@remnic/core 9.57.4 → 9.57.6

package/src/chunking.ts

@@ -47,51 +47,136 @@ function estimateTokens(text: string): number {
 
 /**
  * Split text into sentences.
- * Handles common abbreviations and edge cases.
+ *
+ * The scan stays linear and does not use a backtracking regular expression.
+ * ASCII punctuation keeps its old whitespace rule. Unicode terminators also
+ * split when the next sentence starts immediately, as in CJK text.
  */
-function splitSentences(text: string): string[] {
-  // Split on sentence-ending punctuation (. ! ?) that is followed by whitespace
-  // or end of string; the punctuation stays with the sentence.
-  //
-  // Implemented as a single linear scan rather than a regex. Every regex form of
-  // this split is either polynomial (CodeQL js/polynomial-redos) or — once
-  // bounded/anchored to satisfy CodeQL — mishandles long runs or non-boundary
-  // punctuation (a global match silently drops a skipped prefix; a sticky match
-  // stops at the first interior `.` that is not a real boundary, e.g. "v1.2.3"
-  // or "example.com", emitting the whole document as one chunk). A character
-  // scan is O(n), allocation-free, drops nothing, and treats interior
-  // punctuation correctly. Normal prose splits identically to the previous
-  // /[^.!?]*[.!?]+(?:\s+|$)/g form.
-  const sentences: string[] = [];
+const UNICODE_SENTENCE_TERMINATORS = "。．！？؟۔।॥｡…";
+const ASCII_SENTENCE_TERMINATORS = ".!?";
+const CJK_NO_SPACE_TERMINATORS = "。．！？｡";
+const CLOSING_PUNCTUATION = "\"'”’»」』）］】〉》)]}";
+const DIGITS = "0123456789０１２３４５６７８９";
+const SENTENCE_SEGMENTER =
+  typeof Intl.Segmenter === "function"
+    ? new Intl.Segmenter(undefined, { granularity: "sentence" })
+    : undefined;
+
+function isSentenceTerminator(character: string): boolean {
+  return (
+    ASCII_SENTENCE_TERMINATORS.includes(character) ||
+    UNICODE_SENTENCE_TERMINATORS.includes(character)
+  );
+}
+
+function isCjk(character: string): boolean {
+  return /[\u3000-\u9fff\uf900-\ufaff\uac00-\ud7af]/u.test(character);
+}
+
+type SentenceList = string[] & { separators: string[] };
+
+function splitSentencesFallback(text: string): SentenceList {
+  const sentences = [] as unknown as SentenceList;
+  Object.defineProperty(sentences, "separators", {
+    value: [],
+    writable: true,
+  });
   let start = 0;
+  let separator = "";
   for (let i = 0; i < text.length; i++) {
     const ch = text[i];
-    if (ch !== "." && ch !== "!" && ch !== "?") continue;
-    // Consume a run of terminators (e.g. "?!", "...").
+    if (!isSentenceTerminator(ch)) continue;
+
     let end = i;
-    while (end + 1 < text.length) {
-      const n = text[end + 1];
-      if (n !== "." && n !== "!" && n !== "?") break;
+    let hasUnicodeTerminator = UNICODE_SENTENCE_TERMINATORS.includes(ch);
+    while (end + 1 < text.length && isSentenceTerminator(text[end + 1])) {
+      end++;
+      hasUnicodeTerminator ||= UNICODE_SENTENCE_TERMINATORS.includes(text[end]);
+    }
+
+    const isFullwidthDecimal =
+      ch === "．" &&
+      DIGITS.includes(text[i - 1] ?? "") &&
+      DIGITS.includes(text[end + 1] ?? "");
