@remnic/core 9.3.759 → 9.3.761

package/dist/{chunk-OLEBPUZ7.js → chunk-4WOXD56B.js}

@@ -11,23 +11,23 @@ import {
   processChatMessage,
   sessionBelongsToPrincipal,
   subscribeChatTranscript
-} from "./chunk-AZSSKOG6.js";
+} from "./chunk-JYH3XYWM.js";
 import {
   validateRequest
 } from "./chunk-2MR3MFQB.js";
 import {
   getOperation
-} from "./chunk-3JBW3GHN.js";
+} from "./chunk-LG2MCUBC.js";
 import {
   CorrectionContractError,
   EngramAccessInputError
-} from "./chunk-IZLGHKWA.js";
+} from "./chunk-3CBSKDRL.js";
 import {
   isTrustZoneName
 } from "./chunk-JGSKJHF7.js";
 import {
   projectTagProjectId
-} from "./chunk-W3M34XT4.js";
+} from "./chunk-BAVVI5GP.js";
 import {
   subscribeGraphEvents
 } from "./chunk-DEUNUKTD.js";
@@ -2627,4 +2627,4 @@ function positiveIntQueryParam(value, label) {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-OLEBPUZ7.js.map
+//# sourceMappingURL=chunk-4WOXD56B.js.map

package/dist/{chunk-QUGPXPFJ.js → chunk-5AZQZFJG.js}

@@ -3,10 +3,10 @@ import {
   readNamespaceMaintenanceLastRanStatuses,
   readNamespaceMaintenanceStatuses,
   runNamespaceMaintenancePlan
-} from "./chunk-6CUUFFU7.js";
+} from "./chunk-HP23UD6W.js";
 import {
   listNamespaces
-} from "./chunk-M2AAYJVI.js";
+} from "./chunk-P7N2DQLC.js";
 import {
   analyzeSessionIntegrity,
   applySessionRepair,
@@ -42,13 +42,13 @@ import {
 import {
   listMemoryGovernanceRuns,
   readMemoryGovernanceRunArtifact
-} from "./chunk-SN2EWIAI.js";
+} from "./chunk-P7UA66OG.js";
 import {
   analyzeGraphHealth
 } from "./chunk-EHQ5HO5T.js";
 import {
   StorageManager
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   lintWorkspaceFiles
 } from "./chunk-DM2T26WE.js";
@@ -1599,4 +1599,4 @@ export {
   runBenchmarkRecall,
   runOperatorRepair
 };
-//# sourceMappingURL=chunk-QUGPXPFJ.js.map
+//# sourceMappingURL=chunk-5AZQZFJG.js.map

package/dist/{chunk-DTSOB2YF.js → chunk-6S2C5FQ4.js}

@@ -1,7 +1,7 @@
 import {
   StorageManager,
   normalizeEntityName
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   serializeMutations
 } from "./chunk-LTJAMRGI.js";
@@ -956,4 +956,4 @@ export {
   resolveBriefingSaveDir,
   briefingFilename
 };
-//# sourceMappingURL=chunk-DTSOB2YF.js.map
+//# sourceMappingURL=chunk-6S2C5FQ4.js.map

package/dist/{chunk-WIXQ3F5P.js → chunk-742MWWVL.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-3UXOZBHV.js";
 import {
   StorageManager
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   isSafeRouteNamespace
 } from "./chunk-U3PN77QT.js";
@@ -118,4 +118,4 @@ export {
   runCodexMaterialize,
   runPostConsolidationMaterialize
 };
-//# sourceMappingURL=chunk-WIXQ3F5P.js.map
+//# sourceMappingURL=chunk-742MWWVL.js.map

package/dist/{chunk-W3M34XT4.js → chunk-BAVVI5GP.js}

@@ -1,7 +1,7 @@
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken
-} from "./chunk-ZFXCQPNO.js";
+} from "./chunk-EGGE52UU.js";
 import {
   launchProcessSync
 } from "./chunk-O75CRYGF.js";
@@ -772,4 +772,4 @@ export {
   resolveNamespaceFromStorageDir,
   resolveWritableNamespaceValue
 };
-//# sourceMappingURL=chunk-W3M34XT4.js.map
+//# sourceMappingURL=chunk-BAVVI5GP.js.map

