@hraness/sys1 0.17.0

package/dist/index.js

@@ -0,0 +1,3520 @@
+// src/http.ts
+class HttpBodyLimitError extends Error {
+  maxBytes;
+  constructor(maxBytes) {
+    super(`HTTP body exceeds ${maxBytes} bytes`);
+    this.maxBytes = maxBytes;
+    this.name = "HttpBodyLimitError";
+  }
+}
+async function readBoundedText(source, maxBytes, signal) {
+  signal?.throwIfAborted();
+  if (source.body === null)
+    return "";
+  const reader = source.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  let rejectAbort;
+  const aborted = new Promise((_, reject) => {
+    rejectAbort = reject;
+  });
+  const onAbort = () => {
+    rejectAbort?.(signal?.reason);
+    reader.cancel(signal?.reason).catch(() => {});
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    for (;; ) {
+      signal?.throwIfAborted();
+      const next = await Promise.race([reader.read(), aborted]);
+      signal?.throwIfAborted();
+      if (next.done)
+        break;
+      bytes += next.value.byteLength;
+      if (bytes > maxBytes) {
+        const error = new HttpBodyLimitError(maxBytes);
+        reader.cancel(error).catch(() => {});
+        throw error;
+      }
+      chunks.push(next.value);
+    }
+    const body = new Uint8Array(bytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(body);
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    reader.releaseLock();
+  }
+}
+
+// src/protocol.ts
+import { z } from "zod";
+var PROTOCOL_LIMITS = {
+  maxBodyBytes: 1048576,
+  maxStateBytes: 262144,
+  maxQuestions: 64,
+  maxQuestionNameChars: 128,
+  maxInstructionsChars: 4096,
+  maxCriterionChars: 1024,
+  maxOptionChars: 256,
+  maxChoiceOptions: 255,
+  minScoreLevels: 2,
+  maxScoreLevels: 10,
+  maxModelChars: 128
+};
+var jsonValueSchema = z.lazy(() => z.union([
+  z.string(),
+  z.number(),
+  z.boolean(),
+  z.null(),
+  z.array(jsonValueSchema),
+  z.record(z.string(), jsonValueSchema)
+]));
+var entrySchema = z.union([
+  z.string(),
+  z.null(),
+  z.array(jsonValueSchema),
+  z.record(z.string(), jsonValueSchema)
+]);
+function boundedEntry(maxBytes, message) {
+  return entrySchema.refine((value) => {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    return new TextEncoder().encode(text).byteLength <= maxBytes;
+  }, message);
+}
+var instructionsSchema = boundedEntry(PROTOCOL_LIMITS.maxInstructionsChars, "instructions exceeds 4096 bytes");
+var criterionSchema = boundedEntry(PROTOCOL_LIMITS.maxCriterionChars, "criterion exceeds 1024 bytes");
+var noulQuestionSchema = z.object({
+  type: z.literal("noul"),
+  instructions: instructionsSchema.optional(),
+  criteria: z.object({
+    true: criterionSchema.optional(),
+    false: criterionSchema.optional()
+  }).nullable().optional()
+});
+var choiceQuestionSchema = z.object({
+  type: z.literal("choice"),
+  instructions: instructionsSchema.optional(),
+  criteria: z.record(z.string().min(1).max(PROTOCOL_LIMITS.maxOptionChars), criterionSchema).refine((options) => {
+    const count = Object.keys(options).length;
+    return count >= 1 && count <= PROTOCOL_LIMITS.maxChoiceOptions;
+  }, { message: "choice criteria needs 1..255 options" })
+});
+var scoreQuestionSchema = z.object({
+  type: z.literal("score"),
+  instructions: instructionsSchema.optional(),
+  criteria: z.array(criterionSchema).min(PROTOCOL_LIMITS.minScoreLevels).max(PROTOCOL_LIMITS.maxScoreLevels)
+});
+var questionSchema = z.discriminatedUnion("type", [
+  noulQuestionSchema,
+  choiceQuestionSchema,
+  scoreQuestionSchema
+]);
+var systemOneRequestSchema = z.object({
+  model: z.string().min(1).max(PROTOCOL_LIMITS.maxModelChars).optional(),
+  state: entrySchema,
+  questions: z.record(z.string().min(1).max(PROTOCOL_LIMITS.maxQuestionNameChars), questionSchema).refine((questions) => {
+    const count = Object.keys(questions).length;
+    return count >= 1 && count <= PROTOCOL_LIMITS.maxQuestions;
+  }, { message: "questions needs 1..64 entries" })
+});
+var probabilitySchema = z.number().min(0).max(1);
+var noulAnswerSchema = z.object({
+  type: z.literal("noul"),
+  noul: probabilitySchema
+});
+var choiceAnswerSchema = z.object({
+  type: z.literal("choice"),
+  choice: z.string().min(1),
+  probabilities: z.record(z.string().min(1), probabilitySchema),
+  confidence: probabilitySchema
+}).superRefine((answer, ctx) => {
+  const count = Object.keys(answer.probabilities).length;
+  if (count < 1 || count > PROTOCOL_LIMITS.maxChoiceOptions) {
+    ctx.addIssue({ code: "custom", message: "choice probabilities needs 1..255 entries" });
+  }
+  if (!(answer.choice in answer.probabilities)) {
+    ctx.addIssue({ code: "custom", message: "choice is missing from probabilities" });
+  }
+});
+var scoreAnswerSchema = z.object({
+  type: z.literal("score"),
+  score: z.number().min(0),
+  legend: z.record(z.string().regex(/^(0|[1-9]\d*)$/), entrySchema),
+  probabilities: z.record(z.string().regex(/^(0|[1-9]\d*)$/), probabilitySchema),
+  confidence: probabilitySchema
+}).superRefine((answer, ctx) => {
+  const legendKeys = Object.keys(answer.legend);
+  const probabilityKeys = Object.keys(answer.probabilities);
+  if (legendKeys.length < PROTOCOL_LIMITS.minScoreLevels || legendKeys.length > PROTOCOL_LIMITS.maxScoreLevels) {
+    ctx.addIssue({ code: "custom", message: "score legend needs 2..10 entries" });
+  }
+  if (legendKeys.length !== probabilityKeys.length || legendKeys.some((key) => !(key in answer.probabilities))) {
+    ctx.addIssue({ code: "custom", message: "score legend and probabilities must have identical keys" });
+  }
+  if (legendKeys.some((key, index) => key !== String(index))) {
+    ctx.addIssue({ code: "custom", message: "score keys must be contiguous from zero" });
+  }
+  if (legendKeys.length > 0 && answer.score > legendKeys.length - 1) {
+    ctx.addIssue({ code: "custom", message: "score exceeds the legend range" });
+  }
+});
+var answerSchema = z.discriminatedUnion("type", [
+  noulAnswerSchema,
+  choiceAnswerSchema,
+  scoreAnswerSchema
+]);
+var systemOneResponseSchema = z.object({
+  model: z.string().min(1).max(PROTOCOL_LIMITS.maxModelChars),
+  answers: z.record(z.string().min(1).max(PROTOCOL_LIMITS.maxQuestionNameChars), answerSchema).refine((answers) => Object.keys(answers).length <= PROTOCOL_LIMITS.maxQuestions),
+  usage: z.object({
+    input_tokens: z.number().int().nonnegative(),
+    output_tokens: z.number().int().nonnegative()
+  })
+});
+function errorBody(type, message, details) {
+  return { error: { type, message, ...details === undefined ? {} : { details } } };
+}
+function serializedBytes(value) {
+  return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+
+// src/response.ts
+function sameEntry(left, right) {
+  if (left === right)
+    return true;
+  if (left === null || right === null || typeof left !== "object" || typeof right !== "object") {
+    return false;
+  }
+  if (Array.isArray(left) !== Array.isArray(right))
+    return false;
+  const a = left;
+  const b = right;
