@remnic/core 9.69.56 → 9.69.57

package/dist/capsule-crypto-YO5QJ6L3.js

@@ -1,18 +0,0 @@
-import {
-  decryptCapsuleFile,
-  decryptCapsuleFileInMemory,
-  encryptCapsuleFile,
-  isEncryptedCapsuleFile
-} from "./chunk-DQEMWVMT.js";
-import "./chunk-BJMBJZ2Y.js";
-import "./chunk-UKJAGEXH.js";
-import "./chunk-FP2373TW.js";
-import "./chunk-A6XUJE5D.js";
-import "./chunk-PZ5AY32C.js";
-export {
-  decryptCapsuleFile,
-  decryptCapsuleFileInMemory,
-  encryptCapsuleFile,
-  isEncryptedCapsuleFile
-};
-//# sourceMappingURL=capsule-crypto-YO5QJ6L3.js.map

package/dist/catalog-BuMyYPUn.d.ts

@@ -1,473 +0,0 @@
-import { P as PluginConfig } from './types-Du6VdoAg.js';
-
-/**
- * Rebuildable namespace catalog (issue #1499).
- *
- * Purpose: a downstream, rebuildable metadata index that lets Remnic ENUMERATE
- * the configured and dynamically-created namespaces that exist or should be
- * maintained. Filesystem memory remains the single source of truth; the catalog
- * is derived metadata and can always be reconstructed from disk.
- *
- * Storage format: `<memoryDir>/state/namespaces.jsonl` — an append-and-compact
- * JSON-lines log. We chose this over per-namespace sidecar files because:
- *   - touches (markRead/markWrite/markMaintenance) are cheap single appends;
- *   - it is naturally audit-friendly (the raw log preserves touch history);
- *   - a single file makes enumeration trivial (no directory walk per call);
- *   - last-record-wins compaction folds the log into the current state on read,
- *     and `rebuildFromDisk` rewrites it atomically (temp file + rename).
- *
- * SECURITY:
- *   - The catalog stores ONLY metadata (namespace names, kinds, timestamps,
- *     resolved storage dirs). It NEVER holds raw memory content or secrets.
- *   - Catalog presence grants NO authorization. Read/write access still flows
- *     through the namespace policies in `principal.ts`; this module never makes
- *     an access decision.
- *   - All namespace tokens are validated with `isSafeRouteNamespace` (except the
- *     configured default namespace, which is exempt at the routing layer) and
- *     every storage dir is contained under `<memoryDir>/namespaces`.
- *   - `rebuildFromDisk` rejects/reports symlinked roots that escape the memory
- *     root rather than trusting them.
- *
- * LIFECYCLE: catalog write failures must NEVER crash a primary memory op.
- * Callers should wrap touch calls in try/catch (or rely on the internal
- * failure-tolerant append). The internal serialized write chain recovers from
- * rejection so one failed append cannot poison subsequent writes.
- */
-type NamespaceKind = "default" | "shared" | "project" | "branch" | "team-project" | "explicit";
-type NamespaceDiscoverySource = "config" | "write" | "read" | "scan" | "migration";
-interface NamespaceRecord {
-    namespace: string;
-    identityToken: string;
-    kind: NamespaceKind;
-    createdAt: string;
-    lastReadAt?: string;
-    lastWriteAt?: string;
-    lastMaintenanceAt?: Record<string, string>;
-    storageDir: string;
-    discoveredBy: NamespaceDiscoverySource;
-}
-interface NamespaceCatalogFilter {
-    kind?: NamespaceKind;
-    discoveredBy?: NamespaceDiscoverySource;
-    /** Only include namespaces written since this instant (inclusive lower bound). */
-    writtenSince?: Date;
-}
-interface NamespaceTouchMetadata {
-    discoveredBy?: NamespaceDiscoverySource;
-    kind?: NamespaceKind;
-    /** Explicit storage dir (when the caller already resolved it). */
-    storageDir?: string;
-    /** Override the touch timestamp (mainly for tests / migration replay). */
-    at?: Date;
-}
-interface NamespaceCatalogSkippedRoot {
-    token: string;
-    reason: "symlink" | "escape" | "unsafe" | "error";
-    detail?: string;
-}
-interface NamespaceCatalogRebuildResult {
-    dryRun: boolean;
-    records: NamespaceRecord[];
-    /** Roots reported as ambiguous/unsafe rather than silently misclassified. */
-    skipped: NamespaceCatalogSkippedRoot[];
-    /**
-     * Whether the rebuild actually rewrote the on-disk catalog (round 6, codex P2
-     * / cursor Medium — NBn3n/NBsGG). `false` for a dry-run, AND for an `--apply`
-     * that could NOT acquire the cross-process rebuild lock within the bounded wait
-     * (it ran compute-only to avoid clobbering a concurrent lock holder). Callers
-     * (CLI) must NOT report unqualified success when `applied` is false for a
-     * non-dry-run — the catalog was left unchanged and a retry is needed.
