@fml-inc/fml 0.7.0 → 0.8.0-rc.2

package/dist/chunk-YSU5CS2V.js

@@ -0,0 +1,3331 @@
+import {
+  FML_INSTALLATION_ID_FILE,
+  FML_OBSERVER_DIR,
+  getActiveEnv,
+  getSelectedOrg,
+  getSiteUrlForConvexUrl,
+  getSyncDestinationIdentity,
+  getValidToken
+} from "./chunk-A6HAEVJX.js";
+
+// ../../packages/panopticon/src/artifact.ts
+import {
+  createHash,
+  verify as verifySignature
+} from "crypto";
+function sha256Hex(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+// ../../packages/panopticon/src/download.ts
+import path from "path";
+import { fileURLToPath } from "url";
+
+// ../../packages/panopticon/src/install.ts
+import { spawn } from "child_process";
+import path2 from "path";
+
+// ../../packages/panopticon/src/install-id.ts
+import { randomUUID } from "crypto";
+import fs from "fs";
+import os from "os";
+import path3 from "path";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function readInstallationId(filePath) {
+  try {
+    const value = fs.readFileSync(filePath, "utf8").trim();
+    return UUID_RE.test(value) ? value.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+}
+function loadOrCreateInstallationId(filePath) {
+  const existing = readInstallationId(filePath);
+  if (existing) return existing;
+  const minted = randomUUID();
+  fs.mkdirSync(path3.dirname(filePath), { recursive: true, mode: 448 });
+  try {
+    fs.writeFileSync(filePath, `${minted}
+`, { flag: "wx", mode: 384 });
+    return minted;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  const winner = readInstallationId(filePath);
+  if (winner) return winner;
+  const temporaryFile = `${filePath}.tmp-${process.pid}-${randomUUID()}`;
+  try {
+    fs.writeFileSync(temporaryFile, `${minted}
+`, { mode: 384 });
+    fs.renameSync(temporaryFile, filePath);
+  } finally {
+    fs.rmSync(temporaryFile, { force: true });
+  }
+  return minted;
+}
+function collectObserverIdentity(installIdFile) {
+  let fmlInstallId;
+  try {
+    fmlInstallId = loadOrCreateInstallationId(installIdFile);
+  } catch {
+    return null;
+  }
+  let hostname;
+  try {
+    const value = os.hostname().trim();
+    if (value) hostname = value;
+  } catch {
+    hostname = void 0;
+  }
+  return { fmlInstallId, hostname, platform: process.platform };
+}
+
+// ../../packages/panopticon/src/paths.ts
+import os2 from "os";
+import path4 from "path";
+function getManagedClientPaths(env = process.env, homeDir = os2.homedir()) {
+  const fmlHome = env.FML_HOME ?? path4.join(homeDir, ".fml");
+  const root = env.PANOPTICON_HOME ?? path4.join(fmlHome, "panopticon");
+  return {
+    root,
+    current: path4.join(root, "current"),
+    previous: path4.join(root, "previous"),
+    versions: path4.join(root, "versions"),
+    downloads: path4.join(root, "downloads"),
+    staging: path4.join(root, "staging"),
+    stateFile: path4.join(root, "state.json"),
+    syncSettingsFile: path4.join(root, "sync.json"),
+    releaseManifest: path4.join(root, "release.json"),
+    artifactQueue: path4.join(root, "artifacts.queue.json"),
+    artifactCache: path4.join(root, "artifact-cache")
+  };
+}
+
+// ../../packages/panopticon/src/sync-settings.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import fs2 from "fs";
+import path5 from "path";
+var SYNC_SETTINGS_SCHEMA_VERSION = 1;
+var DEFAULT_SYNC_ENABLED = true;
+function defaultSyncSettings() {
+  return {
+    schemaVersion: SYNC_SETTINGS_SCHEMA_VERSION,
+    enabled: DEFAULT_SYNC_ENABLED
+  };
+}
+function disabledSyncSettings() {
+  return {
+    schemaVersion: SYNC_SETTINGS_SCHEMA_VERSION,
+    enabled: false
+  };
+}
+function serializeSyncSettings(settings) {
+  return `${JSON.stringify(settings, null, 2)}
+`;
+}
+function readSyncSettings(settingsFile) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(settingsFile, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return disabledSyncSettings();
+    }
+    const settings = parsed;
+    if (settings.schemaVersion !== SYNC_SETTINGS_SCHEMA_VERSION || typeof settings.enabled !== "boolean") {
+      return disabledSyncSettings();
+    }
+    return {
+      schemaVersion: SYNC_SETTINGS_SCHEMA_VERSION,
+      enabled: settings.enabled
+    };
+  } catch {
+    return disabledSyncSettings();
+  }
+}
+function initializeSyncSettings(settingsFile) {
+  const settings = defaultSyncSettings();
+  let descriptor;
+  fs2.mkdirSync(path5.dirname(settingsFile), { recursive: true });
+  try {
+    descriptor = fs2.openSync(settingsFile, "wx", 384);
+    fs2.writeFileSync(descriptor, serializeSyncSettings(settings));
+    fs2.fsyncSync(descriptor);
+    return settings;
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      return readSyncSettings(settingsFile);
+    }
+    throw error;
+  } finally {
+    if (descriptor !== void 0) fs2.closeSync(descriptor);
+  }
+}
+function setSyncEnabled(settingsFile, enabled) {
+  const settings = {
+    schemaVersion: SYNC_SETTINGS_SCHEMA_VERSION,
+    enabled
+  };
+  const temporaryFile = `${settingsFile}.tmp-${process.pid}-${randomUUID2()}`;
+  fs2.mkdirSync(path5.dirname(settingsFile), { recursive: true });
+  try {
+    fs2.writeFileSync(temporaryFile, serializeSyncSettings(settings), {
+      mode: 384
+    });
+    try {
+      fs2.renameSync(temporaryFile, settingsFile);
+    } catch (error) {
+      if (process.platform !== "win32") throw error;
+      fs2.copyFileSync(temporaryFile, settingsFile);
+    }
+  } finally {
+    fs2.rmSync(temporaryFile, { force: true });
+  }
+  return settings;
+}
+
+// ../../packages/panopticon/src/artifacts.ts
+import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
+import fs7 from "fs";
+import os3 from "os";
+import path17 from "path";
+
+// ../../packages/agent-targets/src/artifacts/targets/claude.ts
+import path8 from "path";
+
+// ../../packages/agent-targets/src/config-paths.ts
+import path6 from "path";
+function claudeConfigDirectory(context) {
+  const configuredDir = context.claudeConfigDir ?? context.env?.CLAUDE_CONFIG_DIR;
+  return typeof configuredDir === "string" && configuredDir.trim().length > 0 ? path6.resolve(configuredDir) : path6.join(context.homeDir, ".claude");
+}
+function geminiConfigDirectory(context) {
+  const configuredHome = context.env.GEMINI_CLI_HOME;
+  const homeRoot = typeof configuredHome === "string" && configuredHome.trim().length > 0 ? path6.resolve(configuredHome) : context.homeDir;
+  return path6.join(homeRoot, ".gemini");
+}
+
+// ../../packages/agent-targets/src/artifacts/filesystem.ts
+import fs3 from "fs";
+import path7 from "path";
+var DEFAULT_SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".cache",
+  ".next",
+  ".nuxt",
+  ".turbo",
+  ".vite",
+  "tmp",
+  "temp",
+  "backups",
+  "designqc-captures"
+]);
+function normalizeFilePath(filePath) {
+  return path7.resolve(filePath);
+}
+function safeReaddir(dir) {
+  try {
+    return fs3.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function walkFiles(input) {
+  const root = normalizeFilePath(input.root);
+  const files = [];
+  const seen = /* @__PURE__ */ new Set();
+  const skipDirs = input.skipDirs ?? DEFAULT_SKIP_DIRS;
+  function walk(dir, depth) {
+    if (depth > input.maxDepth) return;
+    for (const entry of safeReaddir(dir)) {
+      const entryPath = path7.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!skipDirs.has(entry.name)) walk(entryPath, depth + 1);
+        continue;
+      }
+      if (!entry.isFile() || !input.includeFile(entryPath)) continue;
+      const normalized = normalizeFilePath(entryPath);
+      if (seen.has(normalized)) continue;
+      seen.add(normalized);
+      files.push(normalized);
+    }
+  }
+  walk(root, 0);
+  return files;
+}
+function transcriptCandidate(input) {
+  const sourcePath = normalizeFilePath(input.sourcePath);
+  const readPath = input.readPath ? normalizeFilePath(input.readPath) : void 0;
+  return {
+    artifactType: "agent_transcript",
+    source: input.targetId,
+    sourcePath,
+    ...input.identityKey ? { identityKey: input.identityKey } : {},
+    ...readPath && readPath !== sourcePath ? { readPath } : {},
+    sessionId: input.sessionId,
+    metadata: {
+      originalPath: sourcePath,
+      scope: "global",
+      target: input.targetId,
+      ...input.metadata ?? {}
+    },
+    repositoryObservations: input.repositoryObservations
+  };
+}
+
+// ../../packages/agent-targets/src/artifacts/harness-install-id.ts
+import fs4 from "fs";
+var MAX_HARNESS_INSTALL_ID_LENGTH = 128;
+function normalizeHarnessInstallId(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.length > MAX_HARNESS_INSTALL_ID_LENGTH) return null;
+  if (!/^[\x21-\x7e]+$/.test(trimmed)) return null;
+  return trimmed;
+}
+function readHarnessInstallIdFile(filePath) {
+  try {
+    return normalizeHarnessInstallId(fs4.readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var claudeMachineIdCache = /* @__PURE__ */ new Map();
+function readClaudeMachineId(configFile) {
+  let stat;
+  try {
+    stat = fs4.statSync(configFile);
+  } catch {
+    claudeMachineIdCache.delete(configFile);
+    return null;
+  }
+  const cached = claudeMachineIdCache.get(configFile);
+  if (cached && cached.mtimeMs === stat.mtimeMs && cached.sizeBytes === stat.size) {
+    return cached.machineId;
+  }
+  let machineId = null;
+  try {
+    const parsed = JSON.parse(fs4.readFileSync(configFile, "utf8"));
+    if (parsed && typeof parsed === "object") {
+      machineId = normalizeHarnessInstallId(
+        parsed.machineID
+      );
+    }
+  } catch {
+    machineId = null;
+  }
+  claudeMachineIdCache.set(configFile, {
+    mtimeMs: stat.mtimeMs,
+    sizeBytes: stat.size,
+    machineId
+  });
+  return machineId;
+}
+
+// ../../packages/agent-targets/src/artifacts/repository-context.ts
+import { createHash as createHash2 } from "crypto";
+import fs5 from "fs";
+
+// ../../packages/shared/src/github-repository.ts
+var MAX_REPOSITORY_BYTES = 201;
+var UTF8_ENCODER = new TextEncoder();
+function utf8Bytes(value) {
+  return UTF8_ENCODER.encode(value).byteLength;
+}
+function githubRepositoryPath(pathname) {
+  const parts = pathname.replace(/^\/+|\/+$/g, "").split("/");
+  if (parts.length !== 2) return null;
+  const owner = parts[0];
+  const repository = parts[1]?.replace(/\.git$/i, "");
+  if (!owner || !repository) return null;
+  const segmentPattern = /^[A-Za-z0-9_.-]+$/;
+  if (!segmentPattern.test(owner) || !segmentPattern.test(repository)) {
+    return null;
+  }
+  const canonical = `${owner.toLowerCase()}/${repository.toLowerCase()}`;
+  if (canonical.startsWith("./") || canonical.startsWith("../") || repository === "." || repository === ".." || repository.toLowerCase().endsWith(".git")) {
+    return null;
+  }
+  return utf8Bytes(canonical) <= MAX_REPOSITORY_BYTES ? canonical : null;
+}
+function canonicalGitHubRepository(remote) {
+  const trimmed = remote.trim();
+  if (!trimmed || trimmed.includes("\0")) return null;
+  const scp = trimmed.match(/^git@github\.com:([^?#]+)$/i);
+  if (scp?.[1]) return githubRepositoryPath(scp[1]);
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (url.hostname.toLowerCase() !== "github.com") return null;
+  if (url.search || url.hash || url.password || url.port) return null;
+  if (url.protocol === "https:" || url.protocol === "http:") {
+    if (url.username) return null;
+  } else if (url.protocol === "ssh:") {
+    if (url.username && url.username !== "git") return null;
+  } else {
+    return null;
+  }
+  return githubRepositoryPath(url.pathname);
+}
+
+// ../../packages/agent-targets/src/artifacts/repository-context.ts
+var MAX_ARTIFACT_CONTEXT_PREFIX_BYTES = 256 * 1024;
+var MAX_ARTIFACT_CONTEXT_RECORDS = 64;
+var MAX_CWD_BYTES = 4096;
+var MAX_BRANCH_BYTES = 1024;
+function utf8Bytes2(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function boundedOptionalString(value, maxBytes) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  if (!trimmed || new RegExp("\\p{Cc}", "u").test(trimmed) || utf8Bytes2(trimmed) > maxBytes) {
+    return void 0;
+  }
+  return trimmed;
+}
+function recordValue(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function readJsonlContextRecords(sourcePath) {
+  let file;
+  try {
+    file = fs5.openSync(sourcePath, "r");
+  } catch {
+    return [];
+  }
+  try {
+    const stat = fs5.fstatSync(file);
+    const byteLimit = Math.min(stat.size, MAX_ARTIFACT_CONTEXT_PREFIX_BYTES);
+    if (byteLimit <= 0) return [];
+    const buffer = Buffer.allocUnsafe(byteLimit);
+    const bytesRead = fs5.readSync(file, buffer, 0, byteLimit, 0);
+    let content = buffer.subarray(0, bytesRead).toString("utf8");
+    if (bytesRead < stat.size) {
+      const lastNewline = content.lastIndexOf("\n");
+      if (lastNewline < 0) return [];
+      content = content.slice(0, lastNewline + 1);
+    }
+    const records = [];
+    for (const line of content.split(/\r?\n/)) {
+      if (records.length >= MAX_ARTIFACT_CONTEXT_RECORDS) break;
+      const jsonLine = line.startsWith("\uFEFF") ? line.slice(1) : line;
+      if (!jsonLine.trim()) continue;
+      try {
+        const record = recordValue(JSON.parse(jsonLine));
+        if (record) records.push(record);
+      } catch {
+      }
+    }
+    return records;
+  } catch {
+    return [];
+  } finally {
+    fs5.closeSync(file);
+  }
+}
+function contextTimestampMs(value, fallback) {
+  if (typeof value === "number" && Number.isFinite(value) && value >= 0) {
+    const timestamp = value < 1e10 ? Math.round(value * 1e3) : Math.round(value);
+    return Number.isSafeInteger(timestamp) ? timestamp : fallback;
+  }
+  if (typeof value === "string") {
+    const numeric = Number(value);
+    if (Number.isFinite(numeric)) return contextTimestampMs(numeric, fallback);
+    const parsed = Date.parse(value);
+    if (Number.isSafeInteger(parsed) && parsed >= 0) return parsed;
+  }
+  return fallback;
+}
+function repositoryObservation(input) {
+  const cwd = boundedOptionalString(input.cwd, MAX_CWD_BYTES);
+  const branch = boundedOptionalString(input.branch, MAX_BRANCH_BYTES);
+  const rawCommitHash = boundedOptionalString(input.commitHash, 64);
+  const commitHash = rawCommitHash && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(rawCommitHash) ? rawCommitHash.toLowerCase() : void 0;
+  const identity = JSON.stringify([
+    input.source,
+    input.repository,
+    cwd ?? null,
+    branch ?? null,
+    commitHash ?? null
+  ]);
+  const id = `repo_observation:${createHash2("sha256").update(identity).digest("hex")}`;
+  return {
+    id,
+    repository: input.repository,
+    source: input.source,
+    observedAtMs: input.observedAtMs,
+    ...cwd ? { cwd } : {},
+    ...branch ? { branch } : {},
+    ...commitHash ? { commitHash } : {}
+  };
+}
+
+// ../../packages/agent-targets/src/artifacts/targets/claude.ts
+function claudeTranscriptCandidate(sourcePath, context, harnessInstallId) {
+  const fallbackObservedAtMs = (context.nowMs ?? Date.now)();
+  const observations = /* @__PURE__ */ new Map();
+  for (const record of readJsonlContextRecords(sourcePath)) {
+    if (typeof record.cwd !== "string" || !record.cwd.trim()) continue;
+    const origin = context.resolveGitHubOrigin?.(record.cwd);
+    if (!origin) continue;
+    const observation = repositoryObservation({
+      repository: origin.repository,
+      source: "git_origin",
+      observedAtMs: fallbackObservedAtMs,
+      cwd: record.cwd,
+      branch: origin.branch,
+      commitHash: origin.commitHash
+    });
+    observations.set(observation.id, observation);
+  }
+  return transcriptCandidate({
+    targetId: "claude",
+    sourcePath,
+    metadata: harnessInstallId ? { harnessInstallId } : void 0,
+    repositoryObservations: [...observations.values()]
+  });
+}
+var claudeArtifactDiscovery = Object.freeze({
+  targetId: "claude",
+  discover: (context) => {
+    const { homeDir, env } = context;
+    const configDir = claudeConfigDirectory({ homeDir, env });
+    const harnessInstallId = readClaudeMachineId(path8.join(configDir, ".claude.json")) ?? readClaudeMachineId(path8.join(homeDir, ".claude.json"));
+    return walkFiles({
+      root: path8.join(configDir, "projects"),
+      maxDepth: 6,
+      includeFile: (filePath) => filePath.endsWith(".jsonl")
+    }).map(
+      (sourcePath) => claudeTranscriptCandidate(sourcePath, context, harnessInstallId)
+    );
+  }
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/codex.ts
+import path9 from "path";
+var CODEX_ROLLOUT_ID = /-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl(?:\.zst)?$/i;
+function codexRolloutId(sourcePath) {
+  return CODEX_ROLLOUT_ID.exec(path9.basename(sourcePath))?.[1]?.toLowerCase() ?? null;
+}
+function codexTranscriptCandidate(sourcePath, readPath, store, context, harnessInstallId) {
+  const rolloutId = codexRolloutId(sourcePath);
+  const identityKey = rolloutId ? `codex_rollout:${rolloutId}` : null;
+  const identityMetadata = harnessInstallId ? { harnessInstallId } : {};
+  const fallbackObservedAtMs = (context.nowMs ?? Date.now)();
+  for (const record of readJsonlContextRecords(readPath)) {
+    if (record.type !== "session_meta") continue;
+    const payload = recordValue(record.payload);
+    if (!payload) continue;
+    const sessionId = typeof payload.id === "string" && payload.id.trim() ? payload.id.trim() : null;
+    const cwd = typeof payload.cwd === "string" ? payload.cwd : void 0;
+    const git = recordValue(payload.git);
+    const nativeRepository = typeof git?.repository_url === "string" ? canonicalGitHubRepository(git.repository_url) : null;
+    const origin = cwd ? context.resolveGitHubOrigin?.(cwd) : null;
+    const observations = [];
+    if (nativeRepository) {
+      observations.push(
+        repositoryObservation({
+          repository: nativeRepository,
+          source: "codex_session_meta",
+          observedAtMs: contextTimestampMs(
+            payload.timestamp ?? record.timestamp,
+            fallbackObservedAtMs
+          ),
+          cwd,
+          branch: git?.branch,
+          commitHash: git?.commit_hash
+        })
+      );
+    }
+    if (origin) {
+      observations.push(
+        repositoryObservation({
+          repository: origin.repository,
+          source: "git_origin",
+          observedAtMs: fallbackObservedAtMs,
+          cwd,
+          branch: origin.branch,
+          commitHash: origin.commitHash
+        })
+      );
+    }
+    return transcriptCandidate({
+      targetId: "codex",
+      sourcePath,
+      identityKey,
+      readPath,
+      sessionId,
+      metadata: { store, ...identityMetadata },
+      repositoryObservations: observations
+    });
+  }
+  return transcriptCandidate({
+    targetId: "codex",
+    sourcePath,
+    identityKey,
+    readPath,
+    // A rollout whose session_meta is absent from the bounded prefix still
+    // reads its bytes from the decoded copy; only the evidence is missing.