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => Object.hasOwn(b, key) && sameEntry(a[key], b[key]));
+}
+function matchesRequest(request, response) {
+  const questionNames = Object.keys(request.questions);
+  if (questionNames.length !== Object.keys(response.answers).length)
+    return false;
+  return questionNames.every((name) => {
+    const question = request.questions[name];
+    if (!Object.hasOwn(response.answers, name))
+      return false;
+    const answer = response.answers[name];
+    if (question.type !== answer.type)
+      return false;
+    if (question.type === "choice" && answer.type === "choice") {
+      const options = Object.keys(question.criteria);
+      return Object.hasOwn(question.criteria, answer.choice) && options.length === Object.keys(answer.probabilities).length && options.every((option) => Object.hasOwn(answer.probabilities, option));
+    }
+    if (question.type === "score" && answer.type === "score") {
+      return question.criteria.length === Object.keys(answer.legend).length && question.criteria.every((criterion, index) => sameEntry(criterion, answer.legend[String(index)]));
+    }
+    return true;
+  });
+}
+function scoreEndpoint(bounds, lowerTotal, maximum) {
+  let expected = bounds.reduce((sum, bound, level) => sum + level * bound.lower, 0);
+  let remaining = Math.max(0, 1 - lowerTotal);
+  for (let position = 0;position < bounds.length && remaining > 0; position++) {
+    const level = maximum ? bounds.length - 1 - position : position;
+    const bound = bounds[level];
+    const added = Math.min(remaining, bound.upper - bound.lower);
+    expected += level * added;
+    remaining -= added;
+  }
+  return expected;
+}
+function validateResponseForRequest(request, value, roundingDecimals = 3) {
+  try {
+    if (roundingDecimals !== 2 && roundingDecimals !== 3)
+      throw new Error;
+    const rounding = 0.5 * 10 ** -roundingDecimals;
+    const response = systemOneResponseSchema.parse(value);
+    if (!matchesRequest(request, response))
+      throw new Error;
+    for (const answer of Object.values(response.answers)) {
+      if (answer.type === "noul")
+        continue;
+      const values = Object.values(answer.probabilities);
+      const total = values.reduce((sum, probability) => sum + probability, 0);
+      const bounds = values.map((probability) => ({
+        lower: Math.max(0, probability - rounding),
+        upper: Math.min(1, probability + rounding)
+      }));
+      const lowerTotal = bounds.reduce((sum, bound) => sum + bound.lower, 0);
+      const upperTotal = bounds.reduce((sum, bound) => sum + bound.upper, 0);
+      if (total <= 0 || lowerTotal > 1 + 0.000000001 || upperTotal < 1 - 0.000000001)
+        throw new Error;
+      if (answer.type === "choice") {
+        if (answer.probabilities[answer.choice] + 0.000000001 < Math.max(...values))
+          throw new Error;
+      } else {
+        const minimum = scoreEndpoint(bounds, lowerTotal, false);
+        const maximum = scoreEndpoint(bounds, lowerTotal, true);
+        if (answer.score + rounding < minimum - 0.000000001 || answer.score - rounding > maximum + 0.000000001) {
+          throw new Error;
+        }
+      }
+    }
+    return response;
+  } catch {
+    throw new Error("Invalid or mismatched System One response");
+  }
+}
+
+// src/kev.ts
+var pythonLeadingWhitespace = /^[\u0009-\u000d\u001c-\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]+/u;
+function renderNumber(value) {
+  const wire = JSON.stringify(value);
+  if (!/[.e]/i.test(wire))
+    return wire;
+  if (Math.abs(value) < 0.0001 || Math.abs(value) >= 10000000000000000) {
+    return value.toExponential().replace(/e([+-])(\d)$/u, "e$10$2");
+  }
+  return wire;
+}
+function render(value, indent = 0) {
+  if (value === null)
+    return "";
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "boolean")
+    return value ? "True" : "False";
+  if (typeof value === "number")
+    return renderNumber(value);
+  const pad = "  ".repeat(indent);
+  if (Array.isArray(value)) {
+    return value.map((entry) => `${pad}- ${render(entry, indent + 1).replace(pythonLeadingWhitespace, "")}`).join(`
+`);
+  }
+  return Object.entries(value).map(([key, entry]) => entry !== null && typeof entry === "object" ? `${pad}${key}:
+${render(entry, indent + 1)}` : `${pad}${key}: ${render(entry)}`).join(`
+`);
+}
+function adaptKevRequest(request) {
+  const adapted = structuredClone(request);
+  for (const question of Object.values(adapted.questions)) {
+    if (question.instructions === undefined)
+      question.instructions = null;
+  }
+  return adapted;
+}
+function adaptKevResponse(request, value) {
+  try {
+    const response = systemOneResponseSchema.parse(value);
+    if (request.model !== undefined && response.model !== request.model)
+      throw new Error;
+    for (const [name, question] of Object.entries(request.questions)) {
+      if (question.type !== "score")
+        continue;
+      const answer = response.answers[name];
+      if (answer?.type !== "score" || Object.keys(answer.legend).length !== question.criteria.length) {
+        throw new Error;
+      }
+      if (!question.criteria.every((criterion, index) => answer.legend[String(index)] === render(criterion))) {
+        throw new Error;
+      }
+      answer.legend = Object.fromEntries(question.criteria.map((criterion, index) => [String(index), structuredClone(criterion)]));
+    }
+    return validateResponseForRequest(request, response, 2);
+  } catch {
+    throw new Error("Invalid or mismatched System One response");
+  }
+}
+// src/profile.ts
+import { z as z2 } from "zod";
+var identifier = z2.string().min(1).max(64).regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/).refine((value) => value === value.trim());
+var profileQuestionSchema = z2.discriminatedUnion("type", [
+  noulQuestionSchema.extend({
+    criteria: noulQuestionSchema.shape.criteria.unwrap().unwrap().strict().nullable().optional()
+  }).strict(),
+  choiceQuestionSchema.strict(),
+  scoreQuestionSchema.strict()
+]);
+var profileDefinitionSchema = z2.object({
+  version: z2.literal(1),
+  id: identifier,
+  revision: identifier,
+  model: systemOneRequestSchema.shape.model.unwrap().regex(/^[a-z0-9][a-z0-9.-]*\/\S+$/).refine((value) => value === value.trim()),
+  questions: z2.record(z2.string().min(1).max(PROTOCOL_LIMITS.maxQuestionNameChars), profileQuestionSchema).refine((questions) => {
+    const count = Object.keys(questions).length;
+    return count >= 1 && count <= PROTOCOL_LIMITS.maxQuestions;
+  })
+}).strict();
+
+class Sys1ProfileError extends Error {
+  code;
+  constructor(code) {
+    super(code === "invalid_profile" ? "Invalid Sys1 profile" : "Invalid Sys1 profile request");
+    this.name = "Sys1ProfileError";
+    this.code = code;
+  }
+}
+function snapshotJson(input, maxBytes) {
+  const ancestors = new Set;
+  const encoder = new TextEncoder;
+  let bytes = 0;
+  const account = (count) => {
+    bytes += count;
+    if (bytes > maxBytes)