-     */
-    applied: boolean;
-}
-declare class NamespaceCatalog {
-    private readonly config;
-    private readonly memoryDir;
-    private readonly stateDir;
-    private readonly catalogPath;
-    private readonly rebuildLockPath;
-    private readonly criticalSection;
-    private compactedCache;
-    protected onTouchCriticalSectionForTest?: () => Promise<void>;
-    protected onCatalogReadForTest?: () => void;
-    protected onAfterCatalogAppendForTest?: () => Promise<void>;
-    protected onRebuildBeforeRenameForTest?: () => Promise<void>;
-    protected onRebuildAfterScanForTest?: () => Promise<void>;
-    protected onBeforeBreakStaleUnlinkForTest?: () => Promise<void>;
-    private readonly defaultNamespaceIdentity;
-    private readonly compactBytesLimit;
-    private readonly readCoalesceMs;
-    private readonly writeCoalesceMs;
-    private lastCompactedSize;
-    private readonly pendingTouches;
-    constructor(config: PluginConfig);
-    /** Whether the catalog is active (namespaces enabled and catalog not opted out). */
-    get enabled(): boolean;
-    /**
-     * Sanitize a record at the enumeration boundary (round 5, cursor Medium + codex
-     * P2; round 6 — NDXHe). Reads return whatever is in `namespaces.jsonl` after
-     * schema checks only, so a tampered or pre-fix row could surface unsafe data to
-     * maintenance/QMD until a rewrite occurs. Two distinct defenses:
-     *
-     *  1. UNSAFE NAMESPACE NAME (NGZqr, codex P2): an unsafe non-default namespace
-     *     (e.g. `../evil`, a name with separators, or >64 chars) is REJECTED outright
-     *     — return `null` so the caller drops it. The disk SCAN and the hot touch
-     *     path both reject such names with the SAME default-exempt `isSafeRouteNamespace`
-     *     gate, so the read boundary MUST agree, or `listNamespaces()`/`getNamespaceRecord()`
-     *     would expose a namespace those paths reject (note `isStorageDirForNamespace`
-     *     can still build a tokenized root even for `../evil`, so storageDir sanitation
-     *     alone does not catch it). The default namespace is exempt (it may be a
-     *     non-route literal), matching every other validation site.
-     *
-     *  2. UNSAFE storageDir: for an otherwise-valid namespace, apply the SAME contract
-     *     as the write path — full containment (`isContainedStorageDir`: lexical +
-     *     symlink/realpath) AND namespace ownership (`isStorageDirForNamespace`). When
-     *     a record fails EITHER check we substitute the trusted resolved-and-safe root
-     *     for that namespace (rule 42: read and write stay symmetric).