+    ...rolloutId ? { sessionId: rolloutId } : {},
+    metadata: { store, ...identityMetadata }
+  });
+}
+var codexArtifactDiscovery = Object.freeze({
+  targetId: "codex",
+  discover: (context) => {
+    const { homeDir, env } = context;
+    const configuredHome = env.CODEX_HOME?.trim();
+    const codexHome = configuredHome ? path9.resolve(configuredHome) : path9.join(homeDir, ".codex");
+    const harnessInstallId = readHarnessInstallIdFile(
+      path9.join(codexHome, "installation_id")
+    );
+    const roots = [
+      { store: "sessions", root: path9.join(codexHome, "sessions") },
+      {
+        store: "archived_sessions",
+        root: path9.join(codexHome, "archived_sessions")
+      }
+    ];
+    const files = roots.flatMap(
+      ({ root, store }) => walkFiles({
+        root,
+        maxDepth: 6,
+        includeFile: (filePath) => filePath.endsWith(".jsonl") || filePath.endsWith(".jsonl.zst")
+      }).sort((left, right) => {
+        const leftCompressed = left.endsWith(".zst") ? 1 : 0;
+        const rightCompressed = right.endsWith(".zst") ? 1 : 0;
+        return leftCompressed - rightCompressed || left.localeCompare(right);
+      }).map((sourcePath) => ({ sourcePath, store }))
+    );
+    const seenRollouts = /* @__PURE__ */ new Set();
+    return files.filter(({ sourcePath }) => {
+      const rolloutId = codexRolloutId(sourcePath);
+      if (!rolloutId) return true;
+      if (seenRollouts.has(rolloutId)) return false;
+      seenRollouts.add(rolloutId);
+      return true;
+    }).flatMap(({ sourcePath, store }) => {
+      const readPath = sourcePath.endsWith(".zst") ? context.materializeArtifact?.(sourcePath) ?? null : sourcePath;
+      if (!readPath) return [];
+      return [
+        codexTranscriptCandidate(
+          sourcePath,
+          readPath,
+          store,
+          context,
+          harnessInstallId
+        )
+      ];
+    });
+  }
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/copilot-cli.ts
+import path10 from "path";
+var copilotCliArtifactDiscovery = Object.freeze({
+  targetId: "copilot-cli",
+  discover: ({ homeDir }) => walkFiles({
+    root: path10.join(homeDir, ".copilot", "session-state"),
+    maxDepth: 3,
+    includeFile: (filePath) => path10.basename(filePath) === "events.jsonl"
+  }).map(
+    (sourcePath) => transcriptCandidate({ targetId: "copilot-cli", sourcePath })
+  )
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/cursor.ts
+import path11 from "path";
+function hasPathSegment(filePath, segment) {
+  return normalizeFilePath(filePath).split(path11.sep).includes(segment);
+}
+var cursorArtifactDiscovery = Object.freeze({
+  targetId: "cursor",
+  discover: ({ homeDir }) => walkFiles({
+    root: path11.join(homeDir, ".cursor", "projects"),
+    maxDepth: 5,
+    includeFile: (filePath) => filePath.endsWith(".jsonl") && hasPathSegment(filePath, "agent-transcripts")
+  }).map(
+    (sourcePath) => transcriptCandidate({ targetId: "cursor", sourcePath })
+  )
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/factory-droid.ts
+import path12 from "path";
+var factoryDroidArtifactDiscovery = Object.freeze({
+  targetId: "factory-droid",
+  discover: ({ homeDir }) => walkFiles({
+    root: path12.join(homeDir, ".factory", "sessions"),
+    maxDepth: 4,
+    includeFile: (filePath) => filePath.endsWith(".jsonl")
+  }).map(
+    (sourcePath) => transcriptCandidate({ targetId: "factory-droid", sourcePath })
+  )
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/gemini.ts
+import path13 from "path";
+var GEMINI_DISCOVER_SKIP_DIRS = /* @__PURE__ */ new Set([
+  "bin",
+  "checkpoints",
+  "logs",
+  "plans",
+  "tasks",
+  "tool-outputs",
+  "tracker"
+]);
+var geminiArtifactDiscovery = Object.freeze({
+  targetId: "gemini",
+  discover: ({ homeDir, env }) => {
+    const geminiDir = geminiConfigDirectory({ homeDir, env });
+    const harnessInstallId = readHarnessInstallIdFile(
+      path13.join(geminiDir, "installation_id")
+    );
+    const root = path13.join(geminiDir, "tmp");
+    const files = [];
+    const seen = /* @__PURE__ */ new Set();
+    function walk(dir, depth) {
+      if (depth > 4) return;
+      for (const entry of safeReaddir(dir)) {
+        const entryPath = path13.join(dir, entry.name);
+        if (!entry.isDirectory()) continue;
+        if (GEMINI_DISCOVER_SKIP_DIRS.has(entry.name)) continue;
+        if (entry.name === "chats") {
+          for (const chatEntry of safeReaddir(entryPath)) {
+            if (!chatEntry.isFile() || !chatEntry.name.endsWith(".json")) {
+              continue;
+            }
+            const sourcePath = normalizeFilePath(
+              path13.join(entryPath, chatEntry.name)
+            );
+            if (seen.has(sourcePath)) continue;
+            seen.add(sourcePath);
+            files.push(sourcePath);
+          }
+          continue;
+        }
+        walk(entryPath, depth + 1);
+      }
+    }
+    walk(root, 0);
+    return files.map(
+      (sourcePath) => transcriptCandidate({
+        targetId: "gemini",
+        sourcePath,
+        metadata: harnessInstallId ? { harnessInstallId } : void 0
+      })
+    );
+  }
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/grok.ts
+import path14 from "path";
+function grokHome(homeDir, env) {
+  const configuredHome = env.GROK_HOME?.trim();
+  return configuredHome ? path14.resolve(configuredHome) : path14.join(homeDir, ".grok");
+}
+var grokArtifactDiscovery = Object.freeze({
+  targetId: "grok",
+  discover: ({ homeDir, env }) => walkFiles({
+    root: path14.join(grokHome(homeDir, env), "sessions"),
+    maxDepth: 5,
+    includeFile: (filePath) => path14.basename(filePath) === "updates.jsonl"
+  }).map(
+    (sourcePath) => transcriptCandidate({ targetId: "grok", sourcePath })
+  )
+});
+
+// ../../packages/agent-targets/src/artifacts/targets/pi.ts
+import path15 from "path";
+function piTranscriptCandidate(sourcePath, context) {
+  const fallbackObservedAtMs = (context.nowMs ?? Date.now)();
+  for (const record of readJsonlContextRecords(sourcePath)) {
+    if (record.type !== "session") continue;
+    const sessionId = typeof record.id === "string" && record.id.trim() ? record.id.trim() : null;
+    if (typeof record.cwd !== "string" || !record.cwd.trim()) {
+      return transcriptCandidate({
+        targetId: "pi",
+        sourcePath,
+        sessionId
+      });
+    }
+    const origin = context.resolveGitHubOrigin?.(record.cwd);
+    return transcriptCandidate({
+      targetId: "pi",
+      sourcePath,
+      sessionId,
+      repositoryObservations: origin ? [
+        repositoryObservation({
+          repository: origin.repository,
+          source: "git_origin",
+          observedAtMs: fallbackObservedAtMs,
+          cwd: record.cwd,
+          branch: origin.branch,
+          commitHash: origin.commitHash
+        })
+      ] : []
+    });
+  }
+  return transcriptCandidate({ targetId: "pi", sourcePath });
+}
+var piArtifactDiscovery = Object.freeze({
+  targetId: "pi",
+  discover: (context) => {
+    const { homeDir } = context;
+    return walkFiles({
+      root: path15.join(homeDir, ".pi", "agent", "sessions"),
+      maxDepth: 8,
+      includeFile: (filePath) => filePath.endsWith(".jsonl")
+    }).map((sourcePath) => piTranscriptCandidate(sourcePath, context));
+  }
+});
+
+// ../../packages/agent-targets/src/artifacts/registry.ts
+var ARTIFACT_DISCOVERY_CAPABILITIES = Object.freeze([
+  claudeArtifactDiscovery,
+  codexArtifactDiscovery,
+  geminiArtifactDiscovery,
+  grokArtifactDiscovery,
+  piArtifactDiscovery,
+  cursorArtifactDiscovery,
+  copilotCliArtifactDiscovery,
+  factoryDroidArtifactDiscovery
+]);
+function discoverTargetArtifactCandidates(context) {
+  const observedAtMs = (context.nowMs ?? Date.now)();
+  const capabilityContext = {
+    ...context,
+    nowMs: () => observedAtMs
+  };
+  return ARTIFACT_DISCOVERY_CAPABILITIES.flatMap(
+    (capability) => capability.discover(capabilityContext)
+  );
+}
+
+// ../../packages/agent-targets/src/artifacts/materialize.ts
+import { createHash as createHash3 } from "crypto";
+import fs6 from "fs";
+import path16 from "path";
+import zlib from "zlib";
+var MAX_MATERIALIZED_ARTIFACT_BYTES = 100 * 1024 * 1024;
+var DEFAULT_MATERIALIZED_CACHE_BYTES = 2 * 1024 * 1024 * 1024;
+function cacheEntryName(sourcePath, stat) {
+  const identity = `${path16.resolve(sourcePath)}\0${stat.size}\0${Math.floor(
+    stat.mtimeMs
+  )}`;
+  const digest = createHash3("sha256").update(identity).digest("hex");
+  return `${digest}.jsonl`;
+}
+function supportsCompressedArtifacts() {
+  return typeof zlib.zstdDecompressSync === "function";
+}
+function decodeZstd(sourcePath, maxOutputBytes) {
+  const decompress = zlib.zstdDecompressSync;
+  if (typeof decompress !== "function") return null;
+  try {
+    return decompress(fs6.readFileSync(sourcePath), {
+      maxOutputLength: maxOutputBytes
+    });
+  } catch {
+    return null;
+  }
+}
+function materializedArtifactPath(input) {
+  try {
+    const stat = fs6.statSync(input.sourcePath);
+    if (!stat.isFile() || stat.size === 0) return null;
+    return path16.join(input.cacheDir, cacheEntryName(input.sourcePath, stat));
+  } catch {
+    return null;
+  }
+}
+function materializeCompressedArtifact(input) {
+  let stat;
+  try {
+    stat = fs6.statSync(input.sourcePath);
+  } catch {
+    return null;
+  }
+  if (!stat.isFile() || stat.size === 0) return null;
+  const cachePath = path16.join(
+    input.cacheDir,
+    cacheEntryName(input.sourcePath, stat)
+  );
+  try {
+    if (fs6.statSync(cachePath).isFile()) {
+      const now = /* @__PURE__ */ new Date();
+      try {
+        fs6.utimesSync(cachePath, now, now);
+      } catch {
+      }
+      return cachePath;
+    }
+  } catch {
+  }
+  const decoded = decodeZstd(
+    input.sourcePath,
+    input.maxOutputBytes ?? MAX_MATERIALIZED_ARTIFACT_BYTES
+  );
+  if (!decoded) return null;
+  try {
+    fs6.mkdirSync(input.cacheDir, { recursive: true, mode: 448 });
+    const tempPath = `${cachePath}.${process.pid}.tmp`;
+    fs6.writeFileSync(tempPath, decoded, { mode: 384 });
+    fs6.renameSync(tempPath, cachePath);
+    return cachePath;
+  } catch {
+    return null;
+  }
+}
+function pruneMaterializedCache(input) {
+  const maxTotalBytes = input.maxTotalBytes ?? DEFAULT_MATERIALIZED_CACHE_BYTES;
+  let entries;
+  try {
+    entries = fs6.readdirSync(input.cacheDir, { withFileTypes: true });
+  } catch {
+    return { removed: 0, retainedBytes: 0 };
+  }
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile()) continue;
+    const filePath = path16.join(input.cacheDir, entry.name);
+    try {
+      const stat = fs6.statSync(filePath);
+      files.push({ path: filePath, size: stat.size, atimeMs: stat.atimeMs });
+    } catch {
+    }
+  }
+  files.sort((left, right) => right.atimeMs - left.atimeMs);
+  let retainedBytes = 0;
+  let removed = 0;
+  for (const file of files) {
+    const pinned = input.keepPaths?.has(file.path) ?? false;
+    if (pinned || retainedBytes + file.size <= maxTotalBytes) {
+      retainedBytes += file.size;
+      continue;
+    }
+    try {
+      fs6.rmSync(file.path);
+      removed += 1;
+    } catch {
+      retainedBytes += file.size;
+    }
+  }
+  return { removed, retainedBytes };
+}
+
+// ../../packages/panopticon/src/repository-context.ts
+import { execFileSync } from "child_process";
+var MAX_CWD_BYTES2 = 4096;
+var GIT_OUTPUT_BYTES = 16 * 1024;
+var GIT_TIMEOUT_MS = 1e3;
+var DEFAULT_GITHUB_ORIGIN_CACHE_MAX_ENTRIES = 512;
+function validCwd(cwd) {
+  const trimmed = cwd.trim();
+  return trimmed === cwd && trimmed.length > 0 && !new RegExp("\\p{Cc}", "u").test(trimmed) && Buffer.byteLength(trimmed, "utf8") <= MAX_CWD_BYTES2;
+}
+var runReadOnlyGit = (cwd, args) => {
+  if (!validCwd(cwd)) return null;
+  try {
+    return execFileSync("git", ["-C", cwd, ...args], {
+      encoding: "utf8",
+      maxBuffer: GIT_OUTPUT_BYTES,
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    }).trim() || null;
+  } catch {
+    return null;
+  }
+};
+function resolveGitHubOrigin(cwd, runGit = runReadOnlyGit) {
+  const remote = runGit(cwd, ["remote", "get-url", "origin"]);
+  const repository = remote ? canonicalGitHubRepository(remote) : null;
+  if (!repository) return null;
+  const branchResult = runGit(cwd, ["rev-parse", "--abbrev-ref", "HEAD"]);
+  const branch = branchResult === "HEAD" ? null : branchResult;
+  const commitHash = runGit(cwd, ["rev-parse", "HEAD"]);
+  return {
+    repository,
+    ...branch ? { branch } : {},
+    ...commitHash ? { commitHash } : {}
+  };
+}
+function createMeasuredGitHubOriginResolver(resolve = (cwd) => resolveGitHubOrigin(cwd), nowMs = () => performance.now(), options = {}) {
+  const cache = /* @__PURE__ */ new Map();
+  const maxCacheEntries = options.maxCacheEntries ?? DEFAULT_GITHUB_ORIGIN_CACHE_MAX_ENTRIES;
+  const maxLookups = options.maxLookups ?? Number.POSITIVE_INFINITY;
+  const maxElapsedMs = options.maxElapsedMs ?? Number.POSITIVE_INFINITY;
+  let attempted = 0;
+  let resolved = 0;
+  let unresolved = 0;
+  let cacheHits = 0;
+  let budgetSkipped = 0;
+  let elapsedMs = 0;
+  let slowestMs = 0;
+  const writeLocal = (cwd, origin) => {
+    if (maxCacheEntries <= 0) return;
+    cache.delete(cwd);
+    cache.set(cwd, origin);
+    while (cache.size > maxCacheEntries) {
+      const oldest = cache.keys().next().value;
+      if (oldest === void 0) break;
+      cache.delete(oldest);
+    }
+  };
+  const measuredResolve = (cwd) => {
+    if (cache.has(cwd)) {
+      cacheHits += 1;
+      const origin = cache.get(cwd) ?? null;
+      writeLocal(cwd, origin);
+      return origin;
+    }
+    const lookupStartedAtMs = nowMs();
+    if (attempted >= maxLookups || elapsedMs >= maxElapsedMs) {
+      budgetSkipped += 1;
+      writeLocal(cwd, null);
+      return null;
+    }
+    attempted += 1;
+    try {
+      const origin = resolve(cwd);
+      writeLocal(cwd, origin);
+      if (origin) resolved += 1;
+      else unresolved += 1;
+      return origin;
+    } catch (error) {
+      unresolved += 1;
+      throw error;
+    } finally {
+      const durationMs = nowMs() - lookupStartedAtMs;
