@ashlr/hub 3.13.0 → 3.14.0

package/dist/core/web/public/next/assets/{context-model-Bb15chFt.js.map → context-model-CokrgEUq.js.map}

@@ -1 +1 @@
-{"version":3,"file":"context-model-Bb15chFt.js","names":[],"sources":["../../../../../../src/core/verse/types.ts","../../../../../../src/web-ui/routes/verse/context/context-model.ts"],"sourcesContent":["/**\n * Ashlr Verse — interactive multi-turn session contract (V1).\n *\n * A Verse session binds one project directory to one execution seat\n * (engine + account + model). Each user turn spawns ONE vendor CLI process\n * that resumes the vendor-native conversation by id, streams normalized\n * events, and exits. No long-lived stdin is held between turns.\n *\n * Seats:\n *   claude  -> `claude -p ... --output-format stream-json` via a native-profile launcher (account pinned by CLAUDE_CONFIG_DIR)\n *   local   -> the plain `claude` binary with ANTHROPIC_BASE_URL pointed at Ollama (Anthropic-compatible API); model = Ollama tag\n *   codex   -> `codex exec --json` / `codex exec resume <threadId> --json` via a native-profile launcher (CODEX_HOME pinned)\n *   grok    -> `grok -p ... --output-format streaming-messages-json` via a native-profile launcher (GROK_HOME pinned)\n *\n * Nothing in this module reads secrets. Account identity is pinned by the\n * launcher command recorded in ~/.ashlr/account-connections/connections.json.\n */\nimport type { TRANSIENT_EVENT_TYPE_LIST } from './transient-events.js';\n\nexport type VerseEngine = 'claude' | 'codex' | 'grok' | 'local';\n\nexport type VerseSessionStatus = 'idle' | 'running' | 'error';\n\n/** One selectable execution seat shown in the model/account picker. */\nexport interface VerseSeat {\n  /** Stable id, e.g. `claude`, `codex-personal`, `grok`, `local:qwen3-coder-next:ctx64k`. */\n  id: string;\n  engine: VerseEngine;\n  /** Human label, e.g. \"Claude Code\", \"Personal Codex\", \"Grok\", \"Qwen3-Coder-Next (local)\". */\n  label: string;\n  /** Account id from connections.json for native seats; `local` for Ollama seats. */\n  accountId: string;\n  /** Models this seat can run. First entry is the default. */\n  models: VerseModelOption[];\n  /** Best-known context window in tokens for the default model (null when unknown). */\n  contextWindow: number | null;\n  /** Latest health/usage evidence, if any. Never an admission input in V1. */\n  health: VerseSeatHealth;\n  /**\n   * V2.1 ADDITIVE. The subscription capacity behind this seat, so the seat\n   * list can render a meter without a second request.\n   *\n   * Absent (`undefined`) for LOCAL seats: an Ollama tag has no subscription\n   * and no provider window. Its real constraint is machine memory, which is\n   * reported by `VerseBootstrap.localRuntime`, not by a quota. Absent on a\n   * native seat means the server could not build a record for that account\n   * at all — `health.state` says what it does know.\n   */\n  capacity?: VerseSeatCapacity;\n  /**\n   * V3.9 ADDITIVE. The version of the CLI binary this seat is PINNED to (its\n   * native-profile launcher execs one exact file). Absent when unknown and on\n   * local seats. A pinned binary never updates itself, so a model that needs a\n   * newer CLI is listed with `unavailableReason` rather than silently failing.\n   */\n  cliVersion?: string;\n  /**\n   * V3.9 ADDITIVE. Plain-language facts about this seat's context setup the UI\n   * must show rather than imply (binary skew, catalog not yet fetched, …).\n   * Absent when there is nothing to say, so ordinary seats keep their shape.\n   */\n  notes?: string[];\n}\n\n/**\n * Where a context-window figure came from, so nothing on screen implies more\n * certainty than it has (docs/VERSE-CONTEXT.md §1).\n *\n * - `runtime`          — the CLI reported it for THIS turn (claude/grok\n *                        `result.modelUsage.<m>.contextWindow`, codex rollout\n *                        `token_count.info.model_context_window`, Ollama\n *                        `/api/ps`). Wins over everything else.\n * - `provider-catalog` — the seat's own served catalog on disk (codex/grok\n *                        `native-state/models_cache.json`).\n * - `cli-catalog`      — read out of the pinned CLI binary's embedded catalog\n *                        and recorded here with the version it was read from.\n * - `documented`       — the provider's published model table.\n * - `fallback`         — a named default; the UI marks it as an estimate.\n */\nexport type VerseWindowSource = 'runtime' | 'provider-catalog' | 'cli-catalog' | 'documented' | 'fallback';\n\n/**\n * How much context a session is allowed to accumulate before the CLI compacts.\n *\n * - `standard`  — the default. Evidence-based budget per engine: Claude 1M\n *                 models compact near 400k instead of ~967k; Codex, Grok and\n *                 local run their native windows.\n * - `expansive` — opt-in. Claude runs its full native window (CLI `auto`),\n *                 Codex raises `model_context_window` to the model's catalog\n *                 maximum (872k on GPT-6 / GPT-5.6). Costs more usage per turn,\n *                 buys simultaneous visibility for coupled, cross-cutting work.\n *\n * A mode that does not exist for a model (Grok, local, 200k Claude models,\n * GPT-5.5) is simply absent from that model's option — never faked.\n */\nexport type VerseContextMode = 'standard' | 'expansive';\n\nexport const VERSE_CONTEXT_MODES: readonly VerseContextMode[] = ['standard', 'expansive'];\n\n/** One mode's budget for a model on a seat. */\nexport interface VerseContextBudget {\n  /** The window the CLI measures against in this mode (the meter's denominator). */\n  contextWindow: number;\n  /** Token count at which the CLI auto-compacts in this mode; null when unknown. */\n  autoCompactAt: number | null;\n  /**\n   * The RAW window value the CLI must be TOLD to reach this budget, when that\n   * differs from `contextWindow` — codex measures against 95% of the window it\n   * is configured with, so expansive GPT-6 is `providerWindow: 872_000`\n   * (`-c model_context_window=872000`) but `contextWindow: 828_400`.\n   */\n  providerWindow?: number | null;\n}\n\nexport interface VerseModelOption {\n  id: string;\n  label: string;\n  /** Standard-mode window the CLI measures against (codex: the 95% effective window). */\n  contextWindow: number | null;\n  /**\n   * V3.9 ADDITIVE — every field below is optional so records and fixtures\n   * written before it keep validating. Absent means \"not known\", never zero.\n   */\n  /** Standard-mode auto-compaction point. */\n  autoCompactAt?: number | null;\n  /** Present ONLY when this model on this seat has a real expansive mode. */\n  expansive?: VerseContextBudget | null;\n  /** The CLI's default max output for this model, when known. */\n  maxOutputTokens?: number | null;\n  windowSource?: VerseWindowSource;\n  /** Minimum CLI version that knows this model id (e.g. '2.1.280'); null when any. */\n  minCliVersion?: string | null;\n  /**\n   * Why this model cannot run on this seat right now, in plain language (e.g.\n   * \"needs Claude Code 2.1.280; this seat runs 2.1.257\"). Null/absent = runnable.\n   * Listed rather than hidden so the operator learns WHY a model is missing.\n   */\n  unavailableReason?: string | null;\n}\n\nexport interface VerseSeatHealth {\n  state: 'ready' | 'degraded' | 'unavailable' | 'unknown';\n  /** e.g. \"5h window 72% used, resets 14:00\" — plain text, already sanitized. */\n  summary: string | null;\n  windows: Array<{ id: string; usedPercent: number | null; resetsAt: string | null }>;\n  observedAt: string | null;\n}\n\n// ---------------------------------------------------------------------------\n// Seat capacity (V2.1, additive) — see docs/VERSE-TELEMETRY-V2.md, which is\n// the authority for every honesty rule encoded in these shapes.\n//\n// This file is imported by the BROWSER bundle, so it may not import\n// `core/verse/accounts.ts` (node:fs). The shapes below therefore restate the\n// provider-record shapes structurally. `seats.ts` assigns the account record's\n// values straight into them, so a divergence in `core/verse/accounts.ts` stops\n// `seats.ts` compiling — that assignment is the drift guard.\n// ---------------------------------------------------------------------------\n\n/** One provider-reported quota window, as carried on a seat. */\nexport interface VerseSeatWindow {\n  id: string;\n  /** Provider-reported percent, or null for NO SIGNAL — which is not zero. */\n  usedPercent: number | null;\n  /**\n   * Machine-readable reset instant. STRUCTURALLY ALWAYS NULL for Claude: that\n   * provider publishes only a sentence, which lives in `resetDescription` and\n   * is rendered verbatim. The server never synthesizes an instant from it.\n   * (3.10.1: the Command burn-down chart may place the reset on its time axis\n   * via `resetInstantFromWords` in web-ui command-model, but only for the\n   * collector's exact \"Mon D at H:MMam (Area/Zone)\" form and only when the\n   * result lands within one window of now; anything else stays words.)\n   */\n  resetsAt: string | null;\n  /** The provider's own reset wording, verbatim (\"resets Sep 25 at 7pm (America/New_York)\"). */\n  resetDescription: string | null;\n  /**\n   * TRUE only when the provider explicitly FLAGGED the limit. Such a window's\n   * `usedPercent` is the SENTINEL 100 — a denial, not a measurement — and must\n   * be labelled \"limit reached\", never \"100% used\".\n   */\n  limitReached: boolean;\n  /** False when `usedPercent` is a flagged sentinel rather than a reading. */\n  measured: boolean;\n}\n\n/**\n * Codex credits, INDEPENDENT of the window: a fully used weekly window with a\n * spendable balance is not blocked. `null` is \"no signal\", never \"no credits\".\n */\nexport interface VerseSeatCredits {\n  hasCredits: boolean;\n  unlimited: boolean;\n  /** Provider-reported decimal string, kept verbatim — never rounded. */\n  balance: string | null;\n}\n\n/**\n * The coarse \"can I use this seat right now\" verdict. Deliberately coarse: the\n * exact numbers are in `windows`, and a verdict that pretended to more\n * precision than the providers give would be a lie.\n *\n * - `ready`      — a reading exists and the binding window has headroom.\n * - `tight`      — the binding window is at/above the warn threshold, OR it is\n *                  spent while Codex credits remain spendable (not blocked).\n * - `exhausted`  — the binding window is spent and nothing else is left.\n * - `signed-out` — the account is not authenticated; reconnect it.\n * - `unknown`    — NO window carried a percent. Not zero, not healthy.\n */\nexport type VerseSeatUsability = 'ready' | 'tight' | 'exhausted' | 'signed-out' | 'unknown';\n\n/**\n * Where a seat's windows came from, so nothing implies freshness it lacks.\n * Mirrors `VerseEvidenceSource` in `core/verse/accounts.ts`.\n */\nexport type VerseSeatEvidenceSource = 'collector' | 'shared-evidence' | 'baseline' | 'none';\n\n/** Everything the seat list needs to draw a capacity meter honestly. */\nexport interface VerseSeatCapacity {\n  /** e.g. \"max\", \"pro\", \"SuperGrok\". Null when the provider gave none. */\n  planType: string | null;\n  /**\n   * THE CONSTRAINT THAT ACTUALLY BLOCKS WORK: the window with the highest\n   * `usedPercent`. Null when no window carried a percent at all.\n   */\n  binding: VerseSeatWindow | null;\n  /** Every window the provider reported, in provider order. */\n  windows: VerseSeatWindow[];\n  /** Codex only; null for every other provider and when no signal exists. */\n  credits: VerseSeatCredits | null;\n  usability: VerseSeatUsability;\n  observedAt: string | null;\n  evidenceSource: VerseSeatEvidenceSource;\n  /** Plain-language provider facts the UI must show instead of implying a fault. */\n  notes: string[];\n}\n\nexport interface VerseProject {\n  path: string;\n  name: string;\n  /** From ~/.ashlr/enrollment.json when present. */\n  enrolled: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Workspaces (V2.2, ADDITIVE) — see docs/VERSE-WORKSPACES.md §1.\n//\n// A session bound to ONE directory cannot express \"this service plus the\n// shared library it depends on\", which is most real work. A workspace is a\n// NAMED set of roots with exactly one marked primary.\n//\n// `VerseSession.projectPath` keeps its meaning — it IS the primary root — so\n// every session record, adapter and test written before workspaces existed\n// still loads and still runs. Nothing rewrites saved chat history.\n//\n// ENROLLMENT IS NOT PART OF THIS SHAPE ON PURPOSE. A workspace says what a\n// session may REACH; `~/.ashlr/enrollment.json` says what the AUTONOMOUS lane\n// may mutate, and the two are deliberately separate registries. Membership in\n// a workspace grants no enrollment: `enrolled` below is READ from the\n// registry per root and is never written by anything in this feature.\n// ---------------------------------------------------------------------------\n\n/** One directory in a workspace. Exactly one root in a workspace is primary. */\nexport interface VerseWorkspaceRoot {\n  /** Absolute, physically resolved path (symlinks followed). */\n  path: string;\n  /** Display name; defaults to the basename. */\n  name: string;\n  /**\n   * The session's cwd and the value `projectPath` carries. Exactly one root\n   * per workspace has this set.\n   */\n  primary: boolean;\n}\n\n/**\n * A named set of roots.\n *\n * ONE TYPE, TWO USES, DELIBERATELY. An interactive session binds to a\n * workspace to decide what it can reach; the autonomous lane reads the same\n * workspace as a SECTION — \"these repositories collaborate, work on them\n * together\" — when `section` is true. They were not split because the thing\n * being named is identical in both: a set of directories that belong to one\n * piece of work. Two registries of named repo groups would drift.\n *\n * What is NOT on this type is priority. A repo may belong to several\n * workspaces, so a per-membership rank would give one repo several\n * contradictory ranks. Priority is therefore an attribute OF THE REPO, held\n * once per path in the same registry — see `VerseRootPriority`.\n */\nexport interface VerseWorkspace {\n  id: string;\n  name: string;\n  /** Primary first, then the extras in the order they were added. */\n  roots: VerseWorkspaceRoot[];\n  /**\n   * Offer this workspace to the autonomous lane as a section.\n   *\n   * GRANTS NOTHING. The fleet still reaches only what\n   * `~/.ashlr/enrollment.json` permits; a section can group and order those\n   * repos and nothing else. A member that is not enrolled stays unreachable.\n   */\n  section: boolean;\n  createdAt: string;\n  updatedAt: string;\n}\n\n/**\n * Relative standing of one repository in the autonomous lane's attention.\n *\n * ORDERING ONLY, NEVER ADMISSION. `critical` on an unenrolled repo is still\n * refused by `assertMayMutate`; `low` on an enrolled one is still permitted.\n * An ordinal rather than a number because the operator's judgement here is\n * \"this matters more than that\", and a 0-100 score would invent a precision\n * nobody holds.\n *\n * Absent means `normal`, which is how every repo already behaves — so a\n * registry with no priorities at all reproduces today's flat list exactly.\n */\nexport type VerseRootPriority = 'critical' | 'high' | 'normal' | 'low';\n\nexport const VERSE_ROOT_PRIORITIES: readonly VerseRootPriority[] =\n  ['critical', 'high', 'normal', 'low'];\n\nexport const VERSE_DEFAULT_ROOT_PRIORITY: VerseRootPriority = 'normal';\n\n/** Sort weight; lower sorts first. Never a budget, never a multiplier. */\nexport const VERSE_ROOT_PRIORITY_RANK: Record<VerseRootPriority, number> = {\n  critical: 0,\n  high: 1,\n  normal: 2,\n  low: 3,\n};\n\n/** One enrolled repository as the autonomy scope view ranks it. */\nexport interface VerseAutonomyScopeEntry {\n  path: string;\n  name: string;\n  priority: VerseRootPriority;\n  /** Sections (workspaces with `section: true`) this repo belongs to. */\n  sections: Array<{ id: string; name: string }>;\n  /** True when a focus section is set and this repo is outside it. */\n  outsideFocus: boolean;\n}\n\n/**\n * The autonomous lane's scope, ORDERED.\n *\n * Built by INTERSECTING section membership with the enrollment registry, so\n * it can only ever be a subset of what enrollment already allows. Sections\n * add ordering and grouping; they never add reach.\n */\nexport interface VerseAutonomyScopeView {\n  focusSectionId: string | null;\n  focusSectionName: string | null;\n  /** Enrolled repos, most important first. */\n  entries: VerseAutonomyScopeEntry[];\n  /**\n   * Paths a section names that are NOT enrolled. Listed so the blast radius\n   * is legible in both directions — these are exactly the repos a section\n   * does NOT give the fleet.\n   */\n  unenrolledSectionRoots: string[];\n}\n\n/**\n * Per-root git identity. A turn that edits two repos produces two diffs, so\n * the transcript has to be able to attribute each file to the right one.\n *\n * `remote` is the canonical `owner/repo` for a GitHub origin and null for\n * anything else — deliberately NOT the raw remote URL, which can carry a\n * token in its userinfo and would then reach an API response.\n */\nexport interface VerseRootGit {\n  branch: string;\n  /** Count of porcelain entries; 0 is clean. */\n  dirty: number;\n  ahead: number;\n  behind: number;\n  remote: string | null;\n}\n\n/** A root as the client sees it: identity, reachability and honest scope. */\nexport interface VerseRootStatus {\n  path: string;\n  name: string;\n  primary: boolean;\n  exists: boolean;\n  /**\n   * Read live from the enrollment registry. FALSE means the interactive lane\n   * still works on this root while the autonomous lane refuses it — being in\n   * a workspace never changes this.\n   */\n  enrolled: boolean;\n  /** Null when the root is not a git repository, or git is unavailable. */\n  git: VerseRootGit | null;\n  /**\n   * False when the session's engine has no way to be granted this root (Grok's\n   * CLI exposes `--cwd` and nothing else). The root is still listed, because\n   * hiding it would misrepresent what the workspace is.\n   */\n  reachable: boolean;\n}\n\n/** GET /api/verse/sessions/:id/roots */\nexport interface VerseSessionRootsResponse {\n  sessionId: string;\n  workspaceId: string | null;\n  workspaceName: string | null;\n  roots: VerseRootStatus[];\n  /**\n   * Plain-language facts the UI must show rather than imply: an unreachable\n   * root on a Grok seat, or a root the autonomous lane will refuse.\n   */\n  notes: string[];\n}\n\n/** GET /api/verse/workspaces */\nexport interface VerseWorkspacesResponse {\n  workspaces: VerseWorkspace[];\n  /** Live per-root facts, keyed by workspace id, so one read draws the list. */\n  status: Record<string, VerseRootStatus[]>;\n  /** Per-repo priority, keyed by canonical path. Absent key means `normal`. */\n  priorities: Record<string, VerseRootPriority>;\n  focusSectionId: string | null;\n}\n\n/** POST /api/verse/workspaces */\nexport interface VerseWorkspaceCreateRequest {\n  name: string;\n  /** Absolute paths. The first is the primary. */\n  roots: string[];\n  /** Also offer this set to the autonomous lane as a section. Default false. */\n  section?: boolean;\n}\n\n/** POST /api/verse/workspaces/:id/update */\nexport interface VerseWorkspaceUpdateRequest {\n  name?: string;\n  /** When present, replaces the root set wholesale. First entry is primary. */\n  roots?: string[];\n  section?: boolean;\n}\n\n/** POST /api/verse/workspaces/priority */\nexport interface VerseRootPriorityRequest {\n  path: string;\n  priority: VerseRootPriority;\n}\n\n/** POST /api/verse/workspaces/focus — `sectionId: null` clears the focus. */\nexport interface VerseFocusSectionRequest {\n  sectionId: string | null;\n}\n\n/** Hard cap on roots per workspace — a blast radius, not a UI limit. */\nexport const VERSE_MAX_WORKSPACE_ROOTS = 8;\n\n/**\n * Every root a session can reach, primary first.\n *\n * Pure and total: a record written before workspaces existed has no\n * `extraRoots` and yields exactly `[projectPath]`, which is what every caller\n * assumed before this existed.\n */\nexport function verseSessionRoots(\n  session: Pick<VerseSession, 'projectPath' | 'extraRoots'>,\n): string[] {\n  const out = [session.projectPath];\n  for (const root of session.extraRoots ?? []) {\n    if (typeof root === 'string' && root.length > 0 && !out.includes(root)) out.push(root);\n  }\n  return out;\n}\n\nexport interface VerseUsage {\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheCreationTokens: number;\n  /**\n   * Prompt size of the most recent assistant call = live context occupancy.\n   * Stored UNCLAMPED: a reading above the window is information (the CLI is\n   * about to compact or overflow), and only the UI decides how to draw it.\n   */\n  contextTokens: number;\n  contextWindow: number | null;\n  /** V3.9 ADDITIVE. Where `contextWindow` came from; absent on old records. */\n  contextWindowSource?: VerseWindowSource;\n  /** V3.9 ADDITIVE. Auto-compaction point for the session's current mode. */\n  autoCompactAt?: number | null;\n  /**\n   * V3.9 ADDITIVE. False when `contextTokens` is an UPPER BOUND rather than a\n   * measurement (codex before its rollout is readable: the turn total sums\n   * every model call). Absent means exact.\n   */\n  contextTokensExact?: boolean;\n}\n\nexport interface VerseSession {\n  id: string;\n  title: string;\n  /**\n   * The PRIMARY root: the process cwd and the folder every pre-workspace\n   * client already reads. Unchanged in meaning, which is why no session\n   * record ever has to be rewritten.\n   */\n  projectPath: string;\n  /**\n   * V2.2 ADDITIVE. Roots BEYOND the primary, pinned at creation time.\n   *\n   * Absent on every record written before workspaces existed, and absent on\n   * a single-root session today — so the on-disk shape of an ordinary chat\n   * does not change at all.\n   *\n   * PINNED, not referenced: a session keeps the roots it was created with\n   * even if the named workspace is later edited or deleted, for the same\n   * reason `launch.anthropicBaseUrl` is pinned — a conversation must not\n   * silently gain reach because config moved underneath it.\n   */\n  extraRoots?: string[];\n  /** V2.2 ADDITIVE. Provenance of the pinned roots; absent for an ad-hoc set. */\n  workspaceId?: string;\n  workspaceName?: string;\n  engine: VerseEngine;\n  accountId: string;\n  seatId: string;\n  model: string;\n  /** Vendor conversation id used for resume (claude/grok: our uuid; codex: thread id from output). */\n  nativeSessionId: string | null;\n  createdAt: string;\n  updatedAt: string;\n  status: VerseSessionStatus;\n  turnCount: number;\n  usage: VerseUsage;\n  lastError: string | null;\n  /**\n   * V3.9 ADDITIVE. The session's context budget. Every record written by 3.9+\n   * carries it explicitly, so ABSENT means a pre-3.9 record: the engine\n   * materializes it on first touch — `expansive` for a Claude 1M model (that\n   * is the native ~967k compaction those chats always ran with, so upgrading\n   * never forces a paid compaction), `standard` otherwise (= native).\n   * Changeable mid-session (POST /sessions/:id/context-mode): it changes CLI\n   * flags, not prompt content — but switching DOWN below the current\n   * occupancy makes the CLI compact on its next turn.\n   */\n  contextMode?: VerseContextMode;\n  /** V3.9 ADDITIVE. Native compactions observed so far (claude/grok compact_boundary, codex rollout `compacted`). */\n  compactionCount?: number;\n  /** V3.9 ADDITIVE. Set when this session was started as a handoff from another. */\n  handoffFrom?: { sessionId: string; title: string };\n  /**\n   * V3.9 ADDITIVE. Shared project memory was offered to this session's CLI at\n   * creation. Pinned, like the roots: a conversation must not silently gain a\n   * writable directory because a preference moved underneath it.