-     */
-    private sanitizeRecordForRead;
-    private storageRootOwnershipRank;
-    private configuredNamespaceIdentities;
-    private preferStorageRootOwner;
-    private dropDuplicateStorageRootAliases;
-    private loadSanitizedRecords;
-    listNamespaces(filter?: NamespaceCatalogFilter): Promise<NamespaceRecord[]>;
-    getNamespaceRecord(namespace: string): Promise<NamespaceRecord | null>;
-    markRead(namespace: string, metadata?: NamespaceTouchMetadata): Promise<void>;
-    markWrite(namespace: string, metadata?: NamespaceTouchMetadata): Promise<void>;
-    /**
-     * Route a read/write touch through the per-(namespace, kind) coalescing buffer
-     * (issue #1903). A touch flushes IMMEDIATELY (bypassing the buffer) whenever it
-     * is semantically observable to an in-process reader — first sight of the
-     * namespace, a `config`→`write` provenance upgrade, the first time a touch
-     * field is set (so `listNamespaces({ writtenSince })` and record presence stay
-     * correct), or a change to `kind`/`principal`/`projectId`/`branch`/
-     * `parentNamespace`. A pure timestamp refresh on an already-known record is
-     * DEFERRED and coalesced: the newest buffered `at`/metadata wins and a single
-     * `touch` runs when the window elapses (or on `flushPendingTouches`). Window
-     * `0` skips the buffer entirely (the pre-#1903 immediate-append behavior).
-     * Best-effort: coalescing decisions read only the warm `compactedCache`, never
-     * forcing a disk parse; a cold cache flushes immediately (and re-warms it).
-     */
-    private coalesceTouch;
-    /**
-     * Whether a read/write touch on an EXISTING cached record must flush
-     * immediately rather than coalesce. Only pure timestamp refreshes (the value
-     * returns false) are safe to defer.
-     */
-    private touchMustFlushImmediately;
-    /** Fire a single buffered touch when its coalescing window elapses. */
-    private flushPendingTouch;
-    /**
-     * Flush every buffered coalesced touch now (issue #1903). Called from the
-     * router/orchestrator shutdown hook so a long-lived host does not drop
-     * buffered read/write timestamps on teardown, and by tests to make coalesced
-     * touches deterministically observable. Best-effort: a failed flush never
-     * throws (each touch is `.catch()`-guarded).
-     */
-    flushPendingTouches(): Promise<void>;
-    markMaintenance(namespace: string, jobName: string, at?: Date): Promise<void>;
-    /**
-     * Register namespaces known purely from config (default, shared, explicit
-     * policies). Source `config`. Cheap and idempotent.
-     */
-    registerConfiguredNamespaces(): Promise<void>;
-    /**
-     * Register a namespace whose storage was just resolved by the router. Used as
-     * the router's integration hook (`discoveredBy: config`). Storage dir is
-     * provided so we do not re-resolve it. Failure-tolerant. Returns whether the
-     * registration actually APPENDED (round 6, codex P2 — NEFoX), so the router's
-     * resolve-hook dedup only marks a namespace notified when it truly persisted —
-     * a dropped append (disabled catalog or rebuild-lock-timeout drop) returns
-     * `false` and is retried on the next resolve.
-     */
-    registerResolved(namespace: string, storageDir: string): Promise<boolean>;
-    /**
-     * Generic register/touch without changing read/write timestamps unless the
-     * source implies it. Validates the namespace and resolves a storage dir.
-     * Returns whether the touch actually appended.
-     */
-    private register;
-    private validateNamespace;
-    /**
-     * Resolve the on-disk storage dir for a namespace WITHOUT trusting caller
-     * input. The default namespace may use the legacy memoryDir root; everything
-     * else lives under `<memoryDir>/namespaces/<token>`. Containment is enforced
-     * by rejecting separators/parent-refs in the token.
-     */
-    private resolveStorageDir;
-    private namespaceTokenDir;
-    /**
-     * Whether a candidate storage dir is LEXICALLY contained: it is either the
-     * legacy default root (`memoryDir`) or a strict descendant of
-     * `<memoryDir>/namespaces/`. The router legitimately resolves a namespace to
-     * EITHER the tokenized dir or a legacy raw-name dir under `namespaces/`, so we
-     * accept any contained child rather than a single exact token path. This is a
-     * pure string check — symlink escape is checked separately via realpath.