+      if (Number.isFinite(durationMs) && durationMs > 0) {
+        elapsedMs += durationMs;
+        slowestMs = Math.max(slowestMs, durationMs);
+      }
+    }
+  };
+  return {
+    resolve: measuredResolve,
+    snapshot: () => ({
+      attempted,
+      resolved,
+      unresolved,
+      cacheHits,
+      budgetSkipped,
+      elapsedMs,
+      slowestMs
+    })
+  };
+}
+function createArtifactDiscoveryGitHubOriginResolver() {
+  return createMeasuredGitHubOriginResolver(
+    (cwd) => resolveGitHubOrigin(cwd),
+    () => performance.now()
+  );
+}
+
+// ../../packages/panopticon/src/artifacts.ts
+var RAW_ARTIFACT_ENDPOINT = "/v1/ingest/raw-artifact";
+var RAW_ARTIFACT_SCHEMA_VERSION = 4;
+var RAW_ARTIFACT_IDENTITY_SCHEMA_VERSION = 1;
+var DEFAULT_MAX_ARTIFACT_BYTES = 50 * 1024 * 1024;
+var DEFAULT_UPLOAD_CHUNK_BYTES = 1024 * 1024;
+var MAX_UPLOAD_CHUNK_BYTES = 5 * 1024 * 1024;
+var DEFAULT_UPLOAD_LIMIT = 10;
+var DEFAULT_UPLOAD_BYTE_LIMIT = DEFAULT_UPLOAD_CHUNK_BYTES * DEFAULT_UPLOAD_LIMIT;
+var MAX_UPLOAD_ATTEMPTS = 8;
+var RETRY_BACKOFF_BASE_MS = 3e4;
+var RETRY_BACKOFF_MAX_MS = 30 * 60 * 1e3;
+var RATE_LIMIT_RETRY_FALLBACK_MS = 6e4;
+var MAX_RATE_LIMIT_RETRY_MS = 24 * 60 * 60 * 1e3;
+var MIN_RATE_LIMIT_RETRY_MS = 1e3;
+var RAW_ARTIFACT_POST_TIMEOUT_MS = 6e4;
+var QUEUE_LOCK_STALE_MS = 15 * 60 * 1e3;
+var RAW_ARTIFACT_REPOSITORY_CONTEXT_SCHEMA_VERSION = 1;
+var MAX_RAW_ARTIFACT_REPOSITORY_OBSERVATIONS = 32;
+var MAX_RAW_ARTIFACT_REPOSITORY_CONTEXT_BYTES = 8 * 1024;
+var MAX_RAW_ARTIFACT_NESTED_METADATA_BYTES = 16 * 1024;
+function artifactSourceEnabled(source) {
+  return source !== "hermes";
+}
+var RawArtifactPostError = class extends Error {
+  status;
+  code;
+  retryAfter;
+  constructor(message, status, code, retryAfter) {
+    super(message);
+    this.name = "RawArtifactPostError";
+    this.status = status;
+    this.code = code;
+    this.retryAfter = retryAfter;
+  }
+};
+function isAbortError(error) {
+  return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
+}
+function safeStat(filePath) {
+  try {
+    return fs7.statSync(filePath);
+  } catch {
+    return null;
+  }
+}
+function normalizeFilePath2(filePath) {
+  return path17.resolve(filePath);
+}
+function artifactReadPath(artifact) {
+  return normalizeFilePath2(artifact.readPath ?? artifact.sourcePath);
+}
+function statCandidateSource(sourcePath, transientStatErrors) {
+  try {
+    return fs7.statSync(sourcePath);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    if (transientStatErrors === "throw") throw error;
+    return null;
+  }
+}
+function contentTypeForPath(filePath) {
+  const ext = path17.extname(filePath).toLowerCase();
+  if (ext === ".json" || ext === ".jsonl") return "application/json";
+  if (ext === ".md") return "text/markdown";
+  if (ext === ".toml") return "application/toml";
+  if (ext === ".yaml" || ext === ".yml") return "application/yaml";
+  if (ext === ".js" || ext === ".mjs" || ext === ".cjs") {
+    return "text/javascript";
+  }
+  if (ext === ".ts" || ext === ".tsx") return "text/typescript";
+  return "text/plain";
+}
+function buildArtifactKey(candidate) {
+  return `${candidate.artifactType}:${candidate.source}:${normalizeFilePath2(candidate.sourcePath)}`;
+}
+function buildArtifactId(args) {
+  return `raw_artifact:${sha256Hex(
+    `${args.artifactType}\0${args.source}\0${normalizeFilePath2(args.sourcePath)}`
+  )}`;
+}
+function buildArtifactGenerationId(args) {
+  return `raw_artifact_generation:${sha256Hex(
+    `${args.artifactId}\0${args.generationStartedAtMs}`
+  )}`;
+}
+function buildArtifactChunkId(args) {
+  return `raw_artifact_chunk:${sha256Hex(
+    `${args.artifactId}\0${args.artifactGenerationId}\0${args.chunkStartByte}\0${args.chunkEndByte}\0${args.chunkSha256}`
+  )}`;
+}
+function discoverArtifacts(options = {}) {
+  const repositoryResolution = createArtifactDiscoveryGitHubOriginResolver();
+  const env = options.env ?? process.env;
+  const homeDirInput = options.homeDir ?? env.HOME ?? os3.homedir();
+  if (!homeDirInput) {
+    return {
+      candidates: [],
+      oversized: [],
+      repositoryResolution: repositoryResolution.snapshot()
+    };
+  }
+  const homeDir = normalizeFilePath2(homeDirInput);
+  const candidates = discoverTargetArtifactCandidates({
+    homeDir,
+    env,
+    resolveGitHubOrigin: repositoryResolution.resolve,
+    ...options.materializeArtifact ? { materializeArtifact: options.materializeArtifact } : {}
+  });
+  const maxBytes = options.maxFileBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;
+  const byKey = /* @__PURE__ */ new Map();
+  const oversizedByKey = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const stat = safeStat(artifactReadPath(candidate));
+    if (!stat?.isFile()) continue;
+    if (stat.size > maxBytes) {
+      oversizedByKey.set(buildArtifactKey(candidate), {
+        artifactType: candidate.artifactType,
+        source: candidate.source,
+        sourcePath: candidate.sourcePath,
+        sizeBytes: stat.size,
+        maxFileBytes: maxBytes
+      });
+      continue;
+    }
+    byKey.set(buildArtifactKey(candidate), candidate);
+  }
+  return {
+    candidates: [...byKey.values()],
+    oversized: [...oversizedByKey.values()],
+    repositoryResolution: repositoryResolution.snapshot()
+  };
+}
+function emptyQueue() {
+  return { schemaVersion: RAW_ARTIFACT_SCHEMA_VERSION, artifacts: [] };
+}
+function isRawArtifactUploadMetadata(value) {
+  if (!value || typeof value !== "object") return false;
+  const metadata = value;
+  return typeof metadata.artifactId === "string" && typeof metadata.artifactGenerationId === "string" && typeof metadata.generationStartedAtMs === "number" && typeof metadata.artifactChunkId === "string" && typeof metadata.artifactKey === "string" && typeof metadata.artifactType === "string" && typeof metadata.source === "string" && typeof metadata.sourcePath === "string" && typeof metadata.contentType === "string" && metadata.contentEncoding === "identity" && typeof metadata.sizeBytes === "number" && typeof metadata.chunkStartByte === "number" && typeof metadata.chunkEndByte === "number" && typeof metadata.chunkSizeBytes === "number" && typeof metadata.chunkSha256 === "string" && typeof metadata.firstSeenAtMs === "number" && typeof metadata.lastSeenAtMs === "number" && !!metadata.metadata && typeof metadata.metadata === "object";
+}
+function isRawArtifactInFlightChunk(value) {
+  if (!value || typeof value !== "object") return false;
+  const chunk = value;
+  return typeof chunk.uploadDestinationId === "string" && isRawArtifactUploadMetadata(chunk.metadata);
+}
+function isUploadedChunkCheckpoint(value) {
+  if (!value || typeof value !== "object") return false;
+  const checkpoint = value;
+  return typeof checkpoint.chunkStartByte === "number" && typeof checkpoint.chunkEndByte === "number" && typeof checkpoint.chunkSha256 === "string";
+}
+function isQueueEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const entry = value;
+  return typeof entry.artifactId === "string" && typeof entry.artifactGenerationId === "string" && typeof entry.generationStartedAtMs === "number" && typeof entry.artifactKey === "string" && typeof entry.artifactType === "string" && typeof entry.source === "string" && typeof entry.sourcePath === "string" && (entry.identityKey === void 0 || typeof entry.identityKey === "string") && (entry.readPath === void 0 || typeof entry.readPath === "string") && entry.contentEncoding === "identity" && typeof entry.sizeBytes === "number" && typeof entry.uploadedSizeBytes === "number" && (entry.uploadedRepositoryContextRevision === void 0 || typeof entry.uploadedRepositoryContextRevision === "number" && Number.isSafeInteger(entry.uploadedRepositoryContextRevision) && entry.uploadedRepositoryContextRevision >= 1) && (entry.uploadedIdentitySignature === void 0 || typeof entry.uploadedIdentitySignature === "string") && typeof entry.uploadAttempts === "number" && typeof entry.firstSeenAtMs === "number" && typeof entry.lastSeenAtMs === "number" && (entry.uploadDestinationId === void 0 || typeof entry.uploadDestinationId === "string") && (entry.inFlightChunk === void 0 || isRawArtifactInFlightChunk(entry.inFlightChunk)) && (entry.uploadedChunkCheckpoints === void 0 || Array.isArray(entry.uploadedChunkCheckpoints) && entry.uploadedChunkCheckpoints.every(isUploadedChunkCheckpoint)) && (entry.status === "pending" || entry.status === "uploaded" || entry.status === "failed");
+}
+function isRawArtifactUploadThrottle(value) {
+  if (!value || typeof value !== "object") return false;
+  const throttle = value;
+  return typeof throttle.retryAtMs === "number" && Number.isSafeInteger(throttle.retryAtMs) && throttle.retryAtMs >= 0 && throttle.status === 429 && (throttle.code === void 0 || typeof throttle.code === "string");
+}
+function readUploadThrottles(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  const entries = Object.entries(value).filter(
+    ([, throttle]) => isRawArtifactUploadThrottle(throttle)
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : void 0;
+}
+function readArtifactQueue(queueFile) {
+  try {
+    const parsed = JSON.parse(fs7.readFileSync(queueFile, "utf8"));
+    if (!parsed || typeof parsed !== "object") return emptyQueue();
+    const record = parsed;
+    if (record.schemaVersion !== RAW_ARTIFACT_SCHEMA_VERSION) {
+      return emptyQueue();
+    }
+    if (!Array.isArray(record.artifacts)) return emptyQueue();
+    return {
+      schemaVersion: RAW_ARTIFACT_SCHEMA_VERSION,
+      artifacts: record.artifacts.filter(isQueueEntry),
+      uploadThrottles: readUploadThrottles(record.uploadThrottles)
+    };
+  } catch {
+    return emptyQueue();
+  }
+}
+function writeArtifactQueue(queueFile, queue) {
+  fs7.mkdirSync(path17.dirname(queueFile), { recursive: true, mode: 448 });
+  const tempFile = `${queueFile}.${process.pid}.${Date.now()}.tmp`;
+  fs7.writeFileSync(tempFile, `${JSON.stringify(queue, null, 2)}
+`, {
+    mode: 384
+  });
+  fs7.renameSync(tempFile, queueFile);
+  try {
+    fs7.chmodSync(queueFile, 384);
+  } catch {
+  }
+}
+function statMtimeMs(stat) {
+  return Math.floor(stat.mtimeMs);
+}
+function buildInitialGenerationId(input) {
+  return buildArtifactGenerationId({
+    artifactId: input.artifactId,
+    generationStartedAtMs: input.nowMs
+  });
+}
+function nextGenerationStartedAtMs(nowMs, existing) {
+  return existing ? Math.max(nowMs, existing.generationStartedAtMs + 1) : nowMs;
+}
+function shouldStartNewGeneration(input) {
+  if (input.nextSizeBytes < input.existing.uploadedSizeBytes) return true;
+  if (input.nextSizeBytes < input.existing.sizeBytes) return true;
+  if ((input.nextReadPath !== artifactReadPath(input.existing) || input.existing.readPath !== void 0) && input.nextSizeBytes === input.existing.sizeBytes && input.existing.uploadedSizeBytes >= input.nextSizeBytes && input.existing.contentSha256) {
+    try {
+      const contentSha256 = createHash4("sha256").update(fs7.readFileSync(input.nextReadPath)).digest("hex");
+      if (contentSha256 === input.existing.contentSha256) return false;
+    } catch {
+    }
+  }
+  return input.nextSizeBytes === input.existing.sizeBytes && input.nextMtimeMs !== input.existing.mtimeMs && input.existing.uploadedSizeBytes >= input.nextSizeBytes;
+}
+function optionalBoundedMetadataString(value, maxBytes) {
+  return typeof value === "string" && value.length > 0 && value.trim() === value && !new RegExp("\\p{Cc}", "u").test(value) && Buffer.byteLength(value, "utf8") <= maxBytes;
+}
+function isRepositoryObservation(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const observation = value;
+  const repository = observation.repository;
+  const repositoryName = typeof repository === "string" ? repository.split("/")[1] : void 0;
+  return typeof observation.id === "string" && /^repo_observation:[0-9a-f]{64}$/.test(observation.id) && typeof repository === "string" && /^[a-z0-9_.-]+\/[a-z0-9_.-]+$/.test(repository) && !repository.startsWith("./") && !repository.startsWith("../") && repositoryName !== "." && repositoryName !== ".." && !repositoryName?.endsWith(".git") && (observation.source === "codex_session_meta" || observation.source === "git_origin") && typeof observation.observedAtMs === "number" && Number.isSafeInteger(observation.observedAtMs) && observation.observedAtMs >= 0 && (observation.cwd === void 0 || optionalBoundedMetadataString(observation.cwd, 4096)) && (observation.branch === void 0 || optionalBoundedMetadataString(observation.branch, 1024)) && (observation.commitHash === void 0 || typeof observation.commitHash === "string" && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(observation.commitHash));
+}
+function repositoryContextFromMetadata(metadata, artifactGenerationId) {
+  const value = metadata?.repositoryContext;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const context = value;
+  if (context.schemaVersion !== RAW_ARTIFACT_REPOSITORY_CONTEXT_SCHEMA_VERSION || context.artifactGenerationId !== artifactGenerationId || typeof context.revision !== "number" || !Number.isSafeInteger(context.revision) || context.revision < 1 || !Array.isArray(context.observations) || context.observations.length < 1 || context.observations.length > MAX_RAW_ARTIFACT_REPOSITORY_OBSERVATIONS || !context.observations.every(isRepositoryObservation)) {
+    return null;
+  }
+  const observations = [...context.observations].sort(
+    (left, right) => left.id.localeCompare(right.id)
+  );
+  if (new Set(observations.map((observation) => observation.id)).size !== observations.length) {
+    return null;
+  }
+  return {
+    schemaVersion: RAW_ARTIFACT_REPOSITORY_CONTEXT_SCHEMA_VERSION,
+    artifactGenerationId,
+    revision: context.revision,
+    observations
+  };
+}
+function repositoryContextRevision(metadata, artifactGenerationId) {
+  return repositoryContextFromMetadata(metadata, artifactGenerationId)?.revision ?? 0;
+}
+function contextFitsMetadataBudget(context, metadataWithoutContext) {
+  return Buffer.byteLength(JSON.stringify(context), "utf8") <= MAX_RAW_ARTIFACT_REPOSITORY_CONTEXT_BYTES && Buffer.byteLength(
+    JSON.stringify({ ...metadataWithoutContext, repositoryContext: context }),
+    "utf8"