+      throw new Error;
+  };
+  const copy = (value) => {
+    if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number") {
+      if (typeof value === "number" && !Number.isFinite(value))
+        throw new Error;
+      if (typeof value === "string" && value.length > maxBytes - bytes)
+        throw new Error;
+      account(encoder.encode(JSON.stringify(value)).byteLength);
+      return value;
+    }
+    if (typeof value !== "object" || ancestors.has(value))
+      throw new Error;
+    const array = Array.isArray(value);
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== (array ? Array.prototype : Object.prototype) && !(prototype === null && !array))
+      throw new Error;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    const keys = Reflect.ownKeys(descriptors);
+    if (keys.some((key) => typeof key !== "string"))
+      throw new Error;
+    ancestors.add(value);
+    account(2);
+    let result;
+    if (array) {
+      if (keys.length !== value.length + 1)
+        throw new Error;
+      const items = [];
+      for (let index = 0;index < value.length; index++) {
+        const descriptor = descriptors[String(index)];
+        if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+          throw new Error;
+        if (index > 0)
+          account(1);
+        items.push(copy(descriptor.value));
+      }
+      result = items;
+    } else {
+      const object = Object.create(null);
+      for (let index = 0;index < keys.length; index++) {
+        const key = keys[index];
+        const descriptor = descriptors[key];
+        if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+          throw new Error;
+        if (index > 0)
+          account(1);
+        account(encoder.encode(JSON.stringify(key)).byteLength + 1);
+        object[key] = copy(descriptor.value);
+      }
+      result = object;
+    }
+    ancestors.delete(value);
+    return result;
+  };
+  return copy(input);
+}
+function freezeDeep(value) {
+  if (value !== null && typeof value === "object") {
+    for (const child of Object.values(value))
+      freezeDeep(child);
+    Object.freeze(value);
+  }
+  return value;
+}
+function createProfile(input) {
+  let definition;
+  try {
+    definition = freezeDeep(profileDefinitionSchema.parse(snapshotJson(input, PROTOCOL_LIMITS.maxBodyBytes)));
+  } catch {
+    throw new Sys1ProfileError("invalid_profile");
+  }
+  return Object.freeze({
+    definition,
+    request(state) {
+      try {
+        const request = systemOneRequestSchema.parse(snapshotJson({
+          model: definition.model,
+          state,
+          questions: definition.questions
+        }, PROTOCOL_LIMITS.maxBodyBytes));
+        if (serializedBytes(request.state) > PROTOCOL_LIMITS.maxStateBytes)
+          throw new Error;
+        return request;
+      } catch {
+        throw new Sys1ProfileError("invalid_request");
+      }
+    }
+  });
+}
+
+// src/client.ts
+var DEFAULT_BASE_URL = "http://127.0.0.1:13900";
+var MAX_RESPONSE_BYTES = 4194304;
+var ERROR_MESSAGES = {
+  invalid_options: "Invalid Sys1 client options",
+  invalid_request: "Invalid System One request",
+  aborted: "Sys1 request aborted",
+  timeout: "Sys1 request timed out",
+  transport_error: "Sys1 transport failed",
+  http_error: "Sys1 endpoint returned an HTTP error",
+  response_too_large: "Sys1 response exceeded the byte limit",
+  invalid_response: "Sys1 endpoint returned an invalid or mismatched response"
+};
+
+class Sys1ClientError extends Error {
+  code;
+  status;
+  constructor(code, status) {
+    super(ERROR_MESSAGES[code]);
+    this.name = "Sys1ClientError";
+    this.code = code;
+    this.status = status;
+  }
+}
+function metadata(headers) {
+  const result = {};
+  const adapter = headers.get("x-sys1-adapter");
+  const decimals = headers.get("x-sys1-probability-decimals");
+  if (adapter !== null || decimals !== null) {
+    if (adapter !== "kev" || decimals !== "2")
+      throw new Sys1ClientError("invalid_response");
+    result.adapter = "kev";
+    result.probabilityDecimals = 2;
+  }
+  const name = (key) => {
+    const value = headers.get(key);
+    if (value === null)
+      return;
+    if (!/^[a-zA-Z0-9_.:/-]{1,128}$/.test(value))
+      throw new Sys1ClientError("invalid_response");
+    return value;
+  };
+  const backend = name("x-sys1-backend");
+  if (backend !== undefined)
+    result.backend = backend;
+  const attempts = headers.get("x-sys1-attempts");
+  if (attempts !== null) {
+    if (!/^[1-9]\d{0,5}$/.test(attempts))
+      throw new Sys1ClientError("invalid_response");
+    result.attempts = Number(attempts);
+  }
+  const localAdapter = name("x-sys1-local-adapter");
+  if (localAdapter !== undefined) {
+    result.local = { adapter: localAdapter };
+    for (const [header, key] of [
+      ["x-sys1-local-min-coverage", "minCoverage"],
+      ["x-sys1-local-min-concentration", "minConcentration"]
+    ]) {
+      const value = headers.get(header);
+      if (value === null)
+        continue;
+      if (!/^(0(?:\.\d{1,16})?|1(?:\.0{1,16})?)$/.test(value)) {
+        throw new Sys1ClientError("invalid_response");
+      }
+      result.local[key] = Number(value);
+    }
+  }
+  return result;
+}
+function cancelBody(response) {
+  response.body?.cancel().catch(() => {
+    return;
+  });
+}
+function fetchUntilAborted(fetchFn, url, init, signal) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(new Sys1ClientError("aborted"));
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) {
+      signal.removeEventListener("abort", abort);
+      abort();
+      return;
+    }
+    Promise.resolve().then(() => fetchFn(url, init)).then((response) => {
+      if (signal.aborted)
+        cancelBody(response);
+      resolve(response);
+    }, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
+function createClient(options = {}) {
+  let endpoint;
+  let headers;
+  const timeoutMs = options.timeoutMs ?? 30000;
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  const adapter = options.adapter ?? "systemone";
+  try {
+    if (adapter !== "systemone" && adapter !== "kev")
+      throw new Error;
+    const base = options.baseUrl ?? DEFAULT_BASE_URL;
+    if (base.length > 2048)
+      throw new Error;
+    const url = new URL(base);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
+      throw new Error;
+    }
+    url.pathname = `${url.pathname.replace(/\/+$/, "")}/v1/systemone`;
+    endpoint = url.href;
+    headers = new Headers(options.headers);
+    headers.set("content-type", "application/json");
+    headers.set("accept", "application/json");
+    let headerBytes = 0;
+    headers.forEach((value, key) => {
+      headerBytes += new TextEncoder().encode(key + value).byteLength;
+    });
+    if (headerBytes > 16384 || !Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 300000 || typeof fetchFn !== "function") {
+      throw new Error;
+    }
+  } catch {
+    throw new Sys1ClientError("invalid_options");
+  }
+  return {