-     */
-    private isLexicallyContained;
-    /**
-     * Whether a candidate storage dir satisfies the catalog containment contract,
-     * including SYMLINK-escape rejection (round 5, codex P2). A lexically-contained
-     * path that is actually a symlink to an outside directory would let maintenance
-     * or QMD follow it outside `memoryDir`. We mirror `rebuildFromDisk`'s posture:
-     * the path must be lexically contained AND, if it exists on disk, neither the
-     * path itself a symlink nor its realpath escaping the memory root. Non-existent
-     * paths pass the realpath stage (nothing to follow yet) but still must be
-     * lexically contained.
-     */
-    private isContainedStorageDir;
-    /**
-     * Reject a candidate whose path crosses a SYMLINKED ancestor strictly between
-     * memoryDir and the leaf (codex NVuq5). `realpath`-based containment accepts a
-     * symlinked `<memoryDir>/namespaces` that currently resolves back inside
-     * memoryDir, but the disk scanner rejects such a root and a later retarget would
-     * escape the memory tree — so refuse it here too. The leaf itself is
-     * symlink-checked by the caller; this walks only the intermediate ancestors.
-     */
-    private hasSymlinkedAncestor;
-    /**
-     * Walk up from a not-yet-existing candidate to the nearest ancestor that exists
-     * on disk and verify its realpath stays inside `memoryReal` (round 6, codex P2
-     * — NDo79). Rejects a non-existent leaf whose existing parent chain escapes
-     * memoryDir via a symlink. Stops at memoryDir's resolved root.
-     *
-     * The nearest existing ancestor must also be a DIRECTORY (NHIdt, codex P2): if
-     * an existing parent such as `<memoryDir>/namespaces` is a regular FILE (or
-     * socket/fifo), `realpath(parent)` still succeeds and resolves inside memoryDir,
-     * so a containment-only check would ACCEPT a leaf that can never be created — you
-     * cannot mkdir a child under a file. We `lstat` the nearest existing ancestor and
-     * reject when it is not a directory, mirroring the leaf non-directory rejection
-     * (NF21i) and the disk scan, so every containment consumer agrees.
-     */
-    private isNearestExistingAncestorContained;
-    /**
-     * Resolve the storage dir to persist for a touch, validating any caller-
-     * provided `metadata.storageDir` against the catalog containment contract
-     * (round 4 + round 5, codex P2). `markWrite`/`registerResolved` accept an
-     * explicit storageDir, but persisting it verbatim would let a bad hook or
-     * external consumer write an arbitrary path — including one outside `memoryDir`
-     * or a symlink that escapes it — into the catalog, handing maintenance/QMD an
-     * unsafe root. We accept an explicit (or previously-stored) dir ONLY when it
-     * stays contained under memoryDir (lexically AND via realpath); otherwise we
-     * drop it and fall back to the trusted resolved dir.
-     */
-    private resolveTouchStorageDir;
-    /**
-     * Whether `candidate` is a legitimate storage root FOR `namespace` (round 6,
-     * codex P2 — NDATT). Accepts the namespace's router-resolved root, its canonical
-     * lexical tokenized dir, and (for the default namespace only) memoryDir. This
-     * prevents a contained-but-CROSS-NAMESPACE path — another namespace's tree, or
-     * memoryDir for a non-default namespace — from being persisted as this
-     * namespace's root. Compared on resolved (absolute) paths.
-     */
-    private isStorageDirForNamespace;
-    /**
-     * Resolve the canonical storage dir for a namespace as the LIVE ROUTER would,
-     * but NEVER return a path that escapes the memory root.
-     *
-     * Router alignment (round 4, cursor Medium): a read/register touch with no
-     * explicit storageDir previously used the lexical `resolveStorageDir`, which
-     * always picks `<memoryDir>/namespaces/<token>` (or `memoryDir` for the
-     * default). That diverges from `NamespaceStorageRouter`, which can route to a
-     * legacy raw-name dir or a migrated default root — so a recall touch could
-     * record a contained-but-WRONG root that maintenance/rebuild then targets. We
-     * now delegate to the shared `resolveNamespaceStorageRoot` (the very helper the
-     * router uses) so the catalog records the same on-disk root the router serves.