+    while (end + 1 < text.length && CLOSING_PUNCTUATION.includes(text[end + 1])) {
       end++;
     }
+
     const after = text[end + 1];
-    // A real boundary only if the terminator run ends the string or is followed
-    // by whitespace. Interior punctuation (no following whitespace) is left in
-    // place and the scan continues.
-    if (after === undefined || /\s/.test(after)) {
+    const boundary =
+      !isFullwidthDecimal &&
+      (hasUnicodeTerminator || after === undefined || /\s/u.test(after));
+    if (boundary) {
       const sentence = text.slice(start, end + 1).trim();
-      if (sentence.length > 0) sentences.push(sentence);
-      start = end + 1;
+      if (sentence.length > 0) {
+        sentences.push(sentence);
+        if (sentences.length > 1) sentences.separators.push(separator);
+      }
+      let nextStart = end + 1;
+      while (nextStart < text.length && /\s/u.test(text[nextStart])) nextStart++;
+      separator = text.slice(end + 1, nextStart);
+      start = nextStart;
     }
     i = end;
   }
-  // Trailing text without a closing terminator.
-  if (start < text.length) {
-    const remaining = text.slice(start).trim();
-    if (remaining.length > 0) sentences.push(remaining);
+
+  const remaining = text.slice(start).trim();
+  if (remaining.length > 0) {
+    sentences.push(remaining);
+    if (sentences.length > 1) sentences.separators.push(separator);
   }
   return sentences;
 }
+export function splitSentences(text: string): string[] {
+  const canUseSegmenter =
+    SENTENCE_SEGMENTER !== undefined &&
+    !/\s/u.test(text) &&
+    [...text].some((character) => UNICODE_SENTENCE_TERMINATORS.includes(character));
+  if (canUseSegmenter) {
+    const segments = Array.from(SENTENCE_SEGMENTER.segment(text), ({ segment }) =>
+      segment.trim(),
+    ).filter((segment) => segment.length > 0) as SentenceList;
+    if (
+      segments.length > 1 &&
+      segments.slice(0, -1).every((segment) =>
+        [...segment].some((character) =>
+          UNICODE_SENTENCE_TERMINATORS.includes(character),
+        ),
+      )
+    ) {
+      Object.defineProperty(segments, "separators", {
+        value: Array(segments.length - 1).fill(""),
+        writable: true,
+      });
+      return segments;
+    }
+  }
+  return splitSentencesFallback(text);
+}
+
+function endsWithoutSpace(text: string): boolean {
+  let index = text.length - 1;
+  while (index >= 0 && CLOSING_PUNCTUATION.includes(text[index])) index--;
+  const terminator = text[index] ?? "";
+  if (CJK_NO_SPACE_TERMINATORS.includes(terminator)) {
+    return isCjk(text[index - 1] ?? "");
+  }
+  return terminator === "…" && isCjk(text[index - 1] ?? "");
+}
+export function joinSentences(sentences: string[]): string {
+  let result = "";
+  const separators = (sentences as Partial<SentenceList>).separators;
+  for (let i = 0; i < sentences.length; i++) {
+    const sentence = sentences[i];
+    if (result.length > 0) {
+      const separator = separators?.[i - 1];
+      result += separator ?? (endsWithoutSpace(result) ? "" : " ");
+    }
+    result += sentence;
+  }
+  return result;
+}
+
 