\n   */\n  memoryEnabled?: boolean;\n  /**\n   * V3.10 ADDITIVE (contract: unit C0; written by C3's engine). The operator's\n   * per-chat effort and permission choices, applied from the NEXT turn — a\n   * running turn keeps the argv it was launched with. Absent (every record\n   * before 3.10, and any key never set) = the engine default: permission mode\n   * `accept-edits`, effort = the CLI's own default.\n   *\n   * A MODEL change is deliberately NOT stored here: it rewrites `model` above,\n   * which every launch already reads — one field, one truth.\n   */\n  controls?: VerseSessionControls;\n}\n\n/**\n * V3.10. Permission modes a chat can run in (SPEC-310C §0.6), in picker order.\n *  - `plan`         — the CLI plans and edits nothing.\n *  - `accept-edits` — the default: edits applied without asking.\n *  - `auto`         — the CLI's own auto mode.\n *  - `bypass`       — every check skipped. Shown red and confirmed PER CHAT:\n *                     never a default, never inherited by a new chat.\n * Adapters map these to each CLI's spelling (claude `acceptEdits` /\n * `bypassPermissions`, grok `dontAsk`, …). An engine that cannot honour one\n * reports it unavailable WITH a reason rather than approximating it. The\n * in-page \"Ask\" mode (answering permission prompts in the UI) is 3.11.\n */\nexport const VERSE_PERMISSION_MODES = ['plan', 'accept-edits', 'auto', 'bypass'] as const;\nexport type VersePermissionMode = (typeof VERSE_PERMISSION_MODES)[number];\nexport const VERSE_DEFAULT_PERMISSION_MODE: VersePermissionMode = 'accept-edits';\n\n/**\n * V3.10. Reasoning effort, the union across engines — claude `--effort`\n * (low · medium · high · xhigh · max) and codex `model_reasoning_effort`\n * (minimal · low · medium · high · xhigh). Each seat offers only the subset\n * its CLI accepts; the rest come back unavailable with a reason.\n */\nexport const VERSE_EFFORTS = ['minimal', 'low', 'medium', 'high', 'xhigh', 'max'] as const;\nexport type VerseEffort = (typeof VERSE_EFFORTS)[number];\n\n/** V3.10. `VerseSession.controls` — absent key = engine default (see there). */\nexport interface VerseSessionControls {\n  effort?: VerseEffort;\n  permissionMode?: VersePermissionMode;\n}\n\n/** Normalized event stream. `seq` is monotonic per session and is the SSE id. */\nexport type VerseEvent =\n  | { seq: number; at: string; type: 'user-message'; turnId: string; text: string }\n  | { seq: number; at: string; type: 'turn-started'; turnId: string; pid: number | null }\n  | { seq: number; at: string; type: 'text-delta'; turnId: string; text: string }\n  | { seq: number; at: string; type: 'assistant-message'; turnId: string; text: string }\n  /**\n   * Reasoning the CLI chose to show. V3.10 ADDITIVE optional fields (absent on\n   * older records = unknown, never \"false\"/\"0\"):\n   *  - `redacted`   the CLI sent a signature-only / redacted block, so `text` is\n   *                 empty but the model DID think (the UI says \"Thought 12s\").\n   *  - `durationMs` wall time the block took to stream, when measured.\n   *  - `kind`       see VerseThinkingKind.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'thinking';\n    turnId: string;\n    text: string;\n    redacted?: boolean;\n    durationMs?: number;\n    kind?: VerseThinkingKind;\n  }\n  | { seq: number; at: string; type: 'tool-use'; turnId: string; toolUseId: string; name: string; input: unknown }\n  | { seq: number; at: string; type: 'tool-result'; turnId: string; toolUseId: string; output: string; isError: boolean }\n  | { seq: number; at: string; type: 'usage'; turnId: string; usage: VerseUsage }\n  | { seq: number; at: string; type: 'turn-done'; turnId: string; ok: boolean; nativeSessionId: string | null; durationMs: number }\n  /**\n   * `code` (V3.10 ADDITIVE, optional) is a stable machine key for errors the UI\n   * or engine acts on — see VERSE_ERROR_CODES. Absent = uncategorised.\n   */\n  | { seq: number; at: string; type: 'error'; turnId: string | null; message: string; code?: string }\n  | { seq: number; at: string; type: 'cancelled'; turnId: string }\n  /**\n   * V3.9. The CLI compacted its own conversation. Token counts are the CLI's\n   * own (`compact_metadata.pre_tokens/post_tokens` on claude/grok). Codex\n   * rollouts mark only THAT a compaction happened, so its counts are the last\n   * `token_count` reading before the marker and the first one after it —\n   * measured, but by Verse, not stated by the CLI; its `durationMs` is null.\n   * Any count may be null when no reading brackets the compaction.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'compaction';\n    turnId: string | null;\n    trigger: 'auto' | 'manual';\n    preTokens: number | null;\n    postTokens: number | null;\n    durationMs: number | null;\n  }\n  /**\n   * V3.9. A context-occupancy READING that is not a usage delta — e.g. codex's\n   * rollout `token_count` (exact last-call prompt size and the window the CLI\n   * measured it against), polled mid-turn and read again after it. Replaces\n   * the session's `contextTokens`; never summed. The engine fills\n   * `autoCompactAt` for the window in force.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'context';\n    turnId: string | null;\n    contextTokens: number;\n    contextWindow: number | null;\n    exact: boolean;\n    autoCompactAt?: number | null;\n    /**\n     * Where `contextWindow` came from. A CLI reading is `runtime`; the event\n     * the engine writes after a MODE SWITCH carries the new budget's catalog\n     * source, so a client never relabels a catalog figure as a measurement.\n     * Absent on events from before this field existed (treat as `runtime`).\n     */\n    contextWindowSource?: VerseWindowSource;\n  }\n  // ── V3.10 TRANSIENT events ────────────────────────────────────────────────\n  // Never written to the session log; fanned out to live SSE listeners only\n  // (see VERSE_TRANSIENT_EVENT_TYPES for the wire rules). A reload therefore\n  // never shows them — everything they convey is either ephemeral (a spinner)\n  // or re-stated by a persisted event at turn end (`thinking`, `usage`).\n  /** A chunk of streamed reasoning text for the in-flight thinking block. */\n  | { seq: number; at: string; type: 'thinking-delta'; turnId: string; text: string }\n  /**\n   * The CLI reports reasoning volume without text (claude\n   * `system/thinking_tokens`). An ESTIMATE, rate-limited by the adapter.\n   */\n  | { seq: number; at: string; type: 'thinking-progress'; turnId: string; estimatedTokens: number }\n  /**\n   * What the running turn is doing right now. `tool` names the running tool\n   * when phase is `tool`. `outTokens`/`tokPerSec` are absent when unmeasured.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'progress';\n    turnId: string;\n    phase: VerseProgressPhase;\n    tool?: string;\n    elapsedMs: number;\n    outTokens?: number;\n    tokPerSec?: number;\n  }\n  /** A human-readable notice about the turn's plumbing (API retry, preflight, no-output watchdog). */\n  | { seq: number; at: string; type: 'status'; turnId: string | null; kind: VerseStatusKind; message: string }\n  // ── V3.10 PERSISTED events ────────────────────────────────────────────────\n  /**\n   * The engine recovered from a lost native conversation (e.g. the vendor\n   * thread vanished) by starting a new native session seeded with the handoff\n   * note (`how: 'handoff'`) or a bare new session (`new-native-session`).\n   */\n  | { seq: number; at: string; type: 'recovered'; turnId: string | null; how: VerseRecoveryHow; message: string }\n  /**\n   * The log hit its cap and events with `seq < droppedBefore` were dropped at\n   * a TURN boundary (never mid-turn). `turnId` is always null — it is present\n   * only so code reading `event.turnId` across the union keeps typechecking.\n   */\n  | { seq: number; at: string; type: 'history-truncated'; turnId: null; droppedBefore: number };\n\nexport type VerseEventType = VerseEvent['type'];\n\n/** V3.10. `summary` = vendor-summarised reasoning, `raw` = verbatim, `progress` = a heading/placeholder only. */\nexport type VerseThinkingKind = 'summary' | 'raw' | 'progress';\n\n/** V3.10. Phase of a running turn, carried by the transient `progress` event. */\nexport type VerseProgressPhase = 'thinking' | 'tool' | 'writing' | 'waiting';\n\n/** V3.10. What a transient `status` notice is about. */\nexport type VerseStatusKind = 'retry' | 'preflight' | 'watchdog';\n\n/** V3.10. How a `recovered` event restored the conversation. */\nexport type VerseRecoveryHow = 'new-native-session' | 'handoff';\n\n/**\n * V3.10. Known `error.code` values. `code` stays `string` on the wire so an\n * older client never rejects a newer code; these are the ones Verse acts on.\n *  - `native-thread-missing` — the vendor conversation to resume no longer exists.\n *  - `session-in-use`        — the CLI refused because the native session id is locked.\n */\nexport const VERSE_ERROR_CODES = ['native-thread-missing', 'session-in-use'] as const;\nexport type VerseErrorCode = (typeof VERSE_ERROR_CODES)[number];\n\n/**\n * V3.10. Event types that are NEVER persisted — emitted to live SSE listeners\n * only. The list and its guard live in ./transient-events.ts (re-exported\n * here): the web chat's first-paint store needs the guard, and importing it\n * from this module put every runtime value exported here — the handoff\n * prompt, the effort tables — into the chat's first-paint chunk.\n */\nexport { VERSE_TRANSIENT_EVENT_TYPES, isTransientVerseEvent } from './transient-events.js';\n\nexport type VerseTransientEventType = (typeof TRANSIENT_EVENT_TYPE_LIST)[number];\nexport type VerseTransientEvent = Extract<VerseEvent, { type: VerseTransientEventType }>;\nexport type VersePersistedEvent = Exclude<VerseEvent, { type: VerseTransientEventType }>;\n\n/**\n * Which endpoint a LOCAL seat sends its turns to.\n *\n *  - `ollama`       — the historical lane: the plain `claude` binary with\n *                     ANTHROPIC_BASE_URL pointed straight at Ollama's\n *                     Anthropic-compatible endpoint on :11434. Ollama\n *                     serialises this model architecture, so a fleet of local\n *                     agents on this lane is a queue (docs/LOCAL-FLEET.md).\n *  - `llama-server` — the same binary pointed at the local Anthropic\n *                     normalising proxy that fronts llama-server. That proxy\n *                     is the ONLY way to reach llama-server's parallel slots\n *                     and the prompt-cache fix, because Qwen3.8's chat\n *                     template rejects Claude Code's request shape unless the\n *                     proxy rewrites it on the way through.\n *\n * DISPATCH ONLY. Model DISCOVERY stays on Ollama in both lanes — llama-server\n * implements neither `/api/tags` nor `/api/show`, which is where every local\n * seat's identity, context window and `tools` capability comes from.\n */\nexport type VerseLocalDispatch = 'ollama' | 'llama-server';\n\n/** What a client is told about this machine's local serving situation. */\nexport interface VerseLocalRuntimeSummary {\n  /** Ollama reachable? Drives the local seats and an inline hint when false. */\n  ollama: { reachable: boolean; baseUrl: string; models: string[] };\n  /**\n   * Where local seats DISPATCH turns, reported only when that is NOT the\n   * default Ollama lane.\n   *\n   * Absent means `ollama`, i.e. exactly what every existing client already\n   * assumes — so opting in is visible on the wire and NOT opting in changes no\n   * payload at all.\n   */\n  dispatch?: { lane: VerseLocalDispatch; baseUrl: string };\n}\n\n/** GET /api/verse/bootstrap */\nexport interface VerseBootstrap {\n  seats: VerseSeat[];\n  projects: VerseProject[];\n  sessions: VerseSession[];\n  /** Whether POST routes are enabled on this server (`ashlr serve --allow-dispatch` / `ashlr verse`). */\n  dispatchEnabled: boolean;\n  localRuntime: VerseLocalRuntimeSummary;\n}\n\n/**\n * GET /api/verse/seats (V2.1)\n *\n * WHY THIS ROUTE EXISTS: `bootstrap` is a MOUNT-TIME snapshot. A client that\n * opened the app before the collector's first cycle finished would show\n * \"unknown\" forever. This is the same seat list, cheap enough to poll, and it\n * always reflects the collector's CURRENT state rather than a cached one.\n */\nexport interface VerseSeatsResponse {\n  /** When this body was built. */\n  sampledAt: string;\n  seats: VerseSeat[];\n  localRuntime: VerseBootstrap['localRuntime'];\n}\n\n/**\n * POST /api/verse/sessions\n *\n * Two spellings, never mixed (the API rejects the mix rather than silently\n * preferring one):\n *   - `workspaceId` alone — the named workspace supplies primary and extras.\n *   - `projectPath` (+ optional `extraRoots`) — an ad-hoc set, which is also\n *     exactly the pre-workspace request shape.\n */\nexport interface VerseCreateSessionRequest {\n  projectPath: string;\n  seatId: string;\n  model?: string;\n  title?: string;\n  /** V2.2 ADDITIVE. Absolute paths beyond the primary. */\n  extraRoots?: string[];\n  /** V2.2 ADDITIVE. Bind to a named workspace instead of naming paths. */\n  workspaceId?: string;\n  /**\n   * SERVER-FILLED. The API resolves this from the registry once `workspaceId`\n   * is validated, and never reads it off the request body — so a session can\n   * not be labelled with a workspace name that is not the one it was built\n   * from.\n   */\n  workspaceName?: string;\n  /**\n   * V3.9 ADDITIVE. Absent → the seat's preferred mode (preferences.json), else\n   * `standard`. `expansive` on a model with no expansive budget is rejected.\n   */\n  contextMode?: VerseContextMode;\n  /**\n   * V3.9 ADDITIVE. Start this session as a handoff from an existing one. The\n   * server resolves the source's title itself (never from the body) and pins\n   * `handoffFrom`; the handoff TEXT is sent by the client as turn 1, after the\n   * operator has read it — nothing is spent on their behalf.\n   */\n  handoffFromSessionId?: string;\n}\n\n/** POST /api/verse/sessions/:id/turns */\nexport interface VerseTurnRequest {\n  text: string;\n}\nexport interface VerseTurnResponse {\n  turnId: string;\n  session: VerseSession;\n}\n\n/** GET /api/verse/sessions/:id */\nexport interface VerseSessionDetail {\n  session: VerseSession;\n  events: VerseEvent[];\n}\n\n/** Adapter input: how to launch one turn. Pure data, produced by the engine, consumed by the spawner. */\nexport interface VerseTurnLaunch {\n  argv: string[];\n  cwd: string;\n  /** Extra env layered over a minimal base (PATH/HOME/TMPDIR/LANG). Never contains secrets. */\n  env: Record<string, string>;\n  /** Text written to stdin (codex); null when the prompt is in argv. */\n  stdin: string | null;\n}\n\nexport const VERSE_MAX_TURN_TEXT_BYTES = 64 * 1024;\nexport const VERSE_MAX_EVENTS_PER_SESSION = 20_000;\nexport const VERSE_TURN_TIMEOUT_MS = 30 * 60 * 1000;\n/**\n * LAST-RESORT fallbacks, used only when neither the runtime, the seat's own\n * catalog, nor the verified per-model table (core/verse/model-windows.ts) knows\n * the model. Each mirrors what the CLI ITSELF assumes for an unknown id, so the\n * meter never claims more than the CLI will allow:\n *\n * - claude 200_000 — Claude Code's `Mg()` default for an unrecognized model.\n *   Every KNOWN Claude id carries its real window (1M for the 5.x family,\n *   Opus 4.8 and Sonnet 5) in the per-model table instead.\n * - codex 258_400  — 272_000 × the 95% `effective_context_window_percent`\n *   every codex catalog entry carries; the figure codex's own rollouts report\n *   as `model_context_window` (65,440 of 65,440 observed events).\n * - grok 500_000   — `context_window` for every grok-4.x id in the seat catalog.\n * - local 65_536   — the num_ctx the default local tag pins.\n */\nexport const VERSE_DEFAULT_CONTEXT_WINDOWS: Record<string, number> = {\n  claude: 200_000,\n  codex: 258_400,\n  grok: 500_000,\n  local: 65_536,\n};\n\n// ---------------------------------------------------------------------------\n// V3.9 context orchestration — request/response shapes (docs/VERSE-CONTEXT.md)\n// ---------------------------------------------------------------------------\n\n/** GET /api/verse/preferences — the operator's standing context choices. */\nexport interface VersePreferences {\n  version: 1;\n  /** Per-seat default context mode for NEW sessions. Absent = `standard`. */\n  seats: Record<string, { contextMode?: VerseContextMode }>;\n  /** Shared project memory. On by default; listed canonical paths opt out. */\n  memory: { enabled: boolean; disabledProjects: string[] };\n  /**\n   * V3.10 ADDITIVE. Stream vendor-summarised reasoning on non-local seats\n   * (claude `--thinking-display summarized`). Absent = on (Mason's default).\n   */\n  thinkingDisplay?: boolean;\n}\n\n/**\n * POST /api/verse/preferences — exactly ONE of the three forms per request, so\n * a body can never change more than the operator clicked.\n */\nexport type VersePreferencesUpdate =\n  | { seatId: string; contextMode: VerseContextMode }\n  | { memoryEnabled: boolean }\n  | { projectPath: string; memoryEnabled: boolean };\n\n/** POST /api/verse/sessions/:id/context-mode */\nexport interface VerseContextModeRequest {\n  mode: VerseContextMode;\n}\n\n/** POST /api/verse/sessions/:id/handoff-preview */\nexport interface VerseHandoffPreviewRequest {\n  /**\n   * Include the latest assistant message verbatim (capped) as the agent's own\n   * summary — used after \"Ask this seat to summarize\" produced one.\n   */\n  includeLastAssistant?: boolean;\n  /** Optional operator focus line, e.g. \"finish the migration of X\". ≤ 500 chars. */\n  focus?: string;\n}\n\n/** Deterministic, zero-spend handoff note built from the session's event log. */\nexport interface VerseHandoffPreview {\n  sourceSessionId: string;\n  sourceTitle: string;\n  /** The exact text to send as turn 1 of the new session. ≤ VERSE_HANDOFF_MAX_CHARS. */\n  text: string;\n  stats: {\n    chars: number;\n    /** chars / 4, rounded up — the same estimator the fit badges use. */\n    estTokens: number;\n    turnsCovered: number;\n    filesTouched: number;\n    /** Sections dropped to respect the cap, by name; empty when nothing was cut. */\n    truncated: string[];\n  };\n}\n\nexport const VERSE_HANDOFF_MAX_CHARS = 12_000;\n\n/**\n * The canned turn behind \"Ask this seat to summarize first\". Shared by the UI\n * (which sends it as an ordinary turn through the normal spend chokepoint) and\n * the handoff builder (which must NOT carry it into the new session as the\n * operator's \"latest ask\" — the new chat would otherwise be told to write a\n * handoff note instead of continuing the work).\n *\n * Written so the reply is useful as turn 1 of a session that has NONE of this\n * context. It asks for no tool use on purpose: a summary that starts editing\n * files is not a summary, and a read-only turn is also the cheapest one.\n */\nexport const VERSE_HANDOFF_SUMMARY_REQUEST = [\n  'This conversation is about to continue in a fresh session that has none of its context.',\n  'Write the handoff note that new session should start from. Do not edit files or run commands for this — only write the note.',\n  '',\n  'Cover, concretely:',\n  '- The goal, and what \"done\" looks like.',\n  '- Decisions made so far, each with the reason it was made.',\n  '- Current state: what is finished, what is half-done, what is untested.',\n  '- Files changed and anything not yet committed.',\n  '- How to verify the work (exact commands).',\n  '- Open questions, risks, and approaches already tried that did not work.',\n  '',\n  'Keep it under 600 words. Prefer file paths and commands over prose.',\n].join('\\n');\n\n/** GET /api/verse/context-fit — how big the reachable code is, in tokens. */\nexport interface VerseContextFitRoot {\n  path: string;\n  /** Tracked text files counted (git ls-files, binaries and >1 MB files skipped). */\n  files: number;\n  bytes: number;\n  estTokens: number;\n  /** True when the scan hit its file or time cap; estTokens is then a floor. */\n  truncated: boolean;\n}\n\nexport interface VerseContextFit {\n  roots: VerseContextFitRoot[];\n  totalEstTokens: number;\n  /** Always 'bytes/4' today; named so a better estimator can be introduced honestly. */\n  estimator: 'bytes/4';\n  sampledAt: string;\n}\n\n/**\n * Per-model verdict for a working set (see context-math.ts `fitVerdict`):\n * fits in standard, tight in standard, fits only in expansive, or too big for\n * any single context (split the work).\n */\nexport type VerseFitVerdict = 'fits' | 'tight' | 'expansive' | 'split';\n\n/** GET /api/verse/search?q=&limit= — keyword search over past sessions. Zero spend. */\nexport interface VerseSearchHit {\n  sessionId: string;\n  title: string;\n  projectPath: string;\n  engine: VerseEngine;\n  seq: number;\n  at: string;\n  kind: 'user' | 'assistant';\n  /** ≤ 240 chars around the first match, whitespace-collapsed. */\n  snippet: string;\n  score: number;\n}\n\nexport interface VerseSearchResponse {\n  query: string;\n  hits: VerseSearchHit[];\n  /** Sessions actually scanned (the scan is bounded; see session-search.ts). */\n  scannedSessions: number;\n  truncated: boolean;\n}\n\n/** GET/POST /api/verse/memory — shared project memory for one project. */\nexport interface VerseProjectMemory {\n  projectPath: string;\n  enabled: boolean;\n  /** Contents of MEMORY.md ('' when absent). */\n  content: string;\n  bytes: number;\n  updatedAt: string | null;\n  /** Other files the agents created in the memory directory (names only). */\n  files: string[];\n  /**\n   * Present (true) only when `content` as SENT differs from the bytes on disk:\n   * the public-JSON sanitizer rewrote the home path to `~` or replaced a\n   * secret-looking value with `[REDACTED]`. The file itself is untouched; a\n   * save that would write placeholders over real values is refused (409\n   * VERSE_MEMORY_REDACTED), so the editor must say so before the operator types.\n   */\n  contentSanitized?: boolean;\n}\n\n/** POST /api/verse/memory */\nexport interface VerseProjectMemoryWrite {\n  projectPath: string;\n  content: string;\n}\n\nexport const VERSE_MEMORY_MAX_BYTES = 64 * 1024;\n\n/**\n * POST /api/verse/memory's own JSON body cap: JSON escaping can double the\n * content (every newline becomes `\\\\n`), plus room for the other fields. Every\n * other route keeps the 64 KiB default. Shared so the browser's pre-check can\n * never refuse a save the server would accept.\n */\nexport const VERSE_MEMORY_BODY_MAX_BYTES = 2 * VERSE_MEMORY_MAX_BYTES + 8 * 1024;\n\n/** Cap on the memory block appended to each session's system prompt. */\nexport const VERSE_MEMORY_BLOCK_MAX_BYTES = 6 * 1024;\n","/**\n * routes/verse/context/context-model.ts — the pure half of the context\n * components (handoff dialog, memory panel, session search). No React, no\n * I/O, so every rule the components render is pinned by a plain unit test.\n *\n * Every number shown here comes from context-math.ts (the one module the\n * server and the browser share), so \"compacts ≈367k\" in the handoff dialog is\n * the same figure the meter and the seat picker show.