+  ) <= MAX_RAW_ARTIFACT_NESTED_METADATA_BYTES;
+}
+function mergeRepositoryContext(input) {
+  const byId = new Map(
+    (input.previous?.observations ?? []).map((observation) => [
+      observation.id,
+      observation
+    ])
+  );
+  let added = false;
+  const candidates = (input.observations ?? []).filter(isRepositoryObservation).sort((left, right) => left.id.localeCompare(right.id));
+  if (!input.previous && candidates.length === 0) return null;
+  for (const observation of candidates) {
+    if (byId.has(observation.id) || byId.size >= MAX_RAW_ARTIFACT_REPOSITORY_OBSERVATIONS) {
+      continue;
+    }
+    const nextObservations = [...byId.values(), observation].sort(
+      (left, right) => left.id.localeCompare(right.id)
+    );
+    const nextContext = {
+      schemaVersion: RAW_ARTIFACT_REPOSITORY_CONTEXT_SCHEMA_VERSION,
+      artifactGenerationId: input.artifactGenerationId,
+      revision: input.previous ? input.previous.revision + 1 : 1,
+      observations: nextObservations
+    };
+    if (!contextFitsMetadataBudget(nextContext, input.metadataWithoutContext)) {
+      continue;
+    }
+    byId.set(observation.id, observation);
+    added = true;
+  }
+  if (byId.size === 0) return null;
+  return {
+    schemaVersion: RAW_ARTIFACT_REPOSITORY_CONTEXT_SCHEMA_VERSION,
+    artifactGenerationId: input.artifactGenerationId,
+    revision: input.previous ? input.previous.revision + (added ? 1 : 0) : 1,
+    observations: [...byId.values()].sort(
+      (left, right) => left.id.localeCompare(right.id)
+    )
+  };
+}
+function withoutRepositoryContext(metadata) {
+  if (!metadata) return {};
+  return Object.fromEntries(
+    Object.entries(metadata).filter(([key]) => key !== "repositoryContext")
+  );
+}
+function metadataForGeneration(input) {
+  const previousContext = input.inheritPrevious ? repositoryContextFromMetadata(
+    input.previousMetadata,
+    input.artifactGenerationId
+  ) : null;
+  const metadataWithoutContext = {
+    ...input.inheritPrevious ? withoutRepositoryContext(input.previousMetadata) : {},
+    originalPath: input.sourcePath,
+    ...withoutRepositoryContext(input.candidateMetadata),
+    // Identity is refreshed on every snapshot; when unavailable this pass, an
+    // inherited value from a previous generation snapshot is kept as-is.
+    ...input.observerIdentity ? { observer: input.observerIdentity } : {}
+  };
+  const hasInstallIdentity = metadataWithoutContext.observer !== void 0 || metadataWithoutContext.harnessInstallId !== void 0;
+  const repositoryContext = mergeRepositoryContext({
+    artifactGenerationId: input.artifactGenerationId,
+    previous: previousContext,
+    observations: input.candidateObservations,
+    metadataWithoutContext
+  });
+  return {
+    ...metadataWithoutContext,
+    ...hasInstallIdentity ? {
+      installIdentitySchemaVersion: RAW_ARTIFACT_IDENTITY_SCHEMA_VERSION
+    } : {},
+    ...repositoryContext ? { repositoryContext } : {}
+  };
+}
+function snapshotCandidate(candidate, existing, nowMs, maxFileBytes, transientStatErrors = "ignore", observerIdentity) {
+  const sourcePath = normalizeFilePath2(candidate.sourcePath);
+  const readPath = artifactReadPath(candidate);
+  const stat = statCandidateSource(readPath, transientStatErrors);
+  if (!stat?.isFile() || stat.size > maxFileBytes) return null;
+  const artifactType = candidate.artifactType;
+  const source = candidate.source;
+  const artifactKey = existing?.artifactKey ?? buildArtifactKey({ ...candidate, sourcePath });
+  const artifactId = existing?.artifactId ?? buildArtifactId({ artifactType, source, sourcePath });
+  const identityKey = candidate.identityKey ?? existing?.identityKey;
+  const sizeBytes = stat.size;
+  const mtimeMs = statMtimeMs(stat);
+  if (existing && !shouldStartNewGeneration({
+    existing,
+    nextReadPath: readPath,
+    nextSizeBytes: sizeBytes,
+    nextMtimeMs: mtimeMs
+  })) {
+    const metadata2 = metadataForGeneration({
+      sourcePath,
+      artifactGenerationId: existing.artifactGenerationId,
+      candidateMetadata: candidate.metadata,
+      candidateObservations: candidate.repositoryObservations,
+      previousMetadata: existing.metadata,
+      inheritPrevious: true,
+      observerIdentity
+    });
+    const previousContextRevision = repositoryContextRevision(
+      existing.metadata,
+      existing.artifactGenerationId
+    );
+    const nextContextRevision = repositoryContextRevision(
+      metadata2,
+      existing.artifactGenerationId
+    );
+    const contextAdvanced = nextContextRevision > previousContextRevision;
+    const contextNeedsUpload = nextContextRevision > (existing.uploadedRepositoryContextRevision ?? 0);
+    const nextIdentitySignature = identitySignature(metadata2);
+    const identityAdvanced = nextIdentitySignature !== void 0 && nextIdentitySignature !== identitySignature(existing.metadata);
+    const identityUnacknowledged = nextIdentitySignature !== void 0 && nextIdentitySignature !== existing.uploadedIdentitySignature;
+    const amendmentNeedsUpload = contextNeedsUpload || identityUnacknowledged;
+    const amendmentAdvanced = contextAdvanced || identityAdvanced;
+    const fullyUploaded = existing.uploadedSizeBytes >= sizeBytes;
+    const grew = sizeBytes > existing.sizeBytes;
+    const hasNewWork = grew || amendmentAdvanced;
+    const status = fullyUploaded ? amendmentNeedsUpload ? amendmentAdvanced ? "pending" : existing.status === "failed" ? "failed" : "pending" : "uploaded" : grew ? "pending" : existing.status === "failed" ? "failed" : "pending";
+    return {
+      ...existing,
+      sourcePath,
+      ...identityKey ? { identityKey } : {},
+      // Always taken from the candidate: a stale decoded copy paired with a
+      // freshly discovered plain source would read the wrong bytes.
+      readPath: candidate.readPath ? readPath : void 0,
+      sessionId: existing.sessionId ?? candidate.sessionId ?? null,
+      sizeBytes,
+      mtimeMs,
+      lastSeenAtMs: nowMs,
+      metadata: metadata2,
+      status,
+      // A stored contentSha256 is only valid for the sizeBytes it was
+      // computed at (the completed upload). Once the file grows past that,
+      // drop it so intermediate chunks never carry a stale full-file hash.
+      contentSha256: fullyUploaded ? existing.contentSha256 : void 0,
+      uploadedAtMs: fullyUploaded ? existing.uploadedAtMs : void 0,
+      // Appends are the normal transcript lifecycle. New bytes are meaningful
+      // work and reset both an exhausted retry budget and its backoff clock.
+      uploadAttempts: hasNewWork ? 0 : existing.uploadAttempts,
+      lastAttemptAtMs: hasNewWork ? void 0 : existing.lastAttemptAtMs,
+      lastError: hasNewWork || status === "pending" ? void 0 : existing.lastError
+    };
+  }
+  const generationStartedAtMs = nextGenerationStartedAtMs(nowMs, existing);
+  const artifactGenerationId = buildInitialGenerationId({
+    artifactId,
+    nowMs: generationStartedAtMs
+  });
+  const metadata = metadataForGeneration({
+    sourcePath,
+    artifactGenerationId,
+    candidateMetadata: candidate.metadata,
+    candidateObservations: candidate.repositoryObservations,
+    inheritPrevious: false,
+    observerIdentity
+  });
+  return {
+    artifactId,
+    artifactGenerationId,
+    generationStartedAtMs,
+    artifactKey,
+    artifactType,
+    source,
+    sourcePath,
+    ...identityKey ? { identityKey } : {},
+    ...candidate.readPath ? { readPath } : {},
+    sessionId: candidate.sessionId ?? null,
+    contentType: contentTypeForPath(readPath),
+    contentEncoding: "identity",
+    sizeBytes,
+    mtimeMs,
+    firstSeenAtMs: existing?.firstSeenAtMs ?? nowMs,
+    lastSeenAtMs: generationStartedAtMs,
+    metadata,
+    status: sizeBytes === 0 ? "uploaded" : "pending",
+    uploadedSizeBytes: 0,
+    uploadedRepositoryContextRevision: void 0,
+    uploadedIdentitySignature: void 0,
+    uploadedChunkCheckpoints: [],
+    uploadAttempts: 0
+  };
+}
+function snapshotArtifactsLocked(options, lock) {
+  const nowMs = options.nowMs?.() ?? Date.now();
+  const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_ARTIFACT_BYTES;
+  const queue = readArtifactQueue(options.queueFile);
+  const entriesByKey = new Map(
+    queue.artifacts.map((entry) => [entry.artifactKey, entry])
+  );
+  const entriesByIdentityKey = new Map(
+    queue.artifacts.flatMap(
+      (entry) => entry.identityKey ? [[entry.identityKey, entry]] : []
+    )
+  );
+  let queued = 0;
+  let skipped = 0;
+  const oversizedByPath = /* @__PURE__ */ new Map();
+  const recordOversized = (input) => {
+    const stat = safeStat(input.sourcePath);
+    if (!stat?.isFile() || stat.size <= maxFileBytes) return false;
+    oversizedByPath.set(input.sourcePath, {
+      artifactType: input.artifactType,
+      source: input.source,
+      sourcePath: input.sourcePath,
+      sizeBytes: stat.size,
+      maxFileBytes
+    });
+    return true;
+  };
+  let candidatesSeen = 0;
+  for (const candidate of options.candidates) {
+    candidatesSeen += 1;
+    if (lock && candidatesSeen % 100 === 0 && !lock.heartbeat()) {
+      throw new Error("artifact queue lock ownership was lost");
+    }
+    const existing = (candidate.identityKey ? entriesByIdentityKey.get(candidate.identityKey) : void 0) ?? entriesByKey.get(buildArtifactKey(candidate));
+    const snapshot = snapshotCandidate(
+      candidate,
+      existing,
+      nowMs,
+      maxFileBytes,
+      "ignore",
+      options.observerIdentity
+    );
+    if (!snapshot) {
+      skipped += 1;
+      recordOversized(candidate);
+      continue;
+    }
+    queued += 1;
+    entriesByKey.set(snapshot.artifactKey, snapshot);
+    if (snapshot.identityKey) {
+      entriesByIdentityKey.set(snapshot.identityKey, snapshot);
+    }
+  }
+  const artifacts = [...entriesByKey.values()].filter((entry) => {
+    if (!artifactSourceEnabled(entry.source)) {
+      skipped += 1;
+      return false;
+    }
+    if (entry.readPath && !safeStat(entry.sourcePath)?.isFile()) {
+      skipped += 1;
+      return false;
+    }
+    if (entry.readPath && !safeStat(entry.readPath)?.isFile()) {
+      return true;
+    }
+    const stat = safeStat(artifactReadPath(entry));
+    if (!stat?.isFile() || stat.size > maxFileBytes) {
+      skipped += 1;
+      recordOversized(entry);
+      return false;
+    }
+    return true;
+  });
+  const nextQueue = {
+    schemaVersion: RAW_ARTIFACT_SCHEMA_VERSION,
+    artifacts: artifacts.sort(
+      (a, b) => a.artifactKey.localeCompare(b.artifactKey)
+    ),
+    uploadThrottles: queue.uploadThrottles
+  };
+  if (lock && !lock.heartbeat()) {
+    throw new Error("artifact queue lock ownership was lost");
+  }
+  writeArtifactQueue(options.queueFile, nextQueue);
+  return {
+    queued,
+    skipped,
+    oversized: [...oversizedByPath.values()],
+    queue: nextQueue
+  };
+}
+function sourceRevisionFromStat(stat) {
+  return {
+    device: stat.dev,
+    inode: stat.ino,
+    sizeBytes: stat.size,
+    mtimeNanoseconds: stat.mtimeNs,
+    ctimeNanoseconds: stat.ctimeNs
+  };
+}
+function sameSourceRevision(left, right) {
+  return left.device === right.device && left.inode === right.inode && left.sizeBytes === right.sizeBytes && left.mtimeNanoseconds === right.mtimeNanoseconds && left.ctimeNanoseconds === right.ctimeNanoseconds;
+}
+function safeSourceRevision(filePath) {
+  try {
+    const stat = fs7.statSync(filePath, { bigint: true });
+    return stat.isFile() ? sourceRevisionFromStat(stat) : null;
+  } catch {
+    return null;
+  }
+}
+function readExactRange(fd, startByte, endByte) {
+  const sizeBytes = endByte - startByte;
+  if (sizeBytes < 0) return null;
+  const buffer = Buffer.alloc(sizeBytes);
+  let offset = 0;
+  while (offset < sizeBytes) {
+    const bytesRead = fs7.readSync(
+      fd,
+      buffer,
+      offset,
+      sizeBytes - offset,
+      startByte + offset
+    );
+    if (bytesRead <= 0) return null;
+    offset += bytesRead;
+  }
+  return buffer;
+}
+function readFileRangeAtRevision(filePath, startByte, endByte, expectedRevision) {
+  const pathRevisionBefore = safeSourceRevision(filePath);
+  if (!pathRevisionBefore || expectedRevision && !sameSourceRevision(pathRevisionBefore, expectedRevision)) {
+    return null;
+  }
+  let fd;
+  try {
+    fd = fs7.openSync(filePath, "r");
+  } catch {
+    return null;
+  }
+  try {
+    const openedRevision = sourceRevisionFromStat(
+      fs7.fstatSync(fd, { bigint: true })
+    );
+    if (!sameSourceRevision(pathRevisionBefore, openedRevision)) return null;
+    const bytes = readExactRange(fd, startByte, endByte);
+    if (!bytes) return null;
+    const revisionAfterRead = sourceRevisionFromStat(
+      fs7.fstatSync(fd, { bigint: true })
+    );
+    const pathRevisionAfter = safeSourceRevision(filePath);
+    if (!sameSourceRevision(openedRevision, revisionAfterRead) || !pathRevisionAfter || !sameSourceRevision(openedRevision, pathRevisionAfter)) {
+      return null;
+    }
+    return { bytes, revision: openedRevision };
+  } catch {
+    return null;
+  } finally {
+    fs7.closeSync(fd);
+  }
+}
+function uploadMetadata(input) {
+  const chunkSha256 = sha256Hex(input.chunk);
+  return {
+    artifactId: input.entry.artifactId,
+    artifactGenerationId: input.entry.artifactGenerationId,
+    generationStartedAtMs: input.entry.generationStartedAtMs,
+    artifactChunkId: buildArtifactChunkId({
+      artifactId: input.entry.artifactId,
+      artifactGenerationId: input.entry.artifactGenerationId,
+      chunkStartByte: input.chunkStartByte,
+      chunkEndByte: input.chunkEndByte,
+      chunkSha256
+    }),
+    artifactKey: input.entry.artifactKey,
+    artifactType: input.entry.artifactType,
+    source: input.entry.source,
+    sourcePath: input.entry.sourcePath,
+    sessionId: input.entry.sessionId,
+    contentType: input.entry.contentType,
+    contentEncoding: input.entry.contentEncoding,
+    sizeBytes: input.entry.sizeBytes,
+    // Only the final-chunk computation produces a hash for the current
+    // generation at the current sizeBytes; never fall back to the stored
+    // hash of a previously completed (shorter) content.
