === true,\n    recallMmr: config.recallMmrEnabled,\n    recallReasoningTraceBoost: config.recallReasoningTraceBoostEnabled,\n    recallPlannerLlm: config.recallPlannerLlmEnabled,\n    recallPlanner: config.recallPlannerEnabled,\n    recallConfidenceGate: config.recallConfidenceGateEnabled,\n    graphRecall: config.graphRecallEnabled,\n    // Optional flags: preserve the exact default-when-undefined semantics the\n    // migrated call sites used (`!== false` = default-on, `=== true` = default-off).\n    graphAssistInFullMode: config.graphAssistInFullModeEnabled !== false,\n    graphExpandedIntent: config.graphExpandedIntentEnabled === true,\n    // Issue #1566 Cluster C: mixed-operation flags resolved once per recall op.\n    rerank: config.rerankEnabled,\n    harmonicRetrieval: config.harmonicRetrievalEnabled,\n    parallelRetrieval: config.parallelRetrievalEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Graph-construction capability set (issue #1566 Cluster A).\n//\n// The recall CapabilitySet above covers flags whose EVERY read site lives on\n// the recall call chain. The five flags below are read on graph-construction,\n// write/extraction, AND recall paths — so they cannot join the recall set\n// without leaving some sites on `caps.` and others on `config.` (the exact\n// divergence #1523 forbade). They get their own projection, resolved at graph\n// build/write entry (and alongside `caps` when recall reads them).\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of graph-construction feature gates.\n *\n * Every field is `readonly boolean`. Composition (including default-when-\n * undefined semantics for the optional `graphWriteSessionAdjacencyEnabled`)\n * lives ONLY in {@link resolveGraphConstructionCapabilities}.\n */\nexport interface GraphConstructionCapabilitySet {\n  /** `entityGraphEnabled` — maintain entity co-reference graph edges. */\n  readonly entityGraph: boolean;\n  /** `timeGraphEnabled` — maintain thread-adjacency graph edges. */\n  readonly timeGraph: boolean;\n  /** `causalGraphEnabled` — maintain causal-language graph edges. */\n  readonly causalGraph: boolean;\n  /** `multiGraphMemoryEnabled` — master switch for multi-graph writes/traversal. */\n  readonly multiGraphMemory: boolean;\n  /** `graphWriteSessionAdjacencyEnabled` — session-adjacency fallback for time edges (default-on). */\n  readonly graphWriteSessionAdjacency: boolean;\n}\n\n/**\n * Resolve the {@link GraphConstructionCapabilitySet} from parsed config.\n *\n * Call this ONCE at graph build/write entry (extraction, recall graph\n * expansion, graph-health/repair) and thread the result down — exactly the\n * pattern {@link resolveCapabilities} established for recall.\n */\nexport type GraphConstructionConfigProjection = Pick<\n  PluginConfig,\n  | \"entityGraphEnabled\"\n  | \"timeGraphEnabled\"\n  | \"causalGraphEnabled\"\n  | \"multiGraphMemoryEnabled\"\n  | \"graphWriteSessionAdjacencyEnabled\"\n>;\n\nexport function resolveGraphConstructionCapabilities(\n  config: GraphConstructionConfigProjection,\n): GraphConstructionCapabilitySet {\n  return Object.freeze({\n    entityGraph: config.entityGraphEnabled,\n    timeGraph: config.timeGraphEnabled,\n    causalGraph: config.causalGraphEnabled,\n    multiGraphMemory: config.multiGraphMemoryEnabled,\n    // Optional flag: preserve the exact default-when-undefined semantics the\n    // migrated call site used (`!== false` = default-on).\n    graphWriteSessionAdjacency: config.graphWriteSessionAdjacencyEnabled !== false,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Access-setup capability set (issue #1566 Cluster B).\n//\n// These two flags gate cross-namespace recall budgeting and anomaly-detection\n// auditing. Resolved once at access-service handler entry (and the operator\n// doctor check) rather than re-derived from raw config at each site.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of access-setup feature gates (issue #1566 Cluster B).\n *\n * Every field is `readonly boolean`. Composition (including the default-off\n * semantics for the optional `recallAuditAnomalyDetectionEnabled`) lives ONLY\n * in {@link resolveAccessSetupCapabilities}.\n */\nexport interface AccessSetupCapabilitySet {\n  /** `recallCrossNamespaceBudgetEnabled` — rolling cross-namespace recall budget. */\n  readonly recallCrossNamespaceBudget: boolean;\n  /** `recallAuditAnomalyDetectionEnabled` — access-audit anomaly detection (default-off). */\n  readonly recallAuditAnomalyDetection: boolean;\n}\n\n/**\n * Resolve the {@link AccessSetupCapabilitySet} from parsed config.\n *\n * Call this ONCE at access-service handler entry and thread the result down.\n */\nexport type AccessSetupConfigProjection = Pick<\n  PluginConfig,\n  \"recallCrossNamespaceBudgetEnabled\" | \"recallAuditAnomalyDetectionEnabled\"\n>;\n\nexport function resolveAccessSetupCapabilities(\n  config: AccessSetupConfigProjection,\n): AccessSetupCapabilitySet {\n  return Object.freeze({\n    recallCrossNamespaceBudget: config.recallCrossNamespaceBudgetEnabled,\n    // Optional/default-off flag: preserve `=== true` semantics.\n    recallAuditAnomalyDetection: config.recallAuditAnomalyDetectionEnabled === true,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Memory-lifecycle capability set (issue #1523 batch 3).\n//\n// The flags below gate memory WRITE/EXTRACTION (extraction judge, scope\n// classification, dedupe, telemetry prefilter), temporal supersession of\n// stored facts, and the lifecycle policy pass (promotion / decay / stale\n// filtering). They are read on the persistExtraction write path, the recall\n// candidate-filter path, and the maintenance / lifecycle-pass path — so, like\n// the graph-construction set above, they get their own projection resolved\n// ONCE at each operation entry that reads them (never re-derived from raw\n// config mid-operation — the gate-divergence defect class #1523 targets).\n//\n// Every field projects from an already-resolved PluginConfig boolean (defaults\n// are applied at the config-parse boundary, rule 36), so the resolver is a\n// pure projection — no `!== false` / `=== true` re-coercion here.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of memory-lifecycle feature gates (issue #1523 batch 3).\n *\n * Resolved once per write / recall-filter / maintenance operation and threaded\n * down. Composition lives ONLY in {@link resolveMemoryLifecycleCapabilities}.\n */\nexport interface MemoryLifecycleCapabilitySet {\n  /** `temporalSupersessionEnabled` — supersede stale structured facts on write, filter on recall. */\n  readonly temporalSupersession: boolean;\n  /** `temporalMemoryTreeEnabled` — temporal-memory-tree build + recall tier. */\n  readonly temporalMemoryTree: boolean;\n  /** `lifecyclePolicyEnabled` — lifecycle promotion / decay metadata pass. */\n  readonly lifecyclePolicy: boolean;\n  /** `lifecycleFilterStaleEnabled` — filter stale-lifecycle memories from recall. */\n  readonly lifecycleFilterStale: boolean;\n  /** `lifecycleMetricsEnabled` — emit lifecycle-pass metrics. */\n  readonly lifecycleMetrics: boolean;\n  /** `extractionScopeClassificationEnabled` — LLM classifies each fact's scope. */\n  readonly extractionScopeClassification: boolean;\n  /** `extractionJudgeEnabled` — LLM-as-judge fact-worthiness gate. */\n  readonly extractionJudge: boolean;\n  /** `extractionDedupeEnabled` — dedupe against recent extractions. */\n  readonly extractionDedupe: boolean;\n  /** `extractionTelemetryPrefilterEnabled` — skip mechanical-telemetry transcripts. */\n  readonly extractionTelemetryPrefilter: boolean;\n  /** `extractionJudgeTelemetryEnabled` — collect judge verdict telemetry. */\n  readonly extractionJudgeTelemetry: boolean;\n  /** `embeddingFallbackEnabled` — semantic-dedup / archive-search embedding fallback. */\n  readonly embeddingFallback: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveMemoryLifecycleCapabilities}.\n */\nexport type MemoryLifecycleConfigProjection = Pick<\n  PluginConfig,\n  | \"temporalSupersessionEnabled\"\n  | \"temporalMemoryTreeEnabled\"\n  | \"lifecyclePolicyEnabled\"\n  | \"lifecycleFilterStaleEnabled\"\n  | \"lifecycleMetricsEnabled\"\n  | \"extractionScopeClassificationEnabled\"\n  | \"extractionJudgeEnabled\"\n  | \"extractionDedupeEnabled\"\n  | \"extractionTelemetryPrefilterEnabled\"\n  | \"extractionJudgeTelemetryEnabled\"\n  | \"embeddingFallbackEnabled\"\n>;\n\n/**\n * Resolve the {@link MemoryLifecycleCapabilitySet} from parsed config.\n *\n * Call this ONCE per write / recall-filter / maintenance operation entry and\n * thread the result down — exactly the pattern {@link resolveCapabilities}\n * established for recall.\n */\nexport function resolveMemoryLifecycleCapabilities(\n  config: MemoryLifecycleConfigProjection,\n): MemoryLifecycleCapabilitySet {\n  return Object.freeze({\n    temporalSupersession: config.temporalSupersessionEnabled,\n    temporalMemoryTree: config.temporalMemoryTreeEnabled,\n    lifecyclePolicy: config.lifecyclePolicyEnabled,\n    lifecycleFilterStale: config.lifecycleFilterStaleEnabled,\n    lifecycleMetrics: config.lifecycleMetricsEnabled,\n    extractionScopeClassification: config.extractionScopeClassificationEnabled,\n    extractionJudge: config.extractionJudgeEnabled,\n    extractionDedupe: config.extractionDedupeEnabled,\n    extractionTelemetryPrefilter: config.extractionTelemetryPrefilterEnabled,\n    extractionJudgeTelemetry: config.extractionJudgeTelemetryEnabled,\n    embeddingFallback: config.embeddingFallbackEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Indexing capability set (issue #1523 batch 4).\n//\n// The flags below gate query-aware indexing (temporal/tag index build +\n// prefilter) and the conversation index (QMD/FAISS backend selection). They\n// are read on the recall path, the extraction/persist path, and the\n// maintenance/invalidation path — so they get their own projection resolved\n// ONCE at each operation entry that reads them.\n//\n// Every field projects from an already-resolved PluginConfig boolean (defaults\n// applied at the parse boundary), so the resolver is a pure projection.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of indexing feature gates (issue #1523 batch 4).\n *\n * Resolved once per recall / extraction / maintenance operation and threaded\n * down. Composition lives ONLY in {@link resolveIndexingCapabilities}.\n */\nexport interface IndexingCapabilitySet {\n  /** `queryAwareIndexingEnabled` — build + use temporal/tag index for recall prefilter. */\n  readonly queryAwareIndexing: boolean;\n  /** `conversationIndexEnabled` — conversation-index backend (QMD / FAISS). */\n  readonly conversationIndex: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveIndexingCapabilities}.\n */\nexport type IndexingConfigProjection = Pick<\n  PluginConfig,\n  \"queryAwareIndexingEnabled\" | \"conversationIndexEnabled\"\n>;\n\n/**\n * Resolve the {@link IndexingCapabilitySet} from parsed config.\n *\n * Call this ONCE per recall / extraction / maintenance operation entry and\n * thread the result down — exactly the pattern {@link resolveCapabilities}\n * established for recall.\n */\nexport function resolveIndexingCapabilities(\n  config: IndexingConfigProjection,\n): IndexingCapabilitySet {\n  return Object.freeze({\n    queryAwareIndexing: config.queryAwareIndexingEnabled,\n    conversationIndex: config.conversationIndexEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Creation-memory capability set (issue #1523 batch 4).\n//\n// The flags below gate the creation-memory subsystem: resume-bundle handoff,\n// commitment ledger, commitment lifecycle, and the master creation-memory\n// switch. They are read on the extraction/persist path, the recall\n// enrichment path, and the CLI command surface — so they get their own\n// projection resolved ONCE at each operation entry that reads them.\n//\n// Every field projects from an already-resolved PluginConfig boolean (defaults\n// applied at the parse boundary), so the resolver is a pure projection.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of creation-memory feature gates (issue #1523 batch 4).\n *\n * Resolved once per creation-memory operation (CLI command, extraction,\n * recall enrichment) and threaded down. Composition lives ONLY in\n * {@link resolveCreationMemoryCapabilities}.\n */\nexport interface CreationMemoryCapabilitySet {\n  /** `creationMemoryEnabled` — master switch for creation-memory subsystem. */\n  readonly creationMemory: boolean;\n  /** `commitmentLedgerEnabled` — commitment-ledger read/write. */\n  readonly commitmentLedger: boolean;\n  /** `resumeBundlesEnabled` — resume-bundle handoff bundles. */\n  readonly resumeBundles: boolean;\n  /** `commitmentLifecycleEnabled` — commitment lifecycle (promotion / decay). */\n  readonly commitmentLifecycle: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveCreationMemoryCapabilities}.\n */\nexport type CreationMemoryConfigProjection = Pick<\n  PluginConfig,\n  | \"creationMemoryEnabled\"\n  | \"commitmentLedgerEnabled\"\n  | \"resumeBundlesEnabled\"\n  | \"commitmentLifecycleEnabled\"\n>;\n\n/**\n * Resolve the {@link CreationMemoryCapabilitySet} from parsed config.\n *\n * Call this ONCE per creation-memory operation entry and thread the result\n * down — exactly the pattern {@link resolveCapabilities} established for\n * recall.\n */\nexport function resolveCreationMemoryCapabilities(\n  config: CreationMemoryConfigProjection,\n): CreationMemoryCapabilitySet {\n  return Object.freeze({\n    creationMemory: config.creationMemoryEnabled,\n    commitmentLedger: config.commitmentLedgerEnabled,\n    resumeBundles: config.resumeBundlesEnabled,\n    commitmentLifecycle: config.commitmentLifecycleEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Namespace capability set (issue #1523 batch 5).\n//\n// `namespacesEnabled` is the single most-scattered config flag in the codebase\n// (101 read sites outside config.ts across 18 files — orchestrator, access-service,\n// namespace modules, maintenance, CLI, admin). It gates whether the multi-namespace\n// system is active at all: every namespace resolution, storage path, recall budget,\n// and maintenance fanout checks it. Like the other projections above it gets its own\n// resolver invoked ONCE per operation entry rather than re-derived at each site.\n//\n// The field is a non-optional boolean in PluginConfig, so no coercion is needed.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of namespace feature gates (issue #1523 batch 5).\n *\n * Every field is `readonly boolean`. Composition lives ONLY in\n * {@link resolveNamespaceCapabilities}.\n */\nexport interface NamespaceCapabilitySet {\n  /** `namespacesEnabled` — multi-namespace system master switch. */\n  readonly namespaces: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveNamespaceCapabilities}.