\n */\nimport type { VerseEngine, VerseModelOption, VerseSeat, VerseSession } from '../../../data/api-types.js';\nimport type {\n  VerseContextMode,\n  VerseFitVerdict,\n  VersePreferences,\n  VerseSearchHit,\n} from '../../../../core/verse/types.js';\nimport { VERSE_MEMORY_BLOCK_MAX_BYTES, VERSE_MEMORY_BODY_MAX_BYTES } from '../../../../core/verse/types.js';\nimport {\n  budgetFor,\n  canonicalModelId,\n  estimateTokensFromChars,\n  fitVerdict,\n  hasExpansiveMode,\n  sessionOverheadTokens,\n} from '../../../../core/verse/context-math.js';\nimport { formatContextWindow, formatRelative } from '../verse-model.js';\nimport { asClause, percentText, tidyProse } from '../autonomy/format.js';\nimport { formatTokens } from '../verse-readouts.js';\n\n// ---------------------------------------------------------------------------\n// Handoff\n// ---------------------------------------------------------------------------\n\n// The canned \"Ask this seat to summarize first\" turn is\n// VERSE_HANDOFF_SUMMARY_REQUEST in core/verse/types.ts, not a copy here: the\n// handoff builder on the server matches that exact text to keep it OUT of the\n// new session's \"latest requests\" (otherwise the new chat is told to write\n// another handoff note). A local copy that drifted by one character would\n// silently defeat that filter.\n\n/** Mirrors session-engine's TITLE_MAX so a title we send is never cut by the server instead. */\nexport const TITLE_MAX_CHARS = 120;\n\nconst PART_SUFFIX = /\\s·\\spart\\s(\\d+)$/;\n\n/**\n * Title for the session a handoff continues in: \"Fix the login bug · part 2\".\n * A continuation of a continuation counts up rather than stacking suffixes, so\n * the sidebar reads \"part 3\", never \"part 2 · part 2\".\n */\nexport function handoffTitle(sourceTitle: string): string {\n  const collapsed = sourceTitle.replace(/\\s+/g, ' ').trim();\n  const match = PART_SUFFIX.exec(collapsed);\n  const base = (match ? collapsed.slice(0, match.index) : collapsed) || 'Untitled chat';\n  const next = match ? Number.parseInt(match[1]!, 10) + 1 : 2;\n  const suffix = ` · part ${next}`;\n  const room = TITLE_MAX_CHARS - suffix.length;\n  const clipped = base.length > room ? `${base.slice(0, room - 1).trimEnd()}…` : base;\n  return `${clipped}${suffix}`;\n}\n\n/**\n * A seat's catalog entry for a model id. Exact id first, then canonical — a\n * session created before the alias fix stores `claude-opus-5.5` while the\n * catalog now lists `claude-opus-5-5` (context-math VERSE_MODEL_ID_ALIASES).\n */\nexport function modelOption(seat: VerseSeat | null | undefined, modelId: string): VerseModelOption | null {\n  if (!seat) return null;\n  const exact = seat.models.find((m) => m.id === modelId);\n  if (exact) return exact;\n  const canonical = canonicalModelId(modelId);\n  return seat.models.find((m) => canonicalModelId(m.id) === canonical) ?? null;\n}\n\n/**\n * Why a seat+model cannot take a new session right now; null when it can.\n *\n * The seat's own reason is embedded as a clause: its closing period is\n * dropped (no \"exhausted..\") and any ISO instant in it — a health summary\n * saying when usage resets — is read as the viewer's local time.\n */\nexport function targetUnavailableReason(\n  seat: VerseSeat | null | undefined,\n  option: VerseModelOption | null,\n  now: number = Date.now(),\n): string | null {\n  if (!seat) return 'Pick a seat to continue on.';\n  if (seat.health.state === 'unavailable') {\n    return `${seat.label} is unavailable: ${asClause(tidyProse(seat.health.summary ?? 'no reason given', now))}.`;\n  }\n  if (!option) return 'Pick a model on this seat.';\n  if (option.unavailableReason) {\n    return `${option.label} cannot run on ${seat.label}: ${asClause(tidyProse(option.unavailableReason, now))}.`;\n  }\n  return null;\n}\n\nexport interface HandoffTarget {\n  seatId: string;\n  model: string;\n}\n\n/**\n * Where a handoff lands by default: the SAME seat and model (the common case\n * is \"same agent, fresh context\"). When that model can no longer run there,\n * the seat's first runnable model; when the seat itself is gone or\n * unavailable, the first runnable model on any available seat, in the seat\n * list's own order.\n */\nexport function defaultHandoffTarget(seats: readonly VerseSeat[], source: Pick<VerseSession, 'seatId' | 'model'>): HandoffTarget | null {\n  const own = seats.find((s) => s.id === source.seatId);\n  if (own && own.health.state !== 'unavailable') {\n    const same = modelOption(own, source.model);\n    if (same && !same.unavailableReason) return { seatId: own.id, model: same.id };\n    const runnable = own.models.find((m) => !m.unavailableReason);\n    if (runnable) return { seatId: own.id, model: runnable.id };\n  }\n  for (const seat of seats) {\n    if (seat.health.state === 'unavailable') continue;\n    const runnable = seat.models.find((m) => !m.unavailableReason);\n    if (runnable) return { seatId: seat.id, model: runnable.id };\n  }\n  return null;\n}\n\n/**\n * The mode a handoff starts in. Only a mode that EXISTS for the target model\n * is ever returned (a mode with no budget would be refused by the server).\n *\n *  1. Same seat and model as the source → keep the source's mode. \"Continue in\n *     a fresh chat\" means the same settings with a clean context; an operator\n *     who chose expansive for this work chose it for the work.\n *  2. Otherwise the target seat's standing preference (preferences.json).\n *  3. Otherwise standard.\n */\nexport function defaultHandoffMode(input: {\n  option: VerseModelOption | null;\n  target: HandoffTarget | null;\n  source: Pick<VerseSession, 'seatId' | 'model' | 'contextMode'>;\n  preferences: VersePreferences | null | undefined;\n}): VerseContextMode {\n  const { option, target, source, preferences } = input;\n  const valid = (mode: VerseContextMode | undefined): mode is VerseContextMode =>\n    mode !== undefined && budgetFor(option, mode) !== null;\n  const sameModel = target !== null && target.seatId === source.seatId\n    && canonicalModelId(target.model) === canonicalModelId(source.model);\n  if (sameModel && valid(source.contextMode ?? 'standard')) return source.contextMode ?? 'standard';\n  const preferred = target ? preferences?.seats[target.seatId]?.contextMode : undefined;\n  if (valid(preferred)) return preferred;\n  return 'standard';\n}\n\n/**\n * The mode to put on the create request, or undefined to leave it to the\n * server. A mode is sent only when the model has a budget for it — which is\n * exactly the server's acceptance rule — so what the dialog shows is what is\n * created, and an unknown-window model is never refused over a mode it could\n * not have.\n */\nexport function requestMode(option: VerseModelOption | null, mode: VerseContextMode): VerseContextMode | undefined {\n  return budgetFor(option, mode) !== null ? mode : undefined;\n}\n\n/** \"1M window · compacts ≈367k\" for a model in a mode; null when the budget is unknown. */\nexport function budgetLine(option: VerseModelOption | null, mode: VerseContextMode): string | null {\n  const budget = budgetFor(option, mode);\n  if (!budget) return null;\n  const window = `${formatContextWindow(budget.contextWindow)} window`;\n  return budget.autoCompactAt === null ? window : `${window} · compacts ≈${formatTokens(budget.autoCompactAt)}`;\n}\n\nexport interface HandoffFit {\n  verdict: VerseFitVerdict | null;\n  /** The handoff text's own estimate (chars / 4). */\n  handoffTokens: number;\n  /** The target engine's estimated fixed prompt (context-math `sessionOverheadTokens`). */\n  overheadTokens: number;\n  /** Handoff + that fixed prompt: what the new session holds before its first reply. */\n  needTokens: number;\n  /** One sentence for the dialog. */\n  text: string;\n  tone: 'ok' | 'warn' | 'danger' | 'unknown';\n}\n\n/**\n * Will the new session START comfortably? The handoff is small by design\n * (≤ 12k chars ≈ 3k tokens), but every fresh session also carries the CLI's\n * fixed prompt — a large share of a 64k local slot — so this is a real\n * question on small windows, and the sentence shows both halves of the sum\n * rather than a bare verdict.\n *\n * The fixed prompt is the TARGET seat's engine estimate (local ≈15k measured,\n * claude ≈25k, …), not one flat figure: a flat 30k called every handoff to a\n * 64k local seat \"too big for one context\" when the real sum was ~20k. It is\n * still an estimate — no CLI reports its base prompt before the first turn —\n * so the sentence says \"estimated\" rather than presenting it as a reading.\n * `engine` null (target seat not known yet) falls back to the largest estimate.\n */\nexport function handoffFit(\n  textChars: number,\n  option: VerseModelOption | null,\n  mode: VerseContextMode,\n  engine: VerseEngine | null,\n): HandoffFit {\n  const handoffTokens = estimateTokensFromChars(textChars);\n  const overheadTokens = sessionOverheadTokens(engine);\n  const needTokens = handoffTokens + overheadTokens;\n  const verdict = fitVerdict(handoffTokens, option, overheadTokens);\n  const sum = `~${formatTokens(handoffTokens)} tokens of handoff + an estimated ~${formatTokens(overheadTokens)} of fixed prompt`;\n  const standard = budgetFor(option, 'standard');\n  const standardCap = standard ? standard.autoCompactAt ?? standard.contextWindow : null;\n  const base = { verdict, handoffTokens, overheadTokens, needTokens };\n  switch (verdict) {\n    case 'fits':\n      return { ...base, tone: 'ok', text: `Fits: ${sum} leaves most of the budget before the first compaction.` };\n    case 'tight':\n      return {\n        ...base,\n        tone: 'warn',\n        text: `Tight: ${sum} is ${percentText((needTokens / (standardCap ?? needTokens)) * 100)} of where this model compacts — the new chat will compact early.`,\n      };\n    case 'expansive':\n      return mode === 'expansive'\n        ? { ...base, tone: 'warn', text: `Fits only the expansive budget: ${sum}.` }\n        : { ...base, tone: 'danger', text: `Too big for the standard budget (${sum}). Switch to Expansive, or trim the handoff.` };\n    case 'split':\n      return { ...base, tone: 'danger', text: `Too big for one context on this model (${sum}). Trim the handoff or pick a seat with a larger window.` };\n    default:\n      return { ...base, verdict: null, tone: 'unknown', text: 'This model’s window is not known, so there is no fit estimate.' };\n  }\n}\n\n/** True when the target model has a real expansive budget (context-math, re-exported for the dialog). */\nexport function offersExpansive(option: VerseModelOption | null): boolean {\n  return hasExpansiveMode(option);\n}\n\n/** A local turn runs on this machine; every other engine spends subscription usage. */\nexport function turnCostSentence(engine: VerseEngine, seatLabel: string): string {\n  return engine === 'local'\n    ? `Runs on this machine with ${seatLabel}; it spends no subscription usage.`\n    : `Sends one turn to ${seatLabel} and spends from its usage. The automatic preview costs nothing.`;\n}\n\n// ---------------------------------------------------------------------------\n// Bytes\n// ---------------------------------------------------------------------------\n\nconst encoder = typeof TextEncoder === 'function' ? new TextEncoder() : null;\n\n/** UTF-8 byte length — the unit the server's caps (64 KB memory content, 64 KB turn) are written in. */\nexport function utf8Bytes(text: string): number {\n  if (encoder) return encoder.encode(text).length;\n  // Fallback for an environment with no TextEncoder: count code points by width.\n  let bytes = 0;\n  for (const ch of text) {\n    const cp = ch.codePointAt(0) ?? 0;\n    bytes += cp < 0x80 ? 1 : cp < 0x800 ? 2 : cp < 0x10000 ? 3 : 4;\n  }\n  return bytes;\n}\n\n/**\n * The API's default request-body cap: `readBody` in src/core/web/api.ts, which\n * every /api/verse POST uses unless its route passes a larger one (only\n * POST /memory does — see MEMORY_BODY_MAX_BYTES). A write travels as JSON, so what must fit is\n * the ENCODED body — every `\\n` and `\"` escaped to two bytes — not the text\n * alone; the editors measure it so a refusal happens on screen instead of as\n * \"request body too large\".\n */\nexport const API_BODY_MAX_BYTES = 65_536;\n\n/**\n * POST /api/verse/memory's own body cap — mirrors `VERSE_MEMORY_BODY_MAX_BYTES`\n * in src/core/verse/verse-api.ts (a server module the browser cannot import):\n * room for 64 KiB of content in which EVERY byte escapes to two, plus the\n * project path and the JSON around it. The server still holds the CONTENT to\n * VERSE_MEMORY_MAX_BYTES after parsing. Guarding the memory editor with the\n * 64 KiB default instead blocked saves the server accepts — a 60–64 KB\n * MEMORY.md with ordinary line breaks could not be edited from the panel,\n * which is the exact case the server's larger cap exists for.\n */\nexport const MEMORY_BODY_MAX_BYTES = VERSE_MEMORY_BODY_MAX_BYTES;\n\n/** UTF-8 size of `body` exactly as the client will send it. */\nexport function jsonBodyBytes(body: unknown): number {\n  return utf8Bytes(JSON.stringify(body) ?? '');\n}\n\nexport function formatBytes(bytes: number): string {\n  if (!Number.isFinite(bytes) || bytes < 0) return '—';\n  if (bytes < 1024) return `${bytes} B`;\n  const kb = bytes / 1024;\n  return `${kb < 10 ? kb.toFixed(1).replace(/\\.0$/, '') : Math.round(kb)} KB`;\n}\n\n/**\n * A relative time that reads as a phrase: \"just now\", \"5m ago\", \"on Sep 19\".\n * `formatRelative` (verse-model) is sized for a 5ch sidebar column and reads\n * as a bare token; prose needs the preposition.\n */\nexport function relativePhrase(iso: string | null | undefined, now: number = Date.now()): string | null {\n  if (!iso) return null;\n  const short = formatRelative(iso, now);\n  if (!short) return null;\n  if (short === 'now') return 'just now';\n  // Only the relative tokens (\"5m\", \"3h\", \"2d\") take \"ago\". Anything else is a\n  // DATE, whatever the locale prints: \"Sep 1\" (en-US) but \"1 Sept\" (en-GB)\n  // and \"1. Sept.\" (de) start with a digit — testing for a leading digit\n  // printed \"Last completed 1 Sept ago.\" outside the US.\n  return /^\\d+[mhd]$/.test(short) ? `${short} ago` : `on ${short}`;\n}\n\n// ---------------------------------------------------------------------------\n// Memory\n// ---------------------------------------------------------------------------\n\n/**\n * Shapes that are almost certainly credentials. MEMORY.md is sent to every\n * seat's model on every turn, so a pasted key would travel to every provider\n * — the panel warns BEFORE the save rather than trusting the server's scrub\n * to catch it on the way out. Conservative on purpose: a false alarm on prose\n * would teach the operator to ignore the warning.\n */\nconst SECRET_PATTERNS: ReadonlyArray<{ label: string; re: RegExp }> = [\n  { label: 'a private key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },\n  { label: 'an Anthropic API key', re: /\\bsk-ant-[A-Za-z0-9_-]{20,}/ },\n  { label: 'an OpenAI-style API key', re: /\\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/ },\n  { label: 'an xAI API key', re: /\\bxai-[A-Za-z0-9]{32,}/ },\n  { label: 'a GitHub token', re: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}|\\bgithub_pat_[A-Za-z0-9_]{40,}/ },\n  { label: 'an AWS access key', re: /\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b/ },\n  { label: 'a Slack token', re: /\\bxox[abprs]-[A-Za-z0-9-]{10,}/ },\n  { label: 'a Google API key', re: /\\bAIza[0-9A-Za-z_-]{35}\\b/ },\n  { label: 'a Stripe secret key', re: /\\b(?:sk|rk)_live_[0-9A-Za-z]{20,}/ },\n];\n\n/**\n * Mirrors `VERSE_MEMORY_BLOCK_MAX_BYTES` in src/core/verse/project-memory.ts\n * (a node module the browser cannot import): the most memory text a chat's\n * instructions carry, however large MEMORY.md itself is.\n */\nexport const MEMORY_BLOCK_MAX_BYTES = VERSE_MEMORY_BLOCK_MAX_BYTES;\n\n/**\n * What memory costs, in the one wording the memory panel and the resources\n * panel share. Memory is ON by default and snapshotted into every new chat's\n * system prompt (claude `--append-system-prompt`, codex `developer_instructions`,\n * grok `--rules`), which re-rides every turn, and it asks writable seats to\n * read and update MEMORY.md — tool calls and output. On a paid seat that is\n * real (if small, mostly cached) usage, so \"nothing here spends\" would be\n * false for exactly the operator deciding whether to leave it on near a limit.\n * Reading and editing the file from the panel is still free.\n */\nexport const MEMORY_SPEND_NOTE =\n  `Reading and editing memory here spends nothing. On a paid seat it is not free to use: each new chat’s system prompt carries a memory block of up to ${MEMORY_BLOCK_MAX_BYTES / 1024} KB, re-sent every turn (cached after the first), and the agent reads and updates MEMORY.md as it works. Local seats spend nothing.`;\n\n/** The first credential shape found, as a phrase (\"a GitHub token\"), or null. */\nexport function secretLike(text: string): string | null {\n  for (const { label, re } of SECRET_PATTERNS) if (re.test(text)) return label;\n  return null;\n}\n\n/**\n * The placeholder the server's scrubber (src/core/util/scrub.ts) writes over\n * secret-shaped text in every rule. In a memory view flagged\n * `contentSanitized`, each one stands for a REAL value still in MEMORY.md.\n */\nexport const REDACTION_MARKER = '[REDACTED]';\n\n/** How many redaction placeholders a text carries. */\nexport function redactionMarkers(text: string): number {\n  return text.split(REDACTION_MARKER).length - 1;\n}\n\n// ---------------------------------------------------------------------------\n// Search\n// ---------------------------------------------------------------------------\n\n/** Below this many characters a keyword search over every message is noise, not recall. */\nexport const SEARCH_MIN_CHARS = 2;\n/** Keystrokes inside this window collapse into one request. */\nexport const SEARCH_DEBOUNCE_MS = 250;\n/** Hits asked for per search — enough to fill the sidebar twice over. */\nexport const SEARCH_LIMIT = 30;\n\n/** Whitespace-separated terms, lowercased and de-duplicated (the server ANDs them). */\nexport function searchTerms(query: string): string[] {\n  const out: string[] = [];\n  for (const raw of query.toLowerCase().split(/\\s+/)) {\n    if (raw && !out.includes(raw)) out.push(raw);\n  }\n  return out;\n}\n\nexport interface HighlightSegment {\n  text: string;\n  match: boolean;\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Split `text` into plain and matched runs for every term, case-insensitive.\n * Longest terms first so \"migrate\" wins over \"migrat\" at the same position.\n */\nexport function highlightSegments(text: string, terms: readonly string[]): HighlightSegment[] {\n  const usable = [...terms].filter((t) => t.length > 0).sort((a, b) => b.length - a.length);\n  if (usable.length === 0 || text.length === 0) return text ? [{ text, match: false }] : [];\n  const re = new RegExp(usable.map(escapeRegExp).join('|'), 'gi');\n  const out: HighlightSegment[] = [];\n  let last = 0;\n  for (const m of text.matchAll(re)) {\n    const start = m.index ?? 0;\n    if (m[0].length === 0) continue;\n    if (start > last) out.push({ text: text.slice(last, start), match: false });\n    out.push({ text: m[0], match: true });\n    last = start + m[0].length;\n  }\n  if (last < text.length) out.push({ text: text.slice(last), match: false });\n  return out;\n}\n\nexport interface SessionSearchGroup {\n  sessionId: string;\n  title: string;\n  projectPath: string;\n  engine: VerseEngine;\n  /** The best-scoring hit in this session (the server returns hits best-first). */\n  top: VerseSearchHit;\n  /** Every hit this session contributed to the response. */\n  count: number;\n  /** Newest hit time, for the row's relative time. */\n  latestAt: string;\n}\n\n/**\n * One row per session. The server ranks MESSAGES; the sidebar lists CHATS,\n * and five rows for one chat would push every other match off screen. Order\n * is the order each session first appears, i.e. by its best hit.\n */\nexport function groupSearchHits(hits: readonly VerseSearchHit[]): SessionSearchGroup[] {\n  const groups = new Map<string, SessionSearchGroup>();\n  for (const hit of hits) {\n    const existing = groups.get(hit.sessionId);\n    if (!existing) {\n      groups.set(hit.sessionId, {\n        sessionId: hit.sessionId,\n        title: hit.title,\n        projectPath: hit.projectPath,\n        engine: hit.engine,\n        top: hit,\n        count: 1,\n        latestAt: hit.at,\n      });\n      continue;\n    }\n    existing.count += 1;\n    if (hit.at > existing.latestAt) existing.latestAt = hit.at;\n  }\n  return [...groups.values()];\n}\n"],"mappings":"oMAglBA,IAAa,EAAgB,CAAC,UAAW,MAAO,SAAU,OAAQ,QAAS,KAAK,EAiSnE,EAA4B,MAqF5B,EAA0B,KAa1B,EAAgC,CAC3C,0FACA,+HACA,GACA,qBACA,0CACA,6DACA,0EACA,kDACA,6CACA,2EACA,GACA,qEACF,CAAC,CAAC,KAAK;CAAI,EA4EE,EAAyB,MAQzB,EAA8B,OAG9B,EAA+B,KC5gCtC,EAAc,oBAOpB,SAAgB,EAAa,EAA6B,CACxD,IAAM,EAAY,EAAY,QAAQ,OAAQ,GAAG,CAAC,CAAC,KAAK,EAClD,EAAQ,EAAY,KAAK,CAAS,EAClC,GAAQ,EAAQ,EAAU,MAAM,EAAG,EAAM,KAAK,EAAI,IAAc,gBAEhE,EAAS,WADF,EAAQ,OAAO,SAAS,EAAM,GAAK,EAAE,EAAI,EAAI,IAEpD,EAAA,IAAyB,EAAO,OAEtC,MAAO,GADS,EAAK,OAAS,EAAO,GAAG,EAAK,MAAM,EAAG,EAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAK,IAC3D,GACtB,CAOA,SAAgB,EAAY,EAAoC,EAA0C,CACxG,GAAI,CAAC,EAAM,OAAO,KAClB,IAAM,EAAQ,EAAK,OAAO,KAAM,GAAM,EAAE,KAAO,CAAO,EACtD,GAAI,EAAO,OAAO,EAClB,IAAM,EAAY,EAAiB,CAAO,EAC1C,OAAO,EAAK,OAAO,KAAM,GAAM,EAAiB,EAAE,EAAE,IAAM,CAAS,GAAK,IAC1E,CASA,SAAgB,EACd,EACA,EACA,EAAc,KAAK,IAAI,EACR,CASf,OARK,EACD,EAAK,OAAO,QAAU,cACjB,GAAG,EAAK,MAAM,mBAAmB,EAAS,EAAU,EAAK,OAAO,SAAW,kBAAmB,CAAG,CAAC,EAAE,GAExG,EACD,EAAO,kBACF,GAAG,EAAO,MAAM,iBAAiB,EAAK,MAAM,IAAI,EAAS,EAAU,EAAO,kBAAmB,CAAG,CAAC,EAAE,GAErG,KAJa,6BAJF,6BASpB,CAcA,SAAgB,EAAqB,EAA6B,EAAsE,CACtI,IAAM,EAAM,EAAM,KAAM,GAAM,EAAE,KAAO,EAAO,MAAM,EACpD,GAAI,GAAO,EAAI,OAAO,QAAU,cAAe,CAC7C,IAAM,EAAO,EAAY,EAAK,EAAO,KAAK,EAC1C,GAAI,GAAQ,CAAC,EAAK,kBAAmB,MAAO,CAAE,OAAQ,EAAI,GAAI,MAAO,EAAK,EAAG,EAC7E,IAAM,EAAW,EAAI,OAAO,KAAM,GAAM,CAAC,EAAE,iBAAiB,EAC5D,GAAI,EAAU,MAAO,CAAE,OAAQ,EAAI,GAAI,MAAO,EAAS,EAAG,CAC5D,CACA,IAAK,IAAM,KAAQ,EAAO,CACxB,GAAI,EAAK,OAAO,QAAU,cAAe,SACzC,IAAM,EAAW,EAAK,OAAO,KAAM,GAAM,CAAC,EAAE,iBAAiB,EAC7D,GAAI,EAAU,MAAO,CAAE,OAAQ,EAAK,GAAI,MAAO,EAAS,EAAG,CAC7D,CACA,OAAO,IACT,CAYA,SAAgB,EAAmB,EAKd,CACnB,GAAM,CAAE,SAAQ,SAAQ,SAAQ,eAAgB,EAC1C,EAAS,GACb,IAAS,IAAA,IAAa,EAAU,EAAQ,CAAI,IAAM,KAGpD,GAFkB,IAAW,MAAQ,EAAO,SAAW,EAAO,QACzD,EAAiB,EAAO,KAAK,IAAM,EAAiB,EAAO,KAAK,GACpD,EAAM,EAAO,aAAe,UAAU,EAAG,OAAO,EAAO,aAAe,WACvF,IAAM,EAAY,EAAS,GAAa,MAAM,EAAO,OAAO,EAAE,YAAc,IAAA,GAE5E,OADI,EAAM,CAAS,EAAU,EACtB,UACT,CASA,SAAgB,EAAY,EAAiC,EAAsD,CACjH,OAAO,EAAU,EAAQ,CAAI,IAAM,KAAc,IAAA,GAAP,CAC5C,CAGA,SAAgB,EAAW,EAAiC,EAAuC,CACjG,IAAM,EAAS,EAAU,EAAQ,CAAI,EACrC,GAAI,CAAC,EAAQ,OAAO,KACpB,IAAM,EAAS,GAAG,EAAoB,EAAO,aAAa,EAAE,SAC5D,OAAO,EAAO,gBAAkB,KAAO,EAAS,GAAG,EAAO,eAAe,EAAa,EAAO,aAAa,GAC5G,CA6BA,SAAgB,EACd,EACA,EACA,EACA,EACY,CACZ,IAAM,EAAgB,EAAwB,CAAS,EACjD,EAAiB,EAAsB,CAAM,EAC7C,EAAa,EAAgB,EAC7B,EAAU,EAAW,EAAe,EAAQ,CAAc,EAC1D,EAAM,IAAI,EAAa,CAAa,EAAE,qCAAqC,EAAa,CAAc,EAAE,kBACxG,EAAW,EAAU,EAAQ,UAAU,EACvC,EAAc,EAAW,EAAS,eAAiB,EAAS,cAAgB,KAC5E,EAAO,CAAE,UAAS,gBAAe,iBAAgB,YAAW,EAClE,OAAQ,EAAR,CACE,IAAK,OACH,MAAO,CAAE,GAAG,EAAM,KAAM,KAAM,KAAM,SAAS,EAAI,wDAAyD,EAC5G,IAAK,QACH,MAAO,CACL,GAAG,EACH,KAAM,OACN,KAAM,UAAU,EAAI,MAAM,EAAa,GAAc,GAAe,GAAe,GAAG,EAAE,iEAC1F,EACF,IAAK,YACH,OAAO,IAAS,YACZ,CAAE,GAAG,EAAM,KAAM,OAAQ,KAAM,mCAAmC,EAAI,EAAG,EACzE,CAAE,GAAG,EAAM,KAAM,SAAU,KAAM,oCAAoC,EAAI,6CAA8C,EAC7H,IAAK,QACH,MAAO,CAAE,GAAG,EAAM,KAAM,SAAU,KAAM,0CAA0C,EAAI,yDAA0D,EAClJ,QACE,MAAO,CAAE,GAAG,EAAM,QAAS,KAAM,KAAM,UAAW,KAAM,gEAAiE,CAC7H,CACF,CAGA,SAAgB,EAAgB,EAA0C,CACxE,OAAO,EAAiB,CAAM,CAChC,CAGA,SAAgB,EAAiB,EAAqB,EAA2B,CAC/E,OAAO,IAAW,QACd,6BAA6B,EAAU,oCACvC,qBAAqB,EAAU,iEACrC,CAMA,IAAM,EAAU,OAAO,aAAgB,WAAa,IAAI,YAAgB,KAGxE,SAAgB,EAAU,EAAsB,CAC9C,GAAI,EAAS,OAAO,EAAQ,OAAO,CAAI,CAAC,CAAC,OAEzC,IAAI,EAAQ,EACZ,IAAK,IAAM,KAAM,EAAM,CACrB,IAAM,EAAK,EAAG,YAAY,CAAC,GAAK,EAChC,GAAS,EAAK,IAAO,EAAI,EAAK,KAAQ,EAAI,EAAK,MAAU,EAAI,CAC/D,CACA,OAAO,CACT,CAUA,IAAa,EAAqB,MAYrB,EAAwB,EAGrC,SAAgB,EAAc,EAAuB,CACnD,OAAO,EAAU,KAAK,UAAU,CAAI,GAAK,EAAE,CAC7C,CAEA,SAAgB,EAAY,EAAuB,CACjD,GAAI,CAAC,OAAO,SAAS,CAAK,GAAK,EAAQ,EAAG,MAAO,IACjD,GAAI,EAAQ,KAAM,MAAO,GAAG,EAAM,IAClC,IAAM,EAAK,EAAQ,KACnB,MAAO,GAAG,EAAK,GAAK,EAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAQ,EAAE,EAAI,KAAK,MAAM,CAAE,EAAE,IACzE,CAOA,SAAgB,EAAe,EAAgC,EAAc,KAAK,IAAI,EAAkB,CACtG,GAAI,CAAC,EAAK,OAAO,KACjB,IAAM,EAAQ,EAAe,EAAK,CAAG,EAOrC,OANK,EACD,IAAU,MAAc,WAKrB,aAAa,KAAK,CAAK,EAAI,GAAG,EAAM,MAAQ,MAAM,IANtC,IAOrB,CAaA,IAAM,EAAgE,CACpE,CAAE,MAAO,gBAAiB,GAAI,oCAAqC,EACnE,CAAE,MAAO,uBAAwB,GAAI,6BAA8B,EACnE,CAAE,MAAO,0BAA2B,GAAI,mCAAoC,EAC5E,CAAE,MAAO,iBAAkB,GAAI,wBAAyB,EACxD,CAAE,MAAO,iBAAkB,GAAI,2EAA4E,EAC3G,CAAE,MAAO,oBAAqB,GAAI,+BAAgC,EAClE,CAAE,MAAO,gBAAiB,GAAI,gCAAiC,EAC/D,CAAE,MAAO,mBAAoB,GAAI,2BAA4B,EAC7D,CAAE,MAAO,sBAAuB,GAAI,mCAAoC,CAC1E,EAOa,EAAyB,EAYzB,EACX,uJAAuJ,EAAyB,KAAK,qIAGvL,SAAgB,EAAW,EAA6B,CACtD,IAAK,GAAM,CAAE,QAAO,QAAQ,EAAiB,GAAI,EAAG,KAAK,CAAI,EAAG,OAAO,EACvE,OAAO,IACT,CAOA,IAAa,EAAmB,aAGhC,SAAgB,EAAiB,EAAsB,CACrD,OAAO,EAAK,MAAM,CAAgB,CAAC,CAAC,OAAS,CAC/C,CAcA,SAAgB,EAAY,EAAyB,CACnD,IAAM,EAAgB,CAAC,EACvB,IAAK,IAAM,KAAO,EAAM,YAAY,CAAC,CAAC,MAAM,KAAK,EAC3C,GAAO,CAAC,EAAI,SAAS,CAAG,GAAG,EAAI,KAAK,CAAG,EAE7C,OAAO,CACT,CAOA,SAAS,EAAa,EAAuB,CAC3C,OAAO,EAAM,QAAQ,sBAAuB,MAAM,CACpD,CAMA,SAAgB,EAAkB,EAAc,EAA8C,CAC5F,IAAM,EAAS,CAAC,GAAG,CAAK,CAAC,CAAC,OAAQ,GAAM,EAAE,OAAS,CAAC,CAAC,CAAC,MAAM,EAAG,IAAM,EAAE,OAAS,EAAE,MAAM,EACxF,GAAI,EAAO,SAAW,GAAK,EAAK,SAAW,EAAG,OAAO,EAAO,CAAC,CAAE,OAAM,MAAO,EAAM,CAAC,EAAI,CAAC,EACxF,IAAM,EAAK,IAAI,OAAO,EAAO,IAAI,CAAY,CAAC,CAAC,KAAK,GAAG,EAAG,IAAI,EACxD,EAA0B,CAAC,EAC7B,EAAO,EACX,IAAK,IAAM,KAAK,EAAK,SAAS,CAAE,EAAG,CACjC,IAAM,EAAQ,EAAE,OAAS,EACrB,EAAE,EAAE,CAAC,SAAW,IAChB,EAAQ,GAAM,EAAI,KAAK,CAAE,KAAM,EAAK,MAAM,EAAM,CAAK,EAAG,MAAO,EAAM,CAAC,EAC1E,EAAI,KAAK,CAAE,KAAM,EAAE,GAAI,MAAO,EAAK,CAAC,EACpC,EAAO,EAAQ,EAAE,EAAE,CAAC,OACtB,CAEA,OADI,EAAO,EAAK,QAAQ,EAAI,KAAK,CAAE,KAAM,EAAK,MAAM,CAAI,EAAG,MAAO,EAAM,CAAC,EAClE,CACT,CAoBA,SAAgB,EAAgB,EAAuD,CACrF,IAAM,EAAS,IAAI,IACnB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAW,EAAO,IAAI,EAAI,SAAS,EACzC,GAAI,CAAC,EAAU,CACb,EAAO,IAAI,EAAI,UAAW,CACxB,UAAW,EAAI,UACf,MAAO,EAAI,MACX,YAAa,EAAI,YACjB,OAAQ,EAAI,OACZ,IAAK,EACL,MAAO,EACP,SAAU,EAAI,EAChB,CAAC,EACD,QACF,CACA,EAAS,OAAS,EACd,EAAI,GAAK,EAAS,WAAU,EAAS,SAAW,EAAI,GAC1D,CACA,MAAO,CAAC,GAAG,EAAO,OAAO,CAAC,CAC5B"}