+    contentSha256: input.contentSha256,
+    chunkStartByte: input.chunkStartByte,
+    chunkEndByte: input.chunkEndByte,
+    chunkSizeBytes: input.chunk.length,
+    chunkSha256,
+    mtimeMs: input.entry.mtimeMs,
+    firstSeenAtMs: input.entry.firstSeenAtMs,
+    lastSeenAtMs: input.entry.lastSeenAtMs,
+    metadata: input.entry.metadata
+  };
+}
+function repositoryContextNeedsUpload(entry) {
+  return repositoryContextRevision(entry.metadata, entry.artifactGenerationId) > (entry.uploadedRepositoryContextRevision ?? 0);
+}
+function installIdentityAmendment(metadata) {
+  const observer = metadata.observer !== null && typeof metadata.observer === "object" && !Array.isArray(metadata.observer) ? metadata.observer : void 0;
+  const fmlInstallId = observer?.fmlInstallId;
+  const validObserver = typeof fmlInstallId === "string" && fmlInstallId.trim().length > 0 ? observer : void 0;
+  const harnessInstallId = typeof metadata.harnessInstallId === "string" && metadata.harnessInstallId.trim().length > 0 ? metadata.harnessInstallId : void 0;
+  if (validObserver === void 0 && harnessInstallId === void 0) {
+    return void 0;
+  }
+  const identity = {
+    installIdentitySchemaVersion: RAW_ARTIFACT_IDENTITY_SCHEMA_VERSION,
+    ...validObserver === void 0 ? {} : { observer: validObserver },
+    ...harnessInstallId === void 0 ? {} : { harnessInstallId }
+  };
+  return Buffer.byteLength(JSON.stringify(identity), "utf8") <= MAX_RAW_ARTIFACT_NESTED_METADATA_BYTES ? identity : void 0;
+}
+function identitySignature(metadata) {
+  if (!metadata) return void 0;
+  const identity = installIdentityAmendment(metadata);
+  if (identity === void 0) return void 0;
+  return JSON.stringify({
+    installIdentitySchemaVersion: RAW_ARTIFACT_IDENTITY_SCHEMA_VERSION,
+    observer: identity.observer ?? null,
+    harnessInstallId: identity.harnessInstallId ?? null
+  });
+}
+function identityNeedsUpload(entry) {
+  const signature = identitySignature(entry.metadata);
+  return signature !== void 0 && signature !== entry.uploadedIdentitySignature;
+}
+var UNCONFIRMED_IDENTITY_PERSISTENCE_ERROR = "raw artifact server did not confirm install identity persistence";
+function rawUploadAcknowledgedIdentitySignature(entry, metadata, response) {
+  const signature = identitySignature(metadata.metadata);
+  if (signature === void 0) return entry.uploadedIdentitySignature;
+  return response.status === "stored" || response.installIdentityPersisted === true ? signature : entry.uploadedIdentitySignature;
+}
+function rawUploadLeavesFinalIdentityUnconfirmed(entry, metadata, response) {
+  return metadata.chunkEndByte === entry.sizeBytes && identityNeedsUpload(entry) && identitySignature(metadata.metadata) !== void 0 && response.status === "duplicate" && response.installIdentityPersisted !== true;
+}
+function metadataAmendmentNeedsUpload(entry) {
+  return repositoryContextNeedsUpload(entry) || identityNeedsUpload(entry);
+}
+function acknowledgedRepositoryContextRevision(entry, metadata) {
+  const revision = repositoryContextRevision(
+    metadata.metadata,
+    metadata.artifactGenerationId
+  );
+  return revision > 0 ? Math.max(entry.uploadedRepositoryContextRevision ?? 0, revision) : entry.uploadedRepositoryContextRevision;
+}
+function acknowledgedCheckpoints(entry) {
+  if (entry.uploadedChunkCheckpoints !== void 0) {
+    return entry.uploadedChunkCheckpoints;
+  }
+  if (entry.lastUploadedChunkStartByte !== void 0 && entry.lastUploadedChunkEndByte !== void 0 && entry.lastUploadedChunkSha256 !== void 0) {
+    return [
+      {
+        chunkStartByte: entry.lastUploadedChunkStartByte,
+        chunkEndByte: entry.lastUploadedChunkEndByte,
+        chunkSha256: entry.lastUploadedChunkSha256
+      }
+    ];
+  }
+  return [];
+}
+function contiguousCheckpoints(checkpoints, expectedEndByte) {
+  if (!Number.isSafeInteger(expectedEndByte) || expectedEndByte < 0) {
+    return null;
+  }
+  const sorted = [...checkpoints].sort(
+    (left, right) => left.chunkStartByte - right.chunkStartByte
+  );
+  let nextStartByte = 0;
+  for (const checkpoint of sorted) {
+    if (!Number.isSafeInteger(checkpoint.chunkStartByte) || !Number.isSafeInteger(checkpoint.chunkEndByte) || checkpoint.chunkStartByte !== nextStartByte || checkpoint.chunkEndByte <= checkpoint.chunkStartByte || checkpoint.chunkEndByte > expectedEndByte) {
+      return null;
+    }
+    nextStartByte = checkpoint.chunkEndByte;
+  }
+  return nextStartByte === expectedEndByte ? sorted : null;
+}
+function validateCheckpointPrefix(input) {
+  const checkpoints = contiguousCheckpoints(
+    input.checkpoints,
+    input.expectedEndByte
+  );
+  if (!checkpoints) return { status: "mismatch" };
+  const pathRevisionBefore = safeSourceRevision(input.sourcePath);
+  if (!pathRevisionBefore || pathRevisionBefore.sizeBytes < BigInt(input.expectedEndByte) || input.expectedRevision && !sameSourceRevision(pathRevisionBefore, input.expectedRevision)) {
+    return { status: "changed" };
+  }
+  let fd;
+  try {
+    fd = fs7.openSync(input.sourcePath, "r");
+  } catch {
+    return { status: "changed" };
+  }
+  try {
+    const openedRevision = sourceRevisionFromStat(
+      fs7.fstatSync(fd, { bigint: true })
+    );
+    if (!sameSourceRevision(pathRevisionBefore, openedRevision)) {
+      return { status: "changed" };
+    }
+    const contentHash = createHash4("sha256");
+    let checkpointMismatch = false;
+    for (const checkpoint of checkpoints) {
+      const chunk = readExactRange(
+        fd,
+        checkpoint.chunkStartByte,
+        checkpoint.chunkEndByte
+      );
+      if (!chunk || sha256Hex(chunk) !== checkpoint.chunkSha256) {
+        checkpointMismatch = true;
+        break;
+      }
+      contentHash.update(chunk);
+    }
+    const revisionAfterRead = sourceRevisionFromStat(
+      fs7.fstatSync(fd, { bigint: true })
+    );
+    const pathRevisionAfter = safeSourceRevision(input.sourcePath);
+    if (!sameSourceRevision(openedRevision, revisionAfterRead) || !pathRevisionAfter || !sameSourceRevision(openedRevision, pathRevisionAfter)) {
+      return { status: "changed" };
+    }
+    if (checkpointMismatch) return { status: "mismatch" };
+    return {
+      status: "valid",
+      revision: openedRevision,
+      contentSha256: contentHash.digest("hex")
+    };
+  } catch {
+    return { status: "changed" };
+  } finally {
+    fs7.closeSync(fd);
+  }
+}
+function validatedPrefixStillApplies(prefix, entry, uploadDestinationId, revision) {
+  return prefix?.artifactGenerationId === entry.artifactGenerationId && prefix.uploadDestinationId === uploadDestinationId && prefix.sourcePath === artifactReadPath(entry) && prefix.verifiedThroughByte === entry.uploadedSizeBytes && sameSourceRevision(prefix.revision, revision);
+}
+function withAcknowledgedCheckpoint(entry, checkpoint) {
+  return [
+    ...acknowledgedCheckpoints(entry).filter(
+      (existing) => existing.chunkStartByte !== checkpoint.chunkStartByte
+    ),
+    checkpoint
+  ].sort((left, right) => left.chunkStartByte - right.chunkStartByte);
+}
+function startNewGenerationFromEntry(entry, nowMs) {
+  const stat = safeStat(artifactReadPath(entry));
+  if (!stat?.isFile()) return null;
+  const sizeBytes = stat.size;
+  const mtimeMs = statMtimeMs(stat);
+  const generationStartedAtMs = nextGenerationStartedAtMs(nowMs, entry);
+  const artifactGenerationId = buildInitialGenerationId({
+    artifactId: entry.artifactId,
+    nowMs: generationStartedAtMs
+  });
+  return {
+    ...entry,
+    artifactGenerationId,
+    metadata: metadataForGeneration({
+      sourcePath: entry.sourcePath,
+      artifactGenerationId,
+      candidateMetadata: entry.metadata,
+      inheritPrevious: false
+    }),
+    generationStartedAtMs,
+    sizeBytes,
+    mtimeMs,
+    lastSeenAtMs: generationStartedAtMs,
+    status: sizeBytes === 0 ? "uploaded" : "pending",
+    uploadedSizeBytes: 0,
+    uploadedRepositoryContextRevision: void 0,
+    uploadedIdentitySignature: void 0,
+    // A new generation locks its own chunk grid on first upload and computes
+    // its own full-content hash; never inherit the previous generation's.
+    contentSha256: void 0,
+    uploadChunkSizeBytes: void 0,
+    lastUploadedChunkStartByte: void 0,
+    lastUploadedChunkEndByte: void 0,
+    lastUploadedChunkSha256: void 0,
+    uploadedChunkCheckpoints: [],
+    uploadDestinationId: void 0,
+    uploadTarget: void 0,
+    inFlightChunk: void 0,
+    uploadedAtMs: void 0,
+    uploadAttempts: 0,
+    lastAttemptAtMs: void 0,
+    lastError: void 0
+  };
+}
+function rawArtifactUrl(targetUrl) {
+  return `${targetUrl.replace(/\/$/, "")}${RAW_ARTIFACT_ENDPOINT}`;
+}
+function jwtPrincipalFingerprint(authorization) {
+  const token = authorization.trim().replace(/^Bearer\s+/, "");
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1] ?? "", "base64url").toString("utf8")
+    );
+    if (!payload || typeof payload !== "object") return null;
+    const claims = payload;
+    if (typeof claims.sub !== "string" || claims.sub.length === 0) {
+      return null;
+    }
+    const issuer = typeof claims.iss === "string" ? claims.iss : "";
+    return sha256Hex(`jwt\0${issuer}\0${claims.sub}`);
+  } catch {
+    return null;
+  }
+}
+function buildUploadDestinationId(input) {
+  const normalizedTargetUrl = input.targetUrl.replace(/\/$/, "");
+  const explicitIdentity = input.destinationIdentity?.trim();
+  const credentialFingerprint = explicitIdentity ? sha256Hex(`identity\0${explicitIdentity}`) : jwtPrincipalFingerprint(input.authorization) ?? sha256Hex(input.authorization);
+  const organizationScope = input.organization ? `\0${input.organization}` : "";
+  return `raw_artifact_destination:${sha256Hex(
+    `${normalizedTargetUrl}\0${input.targetName}\0${credentialFingerprint}${organizationScope}`
+  )}`;
+}
+function rawArtifactRequestHeaders(options) {
+  return {
+    Authorization: options.authorization,
+    ...options.organization ? { "X-FML-Organization": options.organization } : {}
+  };
+}
+function canPreserveRetryStateOnDestinationActivation(entry) {
+  return entry.uploadDestinationId === void 0 && entry.uploadedSizeBytes === 0 && entry.status !== "uploaded";
+}
+function activateUploadDestination(entry, uploadDestinationId, targetName) {
+  if (entry.uploadDestinationId === uploadDestinationId) return entry;
+  const canPreserveRetryState = canPreserveRetryStateOnDestinationActivation(entry);
+  return {
+    ...entry,
+    status: entry.sizeBytes === 0 ? "uploaded" : canPreserveRetryState ? entry.status : "pending",
+    uploadedSizeBytes: 0,
+    uploadedRepositoryContextRevision: void 0,
+    uploadedIdentitySignature: void 0,
+    contentSha256: void 0,
+    lastUploadedChunkStartByte: void 0,
+    lastUploadedChunkEndByte: void 0,
+    lastUploadedChunkSha256: void 0,
+    uploadedChunkCheckpoints: [],
+    uploadDestinationId,
+    uploadTarget: targetName,
+    inFlightChunk: void 0,
+    uploadedAtMs: void 0,
+    uploadAttempts: canPreserveRetryState ? entry.uploadAttempts : 0,
+    lastAttemptAtMs: canPreserveRetryState ? entry.lastAttemptAtMs : void 0,
+    lastError: canPreserveRetryState ? entry.lastError : void 0
+  };
+}
+function queueLockFile(queueFile) {
+  return `${queueFile}.lock`;
+}
+function defaultIsPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function readQueueLockHolder(lockFile) {
+  try {
+    const parsed = JSON.parse(fs7.readFileSync(lockFile, "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    const record = parsed;
+    if (typeof record.pid !== "number" || typeof record.timestampMs !== "number") {
+      return null;
+    }
+    const ownerToken = typeof record.ownerToken === "string" ? record.ownerToken : void 0;
+    const timestampMs = ownerToken ? Math.max(record.timestampMs, fs7.statSync(lockFile).mtimeMs) : record.timestampMs;
+    return { pid: record.pid, timestampMs, ownerToken };
+  } catch {
+    return null;
+  }
+}
+function queueLockFileMatchesOwner(lockFile, fd, ownerToken) {
+  try {
+    const openStat = fs7.fstatSync(fd);
+    const pathStat = fs7.statSync(lockFile);
+    if (openStat.dev !== pathStat.dev || openStat.ino !== pathStat.ino) {
+      return false;
+    }
+    return readQueueLockHolder(lockFile)?.ownerToken === ownerToken;
+  } catch {
+    return false;
+  }
+}
+function acquireQueueLock(queueFile, deps) {
+  const lockFile = queueLockFile(queueFile);
+  fs7.mkdirSync(path17.dirname(lockFile), { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      const fd = fs7.openSync(lockFile, "wx+", 384);
+      const ownerToken = randomUUID3();
+      let released = false;
+      try {
+        fs7.writeSync(
+          fd,
+          `${JSON.stringify({
+            pid: process.pid,
+            ownerToken,
+            timestampMs: deps.nowMs()
+          })}
+`
+        );
+        const heartbeatAt = new Date(deps.nowMs());
+        fs7.futimesSync(fd, heartbeatAt, heartbeatAt);
+      } catch (error) {
+        fs7.closeSync(fd);
+        try {
+          fs7.unlinkSync(lockFile);
+        } catch {
+        }
+        throw error;
+      }
+      const close = () => {
+        if (released) return;
+        released = true;
+        fs7.closeSync(fd);
+      };
+      return {
+        heartbeat() {
+          if (released) return false;
+          if (!queueLockFileMatchesOwner(lockFile, fd, ownerToken))
+            return false;
+          try {
+            const heartbeatAt = new Date(deps.nowMs());
+            fs7.futimesSync(fd, heartbeatAt, heartbeatAt);
+            return true;
+          } catch {
+            return false;
+          }
+        },
+        release() {
+          if (released) return;
+          if (queueLockFileMatchesOwner(lockFile, fd, ownerToken)) {
+            try {
+              fs7.unlinkSync(lockFile);
+            } catch {
+            }
+          }
+          close();
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const holder = readQueueLockHolder(lockFile);
+      const stale = !holder || !deps.isPidAlive(holder.pid) || deps.nowMs() - holder.timestampMs > QUEUE_LOCK_STALE_MS;
+      if (!stale) return null;
+      try {
+        fs7.unlinkSync(lockFile);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function resetArtifactQueue(options) {