+    async evaluate(input, evaluation = {}) {
+      if (evaluation.signal?.aborted)
+        throw new Sys1ClientError("aborted");
+      let request;
+      let body;
+      try {
+        const serialized = JSON.stringify(input);
+        if (new TextEncoder().encode(serialized).byteLength > PROTOCOL_LIMITS.maxBodyBytes)
+          throw new Error;
+        request = systemOneRequestSchema.parse(JSON.parse(serialized));
+        const state = typeof request.state === "string" ? request.state : JSON.stringify(request.state);
+        if (new TextEncoder().encode(state).byteLength > PROTOCOL_LIMITS.maxStateBytes)
+          throw new Error;
+        body = JSON.stringify(adapter === "kev" ? adaptKevRequest(request) : request);
+        if (new TextEncoder().encode(body).byteLength > PROTOCOL_LIMITS.maxBodyBytes)
+          throw new Error;
+      } catch {
+        throw new Sys1ClientError("invalid_request");
+      }
+      const controller = new AbortController;
+      let timedOut = false;
+      const onAbort = () => controller.abort();
+      evaluation.signal?.addEventListener("abort", onAbort, { once: true });
+      const timer = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+      }, timeoutMs);
+      try {
+        const response = await fetchUntilAborted(fetchFn, endpoint, {
+          method: "POST",
+          headers: new Headers(headers),
+          body,
+          signal: controller.signal,
+          redirect: "error",
+          credentials: "omit"
+        }, controller.signal);
+        if (!response.ok) {
+          cancelBody(response);
+          throw new Sys1ClientError("http_error", response.status);
+        }
+        const text = await readBoundedText(response, MAX_RESPONSE_BYTES, controller.signal);
+        let parsed;
+        let route;
+        try {
+          route = metadata(response.headers);
+          const value = JSON.parse(text);
+          if (adapter === "kev") {
+            parsed = adaptKevResponse(request, value);
+            route.adapter = "kev";
+            route.probabilityDecimals = 2;
+          } else {
+            parsed = validateResponseForRequest(request, value, route.probabilityDecimals ?? 3);
+          }
+        } catch {
+          throw new Sys1ClientError("invalid_response");
+        }
+        return { response: parsed, metadata: route };
+      } catch (error) {
+        if (controller.signal.aborted)
+          throw new Sys1ClientError(timedOut ? "timeout" : "aborted");
+        if (error instanceof Sys1ClientError)
+          throw error;
+        if (error instanceof HttpBodyLimitError)
+          throw new Sys1ClientError("response_too_large");
+        throw new Sys1ClientError("transport_error");
+      } finally {
+        clearTimeout(timer);
+        evaluation.signal?.removeEventListener("abort", onAbort);
+      }
+    }
+  };
+}
+// src/config.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { z as z3 } from "zod";
+
+// src/defaults.ts
+var LOCAL_MODEL_TIERS = ["compact", "quality"];
+var DEFAULT_LOCAL_MODELS = {
+  compact: "qwen3-0.6b",
+  quality: "qwen3-1.7b"
+};
+var PLATFORM_TARGETS = {
+  "darwin-arm64": "Metal or CPU",
+  "darwin-x64": "CPU",
+  "linux-x64": "CUDA, Vulkan, or CPU",
+  "linux-arm64": "CPU",
+  "win32-x64": "CUDA, Vulkan, or CPU",
+  "win32-arm64": "CPU"
+};
+function platformRecommendation(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const arch = options.arch ?? process.arch;
+  const target = `${platform}-${arch}`;
+  const acceleration = PLATFORM_TARGETS[target];
+  const tier = options.tier ?? "quality";
+  if (acceleration === undefined) {
+    return {
+      platform,
+      arch,
+      target,
+      supported: false,
+      acceleration: "unsupported",
+      tier,
+      model: null,
+      reason: `no supported Bun + llama.cpp package target for ${target}`
+    };
+  }
+  return {
+    platform,
+    arch,
+    target,
+    supported: true,
+    acceleration,
+    tier,
+    model: DEFAULT_LOCAL_MODELS[tier],
+    experimental: true,
+    reason: tier === "compact" ? "operator selected the experimental 0.6B diagnostic model" : "Qwen3 1.7B is the experimental default local model"
+  };
+}
+
+// src/config.ts
+var ROUTING_POLICIES = [
+  "auto",
+  "prefer-local",
+  "prefer-hosted",
+  "local-only",
+  "hosted-only"
+];
+var routingPolicySchema = z3.enum(ROUTING_POLICIES);
+function isLoopbackHost(host) {
+  if (host === "localhost" || host === "::1")
+    return true;
+  const octets = host.split(".");
+  return octets.length === 4 && octets[0] === "127" && octets.every((octet) => /^\d{1,3}$/.test(octet) && Number(octet) <= 255);
+}
+var loopbackHostSchema = z3.string().min(1).max(255).refine(isLoopbackHost, "must be a loopback host");
+var backendUrlSchema = z3.url().max(512).refine((value) => {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  const host = url.hostname.replace(/^\[|\]$/g, "");
+  return (url.protocol === "https:" || url.protocol === "http:" && isLoopbackHost(host)) && url.username === "" && url.password === "" && url.search === "" && url.hash === "";
+}, "use HTTPS or loopback HTTP without URL credentials, query, or fragment");
+var localBackendSchema = z3.object({
+  name: z3.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, digits, hyphens").refine((name) => name !== "typesafe" && !name.startsWith("local-"), "typesafe and local-* names are reserved"),
+  base_url: backendUrlSchema,
+  model: z3.string().min(1).max(128),
+  adapter: z3.enum(["systemone", "kev"]).optional(),
+  size_b: z3.number().positive().max(1e4).optional(),
+  cost_rank: z3.number().int().min(0).max(1000).optional(),
+  capabilities: z3.object({
+    max_options: z3.number().int().positive().max(255).optional(),
+    max_questions: z3.number().int().positive().max(64).optional()
+  }).optional(),
+  enabled: z3.boolean().default(true)
+});
+var configSchema = z3.object({
+  version: z3.literal(1),
+  gateway: z3.object({
+    host: loopbackHostSchema.default("127.0.0.1"),
+    port: z3.number().int().min(1).max(65535).default(13900),
+    request_timeout_ms: z3.number().int().min(1000).max(120000).default(15000),
+    probe_timeout_ms: z3.number().int().min(200).max(1e4).default(1500)
+  }).prefault({}),
+  routing: z3.object({
+    policy: routingPolicySchema.default("auto")
+  }).prefault({}),
+  hosted: z3.object({
+    enabled: z3.boolean().default(false),
+    base_url: backendUrlSchema.default("https://api.typesafe.ai"),
+    model: z3.string().min(1).max(128).default("jev-1.13.0"),
+    api_key_env: z3.string().min(1).max(128).default("TYPESAFE_API_KEY")
+  }).prefault({}),
+  local: z3.object({
+    enabled: z3.boolean().default(true),
+    model: z3.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9.-]*$/).default(DEFAULT_LOCAL_MODELS.quality),
+    context_tokens: z3.number().int().min(256).max(65536).default(2048),
+    eval_timeout_ms: z3.number().int().min(1000).max(300000).default(60000),
+    max_loaded_models: z3.number().int().min(1).max(4).default(1)