 /**
  * Chunk content into overlapping segments at sentence boundaries.
@@ -152,7 +237,7 @@ export function chunkContent(
 
     if (atTarget || isLastSentence) {
       // Create chunk from accumulated sentences
-      const chunkContent = currentChunkSentences.join(" ");
+      const chunkContent = joinSentences(currentChunkSentences);
       chunks.push({
         content: chunkContent,
         index: chunkIndex,
@@ -216,14 +301,14 @@ export function reassembleChunks(chunks: string[]): string {
       const prevEnd = prevSentences.slice(-(j + 1));
       const currStart = currSentences.slice(0, j + 1);
 
-      if (prevEnd.join(" ") === currStart.join(" ")) {
+      if (joinSentences(prevEnd) === joinSentences(currStart)) {
         overlapCount = j + 1;
       }
     }
 
     // Add non-overlapping portion
     if (overlapCount > 0 && overlapCount < currSentences.length) {
-      result.push(currSentences.slice(overlapCount).join(" "));
+      result.push(joinSentences(currSentences.slice(overlapCount)));
     } else if (overlapCount === 0) {
       // No detected overlap, add full chunk
       result.push(currChunk);
@@ -231,5 +316,5 @@ export function reassembleChunks(chunks: string[]): string {
     // If overlapCount === currSentences.length, skip (fully contained)
   }
 
-  return result.join(" ");
+  return joinSentences(result);
 }

package/src/namespaces/catalog.ts

@@ -19,7 +19,7 @@ import {
   withHeldFileLock,
 } from "../utils/serialize-mutations.js";
 import { isSafeRouteNamespace } from "../routing/engine.js";
-import { namespaceIdentityFromToken, namespaceIdentityToken, normalizeNamespaceIdentity } from "./identity.js";
+import { namespaceIdentityFromToken, namespaceIdentityLegacyToken, namespaceIdentityToken, normalizeNamespaceIdentity } from "./identity.js";
 import { resolveDefaultNamespaceRoot, resolveNamespaceStorageRoot } from "./storage.js";
 import { ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
 
@@ -1721,8 +1721,7 @@ export class NamespaceCatalog {
     // sourced from their tokenized dir so a later legacy-named `readdir` entry
     // cannot overwrite the tokenized record (and vice-versa: a tokenized entry
     // always wins over a previously-set legacy one).
-    const scannedFromTokenized = new Set<string>();
-
+    const scannedFromTokenized = new Map<string, number>();
     for (const entry of entries) {
       const token = entry.name;
       const fullPath = path.join(namespacesDir, token);
@@ -1798,7 +1797,7 @@ export class NamespaceCatalog {
       const tokenDecoded = literalOwnsRoot ? null : namespaceIdentityFromToken(token);
       const rawDecoded = tokenDecoded && tokenDecoded.length > 0 ? tokenDecoded : token;
       const decoded = normalizeNamespaceIdentity(rawDecoded);
-      if (decoded.length === 0 || rawDecoded !== decoded) {
+      if (decoded.length === 0 || (rawDecoded !== decoded && rawDecoded.normalize("NFC") !== decoded)) {
         skipped.push({ token, reason: "unsafe", detail: rawDecoded });
         continue;
       }
@@ -1841,11 +1840,12 @@ export class NamespaceCatalog {
       // is the on-disk dir name; it is the tokenized dir iff it equals the
       // namespace's identity token. If we already recorded this namespace from
       // its tokenized dir, a later legacy-named entry must not clobber it.
-      const isTokenizedEntry = token === namespaceIdentityToken(decoded);
-      if (rebuilt.has(decoded) && scannedFromTokenized.has(decoded) && !isTokenizedEntry) {
-        continue;
-      }
-      if (isTokenizedEntry) scannedFromTokenized.add(decoded);
+      const canonicalToken = namespaceIdentityToken(decoded);
+      const legacyToken = namespaceIdentityLegacyToken(decoded.normalize("NFD"));
+      const tokenKind = token === canonicalToken ? 2 : token === legacyToken ? 1 : 0;
+      const priorTokenKind = scannedFromTokenized.get(decoded) ?? 0;
+      if (rebuilt.has(decoded) && priorTokenKind > tokenKind) continue;
+      if (tokenKind > 0) scannedFromTokenized.set(decoded, tokenKind);
 
       const prior = existing.get(decoded);
       rebuilt.set(

package/src/namespaces/identity.ts

@@ -1,14 +1,21 @@
 export function normalizeNamespaceIdentity(namespace: string | null | undefined): string {
-  return namespace?.trim() ?? "";
+  return namespace?.trim().normalize("NFC") ?? "";
 }
 
-export function namespaceIdentityToken(namespace: string): string {
-  const normalized = normalizeNamespaceIdentity(namespace);
-  const bytes = new TextEncoder().encode(normalized);
+function encodeNamespaceIdentityToken(namespace: string): string {
+  const bytes = new TextEncoder().encode(namespace);
   const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
   return `ns-${hex || "default"}`;
 }
 