+  const nowMs = options.nowMs ?? Date.now;
+  const lock = acquireQueueLock(options.queueFile, {
+    nowMs,
+    isPidAlive: options.isPidAlive ?? defaultIsPidAlive
+  });
+  if (!lock) {
+    return {
+      reset: 0,
+      removed: 0,
+      skipped: true,
+      queue: readArtifactQueue(options.queueFile)
+    };
+  }
+  try {
+    const queue = readArtifactQueue(options.queueFile);
+    const resetAtMs = nowMs();
+    const artifacts = queue.artifacts.flatMap((entry) => {
+      if (!artifactSourceEnabled(entry.source)) return [];
+      const reset = startNewGenerationFromEntry(entry, resetAtMs);
+      return reset ? [reset] : [];
+    });
+    const nextQueue = {
+      schemaVersion: RAW_ARTIFACT_SCHEMA_VERSION,
+      artifacts,
+      ...queue.uploadThrottles ? { uploadThrottles: queue.uploadThrottles } : {}
+    };
+    if (!lock.heartbeat()) {
+      throw new Error("artifact queue lock ownership was lost");
+    }
+    writeArtifactQueue(options.queueFile, nextQueue);
+    return {
+      reset: artifacts.length,
+      removed: queue.artifacts.length - artifacts.length,
+      skipped: false,
+      queue: nextQueue
+    };
+  } finally {
+    lock.release();
+  }
+}
+async function postRawArtifact(url, metadata, content, headers, fetchImpl = fetch, timeoutMs = RAW_ARTIFACT_POST_TIMEOUT_MS) {
+  const form = new FormData();
+  form.append(
+    "metadata",
+    new Blob([JSON.stringify(metadata)], { type: "application/json" }),
+    "metadata.json"
+  );
+  form.append(
+    "file",
+    new Blob([new Uint8Array(content)], { type: metadata.contentType }),
+    path17.basename(metadata.sourcePath) || "raw-artifact"
+  );
+  const abort = new AbortController();
+  const timeout = setTimeout(() => abort.abort(), timeoutMs);
+  let bodyText;
+  let responseStatus;
+  let responseOk;
+  let retryAfter;
+  try {
+    const response2 = await fetchImpl(url, {
+      method: "POST",
+      headers,
+      body: form,
+      signal: abort.signal
+    });
+    bodyText = await response2.text().catch(() => "");
+    responseStatus = response2.status;
+    responseOk = response2.ok;
+    retryAfter = response2.headers.get("Retry-After") ?? void 0;
+  } catch (error) {
+    if (abort.signal.aborted) {
+      throw new Error(`raw artifact POST timed out after ${timeoutMs}ms`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+  if (!responseOk) {
+    let code;
+    try {
+      const errorBody = JSON.parse(bodyText);
+      if (errorBody && typeof errorBody === "object") {
+        const parsedCode = errorBody.code;
+        if (typeof parsedCode === "string") code = parsedCode;
+      }
+    } catch {
+    }
+    throw new RawArtifactPostError(
+      `HTTP ${responseStatus}${bodyText ? `: ${bodyText.slice(0, 500)}` : ""}`,
+      responseStatus,
+      code,
+      retryAfter
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(bodyText);
+  } catch {
+    throw new Error("raw artifact POST returned invalid JSON");
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("raw artifact POST returned an invalid acknowledgement");
+  }
+  const response = parsed;
+  if (response.ok !== true || response.status !== "stored" && response.status !== "duplicate") {
+    throw new Error("raw artifact POST did not acknowledge the upload");
+  }
+  if (response.artifactId !== metadata.artifactId || response.artifactGenerationId !== metadata.artifactGenerationId || response.artifactChunkId !== metadata.artifactChunkId) {
+    throw new Error(
+      "raw artifact POST acknowledgement identifiers did not match"
+    );
+  }
+  return {
+    ok: true,
+    status: response.status,
+    artifactId: metadata.artifactId,
+    artifactGenerationId: metadata.artifactGenerationId,
+    artifactChunkId: metadata.artifactChunkId,
+    ...response.installIdentityPersisted === true ? { installIdentityPersisted: true } : {}
+  };
+}
+function retryAtMsFromHeader(retryAfter, nowMs) {
+  const normalized = retryAfter?.trim();
+  const minimumRetryAtMs = Math.min(
+    Number.MAX_SAFE_INTEGER,
+    nowMs + MIN_RATE_LIMIT_RETRY_MS
+  );
+  const maximumRetryAtMs = Math.min(
+    Number.MAX_SAFE_INTEGER,
+    nowMs + MAX_RATE_LIMIT_RETRY_MS
+  );
+  if (normalized && /^\d+$/.test(normalized)) {
+    const seconds = Number(normalized);
+    if (Number.isSafeInteger(seconds)) {
+      return Math.max(
+        minimumRetryAtMs,
+        Math.min(maximumRetryAtMs, nowMs + seconds * 1e3)
+      );
+    }
+  }
+  if (normalized) {
+    const parsedDate = Date.parse(normalized);
+    if (Number.isFinite(parsedDate)) {
+      return Math.max(minimumRetryAtMs, Math.min(maximumRetryAtMs, parsedDate));
+    }
+  }
+  return Math.min(maximumRetryAtMs, nowMs + RATE_LIMIT_RETRY_FALLBACK_MS);
+}
+function activeRetryAtMs(throttle, nowMs) {
+  if (!throttle || throttle.retryAtMs <= nowMs) return void 0;
+  return Math.min(
+    throttle.retryAtMs,
+    Math.min(Number.MAX_SAFE_INTEGER, nowMs + MAX_RATE_LIMIT_RETRY_MS)
+  );
+}
+function retryBackoffMs(entry) {
+  const exponent = Math.max(0, entry.uploadAttempts - 1);
+  const baseDelay = Math.min(
+    RETRY_BACKOFF_MAX_MS,
+    RETRY_BACKOFF_BASE_MS * 2 ** exponent
+  );
+  const jitterSeed = Number.parseInt(
+    sha256Hex(`${entry.artifactId}\0${entry.uploadAttempts}`).slice(0, 8),
+    16
+  );
+  const jitter = 0.75 + jitterSeed / 4294967295 * 0.5;
+  return Math.round(baseDelay * jitter);
+}
+function isUploadableEntry(entry, nowMs, retryExhausted) {
+  return (entry.status === "pending" || entry.status === "failed") && (retryExhausted || entry.uploadAttempts < MAX_UPLOAD_ATTEMPTS) && (entry.status !== "failed" || entry.lastAttemptAtMs === void 0 || nowMs - entry.lastAttemptAtMs >= retryBackoffMs(entry));
+}
+function isRunnableForDestination(entry, uploadDestinationId, nowMs, retryExhausted) {
+  if (!needsUploadForDestination(entry, uploadDestinationId)) return false;
+  if (entry.uploadDestinationId !== uploadDestinationId && !canPreserveRetryStateOnDestinationActivation(entry)) {
+    return true;
+  }
+  return isUploadableEntry(entry, nowMs, retryExhausted);
+}
+function needsUploadForDestination(entry, uploadDestinationId) {
+  if (!artifactSourceEnabled(entry.source)) return false;
+  if (entry.sizeBytes === 0) return false;
+  if (entry.uploadDestinationId !== uploadDestinationId) return true;
+  return entry.status === "pending" || entry.status === "failed";
+}
+function entryRetryAtMs(entry, retryExhausted) {
+  if (entry.status !== "failed" || entry.lastAttemptAtMs === void 0) {
+    return void 0;
+  }
+  if (!retryExhausted && entry.uploadAttempts >= MAX_UPLOAD_ATTEMPTS) {
+    return void 0;
+  }
+  return entry.lastAttemptAtMs + retryBackoffMs(entry);
+}
+function nextRetryAtMsForDestination(artifacts, uploadDestinationId, nowMs, retryExhausted) {
+  let nextRetryAtMs;
+  for (const entry of artifacts) {
+    if (!needsUploadForDestination(entry, uploadDestinationId)) continue;
+    if (isRunnableForDestination(
+      entry,
+      uploadDestinationId,
+      nowMs,
+      retryExhausted
+    )) {
+      continue;
+    }
+    const retryAtMs = entryRetryAtMs(entry, retryExhausted);
+    if (retryAtMs === void 0) continue;
+    nextRetryAtMs = nextRetryAtMs === void 0 ? retryAtMs : Math.min(nextRetryAtMs, retryAtMs);
+  }
+  return nextRetryAtMs;
+}
+function isExhaustedForDestination(entry, uploadDestinationId, retryExhausted) {
+  return artifactSourceEnabled(entry.source) && !retryExhausted && entry.sizeBytes > 0 && (entry.uploadDestinationId === uploadDestinationId || canPreserveRetryStateOnDestinationActivation(entry)) && entry.status === "failed" && entry.uploadAttempts >= MAX_UPLOAD_ATTEMPTS;
+}
+function resolveUploadRun(options, lock) {
+  const nowMs = options.nowMs ?? Date.now;
+  const targetName = options.targetName ?? options.targetUrl;
+  return {
+    nowMs,
+    limit: options.limit ?? DEFAULT_UPLOAD_LIMIT,
+    maxUploadBytes: Math.max(
+      1,
+      Math.floor(options.maxUploadBytes ?? DEFAULT_UPLOAD_BYTE_LIMIT)
+    ),
+    chunkSizeBytes: Math.min(
+      MAX_UPLOAD_CHUNK_BYTES,
+      Math.max(
+        1,
+        Math.floor(options.chunkSizeBytes ?? DEFAULT_UPLOAD_CHUNK_BYTES)
+      )
+    ),
+    maxFileBytes: Math.max(
+      1,
+      Math.floor(options.maxFileBytes ?? DEFAULT_MAX_ARTIFACT_BYTES)
+    ),
+    targetName,
+    uploadDestinationId: buildUploadDestinationId({
+      targetUrl: options.targetUrl,
+      targetName,
+      authorization: options.authorization,
+      organization: options.organization,
+      destinationIdentity: options.destinationIdentity
+    }),
+    retryExhausted: options.retryExhausted ?? false,
+    lock
+  };
+}
+function skippedUploadResult(queue, uploadDestinationId, nowMs, retryExhausted) {
+  const retryAtMs = activeRetryAtMs(
+    queue.uploadThrottles?.[uploadDestinationId],
+    nowMs
+  );
+  return {
+    attempted: 0,
+    uploaded: 0,
+    uploadedChunks: 0,
+    uploadedBytes: 0,
+    failed: 0,
+    exhausted: queue.artifacts.filter(
+      (entry) => isExhaustedForDestination(entry, uploadDestinationId, retryExhausted)
+    ).length,
+    refreshed: 0,
+    retryAtMs,
+    nextRetryAtMs: nextRetryAtMsForDestination(
+      queue.artifacts,
+      uploadDestinationId,
+      nowMs,
+      retryExhausted
+    ),
+    hasRunnable: retryAtMs === void 0 && queue.artifacts.some(
+      (entry) => isRunnableForDestination(
+        entry,
+        uploadDestinationId,
+        nowMs,
+        retryExhausted
+      )
+    ),
+    hasMore: queue.artifacts.some(
+      (entry) => needsUploadForDestination(entry, uploadDestinationId)
+    ),
+    skipped: true,
+    queue
+  };
+}
+async function syncArtifacts(options) {
+  const nowMs = options.nowMs ?? Date.now;
+  const lock = acquireQueueLock(options.queueFile, {
+    nowMs,
+    isPidAlive: options.isPidAlive ?? defaultIsPidAlive
+  });
+  const targetName = options.targetName ?? options.targetUrl;
+  const uploadDestinationId = buildUploadDestinationId({
+    targetUrl: options.targetUrl,
+    targetName,
+    authorization: options.authorization,
+    organization: options.organization,
+    destinationIdentity: options.destinationIdentity
+  });
+  if (!lock) {
+    const queue = readArtifactQueue(options.queueFile);
+    return {
+      snapshot: {
+        queued: 0,
+        skipped: 0,
+        oversized: [],
+        queue
+      },
+      upload: skippedUploadResult(
+        queue,
+        uploadDestinationId,
+        nowMs(),
+        options.retryExhausted ?? false
+      )
+    };
+  }
+  try {
+    const snapshot = snapshotArtifactsLocked(
+      {
+        queueFile: options.queueFile,
+        candidates: options.candidates,
+        nowMs,
+        maxFileBytes: options.maxFileBytes,
+        observerIdentity: options.observerIdentity
+      },
+      lock
+    );
+    if (!lock.heartbeat()) {
+      throw new Error("artifact queue lock ownership was lost");
+    }
+    const upload = await uploadPendingArtifactsLocked(
+      options,
+      resolveUploadRun(options, lock)
+    );
+    return { snapshot, upload };
+  } finally {
+    lock.release();
+  }
+}
+async function uploadPendingArtifactsLocked(options, run) {
+  const {
+    nowMs,
+    limit,
+    maxUploadBytes,
+    chunkSizeBytes,
+    maxFileBytes,
+    targetName,
+    uploadDestinationId,
+    retryExhausted,
+    lock
+  } = run;
+  const queue = readArtifactQueue(options.queueFile);
+  const entries = queue.artifacts.filter((entry) => artifactSourceEnabled(entry.source)).map(
+    (entry) => activateUploadDestination(entry, uploadDestinationId, targetName)
+  );
+  const selectionTimeMs = nowMs();
+  const persistedThrottle = queue.uploadThrottles?.[uploadDestinationId];
+  let retryAtMs = activeRetryAtMs(persistedThrottle, selectionTimeMs);
+  const uploadThrottles = {};
+  if (persistedThrottle && retryAtMs !== void 0) {
+    uploadThrottles[uploadDestinationId] = {
+      ...persistedThrottle,
+      retryAtMs
+    };
+  }
+  const pending = retryAtMs ? [] : entries.filter(
+    (entry) => isUploadableEntry(entry, selectionTimeMs, retryExhausted)
+  );
+  const selected = [
+    ...pending.filter((entry) => entry.status === "pending"),
+    ...pending.filter((entry) => entry.status === "failed")
+  ].slice(0, limit);
+  let attempted = 0;
+  let uploaded = 0;
+  let uploadedChunks = 0;
+  let uploadedBytes = 0;
+  let failed = 0;
+  let refreshed = 0;
+  const persist = () => {
+    if (!lock.heartbeat()) {
+      throw new Error("artifact queue lock ownership was lost");
+    }
+    writeArtifactQueue(options.queueFile, {
+      schemaVersion: RAW_ARTIFACT_SCHEMA_VERSION,
+      artifacts: entries,
+      uploadThrottles: Object.keys(uploadThrottles).length > 0 ? uploadThrottles : void 0
+    });
+    if (!lock.heartbeat()) {
+      throw new Error("artifact queue lock ownership was lost");
+    }
+  };
+  persist();
+  for (const entry of selected) {
+    if (uploadedBytes >= maxUploadBytes) break;
+    const index = entries.findIndex(
+      (candidate) => candidate.artifactKey === entry.artifactKey
+    );
+    if (index < 0) continue;
+    const attemptAtMs = nowMs();
+    entries[index] = {
+      ...entries[index],
+      uploadAttempts: entries[index].uploadAttempts + 1,
+      lastAttemptAtMs: attemptAtMs
+    };
+    persist();
+    try {
+      let current = entries[index];
+      let sourceRefreshesThisAttempt = 0;
+      let validatedPrefix;
+      const refreshSourceSnapshot = () => {
+        const snapshot = snapshotCandidate(
+          {
+            artifactType: current.artifactType,
+            source: current.source,
+            sourcePath: current.sourcePath,
+            identityKey: current.identityKey,
+            readPath: current.readPath,
+            sessionId: current.sessionId,
+            metadata: current.metadata
+          },
+          current,
+          nowMs(),
+          maxFileBytes,
+          // Only a definitively removed or no-longer-eligible source may drop
+          // the entry (and its watermark). A transient stat failure throws at
+          // the stat itself — no re-stat race — and surfaces as a failed
+          // attempt, so the retry backoff applies and progress survives.