\n */\nexport type NamespaceConfigProjection = Pick<PluginConfig, \"namespacesEnabled\">;\n\n/**\n * Resolve the {@link NamespaceCapabilitySet} from parsed config.\n *\n * Call this ONCE at operation entry and thread the result down. The flag is a\n * non-optional boolean so the projection is a pure pass-through.\n */\nexport function resolveNamespaceCapabilities(\n  config: NamespaceConfigProjection,\n): NamespaceCapabilitySet {\n  return Object.freeze({\n    namespaces: config.namespacesEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// QMD capability set (issue #1523 batch 6).\n//\n// The twelve QMD (query-managed database) flags are the largest remaining\n// scattered cluster after batch 5. They gate every aspect of the tiered\n// memory system: master switch, tier migration, cold tier, daemon, auto-embed,\n// maintenance, query rerank, intent hints, explain, auto-upgrade, and parity\n// graph. Read sites span orchestrator, operator-toolkit, access-service, and\n// search/factory. All flags are non-optional booleans on PluginConfig (defaults\n// resolved at the parse boundary), so the projection is pure pass-through.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of QMD feature gates (issue #1523 batch 6).\n *\n * Every field is `readonly boolean`. Composition lives ONLY in\n * {@link resolveQmdCapabilities}.\n */\nexport interface QmdCapabilitySet {\n  /** `qmdEnabled` — QMD tiered-memory master switch. */\n  readonly qmd: boolean;\n  /** `qmdTierMigrationEnabled` — automatic tier promotion/demotion. */\n  readonly qmdTierMigration: boolean;\n  /** `qmdTierAutoBackfillEnabled` — backfill stale tier entries. */\n  readonly qmdTierAutoBackfill: boolean;\n  /** `qmdAutoEmbedEnabled` — auto-embed documents on write. */\n  readonly qmdAutoEmbed: boolean;\n  /** `qmdMaintenanceEnabled` — QMD maintenance pass runner. */\n  readonly qmdMaintenance: boolean;\n  /** `qmdColdTierEnabled` — cold-tier storage. */\n  readonly qmdColdTier: boolean;\n  /** `qmdDaemonEnabled` — background QMD daemon. */\n  readonly qmdDaemon: boolean;\n  /** `qmdTierParityGraphEnabled` — tier parity graph. */\n  readonly qmdTierParityGraph: boolean;\n  /** `qmdQueryRerankEnabled` — QMD query reranking. */\n  readonly qmdQueryRerank: boolean;\n  /** `qmdIntentHintsEnabled` — QMD intent hint extraction. */\n  readonly qmdIntentHints: boolean;\n  /** `qmdExplainEnabled` — QMD explain output. */\n  readonly qmdExplain: boolean;\n  /** `qmdAutoUpgradeEnabled` — QMD auto-upgrade tiers. */\n  readonly qmdAutoUpgrade: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveQmdCapabilities}.\n */\nexport type QmdConfigProjection = Pick<\n  PluginConfig,\n  | \"qmdEnabled\"\n  | \"qmdTierMigrationEnabled\"\n  | \"qmdTierAutoBackfillEnabled\"\n  | \"qmdAutoEmbedEnabled\"\n  | \"qmdMaintenanceEnabled\"\n  | \"qmdColdTierEnabled\"\n  | \"qmdDaemonEnabled\"\n  | \"qmdTierParityGraphEnabled\"\n  | \"qmdQueryRerankEnabled\"\n  | \"qmdIntentHintsEnabled\"\n  | \"qmdExplainEnabled\"\n  | \"qmdAutoUpgradeEnabled\"\n>;\n\n/**\n * Resolve the {@link QmdCapabilitySet} from parsed config.\n *\n * Call this ONCE at operation entry and thread the result down. Eleven flags\n * are non-optional booleans (pure pass-through); `qmdColdTierEnabled` is\n * optional and coerced with `=== true` (matching the pre-migration call sites).\n */\nexport function resolveQmdCapabilities(config: QmdConfigProjection): QmdCapabilitySet {\n  return Object.freeze({\n    qmd: config.qmdEnabled,\n    qmdTierMigration: config.qmdTierMigrationEnabled,\n    qmdTierAutoBackfill: config.qmdTierAutoBackfillEnabled,\n    qmdAutoEmbed: config.qmdAutoEmbedEnabled,\n    qmdMaintenance: config.qmdMaintenanceEnabled,\n    qmdColdTier: config.qmdColdTierEnabled === true,\n    qmdDaemon: config.qmdDaemonEnabled,\n    qmdTierParityGraph: config.qmdTierParityGraphEnabled,\n    qmdQueryRerank: config.qmdQueryRerankEnabled,\n    qmdIntentHints: config.qmdIntentHintsEnabled,\n    qmdExplain: config.qmdExplainEnabled,\n    qmdAutoUpgrade: config.qmdAutoUpgradeEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Identity-continuity capability set (issue #1523 batch 6).\n//\n// `identityContinuityEnabled` gates the identity/continuity system (agent\n// identity tracking, continuity incident logging). Its 13 read sites span\n// orchestrator, access-service, and CLI. The flag is a non-optional boolean\n// on PluginConfig, so the projection is a pure pass-through.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of identity-continuity feature gates (issue #1523 batch 6).\n */\nexport interface IdentityContinuityCapabilitySet {\n  /** `identityContinuityEnabled` — identity-continuity master switch. */\n  readonly identityContinuity: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveIdentityContinuityCapabilities}.\n */\nexport type IdentityContinuityConfigProjection = Pick<PluginConfig, \"identityContinuityEnabled\">;\n\n/**\n * Resolve the {@link IdentityContinuityCapabilitySet} from parsed config.\n */\nexport function resolveIdentityContinuityCapabilities(\n  config: IdentityContinuityConfigProjection,\n): IdentityContinuityCapabilitySet {\n  return Object.freeze({\n    identityContinuity: config.identityContinuityEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Local-LLM capability set (issue #1523 batch 6).\n//\n// `localLlmEnabled` gates whether a local (on-device) LLM is used for\n// summarization, embedding fallback, extraction, and search. Its 11 read\n// sites span orchestrator, extraction, embedding-fallback, local-llm,\n// search/embed-helper, and summarizer. The flag is a non-optional boolean.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of local-LLM feature gates (issue #1523 batch 6).\n */\nexport interface LocalLlmCapabilitySet {\n  /** `localLlmEnabled` — local (on-device) LLM master switch. */\n  readonly localLlm: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveLocalLlmCapabilities}.\n */\nexport type LocalLlmConfigProjection = Pick<PluginConfig, \"localLlmEnabled\">;\n\n/**\n * Resolve the {@link LocalLlmCapabilitySet} from parsed config.\n */\nexport function resolveLocalLlmCapabilities(\n  config: LocalLlmConfigProjection,\n): LocalLlmCapabilitySet {\n  return Object.freeze({\n    localLlm: config.localLlmEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Security capability set (issue #1523 batch 7).\n//\n// The four security/trust-zone flags gate quarantine promotion, poisoning\n// defense, and trust-zone recall. Read sites span orchestrator, access-service,\n// CLI, and research-status commands. All flags are non-optional booleans on\n// PluginConfig (defaults resolved at the parse boundary), so the projection is\n// a pure pass-through.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of security/trust-zone feature gates (issue #1523 batch 7).\n */\nexport interface SecurityCapabilitySet {\n  /** `trustZonesEnabled` — master switch for trust-zone enforcement. */\n  readonly trustZones: boolean;\n  /** `quarantinePromotionEnabled` — promote quarantined memories after review. */\n  readonly quarantinePromotion: boolean;\n  /** `memoryPoisoningDefenseEnabled` — detect and defend against memory poisoning. */\n  readonly memoryPoisoningDefense: boolean;\n  /** `trustZoneRecallEnabled` — restrict recall to trusted zones. */\n  readonly trustZoneRecall: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveSecurityCapabilities}.\n */\nexport type SecurityConfigProjection = Pick<\n  PluginConfig,\n  \"trustZonesEnabled\" | \"quarantinePromotionEnabled\" | \"memoryPoisoningDefenseEnabled\" | \"trustZoneRecallEnabled\"\n>;\n\n/**\n * Resolve the {@link SecurityCapabilitySet} from parsed config.\n */\nexport function resolveSecurityCapabilities(config: SecurityConfigProjection): SecurityCapabilitySet {\n  return Object.freeze({\n    trustZones: config.trustZonesEnabled,\n    quarantinePromotion: config.quarantinePromotionEnabled,\n    memoryPoisoningDefense: config.memoryPoisoningDefenseEnabled,\n    trustZoneRecall: config.trustZoneRecallEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Eval/benchmark capability set (issue #1523 batch 7).\n//\n// The five eval/benchmark flags gate the evaluation harness, shadow mode,\n// baseline snapshot management, delta reporting, and red-team benchmarking.\n// Read sites span orchestrator, CLI, and operator-toolkit. All flags are\n// non-optional booleans on PluginConfig.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of eval/benchmark feature gates (issue #1523 batch 7).\n */\nexport interface EvalCapabilitySet {\n  /** `evalHarnessEnabled` — master switch for the eval harness. */\n  readonly evalHarness: boolean;\n  /** `evalShadowModeEnabled` — run evaluations in shadow mode. */\n  readonly evalShadowMode: boolean;\n  /** `benchmarkBaselineSnapshotsEnabled` — manage baseline snapshots. */\n  readonly benchmarkBaselineSnapshots: boolean;\n  /** `benchmarkDeltaReporterEnabled` — report benchmark deltas. */\n  readonly benchmarkDeltaReporter: boolean;\n  /** `memoryRedTeamBenchEnabled` — red-team benchmarking of memory. */\n  readonly memoryRedTeamBench: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveEvalCapabilities}.\n */\nexport type EvalConfigProjection = Pick<\n  PluginConfig,\n  \"evalHarnessEnabled\" | \"evalShadowModeEnabled\" | \"benchmarkBaselineSnapshotsEnabled\" | \"benchmarkDeltaReporterEnabled\" | \"memoryRedTeamBenchEnabled\"\n>;\n\n/**\n * Resolve the {@link EvalCapabilitySet} from parsed config.\n */\nexport function resolveEvalCapabilities(config: EvalConfigProjection): EvalCapabilitySet {\n  return Object.freeze({\n    evalHarness: config.evalHarnessEnabled,\n    evalShadowMode: config.evalShadowModeEnabled,\n    benchmarkBaselineSnapshots: config.benchmarkBaselineSnapshotsEnabled,\n    benchmarkDeltaReporter: config.benchmarkDeltaReporterEnabled,\n    memoryRedTeamBench: config.memoryRedTeamBenchEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Utility-learning capability set (issue #1523 batch 7).\n//\n// The two utility-learning flags gate memory utility learning and\n// promotion-by-outcome. Read sites span orchestrator, CLI research-status\n// commands, and maintenance files. Both flags are non-optional booleans.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of utility-learning feature gates (issue #1523 batch 7).\n */\nexport interface UtilityLearningCapabilitySet {\n  /** `memoryUtilityLearningEnabled` — learn memory utility weights from outcomes. */\n  readonly memoryUtilityLearning: boolean;\n  /** `promotionByOutcomeEnabled` — promote memories by outcome tracking. */\n  readonly promotionByOutcome: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveUtilityLearningCapabilities}.\n */\nexport type UtilityLearningConfigProjection = Pick<\n  PluginConfig,\n  \"memoryUtilityLearningEnabled\" | \"promotionByOutcomeEnabled\"\n>;\n\n/**\n * Resolve the {@link UtilityLearningCapabilitySet} from parsed config.\n */\nexport function resolveUtilityLearningCapabilities(config: UtilityLearningConfigProjection): UtilityLearningCapabilitySet {\n  return Object.freeze({\n    memoryUtilityLearning: config.memoryUtilityLearningEnabled,\n    promotionByOutcome: config.promotionByOutcomeEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Objective-state capability set (issue #1523 batch 7).\n//\n// The three objective-state flags gate objective-state memory, snapshot\n// writes, and recall. Read sites span orchestrator, access-service, CLI\n// creation-ledger commands, and research-status commands. All flags are\n// non-optional booleans.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of objective-state feature gates (issue #1523 batch 7).\n */\nexport interface ObjectiveStateCapabilitySet {\n  /** `objectiveStateMemoryEnabled` — store objective-state memories. */\n  readonly objectiveStateMemory: boolean;\n  /** `objectiveStateSnapshotWritesEnabled` — write objective-state snapshots. */\n  readonly objectiveStateSnapshotWrites: boolean;\n  /** `objectiveStateRecallEnabled` — recall objective-state memories. */\n  readonly objectiveStateRecall: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveObjectiveStateCapabilities}.\n */\nexport type ObjectiveStateConfigProjection = Pick<\n  PluginConfig,\n  \"objectiveStateMemoryEnabled\" | \"objectiveStateSnapshotWritesEnabled\" | \"objectiveStateRecallEnabled\"\n>;\n\n/**\n * Resolve the {@link ObjectiveStateCapabilitySet} from parsed config.\n */\nexport function resolveObjectiveStateCapabilities(config: ObjectiveStateConfigProjection): ObjectiveStateCapabilitySet {\n  return Object.freeze({\n    objectiveStateMemory: config.objectiveStateMemoryEnabled,\n    objectiveStateSnapshotWrites: config.objectiveStateSnapshotWritesEnabled,\n    objectiveStateRecall: config.objectiveStateRecallEnabled,\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Compression capability set (issue #1523 batch 7).\n//\n// The three compression flags gate guideline learning, semantic refinement,\n// and context-compression actions. Read sites span orchestrator,\n// access-service, and the compression-guideline coordinator. All flags are\n// non-optional booleans.\n// ---------------------------------------------------------------------------\n\n/**\n * Frozen projection of compression feature gates (issue #1523 batch 7).\n */\nexport interface CompressionCapabilitySet {\n  /** `compressionGuidelineLearningEnabled` — learn compression guidelines. */\n  readonly compressionGuidelineLearning: boolean;\n  /** `compressionGuidelineSemanticRefinementEnabled` — semantically refine guidelines. */\n  readonly compressionGuidelineSemanticRefinement: boolean;\n  /** `contextCompressionActionsEnabled` — apply context-compression actions. */\n  readonly contextCompressionActions: boolean;\n}\n\n/**\n * Config projection consumed by {@link resolveCompressionCapabilities}.\n */\nexport type CompressionConfigProjection = Pick<\n  PluginConfig,\n  \"compressionGuidelineLearningEnabled\" | \"compressionGuidelineSemanticRefinementEnabled\" | \"contextCompressionActionsEnabled\"\n>;\n\n/**\n * Resolve the {@link CompressionCapabilitySet} from parsed config.