+export function namespaceIdentityToken(namespace: string): string {
+  return encodeNamespaceIdentityToken(normalizeNamespaceIdentity(namespace));
+}
+
+export function namespaceIdentityLegacyToken(namespace: string): string {
+  return encodeNamespaceIdentityToken(namespace.trim());
+}
+
 export function namespaceIdentityFromToken(token: string): string | null {
   if (!token.startsWith("ns-")) return null;
   const hex = token.slice(3);
@@ -17,7 +24,9 @@ export function namespaceIdentityFromToken(token: string): string | null {
     return null;
   }
   const decoded = Buffer.from(hex, "hex").toString("utf8");
-  return namespaceIdentityToken(decoded).toLowerCase() === token.toLowerCase()
-    ? decoded
+  const normalized = normalizeNamespaceIdentity(decoded);
+  return namespaceIdentityToken(decoded).toLowerCase() === token.toLowerCase() ||
+    namespaceIdentityLegacyToken(decoded).toLowerCase() === token.toLowerCase()
+    ? normalized
     : null;
 }

package/src/namespaces/principal.test.ts

@@ -12,8 +12,8 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { canReadNamespace, isNamespacePolicyCovered, resolvePrincipal } from "./principal.js";
 import type { PluginConfig } from "../types.js";
+import { canReadNamespace, canWriteNamespace, isNamespacePolicyCovered, resolvePrincipal } from "./principal.js";
 
 // ──────────────────────────────────────────────────────────────────────────
 // Helpers
@@ -285,3 +285,12 @@ test("isNamespacePolicyCovered: an explicit default-namespace policy overrides t
   const grantedDefault = makeConfig(true, [{ name: "default", readPrincipals: [], writePrincipals: ["alice"] }]);
   assert.equal(isNamespacePolicyCovered("default", grantedDefault), true);
 });
+
+test("namespace ACL matches canonically equivalent Unicode identities", () => {
+  const config = makeConfig(true, [
+    { name: "Cafe\u0301", readPrincipals: ["reader"], writePrincipals: ["writer"] },
+  ]);
+
+  assert.equal(canReadNamespace("reader", "Café", config), true);
+  assert.equal(canWriteNamespace("writer", "Café", config), true);
+});

package/src/namespaces/principal.ts

@@ -1,7 +1,7 @@
 import { resolveNamespaceCapabilities } from "../capabilities.js";
 import type { PluginConfig } from "../types.js";
 import { isLikelyUnsafeRegex } from "../routing/engine.js";
-
+import { normalizeNamespaceIdentity } from "./identity.js";
 const MAX_REGEX_SESSION_KEY_LENGTH = 512;
 
 function compileSafePrincipalRegex(pattern: string): RegExp | null {
@@ -54,16 +54,21 @@ export function resolvePrincipal(sessionKey: string | undefined, config: PluginC
 export function canReadNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {
   if (!resolveNamespaceCapabilities(config).namespaces) return true;
   if (!principal) return false;
-  const policy = config.namespacePolicies.find((p) => p.name === namespace);
-  if (!policy) return namespace === config.defaultNamespace || namespace === config.sharedNamespace;
+  const identity = normalizeNamespaceIdentity(namespace);
+  const policy = config.namespacePolicies.find((p) => normalizeNamespaceIdentity(p.name) === identity);
+  if (!policy) {
+    return identity === normalizeNamespaceIdentity(config.defaultNamespace) ||
+      identity === normalizeNamespaceIdentity(config.sharedNamespace);
+  }
   return policy.readPrincipals.includes(principal) || policy.readPrincipals.includes("*");
 }
 
 export function canWriteNamespace(principal: string | undefined, namespace: string, config: PluginConfig): boolean {
   if (!resolveNamespaceCapabilities(config).namespaces) return true;
   if (!principal) return false;
-  const policy = config.namespacePolicies.find((p) => p.name === namespace);
-  if (!policy) return namespace === config.defaultNamespace;
+  const identity = normalizeNamespaceIdentity(namespace);
+  const policy = config.namespacePolicies.find((p) => normalizeNamespaceIdentity(p.name) === identity);
+  if (!policy) return identity === normalizeNamespaceIdentity(config.defaultNamespace);
   return policy.writePrincipals.includes(principal) || policy.writePrincipals.includes("*");
 }
 