package/dist/{chunk-QOM3F6YW.js → chunk-CFHDI5CV.js}

@@ -21,16 +21,16 @@ import {
 } from "./chunk-T4WDJPEZ.js";
 import {
   defineOperation
-} from "./chunk-3JBW3GHN.js";
+} from "./chunk-LG2MCUBC.js";
 import {
   EngramAccessInputError
-} from "./chunk-IZLGHKWA.js";
+} from "./chunk-3CBSKDRL.js";
 import {
   projectTagProjectId
-} from "./chunk-W3M34XT4.js";
+} from "./chunk-BAVVI5GP.js";
 import {
   validateBriefingFormat
-} from "./chunk-DTSOB2YF.js";
+} from "./chunk-6S2C5FQ4.js";
 import {
   resolvePrincipal
 } from "./chunk-PE6XR4GG.js";
@@ -417,4 +417,4 @@ defineOperation({ name: "offline_sync_snapshot_stream", description: "SSE stream
 defineOperation({ name: "graph_events", description: "SSE graph events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
 defineOperation({ name: "chat_message", description: "Chat message.", schema: strictSchema({ message: S.str, chatSessionId: S.str }), handler: async (_i, _ctx) => ({ result: { ok: true } }) });
 defineOperation({ name: "chat_events", description: "SSE chat events.", schema: strictSchema({}), handler: async (_i, _ctx) => ({ result: { stream: "sse" } }) });
-//# sourceMappingURL=chunk-QOM3F6YW.js.map
+//# sourceMappingURL=chunk-CFHDI5CV.js.map

package/dist/{chunk-IOZZG75J.js → chunk-DUU4VLOW.js}

@@ -1,6 +1,6 @@
 import {
   StorageManager
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   getCachedRuleMemories,
   setCachedRuleMemories
@@ -117,4 +117,4 @@ export {
   compareVerifiedSemanticRuleResults,
   searchVerifiedSemanticRules
 };
-//# sourceMappingURL=chunk-IOZZG75J.js.map
+//# sourceMappingURL=chunk-DUU4VLOW.js.map

package/dist/{chunk-ZFXCQPNO.js → chunk-EGGE52UU.js}

@@ -1,6 +1,6 @@
 // src/namespaces/identity.ts
 function normalizeNamespaceIdentity(namespace) {
-  return namespace.trim();
+  return namespace?.trim() ?? "";
 }
 function namespaceIdentityToken(namespace) {
   const normalized = normalizeNamespaceIdentity(namespace);
@@ -24,4 +24,4 @@ export {
   namespaceIdentityToken,
   namespaceIdentityFromToken
 };
-//# sourceMappingURL=chunk-ZFXCQPNO.js.map
+//# sourceMappingURL=chunk-EGGE52UU.js.map

package/dist/chunk-EGGE52UU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/namespaces/identity.ts"],"sourcesContent":["export function normalizeNamespaceIdentity(namespace: string | null | undefined): string {\n  return namespace?.trim() ?? \"\";\n}\n\nexport function namespaceIdentityToken(namespace: string): string {\n  const normalized = normalizeNamespaceIdentity(namespace);\n  const bytes = new TextEncoder().encode(normalized);\n  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n  return `ns-${hex || \"default\"}`;\n}\n\nexport function namespaceIdentityFromToken(token: string): string | null {\n  if (!token.startsWith(\"ns-\")) return null;\n  const hex = token.slice(3);\n  if (hex === \"default\") return \"\";\n  if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-f]+$/i.test(hex)) {\n    return null;\n  }\n  const decoded = Buffer.from(hex, \"hex\").toString(\"utf8\");\n  return namespaceIdentityToken(decoded).toLowerCase() === token.toLowerCase()\n    ? decoded\n    : null;\n}\n"],"mappings":";AAAO,SAAS,2BAA2B,WAA8C;AACvF,SAAO,WAAW,KAAK,KAAK;AAC9B;AAEO,SAAS,uBAAuB,WAA2B;AAChE,QAAM,aAAa,2BAA2B,SAAS;AACvD,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,UAAU;AACjD,QAAM,MAAM,MAAM,KAAK,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnF,SAAO,MAAM,OAAO,SAAS;AAC/B;AAEO,SAAS,2BAA2B,OAA8B;AACvE,MAAI,CAAC,MAAM,WAAW,KAAK,EAAG,QAAO;AACrC,QAAM,MAAM,MAAM,MAAM,CAAC;AACzB,MAAI,QAAQ,UAAW,QAAO;AAC9B,MAAI,IAAI,WAAW,KAAK,IAAI,SAAS,MAAM,KAAK,CAAC,eAAe,KAAK,GAAG,GAAG;AACzE,WAAO;AAAA,EACT;AACA,QAAM,UAAU,OAAO,KAAK,KAAK,KAAK,EAAE,SAAS,MAAM;AACvD,SAAO,uBAAuB,OAAO,EAAE,YAAY,MAAM,MAAM,YAAY,IACvE,UACA;AACN;","names":[]}