+  }).prefault({}),
+  backends: z3.array(localBackendSchema).max(64).refine((backends) => new Set(backends.map((backend) => backend.name)).size === backends.length, "backend names must be unique").default([])
+});
+var DEFAULT_CONFIG = configSchema.parse({ version: 1 });
+function sys1Home(env = process.env) {
+  const override = env["SYS1_HOME"];
+  if (override !== undefined && override.length > 0)
+    return override;
+  return join(homedir(), ".sys1");
+}
+function configPath(home) {
+  return join(home, "config.json");
+}
+function pidPath(home) {
+  return join(home, "daemon.json");
+}
+function logPath(home) {
+  return join(home, "daemon.log");
+}
+function loadConfig(home) {
+  const path = configPath(home);
+  if (!existsSync(path)) {
+    return { ok: true, config: DEFAULT_CONFIG, path, existed: false };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return { ok: false, path, message: `config is not valid JSON: ${path}` };
+  }
+  const result = configSchema.safeParse(parsed);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    const where = issue === undefined ? "" : ` at ${issue.path.join(".")}`;
+    const what = issue === undefined ? "invalid config" : issue.message;
+    return { ok: false, path, message: `invalid config${where}: ${what}` };
+  }
+  return { ok: true, config: result.data, path, existed: true };
+}
+function saveConfig(home, config) {
+  mkdirSync(home, { recursive: true, mode: 448 });
+  chmodSync(home, 448);
+  const path = configPath(home);
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+  return path;
+}
+var SETTABLE_KEYS = {
+  "routing.policy": routingPolicySchema,
+  "gateway.host": loopbackHostSchema,
+  "gateway.port": z3.coerce.number().int().min(1).max(65535),
+  "gateway.request_timeout_ms": z3.coerce.number().int().min(1000).max(120000),
+  "gateway.probe_timeout_ms": z3.coerce.number().int().min(200).max(1e4),
+  "hosted.base_url": backendUrlSchema,
+  "hosted.model": z3.string().min(1).max(128),
+  "hosted.api_key_env": z3.string().min(1).max(128),
+  "local.enabled": z3.enum(["true", "false"]).transform((v) => v === "true"),
+  "local.model": z3.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9.-]*$/),
+  "local.context_tokens": z3.coerce.number().int().min(256).max(65536),
+  "local.eval_timeout_ms": z3.coerce.number().int().min(1000).max(300000),
+  "local.max_loaded_models": z3.coerce.number().int().min(1).max(4)
+};
+function setConfigValue(config, key, rawValue) {
+  if (typeof key !== "string" || !Object.hasOwn(SETTABLE_KEYS, key)) {
+    return { ok: false, message: "unknown configuration key" };
+  }
+  const schema = SETTABLE_KEYS[key];
+  const parsed = schema.safeParse(rawValue);
+  if (!parsed.success) {
+    return { ok: false, message: `invalid value for ${key}: ${rawValue}` };
+  }
+  const next = structuredClone(config);
+  const [section, field] = key.split(".");
+  const target = next[section];
+  Object.defineProperty(target, field, { value: parsed.data, writable: true, enumerable: true, configurable: true });
+  return { ok: true, config: configSchema.parse(next) };
+}
+// src/router.ts
+function requestNeeds(request) {
+  let maxOptions = 0;
+  const questions = Object.values(request.questions);
+  for (const question of questions) {
+    switch (question.type) {
+      case "choice":
+        maxOptions = Math.max(maxOptions, Object.keys(question.criteria).length);
+        break;
+      case "score":
+        maxOptions = Math.max(maxOptions, question.criteria.length);
+        break;
+      case "noul":
+        maxOptions = Math.max(maxOptions, 2);
+        break;
+    }
+  }
+  return { maxOptions, questions: questions.length };
+}
+function compatible(candidate, needs) {
+  const caps = candidate.capabilities;
+  if (caps === undefined)
+    return true;
+  if (caps.maxOptions !== undefined && needs.maxOptions > caps.maxOptions)
+    return false;
+  if (caps.maxQuestions !== undefined && needs.questions > caps.maxQuestions)
+    return false;
+  return true;
+}
+function byCheapest(a, b) {
+  const sizeA = a.size_b ?? Number.MAX_SAFE_INTEGER;
+  const sizeB = b.size_b ?? Number.MAX_SAFE_INTEGER;
+  if (sizeA !== sizeB)
+    return sizeA - sizeB;
+  if (a.cost_rank !== b.cost_rank)
+    return a.cost_rank - b.cost_rank;
+  return a.name.localeCompare(b.name);
+}
+function ordered(policy, candidates) {
+  const hosted = candidates.filter((c) => c.kind === "hosted");
+  const locals = candidates.filter((c) => c.kind === "local").sort(byCheapest);
+  switch (policy) {
+    case "prefer-local":
+      return [...locals, ...hosted];
+    case "local-only":
+      return locals;
+    case "hosted-only":
+      return hosted;
+    case "auto":
+    case "prefer-hosted":
+      return [...hosted, ...locals];
+  }
+}
+function chooseBackend(policy, requestedModel, candidates, needs) {
+  const fits = (candidate) => needs === undefined || compatible(candidate, needs);
+  if (requestedModel !== undefined && requestedModel !== "auto") {
+    const slash = requestedModel.indexOf("/");
+    if (slash > 0) {
+      const backendName = requestedModel.slice(0, slash);
+      const modelId = requestedModel.slice(slash + 1);
+      const pinned = candidates.find((c) => c.name === backendName);
+      if (pinned === undefined) {
+        return { ok: false, reason: "unknown_model", detail: `no backend named ${backendName}` };
+      }
+      if (ordered(policy, [pinned]).length === 0) {
+        return {
+          ok: false,
+          reason: "policy_restricted",
+          detail: `routing policy ${policy} excludes backend ${backendName}`
+        };
+      }
+      if (!pinned.models.includes(modelId) && pinned.models.length > 0) {
+        return {
+          ok: false,
+          reason: "unknown_model",
+          detail: `backend ${backendName} does not serve ${modelId}`
+        };
+      }
+      if (!pinned.available) {
+        return {
+          ok: false,
+          reason: "model_unavailable",
+          detail: `backend ${backendName} is not reachable`
+        };
+      }
+      if (!fits(pinned)) {
+        return {
+          ok: false,
+          reason: "request_unsupported",
+          detail: `request exceeds the published limits of backend ${backendName}`
+        };
+      }
+      return { ok: true, backend: pinned, reason: "pinned" };
+    }
+    const matching = candidates.filter((c) => c.models.includes(requestedModel));
+    const allowed = ordered(policy, matching);
+    if (matching.length > 0 && allowed.length === 0) {
+      return {
+        ok: false,
+        reason: "policy_restricted",
+        detail: `routing policy ${policy} excludes every backend serving ${requestedModel}`
+      };
+    }
+    const serving = allowed.filter(fits);
+    const available = serving.find((c) => c.available);
+    if (available !== undefined) {
+      return { ok: true, backend: available, reason: "model" };
+    }
+    if (serving.length > 0) {
+      return {