\n */\nexport function resolveCompressionCapabilities(config: CompressionConfigProjection): CompressionCapabilitySet {\n  return Object.freeze({\n    compressionGuidelineLearning: config.compressionGuidelineLearningEnabled,\n    compressionGuidelineSemanticRefinement: config.compressionGuidelineSemanticRefinementEnabled,\n    contextCompressionActions: config.contextCompressionActionsEnabled,\n  });\n}\n"],"mappings":";AA8EO,SAAS,oBAAoB,QAAqC;AACvE,SAAO,OAAO,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,IACpB,oBAAoB,OAAO;AAAA,IAC3B,yBAAyB,OAAO;AAAA;AAAA;AAAA,IAGhC,kBAAkB,OAAO,sBAAsB;AAAA,IAC/C,WAAW,OAAO;AAAA,IAClB,2BAA2B,OAAO;AAAA,IAClC,kBAAkB,OAAO;AAAA,IACzB,eAAe,OAAO;AAAA,IACtB,sBAAsB,OAAO;AAAA,IAC7B,aAAa,OAAO;AAAA;AAAA;AAAA,IAGpB,uBAAuB,OAAO,iCAAiC;AAAA,IAC/D,qBAAqB,OAAO,+BAA+B;AAAA;AAAA,IAE3D,QAAQ,OAAO;AAAA,IACf,mBAAmB,OAAO;AAAA,IAC1B,mBAAmB,OAAO;AAAA,EAC5B,CAAC;AACH;AAiDO,SAAS,qCACd,QACgC;AAChC,SAAO,OAAO,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,aAAa,OAAO;AAAA,IACpB,kBAAkB,OAAO;AAAA;AAAA;AAAA,IAGzB,4BAA4B,OAAO,sCAAsC;AAAA,EAC3E,CAAC;AACH;AAkCO,SAAS,+BACd,QAC0B;AAC1B,SAAO,OAAO,OAAO;AAAA,IACnB,4BAA4B,OAAO;AAAA;AAAA,IAEnC,6BAA6B,OAAO,uCAAuC;AAAA,EAC7E,CAAC;AACH;AA2EO,SAAS,mCACd,QAC8B;AAC9B,SAAO,OAAO,OAAO;AAAA,IACnB,sBAAsB,OAAO;AAAA,IAC7B,oBAAoB,OAAO;AAAA,IAC3B,iBAAiB,OAAO;AAAA,IACxB,sBAAsB,OAAO;AAAA,IAC7B,kBAAkB,OAAO;AAAA,IACzB,+BAA+B,OAAO;AAAA,IACtC,iBAAiB,OAAO;AAAA,IACxB,kBAAkB,OAAO;AAAA,IACzB,8BAA8B,OAAO;AAAA,IACrC,0BAA0B,OAAO;AAAA,IACjC,mBAAmB,OAAO;AAAA,EAC5B,CAAC;AACH;AA2CO,SAAS,4BACd,QACuB;AACvB,SAAO,OAAO,OAAO;AAAA,IACnB,oBAAoB,OAAO;AAAA,IAC3B,mBAAmB,OAAO;AAAA,EAC5B,CAAC;AACH;AAmDO,SAAS,kCACd,QAC6B;AAC7B,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO;AAAA,IACvB,kBAAkB,OAAO;AAAA,IACzB,eAAe,OAAO;AAAA,IACtB,qBAAqB,OAAO;AAAA,EAC9B,CAAC;AACH;AAqCO,SAAS,6BACd,QACwB;AACxB,SAAO,OAAO,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB,CAAC;AACH;AAyEO,SAAS,uBAAuB,QAA+C;AACpF,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,OAAO;AAAA,IACZ,kBAAkB,OAAO;AAAA,IACzB,qBAAqB,OAAO;AAAA,IAC5B,cAAc,OAAO;AAAA,IACrB,gBAAgB,OAAO;AAAA,IACvB,aAAa,OAAO,uBAAuB;AAAA,IAC3C,WAAW,OAAO;AAAA,IAClB,oBAAoB,OAAO;AAAA,IAC3B,gBAAgB,OAAO;AAAA,IACvB,gBAAgB,OAAO;AAAA,IACvB,YAAY,OAAO;AAAA,IACnB,gBAAgB,OAAO;AAAA,EACzB,CAAC;AACH;AA2BO,SAAS,sCACd,QACiC;AACjC,SAAO,OAAO,OAAO;AAAA,IACnB,oBAAoB,OAAO;AAAA,EAC7B,CAAC;AACH;AA2BO,SAAS,4BACd,QACuB;AACvB,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU,OAAO;AAAA,EACnB,CAAC;AACH;AAqCO,SAAS,4BAA4B,QAAyD;AACnG,SAAO,OAAO,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,IACnB,qBAAqB,OAAO;AAAA,IAC5B,wBAAwB,OAAO;AAAA,IAC/B,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACH;AAsCO,SAAS,wBAAwB,QAAiD;AACvF,SAAO,OAAO,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,IACpB,gBAAgB,OAAO;AAAA,IACvB,4BAA4B,OAAO;AAAA,IACnC,wBAAwB,OAAO;AAAA,IAC/B,oBAAoB,OAAO;AAAA,EAC7B,CAAC;AACH;AA+BO,SAAS,mCAAmC,QAAuE;AACxH,SAAO,OAAO,OAAO;AAAA,IACnB,uBAAuB,OAAO;AAAA,IAC9B,oBAAoB,OAAO;AAAA,EAC7B,CAAC;AACH;AAkCO,SAAS,kCAAkC,QAAqE;AACrH,SAAO,OAAO,OAAO;AAAA,IACnB,sBAAsB,OAAO;AAAA,IAC7B,8BAA8B,OAAO;AAAA,IACrC,sBAAsB,OAAO;AAAA,EAC/B,CAAC;AACH;AAkCO,SAAS,+BAA+B,QAA+D;AAC5G,SAAO,OAAO,OAAO;AAAA,IACnB,8BAA8B,OAAO;AAAA,IACrC,wCAAwC,OAAO;AAAA,IAC/C,2BAA2B,OAAO;AAAA,EACpC,CAAC;AACH;","names":[]}

package/dist/{chunk-GGL34GCW.js → chunk-K3Y2SJTN.js}

@@ -1,9 +1,9 @@
 import {
   NamespaceStorageRouter
-} from "./chunk-ZQUAVZNG.js";
+} from "./chunk-NNJKEAP2.js";
 import {
   namespaceCollectionName
-} from "./chunk-KQYGNGON.js";
+} from "./chunk-ZBZ4XULO.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
@@ -11,6 +11,9 @@ import {
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
+import {
+  resolveNamespaceCapabilities
+} from "./chunk-JWDE7OVJ.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -100,7 +103,7 @@ async function verifyNamespaces(options) {
   };
 }
 async function runNamespaceMigration(options) {
-  if (!options.config.namespacesEnabled) {
+  if (!resolveNamespaceCapabilities(options.config).namespaces) {
     throw new Error("Namespaces are disabled.");
   }
   const targetNamespace = options.to.trim();
@@ -204,4 +207,4 @@ export {
   verifyNamespaces,
   runNamespaceMigration
 };
-//# sourceMappingURL=chunk-GGL34GCW.js.map
+//# sourceMappingURL=chunk-K3Y2SJTN.js.map

package/dist/chunk-K3Y2SJTN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/migrate.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"../capabilities.js\";\nimport path from \"node:path\";\nimport { access, lstat, mkdir, readdir, realpath, rename, rmdir } from \"node:fs/promises\";\nimport type { PluginConfig } from \"../types.js\";\nimport { NamespaceStorageRouter } from \"./storage.js\";\nimport { namespaceCollectionName } from \"./search.js\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { namespaceIdentityFromToken, namespaceIdentityToken } from \"./identity.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\n\nconst LEGACY_NAMESPACE_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"state\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nexport interface NamespaceInventoryEntry {\n  namespace: string;\n  rootDir: string;\n  exists: boolean;\n  usesLegacyRoot: boolean;\n  hasMemoryData: boolean;\n  collection: string;\n}\n\nexport interface NamespaceVerifyReport {\n  ok: boolean;\n  problems: string[];\n  namespaces: NamespaceInventoryEntry[];\n}\n\nexport interface NamespaceMigrationMove {\n  from: string;\n  to: string;\n}\n\nexport interface NamespaceMigrationReport {\n  dryRun: boolean;\n  fromRoot: string;\n  targetRoot: string;\n  moved: NamespaceMigrationMove[];\n  collection: string;\n}\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasAnyLegacyData(rootDir: string): Promise<boolean> {\n  for (const child of LEGACY_NAMESPACE_CHILDREN) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function discoverConfiguredNamespaces(\n  config: PluginConfig,\n): Promise<string[]> {\n  const discovered = new Set<string>([\n    config.defaultNamespace,\n    config.sharedNamespace,\n    ...config.namespacePolicies.map((policy) => policy.name),\n  ]);\n  const configuredNamespaces = new Set(discovered);\n\n  const namespacesDir = path.join(config.memoryDir, \"namespaces\");\n  try {\n    const entries = await readdir(namespacesDir, { withFileTypes: true });\n    for (const entry of entries) {\n      if (!entry.isDirectory()) continue;\n      const namespace = configuredNamespaces.has(entry.name)\n        ? entry.name\n        : namespaceIdentityFromToken(entry.name) ?? entry.name;\n      if (isSafeRouteNamespace(namespace)) {\n        discovered.add(namespace);\n      }\n    }\n  } catch {\n    // No namespace directory yet.\n  }\n\n  return [...discovered];\n}\n\nexport async function listNamespaces(options: {\n  config: PluginConfig;\n  storageRouter?: NamespaceStorageRouter;\n}): Promise<NamespaceInventoryEntry[]> {\n  const storageRouter = options.storageRouter ?? new NamespaceStorageRouter(options.config);\n  const namespaces = await discoverConfiguredNamespaces(options.config);\n  const items = await Promise.all(\n    namespaces.map(async (namespace) => {\n      const storage = await storageRouter.storageFor(namespace);\n      const usesLegacyRoot =\n        namespace === options.config.defaultNamespace &&\n        storage.dir === options.config.memoryDir;\n      return {\n        namespace,\n        rootDir: storage.dir,\n        exists: await exists(storage.dir),\n        usesLegacyRoot,\n        hasMemoryData: await hasAnyLegacyData(storage.dir),\n        collection: namespaceCollectionName(options.config.qmdCollection, namespace, {\n          defaultNamespace: options.config.defaultNamespace,\n          useLegacyDefaultCollection: usesLegacyRoot,\n        }),\n      } satisfies NamespaceInventoryEntry;\n    }),\n  );\n\n  return items.sort((a, b) => a.namespace.localeCompare(b.namespace));\n}\n\nexport async function verifyNamespaces(options: {\n  config: PluginConfig;\n  storageRouter?: NamespaceStorageRouter;\n}): Promise<NamespaceVerifyReport> {\n  const namespaces = await listNamespaces(options);\n  const problems: string[] = [];\n\n  for (const entry of namespaces) {\n    if (entry.exists && !entry.hasMemoryData) {\n      problems.push(`${entry.namespace}: root exists but contains no Engram data`);\n    }\n  }\n\n  return {\n    ok: problems.length === 0,\n    problems,\n    namespaces,\n  };\n}\n\nexport async function runNamespaceMigration(options: {\n  config: PluginConfig;\n  to: string;\n  dryRun?: boolean;\n  renameFn?: typeof rename;\n}): Promise<NamespaceMigrationReport> {\n  if (!resolveNamespaceCapabilities(options.config).namespaces) {\n    throw new Error(\"Namespaces are disabled.\");\n  }\n\n  const targetNamespace = options.to.trim();\n  if (!isSafeRouteNamespace(targetNamespace)) {\n    throw new Error(`Invalid namespace: ${options.to}`);\n  }\n\n  const targetRoot = path.join(\n    options.config.memoryDir,\n    \"namespaces\",\n    namespaceIdentityToken(targetNamespace),\n  );\n  const moved: NamespaceMigrationMove[] = [];\n  const renamePath = options.renameFn ?? rename;\n\n  for (const child of LEGACY_NAMESPACE_CHILDREN) {\n    const from = path.join(options.config.memoryDir, child);\n    if (!(await exists(from))) continue;\n    const to = path.join(targetRoot, child);\n    if (await exists(to)) {\n      throw new Error(`Target already contains ${child}: ${to}`);\n    }\n    const sourceStat = await lstat(from);\n    if (sourceStat.isSymbolicLink()) {\n      throw new Error(`Refusing to migrate symlinked legacy path: ${from}`);\n    }\n    moved.push({ from, to });\n  }\n\n  if (!options.dryRun && moved.length > 0) {\n    await assertSafeNamespaceTarget(options.config.memoryDir, targetRoot);\n    await mkdir(targetRoot, { recursive: true });\n    await assertSafeNamespaceTarget(options.config.memoryDir, targetRoot);\n    const completed: NamespaceMigrationMove[] = [];\n    try {\n      for (const move of moved) {\n        await renamePath(move.from, move.to);\n        completed.push(move);\n      }\n    } catch (cause) {\n      const rollbackErrors: string[] = [];\n      for (const move of completed.reverse()) {\n        try {\n          if (!(await exists(move.from)) && (await exists(move.to))) {\n            await rename(move.to, move.from);\n          }\n        } catch (rollbackCause) {\n          rollbackErrors.push(rollbackCause instanceof Error ? rollbackCause.message : String(rollbackCause));\n        }\n      }\n      try {\n        await rmdir(targetRoot);\n      } catch {\n        // Target may predate migration or still contain unrelated files.\n      }\n      const message = cause instanceof Error ? cause.message : String(cause);\n      throw new Error(\n        `Namespace migration failed and was rolled back: ${message}` +\n          (rollbackErrors.length > 0 ? `; rollback errors: ${rollbackErrors.join(\"; \")}` : \"\"),\n        { cause },\n      );\n    }\n  }\n\n  return {\n    dryRun: options.dryRun === true,\n    fromRoot: options.config.memoryDir,\n    targetRoot,\n    moved,\n    collection: namespaceCollectionName(options.config.qmdCollection, targetNamespace, {\n      defaultNamespace: options.config.defaultNamespace,\n      useLegacyDefaultCollection: false,\n    }),\n  };\n}\n\nasync function assertSafeNamespaceTarget(memoryDir: string, targetRoot: string): Promise<void> {\n  const memoryReal = await realpath(memoryDir);\n  const namespacesDir = path.join(memoryDir, \"namespaces\");\n  if (await exists(namespacesDir)) {\n    const namespacesStat = await lstat(namespacesDir);\n    if (namespacesStat.isSymbolicLink()) {\n      throw new Error(`Refusing to migrate through symlinked namespaces directory: ${namespacesDir}`);\n    }\n    const namespacesReal = await realpath(namespacesDir);\n    if (!isPathInside(memoryReal, namespacesReal)) {\n      throw new Error(`Refusing to migrate through namespaces directory outside memoryDir: ${namespacesDir}`);\n    }\n  }\n  if (await exists(targetRoot)) {\n    const targetStat = await lstat(targetRoot);\n    if (targetStat.isSymbolicLink()) {\n      throw new Error(`Refusing to migrate into symlinked namespace root: ${targetRoot}`);\n    }\n    const targetReal = await realpath(targetRoot);\n    if (!isPathInside(memoryReal, targetReal)) {\n      throw new Error(`Refusing to migrate into namespace root outside memoryDir: ${targetRoot}`);\n    }\n  }\n}\n\nfunction isPathInside(root: string, child: string): boolean {\n  const relative = path.relative(root, child);\n  return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,OAAO,SAAS,UAAU,QAAQ,aAAa;AAQvE,IAAM,4BAA4B;AAAA,EAChC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA8BA,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,SAAmC;AACjE,aAAW,SAAS,2BAA2B;AAC7C,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AAEA,eAAe,6BACb,QACmB;AACnB,QAAM,aAAa,oBAAI,IAAY;AAAA,IACjC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,GAAG,OAAO,kBAAkB,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,EACzD,CAAC;AACD,QAAM,uBAAuB,IAAI,IAAI,UAAU;AAE/C,QAAM,gBAAgB,KAAK,KAAK,OAAO,WAAW,YAAY;AAC9D,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,eAAe,EAAE,eAAe,KAAK,CAAC;AACpE,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,YAAY,qBAAqB,IAAI,MAAM,IAAI,IACjD,MAAM,OACN,2BAA2B,MAAM,IAAI,KAAK,MAAM;AACpD,UAAI,qBAAqB,SAAS,GAAG;AACnC,mBAAW,IAAI,SAAS;AAAA,MAC1B;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,SAAO,CAAC,GAAG,UAAU;AACvB;AAEA,eAAsB,eAAe,SAGE;AACrC,QAAM,gBAAgB,QAAQ,iBAAiB,IAAI,uBAAuB,QAAQ,MAAM;AACxF,QAAM,aAAa,MAAM,6BAA6B,QAAQ,MAAM;AACpE,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,WAAW,IAAI,OAAO,cAAc;AAClC,YAAM,UAAU,MAAM,cAAc,WAAW,SAAS;AACxD,YAAM,iBACJ,cAAc,QAAQ,OAAO,oBAC7B,QAAQ,QAAQ,QAAQ,OAAO;AACjC,aAAO;AAAA,QACL;AAAA,QACA,SAAS,QAAQ;AAAA,QACjB,QAAQ,MAAM,OAAO,QAAQ,GAAG;AAAA,QAChC;AAAA,QACA,eAAe,MAAM,iBAAiB,QAAQ,GAAG;AAAA,QACjD,YAAY,wBAAwB,QAAQ,OAAO,eAAe,WAAW;AAAA,UAC3E,kBAAkB,QAAQ,OAAO;AAAA,UACjC,4BAA4B;AAAA,QAC9B,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,CAAC;AACpE;AAEA,eAAsB,iBAAiB,SAGJ;AACjC,QAAM,aAAa,MAAM,eAAe,OAAO;AAC/C,QAAM,WAAqB,CAAC;AAE5B,aAAW,SAAS,YAAY;AAC9B,QAAI,MAAM,UAAU,CAAC,MAAM,eAAe;AACxC,eAAS,KAAK,GAAG,MAAM,SAAS,2CAA2C;AAAA,IAC7E;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI,SAAS,WAAW;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,sBAAsB,SAKN;AACpC,MAAI,CAAC,6BAA6B,QAAQ,MAAM,EAAE,YAAY;AAC5D,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,kBAAkB,QAAQ,GAAG,KAAK;AACxC,MAAI,CAAC,qBAAqB,eAAe,GAAG;AAC1C,UAAM,IAAI,MAAM,sBAAsB,QAAQ,EAAE,EAAE;AAAA,EACpD;AAEA,QAAM,aAAa,KAAK;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf;AAAA,IACA,uBAAuB,eAAe;AAAA,EACxC;AACA,QAAM,QAAkC,CAAC;AACzC,QAAM,aAAa,QAAQ,YAAY;AAEvC,aAAW,SAAS,2BAA2B;AAC7C,UAAM,OAAO,KAAK,KAAK,QAAQ,OAAO,WAAW,KAAK;AACtD,QAAI,CAAE,MAAM,OAAO,IAAI,EAAI;AAC3B,UAAM,KAAK,KAAK,KAAK,YAAY,KAAK;AACtC,QAAI,MAAM,OAAO,EAAE,GAAG;AACpB,YAAM,IAAI,MAAM,2BAA2B,KAAK,KAAK,EAAE,EAAE;AAAA,IAC3D;AACA,UAAM,aAAa,MAAM,MAAM,IAAI;AACnC,QAAI,WAAW,eAAe,GAAG;AAC/B,YAAM,IAAI,MAAM,8CAA8C,IAAI,EAAE;AAAA,IACtE;AACA,UAAM,KAAK,EAAE,MAAM,GAAG,CAAC;AAAA,EACzB;AAEA,MAAI,CAAC,QAAQ,UAAU,MAAM,SAAS,GAAG;AACvC,UAAM,0BAA0B,QAAQ,OAAO,WAAW,UAAU;AACpE,UAAM,MAAM,YAAY,EAAE,WAAW,KAAK,CAAC;AAC3C,UAAM,0BAA0B,QAAQ,OAAO,WAAW,UAAU;AACpE,UAAM,YAAsC,CAAC;AAC7C,QAAI;AACF,iBAAW,QAAQ,OAAO;AACxB,cAAM,WAAW,KAAK,MAAM,KAAK,EAAE;AACnC,kBAAU,KAAK,IAAI;AAAA,MACrB;AAAA,IACF,SAAS,OAAO;AACd,YAAM,iBAA2B,CAAC;AAClC,iBAAW,QAAQ,UAAU,QAAQ,GAAG;AACtC,YAAI;AACF,cAAI,CAAE,MAAM,OAAO,KAAK,IAAI,KAAO,MAAM,OAAO,KAAK,EAAE,GAAI;AACzD,kBAAM,OAAO,KAAK,IAAI,KAAK,IAAI;AAAA,UACjC;AAAA,QACF,SAAS,eAAe;AACtB,yBAAe,KAAK,yBAAyB,QAAQ,cAAc,UAAU,OAAO,aAAa,CAAC;AAAA,QACpG;AAAA,MACF;AACA,UAAI;AACF,cAAM,MAAM,UAAU;AAAA,MACxB,QAAQ;AAAA,MAER;AACA,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAM,IAAI;AAAA,QACR,mDAAmD,OAAO,MACvD,eAAe,SAAS,IAAI,sBAAsB,eAAe,KAAK,IAAI,CAAC,KAAK;AAAA,QACnF,EAAE,MAAM;AAAA,MACV;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,QAAQ,WAAW;AAAA,IAC3B,UAAU,QAAQ,OAAO;AAAA,IACzB;AAAA,IACA;AAAA,IACA,YAAY,wBAAwB,QAAQ,OAAO,eAAe,iBAAiB;AAAA,MACjF,kBAAkB,QAAQ,OAAO;AAAA,MACjC,4BAA4B;AAAA,IAC9B,CAAC;AAAA,EACH;AACF;AAEA,eAAe,0BAA0B,WAAmB,YAAmC;AAC7F,QAAM,aAAa,MAAM,SAAS,SAAS;AAC3C,QAAM,gBAAgB,KAAK,KAAK,WAAW,YAAY;AACvD,MAAI,MAAM,OAAO,aAAa,GAAG;AAC/B,UAAM,iBAAiB,MAAM,MAAM,aAAa;AAChD,QAAI,eAAe,eAAe,GAAG;AACnC,YAAM,IAAI,MAAM,+DAA+D,aAAa,EAAE;AAAA,IAChG;AACA,UAAM,iBAAiB,MAAM,SAAS,aAAa;AACnD,QAAI,CAAC,aAAa,YAAY,cAAc,GAAG;AAC7C,YAAM,IAAI,MAAM,uEAAuE,aAAa,EAAE;AAAA,IACxG;AAAA,EACF;AACA,MAAI,MAAM,OAAO,UAAU,GAAG;AAC5B,UAAM,aAAa,MAAM,MAAM,UAAU;AACzC,QAAI,WAAW,eAAe,GAAG;AAC/B,YAAM,IAAI,MAAM,sDAAsD,UAAU,EAAE;AAAA,IACpF;AACA,UAAM,aAAa,MAAM,SAAS,UAAU;AAC5C,QAAI,CAAC,aAAa,YAAY,UAAU,GAAG;AACzC,YAAM,IAAI,MAAM,8DAA8D,UAAU,EAAE;AAAA,IAC5F;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAc,OAAwB;AAC1D,QAAM,WAAW,KAAK,SAAS,MAAM,KAAK;AAC1C,SAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;AACpF;","names":[]}