+          "throw"
+        );
+        if (!snapshot) {
+          entries.splice(index, 1);
+          refreshed += 1;
+          validatedPrefix = void 0;
+          persist();
+          return false;
+        }
+        entries[index] = snapshot.artifactGenerationId === current.artifactGenerationId ? {
+          ...snapshot,
+          uploadAttempts: current.uploadAttempts,
+          lastAttemptAtMs: current.lastAttemptAtMs
+        } : snapshot;
+        current = entries[index];
+        refreshed += 1;
+        sourceRefreshesThisAttempt += 1;
+        validatedPrefix = void 0;
+        persist();
+        return sourceRefreshesThisAttempt <= 1;
+      };
+      const resetCurrentGeneration = () => {
+        const reset = startNewGenerationFromEntry(current, nowMs());
+        if (reset) {
+          entries[index] = activateUploadDestination(
+            reset,
+            uploadDestinationId,
+            targetName
+          );
+          current = entries[index];
+        } else {
+          entries.splice(index, 1);
+        }
+        refreshed += 1;
+        validatedPrefix = void 0;
+        persist();
+      };
+      while (uploadedBytes < maxUploadBytes) {
+        if (current.readPath !== void 0 && !safeStat(current.readPath)?.isFile() && statCandidateSource(current.sourcePath, "throw") !== null) {
+          break;
+        }
+        const inFlight = current.inFlightChunk;
+        if (inFlight) {
+          const metadata2 = inFlight.metadata;
+          if (inFlight.uploadDestinationId !== uploadDestinationId || metadata2.artifactGenerationId !== current.artifactGenerationId) {
+            resetCurrentGeneration();
+            break;
+          }
+          const stableRange2 = readFileRangeAtRevision(
+            artifactReadPath(current),
+            metadata2.chunkStartByte,
+            metadata2.chunkEndByte
+          );
+          if (!stableRange2 || stableRange2.bytes.length !== metadata2.chunkSizeBytes || sha256Hex(stableRange2.bytes) !== metadata2.chunkSha256) {
+            resetCurrentGeneration();
+            break;
+          }
+          const chunk2 = stableRange2.bytes;
+          attempted += 1;
+          if (!lock.heartbeat()) {
+            throw new Error("artifact queue lock ownership was lost");
+          }
+          const response2 = await postRawArtifact(
+            rawArtifactUrl(options.targetUrl),
+            metadata2,
+            chunk2,
+            rawArtifactRequestHeaders(options),
+            options.fetch
+          );
+          if (!lock.heartbeat()) {
+            throw new Error("artifact queue lock ownership was lost");
+          }
+          const checkpoint2 = {
+            chunkStartByte: metadata2.chunkStartByte,
+            chunkEndByte: metadata2.chunkEndByte,
+            chunkSha256: metadata2.chunkSha256
+          };
+          const checkpoints = withAcknowledgedCheckpoint(current, checkpoint2);
+          const sourceRevisionAfter2 = safeSourceRevision(
+            artifactReadPath(current)
+          );
+          const identityPersistenceUnconfirmed2 = rawUploadLeavesFinalIdentityUnconfirmed(
+            current,
+            metadata2,
+            response2
+          );
+          const replayedCurrentFinalChunk = metadata2.chunkEndByte === current.sizeBytes && metadata2.sizeBytes === current.sizeBytes;
+          let complete2 = false;
+          let completedValidation;
+          if (replayedCurrentFinalChunk && sourceRevisionAfter2 && sameSourceRevision(stableRange2.revision, sourceRevisionAfter2)) {
+            const validation = validateCheckpointPrefix({
+              sourcePath: artifactReadPath(current),
+              checkpoints,
+              expectedEndByte: current.sizeBytes,
+              expectedRevision: sourceRevisionAfter2
+            });
+            if (validation.status === "mismatch") {
+              uploadedChunks += 1;
+              uploadedBytes += chunk2.length;
+              resetCurrentGeneration();
+              break;
+            }
+            if (validation.status === "valid" && validation.contentSha256 === metadata2.contentSha256) {
+              complete2 = true;
+              completedValidation = validation;
+            } else if (validation.status === "valid") {
+              uploadedChunks += 1;
+              uploadedBytes += chunk2.length;
+              resetCurrentGeneration();
+              break;
+            }
+          }
+          entries[index] = {
+            ...current,
+            contentSha256: complete2 ? metadata2.contentSha256 : void 0,
+            status: complete2 ? "uploaded" : "pending",
+            uploadedSizeBytes: metadata2.chunkEndByte,
+            uploadedRepositoryContextRevision: acknowledgedRepositoryContextRevision(current, metadata2),
+            uploadedIdentitySignature: rawUploadAcknowledgedIdentitySignature(
+              current,
+              metadata2,
+              response2
+            ),
+            lastUploadedChunkStartByte: metadata2.chunkStartByte,
+            lastUploadedChunkEndByte: metadata2.chunkEndByte,
+            lastUploadedChunkSha256: metadata2.chunkSha256,
+            uploadedChunkCheckpoints: checkpoints,
+            uploadDestinationId,
+            uploadTarget: targetName,
+            inFlightChunk: void 0,
+            uploadedAtMs: complete2 ? nowMs() : void 0,
+            // Byte progress normally resets the retry budget, but a duplicate
+            // final chunk without identity confirmation made no progress on
+            // the remaining work and must consume the current attempt.
+            uploadAttempts: identityPersistenceUnconfirmed2 ? current.uploadAttempts : 1,
+            lastAttemptAtMs: entries[index].lastAttemptAtMs,
+            lastError: void 0
+          };
+          current = entries[index];
+          if (identityPersistenceUnconfirmed2) {
+            entries[index] = {
+              ...current,
+              status: "failed",
+              uploadedAtMs: void 0,
+              lastError: UNCONFIRMED_IDENTITY_PERSISTENCE_ERROR
+            };
+            current = entries[index];
+          }
+          validatedPrefix = completedValidation ? {
+            artifactGenerationId: current.artifactGenerationId,
+            uploadDestinationId,
+            sourcePath: artifactReadPath(current),
+            revision: completedValidation.revision,
+            verifiedThroughByte: current.uploadedSizeBytes,
+            contentSha256: completedValidation.contentSha256
+          } : void 0;
+          uploadedChunks += 1;
+          uploadedBytes += chunk2.length;
+          if (identityPersistenceUnconfirmed2) failed += 1;
+          else if (complete2) uploaded += 1;
+          persist();
+          if (identityPersistenceUnconfirmed2) break;
+          if (complete2 && !metadataAmendmentNeedsUpload(current)) break;
+          continue;
+        }
+        const stat = safeStat(artifactReadPath(current));
+        const decodedOutlivedSource = current.readPath !== void 0 && statCandidateSource(current.sourcePath, "throw") === null;
+        if (!stat?.isFile() || decodedOutlivedSource) {
+          entries.splice(index, 1);
+          refreshed += 1;
+          persist();
+          break;
+        }
+        const mtimeMs = statMtimeMs(stat);
+        if (stat.size !== current.sizeBytes || mtimeMs !== current.mtimeMs) {
+          if (!refreshSourceSnapshot()) break;
+        }
+        const sourceRevision = safeSourceRevision(artifactReadPath(current));
+        if (!sourceRevision) {
+          entries.splice(index, 1);
+          refreshed += 1;
+          persist();
+          break;
+        }
+        if (!validatedPrefixStillApplies(
+          validatedPrefix,
+          current,
+          uploadDestinationId,
+          sourceRevision
+        )) {
+          const validation = validateCheckpointPrefix({
+            sourcePath: artifactReadPath(current),
+            checkpoints: acknowledgedCheckpoints(current),
+            expectedEndByte: current.uploadedSizeBytes,
+            expectedRevision: sourceRevision
+          });
+          if (validation.status === "mismatch") {
+            resetCurrentGeneration();
+            break;
+          }
+          if (validation.status === "changed") {
+            if (!refreshSourceSnapshot()) break;
+            continue;
+          }
+          validatedPrefix = {
+            artifactGenerationId: current.artifactGenerationId,
+            uploadDestinationId,
+            sourcePath: artifactReadPath(current),
+            revision: validation.revision,
+            verifiedThroughByte: current.uploadedSizeBytes,
+            contentSha256: validation.contentSha256
+          };
+        }
+        if (current.uploadedSizeBytes >= current.sizeBytes) {
+          if (metadataAmendmentNeedsUpload(current)) {
+            const finalCheckpoint = acknowledgedCheckpoints(current).find(
+              (checkpoint2) => checkpoint2.chunkEndByte === current.sizeBytes
+            );
+            if (!finalCheckpoint || !validatedPrefix || !validatedPrefix.contentSha256) {
+              resetCurrentGeneration();
+              break;
+            }
+            const stableRange2 = readFileRangeAtRevision(
+              artifactReadPath(current),
+              finalCheckpoint.chunkStartByte,
+              finalCheckpoint.chunkEndByte,
+              validatedPrefix.revision
+            );
+            if (!stableRange2 || sha256Hex(stableRange2.bytes) !== finalCheckpoint.chunkSha256) {
+              resetCurrentGeneration();
+              break;
+            }
+            const metadata2 = uploadMetadata({
+              entry: current,
+              chunkStartByte: finalCheckpoint.chunkStartByte,
+              chunkEndByte: finalCheckpoint.chunkEndByte,
+              chunk: stableRange2.bytes,
+              contentSha256: validatedPrefix.contentSha256
+            });
+            entries[index] = {
+              ...current,
+              inFlightChunk: { uploadDestinationId, metadata: metadata2 }
+            };
+            current = entries[index];
+            persist();
+            continue;
+          }
+          entries[index] = {
+            ...current,
+            status: "uploaded",
+            uploadDestinationId,
+            uploadTarget: targetName,
+            uploadedAtMs: nowMs(),
+            lastError: void 0
+          };
+          uploaded += 1;
+          persist();
+          break;
+        }
+        if (maxUploadBytes - uploadedBytes <= 0) break;
+        const generationChunkSizeBytes = current.uploadChunkSizeBytes ?? chunkSizeBytes;
+        if (current.uploadChunkSizeBytes === void 0) {
+          entries[index] = {
+            ...current,
+            uploadChunkSizeBytes: generationChunkSizeBytes
+          };
+          current = entries[index];
+          persist();
+        }
+        const chunkStartByte = current.uploadedSizeBytes;
+        const chunkEndByte = Math.min(
+          current.sizeBytes,
+          chunkStartByte + generationChunkSizeBytes
+        );
+        const stableRange = readFileRangeAtRevision(
+          artifactReadPath(current),
+          chunkStartByte,
+          chunkEndByte,
+          sourceRevision
+        );
+        if (!stableRange) {
+          if (!refreshSourceSnapshot()) break;
+          continue;
+        }
+        const chunk = stableRange.bytes;
+        const complete = chunkEndByte >= current.sizeBytes;
+        const checkpoint = {
+          chunkStartByte,
+          chunkEndByte,
+          chunkSha256: sha256Hex(chunk)
+        };
+        let contentSha256;
+        if (complete) {
+          const validation = validateCheckpointPrefix({
+            sourcePath: artifactReadPath(current),
+            checkpoints: withAcknowledgedCheckpoint(current, checkpoint),
+            expectedEndByte: current.sizeBytes,
+            expectedRevision: stableRange.revision
+          });
+          if (validation.status === "mismatch") {
+            resetCurrentGeneration();
+            break;
+          }
+          if (validation.status === "changed") {
+            if (!refreshSourceSnapshot()) break;
+            continue;
+          }
+          contentSha256 = validation.contentSha256;
+        }
+        const metadata = uploadMetadata({
+          entry: current,
+          chunkStartByte,
+          chunkEndByte,
+          chunk,
+          contentSha256
+        });
+        entries[index] = {
+          ...current,
+          inFlightChunk: {
+            uploadDestinationId,
+            metadata
+          }
+        };
+        current = entries[index];
+        persist();
+        attempted += 1;
+        if (!lock.heartbeat()) {
+          throw new Error("artifact queue lock ownership was lost");
+        }
+        const response = await postRawArtifact(
+          rawArtifactUrl(options.targetUrl),
+          metadata,
+          chunk,
+          rawArtifactRequestHeaders(options),
+          options.fetch
+        );
+        if (!lock.heartbeat()) {
+          throw new Error("artifact queue lock ownership was lost");
+        }
+        const sourceRevisionAfter = safeSourceRevision(
+          artifactReadPath(current)
+        );
+        const acknowledgedComplete = complete && sourceRevisionAfter !== null && sameSourceRevision(stableRange.revision, sourceRevisionAfter);
+        const identityPersistenceUnconfirmed = rawUploadLeavesFinalIdentityUnconfirmed(current, metadata, response);
+        entries[index] = {
+          ...current,
+          contentSha256: acknowledgedComplete ? contentSha256 : void 0,
+          status: acknowledgedComplete ? "uploaded" : "pending",
+          uploadChunkSizeBytes: generationChunkSizeBytes,
+          uploadedSizeBytes: chunkEndByte,
+          uploadedRepositoryContextRevision: acknowledgedRepositoryContextRevision(current, metadata),
+          uploadedIdentitySignature: rawUploadAcknowledgedIdentitySignature(
+            current,
+            metadata,
+            response
+          ),
+          lastUploadedChunkStartByte: chunkStartByte,
+          lastUploadedChunkEndByte: chunkEndByte,
+          lastUploadedChunkSha256: metadata.chunkSha256,
+          uploadedChunkCheckpoints: withAcknowledgedCheckpoint(
+            current,
+            checkpoint
+          ),
+          uploadDestinationId,
+          uploadTarget: targetName,
+          inFlightChunk: void 0,
+          uploadedAtMs: acknowledgedComplete ? nowMs() : void 0,
+          // Byte progress normally resets the retry budget, but a duplicate
+          // final chunk without identity confirmation made no progress on
+          // the remaining work and must consume the current attempt.
+          uploadAttempts: identityPersistenceUnconfirmed ? current.uploadAttempts : 1,
+          lastAttemptAtMs: entries[index].lastAttemptAtMs,
+          lastError: void 0
+        };
+        current = entries[index];
+        if (identityPersistenceUnconfirmed) {
+          entries[index] = {
+            ...current,
+            status: "failed",
+            uploadedAtMs: void 0,
+            lastError: UNCONFIRMED_IDENTITY_PERSISTENCE_ERROR
+          };
+          current = entries[index];
+        }
+        validatedPrefix = sourceRevisionAfter && sameSourceRevision(stableRange.revision, sourceRevisionAfter) ? {
+          artifactGenerationId: current.artifactGenerationId,
+          uploadDestinationId,
+          sourcePath: artifactReadPath(current),
+          revision: sourceRevisionAfter,
+          verifiedThroughByte: current.uploadedSizeBytes,
+          contentSha256
+        } : void 0;
+        uploadedChunks += 1;
+        uploadedBytes += chunk.length;
+        if (identityPersistenceUnconfirmed) failed += 1;
+        else if (acknowledgedComplete) uploaded += 1;
+        persist();
+        if (identityPersistenceUnconfirmed) break;
+        if (acknowledgedComplete) break;
+      }
+    } catch (error) {
+      const failureIndex = entries.findIndex(
+        (candidate) => candidate.artifactKey === entry.artifactKey
+      );
+      if (isAbortError(error)) {
+        if (failureIndex >= 0) {
+          const current = entries[failureIndex];
+          entries[failureIndex] = {
+            ...current,
+            // Cancellation is a lifecycle event, not an upload failure. Undo
+            // this run's attempt bookkeeping while retaining the current
+            // persisted request descriptor for an exact replay. Restoring the
+            // selected entry also preserves a prior real failure and backoff.