+        ok: false,
+        reason: "model_unavailable",
+        detail: `no reachable backend serves ${requestedModel}`
+      };
+    }
+    if (allowed.length > 0) {
+      return {
+        ok: false,
+        reason: "request_unsupported",
+        detail: `request exceeds the published limits of every backend serving ${requestedModel}`
+      };
+    }
+    return {
+      ok: false,
+      reason: "unknown_model",
+      detail: `no backend serves ${requestedModel}`
+    };
+  }
+  const viable = ordered(policy, candidates.filter((c) => c.explicitOnly !== true));
+  const fallback = viable.find((c) => c.available && fits(c));
+  if (fallback !== undefined) {
+    return { ok: true, backend: fallback, reason: policy === "auto" ? "auto" : "policy" };
+  }
+  if (viable.length > 0 && viable.every((c) => !fits(c))) {
+    return {
+      ok: false,
+      reason: "request_unsupported",
+      detail: "request exceeds the published limits of every configured backend"
+    };
+  }
+  return {
+    ok: false,
+    reason: "no_backend_available",
+    detail: "no configured backend is reachable"
+  };
+}
+// src/backends.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+import { z as z6 } from "zod";
+
+// src/local/input.ts
+class LocalInputError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LocalInputError";
+  }
+}
+
+// src/local/decide.ts
+var DECISION_LABELS = [
+  "1",
+  "2",
+  "3",
+  "4",
+  "5",
+  "6",
+  "7",
+  "8",
+  "9",
+  "A",
+  "B",
+  "C",
+  "D",
+  "E",
+  "F",
+  "G",
+  "H",
+  "I",
+  "J",
+  "K",
+  "L",
+  "M",
+  "N",
+  "O",
+  "P",
+  "Q",
+  "R",
+  "S",
+  "T",
+  "U",
+  "V",
+  "W",
+  "X",
+  "Y",
+  "Z"
+];
+var DECIDE_LIMITS = {
+  maxStateChars: 6000,
+  maxPromptChars: 16000,
+  maxInstructionChars: 2000,
+  maxOptionChars: 96,
+  maxCriterionChars: 96,
+  maxLabels: DECISION_LABELS.length
+};
+var NOUL_LABELS = ["yes", "no"];
+function truncate(text, max) {
+  if (text.length > max)
+    throw new LocalInputError(`local input exceeds ${max} characters`);
+  return text;
+}
+function renderEntry(value, max) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return truncate(text, max);
+}
+function renderState(state) {
+  return renderEntry(state, DECIDE_LIMITS.maxStateChars);
+}
+function clamp(text) {
+  if (text.length > DECIDE_LIMITS.maxPromptChars) {
+    throw new LocalInputError(`decision prompt exceeds ${DECIDE_LIMITS.maxPromptChars} characters`);
+  }
+  return text;
+}
+function noulPrompt(state, q) {
+  const criteria = [];
+  if (q.criteria?.true != null) {
+    criteria.push(`YES means: ${renderEntry(q.criteria.true, DECIDE_LIMITS.maxCriterionChars)}`);
+  }
+  if (q.criteria?.false != null) {
+    criteria.push(`NO means: ${renderEntry(q.criteria.false, DECIDE_LIMITS.maxCriterionChars)}`);
+  }
+  return clamp([
+    "You are a decision engine. Read the state, then answer the question with exactly one word: YES or NO.",
+    "",
+    "State:",
+    '"""',
+    renderState(state),
+    '"""',
+    `Question: ${renderEntry(q.instructions ?? "Is the claim true?", DECIDE_LIMITS.maxInstructionChars)}`,
+    ...criteria.length > 0 ? [criteria.join(" ")] : [],
+    "Answer:"
+  ].join(`
+`));
+}
+function choicePrompt(state, q) {
+  const lines = Object.entries(q.criteria).slice(0, DECIDE_LIMITS.maxLabels).map(([option, desc], i) => {
+    const name = truncate(option, DECIDE_LIMITS.maxOptionChars);
+    const detail = desc === null ? "" : ` — ${renderEntry(desc, DECIDE_LIMITS.maxCriterionChars)}`;
+    return `${DECISION_LABELS[i]}: ${name}${detail}`;
+  });
+  return clamp([
+    "You are a decision engine. Read the state, then answer with exactly one option label from the list. Answer with the label only.",
+    "",
+    "State:",
+    '"""',
+    renderState(state),
+    '"""',
+    `Question: ${renderEntry(q.instructions ?? "Choose the best option.", DECIDE_LIMITS.maxInstructionChars)}`,
+    "Options:",
+    ...lines,
+    "Answer:"
+  ].join(`
+`));
+}
+function scorePrompt(state, q) {
+  const lines = q.criteria.map((desc, i) => `${DECISION_LABELS[i]}: ${desc === null ? "(undescribed)" : renderEntry(desc, DECIDE_LIMITS.maxCriterionChars)}`);
+  return clamp([
+    "You are a decision engine. Read the state, then rate it on the given scale. Answer with the level label only.",
+    "",
+    "State:",
+    '"""',
+    renderState(state),
+    '"""',
+    `Question: ${renderEntry(q.instructions ?? "Rate the state.", DECIDE_LIMITS.maxInstructionChars)}`,
+    "Scale (lowest to highest):",
+    ...lines,
+    "Answer:"
+  ].join(`
+`));
+}
+function answerLabels(question) {
+  const count = question.type === "choice" ? Object.keys(question.criteria).length : question.type === "score" ? question.criteria.length : 2;
+  if (count > DECIDE_LIMITS.maxLabels)
+    throw new LocalInputError("too many local answer labels");
+  switch (question.type) {
+    case "noul":
+      return [...NOUL_LABELS];
+    case "choice":
+      return DECISION_LABELS.slice(0, Object.keys(question.criteria).length);
+    case "score":
+      return DECISION_LABELS.slice(0, question.criteria.length);
+  }
+}
+function decisionPrompt(state, question) {
+  answerLabels(question);
+  switch (question.type) {
+    case "noul":
+      return noulPrompt(state, question);
+    case "choice":
+      return choicePrompt(state, question);
+    case "score":
+      return scorePrompt(state, question);
+  }
+}
+function normalize(text) {
+  return text.trim().toLowerCase();
+}
+function tokenCoversLabel(tokenText, label) {
+  const token = normalize(tokenText);
+  if (token.length === 0)
+    return false;
+  const norm = normalize(label);
+  if (token === norm)
+    return true;
+  if (norm.startsWith(token))
+    return true;
+  if (token.startsWith(norm)) {
+    const rest = token.slice(norm.length);
+    return rest.length > 0 && !/^[a-z0-9]/.test(rest);
+  }
+  return false;
+}
+function aggregateMass(entries, labels) {
+  const masses = new Array(labels.length).fill(0);
+  let total = 0;
+  for (const [text, p] of entries) {
+    if (!(p > 0))
+      continue;
+    total += p;
+    for (let i = 0;i < labels.length; i += 1) {
+      const label = labels[i];
+      if (label !== undefined && tokenCoversLabel(text, label)) {
+        masses[i] = (masses[i] ?? 0) + p;
+        break;
+      }
+    }
+  }
+  let top = -1;
+  let topMass = 0;
+  for (let i = 0;i < masses.length; i += 1) {
+    const mass = masses[i] ?? 0;
+    if (mass > topMass) {
+      topMass = mass;
+      top = i;
+    }
+  }
+  const covered = masses.reduce((a, b) => a + b, 0);
+  return { masses, top, coverage: total > 0 ? Math.min(1, covered / total) : 0 };
+}
+function outcomeFromMass(mass, labels) {
+  if (mass.top < 0)
+    return null;
+  const covered = mass.masses.reduce((a, b) => a + b, 0);
+  const distribution = covered > 0 ? mass.masses.map((m) => m / covered) : mass.masses.map(() => 0);
+  const label = labels[mass.top];
+  if (label === undefined)
+    return null;