-     *
-     * Containment (round 5, codex P2): the resolved path can still be a symlink
-     * escaping memoryDir, so we run the full (lexical + realpath) containment
-     * contract. When it FAILS we fall back to a NAMESPACE-SPECIFIC safe root, NOT
-     * a blanket `memoryDir`. Recording `memoryDir` for a non-default namespace
-     * would point enumeration/maintenance at the DEFAULT namespace's tree (round 5,
-     * cursor/codex Medium/P2) — a cross-namespace fanout error. The correct safe
-     * root is the namespace's own lexical tokenized dir
-     * (`<memoryDir>/namespaces/<token>`), which is always contained and is that
-     * namespace's canonical location (we record the lexical PATH as metadata; we do
-     * not follow the escaping symlink). Only the default namespace — or a token so
-     * unsafe even the lexical dir cannot be built — falls back to `memoryDir`.
-     */
-    private resolveSafeStorageDir;
-    /**
-     * The namespace-specific contained fallback root, used when the router-resolved
-     * root fails containment (round 5, cursor/codex Medium/P2).
-     *
-     * Preference order:
-     *  1. The namespace's OWN lexical tokenized dir (`namespaces/<token>`) — so a
-     *     non-default namespace is NOT pointed at the DEFAULT namespace's `memoryDir`
-     *     tree (which would misdirect maintenance fanout). Returned only when the
-     *     token dir itself stays CONTAINED (it is not a symlink, and its realpath
-     *     does not escape memoryDir — e.g. via a symlinked `namespaces/` parent).
-     *  2. `memoryDir` as a LAST resort — for the default namespace, an unsafe token
-     *     that cannot build a contained path, OR the irreparable case where the
-     *     token dir's realpath escapes the root (so even its lexical path resolves
-     *     outside). NF21m note (codex P2): we deliberately do NOT record the lexical
-     *     token dir in that irreparable case — its realpath escapes memoryDir, and
-     *     the NDo79 contract REQUIRES that an escaping path is never persisted (a
-     *     later mkdir/maintenance/QMD op would follow it outside the root). Since no
-     *     contained namespace-specific path exists, containment wins: `memoryDir` is
-     *     the only safe root left. A namespace whose token dir's realpath escapes is
-     *     an irreparable on-disk state; recording the contained default root is
-     *     strictly safer than persisting an escaping one. The common case where the
-     *     token dir IS contained is handled by branch 1, so a healthy non-default
-     *     namespace never reaches `memoryDir`.
-     */
-    private safeFallbackStorageDir;
-    /**
-     * Re-check, NOW, whether a namespace's storage root currently EXISTS on disk
-     * with the SAME safety the directory scan uses (NFJV8, codex P2).
-     *
-     * The rebuild's final re-merge runs under the held lock and folds the freshly
-     * re-read log (`latest`) into the scanned `rebuilt` set. A namespace present in
-     * `latest` (a live touch row) but ABSENT from `rebuilt` is normally PURGED as
-     * deleted (the NATqU "disk scan is authoritative" rule). But there is a TOCTOU
-     * window: a dynamic namespace can be CREATED on disk AFTER `rebuildFromDisk()`
-     * already enumerated `namespaces/` but BEFORE this re-merge. The scan snapshot
-     * missed its new root, yet a gateway `markWrite` already appended a row for it.
-     * Blindly purging that row would rewrite the catalog WITHOUT a live namespace
-     * that now has data on disk, so `writtenSince`/maintenance/QMD consumers miss
-     * it until another touch or rebuild.
-     *
-     * So before purging, we re-resolve the namespace's safe storage root (the same
-     * router-aligned, containment-checked path the scan would have catalogued) and
-     * confirm it is a real, contained, non-symlink directory that actually holds
-     * memory data RIGHT NOW. If so the namespace was created-after-scan and is LIVE
-     * — KEEP its row. This is the precise inverse of NATqU and does NOT reintroduce
-     * it: a touch on a REMOVED root re-checks as ABSENT (no data on disk) and is
-     * still purged; only a root that EXISTS on a fresh re-check is kept.