package/dist/{chunk-PMAQRUN4.js → chunk-NDKW67ER.js}

@@ -1,3 +1,6 @@
+import {
+  resolveNamespaceCapabilities
+} from "./chunk-JWDE7OVJ.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -112,7 +115,7 @@ function resolveExplicitCaptureReviewNamespace(orchestrator, namespace) {
 function resolveExplicitCaptureNamespace(orchestrator, namespace) {
   const normalized = asTrimmed(namespace);
   if (!normalized) return void 0;
-  if (!orchestrator.config.namespacesEnabled) {
+  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {
     if (normalized !== orchestrator.config.defaultNamespace) {
       throw new Error(`unsupported namespace: ${normalized}`);
     }
@@ -438,4 +441,4 @@ export {
   shouldSkipImplicitExtraction,
   shouldProcessInlineExplicitCapture
 };
-//# sourceMappingURL=chunk-PMAQRUN4.js.map
+//# sourceMappingURL=chunk-NDKW67ER.js.map

package/dist/chunk-NDKW67ER.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/explicit-capture.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"./capabilities.js\";\nimport { randomUUID } from \"node:crypto\";\nimport type { Orchestrator } from \"./orchestrator.js\";\nimport { isSafeRouteNamespace } from \"./routing/engine.js\";\nimport { sanitizeMemoryContent } from \"./sanitize.js\";\nimport { ContentHashIndex } from \"./storage.js\";\nimport type { CaptureMode, MemoryCategory, MemoryLifecycleEvent, PluginConfig } from \"./types.js\";\n\nexport type ExplicitCaptureInput = {\n  content: string;\n  category?: string;\n  confidence?: number;\n  namespace?: string;\n  tags?: string[];\n  entityRef?: string;\n  ttl?: string;\n  sourceReason?: string;\n};\n\nexport type ValidExplicitCapture = {\n  content: string;\n  category: MemoryCategory;\n  confidence: number;\n  namespace?: string;\n  tags: string[];\n  entityRef?: string;\n  expiresAt?: string;\n  sourceReason?: string;\n  /**\n   * When true, `namespace` was already resolved AND authorized by the caller\n   * (the access service's `resolveCodingScopedWriteNamespace`, which auth-checks\n   * the base and derives a session-owned `project-*` overlay). The persist /\n   * queue layer then routes to it directly instead of re-validating against the\n   * static policy allow-list — which would otherwise reject legitimately-derived\n   * dynamic project namespaces (#1434). Callers that do NOT pre-authorize the\n   * namespace must leave this unset so the allow-list guard still applies.\n   */\n  namespacePreResolved?: boolean;\n};\n\nexport type ExplicitCaptureSource = \"memory_store\" | \"memory_capture\" | \"suggestion_submit\" | \"inline\";\ntype ExplicitCaptureValidationMode = \"legacy_tool\" | \"strict_explicit\";\n\n// Bounded body {0,100000} instead of an unbounded lazy *? so scanning for the\n// closing tag cannot backtrack polynomially on unterminated <memory_note>\n// markup in hostile turn text (CodeQL js/polynomial-redos). 100 000 chars far\n// exceeds any real inline note, so matching is behavior-preserving; the outer\n// \\s* groups were also dropped (body absorbs whitespace; captures are trimmed).\nconst INLINE_NOTE_RE = /<memory_note>([\\s\\S]{0,100000}?)<\\/memory_note>/gi;\nconst INLINE_NOTE_MARKUP_RE = /<memory_note>[\\s\\S]{0,100000}?<\\/memory_note>/i;\nconst INLINE_ALLOWED_CATEGORIES = new Set<MemoryCategory>([\n  \"fact\",\n  \"preference\",\n  \"correction\",\n  \"entity\",\n  \"decision\",\n  \"relationship\",\n  \"principle\",\n  \"commitment\",\n  \"moment\",\n  \"skill\",\n  \"rule\",\n  \"procedure\",\n  \"reasoning_trace\",\n]);\n\nconst SECRET_PATTERNS: RegExp[] = [\n  /\\bsk-[A-Za-z0-9]{16,}\\b/,\n  /\\bAKIA[0-9A-Z]{16}\\b/,\n  /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/i,\n  /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/i,\n  /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/i,\n];\nconst SECRET_REDACTION_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [\n  { pattern: /\\bsk-[A-Za-z0-9]{16,}\\b/g, replacement: \"[redacted openai key]\" },\n  { pattern: /\\bAKIA[0-9A-Z]{16}\\b/g, replacement: \"[redacted aws key]\" },\n  { pattern: /\\bBearer\\s+[A-Za-z0-9._-]{16,}\\b/gi, replacement: \"Bearer [redacted token]\" },\n  {\n    pattern: /\\b(?:api[_-]?key|secret|token|password|passwd)\\s*[:=]\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"[redacted credential]\",\n  },\n  {\n    pattern: /\\b(?:authorization)\\s*:\\s*[^\\s]{8,}\\b/gi,\n    replacement: \"authorization: [redacted credential]\",\n  },\n];\nconst EXPLICIT_CAPTURE_REVIEW_TAGS = [\"explicit-capture\", \"queued-review\"];\n\nfunction explicitCaptureActor(source: ExplicitCaptureSource): string {\n  switch (source) {\n    case \"inline\":\n      return \"inline.memory_note\";\n    case \"memory_store\":\n      return \"tool.memory_store\";\n    case \"suggestion_submit\":\n      return \"tool.suggestion_submit\";\n    default:\n      return \"tool.memory_capture\";\n  }\n}\n\nfunction asTrimmed(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed && trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction normalizeCaptureContent(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/\\s+/g, \" \")\n    .trim();\n}\n\nfunction redactSecrets(value: string): string {\n  let redacted = value;\n  for (const { pattern, replacement } of SECRET_REDACTION_PATTERNS) {\n    redacted = redacted.replace(pattern, replacement);\n  }\n  return redacted;\n}\n\nfunction containsSecretLikeValue(value: string): boolean {\n  return SECRET_PATTERNS.some((pattern) => pattern.test(value));\n}\n\nfunction assertNoSecretLikeMetadata(field: string, value: string | undefined): void {\n  const trimmed = asTrimmed(value);\n  if (trimmed && containsSecretLikeValue(trimmed)) {\n    throw new Error(`${field} appears to contain a secret or credential`);\n  }\n}\n\nfunction assertNoSecretLikeMetadataList(field: string, values: string[] | undefined): void {\n  for (const value of values ?? []) {\n    assertNoSecretLikeMetadata(field, value);\n  }\n}\n\nfunction sanitizeReviewText(value: string | undefined, fallback: string): string {\n  const redacted = redactSecrets(asTrimmed(value) ?? fallback);\n  const sanitized = sanitizeMemoryContent(redacted);\n  const safe = sanitized.text.trim();\n  return safe.length > 0 ? safe : fallback;\n}\n\nfunction sanitizeReviewMetadata(value: string | undefined): string | undefined {\n  const trimmed = asTrimmed(value);\n  if (!trimmed) return undefined;\n  return sanitizeReviewText(trimmed, \"[redacted]\");\n}\n\nfunction sanitizeReviewTags(tags: string[] | undefined): string[] {\n  return Array.from(new Set((tags ?? [])\n    .map((tag) => sanitizeReviewMetadata(tag))\n    .filter((tag): tag is string => typeof tag === \"string\" && tag.length > 0)));\n}\n\nfunction normalizeExplicitCaptureError(error: unknown): string {\n  if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();\n  const rendered = String(error).trim();\n  return rendered.length > 0 ? rendered : \"explicit capture failed\";\n}\n\nfunction resolveExplicitCaptureReviewNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  return resolveExplicitCaptureNamespace(orchestrator, normalized);\n}\n\nfunction resolveExplicitCaptureNamespace(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n): string | undefined {\n  const normalized = asTrimmed(namespace);\n  if (!normalized) return undefined;\n  if (!resolveNamespaceCapabilities(orchestrator.config).namespaces) {\n    if (normalized !== orchestrator.config.defaultNamespace) {\n      throw new Error(`unsupported namespace: ${normalized}`);\n    }\n    return normalized;\n  }\n  const allowed = new Set([\n    orchestrator.config.defaultNamespace,\n    orchestrator.config.sharedNamespace,\n    ...orchestrator.config.namespacePolicies.map((policy) => policy.name),\n  ].map((value) => value.trim()).filter(Boolean));\n  if (!allowed.has(normalized)) {\n    throw new Error(`unsupported namespace: ${normalized}`);\n  }\n  return normalized;\n}\n\nfunction parseExplicitCaptureTtl(ttl: string | undefined): string | undefined {\n  const raw = asTrimmed(ttl);\n  if (!raw) return undefined;\n\n  const absoluteMs = Date.parse(raw);\n  if (Number.isFinite(absoluteMs)) {\n    return new Date(absoluteMs).toISOString();\n  }\n\n  const relative = raw.match(/^(\\d+)\\s*([mhdw])$/i);\n  if (!relative) {\n    throw new Error(\"ttl must be an ISO-8601 timestamp or relative duration like 30m, 12h, 7d, or 2w\");\n  }\n\n  const amount = Number.parseInt(relative[1] ?? \"\", 10);\n  const unit = (relative[2] ?? \"\").toLowerCase();\n  if (!Number.isFinite(amount) || amount <= 0) {\n    throw new Error(\"ttl duration must be a positive integer\");\n  }\n\n  const multiplier =\n    unit === \"m\" ? 60_000\n      : unit === \"h\" ? 60 * 60_000\n        : unit === \"d\" ? 24 * 60 * 60_000\n          : 7 * 24 * 60 * 60_000;\n  return new Date(Date.now() + amount * multiplier).toISOString();\n}\n\nfunction parseInlineConfidence(value: string): number {\n  const trimmed = value.trim();\n  if (!/^[+-]?(?:\\d+(?:\\.\\d*)?|\\.\\d+)(?:e[+-]?\\d+)?$/i.test(trimmed)) {\n    return Number.NaN;\n  }\n  const parsed = Number(trimmed);\n  return Number.isFinite(parsed) ? parsed : Number.NaN;\n}\n\nfunction parseInlineNote(block: string): ExplicitCaptureInput | null {\n  const lines = block.replace(/\\r/g, \"\").split(\"\\n\");\n  const note: Partial<ExplicitCaptureInput> = {};\n  let idx = 0;\n\n  while (idx < lines.length) {\n    const rawLine = lines[idx] ?? \"\";\n    const line = rawLine.trim();\n    idx += 1;\n    if (line.length === 0) continue;\n    const colonIdx = line.indexOf(\":\");\n    if (colonIdx < 0) continue;\n    const key = line.slice(0, colonIdx).trim();\n    const value = line.slice(colonIdx + 1).trim();\n\n    if (key === \"content\" && value === \"|\") {\n      const contentLines: string[] = [];\n      while (idx < lines.length) {\n        const next = lines[idx] ?? \"\";\n        if (next.startsWith(\"  \") || next.startsWith(\"\\t\")) {\n          contentLines.push(next.replace(/^(  |\\t)/, \"\"));\n          idx += 1;\n          continue;\n        }\n        if (next.trim().length === 0) {\n          contentLines.push(\"\");\n          idx += 1;\n          continue;\n        }\n        break;\n      }\n      note.content = contentLines.join(\"\\n\").trim();\n      continue;\n    }\n\n    switch (key) {\n      case \"content\":\n        note.content = value;\n        break;\n      case \"category\":\n        note.category = value;\n        break;\n      case \"confidence\":\n        note.confidence = parseInlineConfidence(value);\n        break;\n      case \"namespace\":\n        note.namespace = value;\n        break;\n      case \"tags\":\n        note.tags = value\n          .split(\",\")\n          .map((entry) => entry.trim())\n          .filter(Boolean);\n        break;\n      case \"entityRef\":\n        note.entityRef = value;\n        break;\n      case \"ttl\":\n        note.ttl = value;\n        break;\n      case \"sourceReason\":\n        note.sourceReason = value;\n        break;\n      default:\n        break;\n    }\n  }\n\n  return asTrimmed(note.content) ? (note as ExplicitCaptureInput) : null;\n}\n\nexport function parseInlineExplicitCaptureNotes(text: string): ExplicitCaptureInput[] {\n  const notes: ExplicitCaptureInput[] = [];\n  for (const match of text.matchAll(INLINE_NOTE_RE)) {\n    const parsed = parseInlineNote(match[1] ?? \"\");\n    if (parsed) notes.push(parsed);\n  }\n  return notes;\n}\n\nexport function hasInlineExplicitCaptureMarkup(text: string): boolean {\n  return INLINE_NOTE_MARKUP_RE.test(text);\n}\n\nexport function stripInlineExplicitCaptureNotes(text: string): string {\n  return text.replace(INLINE_NOTE_RE, \"\").trim();\n}\n\nexport function validateExplicitCaptureInput(\n  input: ExplicitCaptureInput,\n  mode: ExplicitCaptureValidationMode = \"strict_explicit\",\n): ValidExplicitCapture {\n  const content = asTrimmed(input.content);\n  if (!content) throw new Error(\"content is required\");\n  if (mode === \"strict_explicit\") {\n    if (content.length < 10) throw new Error(\"content must be at least 10 characters\");\n    if (content.length > 4000) throw new Error(\"content must be 4000 characters or fewer\");\n  }\n  if (/<memory_note>/i.test(content) || /<\\/memory_note>/i.test(content)) {\n    throw new Error(\"nested memory_note blocks are not allowed\");\n  }\n\n  const category = (asTrimmed(input.category) ?? \"fact\") as MemoryCategory;\n  if (!INLINE_ALLOWED_CATEGORIES.has(category)) {\n    throw new Error(`unsupported category: ${input.category ?? category}`);\n  }\n\n  const sanitized = sanitizeMemoryContent(content);\n  if (!sanitized.clean) {\n    throw new Error(\"content failed memory sanitization\");\n  }\n  for (const pattern of SECRET_PATTERNS) {\n    if (pattern.test(content)) {\n      throw new Error(\"content appears to contain a secret or credential\");\n    }\n  }\n  assertNoSecretLikeMetadata(\"sourceReason\", input.sourceReason);\n  assertNoSecretLikeMetadata(\"entityRef\", input.entityRef);\n  assertNoSecretLikeMetadata(\"ttl\", input.ttl);\n  assertNoSecretLikeMetadataList(\"tags\", input.tags);\n\n  if (input.confidence !== undefined && !Number.isFinite(input.confidence)) {\n    throw new Error(\"confidence must be a finite number\");\n  }\n  const confidence = input.confidence === undefined ? 