+{"version":3,"file":"context-model-CokrgEUq.js","names":[],"sources":["../../../../../../src/core/verse/types.ts","../../../../../../src/web-ui/routes/verse/context/context-model.ts"],"sourcesContent":["/**\n * Ashlr Verse — interactive multi-turn session contract (V1).\n *\n * A Verse session binds one project directory to one execution seat\n * (engine + account + model). Each user turn spawns ONE vendor CLI process\n * that resumes the vendor-native conversation by id, streams normalized\n * events, and exits. No long-lived stdin is held between turns.\n *\n * Seats:\n *   claude  -> `claude -p ... --output-format stream-json` via a native-profile launcher (account pinned by CLAUDE_CONFIG_DIR)\n *   local   -> the plain `claude` binary with ANTHROPIC_BASE_URL pointed at Ollama (Anthropic-compatible API); model = Ollama tag\n *   codex   -> `codex exec --json` / `codex exec resume <threadId> --json` via a native-profile launcher (CODEX_HOME pinned)\n *   grok    -> `grok -p ... --output-format streaming-messages-json` via a native-profile launcher (GROK_HOME pinned)\n *\n * Nothing in this module reads secrets. Account identity is pinned by the\n * launcher command recorded in ~/.ashlr/account-connections/connections.json.\n */\nimport type { TRANSIENT_EVENT_TYPE_LIST } from './transient-events.js';\n\nexport type VerseEngine = 'claude' | 'codex' | 'grok' | 'local';\n\nexport type VerseSessionStatus = 'idle' | 'running' | 'error';\n\n/** One selectable execution seat shown in the model/account picker. */\nexport interface VerseSeat {\n  /** Stable id, e.g. `claude`, `codex-personal`, `grok`, `local:qwen3-coder-next:ctx64k`. */\n  id: string;\n  engine: VerseEngine;\n  /** Human label, e.g. \"Claude Code\", \"Personal Codex\", \"Grok\", \"Qwen3-Coder-Next (local)\". */\n  label: string;\n  /** Account id from connections.json for native seats; `local` for Ollama seats. */\n  accountId: string;\n  /** Models this seat can run. First entry is the default. */\n  models: VerseModelOption[];\n  /** Best-known context window in tokens for the default model (null when unknown). */\n  contextWindow: number | null;\n  /** Latest health/usage evidence, if any. Never an admission input in V1. */\n  health: VerseSeatHealth;\n  /**\n   * V2.1 ADDITIVE. The subscription capacity behind this seat, so the seat\n   * list can render a meter without a second request.\n   *\n   * Absent (`undefined`) for LOCAL seats: an Ollama tag has no subscription\n   * and no provider window. Its real constraint is machine memory, which is\n   * reported by `VerseBootstrap.localRuntime`, not by a quota. Absent on a\n   * native seat means the server could not build a record for that account\n   * at all — `health.state` says what it does know.\n   */\n  capacity?: VerseSeatCapacity;\n  /**\n   * V3.9 ADDITIVE. The version of the CLI binary this seat is PINNED to (its\n   * native-profile launcher execs one exact file). Absent when unknown and on\n   * local seats. A pinned binary never updates itself, so a model that needs a\n   * newer CLI is listed with `unavailableReason` rather than silently failing.\n   */\n  cliVersion?: string;\n  /**\n   * V3.9 ADDITIVE. Plain-language facts about this seat's context setup the UI\n   * must show rather than imply (binary skew, catalog not yet fetched, …).\n   * Absent when there is nothing to say, so ordinary seats keep their shape.\n   */\n  notes?: string[];\n}\n\n/**\n * Where a context-window figure came from, so nothing on screen implies more\n * certainty than it has (docs/VERSE-CONTEXT.md §1).\n *\n * - `runtime`          — the CLI reported it for THIS turn (claude/grok\n *                        `result.modelUsage.<m>.contextWindow`, codex rollout\n *                        `token_count.info.model_context_window`, Ollama\n *                        `/api/ps`). Wins over everything else.\n * - `provider-catalog` — the seat's own served catalog on disk (codex/grok\n *                        `native-state/models_cache.json`).\n * - `cli-catalog`      — read out of the pinned CLI binary's embedded catalog\n *                        and recorded here with the version it was read from.\n * - `documented`       — the provider's published model table.\n * - `fallback`         — a named default; the UI marks it as an estimate.\n */\nexport type VerseWindowSource = 'runtime' | 'provider-catalog' | 'cli-catalog' | 'documented' | 'fallback';\n\n/**\n * How much context a session is allowed to accumulate before the CLI compacts.\n *\n * - `standard`  — the default. Evidence-based budget per engine: Claude 1M\n *                 models compact near 400k instead of ~967k; Codex, Grok and\n *                 local run their native windows.\n * - `expansive` — opt-in. Claude runs its full native window (CLI `auto`),\n *                 Codex raises `model_context_window` to the model's catalog\n *                 maximum (872k on GPT-6 / GPT-5.6). Costs more usage per turn,\n *                 buys simultaneous visibility for coupled, cross-cutting work.\n *\n * A mode that does not exist for a model (Grok, local, 200k Claude models,\n * GPT-5.5) is simply absent from that model's option — never faked.\n */\nexport type VerseContextMode = 'standard' | 'expansive';\n\nexport const VERSE_CONTEXT_MODES: readonly VerseContextMode[] = ['standard', 'expansive'];\n\n/** One mode's budget for a model on a seat. */\nexport interface VerseContextBudget {\n  /** The window the CLI measures against in this mode (the meter's denominator). */\n  contextWindow: number;\n  /** Token count at which the CLI auto-compacts in this mode; null when unknown. */\n  autoCompactAt: number | null;\n  /**\n   * The RAW window value the CLI must be TOLD to reach this budget, when that\n   * differs from `contextWindow` — codex measures against 95% of the window it\n   * is configured with, so expansive GPT-6 is `providerWindow: 872_000`\n   * (`-c model_context_window=872000`) but `contextWindow: 828_400`.\n   */\n  providerWindow?: number | null;\n}\n\nexport interface VerseModelOption {\n  id: string;\n  label: string;\n  /** Standard-mode window the CLI measures against (codex: the 95% effective window). */\n  contextWindow: number | null;\n  /**\n   * V3.9 ADDITIVE — every field below is optional so records and fixtures\n   * written before it keep validating. Absent means \"not known\", never zero.\n   */\n  /** Standard-mode auto-compaction point. */\n  autoCompactAt?: number | null;\n  /** Present ONLY when this model on this seat has a real expansive mode. */\n  expansive?: VerseContextBudget | null;\n  /** The CLI's default max output for this model, when known. */\n  maxOutputTokens?: number | null;\n  windowSource?: VerseWindowSource;\n  /** Minimum CLI version that knows this model id (e.g. '2.1.280'); null when any. */\n  minCliVersion?: string | null;\n  /**\n   * Why this model cannot run on this seat right now, in plain language (e.g.\n   * \"needs Claude Code 2.1.280; this seat runs 2.1.257\"). Null/absent = runnable.\n   * Listed rather than hidden so the operator learns WHY a model is missing.\n   */\n  unavailableReason?: string | null;\n}\n\nexport interface VerseSeatHealth {\n  state: 'ready' | 'degraded' | 'unavailable' | 'unknown';\n  /** e.g. \"5h window 72% used, resets 14:00\" — plain text, already sanitized. */\n  summary: string | null;\n  windows: Array<{ id: string; usedPercent: number | null; resetsAt: string | null }>;\n  observedAt: string | null;\n}\n\n// ---------------------------------------------------------------------------\n// Seat capacity (V2.1, additive) — see docs/VERSE-TELEMETRY-V2.md, which is\n// the authority for every honesty rule encoded in these shapes.\n//\n// This file is imported by the BROWSER bundle, so it may not import\n// `core/verse/accounts.ts` (node:fs). The shapes below therefore restate the\n// provider-record shapes structurally. `seats.ts` assigns the account record's\n// values straight into them, so a divergence in `core/verse/accounts.ts` stops\n// `seats.ts` compiling — that assignment is the drift guard.\n// ---------------------------------------------------------------------------\n\n/** One provider-reported quota window, as carried on a seat. */\nexport interface VerseSeatWindow {\n  id: string;\n  /** Provider-reported percent, or null for NO SIGNAL — which is not zero. */\n  usedPercent: number | null;\n  /**\n   * Machine-readable reset instant. STRUCTURALLY ALWAYS NULL for Claude: that\n   * provider publishes only a sentence, which lives in `resetDescription` and\n   * is rendered verbatim. The server never synthesizes an instant from it.\n   * (3.10.1: the Command burn-down chart may place the reset on its time axis\n   * via `resetInstantFromWords` in web-ui command-model, but only for the\n   * collector's exact \"Mon D at H:MMam (Area/Zone)\" form and only when the\n   * result lands within one window of now; anything else stays words.)\n   */\n  resetsAt: string | null;\n  /** The provider's own reset wording, verbatim (\"resets Sep 25 at 7pm (America/New_York)\"). */\n  resetDescription: string | null;\n  /**\n   * TRUE only when the provider explicitly FLAGGED the limit. Such a window's\n   * `usedPercent` is the SENTINEL 100 — a denial, not a measurement — and must\n   * be labelled \"limit reached\", never \"100% used\".\n   */\n  limitReached: boolean;\n  /** False when `usedPercent` is a flagged sentinel rather than a reading. */\n  measured: boolean;\n}\n\n/**\n * Codex credits, INDEPENDENT of the window: a fully used weekly window with a\n * spendable balance is not blocked. `null` is \"no signal\", never \"no credits\".\n */\nexport interface VerseSeatCredits {\n  hasCredits: boolean;\n  unlimited: boolean;\n  /** Provider-reported decimal string, kept verbatim — never rounded. */\n  balance: string | null;\n}\n\n/**\n * The coarse \"can I use this seat right now\" verdict. Deliberately coarse: the\n * exact numbers are in `windows`, and a verdict that pretended to more\n * precision than the providers give would be a lie.\n *\n * - `ready`      — a reading exists and the binding window has headroom.\n * - `tight`      — the binding window is at/above the warn threshold, OR it is\n *                  spent while Codex credits remain spendable (not blocked).\n * - `exhausted`  — the binding window is spent and nothing else is left.\n * - `signed-out` — the account is not authenticated; reconnect it.\n * - `unknown`    — NO window carried a percent. Not zero, not healthy.\n */\nexport type VerseSeatUsability = 'ready' | 'tight' | 'exhausted' | 'signed-out' | 'unknown';\n\n/**\n * Where a seat's windows came from, so nothing implies freshness it lacks.\n * Mirrors `VerseEvidenceSource` in `core/verse/accounts.ts`.\n */\nexport type VerseSeatEvidenceSource = 'collector' | 'shared-evidence' | 'baseline' | 'none';\n\n/** Everything the seat list needs to draw a capacity meter honestly. */\nexport interface VerseSeatCapacity {\n  /** e.g. \"max\", \"pro\", \"SuperGrok\". Null when the provider gave none. */\n  planType: string | null;\n  /**\n   * THE CONSTRAINT THAT ACTUALLY BLOCKS WORK: the window with the highest\n   * `usedPercent`. Null when no window carried a percent at all.\n   */\n  binding: VerseSeatWindow | null;\n  /** Every window the provider reported, in provider order. */\n  windows: VerseSeatWindow[];\n  /** Codex only; null for every other provider and when no signal exists. */\n  credits: VerseSeatCredits | null;\n  usability: VerseSeatUsability;\n  observedAt: string | null;\n  evidenceSource: VerseSeatEvidenceSource;\n  /** Plain-language provider facts the UI must show instead of implying a fault. */\n  notes: string[];\n}\n\nexport interface VerseProject {\n  path: string;\n  name: string;\n  /** From ~/.ashlr/enrollment.json when present. */\n  enrolled: boolean;\n}\n\n// ---------------------------------------------------------------------------\n// Workspaces (V2.2, ADDITIVE) — see docs/VERSE-WORKSPACES.md §1.\n//\n// A session bound to ONE directory cannot express \"this service plus the\n// shared library it depends on\", which is most real work. A workspace is a\n// NAMED set of roots with exactly one marked primary.\n//\n// `VerseSession.projectPath` keeps its meaning — it IS the primary root — so\n// every session record, adapter and test written before workspaces existed\n// still loads and still runs. Nothing rewrites saved chat history.\n//\n// ENROLLMENT IS NOT PART OF THIS SHAPE ON PURPOSE. A workspace says what a\n// session may REACH; `~/.ashlr/enrollment.json` says what the AUTONOMOUS lane\n// may mutate, and the two are deliberately separate registries. Membership in\n// a workspace grants no enrollment: `enrolled` below is READ from the\n// registry per root and is never written by anything in this feature.\n// ---------------------------------------------------------------------------\n\n/** One directory in a workspace. Exactly one root in a workspace is primary. */\nexport interface VerseWorkspaceRoot {\n  /** Absolute, physically resolved path (symlinks followed). */\n  path: string;\n  /** Display name; defaults to the basename. */\n  name: string;\n  /**\n   * The session's cwd and the value `projectPath` carries. Exactly one root\n   * per workspace has this set.\n   */\n  primary: boolean;\n}\n\n/**\n * A named set of roots.\n *\n * ONE TYPE, TWO USES, DELIBERATELY. An interactive session binds to a\n * workspace to decide what it can reach; the autonomous lane reads the same\n * workspace as a SECTION — \"these repositories collaborate, work on them\n * together\" — when `section` is true. They were not split because the thing\n * being named is identical in both: a set of directories that belong to one\n * piece of work. Two registries of named repo groups would drift.\n *\n * What is NOT on this type is priority. A repo may belong to several\n * workspaces, so a per-membership rank would give one repo several\n * contradictory ranks. Priority is therefore an attribute OF THE REPO, held\n * once per path in the same registry — see `VerseRootPriority`.\n */\nexport interface VerseWorkspace {\n  id: string;\n  name: string;\n  /** Primary first, then the extras in the order they were added. */\n  roots: VerseWorkspaceRoot[];\n  /**\n   * Offer this workspace to the autonomous lane as a section.\n   *\n   * GRANTS NOTHING. The fleet still reaches only what\n   * `~/.ashlr/enrollment.json` permits; a section can group and order those\n   * repos and nothing else. A member that is not enrolled stays unreachable.\n   */\n  section: boolean;\n  createdAt: string;\n  updatedAt: string;\n}\n\n/**\n * Relative standing of one repository in the autonomous lane's attention.\n *\n * ORDERING ONLY, NEVER ADMISSION. `critical` on an unenrolled repo is still\n * refused by `assertMayMutate`; `low` on an enrolled one is still permitted.\n * An ordinal rather than a number because the operator's judgement here is\n * \"this matters more than that\", and a 0-100 score would invent a precision\n * nobody holds.\n *\n * Absent means `normal`, which is how every repo already behaves — so a\n * registry with no priorities at all reproduces today's flat list exactly.\n */\nexport type VerseRootPriority = 'critical' | 'high' | 'normal' | 'low';\n\nexport const VERSE_ROOT_PRIORITIES: readonly VerseRootPriority[] =\n  ['critical', 'high', 'normal', 'low'];\n\nexport const VERSE_DEFAULT_ROOT_PRIORITY: VerseRootPriority = 'normal';\n\n/** Sort weight; lower sorts first. Never a budget, never a multiplier. */\nexport const VERSE_ROOT_PRIORITY_RANK: Record<VerseRootPriority, number> = {\n  critical: 0,\n  high: 1,\n  normal: 2,\n  low: 3,\n};\n\n/** One enrolled repository as the autonomy scope view ranks it. */\nexport interface VerseAutonomyScopeEntry {\n  path: string;\n  name: string;\n  priority: VerseRootPriority;\n  /** Sections (workspaces with `section: true`) this repo belongs to. */\n  sections: Array<{ id: string; name: string }>;\n  /** True when a focus section is set and this repo is outside it. */\n  outsideFocus: boolean;\n}\n\n/**\n * The autonomous lane's scope, ORDERED.\n *\n * Built by INTERSECTING section membership with the enrollment registry, so\n * it can only ever be a subset of what enrollment already allows. Sections\n * add ordering and grouping; they never add reach.\n */\nexport interface VerseAutonomyScopeView {\n  focusSectionId: string | null;\n  focusSectionName: string | null;\n  /** Enrolled repos, most important first. */\n  entries: VerseAutonomyScopeEntry[];\n  /**\n   * Paths a section names that are NOT enrolled. Listed so the blast radius\n   * is legible in both directions — these are exactly the repos a section\n   * does NOT give the fleet.\n   */\n  unenrolledSectionRoots: string[];\n}\n\n/**\n * Per-root git identity. A turn that edits two repos produces two diffs, so\n * the transcript has to be able to attribute each file to the right one.\n *\n * `remote` is the canonical `owner/repo` for a GitHub origin and null for\n * anything else — deliberately NOT the raw remote URL, which can carry a\n * token in its userinfo and would then reach an API response.\n */\nexport interface VerseRootGit {\n  branch: string;\n  /** Count of porcelain entries; 0 is clean. */\n  dirty: number;\n  ahead: number;\n  behind: number;\n  remote: string | null;\n}\n\n/** A root as the client sees it: identity, reachability and honest scope. */\nexport interface VerseRootStatus {\n  path: string;\n  name: string;\n  primary: boolean;\n  exists: boolean;\n  /**\n   * Read live from the enrollment registry. FALSE means the interactive lane\n   * still works on this root while the autonomous lane refuses it — being in\n   * a workspace never changes this.\n   */\n  enrolled: boolean;\n  /** Null when the root is not a git repository, or git is unavailable. */\n  git: VerseRootGit | null;\n  /**\n   * False when the session's engine has no way to be granted this root (Grok's\n   * CLI exposes `--cwd` and nothing else). The root is still listed, because\n   * hiding it would misrepresent what the workspace is.\n   */\n  reachable: boolean;\n}\n\n/** GET /api/verse/sessions/:id/roots */\nexport interface VerseSessionRootsResponse {\n  sessionId: string;\n  workspaceId: string | null;\n  workspaceName: string | null;\n  roots: VerseRootStatus[];\n  /**\n   * Plain-language facts the UI must show rather than imply: an unreachable\n   * root on a Grok seat, or a root the autonomous lane will refuse.\n   */\n  notes: string[];\n}\n\n/** GET /api/verse/workspaces */\nexport interface VerseWorkspacesResponse {\n  workspaces: VerseWorkspace[];\n  /** Live per-root facts, keyed by workspace id, so one read draws the list. */\n  status: Record<string, VerseRootStatus[]>;\n  /** Per-repo priority, keyed by canonical path. Absent key means `normal`. */\n  priorities: Record<string, VerseRootPriority>;\n  focusSectionId: string | null;\n}\n\n/** POST /api/verse/workspaces */\nexport interface VerseWorkspaceCreateRequest {\n  name: string;\n  /** Absolute paths. The first is the primary. */\n  roots: string[];\n  /** Also offer this set to the autonomous lane as a section. Default false. */\n  section?: boolean;\n}\n\n/** POST /api/verse/workspaces/:id/update */\nexport interface VerseWorkspaceUpdateRequest {\n  name?: string;\n  /** When present, replaces the root set wholesale. First entry is primary. */\n  roots?: string[];\n  section?: boolean;\n}\n\n/** POST /api/verse/workspaces/priority */\nexport interface VerseRootPriorityRequest {\n  path: string;\n  priority: VerseRootPriority;\n}\n\n/** POST /api/verse/workspaces/focus — `sectionId: null` clears the focus. */\nexport interface VerseFocusSectionRequest {\n  sectionId: string | null;\n}\n\n/** Hard cap on roots per workspace — a blast radius, not a UI limit. */\nexport const VERSE_MAX_WORKSPACE_ROOTS = 8;\n\n/**\n * Every root a session can reach, primary first.\n *\n * Pure and total: a record written before workspaces existed has no\n * `extraRoots` and yields exactly `[projectPath]`, which is what every caller\n * assumed before this existed.\n */\nexport function verseSessionRoots(\n  session: Pick<VerseSession, 'projectPath' | 'extraRoots'>,\n): string[] {\n  const out = [session.projectPath];\n  for (const root of session.extraRoots ?? []) {\n    if (typeof root === 'string' && root.length > 0 && !out.includes(root)) out.push(root);\n  }\n  return out;\n}\n\nexport interface VerseUsage {\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheCreationTokens: number;\n  /**\n   * Prompt size of the most recent assistant call = live context occupancy.\n   * Stored UNCLAMPED: a reading above the window is information (the CLI is\n   * about to compact or overflow), and only the UI decides how to draw it.\n   */\n  contextTokens: number;\n  contextWindow: number | null;\n  /** V3.9 ADDITIVE. Where `contextWindow` came from; absent on old records. */\n  contextWindowSource?: VerseWindowSource;\n  /** V3.9 ADDITIVE. Auto-compaction point for the session's current mode. */\n  autoCompactAt?: number | null;\n  /**\n   * V3.9 ADDITIVE. False when `contextTokens` is an UPPER BOUND rather than a\n   * measurement (codex before its rollout is readable: the turn total sums\n   * every model call). Absent means exact.\n   */\n  contextTokensExact?: boolean;\n}\n\nexport interface VerseSession {\n  id: string;\n  title: string;\n  /**\n   * The PRIMARY root: the process cwd and the folder every pre-workspace\n   * client already reads. Unchanged in meaning, which is why no session\n   * record ever has to be rewritten.