package/dist/{chunk-LLVKDFNU.js → chunk-GYJESQS5.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-SFQ6QNL7.js";
 import {
   StorageManager
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   buildLifecycleEventsForMemory,
   sortMemoryLifecycleEvents
@@ -74,4 +74,4 @@ export {
   backupExistingLedger,
   rebuildMemoryLifecycleLedger
 };
-//# sourceMappingURL=chunk-LLVKDFNU.js.map
+//# sourceMappingURL=chunk-GYJESQS5.js.map

package/dist/{chunk-EGQ3AVZV.js → chunk-HHCMZEUC.js}

@@ -1,10 +1,10 @@
 import {
   namespaceIdentityToken,
   normalizeNamespaceIdentity
-} from "./chunk-ZFXCQPNO.js";
+} from "./chunk-EGGE52UU.js";
 import {
   StorageManager
-} from "./chunk-YP23FQPT.js";
+} from "./chunk-3DAIQSVS.js";
 import {
   MutationSerializer
 } from "./chunk-LTJAMRGI.js";
@@ -339,4 +339,4 @@ export {
   resolveNamespaceStorageRoot,
   NamespaceStorageRouter
 };
-//# sourceMappingURL=chunk-EGQ3AVZV.js.map
+//# sourceMappingURL=chunk-HHCMZEUC.js.map