-     *
-     * Mirrors the per-entry scan checks (symlink rejection + realpath containment +
-     * `hasMemoryData`) so a symlinked/escaping root is never resurrected.
-     */
-    private liveStorageRootExistsForRebuild;
-    /**
-     * Record a namespace touch. Returns whether the touch actually APPENDED to the
-     * log (round 6, codex P2 — NEFoX): a disabled catalog or a dropped append (the
-     * NAUf7 rebuild-lock-timeout drop) returns `false`, so callers (e.g. the router
-     * resolve-hook dedup) can avoid marking a dropped registration as completed and
-     * suppressing its retry.
-     */
-    private touch;
-    /**
-     * Fold-and-rewrite the JSONL log when it exceeds `compactBytesLimit`
-     * (issue #1903). MUST be called only from inside `touch`'s held-lock +
-     * `queueCritical` critical section — it reuses `loadCompacted` (last-record-
-     * wins fold; every namespace row survives) and `rewriteUnchained` (atomic
-     * temp-file + rename), so the collapse is cross-process safe and never
-     * invokes the disk-scan purge in `finishRebuild`. Best-effort and fail-open
-     * (rule #40): the append already succeeded and is durable, so a failed
-     * compaction must not fail the touch — the next over-limit touch retries.
-     */
-    private maybeAutoCompact;
-    rebuildFromDisk(options?: {
-        dryRun?: boolean;
-    }): Promise<NamespaceCatalogRebuildResult>;
-    /**
-     * Body of `rebuildFromDisk`, run inside a single `queueCritical` turn. MUST
-     * only be invoked from within the serialized chain so the load and the
-     * rewrite are atomic with respect to concurrent touches (in-process).
-     *
-     * `wantMutate` is true for an `--apply` (the caller intends to rewrite). The
-     * cross-process file lock is acquired LATE — only around the final
-     * load→merge→rename window (NFgCT, codex P2) — never across the disk scan, so a
-     * long scan does not force concurrent gateway touches to wait (and drop their
-     * append). Whether the rewrite actually happened is reported via the result's
-     * `applied`: true only when `wantMutate` AND the lock was acquired.
-     */
-    private rebuildInsideChain;
-    /**
-     * Final load→merge→rename window of a rebuild, factored out so the caller can
-     * run it WITHIN the cross-process file lock (NFgCT, codex P2) without holding
-     * that lock across the preceding disk scan. Re-reads the latest on-disk state,
-     * folds concurrent touches, then (when `canMutate`) atomically rewrites the log.
-     *
-     * `canMutate` records that the cross-process lock was actually held. The
-     * re-merge + rewrite run only when it is true — a dry-run, or an unlocked apply
-     * (lock-acquisition timeout), computes records but does NOT rename, so it can
-     * never clobber a concurrent lock holder's window. `applied` mirrors `canMutate`.
-     */
-    private finishRebuild;
-    /**
-     * Run `fn` while HOLDING the shared cross-process advisory lock (round 5, codex
-     * P2; generalized round 7 — NEZkA). This is the SINGLE mutex shared by BOTH the
-     * touch read→merge→append window AND the rebuild final load→merge→rename window,
-     * so a touch and a rebuild in different processes are mutually exclusive over
-     * their respective critical sections — closing the check-then-append gap where a
-     * polled-only touch could append into a rebuild's load→rename window.
-     *
-     * Issue #1524 adoption: this is now a thin delegation to the shared
-     * `withHeldFileLock` utility. The acquire loop, mtime heartbeat, stale-break
-     * (NG7Bg replacement-safe), and ownership-checked release (NCzT6) all live in
-     * ONE place — the util — so this module no longer re-implements them. The
-     * catalog's `REBUILD_LOCK_*` constants and the `onBeforeBreakStaleUnlinkForTest`
-     * seam flow straight through. The util generates a per-CALL owner uuid, which
-     * is stricter than the previous per-instance `lockOwnerId` (two calls on the
-     * same instance get different ids, so neither mistakes the other's lock as
-     * self-held — the NBsGP invariant, preserved and tightened).