@@ -87,8 +92,9 @@ export function isNamespacePolicyCovered(namespace: string, config: PluginConfig
   // An explicit policy wins over the default fallback (exactly as
   // canWriteNamespace), so a policy naming the default with no writers is NOT
   // covered. Only fall back to defaultNamespace when no policy matches.
-  const policy = config.namespacePolicies.find((p) => p.name === namespace);
-  if (!policy) return namespace === config.defaultNamespace;
+  const identity = normalizeNamespaceIdentity(namespace);
+  const policy = config.namespacePolicies.find((p) => normalizeNamespaceIdentity(p.name) === identity);
+  if (!policy) return identity === normalizeNamespaceIdentity(config.defaultNamespace);
   return policy.writePrincipals.some((w) => w.trim().length > 0);
 }
 
@@ -102,8 +108,10 @@ export function isNamespacePolicyCovered(namespace: string, config: PluginConfig
 export function defaultNamespaceForPrincipal(principal: string | undefined, config: PluginConfig): string {
   if (!resolveNamespaceCapabilities(config).namespaces) return config.defaultNamespace;
   if (!principal) return config.defaultNamespace;
-  const exists = config.namespacePolicies.some((p) => p.name === principal);
-  return exists ? principal : config.defaultNamespace;
+  const policy = config.namespacePolicies.find(
+    (p) => normalizeNamespaceIdentity(p.name) === normalizeNamespaceIdentity(principal),
+  );
+  return policy ? normalizeNamespaceIdentity(policy.name) : config.defaultNamespace;
 }
 
 export function recallNamespacesForPrincipal(principal: string | undefined, config: PluginConfig): string[] {

package/src/namespaces/scope-profiles.ts

@@ -12,7 +12,12 @@ import type {
   ScopeProfilePromotionTarget,
   ScopeTeamConfig,
 } from "../types.js";
-import { canReadNamespace, canWriteNamespace, defaultNamespaceForPrincipal } from "./principal.js";
+import {
+  canReadNamespace,
+  canWriteNamespace,
+  defaultNamespaceForPrincipal,
+} from "./principal.js";
+import { normalizeNamespaceIdentity } from "./identity.js";
 
 type ScopeProfileCodingOverlay = Pick<CodingNamespaceOverlay, "namespace" | "readFallbacks">;
 
@@ -65,19 +70,28 @@ function principalListed(list: string[], principal: string | undefined): boolean
 }
 
 function derivedScopeProfileSelfNamespace(principal: string | undefined, config: PluginConfig): string | null {
-  if (!principal || principal === config.defaultNamespace || principal === config.sharedNamespace) return null;
+  if (
+    !principal ||
+    normalizeNamespaceIdentity(principal) === normalizeNamespaceIdentity(config.defaultNamespace) ||
+    normalizeNamespaceIdentity(principal) === normalizeNamespaceIdentity(config.sharedNamespace)
+  ) {
+    return null;
+  }
   if (isSafeRouteNamespace(principal)) return principal;
   return "principal-" + createHash("sha256").update(principal).digest("hex").slice(0, 54);
 }
 
 function scopeProfileSelfNamespace(principal: string | undefined, config: PluginConfig): string {
   const existing = defaultNamespaceForPrincipal(principal, config);
-  if (existing !== config.defaultNamespace) return existing;
+  if (normalizeNamespaceIdentity(existing) !== normalizeNamespaceIdentity(config.defaultNamespace)) return existing;
   return derivedScopeProfileSelfNamespace(principal, config) ?? existing;
 }
 