0.95 : Number(input.confidence);\n  if (confidence < 0 || confidence > 1) {\n    throw new Error(\"confidence must be between 0 and 1\");\n  }\n  const requestedNamespace = asTrimmed(input.namespace);\n  if (requestedNamespace && !isSafeRouteNamespace(requestedNamespace)) {\n    throw new Error(`unsafe namespace: ${requestedNamespace}`);\n  }\n  const expiresAt = parseExplicitCaptureTtl(input.ttl);\n\n  return {\n    content,\n    category,\n    confidence,\n    namespace: asTrimmed(input.namespace),\n    tags: Array.from(new Set((input.tags ?? []).map((tag) => tag.trim()).filter(Boolean))),\n    entityRef: asTrimmed(input.entityRef),\n    expiresAt,\n    sourceReason: asTrimmed(input.sourceReason),\n  };\n}\n\nasync function findDuplicateExplicitCapture(\n  orchestrator: Orchestrator,\n  resolvedNamespace: string | undefined,\n  candidate: ValidExplicitCapture,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  if (\n    candidate.category === \"fact\"\n    && typeof (storage as { hasFactContentHash?: (content: string) => Promise<boolean> }).hasFactContentHash === \"function\"\n  ) {\n    try {\n      const hasHash = await (storage as { hasFactContentHash: (content: string) => Promise<boolean> }).hasFactContentHash(\n        candidate.content,\n      );\n      if (!hasHash) {\n        const authoritative =\n          typeof (storage as { isFactContentHashAuthoritative?: () => Promise<boolean> | boolean }).isFactContentHashAuthoritative\n            === \"function\"\n            ? await (storage as { isFactContentHashAuthoritative: () => Promise<boolean> | boolean })\n              .isFactContentHashAuthoritative()\n            : false;\n        if (authoritative) return null;\n      }\n    } catch (err) {\n      // Fail open: hash index is only an optimization, so fall back to the full corpus scan.\n      void err;\n    }\n  }\n  const existing = await storage.readAllMemories();\n  const normalizedCandidate = normalizeCaptureContent(candidate.content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"active\") return false;\n    if (memory.frontmatter.category !== candidate.category) return false;\n    return normalizeCaptureContent(memory.content) === normalizedCandidate;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function persistExplicitCapture(\n  orchestrator: Orchestrator,\n  candidate: ValidExplicitCapture,\n  source: ExplicitCaptureSource,\n): Promise<{ id: string; duplicateOf?: string; tombstoneBlocked?: boolean }> {\n  const resolvedNamespace = candidate.namespacePreResolved\n    ? asTrimmed(candidate.namespace)\n    : resolveExplicitCaptureNamespace(orchestrator, candidate.namespace);\n  const duplicateOf = await findDuplicateExplicitCapture(orchestrator, resolvedNamespace, candidate);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const storage = await orchestrator.getStorage(resolvedNamespace);\n  // #1645 (review thread yG-): surface the tombstone block so callers\n  // (memory_store tool, access-service HTTP/MCP) can report the capture as\n  // queued for review instead of a successfully stored active memory.\n  const { id, tombstoneBlocked } = await storage.writeMemory(candidate.category, candidate.content, {\n    confidence: candidate.confidence,\n    tags: candidate.tags,\n    entityRef: candidate.entityRef,\n    expiresAt: candidate.expiresAt,\n    source: source === \"inline\" ? \"explicit-inline\" : \"explicit\",\n  });\n  // #1522: catalog touch handled at the storage chokepoint — the StorageManager's\n  // post-write hook records the namespace touch automatically.\n\n  const created = new Date().toISOString();\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_accepted\",\n    timestamp: created,\n    actor: explicitCaptureActor(source),\n    reasonCode: candidate.sourceReason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n\n  return { id, tombstoneBlocked };\n}\n\nfunction buildExplicitCaptureReviewContent(input: ExplicitCaptureInput, reason: string): string {\n  const requestedContent = asTrimmed(input.content);\n  const safeContent = sanitizeReviewText(requestedContent, \"[empty explicit capture]\");\n  const safeCategory = sanitizeReviewMetadata(input.category);\n  const safeNamespace = sanitizeReviewMetadata(input.namespace);\n  const safeEntityRef = sanitizeReviewMetadata(input.entityRef);\n  const safeTtl = sanitizeReviewMetadata(input.ttl);\n  const safeSourceReason = sanitizeReviewMetadata(input.sourceReason);\n  const safeTags = sanitizeReviewTags(input.tags);\n  const lines = [\n    \"Explicit capture queued for review.\",\n    \"\",\n    `Reason: ${reason}`,\n    \"\",\n    \"Submitted content:\",\n    safeContent,\n  ];\n  const metadata = [\n    safeCategory ? `Requested category: ${safeCategory}` : undefined,\n    safeNamespace ? `Requested namespace: ${safeNamespace}` : undefined,\n    safeEntityRef ? `Requested entityRef: ${safeEntityRef}` : undefined,\n    safeTtl ? `Requested ttl: ${safeTtl}` : undefined,\n    safeSourceReason ? `Requested sourceReason: ${safeSourceReason}` : undefined,\n    safeTags.length > 0 ? `Requested tags: ${safeTags.join(\", \")}` : undefined,\n  ].filter((entry): entry is string => typeof entry === \"string\" && entry.length > 0);\n  if (metadata.length > 0) {\n    lines.push(\"\", ...metadata);\n  }\n  return lines.join(\"\\n\");\n}\n\nasync function findQueuedExplicitCaptureDuplicate(\n  orchestrator: Orchestrator,\n  namespace: string | undefined,\n  content: string,\n): Promise<string | null> {\n  const storage = await orchestrator.getStorage(namespace);\n  const existing = await storage.readAllMemories();\n  const normalized = normalizeCaptureContent(content);\n  const match = existing.find((memory) => {\n    const status = memory.frontmatter.status ?? \"active\";\n    if (status !== \"pending_review\") return false;\n    if (!(memory.frontmatter.tags ?? []).includes(\"queued-review\")) return false;\n    return normalizeCaptureContent(memory.content) === normalized;\n  });\n  return match?.frontmatter.id ?? null;\n}\n\nexport async function queueExplicitCaptureForReview(\n  orchestrator: Orchestrator,\n  input: ExplicitCaptureInput,\n  source: ExplicitCaptureSource,\n  error: unknown,\n): Promise<{ id: string; duplicateOf?: string }> {\n  const reason = sanitizeReviewText(normalizeExplicitCaptureError(error), \"explicit capture failed\");\n  const requestedNamespace = asTrimmed(input.namespace);\n  // A caller-pre-authorized namespace (e.g. a session-owned project overlay\n  // from the access service) routes directly; otherwise apply the static\n  // policy allow-list guard (#1434).\n  const queueNamespace = (input as { namespacePreResolved?: boolean }).namespacePreResolved\n    ? requestedNamespace\n    : resolveExplicitCaptureReviewNamespace(orchestrator, requestedNamespace);\n  const content = buildExplicitCaptureReviewContent(input, reason);\n  const duplicateOf = await findQueuedExplicitCaptureDuplicate(orchestrator, queueNamespace, content);\n  if (duplicateOf) {\n    return { id: duplicateOf, duplicateOf };\n  }\n\n  const requestedCategory = asTrimmed(input.category);\n  const reviewCategory = requestedCategory && INLINE_ALLOWED_CATEGORIES.has(requestedCategory as MemoryCategory)\n    ? requestedCategory as MemoryCategory\n    : \"fact\";\n  const requestedTags = sanitizeReviewTags(input.tags);\n  const storage = await orchestrator.getStorage(queueNamespace);\n  const { id: id } = await storage.writeMemory(reviewCategory, content, {\n    confidence: 0.2,\n    tags: Array.from(new Set([...EXPLICIT_CAPTURE_REVIEW_TAGS, ...requestedTags])),\n    entityRef: sanitizeReviewMetadata(input.entityRef),\n    source: source === \"inline\" ? \"explicit-inline-review\" : \"explicit-review\",\n  });\n  try {\n    const created = await storage.getMemoryById(id);\n    if (created) {\n      await storage.writeMemoryFrontmatter(created, {\n        status: \"pending_review\",\n        updated: new Date().toISOString(),\n      }, {\n        actor: explicitCaptureActor(source),\n        reasonCode: reason,\n        ruleVersion: \"explicit-capture.v1\",\n      });\n    }\n  } finally {\n    // Record the catalog write touch (issue #1499, round 5/6 codex P2; NIhUg).\n    // A queued review capture writes memory to the namespace's root (the DEFAULT\n    // root when undefined), so its `lastWriteAt` must reflect the write once\n    // `writeMemory` returns an id. If the later pending-review frontmatter update\n    // fails, the memory file is still durable and must not disappear from\n    // writtenSince/maintenance scheduling. Guarded optional hook (rule #33).\n    // #1522: catalog touch handled at the storage chokepoint.\n  }\n  const event: MemoryLifecycleEvent = {\n    eventId: `mle-${randomUUID()}`,\n    memoryId: id,\n    eventType: \"explicit_capture_queued\",\n    timestamp: new Date().toISOString(),\n    actor: explicitCaptureActor(source),\n    reasonCode: reason,\n    ruleVersion: \"explicit-capture.v1\",\n  };\n  await storage.appendMemoryLifecycleEvents([event]);\n  return { id };\n}\n\nexport function shouldSkipImplicitExtraction(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode === \"explicit\";\n}\n\nexport function shouldProcessInlineExplicitCapture(cfg: Pick<PluginConfig, \"captureMode\">): boolean {\n  return cfg.captureMode !== \"implicit\";\n}\n"],"mappings":";;;;;;;;;;;AACA,SAAS,kBAAkB;AA+C3B,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,oBAAI,IAAoB;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,kBAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,4BAA6E;AAAA,EACjF,EAAE,SAAS,4BAA4B,aAAa,wBAAwB;AAAA,EAC5E,EAAE,SAAS,yBAAyB,aAAa,qBAAqB;AAAA,EACtE,EAAE,SAAS,sCAAsC,aAAa,0BAA0B;AAAA,EACxF;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AACA,IAAM,+BAA+B,CAAC,oBAAoB,eAAe;AAEzE,SAAS,qBAAqB,QAAuC;AACnE,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,SAAS,UAAU,OAA+C;AAChE,QAAM,UAAU,OAAO,KAAK;AAC5B,SAAO,WAAW,QAAQ,SAAS,IAAI,UAAU;AACnD;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MACJ,YAAY,EACZ,QAAQ,QAAQ,GAAG,EACnB,KAAK;AACV;AAEA,SAAS,cAAc,OAAuB;AAC5C,MAAI,WAAW;AACf,aAAW,EAAE,SAAS,YAAY,KAAK,2BAA2B;AAChE,eAAW,SAAS,QAAQ,SAAS,WAAW;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,OAAwB;AACvD,SAAO,gBAAgB,KAAK,CAAC,YAAY,QAAQ,KAAK,KAAK,CAAC;AAC9D;AAEA,SAAS,2BAA2B,OAAe,OAAiC;AAClF,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,WAAW,wBAAwB,OAAO,GAAG;AAC/C,UAAM,IAAI,MAAM,GAAG,KAAK,4CAA4C;AAAA,EACtE;AACF;AAEA,SAAS,+BAA+B,OAAe,QAAoC;AACzF,aAAW,SAAS,UAAU,CAAC,GAAG;AAChC,+BAA2B,OAAO,KAAK;AAAA,EACzC;AACF;AAEA,SAAS,mBAAmB,OAA2B,UAA0B;AAC/E,QAAM,WAAW,cAAc,UAAU,KAAK,KAAK,QAAQ;AAC3D,QAAM,YAAY,sBAAsB,QAAQ;AAChD,QAAM,OAAO,UAAU,KAAK,KAAK;AACjC,SAAO,KAAK,SAAS,IAAI,OAAO;AAClC;AAEA,SAAS,uBAAuB,OAA+C;AAC7E,QAAM,UAAU,UAAU,KAAK;AAC/B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,mBAAmB,SAAS,YAAY;AACjD;AAEA,SAAS,mBAAmB,MAAsC;AAChE,SAAO,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC,GACjC,IAAI,CAAC,QAAQ,uBAAuB,GAAG,CAAC,EACxC,OAAO,CAAC,QAAuB,OAAO,QAAQ,YAAY,IAAI,SAAS,CAAC,CAAC,CAAC;AAC/E;AAEA,SAAS,8BAA8B,OAAwB;AAC7D,MAAI,iBAAiB,SAAS,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,QAAQ,KAAK;AACzF,QAAM,WAAW,OAAO,KAAK,EAAE,KAAK;AACpC,SAAO,SAAS,SAAS,IAAI,WAAW;AAC1C;AAEA,SAAS,sCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,gCAAgC,cAAc,UAAU;AACjE;AAEA,SAAS,gCACP,cACA,WACoB;AACpB,QAAM,aAAa,UAAU,SAAS;AACtC,MAAI,CAAC,WAAY,QAAO;AACxB,MAAI,CAAC,6BAA6B,aAAa,MAAM,EAAE,YAAY;AACjE,QAAI,eAAe,aAAa,OAAO,kBAAkB;AACvD,YAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,IACxD;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU,IAAI,IAAI;AAAA,IACtB,aAAa,OAAO;AAAA,IACpB,aAAa,OAAO;AAAA,IACpB,GAAG,aAAa,OAAO,kBAAkB,IAAI,CAAC,WAAW,OAAO,IAAI;AAAA,EACtE,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;AAC9C,MAAI,CAAC,QAAQ,IAAI,UAAU,GAAG;AAC5B,UAAM,IAAI,MAAM,0BAA0B,UAAU,EAAE;AAAA,EACxD;AACA,SAAO;AACT;AAEA,SAAS,wBAAwB,KAA6C;AAC5E,QAAM,MAAM,UAAU,GAAG;AACzB,MAAI,CAAC,IAAK,QAAO;AAEjB,QAAM,aAAa,KAAK,MAAM,GAAG;AACjC,MAAI,OAAO,SAAS,UAAU,GAAG;AAC/B,WAAO,IAAI,KAAK,UAAU,EAAE,YAAY;AAAA,EAC1C;AAEA,QAAM,WAAW,IAAI,MAAM,qBAAqB;AAChD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,iFAAiF;AAAA,EACnG;AAEA,QAAM,SAAS,OAAO,SAAS,SAAS,CAAC,KAAK,IAAI,EAAE;AACpD,QAAM,QAAQ,SAAS,CAAC,KAAK,IAAI,YAAY;AAC7C,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GAAG;AAC3C,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAEA,QAAM,aACJ,SAAS,MAAM,MACX,SAAS,MAAM,KAAK,MAClB,SAAS,MAAM,KAAK,KAAK,MACvB,IAAI,KAAK,KAAK;AACxB,SAAO,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,UAAU,EAAE,YAAY;AAChE;AAEA,SAAS,sBAAsB,OAAuB;AACpD,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,gDAAgD,KAAK,OAAO,GAAG;AAClE,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,SAAS,OAAO,OAAO;AAC7B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS,OAAO;AACnD;AAEA,SAAS,gBAAgB,OAA4C;AACnE,QAAM,QAAQ,MAAM,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACjD,QAAM,OAAsC,CAAC;AAC7C,MAAI,MAAM;AAEV,SAAO,MAAM,MAAM,QAAQ;AACzB,UAAM,UAAU,MAAM,GAAG,KAAK;AAC9B,UAAM,OAAO,QAAQ,KAAK;AAC1B,WAAO;AACP,QAAI,KAAK,WAAW,EAAG;AACvB,UAAM,WAAW,KAAK,QAAQ,GAAG;AACjC,QAAI,WAAW,EAAG;AAClB,UAAM,MAAM,KAAK,MAAM,GAAG,QAAQ,EAAE,KAAK;AACzC,UAAM,QAAQ,KAAK,MAAM,WAAW,CAAC,EAAE,KAAK;AAE5C,QAAI,QAAQ,aAAa,UAAU,KAAK;AACtC,YAAM,eAAyB,CAAC;AAChC,aAAO,MAAM,MAAM,QAAQ;AACzB,cAAM,OAAO,MAAM,GAAG,KAAK;AAC3B,YAAI,KAAK,WAAW,IAAI,KAAK,KAAK,WAAW,GAAI,GAAG;AAClD,uBAAa,KAAK,KAAK,QAAQ,YAAY,EAAE,CAAC;AAC9C,iBAAO;AACP;AAAA,QACF;AACA,YAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAC5B,uBAAa,KAAK,EAAE;AACpB,iBAAO;AACP;AAAA,QACF;AACA;AAAA,MACF;AACA,WAAK,UAAU,aAAa,KAAK,IAAI,EAAE,KAAK;AAC5C;AAAA,IACF;AAEA,YAAQ,KAAK;AAAA,MACX,KAAK;AACH,aAAK,UAAU;AACf;AAAA,MACF,KAAK;AACH,aAAK,WAAW;AAChB;AAAA,MACF,KAAK;AACH,aAAK,aAAa,sBAAsB,KAAK;AAC7C;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,OAAO,MACT,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACjB;AAAA,MACF,KAAK;AACH,aAAK,YAAY;AACjB;AAAA,MACF,KAAK;AACH,aAAK,MAAM;AACX;AAAA,MACF,KAAK;AACH,aAAK,eAAe;AACpB;AAAA,MACF;AACE;AAAA,IACJ;AAAA,EACF;AAEA,SAAO,UAAU,KAAK,OAAO,IAAK,OAAgC;AACpE;AAEO,SAAS,gCAAgC,MAAsC;AACpF,QAAM,QAAgC,CAAC;AACvC,aAAW,SAAS,KAAK,SAAS,cAAc,GAAG;AACjD,UAAM,SAAS,gBAAgB,MAAM,CAAC,KAAK,EAAE;AAC7C,QAAI,OAAQ,OAAM,KAAK,MAAM;AAAA,EAC/B;AACA,SAAO;AACT;AAEO,SAAS,+BAA+B,MAAuB;AACpE,SAAO,sBAAsB,KAAK,IAAI;AACxC;AAEO,SAAS,gCAAgC,MAAsB;AACpE,SAAO,KAAK,QAAQ,gBAAgB,EAAE,EAAE,KAAK;AAC/C;AAEO,SAAS,6BACd,OACA,OAAsC,mBAChB;AACtB,QAAM,UAAU,UAAU,MAAM,OAAO;AACvC,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,qBAAqB;AACnD,MAAI,SAAS,mBAAmB;AAC9B,QAAI,QAAQ,SAAS,GAAI,OAAM,IAAI,MAAM,wCAAwC;AACjF,QAAI,QAAQ,SAAS,IAAM,OAAM,IAAI,MAAM,0CAA0C;AAAA,EACvF;AACA,MAAI,iBAAiB,KAAK,OAAO,KAAK,mBAAmB,KAAK,OAAO,GAAG;AACtE,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,WAAY,UAAU,MAAM,QAAQ,KAAK;AAC/C,MAAI,CAAC,0BAA0B,IAAI,QAAQ,GAAG;AAC5C,UAAM,IAAI,MAAM,yBAAyB,MAAM,YAAY,QAAQ,EAAE;AAAA,EACvE;AAEA,QAAM,YAAY,sBAAsB,OAAO;AAC/C,MAAI,CAAC,UAAU,OAAO;AACpB,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,aAAW,WAAW,iBAAiB;AACrC,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF;AACA,6BAA2B,gBAAgB,MAAM,YAAY;AAC7D,6BAA2B,aAAa,MAAM,SAAS;AACvD,6BAA2B,OAAO,MAAM,GAAG;AAC3C,iCAA+B,QAAQ,MAAM,IAAI;AAEjD,MAAI,MAAM,eAAe,UAAa,CAAC,OAAO,SAAS,MAAM,UAAU,GAAG;AACxE,