package/dist/{chunk-6CUUFFU7.js → chunk-HP23UD6W.js}

@@ -1,15 +1,15 @@
 import {
   resolveDefaultNamespaceRoot,
   resolveNamespaceStorageRoot
-} from "./chunk-EGQ3AVZV.js";
+} from "./chunk-HHCMZEUC.js";
 import {
   getConfiguredNamespaces
-} from "./chunk-W3M34XT4.js";
+} from "./chunk-BAVVI5GP.js";
 import {
   namespaceIdentityFromToken,
   namespaceIdentityToken,
   normalizeNamespaceIdentity
-} from "./chunk-ZFXCQPNO.js";
+} from "./chunk-EGGE52UU.js";
 import {
   MutationSerializer,
   withHeldFileLock
@@ -34,10 +34,11 @@ import {
   appendFile,
   lstat,
   mkdir,
+  open,
   readdir,
-  readFile,
   realpath,
   rename,
+  stat,
   writeFile
 } from "fs/promises";
 var NAMESPACE_KINDS = [
@@ -256,12 +257,19 @@ var NamespaceCatalog = class {
   // neither mistakes the other's lock for self-held (round 6, codex P2 — NBsGP
   // invariant preserved and tightened).
   criticalSection = new MutationSerializer();
+  compactedCache;
   // Test-only seam (round 7 — NEZkA): fires inside a touch's HELD-lock critical
   // section, after the lock is acquired but BEFORE the read→merge→append. A
   // deterministic concurrency test installs a hook here to widen the (otherwise
   // microscopic) window and prove that a cross-process rebuild CANNOT run its
   // load→rename while a touch holds the lock. Never set in production code.
   onTouchCriticalSectionForTest;
+  // Test-only observation seam: fires only when the JSONL file is fully read.
+  // Cached loads do not invoke it.
+  onCatalogReadForTest;
+  // Test-only seam: fires after this process appends but before it stats the
+  // file to refresh the cache identity.
+  onAfterCatalogAppendForTest;
   // Test-only seam (round 7 — NEZkA): fires inside a mutating rebuild's HELD-lock
   // critical section, after the final cross-process re-merge `loadCompacted()` and
   // BEFORE the atomic `rename()`. This is the EXACT window in which a check-then-
@@ -376,14 +384,16 @@ var NamespaceCatalog = class {
     }
     return [...byStorageDir.values()];
   }
-  async loadSanitizedRecords() {
-    const records = await this.loadCompacted();
-    const sanitized = await Promise.all(
-      [...records.values()].map((r) => this.sanitizeRecordForRead(r))
-    );
-    return this.dropDuplicateStorageRootAliases(
-      sanitized.filter((r) => r !== null)
-    );
+  loadSanitizedRecords() {
+    return this.queueCritical(async () => {
+      const records = await this.loadCompacted();
+      const sanitized = await Promise.all(
+        [...records.values()].map((r) => this.sanitizeRecordForRead(r))
+      );
+      return this.dropDuplicateStorageRootAliases(
+        sanitized.filter((r) => r !== null)
+      );
+    });
   }
   async listNamespaces(filter) {
     if (!this.enabled) return [];
@@ -1040,7 +1050,7 @@ var NamespaceCatalog = class {
    */
   async finishRebuild(rebuilt, skipped, dryRun, canMutate, memoryReal, nowIso) {
     if (canMutate) {
-      const latest = await this.loadCompacted();
+      const latest = await this.loadCompacted(true);
       for (const [ns, fresh] of latest) {
         const current = rebuilt.get(ns);
         if (!current) {
@@ -1168,36 +1178,71 @@ var NamespaceCatalog = class {
   }
   // ── Persistence ──────────────────────────────────────────────────────────
   /** Load the JSONL log and fold it into current state (last-record-wins). */
-  async loadCompacted() {
+  async loadCompacted(forceFresh = false) {
     const records = /* @__PURE__ */ new Map();
-    let raw;
+    let handle;
     try {
-      raw = await readFile(this.catalogPath, "utf8");
+      handle = await open(this.catalogPath, "r");
     } catch {
+      this.compactedCache = void 0;
       return records;
     }
-    for (const line of raw.split("\n")) {
-      const trimmed = line.trim();
-      if (trimmed.length === 0) continue;
-      let parsed;
-      try {
-        parsed = JSON.parse(trimmed);
-      } catch {
-        continue;
+    let identity;
+    try {
+      const fileStat = await handle.stat();
+      identity = {
+        size: fileStat.size,
+        mtimeMs: fileStat.mtimeMs,
+        ctimeMs: fileStat.ctimeMs,
+        ino: fileStat.ino
+      };
+      if (!forceFresh && this.compactedCache && this.compactedCache.identity.size === identity.size && this.compactedCache.identity.mtimeMs === identity.mtimeMs && this.compactedCache.identity.ctimeMs === identity.ctimeMs && this.compactedCache.identity.ino === identity.ino) {
+        await handle.close().catch(() => void 0);
+        return this.cloneCompactedRecords(this.compactedCache.records);
       }
-      const record = coerceRecord(parsed);
-      if (!record) continue;
-      const prior = records.get(record.namespace);
-      records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
+    } catch {
     }
-    return records;
+    try {
+      this.onCatalogReadForTest?.();
+      const raw = await handle.readFile("utf8");
+      for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.length === 0) continue;
+        let parsed;
+        try {
+          parsed = JSON.parse(trimmed);
+        } catch {
+          continue;
+        }
+        const record = coerceRecord(parsed);
+        if (!record) continue;
+        const prior = records.get(record.namespace);
+        records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
+      }
+    } catch {
+      this.compactedCache = void 0;
+      return /* @__PURE__ */ new Map();
+    } finally {
+      await handle.close().catch(() => void 0);
+    }
+    this.compactedCache = identity ? { identity, records } : void 0;
+    return this.cloneCompactedRecords(records);
+  }
+  cloneCompactedRecords(records) {
+    return new Map(
+      [...records].map(([namespace, record]) => [
+        namespace,
+        {
+          ...record,
+          lastMaintenanceAt: record.lastMaintenanceAt ? { ...record.lastMaintenanceAt } : void 0
+        }
+      ])
+    );
   }
   /**
    * Serialize an arbitrary read-modify-write critical section through the single
-   * per-instance chain. Every catalog mutation (touch read+merge+append, full
-   * rewrite) runs through this so they are mutually exclusive: a touch always
-   * reads the latest persisted state before appending, and a rebuild rewrite
-   * cannot interleave with a touch's append.
+   * per-instance chain. Every catalog mutation and cached catalog read runs
+   * through this queue, so cache validation and updates cannot race in-process.
    *
    * Issue #1524 adoption: delegates to the shared `MutationSerializer` (stored
    * as `criticalSection`). The util owns the rejection-recovery invariant
@@ -1217,8 +1262,13 @@ var NamespaceCatalog = class {
    */
   async appendUnchained(record) {
     const line = serializeRecord(record) + "\n";
+    const lineByteLength = Buffer.byteLength(line, "utf8");
     await mkdir(this.stateDir, { recursive: true });
     await appendFile(this.catalogPath, line, "utf8");
+    if (this.onAfterCatalogAppendForTest) {
+      await this.onAfterCatalogAppendForTest();
+    }
+    await this.refreshCacheAfterAppend(record, lineByteLength);
   }
   /**
    * Atomic temp-file + rename rewrite (CLAUDE.md rule #54: write temp, then
@@ -1234,6 +1284,48 @@ var NamespaceCatalog = class {
     const tmp = `${this.catalogPath}.${process.pid}.${Date.now()}.tmp`;
     await writeFile(tmp, body, "utf8");
     await rename(tmp, this.catalogPath);
+    await this.refreshCacheIdentity(new Map(records.map((record) => [record.namespace, record])));
+  }
+  async refreshCacheAfterAppend(record, lineByteLength) {
+    const cached = this.compactedCache;
+    if (!cached) return;
+    const expectedSize = cached.identity.size + lineByteLength;
+    try {
+      const fileStat = await stat(this.catalogPath);
+      if (fileStat.size !== expectedSize || fileStat.ino !== cached.identity.ino) {
+        this.compactedCache = void 0;
+        return;
+      }
+      const prior = cached.records.get(record.namespace);
+      cached.records.set(record.namespace, prior ? mergeNewerTouchFields(record, prior) : record);
+      this.compactedCache = {
+        identity: {
+          size: fileStat.size,
+          mtimeMs: fileStat.mtimeMs,
+          ctimeMs: fileStat.ctimeMs,
+          ino: fileStat.ino
+        },
+        records: cached.records
+      };
+    } catch {
+      this.compactedCache = void 0;
+    }
+  }
+  async refreshCacheIdentity(records) {
+    try {
+      const fileStat = await stat(this.catalogPath);
+      this.compactedCache = {
+        identity: {
+          size: fileStat.size,
+          mtimeMs: fileStat.mtimeMs,
+          ctimeMs: fileStat.ctimeMs,
+          ino: fileStat.ino
+        },
+        records
+      };
+    } catch {
+      this.compactedCache = void 0;
+    }
   }
 };
 function isPathInside(root, child) {
@@ -1243,13 +1335,13 @@ function isPathInside(root, child) {
 