+            status: entry.status,
+            uploadAttempts: entry.uploadAttempts,
+            lastAttemptAtMs: entry.lastAttemptAtMs,
+            lastError: entry.lastError
+          };
+          persist();
+        }
+        throw error;
+      }
+      if (failureIndex < 0) {
+        failed += 1;
+        persist();
+        continue;
+      }
+      const identityReplayConflict = entry.uploadedSizeBytes >= entry.sizeBytes && identityNeedsUpload(entry);
+      if (error instanceof RawArtifactPostError && error.status === 409 && error.code === "CONFLICT" && !identityReplayConflict) {
+        const reset = startNewGenerationFromEntry(
+          entries[failureIndex],
+          nowMs()
+        );
+        if (reset) {
+          entries[failureIndex] = activateUploadDestination(
+            reset,
+            uploadDestinationId,
+            targetName
+          );
+        } else {
+          entries.splice(failureIndex, 1);
+        }
+        refreshed += 1;
+        persist();
+        continue;
+      }
+      if (error instanceof RawArtifactPostError && error.status === 429) {
+        const throttledAtMs = nowMs();
+        retryAtMs = retryAtMsFromHeader(error.retryAfter, throttledAtMs);
+        uploadThrottles[uploadDestinationId] = {
+          retryAtMs,
+          status: 429,
+          code: error.code
+        };
+        const current = entries[failureIndex];
+        if (current.artifactGenerationId === entry.artifactGenerationId && current.uploadedSizeBytes === entry.uploadedSizeBytes) {
+          entries[failureIndex] = {
+            ...current,
+            status: entry.status,
+            uploadAttempts: entry.uploadAttempts,
+            lastAttemptAtMs: entry.lastAttemptAtMs,
+            lastError: entry.lastError
+          };
+        }
+        persist();
+        break;
+      }
+      entries[failureIndex] = {
+        ...entries[failureIndex],
+        status: "failed",
+        lastError: error instanceof Error ? error.message : String(error)
+      };
+      failed += 1;
+      persist();
+    }
+  }
+  const nextQueue = readArtifactQueue(options.queueFile);
+  const completedAtMs = nowMs();
+  const exhausted = nextQueue.artifacts.filter(
+    (entry) => isExhaustedForDestination(entry, uploadDestinationId, retryExhausted)
+  ).length;
+  return {
+    attempted,
+    uploaded,
+    uploadedChunks,
+    uploadedBytes,
+    failed,
+    exhausted,
+    refreshed,
+    retryAtMs,
+    nextRetryAtMs: nextRetryAtMsForDestination(
+      nextQueue.artifacts,
+      uploadDestinationId,
+      completedAtMs,
+      retryExhausted
+    ),
+    hasRunnable: retryAtMs === void 0 && nextQueue.artifacts.some(
+      (entry) => isRunnableForDestination(
+        entry,
+        uploadDestinationId,
+        completedAtMs,
+        retryExhausted
+      )
+    ),
+    hasMore: nextQueue.artifacts.some(
+      (entry) => needsUploadForDestination(entry, uploadDestinationId)
+    ),
+    skipped: false,
+    queue: nextQueue
+  };
+}
+
+// ../../packages/panopticon/src/raw-sync.ts
+import path18 from "path";
+
+// ../../packages/panopticon/src/artifact-materializer.ts
+import fs8 from "fs";
+function entryNeedsBytes(entry, amendmentPending) {
+  if (entry.uploadedSizeBytes < entry.sizeBytes) return true;
+  return amendmentPending(entry);
+}
+function createArtifactMaterializer(input) {
+  const maxTotalBytes = input.maxTotalBytes ?? DEFAULT_MATERIALIZED_CACHE_BYTES;
+  const satisfiedSources = new Set(
+    input.entries.filter((entry) => !entryNeedsBytes(entry, input.amendmentPending)).map((entry) => entry.sourcePath)
+  );
+  const retained = /* @__PURE__ */ new Set();
+  let spentBytes = 0;
+  const unsupportedReason = (input.supportsCompression ?? supportsCompressedArtifacts)() ? void 0 : `compressed artifacts need Node 22.15 or newer (running ${process.version})`;
+  const chargeExisting = (cachePath) => {
+    try {
+      const stat = fs8.statSync(cachePath);
+      if (!stat.isFile()) return false;
+      if (!retained.has(cachePath)) {
+        retained.add(cachePath);
+        spentBytes += stat.size;
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  return {
+    unsupportedReason,
+    materialize: (sourcePath) => {
+      if (unsupportedReason) return null;
+      if (satisfiedSources.has(sourcePath)) return null;
+      const cachePath = materializedArtifactPath({
+        sourcePath,
+        cacheDir: input.cacheDir
+      });
+      if (cachePath && chargeExisting(cachePath)) return cachePath;
+      if (spentBytes >= maxTotalBytes) return null;
+      const materialized = materializeCompressedArtifact({
+        sourcePath,
+        cacheDir: input.cacheDir
+      });
+      if (!materialized) return null;
+      chargeExisting(materialized);
+      return materialized;
+    },
+    retained: () => retained
+  };
+}
+
+// ../../packages/panopticon/src/raw-sync.ts
+var DEFAULT_RAW_SYNC_MAX_DRAIN_PASSES = 10;
+var DEFAULT_RAW_SYNC_MAX_DRAIN_BYTES = 100 * 1024 * 1024;
+var DEFAULT_RAW_SYNC_MAX_DRAIN_MS = 6e4;
+function getRawArtifactSyncPaths(stateDir) {
+  if (stateDir.length === 0) {
+    throw new Error("raw artifact sync state directory must not be empty");
+  }
+  const root = path18.resolve(stateDir);
+  const managed = getManagedClientPaths({ PANOPTICON_HOME: root });
+  return {
+    root,
+    settingsFile: managed.syncSettingsFile,
+    queueFile: managed.artifactQueue,
+    artifactCacheDir: managed.artifactCache
+  };
+}
+function summarizeArtifactQueue(queue) {
+  let pending = 0;
+  let uploaded = 0;
+  let failed = 0;
+  let rawPending = 0;
+  let metadataPending = 0;
+  let uploadedBytes = 0;
+  let totalBytes = 0;
+  for (const artifact of queue.artifacts) {
+    if (artifact.status === "pending") pending += 1;
+    if (artifact.status === "uploaded") uploaded += 1;
+    if (artifact.status === "failed") failed += 1;
+    if (artifact.uploadedSizeBytes < artifact.sizeBytes) rawPending += 1;
+    if (artifact.uploadedSizeBytes >= artifact.sizeBytes && metadataAmendmentNeedsUpload(artifact)) {
+      metadataPending += 1;
+    }
+    uploadedBytes += Math.min(artifact.uploadedSizeBytes, artifact.sizeBytes);
+    totalBytes += artifact.sizeBytes;
+  }
+  return {
+    tracked: queue.artifacts.length,
+    pending,
+    uploaded,
+    failed,
+    rawPending,
+    metadataPending,
+    uploadedBytes,
+    totalBytes,
+    remainingBytes: Math.max(0, totalBytes - uploadedBytes)
+  };
+}
+function mergeOversizedArtifacts(...groups) {
+  const byPath = /* @__PURE__ */ new Map();
+  for (const group of groups) {
+    for (const artifact of group) byPath.set(artifact.sourcePath, artifact);
+  }
+  return [...byPath.values()];
+}
+function uploadOutcome(upload) {
+  if (upload.skipped) return "busy";
+  if (upload.failed > 0) return "failed";
+  if (upload.exhausted > 0) return "exhausted";
+  if (upload.retryAtMs !== void 0) return "throttled";
+  if (!upload.hasMore) return "drained";
+  return upload.hasRunnable ? "pending" : "backing_off";
+}
+function positiveInteger(value, fallback) {
+  return value === void 0 || !Number.isFinite(value) ? fallback : Math.max(1, Math.floor(value));
+}
+function createRawArtifactSync(options) {
+  const paths = getRawArtifactSyncPaths(options.stateDir);
+  const maxDrainPasses = positiveInteger(
+    options.maxDrainPasses,
+    DEFAULT_RAW_SYNC_MAX_DRAIN_PASSES
+  );
+  const maxDrainBytes = positiveInteger(
+    options.maxDrainBytes,
+    DEFAULT_RAW_SYNC_MAX_DRAIN_BYTES
+  );
+  const maxDrainMs = positiveInteger(
+    options.maxDrainMs,
+    DEFAULT_RAW_SYNC_MAX_DRAIN_MS
+  );
+  let lastMaterializer;
+  const getSettings = () => readSyncSettings(paths.settingsFile);
+  const status = () => ({
+    settings: getSettings(),
+    queue: summarizeArtifactQueue(readArtifactQueue(paths.queueFile))
+  });
+  const discover = () => {
+    const materializer = createArtifactMaterializer({
+      cacheDir: paths.artifactCacheDir,
+      entries: readArtifactQueue(paths.queueFile).artifacts,
+      amendmentPending: metadataAmendmentNeedsUpload,
+      maxTotalBytes: options.maxArtifactCacheBytes
+    });
+    lastMaterializer = materializer;
+    const discovery = discoverArtifacts({
+      homeDir: options.homeDir,
+      projectRoots: options.projectRoots,
+      maxFileBytes: options.maxFileBytes,
+      materializeArtifact: materializer.materialize
+    });
+    return materializer.unsupportedReason ? {
+      ...discovery,
+      compressedArtifactsUnsupportedReason: materializer.unsupportedReason
+    } : discovery;
+  };
+  return {
+    paths,
+    getSettings,
+    setEnabled: (enabled) => setSyncEnabled(paths.settingsFile, enabled),
+    status,
+    discover,
+    reset: () => {
+      const result = resetArtifactQueue({
+        queueFile: paths.queueFile,
+        nowMs: options.nowMs,
+        isPidAlive: options.isPidAlive
+      });
+      return {
+        reset: result.reset,
+        removed: result.removed,
+        skipped: result.skipped,
+        status: {
+          settings: getSettings(),
+          queue: summarizeArtifactQueue(result.queue)
+        }
+      };
+    },
+    run: async (transport) => {
+      if (!getSettings().enabled) {
+        return {
+          outcome: "disabled",
+          enabled: false,
+          syncPasses: 0,
+          drained: false,
+          status: status()
+        };
+      }
+      const discovery = discover();
+      const syncOptions = {
+        queueFile: paths.queueFile,
+        candidates: discovery.candidates,
+        maxFileBytes: options.maxFileBytes,
+        observerIdentity: options.observerIdentity,
+        retryExhausted: options.retryExhausted,
+        nowMs: options.nowMs,
+        isPidAlive: options.isPidAlive,
+        targetUrl: transport.targetUrl,
+        targetName: transport.targetName ?? transport.targetUrl,
+        authorization: transport.authorization,
+        organization: transport.organization,
+        destinationIdentity: transport.destinationIdentity,
+        fetch: transport.fetch
+      };
+      const startedAtMs = (options.nowMs ?? Date.now)();
+      const runPass = async (uploadedSoFar) => await syncArtifacts({
+        ...syncOptions,
+        maxUploadBytes: Math.min(
+          DEFAULT_UPLOAD_BYTE_LIMIT,
+          Math.max(1, maxDrainBytes - uploadedSoFar)
+        )
+      });
+      let sync = await runPass(0);
+      let syncPasses = 1;
+      let snapshotQueued = sync.snapshot.queued;
+      let snapshotSkipped = sync.snapshot.skipped;
+      let attempted = sync.upload.attempted;
+      let uploaded = sync.upload.uploaded;
+      let uploadedChunks = sync.upload.uploadedChunks;
+      let uploadedBytes = sync.upload.uploadedBytes;
+      let failed = sync.upload.failed;
+      let exhausted = sync.upload.exhausted;
+      let refreshed = sync.upload.refreshed;
+      let oversized = mergeOversizedArtifacts(
+        discovery.oversized,
+        sync.snapshot.oversized
+      );
+      while (sync.upload.hasMore && sync.upload.hasRunnable && !sync.upload.skipped && sync.upload.failed === 0 && sync.upload.exhausted === 0 && sync.upload.retryAtMs === void 0 && syncPasses < maxDrainPasses && uploadedBytes < maxDrainBytes && (options.nowMs ?? Date.now)() - startedAtMs < maxDrainMs && getSettings().enabled && (sync.upload.attempted > 0 || sync.upload.uploadedChunks > 0 || sync.upload.refreshed > 0)) {
+        sync = await runPass(uploadedBytes);
+        syncPasses += 1;
+        snapshotQueued += sync.snapshot.queued;
+        snapshotSkipped += sync.snapshot.skipped;
+        attempted += sync.upload.attempted;
+        uploaded += sync.upload.uploaded;
+        uploadedChunks += sync.upload.uploadedChunks;
+        uploadedBytes += sync.upload.uploadedBytes;
+        failed += sync.upload.failed;
+        exhausted = sync.upload.exhausted;
+        refreshed += sync.upload.refreshed;
+        oversized = mergeOversizedArtifacts(oversized, sync.snapshot.oversized);
+      }
+      pruneMaterializedCache({
+        cacheDir: paths.artifactCacheDir,
+        maxTotalBytes: options.maxArtifactCacheBytes,
+        keepPaths: lastMaterializer?.retained()
+      });
+      const upload = {
+        attempted,
+        uploaded,
+        uploadedChunks,
+        uploadedBytes,
+        failed,
+        exhausted,
+        refreshed,
+        retryAtMs: sync.upload.retryAtMs,
+        nextRetryAtMs: sync.upload.nextRetryAtMs,
+        hasRunnable: sync.upload.hasRunnable,
+        hasMore: sync.upload.hasMore,
+        skipped: sync.upload.skipped
+      };
+      const outcome = uploadOutcome(upload);
+      return {
+        outcome,
+        enabled: true,
+        syncPasses,
+        drained: outcome === "drained",
+        discovery,
+        oversized,
+        snapshot: {
+          queued: snapshotQueued,
+          skipped: snapshotSkipped
+        },
+        upload,
+        status: {
+          settings: getSettings(),
+          queue: summarizeArtifactQueue(sync.upload.queue)
+        }
+      };
+    }
+  };
+}
+
+// src/sync/runner.ts
+function createCliRawSync(opts = {}) {
+  return createRawArtifactSync({
+    stateDir: FML_OBSERVER_DIR,
+    retryExhausted: opts.continuous ?? false,
+    observerIdentity: collectObserverIdentity(FML_INSTALLATION_ID_FILE) ?? void 0
+  });
+}
+async function runRawSyncOnce(opts = {}) {
+  const sync = createCliRawSync({ continuous: opts.continuous });
+  if (!sync.getSettings().enabled) {
+    return { kind: "disabled", status: sync.status() };
+  }
+  const environment = getActiveEnv();
+  const token = await getValidToken({ env: environment.name });
+  if (!token) {
+    return {
+      kind: "unauthenticated",
+      environment: environment.name,
+      status: sync.status()
+    };
+  }
+  const targetUrl = getSiteUrlForConvexUrl(environment.convexUrl);
+  const organization = process.env.FML_ORG ?? getSelectedOrg(environment.name) ?? void 0;
+  const result = await sync.run({
+    targetUrl,
+    targetName: targetUrl,
+    authorization: token.startsWith("Bearer ") ? token : `Bearer ${token}`,
+    organization,
+    destinationIdentity: getSyncDestinationIdentity(environment.name) ?? void 0,
+    ...opts.fetch ? { fetch: opts.fetch } : {}
+  });
+  if (result.outcome === "disabled") {
+    return { kind: "disabled", status: result.status };
+  }
+  return {
+    kind: "completed",
+    environment: environment.name,
+    organization,
+    targetUrl,
+    result
+  };
+}
+
+// src/package-root.ts
+import fs9 from "fs";
+import path19 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function resolvePackageRoot(startDir = path19.dirname(fileURLToPath2(import.meta.url))) {
+  let directory = startDir;
+  while (true) {
+    if (fs9.existsSync(path19.join(directory, "package.json")) && fs9.existsSync(path19.join(directory, "bin"))) {
+      return directory;
+    }
+    const parent = path19.dirname(directory);
+    if (parent === directory) {
+      throw new Error(`Could not resolve FML package root from ${startDir}`);
+    }
+    directory = parent;
+  }
+}
+
+export {
+  claudeConfigDirectory,
+  geminiConfigDirectory,
+  initializeSyncSettings,
+  createRawArtifactSync,
+  resolvePackageRoot,
+  createCliRawSync,
+  runRawSyncOnce
+};