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,aAAa,MAAM,eAAe,SAAY,OAAO,OAAO,MAAM,UAAU;AAClF,MAAI,aAAa,KAAK,aAAa,GAAG;AACpC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AACA,QAAM,qBAAqB,UAAU,MAAM,SAAS;AACpD,MAAI,sBAAsB,CAAC,qBAAqB,kBAAkB,GAAG;AACnE,UAAM,IAAI,MAAM,qBAAqB,kBAAkB,EAAE;AAAA,EAC3D;AACA,QAAM,YAAY,wBAAwB,MAAM,GAAG;AAEnD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC,MAAM,MAAM,KAAK,IAAI,KAAK,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,CAAC;AAAA,IACrF,WAAW,UAAU,MAAM,SAAS;AAAA,IACpC;AAAA,IACA,cAAc,UAAU,MAAM,YAAY;AAAA,EAC5C;AACF;AAEA,eAAe,6BACb,cACA,mBACA,WACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAC/D,MACE,UAAU,aAAa,UACpB,OAAQ,QAA2E,uBAAuB,YAC7G;AACA,QAAI;AACF,YAAM,UAAU,MAAO,QAA0E;AAAA,QAC/F,UAAU;AAAA,MACZ;AACA,UAAI,CAAC,SAAS;AACZ,cAAM,gBACJ,OAAQ,QAAkF,mCACpF,aACF,MAAO,QACN,+BAA+B,IAChC;AACN,YAAI,cAAe,QAAO;AAAA,MAC5B;AAAA,IACF,SAAS,KAAK;AAEZ,WAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,sBAAsB,wBAAwB,UAAU,OAAO;AACrE,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,SAAU,QAAO;AAChC,QAAI,OAAO,YAAY,aAAa,UAAU,SAAU,QAAO;AAC/D,WAAO,wBAAwB,OAAO,OAAO,MAAM;AAAA,EACrD,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,uBACpB,cACA,WACA,QAC2E;AAC3E,QAAM,oBAAoB,UAAU,uBAChC,UAAU,UAAU,SAAS,IAC7B,gCAAgC,cAAc,UAAU,SAAS;AACrE,QAAM,cAAc,MAAM,6BAA6B,cAAc,mBAAmB,SAAS;AACjG,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,UAAU,MAAM,aAAa,WAAW,iBAAiB;AAI/D,QAAM,EAAE,IAAI,iBAAiB,IAAI,MAAM,QAAQ,YAAY,UAAU,UAAU,UAAU,SAAS;AAAA,IAChG,YAAY,UAAU;AAAA,IACtB,MAAM,UAAU;AAAA,IAChB,WAAW,UAAU;AAAA,IACrB,WAAW,UAAU;AAAA,IACrB,QAAQ,WAAW,WAAW,oBAAoB;AAAA,EACpD,CAAC;AAID,QAAM,WAAU,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,WAAW;AAAA,IACX,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY,UAAU;AAAA,IACtB,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AAEjD,SAAO,EAAE,IAAI,iBAAiB;AAChC;AAEA,SAAS,kCAAkC,OAA6B,QAAwB;AAC9F,QAAM,mBAAmB,UAAU,MAAM,OAAO;AAChD,QAAM,cAAc,mBAAmB,kBAAkB,0BAA0B;AACnF,QAAM,eAAe,uBAAuB,MAAM,QAAQ;AAC1D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,gBAAgB,uBAAuB,MAAM,SAAS;AAC5D,QAAM,UAAU,uBAAuB,MAAM,GAAG;AAChD,QAAM,mBAAmB,uBAAuB,MAAM,YAAY;AAClE,QAAM,WAAW,mBAAmB,MAAM,IAAI;AAC9C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA,WAAW,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,eAAe,uBAAuB,YAAY,KAAK;AAAA,IACvD,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,gBAAgB,wBAAwB,aAAa,KAAK;AAAA,IAC1D,UAAU,kBAAkB,OAAO,KAAK;AAAA,IACxC,mBAAmB,2BAA2B,gBAAgB,KAAK;AAAA,IACnE,SAAS,SAAS,IAAI,mBAAmB,SAAS,KAAK,IAAI,CAAC,KAAK;AAAA,EACnE,EAAE,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAClF,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,KAAK,IAAI,GAAG,QAAQ;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,IAAI;AACxB;AAEA,eAAe,mCACb,cACA,WACA,SACwB;AACxB,QAAM,UAAU,MAAM,aAAa,WAAW,SAAS;AACvD,QAAM,WAAW,MAAM,QAAQ,gBAAgB;AAC/C,QAAM,aAAa,wBAAwB,OAAO;AAClD,QAAM,QAAQ,SAAS,KAAK,CAAC,WAAW;AACtC,UAAM,SAAS,OAAO,YAAY,UAAU;AAC5C,QAAI,WAAW,iBAAkB,QAAO;AACxC,QAAI,EAAE,OAAO,YAAY,QAAQ,CAAC,GAAG,SAAS,eAAe,EAAG,QAAO;AACvE,WAAO,wBAAwB,OAAO,OAAO,MAAM;AAAA,EACrD,CAAC;AACD,SAAO,OAAO,YAAY,MAAM;AAClC;AAEA,eAAsB,8BACpB,cACA,OACA,QACA,OAC+C;AAC/C,QAAM,SAAS,mBAAmB,8BAA8B,KAAK,GAAG,yBAAyB;AACjG,QAAM,qBAAqB,UAAU,MAAM,SAAS;AAIpD,QAAM,iBAAkB,MAA6C,uBACjE,qBACA,sCAAsC,cAAc,kBAAkB;AAC1E,QAAM,UAAU,kCAAkC,OAAO,MAAM;AAC/D,QAAM,cAAc,MAAM,mCAAmC,cAAc,gBAAgB,OAAO;AAClG,MAAI,aAAa;AACf,WAAO,EAAE,IAAI,aAAa,YAAY;AAAA,EACxC;AAEA,QAAM,oBAAoB,UAAU,MAAM,QAAQ;AAClD,QAAM,iBAAiB,qBAAqB,0BAA0B,IAAI,iBAAmC,IACzG,oBACA;AACJ,QAAM,gBAAgB,mBAAmB,MAAM,IAAI;AACnD,QAAM,UAAU,MAAM,aAAa,WAAW,cAAc;AAC5D,QAAM,EAAE,GAAO,IAAI,MAAM,QAAQ,YAAY,gBAAgB,SAAS;AAAA,IACpE,YAAY;AAAA,IACZ,MAAM,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,8BAA8B,GAAG,aAAa,CAAC,CAAC;AAAA,IAC7E,WAAW,uBAAuB,MAAM,SAAS;AAAA,IACjD,QAAQ,WAAW,WAAW,2BAA2B;AAAA,EAC3D,CAAC;AACD,MAAI;AACF,UAAM,UAAU,MAAM,QAAQ,cAAc,EAAE;AAC9C,QAAI,SAAS;AACX,YAAM,QAAQ,uBAAuB,SAAS;AAAA,QAC5C,QAAQ;AAAA,QACR,UAAS,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,GAAG;AAAA,QACD,OAAO,qBAAqB,MAAM;AAAA,QAClC,YAAY;AAAA,QACZ,aAAa;AAAA,MACf,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AAAA,EAQF;AACA,QAAM,QAA8B;AAAA,IAClC,SAAS,OAAO,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,WAAW;AAAA,IACX,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,qBAAqB,MAAM;AAAA,IAClC,YAAY;AAAA,IACZ,aAAa;AAAA,EACf;AACA,QAAM,QAAQ,4BAA4B,CAAC,KAAK,CAAC;AACjD,SAAO,EAAE,GAAG;AACd;AAEO,SAAS,6BAA6B,KAAiD;AAC5F,SAAO,IAAI,gBAAgB;AAC7B;AAEO,SAAS,mCAAmC,KAAiD;AAClG,SAAO,IAAI,gBAAgB;AAC7B;","names":[]}

package/dist/{chunk-ZQUAVZNG.js → chunk-NNJKEAP2.js}

@@ -11,6 +11,9 @@ import {
 import {
   ALL_CATEGORY_DIRS
 } from "./chunk-VS2IYZRU.js";
+import {
+  resolveNamespaceCapabilities
+} from "./chunk-JWDE7OVJ.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -73,7 +76,7 @@ async function hasAnyNamespaceStorageMarker(rootDir, options = {}) {
   return false;
 }
 async function resolveDefaultNamespaceRoot(config) {
-  if (!config.namespacesEnabled) {
+  if (!resolveNamespaceCapabilities(config).namespaces) {
     return config.memoryDir;
   }
   const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
@@ -87,7 +90,7 @@ async function resolveDefaultNamespaceRoot(config) {
   return await exists(nsDir) && !await hasAnyLegacyData(config.memoryDir) ? nsDir : config.memoryDir;
 }
 async function resolveNamespaceStorageRoot(config, namespace) {
-  if (!config.namespacesEnabled) return config.memoryDir;
+  if (!resolveNamespaceCapabilities(config).namespaces) return config.memoryDir;
   if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {
     return resolveDefaultNamespaceRoot(config);
   }
@@ -150,7 +153,7 @@ var NamespaceStorageRouter = class {
     return this.defaultNsRootResolved;
   }
   async namespaceRoot(namespace) {
-    if (!this.config.namespacesEnabled) return this.config.memoryDir;
+    if (!resolveNamespaceCapabilities(this.config).namespaces) return this.config.memoryDir;
     if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {
       return this.defaultNsRootResolved ?? this.config.memoryDir;
     }
@@ -336,4 +339,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-ZQUAVZNG.js.map
+//# sourceMappingURL=chunk-NNJKEAP2.js.map

package/dist/chunk-NNJKEAP2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/storage.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"../capabilities.js\";\nimport path from \"node:path\";\nimport { access, lstat, readdir } from \"node:fs/promises\";\nimport { isSafeRouteNamespace } from \"../routing/engine.js\";\nimport { StorageManager } from \"../storage.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { ALL_CATEGORY_DIRS } from \"../utils/category-dir.js\";\nimport { namespaceIdentityToken, normalizeNamespaceIdentity } from \"./identity.js\";\nimport type { NamespaceCatalog } from \"./catalog.js\";\nimport { MutationSerializer } from \"../utils/serialize-mutations.js\";\n\nasync function exists(p: string): Promise<boolean> {\n  try {\n    await access(p);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nasync function hasStoredEntries(p: string): Promise<boolean> {\n  try {\n    const entry = await lstat(p);\n    if (entry.isSymbolicLink()) return true;\n    if (!entry.isDirectory()) return true;\n    const children = await readdir(p, { withFileTypes: true });\n    for (const child of children) {\n      const childPath = path.join(p, child.name);\n      if (child.isSymbolicLink() || child.isFile()) return true;\n      if (child.isDirectory() && (await hasStoredEntries(childPath))) return true;\n    }\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// Build a per-namespace directory under `<memoryDir>/namespaces` and assert the\n// resolved path stays inside that base. Namespace identifiers can originate from\n// operator config (config.defaultNamespace) and request-derived routing, so this\n// containment check prevents directory traversal (CodeQL js/path-injection).\n// For safe segments this returns exactly `path.join(base, segment)`, so there is\n// no behavioral change for valid namespaces.\nfunction resolveNamespaceDir(memoryDir: string, segment: string): string {\n  // Mirror isSafeRouteNamespace's separator/parent-ref rejection (without its\n  // 64-char cap, so identity tokens still pass). Rejecting separators and \"..\"\n  // up front keeps the value a single contained child of <memoryDir>/namespaces.\n  if (\n    segment.length === 0 ||\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"..\") ||\n    path.isAbsolute(segment)\n  ) {\n    throw new Error(`unsafe namespace path segment: ${segment}`);\n  }\n  return path.join(memoryDir, \"namespaces\", segment);\n}\n\nconst LEGACY_NAMESPACE_CONTENT_CHILDREN = [\n  ...ALL_CATEGORY_DIRS,\n  \"entities\",\n  \"artifacts\",\n  \"identity\",\n  \"config\",\n  \"summaries\",\n  \"profile.md\",\n] as const;\n\nconst LEGACY_NAMESPACE_RUNTIME_CHILDREN = [\"state\"] as const;\n\nasync function hasAnyLegacyData(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await hasStoredEntries(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\nasync function hasAnyNamespaceStorageMarker(\n  rootDir: string,\n  options: { includeRuntimeState?: boolean } = {},\n): Promise<boolean> {\n  const children = options.includeRuntimeState === true\n    ? [...LEGACY_NAMESPACE_CONTENT_CHILDREN, ...LEGACY_NAMESPACE_RUNTIME_CHILDREN]\n    : LEGACY_NAMESPACE_CONTENT_CHILDREN;\n  for (const child of children) {\n    if (await exists(path.join(rootDir, child))) return true;\n  }\n  return false;\n}\n\n/**\n * Storage routing for namespaces.\n *\n * Compatibility note:\n * - When namespaces are enabled, existing raw namespace roots are preserved.\n *   New namespace roots use tokenized names under `memoryDir/namespaces/<token>`.\n * - The default namespace continues to use the legacy `memoryDir` root unless the caller\n *   has created `memoryDir/namespaces/<defaultNamespace>` (in which case we use that).\n *\n * This avoids surprising \"lost memories\" when an install flips namespaces on without\n * migrating existing data.\n */\n/**\n * Optional hooks for the storage router. `onResolve` fires whenever a namespace's\n * storage is resolved/created, so a downstream consumer (e.g. the namespace\n * catalog, issue #1499) can register the namespace. The hook MUST NOT throw into\n * the router; the router invokes it defensively and a hook failure never affects\n * storage resolution.\n *\n * The hook MAY return (or resolve to) a boolean indicating whether the\n * registration actually PERSISTED (round 6, codex P2 — NEFoX). When it resolves\n * to `false` (a dropped/no-op registration), the router does NOT mark the\n * (namespace, storageDir) pair as notified, so the next resolve RETRIES it\n * instead of suppressing it forever. A `void`/`undefined` result is treated as\n * success (legacy hooks).\n */\nexport interface NamespaceStorageRouterHooks {\n  onResolve?: (\n    namespace: string,\n    storageDir: string,\n  ) => void | boolean | Promise<void | boolean>;\n}\n\n/**\n * Resolve the runtime storage root for the configured DEFAULT namespace.\n *\n * Shared between the live router (`NamespaceStorageRouter.defaultNamespaceRoot`)\n * and the rebuildable catalog (`NamespaceCatalog.rebuildFromDisk`) so the two\n * can never diverge (CLAUDE.md rule #22/#42 — read & write paths resolve through\n * the same logic). The contract is: while legacy memory data still lives\n * directly under `memoryDir`, the default root stays `memoryDir`; only once the\n * legacy root is empty and a `namespaces/<default|token>` dir holds data does\n * the default migrate into that tokenized/legacy-named dir.\n */\nexport async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise<string> {\n  if (!resolveNamespaceCapabilities(config).namespaces) {\n    return config.memoryDir;\n  }\n\n  // Build the legacy default root from the NORMALIZED (trimmed) name so a\n  // whitespace-padded `defaultNamespace` still finds the live `namespaces/default`\n  // root (NIabe). `storageFor()` classifies the trimmed value as the default, and\n  // the on-disk legacy dir is created under the trimmed name; using the raw spaced\n  // name here would look for `namespaces/<spaced>` and miss the real root, falling\n  // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes\n  // internally, so the tokenized path is unaffected.\n  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);\n  const tokenizedNsDir = resolveNamespaceDir(\n    config.memoryDir,\n    namespaceIdentityToken(config.defaultNamespace),\n  );\n  const tokenizedHasData =\n    (await exists(tokenizedNsDir)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));\n  const nsDir = tokenizedHasData\n    ? tokenizedNsDir\n    : (await exists(legacyNsDir))\n      ? legacyNsDir\n      : tokenizedNsDir;\n  return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))\n    ? nsDir\n    : config.memoryDir;\n}\n\n/**\n * Resolve the runtime storage root for ANY namespace exactly as the live router\n * would (`NamespaceStorageRouter.namespaceRoot`). Shared so the rebuildable\n * catalog records the SAME on-disk root the router routes to — a recall/read\n * touch must not guess `namespaces/<token>` when the router actually serves a\n * legacy raw-name dir or a migrated default root (CLAUDE.md rule #22/#42; round\n * 4, cursor Medium). The default namespace delegates to `resolveDefaultNamespaceRoot`;\n * every other namespace prefers the tokenized root when it has a storage marker,\n * else a legacy raw-name dir when present, else the tokenized root.\n */\nexport async function resolveNamespaceStorageRoot(\n  config: PluginConfig,\n  namespace: string,\n): Promise<string> {\n  if (!resolveNamespaceCapabilities(config).namespaces) return config.memoryDir;\n  // Compare on NORMALIZED identity so a whitespace-padded configured default name\n  // still routes to the default root rather than a tokenized non-default dir\n  // (NH-FH). The catalog keys records by the same normalized identity.\n  if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {\n    return resolveDefaultNamespaceRoot(config);\n  }\n  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);\n  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));\n  if (\n    (await exists(tokenizedRoot)) &&\n    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))\n  ) {\n    return tokenizedRoot;\n  }\n  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;\n}\n\nexport class NamespaceStorageRouter {\n  private readonly cache = new Map<string, StorageManager>();\n  private defaultNsRootResolved: string | null = null;\n  // Dedup the resolve hook (round 6, cursor Medium — NCNL2). Recall/extraction\n  // call `storageFor` repeatedly; firing `onResolve` (→ catalog loadCompacted +\n  // append) on every cache hit grows `namespaces.jsonl` without bound between\n  // rebuilds. We fire the hook only when the (namespace, storageDir) pair is new\n  // or its dir changed, so a steady-state cache hit is a no-op for the catalog.