 function hasExplicitNamespacePolicy(namespace: string, config: PluginConfig): boolean {
-  return (config.namespacePolicies ?? []).some((policy) => policy.name === namespace);
+  const identity = normalizeNamespaceIdentity(namespace);
+  return (config.namespacePolicies ?? []).some(
+    (policy) => normalizeNamespaceIdentity(policy.name) === identity,
+  );
 }
 
 function isScopeProfileImplicitSelfNamespace(
@@ -88,9 +102,9 @@ function isScopeProfileImplicitSelfNamespace(
   const derived = derivedScopeProfileSelfNamespace(principal, config);
   return Boolean(
     derived &&
-      namespace === derived &&
-      namespace !== config.defaultNamespace &&
-      namespace !== config.sharedNamespace &&
+      normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(derived) &&
+      normalizeNamespaceIdentity(namespace) !== normalizeNamespaceIdentity(config.defaultNamespace) &&
+      normalizeNamespaceIdentity(namespace) !== normalizeNamespaceIdentity(config.sharedNamespace) &&
       isSafeRouteNamespace(namespace) &&
       !hasExplicitNamespacePolicy(namespace, config),
   );
@@ -297,16 +311,24 @@ function resolveLayer(params: {
   const userProjectBase = namespace.endsWith(userProjectSuffix)
     ? namespace.slice(0, -userProjectSuffix.length)
     : "";
+  const userProjectBaseIdentity = normalizeNamespaceIdentity(userProjectBase);
+  const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
+  const sharedIdentity = normalizeNamespaceIdentity(config.sharedNamespace);
+  const namespaceIdentity = normalizeNamespaceIdentity(namespace);
   const dynamicUserProjectCollision =
     userProjectBase.length > 0 &&
-    (userProjectBase === config.defaultNamespace ||
-      userProjectBase === config.sharedNamespace ||
-      (config.namespacePolicies ?? []).some((policy) => policy.name === userProjectBase));
+    (userProjectBaseIdentity === defaultIdentity ||
+      userProjectBaseIdentity === sharedIdentity ||
+      (config.namespacePolicies ?? []).some(
+        (policy) => normalizeNamespaceIdentity(policy.name) === userProjectBaseIdentity,
+      ));
   const protectedNamespace =
-    namespace === config.defaultNamespace ||
-    namespace === config.sharedNamespace ||
+    namespaceIdentity === defaultIdentity ||
+    namespaceIdentity === sharedIdentity ||
     dynamicUserProjectCollision ||
-    (config.namespacePolicies ?? []).some((policy) => policy.name === namespace);
+    (config.namespacePolicies ?? []).some(
+      (policy) => normalizeNamespaceIdentity(policy.name) === namespaceIdentity,
+    );
   const policyReadable = !protectedNamespace || canReadNamespace(principal, namespace, config);
   const policyWritable = !protectedNamespace || canWriteNamespace(principal, namespace, config);
   const policyBlocked = protectedNamespace && (!policyReadable || !policyWritable);

package/src/namespaces/storage.ts

@@ -6,7 +6,11 @@ import { StorageManager } from "../storage.js";
 import { keyring, secureStoreDir } from "../secure-store/index.js";
 import type { PluginConfig } from "../types.js";
 import { ALL_CATEGORY_DIRS } from "../utils/category-dir.js";
-import { namespaceIdentityToken, normalizeNamespaceIdentity } from "./identity.js";
+import {
+  namespaceIdentityLegacyToken,
+  namespaceIdentityToken,
+  normalizeNamespaceIdentity,
+} from "./identity.js";
 import type { NamespaceCatalog } from "./catalog.js";
 import { MutationSerializer } from "../utils/serialize-mutations.js";
 