-     *
-     * IN-PROCESS SAFETY: every caller invokes this from inside (or wrapping) the
-     * per-process `queueCritical` chain, which serializes all catalog mutations in
-     * THIS process (now via `MutationSerializer`). So within one process only one
-     * logical holder attempts OS-lock acquisition at a time — the file lock is never
-     * self-contended in-process, and the lock is acquired and released within a
-     * single in-process turn. The file lock adds only the missing CROSS-process
-     * exclusion.
-     *
-     * ACQUISITION RESULT (round 6, codex P2 — NBPmY): `fn` receives whether WE
-     * actually hold the lock. When acquisition TIMED OUT (another holder is active),
-     * a MUTATING rebuild must NOT perform its load/rename window unlocked, and a
-     * touch must NOT append unlocked — both would recreate the lost-append race. The
-     * caller uses `acquired` to run compute-only (rebuild) or DROP the append
-     * (touch) when unlocked.
-     */
-    private withHeldCatalogLock;
-    /**
-     * Merge a prior record's preserved metadata (timestamps, principal hints)
-     * onto a freshly-discovered record. Disk-derived fields (storageDir, kind)
-     * take precedence from the new record.
-     *
-     * PROVENANCE (round 3, cursor Low): `discoveredBy` and `createdAt` are
-     * CREATION-ONLY — identical to the touch path's invariant. A rebuild must NOT
-     * reset a namespace first seen via a `write`/`read` touch back to `config`
-     * just because it is also listed in policies. So when a prior record exists we
-     * carry its `discoveredBy` forward; only brand-new records keep the fresh
-     * (config/scan) provenance.
-     */
-    private mergeForRebuild;
-    /** Load the JSONL log and fold it into current state (last-record-wins). */
-    private loadCompacted;
-    private cloneCompactedRecords;
-    /**
-     * Serialize an arbitrary read-modify-write critical section through the single
-     * per-instance chain. Every catalog mutation and cached catalog read runs
-     * through this queue, so cache validation and updates cannot race in-process.
-     *
-     * Issue #1524 adoption: delegates to the shared `MutationSerializer` (stored
-     * as `criticalSection`). The util owns the rejection-recovery invariant
-     * (CLAUDE.md rule #40 — one failed section never poisons subsequent ones, but
-     * the failing section's error still surfaces to ITS awaited promise) and the
-     * no-unbounded-growth cleanup. The key is constant: the catalog has ONE
-     * logical mutation queue (touches and rebuilds mutually exclude in-process).
-     */
-    private queueCritical;
-    /**
-     * Append a single record to the JSONL log WITHOUT re-serializing through the
-     * write chain. MUST only be called from inside a `queueCritical(...)` section
-     * (which already holds the serialized turn); calling it directly would bypass
-     * the read-before-append ordering that prevents lost-field races.
-     */
-    private appendUnchained;
-    /**
-     * Atomic temp-file + rename rewrite (CLAUDE.md rule #54: write temp, then
-     * rename — never delete-before-write) WITHOUT re-entering the write chain.
-     * MUST only be called from inside a `queueCritical(...)` turn (e.g. the
-     * rebuild critical section, which already holds the serialized turn so its
-     * load and rewrite are atomic against concurrent touches). Re-entering the
-     * chain from within a held turn would deadlock.
-     */
-    private rewriteUnchained;
-    private refreshCacheAfterAppend;
-    private refreshCacheIdentity;
-}
-
-export { type NamespaceKind as N, NamespaceCatalog as a, type NamespaceRecord as b, type NamespaceCatalogFilter as c, type NamespaceCatalogRebuildResult as d, type NamespaceCatalogSkippedRoot as e, type NamespaceDiscoverySource as f, type NamespaceTouchMetadata as g };