\n  private readonly notifiedResolved = new Map<string, string>();\n  // Instance-scoped serializer for the resolve hook (issue #1524 adoption).\n  // Replaces the bespoke `inFlightResolved` marker-then-clear pattern: the\n  // serializer's per-key chain strictly orders concurrent notifications for the\n  // SAME namespace, and the task re-checks `notifiedResolved` once it runs, so a\n  // burst of cache hits before the first hook settles collapses to a single\n  // hook invocation (the once-per-namespace intent). Recovery is preserved —\n  // one rejected hook never poisons subsequent notifications for that key.\n  private readonly resolveSerializer = new MutationSerializer();\n  // (namespace, storageDir) pairs whose resolve hook is currently pending. Set SYNCHRONOUSLY in\n  // notifyResolved (before queueing) so a burst of concurrent storageFor()\n  // cache hits collapses onto the one in-flight hook instead of each enqueuing\n  // its own task. Cleared when the queued hook settles. Without this, a dropped\n  // hook (returns false on a rebuild-lock timeout) leaves notifiedResolved\n  // unset, so every queued sibling task would re-run the hook — N serial lock\n  // waits (cursor Medium 06f58a7c, codex P2).\n  private readonly inFlightResolveHooks = new Set<string>();\n  // Tracks every in-flight resolve-hook promise so callers can deterministically\n  // await the fire-and-forget registrations that `storageFor()` kicks off (see\n  // `whenResolveHooksSettled`). Entries are removed as each hook settles, so the\n  // set holds at most one promise per concurrently-resolving namespace.\n  private readonly pendingResolveHooks = new Set<Promise<unknown>>();\n  // Pending post-write catalog touch promises (#1522). Like pendingResolveHooks,\n  // lets tests await fire-and-forget write touches deterministically.\n  private readonly pendingWriteTouches = new Set<Promise<unknown>>();\n\n  // Normalized (trimmed) default namespace identity (NH-FH). `storageFor`\n  // normalizes its input, so default-namespace branches must compare against the\n  // normalized config default too — otherwise a whitespace-padded configured\n  // default name routes the default namespace to a tokenized non-default root.\n  private readonly defaultNamespaceIdentity: string;\n\n  constructor(\n    private readonly config: PluginConfig,\n    private readonly hooks: NamespaceStorageRouterHooks = {},\n    /** Catalog reference for post-write/read touches (issue #1522 chokepoint). */\n    private readonly catalog?: NamespaceCatalog,\n  ) {\n    this.defaultNamespaceIdentity = normalizeNamespaceIdentity(config.defaultNamespace);\n  }\n\n  private async defaultNamespaceRoot(): Promise<string> {\n    this.defaultNsRootResolved = await resolveDefaultNamespaceRoot(this.config);\n    return this.defaultNsRootResolved;\n  }\n\n  private async namespaceRoot(namespace: string): Promise<string> {\n    // NOTE: only used after defaultNamespaceRoot() resolution.\n    if (!resolveNamespaceCapabilities(this.config).namespaces) return this.config.memoryDir;\n    if (normalizeNamespaceIdentity(namespace) === this.defaultNamespaceIdentity) {\n      return this.defaultNsRootResolved ?? this.config.memoryDir;\n    }\n    return resolveNamespaceStorageRoot(this.config, namespace);\n  }\n\n  async storageFor(namespace: string): Promise<StorageManager> {\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    if (ns !== this.defaultNamespaceIdentity && !isSafeRouteNamespace(ns)) {\n      throw new Error(`unsafe namespace: ${ns}`);\n    }\n    // Even when the default namespace is exempt from the check above, every\n    // on-disk path is built through resolveNamespaceDir(), which rejects\n    // traversal segments — so an unsafe configured default still cannot escape\n    // <memoryDir>/namespaces (CodeQL js/path-injection).\n\n    let root: string;\n    if (ns === this.defaultNamespaceIdentity) {\n      root = await this.defaultNamespaceRoot();\n      const cached = this.cache.get(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    } else {\n      const cached = this.cache.get(ns);\n      root = await this.namespaceRoot(ns);\n      if (cached && cached.dir === root) {\n        this.notifyResolved(ns, root);\n        return cached;\n      }\n    }\n\n    const sm = new StorageManager(root, this.config.entitySchemas);\n    // Propagate the inline-attribution template so that router-created storages\n    // (used by extraction and shared-promotion paths) strip citations consistently,\n    // matching the behaviour of the primary this.storage instance in the orchestrator.\n    sm.citationTemplate = this.config.inlineSourceAttributionFormat;\n    // #1522: install the post-write catalog touch at the chokepoint — every\n    // successful write on this StorageManager records the namespace touch.\n    this.bindCatalogWriteHook(sm, ns);\n    // #1579: apply the tombstone non-resurrection config so every namespace\n    // storage enforces the invariant at its own writeMemory chokepoint.\n    this.applyTombstonesConfig(sm, ns);\n    this.cache.set(ns, sm);\n    this.notifyResolved(ns, root);\n    return sm;\n  }\n\n  /**\n   * Fire the resolve hook defensively. A hook failure (e.g. a catalog write\n   * error) MUST NOT crash storage resolution — see CLAUDE.md gotcha #13.\n   *\n   * Issue #1524 adoption: hook invocations for the SAME namespace are now\n   * strictly ordered through the shared `MutationSerializer` rather than the\n   * bespoke `inFlightResolved` marker-then-clear pattern. The serializer\n   * guarantees one in-flight hook per namespace; a concurrent burst of\n   * `storageFor()` cache hits collapses to a single hook invocation because\n   * each queued task re-checks `notifiedResolved` before invoking the hook. A\n   * dropped (`false`) or rejected hook leaves `notifiedResolved` unset so the\n   * next `storageFor()` retries — the serializer recovers from the rejection,\n   * so a failed hook never poisons later notifications.\n   */\n  private notifyResolved(namespace: string, storageDir: string): void {\n    const hook = this.hooks.onResolve;\n    if (!hook) return;\n    // Permanent dedup: skip once we've SUCCESSFULLY notified this exact\n    // (namespace, storageDir). A changed dir (rare: migration/realignment)\n    // still re-fires once. The mark is set ONLY AFTER the hook succeeds, so a\n    // dropped registration (e.g. rebuild-lock timeout) is RETRIED on the next\n    // cache hit instead of being suppressed forever (round 6, cursor Medium —\n    // ND3EJ).\n    if (this.notifiedResolved.get(namespace) === storageDir) return;\n    // In-flight dedup (cursor Medium 06f58a7c, codex P2): if a hook for THIS\n    // namespace is already pending, collapse this call onto it instead of\n    // enqueueing another task. The serializer strictly orders queued tasks, but\n    // ordering alone is not enough — when the first hook returns `false`\n    // (dropped touch, e.g. rebuild-lock timeout), `notifiedResolved` stays\n    // unset, so each queued sibling task would pass its re-check and re-run the\n    // hook. With the real catalog hook each retry can spend the full lock wait,\n    // so N cache hits during a rebuild leave N serial background lock attempts.\n    // Collapsing here means at most ONE hook runs per in-flight registration;\n    // its result (set `notifiedResolved` on success, leave unset on drop)\n    // decides whether a LATER `storageFor()` retries — collapsing loses\n    // nothing because the drop is already retried on the next cache hit.\n    // Keyed by the composite (namespace, storageDir) so a CHANGED dir\n    // (migration/realignment) for the same namespace still gets its own hook —\n    // it is NOT collapsed onto the old dir's pending registration (cursor\n    // Medium, codex P2).\n    const inFlightKey = namespace + \"\\u0000\" + storageDir;\n    if (this.inFlightResolveHooks.has(inFlightKey)) return;\n    this.inFlightResolveHooks.add(inFlightKey);\n    // Queue through the serializer. Concurrent calls for the same namespace\n    // strictly order here; the 2nd call's task runs only after the 1st's hook\n    // settles, by which point `notifiedResolved` is either set (no-op) or still\n    // unset (retry). The returned promise is tracked for\n    // `whenResolveHooksSettled()`. Rejections from the task body are caught so\n    // they never reach the caller (best-effort hook contract); the serializer's\n    // recovered tail still lets subsequent notifications run.\n    const task = async (): Promise<void> => {\n      // Re-check after queueing: a prior task in this same chain may have just\n      // marked the pair as notified.\n      if (this.notifiedResolved.get(namespace) === storageDir) return;\n      try {\n        // Hook may be sync or async; Promise.resolve normalizes both. A result\n        // of `false` means the registration was dropped/no-op (e.g. rebuild-lock\n        // timeout) — leave notifiedResolved UNSET so the next storageFor retries\n        // (round 6, codex P2 — NEFoX). `void`/`undefined` is success for legacy\n        // hooks. A rejection leaves notifiedResolved unset for the same reason.\n        const persisted = await Promise.resolve(hook(namespace, storageDir));\n        if (persisted !== false) {\n          this.notifiedResolved.set(namespace, storageDir);\n        }\n      } catch {\n        // Best-effort: a hook failure MUST NOT crash storage resolution. Leave\n        // notifiedResolved unset so a later storageFor retries the registration.\n      }\n    };\n    const queued = this.resolveSerializer.serialize(namespace, task);\n    this.pendingResolveHooks.add(queued);\n    // Clear the in-flight marker when the hook settles so a subsequent\n    // storageFor() can retry after a drop, or short-circuit via notifiedResolved\n    // after a success.\n    const cleanup = (): void => {\n      this.inFlightResolveHooks.delete(inFlightKey);\n      this.pendingResolveHooks.delete(queued);\n    };\n    void queued.then(cleanup, cleanup);\n  }\n\n  /**\n   * Install the post-write catalog touch hook on an externally-constructed\n   * StorageManager (issue #1522). Used by the orchestrator for the legacy\n   * default-namespace storage (`this.storage`) that bypasses the router.\n   */\n  bindCatalogWriteHook(sm: StorageManager, namespace: string): void {\n    sm.onCatalogWrite = () => this.touchCatalogWrite(namespace, sm.dir);\n  }\n\n  /**\n   * Install the tombstone config on an externally-constructed StorageManager\n   * (issue #1579). Mirrors `bindCatalogWriteHook` — used for the legacy\n   * default-namespace storage that bypasses the router. Router-created\n   * storages are wired inline in `storageFor()` via `applyTombstonesConfig`.\n   */\n  bindTombstonesConfig(\n    sm: StorageManager,\n    namespace: string,\n    config: { enabled: boolean; semanticMatch: boolean; semanticThreshold: number },\n  ): void {\n    this.tombstonesGlobalConfig = { ...config };\n    sm.setTombstonesConfig({ ...config, namespace });\n  }\n\n  private tombstonesGlobalConfig: {\n    enabled: boolean;\n    semanticMatch: boolean;\n    semanticThreshold: number;\n  } = { enabled: false, semanticMatch: false, semanticThreshold: 0.9 };\n\n  /**\n   * Apply the tombstone config to a router-created StorageManager. Called\n   * inline in `storageFor()` so every namespace storage enforces the\n   * non-resurrection invariant, namespace-scoped (rule 42).\n   */\n  private applyTombstonesConfig(sm: StorageManager, namespace: string): void {\n    sm.setTombstonesConfig({ ...this.tombstonesGlobalConfig, namespace });\n  }\n\n  /**\n   * Post-write catalog touch (issue #1522 chokepoint). Called by every\n   * StorageManager's post-write hook AFTER a successful write. Best-effort\n   * and failure-tolerant — a catalog error MUST NOT affect the primary write\n   * (gotcha #13, rule #40). Fire-and-forget by design.\n   */\n  private touchCatalogWrite(namespace: string, storageDir: string): void {\n    if (!this.catalog) return;\n    const touch = this.catalog\n      .markWrite(namespace, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Record a namespace read in the catalog (issue #1522 chokepoint move).\n   * Best-effort and failure-tolerant. Used by recall paths so the read touch\n   * lives in the storage layer, not at the caller.\n   */\n  recordRead(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    void this.catalog\n      .markRead(ns, { discoveredBy: \"read\", storageDir })\n      .catch(() => undefined);\n  }\n  /**\n   * Record a namespace write touch in the catalog (issue #1522). Best-effort\n   * and failure-tolerant. Used by consolidation/cleanup passes that may mutate\n   * the store via delete-only paths (e.g. entity-file merges, TTL cleanup) so\n   * the namespace's lastWriteAt stays fresh even when no explicit write went\n   * through the storage chokepoint. This is NOT a substitute for the chokepoint\n   * — it's a belt-and-suspenders for paths the chokepoint doesn't cover.\n   */\n  recordWrite(namespace: string, storageDir?: string): void {\n    if (!this.catalog) return;\n    const ns = normalizeNamespaceIdentity(namespace || this.config.defaultNamespace);\n    const touch = this.catalog\n      .markWrite(ns, { discoveredBy: \"write\", storageDir })\n      .catch(() => undefined);\n    this.pendingWriteTouches.add(touch);\n    void touch.then(\n      () => { this.pendingWriteTouches.delete(touch); },\n      () => { this.pendingWriteTouches.delete(touch); },\n    );\n  }\n\n  /**\n   * Resolve once every in-flight post-write catalog touch has settled (#1522).\n   * Mirrors `whenResolveHooksSettled()`: the StorageManager's post-write hook\n   * fires the catalog touch fire-and-forget, so tests asserting lastWriteAt\n   * moved should await this instead of racing a timer.\n   */\n  async whenWriteTouchesSettled(): Promise<void> {\n    while (this.pendingWriteTouches.size > 0) {\n      await Promise.allSettled([...this.pendingWriteTouches]);\n    }\n  }\n\n  /**\n   * Resolve once every in-flight `onResolve` registration has settled.\n   *\n   * `storageFor()` fires the resolve hook fire-and-forget, so its catalog side\n   * effect (e.g. `registerResolved(...)`) is not observable the moment\n   * `storageFor()` returns. Callers that must act on that side effect — notably\n   * tests asserting the catalog was updated — should await this instead of\n   * racing a timer. Resolves immediately when no hook is registered or nothing\n   * is in flight. The loop re-checks because a settling hook could, in\n   * principle, trigger a follow-on resolution.