\n   */\n  projectPath: string;\n  /**\n   * V2.2 ADDITIVE. Roots BEYOND the primary, pinned at creation time.\n   *\n   * Absent on every record written before workspaces existed, and absent on\n   * a single-root session today — so the on-disk shape of an ordinary chat\n   * does not change at all.\n   *\n   * PINNED, not referenced: a session keeps the roots it was created with\n   * even if the named workspace is later edited or deleted, for the same\n   * reason `launch.anthropicBaseUrl` is pinned — a conversation must not\n   * silently gain reach because config moved underneath it.\n   */\n  extraRoots?: string[];\n  /** V2.2 ADDITIVE. Provenance of the pinned roots; absent for an ad-hoc set. */\n  workspaceId?: string;\n  workspaceName?: string;\n  engine: VerseEngine;\n  accountId: string;\n  seatId: string;\n  model: string;\n  /** Vendor conversation id used for resume (claude/grok: our uuid; codex: thread id from output). */\n  nativeSessionId: string | null;\n  createdAt: string;\n  updatedAt: string;\n  status: VerseSessionStatus;\n  turnCount: number;\n  usage: VerseUsage;\n  lastError: string | null;\n  /**\n   * V3.9 ADDITIVE. The session's context budget. Every record written by 3.9+\n   * carries it explicitly, so ABSENT means a pre-3.9 record: the engine\n   * materializes it on first touch — `expansive` for a Claude 1M model (that\n   * is the native ~967k compaction those chats always ran with, so upgrading\n   * never forces a paid compaction), `standard` otherwise (= native).\n   * Changeable mid-session (POST /sessions/:id/context-mode): it changes CLI\n   * flags, not prompt content — but switching DOWN below the current\n   * occupancy makes the CLI compact on its next turn.\n   */\n  contextMode?: VerseContextMode;\n  /** V3.9 ADDITIVE. Native compactions observed so far (claude/grok compact_boundary, codex rollout `compacted`). */\n  compactionCount?: number;\n  /** V3.9 ADDITIVE. Set when this session was started as a handoff from another. */\n  handoffFrom?: { sessionId: string; title: string };\n  /**\n   * V3.9 ADDITIVE. Shared project memory was offered to this session's CLI at\n   * creation. Pinned, like the roots: a conversation must not silently gain a\n   * writable directory because a preference moved underneath it.\n   */\n  memoryEnabled?: boolean;\n  /**\n   * V3.10 ADDITIVE (contract: unit C0; written by C3's engine). The operator's\n   * per-chat effort and permission choices, applied from the NEXT turn — a\n   * running turn keeps the argv it was launched with. Absent (every record\n   * before 3.10, and any key never set) = the engine default: permission mode\n   * `accept-edits`, effort = the CLI's own default.\n   *\n   * A MODEL change is deliberately NOT stored here: it rewrites `model` above,\n   * which every launch already reads — one field, one truth.\n   */\n  controls?: VerseSessionControls;\n}\n\n/**\n * V3.10. Permission modes a chat can run in (SPEC-310C §0.6), in picker order.\n *  - `plan`         — the CLI plans and edits nothing.\n *  - `accept-edits` — the default: edits applied without asking.\n *  - `auto`         — the CLI's own auto mode.\n *  - `bypass`       — every check skipped. Shown red and confirmed PER CHAT:\n *                     never a default, never inherited by a new chat.\n * Adapters map these to each CLI's spelling (claude `acceptEdits` /\n * `bypassPermissions`, grok `dontAsk`, …). An engine that cannot honour one\n * reports it unavailable WITH a reason rather than approximating it. The\n * in-page \"Ask\" mode (answering permission prompts in the UI) is 3.11.\n */\nexport const VERSE_PERMISSION_MODES = ['plan', 'accept-edits', 'auto', 'bypass'] as const;\nexport type VersePermissionMode = (typeof VERSE_PERMISSION_MODES)[number];\nexport const VERSE_DEFAULT_PERMISSION_MODE: VersePermissionMode = 'accept-edits';\n\n/**\n * V3.10. Reasoning effort, the union across engines — claude `--effort`\n * (low · medium · high · xhigh · max) and codex `model_reasoning_effort`\n * (minimal · low · medium · high · xhigh). Each seat offers only the subset\n * its CLI accepts; the rest come back unavailable with a reason.\n */\nexport const VERSE_EFFORTS = ['minimal', 'low', 'medium', 'high', 'xhigh', 'max'] as const;\nexport type VerseEffort = (typeof VERSE_EFFORTS)[number];\n\n/** V3.10. `VerseSession.controls` — absent key = engine default (see there). */\nexport interface VerseSessionControls {\n  effort?: VerseEffort;\n  permissionMode?: VersePermissionMode;\n}\n\n/** Normalized event stream. `seq` is monotonic per session and is the SSE id. */\nexport type VerseEvent =\n  | { seq: number; at: string; type: 'user-message'; turnId: string; text: string }\n  | { seq: number; at: string; type: 'turn-started'; turnId: string; pid: number | null }\n  | { seq: number; at: string; type: 'text-delta'; turnId: string; text: string }\n  | { seq: number; at: string; type: 'assistant-message'; turnId: string; text: string }\n  /**\n   * Reasoning the CLI chose to show. V3.10 ADDITIVE optional fields (absent on\n   * older records = unknown, never \"false\"/\"0\"):\n   *  - `redacted`   the CLI sent a signature-only / redacted block, so `text` is\n   *                 empty but the model DID think (the UI says \"Thought 12s\").\n   *  - `durationMs` wall time the block took to stream, when measured.\n   *  - `kind`       see VerseThinkingKind.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'thinking';\n    turnId: string;\n    text: string;\n    redacted?: boolean;\n    durationMs?: number;\n    kind?: VerseThinkingKind;\n  }\n  | { seq: number; at: string; type: 'tool-use'; turnId: string; toolUseId: string; name: string; input: unknown }\n  | { seq: number; at: string; type: 'tool-result'; turnId: string; toolUseId: string; output: string; isError: boolean }\n  | { seq: number; at: string; type: 'usage'; turnId: string; usage: VerseUsage }\n  | { seq: number; at: string; type: 'turn-done'; turnId: string; ok: boolean; nativeSessionId: string | null; durationMs: number }\n  /**\n   * `code` (V3.10 ADDITIVE, optional) is a stable machine key for errors the UI\n   * or engine acts on — see VERSE_ERROR_CODES. Absent = uncategorised.\n   */\n  | { seq: number; at: string; type: 'error'; turnId: string | null; message: string; code?: string }\n  | { seq: number; at: string; type: 'cancelled'; turnId: string }\n  /**\n   * V3.9. The CLI compacted its own conversation. Token counts are the CLI's\n   * own (`compact_metadata.pre_tokens/post_tokens` on claude/grok). Codex\n   * rollouts mark only THAT a compaction happened, so its counts are the last\n   * `token_count` reading before the marker and the first one after it —\n   * measured, but by Verse, not stated by the CLI; its `durationMs` is null.\n   * Any count may be null when no reading brackets the compaction.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'compaction';\n    turnId: string | null;\n    trigger: 'auto' | 'manual';\n    preTokens: number | null;\n    postTokens: number | null;\n    durationMs: number | null;\n  }\n  /**\n   * V3.9. A context-occupancy READING that is not a usage delta — e.g. codex's\n   * rollout `token_count` (exact last-call prompt size and the window the CLI\n   * measured it against), polled mid-turn and read again after it. Replaces\n   * the session's `contextTokens`; never summed. The engine fills\n   * `autoCompactAt` for the window in force.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'context';\n    turnId: string | null;\n    contextTokens: number;\n    contextWindow: number | null;\n    exact: boolean;\n    autoCompactAt?: number | null;\n    /**\n     * Where `contextWindow` came from. A CLI reading is `runtime`; the event\n     * the engine writes after a MODE SWITCH carries the new budget's catalog\n     * source, so a client never relabels a catalog figure as a measurement.\n     * Absent on events from before this field existed (treat as `runtime`).\n     */\n    contextWindowSource?: VerseWindowSource;\n  }\n  // ── V3.10 TRANSIENT events ────────────────────────────────────────────────\n  // Never written to the session log; fanned out to live SSE listeners only\n  // (see VERSE_TRANSIENT_EVENT_TYPES for the wire rules). A reload therefore\n  // never shows them — everything they convey is either ephemeral (a spinner)\n  // or re-stated by a persisted event at turn end (`thinking`, `usage`).\n  /** A chunk of streamed reasoning text for the in-flight thinking block. */\n  | { seq: number; at: string; type: 'thinking-delta'; turnId: string; text: string }\n  /**\n   * The CLI reports reasoning volume without text (claude\n   * `system/thinking_tokens`). An ESTIMATE, rate-limited by the adapter.\n   */\n  | { seq: number; at: string; type: 'thinking-progress'; turnId: string; estimatedTokens: number }\n  /**\n   * What the running turn is doing right now. `tool` names the running tool\n   * when phase is `tool`. `outTokens`/`tokPerSec` are absent when unmeasured.\n   */\n  | {\n    seq: number;\n    at: string;\n    type: 'progress';\n    turnId: string;\n    phase: VerseProgressPhase;\n    tool?: string;\n    elapsedMs: number;\n    outTokens?: number;\n    tokPerSec?: number;\n  }\n  /** A human-readable notice about the turn's plumbing (API retry, preflight, no-output watchdog). */\n  | { seq: number; at: string; type: 'status'; turnId: string | null; kind: VerseStatusKind; message: string }\n  // ── V3.10 PERSISTED events ────────────────────────────────────────────────\n  /**\n   * The engine recovered from a lost native conversation (e.g. the vendor\n   * thread vanished) by starting a new native session seeded with the handoff\n   * note (`how: 'handoff'`) or a bare new session (`new-native-session`).\n   */\n  | { seq: number; at: string; type: 'recovered'; turnId: string | null; how: VerseRecoveryHow; message: string }\n  /**\n   * The log hit its cap and events with `seq < droppedBefore` were dropped at\n   * a TURN boundary (never mid-turn). `turnId` is always null — it is present\n   * only so code reading `event.turnId` across the union keeps typechecking.\n   */\n  | { seq: number; at: string; type: 'history-truncated'; turnId: null; droppedBefore: number };\n\nexport type VerseEventType = VerseEvent['type'];\n\n/** V3.10. `summary` = vendor-summarised reasoning, `raw` = verbatim, `progress` = a heading/placeholder only. */\nexport type VerseThinkingKind = 'summary' | 'raw' | 'progress';\n\n/** V3.10. Phase of a running turn, carried by the transient `progress` event. */\nexport type VerseProgressPhase = 'thinking' | 'tool' | 'writing' | 'waiting';\n\n/** V3.10. What a transient `status` notice is about. */\nexport type VerseStatusKind = 'retry' | 'preflight' | 'watchdog';\n\n/** V3.10. How a `recovered` event restored the conversation. */\nexport type VerseRecoveryHow = 'new-native-session' | 'handoff';\n\n/**\n * V3.10. Known `error.code` values. `code` stays `string` on the wire so an\n * older client never rejects a newer code; these are the ones Verse acts on.\n *  - `native-thread-missing` — the vendor conversation to resume no longer exists.\n *  - `session-in-use`        — the CLI refused because the native session id is locked.\n */\nexport const VERSE_ERROR_CODES = ['native-thread-missing', 'session-in-use'] as const;\nexport type VerseErrorCode = (typeof VERSE_ERROR_CODES)[number];\n\n/**\n * V3.10. Event types that are NEVER persisted — emitted to live SSE listeners\n * only. The list and its guard live in ./transient-events.ts (re-exported\n * here): the web chat's first-paint store needs the guard, and importing it\n * from this module put every runtime value exported here — the handoff\n * prompt, the effort tables — into the chat's first-paint chunk.\n */\nexport { VERSE_TRANSIENT_EVENT_TYPES, isTransientVerseEvent } from './transient-events.js';\n\nexport type VerseTransientEventType = (typeof TRANSIENT_EVENT_TYPE_LIST)[number];\nexport type VerseTransientEvent = Extract<VerseEvent, { type: VerseTransientEventType }>;\nexport type VersePersistedEvent = Exclude<VerseEvent, { type: VerseTransientEventType }>;\n\n/**\n * Which endpoint a LOCAL seat sends its turns to.\n *\n *  - `ollama`       — the historical lane: the plain `claude` binary with\n *                     ANTHROPIC_BASE_URL pointed straight at Ollama's\n *                     Anthropic-compatible endpoint on :11434. Ollama\n *                     serialises this model architecture, so a fleet of local\n *                     agents on this lane is a queue (docs/LOCAL-FLEET.md).\n *  - `llama-server` — the same binary pointed at the local Anthropic\n *                     normalising proxy that fronts llama-server. That proxy\n *                     is the ONLY way to reach llama-server's parallel slots\n *                     and the prompt-cache fix, because Qwen3.8's chat\n *                     template rejects Claude Code's request shape unless the\n *                     proxy rewrites it on the way through.\n *\n * DISPATCH ONLY. Model DISCOVERY stays on Ollama in both lanes — llama-server\n * implements neither `/api/tags` nor `/api/show`, which is where every local\n * seat's identity, context window and `tools` capability comes from.\n */\nexport type VerseLocalDispatch = 'ollama' | 'llama-server';\n\n/** What a client is told about this machine's local serving situation. */\nexport interface VerseLocalRuntimeSummary {\n  /** Ollama reachable? Drives the local seats and an inline hint when false. */\n  ollama: { reachable: boolean; baseUrl: string; models: string[] };\n  /**\n   * Where local seats DISPATCH turns, reported only when that is NOT the\n   * default Ollama lane.\n   *\n   * Absent means `ollama`, i.e. exactly what every existing client already\n   * assumes — so opting in is visible on the wire and NOT opting in changes no\n   * payload at all.\n   */\n  dispatch?: { lane: VerseLocalDispatch; baseUrl: string };\n}\n\n/** GET /api/verse/bootstrap */\nexport interface VerseBootstrap {\n  seats: VerseSeat[];\n  projects: VerseProject[];\n  sessions: VerseSession[];\n  /** Whether POST routes are enabled on this server (`ashlr serve --allow-dispatch` / `ashlr verse`). */\n  dispatchEnabled: boolean;\n  localRuntime: VerseLocalRuntimeSummary;\n}\n\n/**\n * GET /api/verse/seats (V2.1)\n *\n * WHY THIS ROUTE EXISTS: `bootstrap` is a MOUNT-TIME snapshot. A client that\n * opened the app before the collector's first cycle finished would show\n * \"unknown\" forever. This is the same seat list, cheap enough to poll, and it\n * always reflects the collector's CURRENT state rather than a cached one.\n */\nexport interface VerseSeatsResponse {\n  /** When this body was built. */\n  sampledAt: string;\n  seats: VerseSeat[];\n  localRuntime: VerseBootstrap['localRuntime'];\n}\n\n/**\n * POST /api/verse/sessions\n *\n * Two spellings, never mixed (the API rejects the mix rather than silently\n * preferring one):\n *   - `workspaceId` alone — the named workspace supplies primary and extras.\n *   - `projectPath` (+ optional `extraRoots`) — an ad-hoc set, which is also\n *     exactly the pre-workspace request shape.\n */\nexport interface VerseCreateSessionRequest {\n  projectPath: string;\n  seatId: string;\n  model?: string;\n  title?: string;\n  /** V2.2 ADDITIVE. Absolute paths beyond the primary. */\n  extraRoots?: string[];\n  /** V2.2 ADDITIVE. Bind to a named workspace instead of naming paths. */\n  workspaceId?: string;\n  /**\n   * SERVER-FILLED. The API resolves this from the registry once `workspaceId`\n   * is validated, and never reads it off the request body — so a session can\n   * not be labelled with a workspace name that is not the one it was built\n   * from.\n   */\n  workspaceName?: string;\n  /**\n   * V3.9 ADDITIVE. Absent → the seat's preferred mode (preferences.json), else\n   * `standard`. `expansive` on a model with no expansive budget is rejected.\n   */\n  contextMode?: VerseContextMode;\n  /**\n   * V3.9 ADDITIVE. Start this session as a handoff from an existing one. The\n   * server resolves the source's title itself (never from the body) and pins\n   * `handoffFrom`; the handoff TEXT is sent by the client as turn 1, after the\n   * operator has read it — nothing is spent on their behalf.\n   */\n  handoffFromSessionId?: string;\n}\n\n/** POST /api/verse/sessions/:id/turns */\nexport interface VerseTurnRequest {\n  text: string;\n}\nexport interface VerseTurnResponse {\n  turnId: string;\n  session: VerseSession;\n}\n\n/** GET /api/verse/sessions/:id */\nexport interface VerseSessionDetail {\n  session: VerseSession;\n  events: VerseEvent[];\n}\n\n/** Adapter input: how to launch one turn. Pure data, produced by the engine, consumed by the spawner. */\nexport interface VerseTurnLaunch {\n  argv: string[];\n  cwd: string;\n  /** Extra env layered over a minimal base (PATH/HOME/TMPDIR/LANG). Never contains secrets. */\n  env: Record<string, string>;\n  /** Text written to stdin (codex); null when the prompt is in argv. */\n  stdin: string | null;\n}\n\nexport const VERSE_MAX_TURN_TEXT_BYTES = 64 * 1024;\nexport const VERSE_MAX_EVENTS_PER_SESSION = 20_000;\nexport const VERSE_TURN_TIMEOUT_MS = 30 * 60 * 1000;\n/**\n * LAST-RESORT fallbacks, used only when neither the runtime, the seat's own\n * catalog, nor the verified per-model table (core/verse/model-windows.ts) knows\n * the model. Each mirrors what the CLI ITSELF assumes for an unknown id, so the\n * meter never claims more than the CLI will allow:\n *\n * - claude 200_000 — Claude Code's `Mg()` default for an unrecognized model.\n *   Every KNOWN Claude id carries its real window (1M for the 5.x family,\n *   Opus 4.8 and Sonnet 5) in the per-model table instead.\n * - codex 258_400  — 272_000 × the 95% `effective_context_window_percent`\n *   every codex catalog entry carries; the figure codex's own rollouts report\n *   as `model_context_window` (65,440 of 65,440 observed events).\n * - grok 500_000   — `context_window` for every grok-4.x id in the seat catalog.\n * - local 65_536   — the num_ctx the default local tag pins.\n */\nexport const VERSE_DEFAULT_CONTEXT_WINDOWS: Record<string, number> = {\n  claude: 200_000,\n  codex: 258_400,\n  grok: 500_000,\n  local: 65_536,\n};\n\n// ---------------------------------------------------------------------------\n// V3.9 context orchestration — request/response shapes (docs/VERSE-CONTEXT.md)\n// ---------------------------------------------------------------------------\n\n/** GET /api/verse/preferences — the operator's standing context choices. */\nexport interface VersePreferences {\n  version: 1;\n  /** Per-seat default context mode for NEW sessions. Absent = `standard`. */\n  seats: Record<string, { contextMode?: VerseContextMode }>;\n  /** Shared project memory. On by default; listed canonical paths opt out. */\n  memory: { enabled: boolean; disabledProjects: string[] };\n  /**\n   * V3.10 ADDITIVE. Stream vendor-summarised reasoning on non-local seats\n   * (claude `--thinking-display summarized`). Absent = on (Mason's default).\n   */\n  thinkingDisplay?: boolean;\n}\n\n/**\n * POST /api/verse/preferences — exactly ONE of the three forms per request, so\n * a body can never change more than the operator clicked.\n */\nexport type VersePreferencesUpdate =\n  | { seatId: string; contextMode: VerseContextMode }\n  | { memoryEnabled: boolean }\n  | { projectPath: string; memoryEnabled: boolean };\n\n/** POST /api/verse/sessions/:id/context-mode */\nexport interface VerseContextModeRequest {\n  mode: VerseContextMode;\n}\n\n/** POST /api/verse/sessions/:id/handoff-preview */\nexport interface VerseHandoffPreviewRequest {\n  /**\n   * Include the latest assistant message verbatim (capped) as the agent's own\n   * summary — used after \"Ask this seat to summarize\" produced one.\n   */\n  includeLastAssistant?: boolean;\n  /** Optional operator focus line, e.g. \"finish the migration of X\". ≤ 500 chars. */\n  focus?: string;\n}\n\n/** Deterministic, zero-spend handoff note built from the session's event log. */\nexport interface VerseHandoffPreview {\n  sourceSessionId: string;\n  sourceTitle: string;\n  /** The exact text to send as turn 1 of the new session. ≤ VERSE_HANDOFF_MAX_CHARS. */\n  text: string;\n  stats: {\n    chars: number;\n    /** chars / 4, rounded up — the same estimator the fit badges use. */\n    estTokens: number;\n    turnsCovered: number;\n    filesTouched: number;\n    /** Sections dropped to respect the cap, by name; empty when nothing was cut. */\n    truncated: string[];\n  };\n}\n\nexport const VERSE_HANDOFF_MAX_CHARS = 12_000;\n\n/**\n * The canned turn behind \"Ask this seat to summarize first\". Shared by the UI\n * (which sends it as an ordinary turn through the normal spend chokepoint) and\n * the handoff builder (which must NOT carry it into the new session as the\n * operator's \"latest ask\" — the new chat would otherwise be told to write a\n * handoff note instead of continuing the work).\n *\n * Written so the reply is useful as turn 1 of a session that has NONE of this\n * context. It asks for no tool use on purpose: a summary that starts editing\n * files is not a summary, and a read-only turn is also the cheapest one.\n */\nexport const VERSE_HANDOFF_SUMMARY_REQUEST = [\n  'This conversation is about to continue in a fresh session that has none of its context.',\n  'Write the handoff note that new session should start from. Do not edit files or run commands for this — only write the note.',\n  '',\n  'Cover, concretely:',\n  '- The goal, and what \"done\" looks like.',\n  '- Decisions made so far, each with the reason it was made.',\n  '- Current state: what is finished, what is half-done, what is untested.',\n  '- Files changed and anything not yet committed.',\n  '- How to verify the work (exact commands).',\n  '- Open questions, risks, and approaches already tried that did not work.',\n  '',\n  'Keep it under 600 words. Prefer file paths and commands over prose.',\n].join('\\n');\n\n/** GET /api/verse/context-fit — how big the reachable code is, in tokens. */\nexport interface VerseContextFitRoot {\n  path: string;\n  /** Tracked text files counted (git ls-files, binaries and >1 MB files skipped). */\n  files: number;\n  bytes: number;\n  estTokens: number;\n  /** True when the scan hit its file or time cap; estTokens is then a floor. */\n  truncated: boolean;\n}\n\nexport interface VerseContextFit {\n  roots: VerseContextFitRoot[];\n  totalEstTokens: number;\n  /** Always 'bytes/4' today; named so a better estimator can be introduced honestly. */\n  estimator: 'bytes/4';\n  sampledAt: string;\n}\n\n/**\n * Per-model verdict for a working set (see context-math.ts `fitVerdict`):\n * fits in standard, tight in standard, fits only in expansive, or too big for\n * any single context (split the work).\n */\nexport type VerseFitVerdict = 'fits' | 'tight' | 'expansive' | 'split';\n\n/** GET /api/verse/search?q=&limit= — keyword search over past sessions. Zero spend. */\nexport interface VerseSearchHit {\n  sessionId: string;\n  title: string;\n  projectPath: string;\n  engine: VerseEngine;\n  seq: number;\n  at: string;\n  kind: 'user' | 'assistant';\n  /** ≤ 240 chars around the first match, whitespace-collapsed. */\n  snippet: string;\n  score: number;\n}\n\nexport interface VerseSearchResponse {\n  query: string;\n  hits: VerseSearchHit[];\n  /** Sessions actually scanned (the scan is bounded; see session-search.ts). */\n  scannedSessions: number;\n  truncated: boolean;\n}\n\n/** GET/POST /api/verse/memory — shared project memory for one project. */\nexport interface VerseProjectMemory {\n  projectPath: string;\n  enabled: boolean;\n  /** Contents of MEMORY.md ('' when absent). */\n  content: string;\n  bytes: number;\n  updatedAt: string | null;\n  /** Other files the agents created in the memory directory (names only). */\n  files: string[];\n  /**\n   * Present (true) only when `content` as SENT differs from the bytes on disk:\n   * the public-JSON sanitizer rewrote the home path to `~` or replaced a\n   * secret-looking value with `[REDACTED]`. The file itself is untouched; a\n   * save that would write placeholders over real values is refused (409\n   * VERSE_MEMORY_REDACTED), so the editor must say so before the operator types.