@@ -153,19 +157,43 @@ export async function resolveDefaultNamespaceRoot(config: PluginConfig): Promise
   // back to memoryDir/tokenized. `namespaceIdentityToken` already normalizes
   // internally, so the tokenized path is unaffected.
   const defaultIdentity = normalizeNamespaceIdentity(config.defaultNamespace);
+  const defaultNfdIdentity = defaultIdentity.normalize("NFD");
   const legacyNsDir = resolveNamespaceDir(config.memoryDir, defaultIdentity);
+  const legacyNfdNsDir = resolveNamespaceDir(config.memoryDir, defaultNfdIdentity);
   const tokenizedNsDir = resolveNamespaceDir(
     config.memoryDir,
-    namespaceIdentityToken(config.defaultNamespace),
+    namespaceIdentityToken(defaultIdentity),
+  );
+  const legacyTokenNsDir = resolveNamespaceDir(
+    config.memoryDir,
+    namespaceIdentityLegacyToken(defaultNfdIdentity),
   );
   const tokenizedHasData =
     (await exists(tokenizedNsDir)) &&
     (await hasAnyNamespaceStorageMarker(tokenizedNsDir, { includeRuntimeState: true }));
+  const legacyTokenHasData =
+    (await exists(legacyTokenNsDir)) &&
+    (await hasAnyNamespaceStorageMarker(legacyTokenNsDir, { includeRuntimeState: true }));
+  const legacyHasData =
+    (await exists(legacyNsDir)) &&
+    (await hasAnyNamespaceStorageMarker(legacyNsDir, { includeRuntimeState: true }));
+  const legacyNfdHasData =
+    legacyNfdNsDir !== legacyNsDir &&
+    (await exists(legacyNfdNsDir)) &&
+    (await hasAnyNamespaceStorageMarker(legacyNfdNsDir, { includeRuntimeState: true }));
   const nsDir = tokenizedHasData
     ? tokenizedNsDir
-    : (await exists(legacyNsDir))
-      ? legacyNsDir
-      : tokenizedNsDir;
+    : legacyTokenHasData
+      ? legacyTokenNsDir
+      : legacyHasData
+        ? legacyNsDir
+        : legacyNfdHasData
+          ? legacyNfdNsDir
+          : (await exists(legacyNsDir))
+            ? legacyNsDir
+            : legacyNfdNsDir !== legacyNsDir && (await exists(legacyNfdNsDir))
+              ? legacyNfdNsDir
+              : tokenizedNsDir;
   return (await exists(nsDir)) && !(await hasAnyLegacyData(config.memoryDir))
     ? nsDir
     : config.memoryDir;
@@ -192,15 +220,37 @@ export async function resolveNamespaceStorageRoot(
   if (normalizeNamespaceIdentity(namespace) === normalizeNamespaceIdentity(config.defaultNamespace)) {
     return resolveDefaultNamespaceRoot(config);
   }
-  const legacyRoot = resolveNamespaceDir(config.memoryDir, namespace);
-  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(namespace));
-  if (
-    (await exists(tokenizedRoot)) &&
-    (await hasAnyNamespaceStorageMarker(tokenizedRoot, { includeRuntimeState: true }))
-  ) {
-    return tokenizedRoot;
+  const normalized = normalizeNamespaceIdentity(namespace);
+  const legacyExactNamespace = namespace.trim();
+  const legacyNfdNamespace = normalized.normalize("NFD");
+  const legacyRoot = resolveNamespaceDir(config.memoryDir, normalized);
+  const legacyExactRoot =
+    legacyExactNamespace !== normalized && isSafeRouteNamespace(legacyExactNamespace)
+      ? resolveNamespaceDir(config.memoryDir, legacyExactNamespace)
+      : null;
+  const legacyNfdRoot =
+    legacyNfdNamespace !== normalized
+      ? resolveNamespaceDir(config.memoryDir, legacyNfdNamespace)
+      : null;
+  const tokenizedRoot = resolveNamespaceDir(config.memoryDir, namespaceIdentityToken(normalized));
+  const legacyTokenRoots = [
+    namespaceIdentityLegacyToken(legacyExactNamespace),
+    namespaceIdentityLegacyToken(legacyNfdNamespace),
+  ]
+    .filter((token, index, tokens) => tokens.indexOf(token) === index)
+    .map((token) => resolveNamespaceDir(config.memoryDir, token));
+  for (const candidate of [tokenizedRoot, ...legacyTokenRoots]) {
+    if (
+      (await exists(candidate)) &&
+      (await hasAnyNamespaceStorageMarker(candidate, { includeRuntimeState: true }))
+    ) {
+      return candidate;
+    }
+  }
+  for (const candidate of [legacyRoot, legacyExactRoot, legacyNfdRoot]) {
+    if (candidate && (await exists(candidate))) return candidate;
   }
-  return (await exists(legacyRoot)) ? legacyRoot : tokenizedRoot;
+  return tokenizedRoot;
 }
 