\n   */\n  async whenResolveHooksSettled(): Promise<void> {\n    while (this.pendingResolveHooks.size > 0) {\n      await Promise.allSettled([...this.pendingResolveHooks]);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AACA,OAAO,UAAU;AACjB,SAAS,QAAQ,OAAO,eAAe;AASvC,eAAe,OAAO,GAA6B;AACjD,MAAI;AACF,UAAM,OAAO,CAAC;AACd,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,GAA6B;AAC3D,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,QAAI,MAAM,eAAe,EAAG,QAAO;AACnC,QAAI,CAAC,MAAM,YAAY,EAAG,QAAO;AACjC,UAAM,WAAW,MAAM,QAAQ,GAAG,EAAE,eAAe,KAAK,CAAC;AACzD,eAAW,SAAS,UAAU;AAC5B,YAAM,YAAY,KAAK,KAAK,GAAG,MAAM,IAAI;AACzC,UAAI,MAAM,eAAe,KAAK,MAAM,OAAO,EAAG,QAAO;AACrD,UAAI,MAAM,YAAY,KAAM,MAAM,iBAAiB,SAAS,EAAI,QAAO;AAAA,IACzE;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQA,SAAS,oBAAoB,WAAmB,SAAyB;AAIvE,MACE,QAAQ,WAAW,KACnB,QAAQ,SAAS,GAAG,KACpB,QAAQ,SAAS,IAAI,KACrB,QAAQ,SAAS,IAAI,KACrB,KAAK,WAAW,OAAO,GACvB;AACA,UAAM,IAAI,MAAM,kCAAkC,OAAO,EAAE;AAAA,EAC7D;AACA,SAAO,KAAK,KAAK,WAAW,cAAc,OAAO;AACnD;AAEA,IAAM,oCAAoC;AAAA,EACxC,GAAG;AAAA,EACH;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,oCAAoC,CAAC,OAAO;AAElD,eAAe,iBACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,iBAAiB,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EAChE;AACA,SAAO;AACT;AAEA,eAAe,6BACb,SACA,UAA6C,CAAC,GAC5B;AAClB,QAAM,WAAW,QAAQ,wBAAwB,OAC7C,CAAC,GAAG,mCAAmC,GAAG,iCAAiC,IAC3E;AACJ,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAO,KAAK,KAAK,SAAS,KAAK,CAAC,EAAG,QAAO;AAAA,EACtD;AACA,SAAO;AACT;AA8CA,eAAsB,4BAA4B,QAAuC;AACvF,MAAI,CAAC,6BAA6B,MAAM,EAAE,YAAY;AACpD,WAAO,OAAO;AAAA,EAChB;AASA,QAAM,kBAAkB,2BAA2B,OAAO,gBAAgB;AAC1E,QAAM,cAAc,oBAAoB,OAAO,WAAW,eAAe;AACzE,QAAM,iBAAiB;AAAA,IACrB,OAAO;AAAA,IACP,uBAAuB,OAAO,gBAAgB;AAAA,EAChD;AACA,QAAM,mBACH,MAAM,OAAO,cAAc,KAC3B,MAAM,6BAA6B,gBAAgB,EAAE,qBAAqB,KAAK,CAAC;AACnF,QAAM,QAAQ,mBACV,iBACC,MAAM,OAAO,WAAW,IACvB,cACA;AACN,SAAQ,MAAM,OAAO,KAAK,KAAM,CAAE,MAAM,iBAAiB,OAAO,SAAS,IACrE,QACA,OAAO;AACb;AAYA,eAAsB,4BACpB,QACA,WACiB;AACjB,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO,OAAO;AAIpE,MAAI,2BAA2B,SAAS,MAAM,2BAA2B,OAAO,gBAAgB,GAAG;AACjG,WAAO,4BAA4B,MAAM;AAAA,EAC3C;AACA,QAAM,aAAa,oBAAoB,OAAO,WAAW,SAAS;AAClE,QAAM,gBAAgB,oBAAoB,OAAO,WAAW,uBAAuB,SAAS,CAAC;AAC7F,MACG,MAAM,OAAO,aAAa,KAC1B,MAAM,6BAA6B,eAAe,EAAE,qBAAqB,KAAK,CAAC,GAChF;AACA,WAAO;AAAA,EACT;AACA,SAAQ,MAAM,OAAO,UAAU,IAAK,aAAa;AACnD;AAEO,IAAM,yBAAN,MAA6B;AAAA,EAwClC,YACmB,QACA,QAAqC,CAAC,GAEtC,SACjB;AAJiB;AACA;AAEA;AAEjB,SAAK,2BAA2B,2BAA2B,OAAO,gBAAgB;AAAA,EACpF;AAAA,EANmB;AAAA,EACA;AAAA,EAEA;AAAA,EA3CF,QAAQ,oBAAI,IAA4B;AAAA,EACjD,wBAAuC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM9B,mBAAmB,oBAAI,IAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,oBAAoB,IAAI,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ3C,uBAAuB,oBAAI,IAAY;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvC,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA,EAGhD,sBAAsB,oBAAI,IAAsB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMhD;AAAA,EAWjB,MAAc,uBAAwC;AACpD,SAAK,wBAAwB,MAAM,4BAA4B,KAAK,MAAM;AAC1E,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,cAAc,WAAoC;AAE9D,QAAI,CAAC,6BAA6B,KAAK,MAAM,EAAE,WAAY,QAAO,KAAK,OAAO;AAC9E,QAAI,2BAA2B,SAAS,MAAM,KAAK,0BAA0B;AAC3E,aAAO,KAAK,yBAAyB,KAAK,OAAO;AAAA,IACnD;AACA,WAAO,4BAA4B,KAAK,QAAQ,SAAS;AAAA,EAC3D;AAAA,EAEA,MAAM,WAAW,WAA4C;AAC3D,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,QAAI,OAAO,KAAK,4BAA4B,CAAC,qBAAqB,EAAE,GAAG;AACrE,YAAM,IAAI,MAAM,qBAAqB,EAAE,EAAE;AAAA,IAC3C;AAMA,QAAI;AACJ,QAAI,OAAO,KAAK,0BAA0B;AACxC,aAAO,MAAM,KAAK,qBAAqB;AACvC,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF,OAAO;AACL,YAAM,SAAS,KAAK,MAAM,IAAI,EAAE;AAChC,aAAO,MAAM,KAAK,cAAc,EAAE;AAClC,UAAI,UAAU,OAAO,QAAQ,MAAM;AACjC,aAAK,eAAe,IAAI,IAAI;AAC5B,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,KAAK,IAAI,eAAe,MAAM,KAAK,OAAO,aAAa;AAI7D,OAAG,mBAAmB,KAAK,OAAO;AAGlC,SAAK,qBAAqB,IAAI,EAAE;AAGhC,SAAK,sBAAsB,IAAI,EAAE;AACjC,SAAK,MAAM,IAAI,IAAI,EAAE;AACrB,SAAK,eAAe,IAAI,IAAI;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBQ,eAAe,WAAmB,YAA0B;AAClE,UAAM,OAAO,KAAK,MAAM;AACxB,QAAI,CAAC,KAAM;AAOX,QAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AAiBzD,UAAM,cAAc,YAAY,OAAW;AAC3C,QAAI,KAAK,qBAAqB,IAAI,WAAW,EAAG;AAChD,SAAK,qBAAqB,IAAI,WAAW;AAQzC,UAAM,OAAO,YAA2B;AAGtC,UAAI,KAAK,iBAAiB,IAAI,SAAS,MAAM,WAAY;AACzD,UAAI;AAMF,cAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,WAAW,UAAU,CAAC;AACnE,YAAI,cAAc,OAAO;AACvB,eAAK,iBAAiB,IAAI,WAAW,UAAU;AAAA,QACjD;AAAA,MACF,QAAQ;AAAA,MAGR;AAAA,IACF;AACA,UAAM,SAAS,KAAK,kBAAkB,UAAU,WAAW,IAAI;AAC/D,SAAK,oBAAoB,IAAI,MAAM;AAInC,UAAM,UAAU,MAAY;AAC1B,WAAK,qBAAqB,OAAO,WAAW;AAC5C,WAAK,oBAAoB,OAAO,MAAM;AAAA,IACxC;AACA,SAAK,OAAO,KAAK,SAAS,OAAO;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,qBAAqB,IAAoB,WAAyB;AAChE,OAAG,iBAAiB,MAAM,KAAK,kBAAkB,WAAW,GAAG,GAAG;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,qBACE,IACA,WACA,QACM;AACN,SAAK,yBAAyB,EAAE,GAAG,OAAO;AAC1C,OAAG,oBAAoB,EAAE,GAAG,QAAQ,UAAU,CAAC;AAAA,EACjD;AAAA,EAEQ,yBAIJ,EAAE,SAAS,OAAO,eAAe,OAAO,mBAAmB,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO3D,sBAAsB,IAAoB,WAAyB;AACzE,OAAG,oBAAoB,EAAE,GAAG,KAAK,wBAAwB,UAAU,CAAC;AAAA,EACtE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,WAAmB,YAA0B;AACrE,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,QAAQ,KAAK,QAChB,UAAU,WAAW,EAAE,cAAc,SAAS,WAAW,CAAC,EAC1D,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAmB,YAA2B;AACvD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,SAAK,KAAK,QACP,SAAS,IAAI,EAAE,cAAc,QAAQ,WAAW,CAAC,EACjD,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAY,WAAmB,YAA2B;AACxD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,KAAK,2BAA2B,aAAa,KAAK,OAAO,gBAAgB;AAC/E,UAAM,QAAQ,KAAK,QAChB,UAAU,IAAI,EAAE,cAAc,SAAS,WAAW,CAAC,EACnD,MAAM,MAAM,MAAS;AACxB,SAAK,oBAAoB,IAAI,KAAK;AAClC,SAAK,MAAM;AAAA,MACT,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,MAChD,MAAM;AAAE,aAAK,oBAAoB,OAAO,KAAK;AAAA,MAAG;AAAA,IAClD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,0BAAyC;AAC7C,WAAO,KAAK,oBAAoB,OAAO,GAAG;AACxC,YAAM,QAAQ,WAAW,CAAC,GAAG,KAAK,mBAAmB,CAAC;AAAA,IACxD;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-UZYLX7M6.js → chunk-OYHYBHHI.js}

@@ -1,3 +1,6 @@
+import {
+  resolveNamespaceCapabilities
+} from "./chunk-JWDE7OVJ.js";
 import {
   isLikelyUnsafeRegex
 } from "./chunk-U3PN77QT.js";
@@ -13,7 +16,7 @@ function compileSafePrincipalRegex(pattern) {
   }
 }
 function resolvePrincipal(sessionKey, config) {
-  if (!config.namespacesEnabled) return "default";
+  if (!resolveNamespaceCapabilities(config).namespaces) return "default";
   const sk = typeof sessionKey === "string" && sessionKey.trim().length > 0 ? sessionKey : "";
   const mode = config.principalFromSessionKeyMode;
   const rules = config.principalFromSessionKeyRules ?? [];
@@ -44,28 +47,28 @@ function resolvePrincipal(sessionKey, config) {
   return "default";
 }
 function canReadNamespace(principal, namespace, config) {
-  if (!config.namespacesEnabled) return true;
+  if (!resolveNamespaceCapabilities(config).namespaces) return true;
   if (!principal) return false;
   const policy = config.namespacePolicies.find((p) => p.name === namespace);
   if (!policy) return namespace === config.defaultNamespace || namespace === config.sharedNamespace;
   return policy.readPrincipals.includes(principal) || policy.readPrincipals.includes("*");
 }
 function canWriteNamespace(principal, namespace, config) {
-  if (!config.namespacesEnabled) return true;
+  if (!resolveNamespaceCapabilities(config).namespaces) return true;
   if (!principal) return false;
   const policy = config.namespacePolicies.find((p) => p.name === namespace);
   if (!policy) return namespace === config.defaultNamespace;
   return policy.writePrincipals.includes(principal) || policy.writePrincipals.includes("*");
 }
 function defaultNamespaceForPrincipal(principal, config) {
-  if (!config.namespacesEnabled) return config.defaultNamespace;
+  if (!resolveNamespaceCapabilities(config).namespaces) return config.defaultNamespace;
   if (!principal) return config.defaultNamespace;
   const exists = config.namespacePolicies.some((p) => p.name === principal);
   return exists ? principal : config.defaultNamespace;
 }
 function recallNamespacesForPrincipal(principal, config) {
   const out = [];
-  if (!config.namespacesEnabled) return [config.defaultNamespace];
+  if (!resolveNamespaceCapabilities(config).namespaces) return [config.defaultNamespace];
   if (!principal) return out;
   const selfNs = defaultNamespaceForPrincipal(principal, config);
   if (config.defaultRecallNamespaces.includes("self") && canReadNamespace(principal, selfNs, config)) {
@@ -89,4 +92,4 @@ export {
   defaultNamespaceForPrincipal,
   recallNamespacesForPrincipal
 };
-//# sourceMappingURL=chunk-UZYLX7M6.js.map
+//# sourceMappingURL=chunk-OYHYBHHI.js.map

package/dist/chunk-OYHYBHHI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/principal.ts"],"sourcesContent":["import { resolveNamespaceCapabilities } from \"../capabilities.js\";\nimport type { PluginConfig } from \"../types.js\";\nimport { isLikelyUnsafeRegex } from \"../routing/engine.js\";\n\nconst MAX_REGEX_SESSION_KEY_LENGTH = 512;\n\nfunction compileSafePrincipalRegex(pattern: string): RegExp | null {\n  if (isLikelyUnsafeRegex(pattern)) return null;\n  try {\n    return new RegExp(pattern);\n  } catch {\n    return null;\n  }\n}\n\nexport function resolvePrincipal(sessionKey: string | undefined, config: PluginConfig): string | undefined {\n  if (!resolveNamespaceCapabilities(config).namespaces) return \"default\";\n  const sk = typeof sessionKey === \"string\" && sessionKey.trim().length > 0\n    ? sessionKey\n    : \"\";\n  const mode = config.principalFromSessionKeyMode;\n  const rules = config.principalFromSessionKeyRules ?? [];\n\n  if (!sk) return undefined;\n\n  if (mode === \"prefix\") {\n    for (const r of rules) {\n      if (sk.startsWith(r.match)) return r.principal;\n    }\n  } else if (mode === \"map\") {\n    for (const r of rules) {\n      if (sk === r.match) return r.principal;\n    }\n  } else if (mode === \"regex\") {\n    if (sk.length <= MAX_REGEX_SESSION_KEY_LENGTH) {\n      for (const r of rules) {\n        const re = compileSafePrincipalRegex(r.match);\n        if (re?.test(sk)) {\n          return r.principal;\n        }\n      }\n    }\n  }\n\n  // Fallback heuristic: \"agent:<agentId>:<channelType>:...\"\n  const parts = sk.split(\":\");\n  if (parts.length >= 2 && parts[0] === \"agent\") {\n    const agentId = parts[1];\n    if (agentId && agentId.length > 0) return agentId;\n  }\n  return \"default\";\n}\n\nexport function canReadNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {\n  if (!resolveNamespaceCapabilities(config).namespaces) return true;\n  if (!principal) return false;\n  const policy = config.namespacePolicies.find((p) => p.name === namespace);\n  if (!policy) return namespace === config.defaultNamespace || namespace === config.sharedNamespace;\n  return policy.readPrincipals.includes(principal) || policy.readPrincipals.includes(\"*\");\n}\n\nexport function canWriteNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {\n  if (!resolveNamespaceCapabilities(config).namespaces) return true;\n  if (!principal) return false;\n  const policy = config.namespacePolicies.find((p) => p.name === namespace);\n  if (!policy) return namespace === config.defaultNamespace;\n  return policy.writePrincipals.includes(principal) || policy.writePrincipals.includes(\"*\");\n}\n\n/**\n * Default \"self\" namespace for a principal.\n *\n * Heuristic:\n * - If there's a namespace policy with the same name as the principal, use it.\n * - Otherwise use config.defaultNamespace.\n */\nexport function defaultNamespaceForPrincipal(principal: string | undefined, config: PluginConfig): string {\n  if (!resolveNamespaceCapabilities(config).namespaces) return config.defaultNamespace;\n  if (!principal) return config.defaultNamespace;\n  const exists = config.namespacePolicies.some((p) => p.name === principal);\n  return exists ? principal : config.defaultNamespace;\n}\n\nexport function recallNamespacesForPrincipal(principal: string | undefined, config: PluginConfig): string[] {\n  const out: string[] = [];\n  if (!resolveNamespaceCapabilities(config).namespaces) return [config.defaultNamespace];\n  if (!principal) return out;\n\n  const selfNs = defaultNamespaceForPrincipal(principal, config);\n  if (config.defaultRecallNamespaces.includes(\"self\") && canReadNamespace(principal, selfNs, config)) {\n    out.push(selfNs);\n  }\n  if (config.defaultRecallNamespaces.includes(\"shared\") && canReadNamespace(principal, config.sharedNamespace, config)) {\n    out.push(config.sharedNamespace);\n  }\n\n  for (const p of config.namespacePolicies) {\n    if (p.includeInRecallByDefault && canReadNamespace(principal, p.name, config)) {\n      if (!out.includes(p.name)) out.push(p.name);\n    }\n  }\n\n  return out;\n}\n"],"mappings":";;;;;;;;AAIA,IAAM,+BAA+B;AAErC,SAAS,0BAA0B,SAAgC;AACjE,MAAI,oBAAoB,OAAO,EAAG,QAAO;AACzC,MAAI;AACF,WAAO,IAAI,OAAO,OAAO;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,YAAgC,QAA0C;AACzG,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO;AAC7D,QAAM,KAAK,OAAO,eAAe,YAAY,WAAW,KAAK,EAAE,SAAS,IACpE,aACA;AACJ,QAAM,OAAO,OAAO;AACpB,QAAM,QAAQ,OAAO,gCAAgC,CAAC;AAEtD,MAAI,CAAC,GAAI,QAAO;AAEhB,MAAI,SAAS,UAAU;AACrB,eAAW,KAAK,OAAO;AACrB,UAAI,GAAG,WAAW,EAAE,KAAK,EAAG,QAAO,EAAE;AAAA,IACvC;AAAA,EACF,WAAW,SAAS,OAAO;AACzB,eAAW,KAAK,OAAO;AACrB,UAAI,OAAO,EAAE,MAAO,QAAO,EAAE;AAAA,IAC/B;AAAA,EACF,WAAW,SAAS,SAAS;AAC3B,QAAI,GAAG,UAAU,8BAA8B;AAC7C,iBAAW,KAAK,OAAO;AACrB,cAAM,KAAK,0BAA0B,EAAE,KAAK;AAC5C,YAAI,IAAI,KAAK,EAAE,GAAG;AAChB,iBAAO,EAAE;AAAA,QACX;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,QAAQ,GAAG,MAAM,GAAG;AAC1B,MAAI,MAAM,UAAU,KAAK,MAAM,CAAC,MAAM,SAAS;AAC7C,UAAM,UAAU,MAAM,CAAC;AACvB,QAAI,WAAW,QAAQ,SAAS,EAAG,QAAO;AAAA,EAC5C;AACA,SAAO;AACT;AAEO,SAAS,iBAAiB,WAA+B,WAAmB,QAA+B;AAChH,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO,cAAc,OAAO,oBAAoB,cAAc,OAAO;AAClF,SAAO,OAAO,eAAe,SAAS,SAAS,KAAK,OAAO,eAAe,SAAS,GAAG;AACxF;AAEO,SAAS,kBAAkB,WAA+B,WAAmB,QAA+B;AACjH,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO;AAC7D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,MAAI,CAAC,OAAQ,QAAO,cAAc,OAAO;AACzC,SAAO,OAAO,gBAAgB,SAAS,SAAS,KAAK,OAAO,gBAAgB,SAAS,GAAG;AAC1F;AASO,SAAS,6BAA6B,WAA+B,QAA8B;AACxG,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO,OAAO;AACpE,MAAI,CAAC,UAAW,QAAO,OAAO;AAC9B,QAAM,SAAS,OAAO,kBAAkB,KAAK,CAAC,MAAM,EAAE,SAAS,SAAS;AACxE,SAAO,SAAS,YAAY,OAAO;AACrC;AAEO,SAAS,6BAA6B,WAA+B,QAAgC;AAC1G,QAAM,MAAgB,CAAC;AACvB,MAAI,CAAC,6BAA6B,MAAM,EAAE,WAAY,QAAO,CAAC,OAAO,gBAAgB;AACrF,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,SAAS,6BAA6B,WAAW,MAAM;AAC7D,MAAI,OAAO,wBAAwB,SAAS,MAAM,KAAK,iBAAiB,WAAW,QAAQ,MAAM,GAAG;AAClG,QAAI,KAAK,MAAM;AAAA,EACjB;AACA,MAAI,OAAO,wBAAwB,SAAS,QAAQ,KAAK,iBAAiB,WAAW,OAAO,iBAAiB,MAAM,GAAG;AACpH,QAAI,KAAK,OAAO,eAAe;AAAA,EACjC;AAEA,aAAW,KAAK,OAAO,mBAAmB;AACxC,QAAI,EAAE,4BAA4B,iBAAiB,WAAW,EAAE,MAAM,MAAM,GAAG;AAC7E,UAAI,CAAC,IAAI,SAAS,EAAE,IAAI,EAAG,KAAI,KAAK,EAAE,IAAI;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}