\n   */\n  contentSanitized?: boolean;\n}\n\n/** POST /api/verse/memory */\nexport interface VerseProjectMemoryWrite {\n  projectPath: string;\n  content: string;\n}\n\nexport const VERSE_MEMORY_MAX_BYTES = 64 * 1024;\n\n/**\n * POST /api/verse/memory's own JSON body cap: JSON escaping can double the\n * content (every newline becomes `\\\\n`), plus room for the other fields. Every\n * other route keeps the 64 KiB default. Shared so the browser's pre-check can\n * never refuse a save the server would accept.\n */\nexport const VERSE_MEMORY_BODY_MAX_BYTES = 2 * VERSE_MEMORY_MAX_BYTES + 8 * 1024;\n\n/** Cap on the memory block appended to each session's system prompt. */\nexport const VERSE_MEMORY_BLOCK_MAX_BYTES = 6 * 1024;\n","/**\n * routes/verse/context/context-model.ts — the pure half of the context\n * components (handoff dialog, memory panel, session search). No React, no\n * I/O, so every rule the components render is pinned by a plain unit test.\n *\n * Every number shown here comes from context-math.ts (the one module the\n * server and the browser share), so \"compacts ≈367k\" in the handoff dialog is\n * the same figure the meter and the seat picker show.\n */\nimport type { VerseEngine, VerseModelOption, VerseSeat, VerseSession } from '../../../data/api-types.js';\nimport type {\n  VerseContextMode,\n  VerseFitVerdict,\n  VersePreferences,\n  VerseSearchHit,\n} from '../../../../core/verse/types.js';\nimport { VERSE_MEMORY_BLOCK_MAX_BYTES, VERSE_MEMORY_BODY_MAX_BYTES } from '../../../../core/verse/types.js';\nimport {\n  budgetFor,\n  canonicalModelId,\n  estimateTokensFromChars,\n  fitVerdict,\n  hasExpansiveMode,\n  sessionOverheadTokens,\n} from '../../../../core/verse/context-math.js';\nimport { formatContextWindow, formatRelative } from '../verse-model.js';\nimport { asClause, percentText, tidyProse } from '../autonomy/format.js';\nimport { formatTokens } from '../verse-readouts.js';\n\n// ---------------------------------------------------------------------------\n// Handoff\n// ---------------------------------------------------------------------------\n\n// The canned \"Ask this seat to summarize first\" turn is\n// VERSE_HANDOFF_SUMMARY_REQUEST in core/verse/types.ts, not a copy here: the\n// handoff builder on the server matches that exact text to keep it OUT of the\n// new session's \"latest requests\" (otherwise the new chat is told to write\n// another handoff note). A local copy that drifted by one character would\n// silently defeat that filter.\n\n/** Mirrors session-engine's TITLE_MAX so a title we send is never cut by the server instead. */\nexport const TITLE_MAX_CHARS = 120;\n\nconst PART_SUFFIX = /\\s·\\spart\\s(\\d+)$/;\n\n/**\n * Title for the session a handoff continues in: \"Fix the login bug · part 2\".\n * A continuation of a continuation counts up rather than stacking suffixes, so\n * the sidebar reads \"part 3\", never \"part 2 · part 2\".\n */\nexport function handoffTitle(sourceTitle: string): string {\n  const collapsed = sourceTitle.replace(/\\s+/g, ' ').trim();\n  const match = PART_SUFFIX.exec(collapsed);\n  const base = (match ? collapsed.slice(0, match.index) : collapsed) || 'Untitled chat';\n  const next = match ? Number.parseInt(match[1]!, 10) + 1 : 2;\n  const suffix = ` · part ${next}`;\n  const room = TITLE_MAX_CHARS - suffix.length;\n  const clipped = base.length > room ? `${base.slice(0, room - 1).trimEnd()}…` : base;\n  return `${clipped}${suffix}`;\n}\n\n/**\n * A seat's catalog entry for a model id. Exact id first, then canonical — a\n * session created before the alias fix stores `claude-opus-5.5` while the\n * catalog now lists `claude-opus-5-5` (context-math VERSE_MODEL_ID_ALIASES).\n */\nexport function modelOption(seat: VerseSeat | null | undefined, modelId: string): VerseModelOption | null {\n  if (!seat) return null;\n  const exact = seat.models.find((m) => m.id === modelId);\n  if (exact) return exact;\n  const canonical = canonicalModelId(modelId);\n  return seat.models.find((m) => canonicalModelId(m.id) === canonical) ?? null;\n}\n\n/**\n * Why a seat+model cannot take a new session right now; null when it can.\n *\n * The seat's own reason is embedded as a clause: its closing period is\n * dropped (no \"exhausted..\") and any ISO instant in it — a health summary\n * saying when usage resets — is read as the viewer's local time.\n */\nexport function targetUnavailableReason(\n  seat: VerseSeat | null | undefined,\n  option: VerseModelOption | null,\n  now: number = Date.now(),\n): string | null {\n  if (!seat) return 'Pick a seat to continue on.';\n  if (seat.health.state === 'unavailable') {\n    return `${seat.label} is unavailable: ${asClause(tidyProse(seat.health.summary ?? 'no reason given', now))}.`;\n  }\n  if (!option) return 'Pick a model on this seat.';\n  if (option.unavailableReason) {\n    return `${option.label} cannot run on ${seat.label}: ${asClause(tidyProse(option.unavailableReason, now))}.`;\n  }\n  return null;\n}\n\nexport interface HandoffTarget {\n  seatId: string;\n  model: string;\n}\n\n/**\n * Where a handoff lands by default: the SAME seat and model (the common case\n * is \"same agent, fresh context\"). When that model can no longer run there,\n * the seat's first runnable model; when the seat itself is gone or\n * unavailable, the first runnable model on any available seat, in the seat\n * list's own order.\n */\nexport function defaultHandoffTarget(seats: readonly VerseSeat[], source: Pick<VerseSession, 'seatId' | 'model'>): HandoffTarget | null {\n  const own = seats.find((s) => s.id === source.seatId);\n  if (own && own.health.state !== 'unavailable') {\n    const same = modelOption(own, source.model);\n    if (same && !same.unavailableReason) return { seatId: own.id, model: same.id };\n    const runnable = own.models.find((m) => !m.unavailableReason);\n    if (runnable) return { seatId: own.id, model: runnable.id };\n  }\n  for (const seat of seats) {\n    if (seat.health.state === 'unavailable') continue;\n    const runnable = seat.models.find((m) => !m.unavailableReason);\n    if (runnable) return { seatId: seat.id, model: runnable.id };\n  }\n  return null;\n}\n\n/**\n * The mode a handoff starts in. Only a mode that EXISTS for the target model\n * is ever returned (a mode with no budget would be refused by the server).\n *\n *  1. Same seat and model as the source → keep the source's mode. \"Continue in\n *     a fresh chat\" means the same settings with a clean context; an operator\n *     who chose expansive for this work chose it for the work.\n *  2. Otherwise the target seat's standing preference (preferences.json).\n *  3. Otherwise standard.\n */\nexport function defaultHandoffMode(input: {\n  option: VerseModelOption | null;\n  target: HandoffTarget | null;\n  source: Pick<VerseSession, 'seatId' | 'model' | 'contextMode'>;\n  preferences: VersePreferences | null | undefined;\n}): VerseContextMode {\n  const { option, target, source, preferences } = input;\n  const valid = (mode: VerseContextMode | undefined): mode is VerseContextMode =>\n    mode !== undefined && budgetFor(option, mode) !== null;\n  const sameModel = target !== null && target.seatId === source.seatId\n    && canonicalModelId(target.model) === canonicalModelId(source.model);\n  if (sameModel && valid(source.contextMode ?? 'standard')) return source.contextMode ?? 'standard';\n  const preferred = target ? preferences?.seats[target.seatId]?.contextMode : undefined;\n  if (valid(preferred)) return preferred;\n  return 'standard';\n}\n\n/**\n * The mode to put on the create request, or undefined to leave it to the\n * server. A mode is sent only when the model has a budget for it — which is\n * exactly the server's acceptance rule — so what the dialog shows is what is\n * created, and an unknown-window model is never refused over a mode it could\n * not have.\n */\nexport function requestMode(option: VerseModelOption | null, mode: VerseContextMode): VerseContextMode | undefined {\n  return budgetFor(option, mode) !== null ? mode : undefined;\n}\n\n/** \"1M window · compacts ≈367k\" for a model in a mode; null when the budget is unknown. */\nexport function budgetLine(option: VerseModelOption | null, mode: VerseContextMode): string | null {\n  const budget = budgetFor(option, mode);\n  if (!budget) return null;\n  const window = `${formatContextWindow(budget.contextWindow)} window`;\n  return budget.autoCompactAt === null ? window : `${window} · compacts ≈${formatTokens(budget.autoCompactAt)}`;\n}\n\nexport interface HandoffFit {\n  verdict: VerseFitVerdict | null;\n  /** The handoff text's own estimate (chars / 4). */\n  handoffTokens: number;\n  /** The target engine's estimated fixed prompt (context-math `sessionOverheadTokens`). */\n  overheadTokens: number;\n  /** Handoff + that fixed prompt: what the new session holds before its first reply. */\n  needTokens: number;\n  /** One sentence for the dialog. */\n  text: string;\n  tone: 'ok' | 'warn' | 'danger' | 'unknown';\n}\n\n/**\n * Will the new session START comfortably? The handoff is small by design\n * (≤ 12k chars ≈ 3k tokens), but every fresh session also carries the CLI's\n * fixed prompt — a large share of a 64k local slot — so this is a real\n * question on small windows, and the sentence shows both halves of the sum\n * rather than a bare verdict.\n *\n * The fixed prompt is the TARGET seat's engine estimate (local ≈15k measured,\n * claude ≈25k, …), not one flat figure: a flat 30k called every handoff to a\n * 64k local seat \"too big for one context\" when the real sum was ~20k. It is\n * still an estimate — no CLI reports its base prompt before the first turn —\n * so the sentence says \"estimated\" rather than presenting it as a reading.\n * `engine` null (target seat not known yet) falls back to the largest estimate.\n */\nexport function handoffFit(\n  textChars: number,\n  option: VerseModelOption | null,\n  mode: VerseContextMode,\n  engine: VerseEngine | null,\n): HandoffFit {\n  const handoffTokens = estimateTokensFromChars(textChars);\n  const overheadTokens = sessionOverheadTokens(engine);\n  const needTokens = handoffTokens + overheadTokens;\n  const verdict = fitVerdict(handoffTokens, option, overheadTokens);\n  const sum = `~${formatTokens(handoffTokens)} tokens of handoff + an estimated ~${formatTokens(overheadTokens)} of fixed prompt`;\n  const standard = budgetFor(option, 'standard');\n  const standardCap = standard ? standard.autoCompactAt ?? standard.contextWindow : null;\n  const base = { verdict, handoffTokens, overheadTokens, needTokens };\n  switch (verdict) {\n    case 'fits':\n      return { ...base, tone: 'ok', text: `Fits: ${sum} leaves most of the budget before the first compaction.` };\n    case 'tight':\n      return {\n        ...base,\n        tone: 'warn',\n        text: `Tight: ${sum} is ${percentText((needTokens / (standardCap ?? needTokens)) * 100)} of where this model compacts — the new chat will compact early.`,\n      };\n    case 'expansive':\n      return mode === 'expansive'\n        ? { ...base, tone: 'warn', text: `Fits only the expansive budget: ${sum}.` }\n        : { ...base, tone: 'danger', text: `Too big for the standard budget (${sum}). Switch to Expansive, or trim the handoff.` };\n    case 'split':\n      return { ...base, tone: 'danger', text: `Too big for one context on this model (${sum}). Trim the handoff or pick a seat with a larger window.` };\n    default:\n      return { ...base, verdict: null, tone: 'unknown', text: 'This model’s window is not known, so there is no fit estimate.' };\n  }\n}\n\n/** True when the target model has a real expansive budget (context-math, re-exported for the dialog). */\nexport function offersExpansive(option: VerseModelOption | null): boolean {\n  return hasExpansiveMode(option);\n}\n\n/** A local turn runs on this machine; every other engine spends subscription usage. */\nexport function turnCostSentence(engine: VerseEngine, seatLabel: string): string {\n  return engine === 'local'\n    ? `Runs on this machine with ${seatLabel}; it spends no subscription usage.`\n    : `Sends one turn to ${seatLabel} and spends from its usage. The automatic preview costs nothing.`;\n}\n\n// ---------------------------------------------------------------------------\n// Bytes\n// ---------------------------------------------------------------------------\n\nconst encoder = typeof TextEncoder === 'function' ? new TextEncoder() : null;\n\n/** UTF-8 byte length — the unit the server's caps (64 KB memory content, 64 KB turn) are written in. */\nexport function utf8Bytes(text: string): number {\n  if (encoder) return encoder.encode(text).length;\n  // Fallback for an environment with no TextEncoder: count code points by width.\n  let bytes = 0;\n  for (const ch of text) {\n    const cp = ch.codePointAt(0) ?? 0;\n    bytes += cp < 0x80 ? 1 : cp < 0x800 ? 2 : cp < 0x10000 ? 3 : 4;\n  }\n  return bytes;\n}\n\n/**\n * The API's default request-body cap: `readBody` in src/core/web/api.ts, which\n * every /api/verse POST uses unless its route passes a larger one (only\n * POST /memory does — see MEMORY_BODY_MAX_BYTES). A write travels as JSON, so what must fit is\n * the ENCODED body — every `\\n` and `\"` escaped to two bytes — not the text\n * alone; the editors measure it so a refusal happens on screen instead of as\n * \"request body too large\".\n */\nexport const API_BODY_MAX_BYTES = 65_536;\n\n/**\n * POST /api/verse/memory's own body cap — mirrors `VERSE_MEMORY_BODY_MAX_BYTES`\n * in src/core/verse/verse-api.ts (a server module the browser cannot import):\n * room for 64 KiB of content in which EVERY byte escapes to two, plus the\n * project path and the JSON around it. The server still holds the CONTENT to\n * VERSE_MEMORY_MAX_BYTES after parsing. Guarding the memory editor with the\n * 64 KiB default instead blocked saves the server accepts — a 60–64 KB\n * MEMORY.md with ordinary line breaks could not be edited from the panel,\n * which is the exact case the server's larger cap exists for.\n */\nexport const MEMORY_BODY_MAX_BYTES = VERSE_MEMORY_BODY_MAX_BYTES;\n\n/** UTF-8 size of `body` exactly as the client will send it. */\nexport function jsonBodyBytes(body: unknown): number {\n  return utf8Bytes(JSON.stringify(body) ?? '');\n}\n\nexport function formatBytes(bytes: number): string {\n  if (!Number.isFinite(bytes) || bytes < 0) return '—';\n  if (bytes < 1024) return `${bytes} B`;\n  const kb = bytes / 1024;\n  return `${kb < 10 ? kb.toFixed(1).replace(/\\.0$/, '') : Math.round(kb)} KB`;\n}\n\n/**\n * A relative time that reads as a phrase: \"just now\", \"5m ago\", \"on Sep 19\".\n * `formatRelative` (verse-model) is sized for a 5ch sidebar column and reads\n * as a bare token; prose needs the preposition.\n */\nexport function relativePhrase(iso: string | null | undefined, now: number = Date.now()): string | null {\n  if (!iso) return null;\n  const short = formatRelative(iso, now);\n  if (!short) return null;\n  if (short === 'now') return 'just now';\n  // Only the relative tokens (\"5m\", \"3h\", \"2d\") take \"ago\". Anything else is a\n  // DATE, whatever the locale prints: \"Sep 1\" (en-US) but \"1 Sept\" (en-GB)\n  // and \"1. Sept.\" (de) start with a digit — testing for a leading digit\n  // printed \"Last completed 1 Sept ago.\" outside the US.\n  return /^\\d+[mhd]$/.test(short) ? `${short} ago` : `on ${short}`;\n}\n\n// ---------------------------------------------------------------------------\n// Memory\n// ---------------------------------------------------------------------------\n\n/**\n * Shapes that are almost certainly credentials. MEMORY.md is sent to every\n * seat's model on every turn, so a pasted key would travel to every provider\n * — the panel warns BEFORE the save rather than trusting the server's scrub\n * to catch it on the way out. Conservative on purpose: a false alarm on prose\n * would teach the operator to ignore the warning.\n */\nconst SECRET_PATTERNS: ReadonlyArray<{ label: string; re: RegExp }> = [\n  { label: 'a private key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },\n  { label: 'an Anthropic API key', re: /\\bsk-ant-[A-Za-z0-9_-]{20,}/ },\n  { label: 'an OpenAI-style API key', re: /\\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/ },\n  { label: 'an xAI API key', re: /\\bxai-[A-Za-z0-9]{32,}/ },\n  { label: 'a GitHub token', re: /\\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}|\\bgithub_pat_[A-Za-z0-9_]{40,}/ },\n  { label: 'an AWS access key', re: /\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b/ },\n  { label: 'a Slack token', re: /\\bxox[abprs]-[A-Za-z0-9-]{10,}/ },\n  { label: 'a Google API key', re: /\\bAIza[0-9A-Za-z_-]{35}\\b/ },\n  { label: 'a Stripe secret key', re: /\\b(?:sk|rk)_live_[0-9A-Za-z]{20,}/ },\n];\n\n/**\n * Mirrors `VERSE_MEMORY_BLOCK_MAX_BYTES` in src/core/verse/project-memory.ts\n * (a node module the browser cannot import): the most memory text a chat's\n * instructions carry, however large MEMORY.md itself is.\n */\nexport const MEMORY_BLOCK_MAX_BYTES = VERSE_MEMORY_BLOCK_MAX_BYTES;\n\n/**\n * What memory costs, in the one wording the memory panel and the resources\n * panel share. Memory is ON by default and snapshotted into every new chat's\n * system prompt (claude `--append-system-prompt`, codex `developer_instructions`,\n * grok `--rules`), which re-rides every turn, and it asks writable seats to\n * read and update MEMORY.md — tool calls and output. On a paid seat that is\n * real (if small, mostly cached) usage, so \"nothing here spends\" would be\n * false for exactly the operator deciding whether to leave it on near a limit.\n * Reading and editing the file from the panel is still free.\n */\nexport const MEMORY_SPEND_NOTE =\n  `Reading and editing memory here spends nothing. On a paid seat it is not free to use: each new chat’s system prompt carries a memory block of up to ${MEMORY_BLOCK_MAX_BYTES / 1024} KB, re-sent every turn (cached after the first), and the agent reads and updates MEMORY.md as it works. Local seats spend nothing.`;\n\n/** The first credential shape found, as a phrase (\"a GitHub token\"), or null. */\nexport function secretLike(text: string): string | null {\n  for (const { label, re } of SECRET_PATTERNS) if (re.test(text)) return label;\n  return null;\n}\n\n/**\n * The placeholder the server's scrubber (src/core/util/scrub.ts) writes over\n * secret-shaped text in every rule. In a memory view flagged\n * `contentSanitized`, each one stands for a REAL value still in MEMORY.md.\n */\nexport const REDACTION_MARKER = '[REDACTED]';\n\n/** How many redaction placeholders a text carries. */\nexport function redactionMarkers(text: string): number {\n  return text.split(REDACTION_MARKER).length - 1;\n}\n\n// ---------------------------------------------------------------------------\n// Search\n// ---------------------------------------------------------------------------\n\n/** Below this many characters a keyword search over every message is noise, not recall. */\nexport const SEARCH_MIN_CHARS = 2;\n/** Keystrokes inside this window collapse into one request. */\nexport const SEARCH_DEBOUNCE_MS = 250;\n/** Hits asked for per search — enough to fill the sidebar twice over. */\nexport const SEARCH_LIMIT = 30;\n\n/** Whitespace-separated terms, lowercased and de-duplicated (the server ANDs them). */\nexport function searchTerms(query: string): string[] {\n  const out: string[] = [];\n  for (const raw of query.toLowerCase().split(/\\s+/)) {\n    if (raw && !out.includes(raw)) out.push(raw);\n  }\n  return out;\n}\n\nexport interface HighlightSegment {\n  text: string;\n  match: boolean;\n}\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\n/**\n * Split `text` into plain and matched runs for every term, case-insensitive.\n * Longest terms first so \"migrate\" wins over \"migrat\" at the same position.\n */\nexport function highlightSegments(text: string, terms: readonly string[]): HighlightSegment[] {\n  const usable = [...terms].filter((t) => t.length > 0).sort((a, b) => b.length - a.length);\n  if (usable.length === 0 || text.length === 0) return text ? [{ text, match: false }] : [];\n  const re = new RegExp(usable.map(escapeRegExp).join('|'), 'gi');\n  const out: HighlightSegment[] = [];\n  let last = 0;\n  for (const m of text.matchAll(re)) {\n    const start = m.index ?? 0;\n    if (m[0].length === 0) continue;\n    if (start > last) out.push({ text: text.slice(last, start), match: false });\n    out.push({ text: m[0], match: true });\n    last = start + m[0].length;\n  }\n  if (last < text.length) out.push({ text: text.slice(last), match: false });\n  return out;\n}\n\nexport interface SessionSearchGroup {\n  sessionId: string;\n  title: string;\n  projectPath: string;\n  engine: VerseEngine;\n  /** The best-scoring hit in this session (the server returns hits best-first). */\n  top: VerseSearchHit;\n  /** Every hit this session contributed to the response. */\n  count: number;\n  /** Newest hit time, for the row's relative time. */\n  latestAt: string;\n}\n\n/**\n * One row per session. The server ranks MESSAGES; the sidebar lists CHATS,\n * and five rows for one chat would push every other match off screen. Order\n * is the order each session first appears, i.e. by its best hit.