 // src/maintenance/namespace-planner.ts
 import { createHash, randomUUID } from "crypto";
-import { lstat as lstat2, mkdir as mkdir2, open, readFile as readFile2, readdir as readdir2, rename as rename2, rm, rmdir, utimes, writeFile as writeFile2 } from "fs/promises";
+import { lstat as lstat2, mkdir as mkdir2, open as open2, readFile, readdir as readdir2, rename as rename2, rm, rmdir, utimes, writeFile as writeFile2 } from "fs/promises";
 import path2 from "path";
 var DEFAULT_MAX_NAMESPACES_PER_CYCLE = 20;
 var DEFAULT_LOCK_STALE_MS = 10 * 6e4;
 var LOCK_BASE = "maintenance-locks";
 var STATUS_BASE = "namespace-maintenance-status";
-var namespaceMaintenanceFs = { open, rm };
+var namespaceMaintenanceFs = { open: open2, rm };
 function inferConfiguredKind(config, namespace) {
   if (namespace === config.defaultNamespace.trim()) return "default";
   if (namespace === config.sharedNamespace.trim()) return "shared";
@@ -1516,7 +1608,7 @@ async function tryAcquireNamespaceMaintenanceLock(config, jobName, namespace) {
       path: filePath,
       async touch() {
         try {
-          const parsed = JSON.parse(await readFile2(ownerPath, "utf8"));
+          const parsed = JSON.parse(await readFile(ownerPath, "utf8"));
           if (parsed.lockId === lockId) {
             const now = /* @__PURE__ */ new Date();
             await utimes(ownerPath, now, now);
@@ -1527,7 +1619,7 @@ async function tryAcquireNamespaceMaintenanceLock(config, jobName, namespace) {
       },
       async release() {
         try {
-          const parsed = JSON.parse(await readFile2(ownerPath, "utf8"));
+          const parsed = JSON.parse(await readFile(ownerPath, "utf8"));
           if (parsed.lockId === lockId) {
             await namespaceMaintenanceFs.rm(ownerPath, { force: true });
             await rmdir(filePath).catch(() => void 0);
@@ -1607,7 +1699,7 @@ async function readLatestStatusAtByNamespace(config, jobName) {
 }
 async function readStatusFile(filePath) {
   try {
-    const parsed = JSON.parse(await readFile2(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile(filePath, "utf8"));
     return parseStatus(parsed);
   } catch {
     return null;
@@ -1950,4 +2042,4 @@ export {
   runNamespaceMaintenancePlan,
   runNamespaceMaintenanceBatchPlan
 };
-//# sourceMappingURL=chunk-6CUUFFU7.js.map
+//# sourceMappingURL=chunk-HP23UD6W.js.map