+  return { label, distribution, coverage: mass.coverage };
+}
+function confidenceOf(distribution) {
+  const top = Math.max(...distribution);
+  const uniform = 1 / distribution.length;
+  if (distribution.length <= 1 || top <= uniform)
+    return 0;
+  return Math.min(1, (top - uniform) / (1 - uniform));
+}
+function round(value) {
+  return Math.round(value * 1000) / 1000;
+}
+function toLocalAnswer(question, outcome) {
+  const confidence = round(confidenceOf(outcome.distribution));
+  switch (question.type) {
+    case "noul":
+      return { type: "noul", noul: round(outcome.distribution[0] ?? 0) };
+    case "choice": {
+      const keys = Object.keys(question.criteria);
+      const selected = keys[DECISION_LABELS.indexOf(outcome.label)];
+      if (selected === undefined)
+        throw new Error("choice outcome has no selected option");
+      const probabilities = {};
+      keys.forEach((key, i) => {
+        probabilities[key] = round(outcome.distribution[i] ?? 0);
+      });
+      return { type: "choice", choice: selected, probabilities, confidence };
+    }
+    case "score": {
+      const legend = {};
+      const probabilities = {};
+      let score = 0;
+      question.criteria.forEach((criterion, i) => {
+        const key = String(i);
+        const probability = outcome.distribution[i] ?? 0;
+        legend[key] = criterion;
+        probabilities[key] = round(probability);
+        score += i * probability;
+      });
+      return { type: "score", score: round(score), legend, probabilities, confidence };
+    }
+  }
+}
+function toLocalResponse(model, answers, usage) {
+  return { model, answers, usage };
+}
+function questionEntries(request) {
+  return Object.entries(request.questions).slice(0, 64);
+}
+
+// src/local/engine.ts
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { z as z4 } from "zod";
+
+// src/local/engine-types.ts
+class EngineUnavailableError extends Error {
+  detail;
+  constructor(message, detail) {
+    super(message);
+    this.name = "EngineUnavailableError";
+    this.detail = detail;
+  }
+}
+var ENGINE_IPC_LIMITS = {
+  requestBytes: 131072,
+  responseBytes: 16 * 1048576,
+  maxEntries: 300000,
+  maxTokenBytes: 4096,
+  maxPromptBytes: 65536
+};
+
+// src/local/engine.ts
+var distributionSchema = z4.object({
+  entries: z4.array(z4.tuple([
+    z4.string().refine((text) => Buffer.byteLength(text) <= ENGINE_IPC_LIMITS.maxTokenBytes),
+    z4.number().finite().positive().max(1)
+  ])).max(ENGINE_IPC_LIMITS.maxEntries),
+  inputTokens: z4.number().int().nonnegative().max(1e6)
+}).strict();
+var probeSchema = z4.object({
+  ok: z4.boolean(),
+  backend: z4.string().max(128).optional(),
+  gpu_offloading: z4.boolean().optional(),
+  supported_backends: z4.array(z4.string().max(128)).max(32).optional(),
+  message: z4.string().max(512).optional()
+}).strict();
+var responseSchema = z4.discriminatedUnion("kind", [
+  z4.object({ id: z4.number().int(), kind: z4.literal("distribution"), value: distributionSchema }).strict(),
+  z4.object({ id: z4.number().int(), kind: z4.literal("probe"), value: probeSchema }).strict(),
+  z4.object({ id: z4.number().int(), kind: z4.literal("error"), detail: z4.string().max(128) }).strict(),
+  z4.object({ id: z4.number().int(), kind: z4.literal("unsupported"), detail: z4.literal("context_limit") }).strict()
+]);
+function defaultWorker() {
+  const entry = new URL(import.meta.url.endsWith(".ts") ? "./engine-worker.ts" : "./engine-worker.js", import.meta.url);
+  return spawn(process.execPath, [fileURLToPath(entry)], {
+    stdio: ["pipe", "pipe", "ignore"],
+    windowsHide: true
+  });
+}
+function unavailable(detail) {
+  return new EngineUnavailableError("local engine unavailable", detail);
+}
+
+class EngineWorker {
+  phase = "created";
+  child;
+  collected;
+  pipes;
+  pending = null;
+  chunks = [];
+  bytes = 0;
+  nextId = 0;
+  stopped = false;
+  stopPromise;
+  constructor(factory) {
+    this.child = factory();
+    this.pipes = this.child.stdio.filter((pipe) => pipe !== null && pipe !== undefined);
+    const pipesClosed = this.pipes.map((pipe) => new Promise((resolve) => {
+      if (pipe.closed)
+        resolve();
+      else
+        pipe.once("close", () => resolve());
+    }));
+    const processClosed = new Promise((resolve) => this.child.once("close", () => {
+      this.stopped = true;
+      const pending = this.pending;
+      this.pending = null;
+      pending?.reject(unavailable("worker_exited"));
+      resolve();
+    }));
+    this.collected = Promise.all([processClosed, ...pipesClosed]).then(() => {});
+    this.child.on("error", () => {
+      this.fail("worker_failed");
+    });
+    this.child.stdin?.on("error", () => {
+      this.fail("worker_input_failed");
+    });
+    const output = this.child.stdout;
+    if (this.child.stdin === null || output == null) {
+      this.fail("worker_pipes_unavailable");
+      return;
+    }
+    output.on("error", () => {
+      this.fail("worker_output_failed");
+    });
+    output.on("data", (chunk) => this.accept(chunk));
+  }
+  accept(chunk) {
+    if (this.stopped)
+      return;
+    this.phase = "response_started";
+    this.bytes += chunk.byteLength;
+    if (this.bytes > ENGINE_IPC_LIMITS.responseBytes) {
+      this.fail("worker_response_limit");
+      return;
+    }
+    this.chunks.push(chunk);
+    const newline = chunk.indexOf(10);
+    if (newline < 0)
+      return;
+    if (newline !== chunk.length - 1) {
+      this.fail("worker_response_invalid");
+      return;
+    }
+    let response;
+    try {
+      response = responseSchema.parse(JSON.parse(Buffer.concat(this.chunks, this.bytes).toString("utf8")));
+    } catch {
+      this.fail("worker_response_invalid");
+      return;
+    }
+    this.chunks = [];
+    this.bytes = 0;
+    const pending = this.pending;
+    if (pending === null || pending.id !== response.id) {
+      this.fail("worker_response_mismatch");
+      return;
+    }
+    this.pending = null;
+    this.phase = "response_received";
+    pending.resolve(response);
+  }
+  async fail(detail) {
+    const pending = this.pending;
+    this.pending = null;
+    await this.stop();
+    pending?.reject(unavailable(detail));
+  }
+  async request(payload, signal) {
+    if (this.stopped)
+      throw unavailable("worker_stopped");
+    if (signal.aborted)
+      throw unavailable("inference_aborted");
+    if (this.pending !== null)
+      throw unavailable("worker_busy");
+    const id = ++this.nextId;
+    const wire = `${JSON.stringify({ ...payload, id })}
+`;
+    if (Buffer.byteLength(wire) > ENGINE_IPC_LIMITS.requestBytes)
+      throw unavailable("worker_request_limit");
+    const abort = () => {
+      this.fail("inference_aborted");
+    };
+    try {
+      return await new Promise((resolve, reject) => {
+        this.pending = { id, resolve, reject };
+        signal.addEventListener("abort", abort, { once: true });
+        if (signal.aborted)
+          abort();
+        else {