\n */\nexport function groupSearchHits(hits: readonly VerseSearchHit[]): SessionSearchGroup[] {\n  const groups = new Map<string, SessionSearchGroup>();\n  for (const hit of hits) {\n    const existing = groups.get(hit.sessionId);\n    if (!existing) {\n      groups.set(hit.sessionId, {\n        sessionId: hit.sessionId,\n        title: hit.title,\n        projectPath: hit.projectPath,\n        engine: hit.engine,\n        top: hit,\n        count: 1,\n        latestAt: hit.at,\n      });\n      continue;\n    }\n    existing.count += 1;\n    if (hit.at > existing.latestAt) existing.latestAt = hit.at;\n  }\n  return [...groups.values()];\n}\n"],"mappings":"oMAglBA,IAAa,EAAgB,CAAC,UAAW,MAAO,SAAU,OAAQ,QAAS,KAAK,EAiSnE,EAA4B,MAqF5B,EAA0B,KAa1B,EAAgC,CAC3C,0FACA,+HACA,GACA,qBACA,0CACA,6DACA,0EACA,kDACA,6CACA,2EACA,GACA,qEACF,CAAC,CAAC,KAAK;CAAI,EA4EE,EAAyB,MAQzB,EAA8B,OAG9B,EAA+B,KC5gCtC,EAAc,oBAOpB,SAAgB,EAAa,EAA6B,CACxD,IAAM,EAAY,EAAY,QAAQ,OAAQ,GAAG,CAAC,CAAC,KAAK,EAClD,EAAQ,EAAY,KAAK,CAAS,EAClC,GAAQ,EAAQ,EAAU,MAAM,EAAG,EAAM,KAAK,EAAI,IAAc,gBAEhE,EAAS,WADF,EAAQ,OAAO,SAAS,EAAM,GAAK,EAAE,EAAI,EAAI,IAEpD,EAAA,IAAyB,EAAO,OAEtC,MAAO,GADS,EAAK,OAAS,EAAO,GAAG,EAAK,MAAM,EAAG,EAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAK,IAC3D,GACtB,CAOA,SAAgB,EAAY,EAAoC,EAA0C,CACxG,GAAI,CAAC,EAAM,OAAO,KAClB,IAAM,EAAQ,EAAK,OAAO,KAAM,GAAM,EAAE,KAAO,CAAO,EACtD,GAAI,EAAO,OAAO,EAClB,IAAM,EAAY,EAAiB,CAAO,EAC1C,OAAO,EAAK,OAAO,KAAM,GAAM,EAAiB,EAAE,EAAE,IAAM,CAAS,GAAK,IAC1E,CASA,SAAgB,EACd,EACA,EACA,EAAc,KAAK,IAAI,EACR,CASf,OARK,EACD,EAAK,OAAO,QAAU,cACjB,GAAG,EAAK,MAAM,mBAAmB,EAAS,EAAU,EAAK,OAAO,SAAW,kBAAmB,CAAG,CAAC,EAAE,GAExG,EACD,EAAO,kBACF,GAAG,EAAO,MAAM,iBAAiB,EAAK,MAAM,IAAI,EAAS,EAAU,EAAO,kBAAmB,CAAG,CAAC,EAAE,GAErG,KAJa,6BAJF,6BASpB,CAcA,SAAgB,EAAqB,EAA6B,EAAsE,CACtI,IAAM,EAAM,EAAM,KAAM,GAAM,EAAE,KAAO,EAAO,MAAM,EACpD,GAAI,GAAO,EAAI,OAAO,QAAU,cAAe,CAC7C,IAAM,EAAO,EAAY,EAAK,EAAO,KAAK,EAC1C,GAAI,GAAQ,CAAC,EAAK,kBAAmB,MAAO,CAAE,OAAQ,EAAI,GAAI,MAAO,EAAK,EAAG,EAC7E,IAAM,EAAW,EAAI,OAAO,KAAM,GAAM,CAAC,EAAE,iBAAiB,EAC5D,GAAI,EAAU,MAAO,CAAE,OAAQ,EAAI,GAAI,MAAO,EAAS,EAAG,CAC5D,CACA,IAAK,IAAM,KAAQ,EAAO,CACxB,GAAI,EAAK,OAAO,QAAU,cAAe,SACzC,IAAM,EAAW,EAAK,OAAO,KAAM,GAAM,CAAC,EAAE,iBAAiB,EAC7D,GAAI,EAAU,MAAO,CAAE,OAAQ,EAAK,GAAI,MAAO,EAAS,EAAG,CAC7D,CACA,OAAO,IACT,CAYA,SAAgB,EAAmB,EAKd,CACnB,GAAM,CAAE,SAAQ,SAAQ,SAAQ,eAAgB,EAC1C,EAAS,GACb,IAAS,IAAA,IAAa,EAAU,EAAQ,CAAI,IAAM,KAGpD,GAFkB,IAAW,MAAQ,EAAO,SAAW,EAAO,QACzD,EAAiB,EAAO,KAAK,IAAM,EAAiB,EAAO,KAAK,GACpD,EAAM,EAAO,aAAe,UAAU,EAAG,OAAO,EAAO,aAAe,WACvF,IAAM,EAAY,EAAS,GAAa,MAAM,EAAO,OAAO,EAAE,YAAc,IAAA,GAE5E,OADI,EAAM,CAAS,EAAU,EACtB,UACT,CASA,SAAgB,EAAY,EAAiC,EAAsD,CACjH,OAAO,EAAU,EAAQ,CAAI,IAAM,KAAc,IAAA,GAAP,CAC5C,CAGA,SAAgB,EAAW,EAAiC,EAAuC,CACjG,IAAM,EAAS,EAAU,EAAQ,CAAI,EACrC,GAAI,CAAC,EAAQ,OAAO,KACpB,IAAM,EAAS,GAAG,EAAoB,EAAO,aAAa,EAAE,SAC5D,OAAO,EAAO,gBAAkB,KAAO,EAAS,GAAG,EAAO,eAAe,EAAa,EAAO,aAAa,GAC5G,CA6BA,SAAgB,EACd,EACA,EACA,EACA,EACY,CACZ,IAAM,EAAgB,EAAwB,CAAS,EACjD,EAAiB,EAAsB,CAAM,EAC7C,EAAa,EAAgB,EAC7B,EAAU,EAAW,EAAe,EAAQ,CAAc,EAC1D,EAAM,IAAI,EAAa,CAAa,EAAE,qCAAqC,EAAa,CAAc,EAAE,kBACxG,EAAW,EAAU,EAAQ,UAAU,EACvC,EAAc,EAAW,EAAS,eAAiB,EAAS,cAAgB,KAC5E,EAAO,CAAE,UAAS,gBAAe,iBAAgB,YAAW,EAClE,OAAQ,EAAR,CACE,IAAK,OACH,MAAO,CAAE,GAAG,EAAM,KAAM,KAAM,KAAM,SAAS,EAAI,wDAAyD,EAC5G,IAAK,QACH,MAAO,CACL,GAAG,EACH,KAAM,OACN,KAAM,UAAU,EAAI,MAAM,EAAa,GAAc,GAAe,GAAe,GAAG,EAAE,iEAC1F,EACF,IAAK,YACH,OAAO,IAAS,YACZ,CAAE,GAAG,EAAM,KAAM,OAAQ,KAAM,mCAAmC,EAAI,EAAG,EACzE,CAAE,GAAG,EAAM,KAAM,SAAU,KAAM,oCAAoC,EAAI,6CAA8C,EAC7H,IAAK,QACH,MAAO,CAAE,GAAG,EAAM,KAAM,SAAU,KAAM,0CAA0C,EAAI,yDAA0D,EAClJ,QACE,MAAO,CAAE,GAAG,EAAM,QAAS,KAAM,KAAM,UAAW,KAAM,gEAAiE,CAC7H,CACF,CAGA,SAAgB,EAAgB,EAA0C,CACxE,OAAO,EAAiB,CAAM,CAChC,CAGA,SAAgB,EAAiB,EAAqB,EAA2B,CAC/E,OAAO,IAAW,QACd,6BAA6B,EAAU,oCACvC,qBAAqB,EAAU,iEACrC,CAMA,IAAM,EAAU,OAAO,aAAgB,WAAa,IAAI,YAAgB,KAGxE,SAAgB,EAAU,EAAsB,CAC9C,GAAI,EAAS,OAAO,EAAQ,OAAO,CAAI,CAAC,CAAC,OAEzC,IAAI,EAAQ,EACZ,IAAK,IAAM,KAAM,EAAM,CACrB,IAAM,EAAK,EAAG,YAAY,CAAC,GAAK,EAChC,GAAS,EAAK,IAAO,EAAI,EAAK,KAAQ,EAAI,EAAK,MAAU,EAAI,CAC/D,CACA,OAAO,CACT,CAUA,IAAa,EAAqB,MAYrB,EAAwB,EAGrC,SAAgB,EAAc,EAAuB,CACnD,OAAO,EAAU,KAAK,UAAU,CAAI,GAAK,EAAE,CAC7C,CAEA,SAAgB,EAAY,EAAuB,CACjD,GAAI,CAAC,OAAO,SAAS,CAAK,GAAK,EAAQ,EAAG,MAAO,IACjD,GAAI,EAAQ,KAAM,MAAO,GAAG,EAAM,IAClC,IAAM,EAAK,EAAQ,KACnB,MAAO,GAAG,EAAK,GAAK,EAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,OAAQ,EAAE,EAAI,KAAK,MAAM,CAAE,EAAE,IACzE,CAOA,SAAgB,EAAe,EAAgC,EAAc,KAAK,IAAI,EAAkB,CACtG,GAAI,CAAC,EAAK,OAAO,KACjB,IAAM,EAAQ,EAAe,EAAK,CAAG,EAOrC,OANK,EACD,IAAU,MAAc,WAKrB,aAAa,KAAK,CAAK,EAAI,GAAG,EAAM,MAAQ,MAAM,IANtC,IAOrB,CAaA,IAAM,EAAgE,CACpE,CAAE,MAAO,gBAAiB,GAAI,oCAAqC,EACnE,CAAE,MAAO,uBAAwB,GAAI,6BAA8B,EACnE,CAAE,MAAO,0BAA2B,GAAI,mCAAoC,EAC5E,CAAE,MAAO,iBAAkB,GAAI,wBAAyB,EACxD,CAAE,MAAO,iBAAkB,GAAI,2EAA4E,EAC3G,CAAE,MAAO,oBAAqB,GAAI,+BAAgC,EAClE,CAAE,MAAO,gBAAiB,GAAI,gCAAiC,EAC/D,CAAE,MAAO,mBAAoB,GAAI,2BAA4B,EAC7D,CAAE,MAAO,sBAAuB,GAAI,mCAAoC,CAC1E,EAOa,EAAyB,EAYzB,EACX,uJAAuJ,EAAyB,KAAK,qIAGvL,SAAgB,EAAW,EAA6B,CACtD,IAAK,GAAM,CAAE,QAAO,QAAQ,EAAiB,GAAI,EAAG,KAAK,CAAI,EAAG,OAAO,EACvE,OAAO,IACT,CAOA,IAAa,EAAmB,aAGhC,SAAgB,EAAiB,EAAsB,CACrD,OAAO,EAAK,MAAM,CAAgB,CAAC,CAAC,OAAS,CAC/C,CAcA,SAAgB,EAAY,EAAyB,CACnD,IAAM,EAAgB,CAAC,EACvB,IAAK,IAAM,KAAO,EAAM,YAAY,CAAC,CAAC,MAAM,KAAK,EAC3C,GAAO,CAAC,EAAI,SAAS,CAAG,GAAG,EAAI,KAAK,CAAG,EAE7C,OAAO,CACT,CAOA,SAAS,EAAa,EAAuB,CAC3C,OAAO,EAAM,QAAQ,sBAAuB,MAAM,CACpD,CAMA,SAAgB,EAAkB,EAAc,EAA8C,CAC5F,IAAM,EAAS,CAAC,GAAG,CAAK,CAAC,CAAC,OAAQ,GAAM,EAAE,OAAS,CAAC,CAAC,CAAC,MAAM,EAAG,IAAM,EAAE,OAAS,EAAE,MAAM,EACxF,GAAI,EAAO,SAAW,GAAK,EAAK,SAAW,EAAG,OAAO,EAAO,CAAC,CAAE,OAAM,MAAO,EAAM,CAAC,EAAI,CAAC,EACxF,IAAM,EAAK,IAAI,OAAO,EAAO,IAAI,CAAY,CAAC,CAAC,KAAK,GAAG,EAAG,IAAI,EACxD,EAA0B,CAAC,EAC7B,EAAO,EACX,IAAK,IAAM,KAAK,EAAK,SAAS,CAAE,EAAG,CACjC,IAAM,EAAQ,EAAE,OAAS,EACrB,EAAE,EAAE,CAAC,SAAW,IAChB,EAAQ,GAAM,EAAI,KAAK,CAAE,KAAM,EAAK,MAAM,EAAM,CAAK,EAAG,MAAO,EAAM,CAAC,EAC1E,EAAI,KAAK,CAAE,KAAM,EAAE,GAAI,MAAO,EAAK,CAAC,EACpC,EAAO,EAAQ,EAAE,EAAE,CAAC,OACtB,CAEA,OADI,EAAO,EAAK,QAAQ,EAAI,KAAK,CAAE,KAAM,EAAK,MAAM,CAAI,EAAG,MAAO,EAAM,CAAC,EAClE,CACT,CAoBA,SAAgB,EAAgB,EAAuD,CACrF,IAAM,EAAS,IAAI,IACnB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAW,EAAO,IAAI,EAAI,SAAS,EACzC,GAAI,CAAC,EAAU,CACb,EAAO,IAAI,EAAI,UAAW,CACxB,UAAW,EAAI,UACf,MAAO,EAAI,MACX,YAAa,EAAI,YACjB,OAAQ,EAAI,OACZ,IAAK,EACL,MAAO,EACP,SAAU,EAAI,EAChB,CAAC,EACD,QACF,CACA,EAAS,OAAS,EACd,EAAI,GAAK,EAAS,WAAU,EAAS,SAAW,EAAI,GAC1D,CACA,MAAO,CAAC,GAAG,EAAO,OAAO,CAAC,CAC5B"}

package/dist/core/web/public/next/assets/context-queries-eL3caKVG.js

@@ -0,0 +1,2 @@
+import{G as e,I as t,N as n,O as r,W as i,k as a,o,u as s}from"./global-CMNW_dqn.js";import{f as c,i as l,r as u,w as d}from"./VerseConsoleApp-CWU6R3By.js";import{l as f}from"./verse-store-DNVRuiJL.js";import{t as p}from"./format-CH4g_sl1.js";var m=`verse-preferences`,h=`verse-memory:`;async function g(e){try{let t=await e.json();if(typeof t.error==`string`&&t.error)return t.error;if(typeof t.note==`string`&&t.note)return t.note}catch{}return null}async function _(e,t){let r=await fetch(e,{method:`GET`,credentials:`same-origin`,headers:{"x-ashlr-read-client":a()},signal:t});if(r.status===401)throw n(),new o(`Read session expired.`,401,e);if(!r.ok){let t=await g(r);throw new o(`GET ${e} failed (HTTP ${r.status})${t?`: ${p(t)}`:``}.`,r.status,e,t)}return await r.json()}async function v(e,n){let i=r();if(!i)throw new l;let a=await s(e,n,i);return t(),a}function y(e,t){let n=t.toString();return n?`${e}?${n}`:e}async function b(e,t){let n={mode:t},r=await v(d(e,`/context-mode`),n);return f(e,r),i(u),r}async function x(e,t={}){let n={};t.includeLastAssistant===!0&&(n.includeLastAssistant=!0);let r=typeof t.focus==`string`?t.focus.trim().slice(0,500):``;return r&&(n.focus=r),v(d(e,`/handoff-preview`),n)}async function S(e){let{source:t}=e,n={projectPath:t.projectPath,seatId:e.seatId,handoffFromSessionId:t.id},r=(t.extraRoots??[]).filter(e=>typeof e==`string`&&e.length>0&&e!==t.projectPath);r.length>0&&(n.extraRoots=r),e.model&&(n.model=e.model),e.contextMode&&(n.contextMode=e.contextMode);let i=e.title?.trim();i&&(n.title=i);let a=await v(`/api/verse/sessions`,n);return c(),a}function C(e){return _(`/api/verse/preferences`,e)}var w={key:m,fetch:e=>C(e)};async function T(t){let n=await v(`/api/verse/preferences`,t);return i(m),e(h),n}function E(e){let t=new URLSearchParams,n=e.workspaceId?.trim()??``,r=e.projectPath?.trim()??``,i=(e.extraRoots??[]).map(e=>e.trim()).filter(e=>e.length>0);if(n){if(r||i.length>0)throw Error(`Estimate a workspace or a folder set, not both.`);t.set(`workspaceId`,n)}else if(r){t.set(`projectPath`,r);for(let e of i)t.append(`extraRoots`,e)}else throw Error(`Pick a project or a workspace to estimate.`);return y(`/api/verse/context-fit`,t)}function D(e,t){return _(E(e),t)}function O(e,t,n){let r=new URLSearchParams({q:e});return typeof t==`number`&&Number.isFinite(t)&&r.set(`limit`,String(Math.max(1,Math.min(50,Math.floor(t))))),_(y(`/api/verse/search`,r),n)}function k(e){return`${h}${e}`}function A(e,t){return _(y(`/api/verse/memory`,new URLSearchParams({projectPath:e})),t)}function j(e){return{key:k(e),fetch:t=>A(e,t)}}async function M(e,t){let n=await v(`/api/verse/memory`,{projectPath:e,content:t});return i(k(e)),n}export{A as a,T as c,M as d,C as i,w as l,D as n,O as o,x as r,b as s,S as t,j as u};
+//# sourceMappingURL=context-queries-eL3caKVG.js.map

package/dist/core/web/public/next/assets/{context-queries-_9bFWb9v.js.map → context-queries-eL3caKVG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"context-queries-_9bFWb9v.js","names":[],"sources":["../../../../../../src/web-ui/routes/verse/context/context-queries.ts"],"sourcesContent":["/**\n * routes/verse/context/context-queries.ts — every V3.9 context-orchestration\n * call the Verse console makes (docs/VERSE-CONTEXT.md): context mode, handoff\n * preview + handoff creation, preferences, context fit, session search and\n * shared project memory.\n *\n * Same conventions as ../verse-queries.ts, deliberately:\n *\n *  - WRITES pull the held mutation token from auth-store, throw\n *    `VerseMutationLockedError` (the SAME class, so ChatSection's `fail`\n *    recognises it) when none is held, touch the hold on success, and\n *    invalidate exactly the cache keys they obviously change.\n *  - READS carry the per-tab read-client proof and report an expired read\n *    session, exactly like `apiGet`. They are written out here rather than\n *    routed through `apiGet` for one reason: `apiGet` discards the response\n *    body on a non-2xx, and the routes below answer a refused read (\"path is\n *    not a directory\", \"q must be at least 2 characters\") with a sentence\n *    written for a person. Those sentences travel as `ApiError.detail`, the\n *    field `describeControlError` already prefers.\n *\n * NOTHING HERE SPENDS. Every route below is deterministic server work\n * (preferences file, git ls-files, events.jsonl scans, a memory file). The\n * one model call a context feature can cause — \"ask this seat to summarize\"\n * — goes through the ordinary `sendVerseTurn`, i.e. through the engine's\n * `startTurn` chokepoint and the local-only policy, never through this file.\n *\n * `handoff-preview` is a POST although it only reads: it spawns\n * `git diff --stat` per root, and the API keeps every spawning route behind\n * the dispatch flag and the mutation token. It therefore needs the token like\n * any write, and the dialog says so.\n */\nimport type { VerseCreateSessionRequest, VerseSession } from '../../../data/api-types.js';\nimport type {\n  VerseContextFit,\n  VerseContextMode,\n  VerseContextModeRequest,\n  VerseHandoffPreview,\n  VerseHandoffPreviewRequest,\n  VersePreferences,\n  VersePreferencesUpdate,\n  VerseProjectMemory,\n  VerseProjectMemoryWrite,\n  VerseSearchResponse,\n} from '../../../../core/verse/types.js';\nimport { getMutationToken, reportSessionExpired, getReadClientProof, touchMutationHold } from '../../../data/auth-store.js';\nimport { invalidate, invalidatePrefix } from '../../../data/cache.js';\nimport { ApiError, apiPost } from '../../../data/client.js';\nimport type { QueryDef } from '../../../data/queries.js';\nimport { invalidateVerseLists, verseSessionPath, VERSE_SESSIONS_KEY, VerseMutationLockedError } from '../verse-queries.js';\nimport { setVerseSession } from '../verse-store.js';\nimport { asClause } from '../autonomy/format.js';\n\nexport const VERSE_PREFERENCES_KEY = 'verse-preferences';\n/** Prefix of every per-project memory key; `invalidatePrefix` reaches all of them. */\nexport const VERSE_MEMORY_KEY_PREFIX = 'verse-memory:';\n/** Prefix of every context-fit key (one per root set). */\nexport const VERSE_CONTEXT_FIT_KEY_PREFIX = 'verse-context-fit:';\n\n// ---------------------------------------------------------------------------\n// Transport\n// ---------------------------------------------------------------------------\n\n/** The server's own refusal sentence, when the body carried one. */\nasync function refusalDetail(res: Response): Promise<string | null> {\n  try {\n    const body = (await res.json()) as { error?: unknown; note?: unknown };\n    if (typeof body.error === 'string' && body.error) return body.error;\n    if (typeof body.note === 'string' && body.note) return body.note;\n  } catch {\n    /* not JSON — the status alone has to do */\n  }\n  return null;\n}\n\n/**\n * GET with the read-client proof. Behaves like `apiGet` (401 reports the\n * expired read session) but keeps the server's refusal sentence.\n */\nasync function getJson<T>(path: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(path, {\n    method: 'GET',\n    credentials: 'same-origin',\n    headers: { 'x-ashlr-read-client': getReadClientProof() },\n    signal,\n  });\n  if (res.status === 401) {\n    reportSessionExpired();\n    throw new ApiError('Read session expired.', 401, path);\n  }\n  if (!res.ok) {\n    const detail = await refusalDetail(res);\n    // asClause: a detail ending in its own period would otherwise read \"…..\".\n    throw new ApiError(`GET ${path} failed (HTTP ${res.status})${detail ? `: ${asClause(detail)}` : ''}.`, res.status, path, detail);\n  }\n  return (await res.json()) as T;\n}\n\nasync function post<T>(path: string, body: unknown): Promise<T> {\n  const token = getMutationToken();\n  if (!token) throw new VerseMutationLockedError();\n  const result = await apiPost<T>(path, body, token);\n  touchMutationHold();\n  return result;\n}\n\nfunction withQuery(path: string, params: URLSearchParams): string {\n  const query = params.toString();\n  return query ? `${path}?${query}` : path;\n}\n\n// ---------------------------------------------------------------------------\n// Context mode\n// ---------------------------------------------------------------------------\n\n/**\n * Switch a session between `standard` and `expansive`. Applies from the next\n * turn (it only changes CLI flags, never prompt content, so the provider's\n * prompt cache survives the switch).\n *\n * The returned record is also written into verse-store, so the meter, the\n * mode chip and the composer hint all move on this response rather than on\n * the next list refresh — whichever component made the call.\n */\nexport async function setSessionContextMode(sessionId: string, mode: VerseContextMode): Promise<VerseSession> {\n  const body: VerseContextModeRequest = { mode };\n  const session = await post<VerseSession>(verseSessionPath(sessionId, '/context-mode'), body);\n  setVerseSession(sessionId, session);\n  invalidate(VERSE_SESSIONS_KEY);\n  return session;\n}\n\n// ---------------------------------------------------------------------------\n// Handoff\n// ---------------------------------------------------------------------------\n\n/** Longest focus line the API accepts (types.ts VerseHandoffPreviewRequest). */\nexport const HANDOFF_FOCUS_MAX_CHARS = 500;\n\n/**\n * Build the deterministic handoff note for a session. Zero spend: the server\n * reads events.jsonl and a bounded `git diff --stat` per root.\n *\n * Only keys that carry a value are sent — the route rejects unknown keys, and\n * `includeLastAssistant: false` is the default anyway, so omitting it keeps\n * the body minimal and the server's validation the single authority.\n */\nexport async function fetchHandoffPreview(sessionId: string, req: VerseHandoffPreviewRequest = {}): Promise<VerseHandoffPreview> {\n  const body: VerseHandoffPreviewRequest = {};\n  if (req.includeLastAssistant === true) body.includeLastAssistant = true;\n  const focus = typeof req.focus === 'string' ? req.focus.trim().slice(0, HANDOFF_FOCUS_MAX_CHARS) : '';\n  if (focus) body.focus = focus;\n  return post<VerseHandoffPreview>(verseSessionPath(sessionId, '/handoff-preview'), body);\n}\n\nexport interface HandoffSessionInput {\n  /** The session being handed off. Its PINNED roots are reused, see below. */\n  source: VerseSession;\n  seatId: string;\n  model?: string;\n  contextMode?: VerseContextMode;\n  /** Optional title; absent → the server titles it from the first message. */\n  title?: string;\n}\n\n/**\n * Create the session a handoff continues in. FREE: creating a session spawns\n * nothing. The handoff text is NOT sent here — the caller pre-fills the new\n * chat's composer and the operator presses send, so the first (spent) turn is\n * always one the operator read.\n *\n * Roots: the source's PINNED roots (`projectPath` + `extraRoots`), never its\n * `workspaceId`. A session keeps the roots it was created with even if the\n * named workspace was later edited or deleted (types.ts VerseSession\n * `extraRoots`); re-resolving the workspace here would let the continuation\n * silently gain or lose a folder the conversation was about — or fail\n * outright on a deleted workspace. The API also refuses the two spellings\n * mixed, so it is one or the other, and the pinned set is the honest one.\n *\n * The server resolves `handoffFrom.title` from `handoffFromSessionId` itself;\n * nothing about provenance is taken from this body.\n */\nexport async function createHandoffSession(input: HandoffSessionInput): Promise<VerseSession> {\n  const { source } = input;\n  const req: VerseCreateSessionRequest = {\n    projectPath: source.projectPath,\n    seatId: input.seatId,\n    handoffFromSessionId: source.id,\n  };\n  const extras = (source.extraRoots ?? []).filter((root) => typeof root === 'string' && root.length > 0 && root !== source.projectPath);\n  if (extras.length > 0) req.extraRoots = extras;\n  if (input.model) req.model = input.model;\n  if (input.contextMode) req.contextMode = input.contextMode;\n  const title = input.title?.trim();\n  if (title) req.title = title;\n  const session = await post<VerseSession>('/api/verse/sessions', req);\n  invalidateVerseLists();\n  return session;\n}\n\n// ---------------------------------------------------------------------------\n// Preferences\n// ---------------------------------------------------------------------------\n\nexport function fetchPreferences(signal?: AbortSignal): Promise<VersePreferences> {\n  return getJson<VersePreferences>('/api/verse/preferences', signal);\n}\n\nexport const versePreferencesQuery: QueryDef<VersePreferences> = {\n  key: VERSE_PREFERENCES_KEY,\n  fetch: (signal) => fetchPreferences(signal),\n};\n\n/**\n * Change ONE standing preference (the three request forms are exclusive, so a\n * body never changes more than the operator clicked). Memory records carry an\n * `enabled` flag derived from these preferences, so every cached memory read\n * is refreshed too.\n */\nexport async function updatePreferences(update: VersePreferencesUpdate): Promise<VersePreferences> {\n  const prefs = await post<VersePreferences>('/api/verse/preferences', update);\n  invalidate(VERSE_PREFERENCES_KEY);\n  invalidatePrefix(VERSE_MEMORY_KEY_PREFIX);\n  return prefs;\n}\n\n// ---------------------------------------------------------------------------\n// Context fit\n// ---------------------------------------------------------------------------\n\nexport interface ContextFitQuery {\n  workspaceId?: string;\n  projectPath?: string;\n  extraRoots?: string[];\n}\n\n/**\n * The query string for a fit request: a workspace id ALONE, or a project path\n * with each extra root as its own repeated `extraRoots` parameter (a path may\n * contain a comma, so a joined list could not be split back honestly). The\n * API refuses the two spellings mixed — refused here first, with the reason.\n */\nexport function contextFitPath(q: ContextFitQuery): string {\n  const params = new URLSearchParams();\n  const workspaceId = q.workspaceId?.trim() ?? '';\n  const projectPath = q.projectPath?.trim() ?? '';\n  const extras = (q.extraRoots ?? []).map((r) => r.trim()).filter((r) => r.length > 0);\n  if (workspaceId) {\n    if (projectPath || extras.length > 0) throw new Error('Estimate a workspace or a folder set, not both.');\n    params.set('workspaceId', workspaceId);\n  } else if (projectPath) {\n    params.set('projectPath', projectPath);\n    for (const root of extras) params.append('extraRoots', root);\n  } else {\n    throw new Error('Pick a project or a workspace to estimate.');\n  }\n  return withQuery('/api/verse/context-fit', params);\n}\n\n/** How big the reachable code is, in estimated tokens. Zero spend (git ls-files + stat). */\nexport function fetchContextFit(q: ContextFitQuery, signal?: AbortSignal): Promise<VerseContextFit> {\n  return getJson<VerseContextFit>(contextFitPath(q), signal);\n}\n\n/** Cache-backed form, keyed by the exact root set, for pickers that re-render often. */\nexport function verseContextFitQuery(q: ContextFitQuery): QueryDef<VerseContextFit> {\n  const path = contextFitPath(q);\n  return { key: `${VERSE_CONTEXT_FIT_KEY_PREFIX}${path}`, fetch: (signal) => getJson<VerseContextFit>(path, signal) };\n}\n\n// ---------------------------------------------------------------------------\n// Session search\n// ---------------------------------------------------------------------------\n\n/** The API caps `limit` at 50 (session-search.ts); asking for more is refused, so clamp. */\nexport const SEARCH_LIMIT_MAX = 50;\n\n/** Keyword search over past sessions' messages. Zero spend — a bounded scan of events.jsonl. */\nexport function searchSessions(q: string, limit?: number, signal?: AbortSignal): Promise<VerseSearchResponse> {\n  const params = new URLSearchParams({ q });\n  if (typeof limit === 'number' && Number.isFinite(limit)) {\n    params.set('limit', String(Math.max(1, Math.min(SEARCH_LIMIT_MAX, Math.floor(limit)))));\n  }\n  return getJson<VerseSearchResponse>(withQuery('/api/verse/search', params), signal);\n}\n\n// ---------------------------------------------------------------------------\n// Shared project memory\n// ---------------------------------------------------------------------------\n\n/**\n * The memory record as the browser receives it. The server's public-JSON\n * sanitizer rewrites the home folder as `~` and secret-shaped text as\n * `[REDACTED]` on the way out, so `content` can differ from the file on disk;\n * the route then adds `contentSanitized: true` (absent otherwise). Declared\n * here, not in types.ts: that contract is frozen and the flag is additive.\n */\nexport type VerseProjectMemoryView = VerseProjectMemory & { contentSanitized?: boolean };\n\nexport function verseProjectMemoryKey(projectPath: string): string {\n  return `${VERSE_MEMORY_KEY_PREFIX}${projectPath}`;\n}\n\nexport function fetchProjectMemory(projectPath: string, signal?: AbortSignal): Promise<VerseProjectMemoryView> {\n  return getJson<VerseProjectMemoryView>(withQuery('/api/verse/memory', new URLSearchParams({ projectPath })), signal);\n}\n\nexport function verseProjectMemoryQuery(projectPath: string): QueryDef<VerseProjectMemoryView> {\n  return { key: verseProjectMemoryKey(projectPath), fetch: (signal) => fetchProjectMemory(projectPath, signal) };\n}\n\n/**\n * Replace MEMORY.md for a project (atomic, 0600 on the server, capped at\n * VERSE_MEMORY_MAX_BYTES). `''` clears it. Chats already open keep the block\n * pinned in their instructions at creation; they see the change when they\n * next read the file.\n */\nexport async function writeProjectMemory(projectPath: string, content: string): Promise<VerseProjectMemoryView> {\n  const body: VerseProjectMemoryWrite = { projectPath, content };\n  const memory = await post<VerseProjectMemoryView>('/api/verse/memory', body);\n  invalidate(verseProjectMemoryKey(projectPath));\n  return memory;\n}\n"],"mappings":"wPAoDA,IAAa,EAAwB,oBAExB,EAA0B,gBASvC,eAAe,EAAc,EAAuC,CAClE,GAAI,CACF,IAAM,EAAQ,MAAM,EAAI,KAAK,EAC7B,GAAI,OAAO,EAAK,OAAU,UAAY,EAAK,MAAO,OAAO,EAAK,MAC9D,GAAI,OAAO,EAAK,MAAS,UAAY,EAAK,KAAM,OAAO,EAAK,IAC9D,MAAQ,CAER,CACA,OAAO,IACT,CAMA,eAAe,EAAW,EAAc,EAAkC,CACxE,IAAM,EAAM,MAAM,MAAM,EAAM,CAC5B,OAAQ,MACR,YAAa,cACb,QAAS,CAAE,sBAAuB,EAAmB,CAAE,EACvD,QACF,CAAC,EACD,GAAI,EAAI,SAAW,IAEjB,MADA,EAAqB,EACf,IAAI,EAAS,wBAAyB,IAAK,CAAI,EAEvD,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAS,MAAM,EAAc,CAAG,EAEtC,MAAM,IAAI,EAAS,OAAO,EAAK,gBAAgB,EAAI,OAAO,GAAG,EAAS,KAAK,EAAS,CAAM,IAAM,GAAG,GAAI,EAAI,OAAQ,EAAM,CAAM,CACjI,CACA,OAAQ,MAAM,EAAI,KAAK,CACzB,CAEA,eAAe,EAAQ,EAAc,EAA2B,CAC9D,IAAM,EAAQ,EAAiB,EAC/B,GAAI,CAAC,EAAO,MAAM,IAAI,EACtB,IAAM,EAAS,MAAM,EAAW,EAAM,EAAM,CAAK,EAEjD,OADA,EAAkB,EACX,CACT,CAEA,SAAS,EAAU,EAAc,EAAiC,CAChE,IAAM,EAAQ,EAAO,SAAS,EAC9B,OAAO,EAAQ,GAAG,EAAK,GAAG,IAAU,CACtC,CAeA,eAAsB,EAAsB,EAAmB,EAA+C,CAC5G,IAAM,EAAgC,CAAE,MAAK,EACvC,EAAU,MAAM,EAAmB,EAAiB,EAAW,eAAe,EAAG,CAAI,EAG3F,OAFA,EAAgB,EAAW,CAAO,EAClC,EAAW,CAAkB,EACtB,CACT,CAiBA,eAAsB,EAAoB,EAAmB,EAAkC,CAAC,EAAiC,CAC/H,IAAM,EAAmC,CAAC,EACtC,EAAI,uBAAyB,KAAM,EAAK,qBAAuB,IACnE,IAAM,EAAQ,OAAO,EAAI,OAAU,SAAW,EAAI,MAAM,KAAK,CAAC,CAAC,MAAM,EAAA,GAA0B,EAAI,GAEnG,OADI,IAAO,EAAK,MAAQ,GACjB,EAA0B,EAAiB,EAAW,kBAAkB,EAAG,CAAI,CACxF,CA6BA,eAAsB,EAAqB,EAAmD,CAC5F,GAAM,CAAE,UAAW,EACb,EAAiC,CACrC,YAAa,EAAO,YACpB,OAAQ,EAAM,OACd,qBAAsB,EAAO,EAC/B,EACM,GAAU,EAAO,YAAc,CAAC,EAAA,CAAG,OAAQ,GAAS,OAAO,GAAS,UAAY,EAAK,OAAS,GAAK,IAAS,EAAO,WAAW,EAChI,EAAO,OAAS,IAAG,EAAI,WAAa,GACpC,EAAM,QAAO,EAAI,MAAQ,EAAM,OAC/B,EAAM,cAAa,EAAI,YAAc,EAAM,aAC/C,IAAM,EAAQ,EAAM,OAAO,KAAK,EAC5B,IAAO,EAAI,MAAQ,GACvB,IAAM,EAAU,MAAM,EAAmB,sBAAuB,CAAG,EAEnE,OADA,EAAqB,EACd,CACT,CAMA,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAA0B,yBAA0B,CAAM,CACnE,CAEA,IAAa,EAAoD,CAC/D,IAAK,EACL,MAAQ,GAAW,EAAiB,CAAM,CAC5C,EAQA,eAAsB,EAAkB,EAA2D,CACjG,IAAM,EAAQ,MAAM,EAAuB,yBAA0B,CAAM,EAG3E,OAFA,EAAW,CAAqB,EAChC,EAAiB,CAAuB,EACjC,CACT,CAkBA,SAAgB,EAAe,EAA4B,CACzD,IAAM,EAAS,IAAI,gBACb,EAAc,EAAE,aAAa,KAAK,GAAK,GACvC,EAAc,EAAE,aAAa,KAAK,GAAK,GACvC,GAAU,EAAE,YAAc,CAAC,EAAA,CAAG,IAAK,GAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAQ,GAAM,EAAE,OAAS,CAAC,EACnF,GAAI,EAAa,CACf,GAAI,GAAe,EAAO,OAAS,EAAG,MAAU,MAAM,iDAAiD,EACvG,EAAO,IAAI,cAAe,CAAW,CACvC,MAAO,GAAI,EAAa,CACtB,EAAO,IAAI,cAAe,CAAW,EACrC,IAAK,IAAM,KAAQ,EAAQ,EAAO,OAAO,aAAc,CAAI,CAC7D,MACE,MAAU,MAAM,4CAA4C,EAE9D,OAAO,EAAU,yBAA0B,CAAM,CACnD,CAGA,SAAgB,EAAgB,EAAoB,EAAgD,CAClG,OAAO,EAAyB,EAAe,CAAC,EAAG,CAAM,CAC3D,CAgBA,SAAgB,EAAe,EAAW,EAAgB,EAAoD,CAC5G,IAAM,EAAS,IAAI,gBAAgB,CAAE,GAAE,CAAC,EAIxC,OAHI,OAAO,GAAU,UAAY,OAAO,SAAS,CAAK,GACpD,EAAO,IAAI,QAAS,OAAO,KAAK,IAAI,EAAG,KAAK,IAAA,GAAsB,KAAK,MAAM,CAAK,CAAC,CAAC,CAAC,CAAC,EAEjF,EAA6B,EAAU,oBAAqB,CAAM,EAAG,CAAM,CACpF,CAeA,SAAgB,EAAsB,EAA6B,CACjE,MAAO,GAAG,IAA0B,GACtC,CAEA,SAAgB,EAAmB,EAAqB,EAAuD,CAC7G,OAAO,EAAgC,EAAU,oBAAqB,IAAI,gBAAgB,CAAE,aAAY,CAAC,CAAC,EAAG,CAAM,CACrH,CAEA,SAAgB,EAAwB,EAAuD,CAC7F,MAAO,CAAE,IAAK,EAAsB,CAAW,EAAG,MAAQ,GAAW,EAAmB,EAAa,CAAM,CAAE,CAC/G,CAQA,eAAsB,EAAmB,EAAqB,EAAkD,CAE9G,IAAM,EAAS,MAAM,EAA6B,oBAAqB,CAD/B,cAAa,SACkB,CAAI,EAE3E,OADA,EAAW,EAAsB,CAAW,CAAC,EACtC,CACT"}