 export class NamespaceStorageRouter {

package/src/namespaces/unicode-routing.test.ts

@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import type { PluginConfig } from "../types.js";
+import { NamespaceCatalog } from "./catalog.js";
+import { namespaceIdentityFromToken, namespaceIdentityLegacyToken, namespaceIdentityToken } from "./identity.js";
+import { resolveDefaultNamespaceRoot, resolveNamespaceStorageRoot } from "./storage.js";
+
+function makeConfig(memoryDir: string): PluginConfig {
+  return {
+    memoryDir,
+    namespacesEnabled: true,
+    namespaceCatalogEnabled: true,
+    defaultNamespace: "default",
+    sharedNamespace: "shared",
+    namespacePolicies: [],
+    entitySchemas: {},
+  } as unknown as PluginConfig;
+}
+
+test("Unicode namespaces decode from disk and list in stable order", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-unicode-routing-"));
+  try {
+    const config = makeConfig(memoryDir);
+    const catalog = new NamespaceCatalog(config);
+    const cjk = "项目";
+    const ascii = "alpha";
+
+    assert.equal(namespaceIdentityFromToken(namespaceIdentityToken(cjk)), cjk);
+    assert.equal(namespaceIdentityToken("Cafe\u0301"), namespaceIdentityToken("Café"));
+    const nfd = "Café".normalize("NFD");
+    const legacyToken = namespaceIdentityLegacyToken(nfd);
+    assert.equal(namespaceIdentityFromToken(legacyToken), "Café");
+    await mkdir(path.join(memoryDir, "namespaces", legacyToken, "facts"), { recursive: true });
+    assert.equal(
+      await resolveNamespaceStorageRoot(config, "Café"),
+      path.join(memoryDir, "namespaces", legacyToken),
+    );
+    const rebuilt = await catalog.rebuildFromDisk({ dryRun: true });
+    const legacyRecord = rebuilt.records.find((record) => record.namespace === "Café");
+    assert.equal(legacyRecord?.storageDir, path.join(memoryDir, "namespaces", legacyToken));
+    await catalog.markWrite(cjk, { discoveredBy: "write" });
+    await catalog.markWrite(ascii, { discoveredBy: "write" });
+
+    const first = await catalog.listNamespaces();
+    const second = await catalog.listNamespaces();
+    assert.deepEqual(
+      first.map((record) => record.namespace),
+      second.map((record) => record.namespace)
+    );
+    assert.ok(first.some((record) => record.namespace === cjk));
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("default Unicode namespace resolves legacy NFD roots", async () => {
+  const memoryDir = await mkdtemp(path.join(os.tmpdir(), "remnic-unicode-default-"));
+  try {
+    const config = { ...makeConfig(memoryDir), defaultNamespace: "Café" };
+    const nfd = config.defaultNamespace.normalize("NFD");
+    const nfdRoot = path.join(memoryDir, "namespaces", nfd);
+    await mkdir(path.join(nfdRoot, "facts"), { recursive: true });
+    assert.equal(await resolveDefaultNamespaceRoot(config), nfdRoot);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});