+{"version":3,"file":"context-queries-eL3caKVG.js","names":[],"sources":["../../../../../../src/web-ui/routes/verse/context/context-queries.ts"],"sourcesContent":["/**\n * routes/verse/context/context-queries.ts — every V3.9 context-orchestration\n * call the Verse console makes (docs/VERSE-CONTEXT.md): context mode, handoff\n * preview + handoff creation, preferences, context fit, session search and\n * shared project memory.\n *\n * Same conventions as ../verse-queries.ts, deliberately:\n *\n *  - WRITES pull the held mutation token from auth-store, throw\n *    `VerseMutationLockedError` (the SAME class, so ChatSection's `fail`\n *    recognises it) when none is held, touch the hold on success, and\n *    invalidate exactly the cache keys they obviously change.\n *  - READS carry the per-tab read-client proof and report an expired read\n *    session, exactly like `apiGet`. They are written out here rather than\n *    routed through `apiGet` for one reason: `apiGet` discards the response\n *    body on a non-2xx, and the routes below answer a refused read (\"path is\n *    not a directory\", \"q must be at least 2 characters\") with a sentence\n *    written for a person. Those sentences travel as `ApiError.detail`, the\n *    field `describeControlError` already prefers.\n *\n * NOTHING HERE SPENDS. Every route below is deterministic server work\n * (preferences file, git ls-files, events.jsonl scans, a memory file). The\n * one model call a context feature can cause — \"ask this seat to summarize\"\n * — goes through the ordinary `sendVerseTurn`, i.e. through the engine's\n * `startTurn` chokepoint and the local-only policy, never through this file.\n *\n * `handoff-preview` is a POST although it only reads: it spawns\n * `git diff --stat` per root, and the API keeps every spawning route behind\n * the dispatch flag and the mutation token. It therefore needs the token like\n * any write, and the dialog says so.\n */\nimport type { VerseCreateSessionRequest, VerseSession } from '../../../data/api-types.js';\nimport type {\n  VerseContextFit,\n  VerseContextMode,\n  VerseContextModeRequest,\n  VerseHandoffPreview,\n  VerseHandoffPreviewRequest,\n  VersePreferences,\n  VersePreferencesUpdate,\n  VerseProjectMemory,\n  VerseProjectMemoryWrite,\n  VerseSearchResponse,\n} from '../../../../core/verse/types.js';\nimport { getMutationToken, reportSessionExpired, getReadClientProof, touchMutationHold } from '../../../data/auth-store.js';\nimport { invalidate, invalidatePrefix } from '../../../data/cache.js';\nimport { ApiError, apiPost } from '../../../data/client.js';\nimport type { QueryDef } from '../../../data/queries.js';\nimport { invalidateVerseLists, verseSessionPath, VERSE_SESSIONS_KEY, VerseMutationLockedError } from '../verse-queries.js';\nimport { setVerseSession } from '../verse-store.js';\nimport { asClause } from '../autonomy/format.js';\n\nexport const VERSE_PREFERENCES_KEY = 'verse-preferences';\n/** Prefix of every per-project memory key; `invalidatePrefix` reaches all of them. */\nexport const VERSE_MEMORY_KEY_PREFIX = 'verse-memory:';\n/** Prefix of every context-fit key (one per root set). */\nexport const VERSE_CONTEXT_FIT_KEY_PREFIX = 'verse-context-fit:';\n\n// ---------------------------------------------------------------------------\n// Transport\n// ---------------------------------------------------------------------------\n\n/** The server's own refusal sentence, when the body carried one. */\nasync function refusalDetail(res: Response): Promise<string | null> {\n  try {\n    const body = (await res.json()) as { error?: unknown; note?: unknown };\n    if (typeof body.error === 'string' && body.error) return body.error;\n    if (typeof body.note === 'string' && body.note) return body.note;\n  } catch {\n    /* not JSON — the status alone has to do */\n  }\n  return null;\n}\n\n/**\n * GET with the read-client proof. Behaves like `apiGet` (401 reports the\n * expired read session) but keeps the server's refusal sentence.\n */\nasync function getJson<T>(path: string, signal?: AbortSignal): Promise<T> {\n  const res = await fetch(path, {\n    method: 'GET',\n    credentials: 'same-origin',\n    headers: { 'x-ashlr-read-client': getReadClientProof() },\n    signal,\n  });\n  if (res.status === 401) {\n    reportSessionExpired();\n    throw new ApiError('Read session expired.', 401, path);\n  }\n  if (!res.ok) {\n    const detail = await refusalDetail(res);\n    // asClause: a detail ending in its own period would otherwise read \"…..\".\n    throw new ApiError(`GET ${path} failed (HTTP ${res.status})${detail ? `: ${asClause(detail)}` : ''}.`, res.status, path, detail);\n  }\n  return (await res.json()) as T;\n}\n\nasync function post<T>(path: string, body: unknown): Promise<T> {\n  const token = getMutationToken();\n  if (!token) throw new VerseMutationLockedError();\n  const result = await apiPost<T>(path, body, token);\n  touchMutationHold();\n  return result;\n}\n\nfunction withQuery(path: string, params: URLSearchParams): string {\n  const query = params.toString();\n  return query ? `${path}?${query}` : path;\n}\n\n// ---------------------------------------------------------------------------\n// Context mode\n// ---------------------------------------------------------------------------\n\n/**\n * Switch a session between `standard` and `expansive`. Applies from the next\n * turn (it only changes CLI flags, never prompt content, so the provider's\n * prompt cache survives the switch).\n *\n * The returned record is also written into verse-store, so the meter, the\n * mode chip and the composer hint all move on this response rather than on\n * the next list refresh — whichever component made the call.\n */\nexport async function setSessionContextMode(sessionId: string, mode: VerseContextMode): Promise<VerseSession> {\n  const body: VerseContextModeRequest = { mode };\n  const session = await post<VerseSession>(verseSessionPath(sessionId, '/context-mode'), body);\n  setVerseSession(sessionId, session);\n  invalidate(VERSE_SESSIONS_KEY);\n  return session;\n}\n\n// ---------------------------------------------------------------------------\n// Handoff\n// ---------------------------------------------------------------------------\n\n/** Longest focus line the API accepts (types.ts VerseHandoffPreviewRequest). */\nexport const HANDOFF_FOCUS_MAX_CHARS = 500;\n\n/**\n * Build the deterministic handoff note for a session. Zero spend: the server\n * reads events.jsonl and a bounded `git diff --stat` per root.\n *\n * Only keys that carry a value are sent — the route rejects unknown keys, and\n * `includeLastAssistant: false` is the default anyway, so omitting it keeps\n * the body minimal and the server's validation the single authority.\n */\nexport async function fetchHandoffPreview(sessionId: string, req: VerseHandoffPreviewRequest = {}): Promise<VerseHandoffPreview> {\n  const body: VerseHandoffPreviewRequest = {};\n  if (req.includeLastAssistant === true) body.includeLastAssistant = true;\n  const focus = typeof req.focus === 'string' ? req.focus.trim().slice(0, HANDOFF_FOCUS_MAX_CHARS) : '';\n  if (focus) body.focus = focus;\n  return post<VerseHandoffPreview>(verseSessionPath(sessionId, '/handoff-preview'), body);\n}\n\nexport interface HandoffSessionInput {\n  /** The session being handed off. Its PINNED roots are reused, see below. */\n  source: VerseSession;\n  seatId: string;\n  model?: string;\n  contextMode?: VerseContextMode;\n  /** Optional title; absent → the server titles it from the first message. */\n  title?: string;\n}\n\n/**\n * Create the session a handoff continues in. FREE: creating a session spawns\n * nothing. The handoff text is NOT sent here — the caller pre-fills the new\n * chat's composer and the operator presses send, so the first (spent) turn is\n * always one the operator read.\n *\n * Roots: the source's PINNED roots (`projectPath` + `extraRoots`), never its\n * `workspaceId`. A session keeps the roots it was created with even if the\n * named workspace was later edited or deleted (types.ts VerseSession\n * `extraRoots`); re-resolving the workspace here would let the continuation\n * silently gain or lose a folder the conversation was about — or fail\n * outright on a deleted workspace. The API also refuses the two spellings\n * mixed, so it is one or the other, and the pinned set is the honest one.\n *\n * The server resolves `handoffFrom.title` from `handoffFromSessionId` itself;\n * nothing about provenance is taken from this body.\n */\nexport async function createHandoffSession(input: HandoffSessionInput): Promise<VerseSession> {\n  const { source } = input;\n  const req: VerseCreateSessionRequest = {\n    projectPath: source.projectPath,\n    seatId: input.seatId,\n    handoffFromSessionId: source.id,\n  };\n  const extras = (source.extraRoots ?? []).filter((root) => typeof root === 'string' && root.length > 0 && root !== source.projectPath);\n  if (extras.length > 0) req.extraRoots = extras;\n  if (input.model) req.model = input.model;\n  if (input.contextMode) req.contextMode = input.contextMode;\n  const title = input.title?.trim();\n  if (title) req.title = title;\n  const session = await post<VerseSession>('/api/verse/sessions', req);\n  invalidateVerseLists();\n  return session;\n}\n\n// ---------------------------------------------------------------------------\n// Preferences\n// ---------------------------------------------------------------------------\n\nexport function fetchPreferences(signal?: AbortSignal): Promise<VersePreferences> {\n  return getJson<VersePreferences>('/api/verse/preferences', signal);\n}\n\nexport const versePreferencesQuery: QueryDef<VersePreferences> = {\n  key: VERSE_PREFERENCES_KEY,\n  fetch: (signal) => fetchPreferences(signal),\n};\n\n/**\n * Change ONE standing preference (the three request forms are exclusive, so a\n * body never changes more than the operator clicked). Memory records carry an\n * `enabled` flag derived from these preferences, so every cached memory read\n * is refreshed too.\n */\nexport async function updatePreferences(update: VersePreferencesUpdate): Promise<VersePreferences> {\n  const prefs = await post<VersePreferences>('/api/verse/preferences', update);\n  invalidate(VERSE_PREFERENCES_KEY);\n  invalidatePrefix(VERSE_MEMORY_KEY_PREFIX);\n  return prefs;\n}\n\n// ---------------------------------------------------------------------------\n// Context fit\n// ---------------------------------------------------------------------------\n\nexport interface ContextFitQuery {\n  workspaceId?: string;\n  projectPath?: string;\n  extraRoots?: string[];\n}\n\n/**\n * The query string for a fit request: a workspace id ALONE, or a project path\n * with each extra root as its own repeated `extraRoots` parameter (a path may\n * contain a comma, so a joined list could not be split back honestly). The\n * API refuses the two spellings mixed — refused here first, with the reason.\n */\nexport function contextFitPath(q: ContextFitQuery): string {\n  const params = new URLSearchParams();\n  const workspaceId = q.workspaceId?.trim() ?? '';\n  const projectPath = q.projectPath?.trim() ?? '';\n  const extras = (q.extraRoots ?? []).map((r) => r.trim()).filter((r) => r.length > 0);\n  if (workspaceId) {\n    if (projectPath || extras.length > 0) throw new Error('Estimate a workspace or a folder set, not both.');\n    params.set('workspaceId', workspaceId);\n  } else if (projectPath) {\n    params.set('projectPath', projectPath);\n    for (const root of extras) params.append('extraRoots', root);\n  } else {\n    throw new Error('Pick a project or a workspace to estimate.');\n  }\n  return withQuery('/api/verse/context-fit', params);\n}\n\n/** How big the reachable code is, in estimated tokens. Zero spend (git ls-files + stat). */\nexport function fetchContextFit(q: ContextFitQuery, signal?: AbortSignal): Promise<VerseContextFit> {\n  return getJson<VerseContextFit>(contextFitPath(q), signal);\n}\n\n/** Cache-backed form, keyed by the exact root set, for pickers that re-render often. */\nexport function verseContextFitQuery(q: ContextFitQuery): QueryDef<VerseContextFit> {\n  const path = contextFitPath(q);\n  return { key: `${VERSE_CONTEXT_FIT_KEY_PREFIX}${path}`, fetch: (signal) => getJson<VerseContextFit>(path, signal) };\n}\n\n// ---------------------------------------------------------------------------\n// Session search\n// ---------------------------------------------------------------------------\n\n/** The API caps `limit` at 50 (session-search.ts); asking for more is refused, so clamp. */\nexport const SEARCH_LIMIT_MAX = 50;\n\n/** Keyword search over past sessions' messages. Zero spend — a bounded scan of events.jsonl. */\nexport function searchSessions(q: string, limit?: number, signal?: AbortSignal): Promise<VerseSearchResponse> {\n  const params = new URLSearchParams({ q });\n  if (typeof limit === 'number' && Number.isFinite(limit)) {\n    params.set('limit', String(Math.max(1, Math.min(SEARCH_LIMIT_MAX, Math.floor(limit)))));\n  }\n  return getJson<VerseSearchResponse>(withQuery('/api/verse/search', params), signal);\n}\n\n// ---------------------------------------------------------------------------\n// Shared project memory\n// ---------------------------------------------------------------------------\n\n/**\n * The memory record as the browser receives it. The server's public-JSON\n * sanitizer rewrites the home folder as `~` and secret-shaped text as\n * `[REDACTED]` on the way out, so `content` can differ from the file on disk;\n * the route then adds `contentSanitized: true` (absent otherwise). Declared\n * here, not in types.ts: that contract is frozen and the flag is additive.\n */\nexport type VerseProjectMemoryView = VerseProjectMemory & { contentSanitized?: boolean };\n\nexport function verseProjectMemoryKey(projectPath: string): string {\n  return `${VERSE_MEMORY_KEY_PREFIX}${projectPath}`;\n}\n\nexport function fetchProjectMemory(projectPath: string, signal?: AbortSignal): Promise<VerseProjectMemoryView> {\n  return getJson<VerseProjectMemoryView>(withQuery('/api/verse/memory', new URLSearchParams({ projectPath })), signal);\n}\n\nexport function verseProjectMemoryQuery(projectPath: string): QueryDef<VerseProjectMemoryView> {\n  return { key: verseProjectMemoryKey(projectPath), fetch: (signal) => fetchProjectMemory(projectPath, signal) };\n}\n\n/**\n * Replace MEMORY.md for a project (atomic, 0600 on the server, capped at\n * VERSE_MEMORY_MAX_BYTES). `''` clears it. Chats already open keep the block\n * pinned in their instructions at creation; they see the change when they\n * next read the file.\n */\nexport async function writeProjectMemory(projectPath: string, content: string): Promise<VerseProjectMemoryView> {\n  const body: VerseProjectMemoryWrite = { projectPath, content };\n  const memory = await post<VerseProjectMemoryView>('/api/verse/memory', body);\n  invalidate(verseProjectMemoryKey(projectPath));\n  return memory;\n}\n"],"mappings":"mPAoDA,IAAa,EAAwB,oBAExB,EAA0B,gBASvC,eAAe,EAAc,EAAuC,CAClE,GAAI,CACF,IAAM,EAAQ,MAAM,EAAI,KAAK,EAC7B,GAAI,OAAO,EAAK,OAAU,UAAY,EAAK,MAAO,OAAO,EAAK,MAC9D,GAAI,OAAO,EAAK,MAAS,UAAY,EAAK,KAAM,OAAO,EAAK,IAC9D,MAAQ,CAER,CACA,OAAO,IACT,CAMA,eAAe,EAAW,EAAc,EAAkC,CACxE,IAAM,EAAM,MAAM,MAAM,EAAM,CAC5B,OAAQ,MACR,YAAa,cACb,QAAS,CAAE,sBAAuB,EAAmB,CAAE,EACvD,QACF,CAAC,EACD,GAAI,EAAI,SAAW,IAEjB,MADA,EAAqB,EACf,IAAI,EAAS,wBAAyB,IAAK,CAAI,EAEvD,GAAI,CAAC,EAAI,GAAI,CACX,IAAM,EAAS,MAAM,EAAc,CAAG,EAEtC,MAAM,IAAI,EAAS,OAAO,EAAK,gBAAgB,EAAI,OAAO,GAAG,EAAS,KAAK,EAAS,CAAM,IAAM,GAAG,GAAI,EAAI,OAAQ,EAAM,CAAM,CACjI,CACA,OAAQ,MAAM,EAAI,KAAK,CACzB,CAEA,eAAe,EAAQ,EAAc,EAA2B,CAC9D,IAAM,EAAQ,EAAiB,EAC/B,GAAI,CAAC,EAAO,MAAM,IAAI,EACtB,IAAM,EAAS,MAAM,EAAW,EAAM,EAAM,CAAK,EAEjD,OADA,EAAkB,EACX,CACT,CAEA,SAAS,EAAU,EAAc,EAAiC,CAChE,IAAM,EAAQ,EAAO,SAAS,EAC9B,OAAO,EAAQ,GAAG,EAAK,GAAG,IAAU,CACtC,CAeA,eAAsB,EAAsB,EAAmB,EAA+C,CAC5G,IAAM,EAAgC,CAAE,MAAK,EACvC,EAAU,MAAM,EAAmB,EAAiB,EAAW,eAAe,EAAG,CAAI,EAG3F,OAFA,EAAgB,EAAW,CAAO,EAClC,EAAW,CAAkB,EACtB,CACT,CAiBA,eAAsB,EAAoB,EAAmB,EAAkC,CAAC,EAAiC,CAC/H,IAAM,EAAmC,CAAC,EACtC,EAAI,uBAAyB,KAAM,EAAK,qBAAuB,IACnE,IAAM,EAAQ,OAAO,EAAI,OAAU,SAAW,EAAI,MAAM,KAAK,CAAC,CAAC,MAAM,EAAA,GAA0B,EAAI,GAEnG,OADI,IAAO,EAAK,MAAQ,GACjB,EAA0B,EAAiB,EAAW,kBAAkB,EAAG,CAAI,CACxF,CA6BA,eAAsB,EAAqB,EAAmD,CAC5F,GAAM,CAAE,UAAW,EACb,EAAiC,CACrC,YAAa,EAAO,YACpB,OAAQ,EAAM,OACd,qBAAsB,EAAO,EAC/B,EACM,GAAU,EAAO,YAAc,CAAC,EAAA,CAAG,OAAQ,GAAS,OAAO,GAAS,UAAY,EAAK,OAAS,GAAK,IAAS,EAAO,WAAW,EAChI,EAAO,OAAS,IAAG,EAAI,WAAa,GACpC,EAAM,QAAO,EAAI,MAAQ,EAAM,OAC/B,EAAM,cAAa,EAAI,YAAc,EAAM,aAC/C,IAAM,EAAQ,EAAM,OAAO,KAAK,EAC5B,IAAO,EAAI,MAAQ,GACvB,IAAM,EAAU,MAAM,EAAmB,sBAAuB,CAAG,EAEnE,OADA,EAAqB,EACd,CACT,CAMA,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAA0B,yBAA0B,CAAM,CACnE,CAEA,IAAa,EAAoD,CAC/D,IAAK,EACL,MAAQ,GAAW,EAAiB,CAAM,CAC5C,EAQA,eAAsB,EAAkB,EAA2D,CACjG,IAAM,EAAQ,MAAM,EAAuB,yBAA0B,CAAM,EAG3E,OAFA,EAAW,CAAqB,EAChC,EAAiB,CAAuB,EACjC,CACT,CAkBA,SAAgB,EAAe,EAA4B,CACzD,IAAM,EAAS,IAAI,gBACb,EAAc,EAAE,aAAa,KAAK,GAAK,GACvC,EAAc,EAAE,aAAa,KAAK,GAAK,GACvC,GAAU,EAAE,YAAc,CAAC,EAAA,CAAG,IAAK,GAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAQ,GAAM,EAAE,OAAS,CAAC,EACnF,GAAI,EAAa,CACf,GAAI,GAAe,EAAO,OAAS,EAAG,MAAU,MAAM,iDAAiD,EACvG,EAAO,IAAI,cAAe,CAAW,CACvC,MAAO,GAAI,EAAa,CACtB,EAAO,IAAI,cAAe,CAAW,EACrC,IAAK,IAAM,KAAQ,EAAQ,EAAO,OAAO,aAAc,CAAI,CAC7D,MACE,MAAU,MAAM,4CAA4C,EAE9D,OAAO,EAAU,yBAA0B,CAAM,CACnD,CAGA,SAAgB,EAAgB,EAAoB,EAAgD,CAClG,OAAO,EAAyB,EAAe,CAAC,EAAG,CAAM,CAC3D,CAgBA,SAAgB,EAAe,EAAW,EAAgB,EAAoD,CAC5G,IAAM,EAAS,IAAI,gBAAgB,CAAE,GAAE,CAAC,EAIxC,OAHI,OAAO,GAAU,UAAY,OAAO,SAAS,CAAK,GACpD,EAAO,IAAI,QAAS,OAAO,KAAK,IAAI,EAAG,KAAK,IAAA,GAAsB,KAAK,MAAM,CAAK,CAAC,CAAC,CAAC,CAAC,EAEjF,EAA6B,EAAU,oBAAqB,CAAM,EAAG,CAAM,CACpF,CAeA,SAAgB,EAAsB,EAA6B,CACjE,MAAO,GAAG,IAA0B,GACtC,CAEA,SAAgB,EAAmB,EAAqB,EAAuD,CAC7G,OAAO,EAAgC,EAAU,oBAAqB,IAAI,gBAAgB,CAAE,aAAY,CAAC,CAAC,EAAG,CAAM,CACrH,CAEA,SAAgB,EAAwB,EAAuD,CAC7F,MAAO,CAAE,IAAK,EAAsB,CAAW,EAAG,MAAQ,GAAW,EAAmB,EAAa,CAAM,CAAE,CAC/G,CAQA,eAAsB,EAAmB,EAAqB,EAAkD,CAE9G,IAAM,EAAS,MAAM,EAA6B,oBAAqB,CAD/B,cAAa,SACkB,CAAI,EAE3E,OADA,EAAW,EAAsB,CAAW,CAAC,EACtC,CACT"}

package/dist/core/web/public/next/assets/{control-queries-CXtmZZH6.js → control-queries-B9K-wmcB.js}

@@ -1,2 +1,2 @@
-import{D as e,F as t,U as n,c as r,l as i}from"./global-y_exIyAP.js";import{i as a,n as o}from"./mutations-CWlxEMEm.js";var s={dailyBudgetUsd:{min:0,max:1e3},perTickItems:{min:1,max:50},parallel:{min:1,max:16},intervalMs:{min:3e4,max:864e5},maxConcurrent:{min:1,max:32},concurrency:{min:1,max:32},subscriptionMaxPercent:{min:1,max:100},foundryLimitMax:{min:0,max:1e6}},c=`verse-control`,l=`verse-caps`,u=`verse-scope`,d=`verse-safety`,f=`verse-audit:`,p=500,m={key:c,fetch:e=>r(`/api/verse/control`,e)},h={key:l,fetch:e=>r(`/api/verse/caps`,e)},g={key:d,fetch:e=>r(`/api/verse/safety`,e)};function _(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}var v={key:u,fetch:e=>r(`/api/verse/scope`,e)};function y(e={}){let t=Math.min(e.limit??200,p),n=new URLSearchParams;return n.set(`limit`,String(t)),e.action&&n.set(`action`,e.action),e.result&&n.set(`result`,e.result),{key:`${f}${t}:${e.action??``}:${e.result??``}`,fetch:e=>r(`/api/verse/audit?${n.toString()}`,e)}}var b={key:`goals`,fetch:e=>r(`/api/goals`,e)};function x(e){return e==null?{items:[],absent:!0}:Array.isArray(e)?{items:e,absent:!1}:_(e)&&Array.isArray(e.items)?{items:e.items,absent:!1}:{items:[],absent:!0}}var S={key:`backlog`,fetch:e=>r(`/api/backlog`,e).then(x)},C=class extends Error{constructor(){super(`Unlock actions with the mutation token before changing the loop.`),this.name=`VerseControlLockedError`}};async function w(n,r){let a=e();if(!a)throw new C;let o=await i(n,r,a);return t(),o}function T(){n(c)}async function E(e){let t=await w(`/api/verse/caps`,e);return n(l),T(),t}async function D(e){await w(`/api/verse/scope`,e),n(u),T()}async function O(e){let t=await w(`/api/verse/daemon`,{action:e});return T(),n(`daemon`),t}async function k(){await o(),T()}async function A(){await a(),T()}export{O as a,y as c,m as d,b as f,s as h,A as i,S as l,v as m,C as n,E as o,g as p,k as r,D as s,c as t,h as u};
-//# sourceMappingURL=control-queries-CXtmZZH6.js.map
+import{I as e,O as t,W as n,l as r,u as i}from"./global-CMNW_dqn.js";import{i as a,n as o}from"./mutations-DQPbFdRJ.js";var s={dailyBudgetUsd:{min:0,max:1e3},perTickItems:{min:1,max:50},parallel:{min:1,max:16},intervalMs:{min:3e4,max:864e5},maxConcurrent:{min:1,max:32},concurrency:{min:1,max:32},subscriptionMaxPercent:{min:1,max:100},foundryLimitMax:{min:0,max:1e6}},c=`verse-control`,l=`verse-caps`,u=`verse-scope`,d=`verse-safety`,f=`verse-audit:`,p=500,m={key:c,fetch:e=>r(`/api/verse/control`,e)},h={key:l,fetch:e=>r(`/api/verse/caps`,e)},g={key:d,fetch:e=>r(`/api/verse/safety`,e)};function _(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}var v={key:u,fetch:e=>r(`/api/verse/scope`,e)};function y(e={}){let t=Math.min(e.limit??200,p),n=new URLSearchParams;return n.set(`limit`,String(t)),e.action&&n.set(`action`,e.action),e.result&&n.set(`result`,e.result),{key:`${f}${t}:${e.action??``}:${e.result??``}`,fetch:e=>r(`/api/verse/audit?${n.toString()}`,e)}}var b={key:`goals`,fetch:e=>r(`/api/goals`,e)};function x(e){return e==null?{items:[],absent:!0}:Array.isArray(e)?{items:e,absent:!1}:_(e)&&Array.isArray(e.items)?{items:e.items,absent:!1}:{items:[],absent:!0}}var S={key:`backlog`,fetch:e=>r(`/api/backlog`,e).then(x)},C=class extends Error{constructor(){super(`Unlock actions with the mutation token before changing the loop.`),this.name=`VerseControlLockedError`}};async function w(n,r){let a=t();if(!a)throw new C;let o=await i(n,r,a);return e(),o}function T(){n(c)}async function E(e){let t=await w(`/api/verse/caps`,e);return n(l),T(),t}async function D(e){await w(`/api/verse/scope`,e),n(u),T()}async function O(e){let t=await w(`/api/verse/daemon`,{action:e});return T(),n(`daemon`),t}async function k(){await o(),T()}async function A(){await a(),T()}export{O as a,y as c,m as d,b as f,s as h,A as i,S as l,v as m,C as n,E as o,g as p,k as r,D as s,c as t,h as u};
+//# sourceMappingURL=control-queries-B9K-wmcB.js.map