+          this.phase = "request_sent";
+          this.child.stdin.write(wire);
+        }
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+  }
+  stop() {
+    if (this.stopPromise !== undefined)
+      return this.stopPromise;
+    this.stopped = true;
+    this.stopPromise = (async () => {
+      this.child.kill("SIGKILL");
+      for (const pipe of this.pipes)
+        pipe.destroy();
+      await this.collected;
+      this.chunks = [];
+      this.bytes = 0;
+    })();
+    return this.stopPromise;
+  }
+  exitStatus() {
+    const signal = this.child.signalCode;
+    if (signal !== null && /^SIG[A-Z0-9]{1,16}$/.test(signal))
+      return signal;
+    const code = this.child.exitCode;
+    return code !== null && Number.isSafeInteger(code) ? String(code) : "unknown";
+  }
+}
+
+class LlamaEngine {
+  options;
+  factory;
+  modelId;
+  worker = null;
+  queue = Promise.resolve();
+  disposed = false;
+  shutdown = new AbortController;
+  disposePromise;
+  constructor(options, factory = defaultWorker) {
+    this.options = options;
+    this.factory = factory;
+    this.modelId = options.modelId;
+    if (!Number.isInteger(options.evalTimeoutMs) || options.evalTimeoutMs < 1 || options.evalTimeoutMs > 300000) {
+      throw unavailable("invalid_timeout");
+    }
+  }
+  firstTokenDistribution(prompt, signal) {
+    if (this.disposed)
+      return Promise.reject(unavailable("engine_disposed"));
+    if (Buffer.byteLength(prompt) > ENGINE_IPC_LIMITS.maxPromptBytes)
+      return Promise.reject(unavailable("prompt_limit"));
+    const timeout = new AbortController;
+    const timer = setTimeout(() => timeout.abort(), this.options.evalTimeoutMs);
+    const combined = AbortSignal.any([this.shutdown.signal, timeout.signal, ...signal === undefined ? [] : [signal]]);
+    let active = false;
+    const run = this.queue.then(async () => {
+      if (combined.aborted)
+        throw unavailable("inference_aborted");
+      active = true;
+      this.worker ??= new EngineWorker(this.factory);
+      const worker = this.worker;
+      try {
+        const response = await worker.request({ op: "evaluate", options: this.options, prompt }, combined);
+        if (response.kind === "unsupported")
+          throw new LocalInputError("prompt tokens exceed the model context capacity");
+        if (response.kind !== "distribution") {
+          throw unavailable(response.kind === "error" ? response.detail : "worker_response_mismatch");
+        }
+        return response.value;
+      } catch (error) {
+        await worker.stop();
+        if (this.worker === worker)
+          this.worker = null;
+        throw error;
+      }
+    });
+    this.queue = run.catch(() => {});
+    return new Promise((resolve, reject) => {
+      const abortQueued = () => {
+        if (!active)
+          reject(unavailable("inference_aborted"));
+      };
+      combined.addEventListener("abort", abortQueued, { once: true });
+      if (combined.aborted)
+        abortQueued();
+      run.then(resolve, reject).finally(() => {
+        clearTimeout(timer);
+        combined.removeEventListener("abort", abortQueued);
+      });
+    });
+  }
+  dispose() {
+    if (this.disposePromise !== undefined)
+      return this.disposePromise;
+    this.disposed = true;
+    this.shutdown.abort();
+    this.disposePromise = (async () => {
+      await this.worker?.stop();
+      await this.queue;
+      this.worker = null;
+    })();
+    return this.disposePromise;
+  }
+}
+async function probeNativeRuntime(options = {}) {
+  const started = performance.now();
+  const timeoutMs = options.timeoutMs ?? 30000;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30000) {
+    return { ok: false, failure_code: "invalid_timeout", elapsed_ms: 0, message: "native runtime probe failed: invalid_timeout" };
+  }
+  let worker;
+  const controller = new AbortController;
+  let deadlineReached = false;
+  const timer = setTimeout(() => {
+    deadlineReached = true;
+    controller.abort();
+  }, timeoutMs);
+  const failure = (code) => {
+    const elapsed = Math.max(0, Math.round(performance.now() - started));
+    const phase = worker?.phase ?? "created";
+    const exit = code === "worker_exited" ? `; exit=${worker?.exitStatus() ?? "unknown"}` : "";
+    return {
+      ok: false,
+      failure_code: code,
+      elapsed_ms: elapsed,
+      message: `native runtime probe failed: ${code}; elapsed_ms=${elapsed}; phase=${phase}${exit}`
+    };
+  };
+  try {
+    worker = new EngineWorker(options.workerFactory ?? defaultWorker);
+    const response = await worker.request({ op: "probe" }, controller.signal);
+    if (response.kind !== "probe")
+      return failure("worker_response_mismatch");
+    const value = response.value;
+    if (!value.ok)
+      return failure("native_unavailable");
+    return {
+      ok: value.ok,
+      elapsed_ms: Math.max(0, Math.round(performance.now() - started)),
+      ...value.backend === undefined ? {} : { backend: value.backend },
+      ...value.gpu_offloading === undefined ? {} : { gpu_offloading: value.gpu_offloading },
+      ...value.supported_backends === undefined ? {} : { supported_backends: value.supported_backends }
+    };
+  } catch (error) {
+    const allowed = new Set([
+      "worker_exited",
+      "worker_failed",
+      "worker_input_failed",
+      "worker_output_failed",
+      "worker_pipes_unavailable",
+      "worker_response_limit",
+      "worker_response_invalid",
+      "worker_response_mismatch",
+      "worker_request_limit",
+      "worker_stopped",
+      "worker_busy"
+    ]);
+    return failure(deadlineReached ? "probe_timeout" : error instanceof EngineUnavailableError && allowed.has(error.detail) ? error.detail : "worker_failed");
+  } finally {
+    clearTimeout(timer);
+    await worker?.stop();
+  }
+}
+
+// src/local/store.ts
+import {
+  chmodSync as chmodSync2,
+  closeSync,
+  createReadStream,
+  existsSync as existsSync2,
+  lstatSync,
+  mkdirSync as mkdirSync2,
+  openSync,
+  readFileSync as readFileSync2,
+  readSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { createWriteStream } from "node:fs";
+import { createHash } from "node:crypto";
+import { join as join2 } from "node:path";
+import { z as z5 } from "zod";
+var MODEL_LIMITS = {
+  maxManifestBytes: 65536,
+  maxModelBytes: 8589934592,
+  maxModels: 16,
+  maxGgufTensors: 1e6,
+  maxGgufMetadataEntries: 1e6,
+  downloadTimeoutMs: 3600000
+};
+var modelIdSchema = z5.string().min(1).max(64).regex(/^[a-z0-9][a-z0-9.-]*$/, "lowercase letters, digits, dots, hyphens");
+var MODEL_KINDS = ["gguf"];
+var modelKindSchema = z5.enum(MODEL_KINDS);
+var KIND_EXTENSIONS = {
+  gguf: "gguf"
+};
+var installedModelSchema = z5.object({
+  id: modelIdSchema,
+  kind: modelKindSchema.default("gguf"),
+  file: z5.string().min(1).max(128).regex(/^[a-z0-9][a-z0-9.-]*\.gguf$/, "safe lowercase model filename"),
+  size_b: z5.number().positive().max(1e4).optional(),
+  source: z5.string().min(1).max(512),
+  sha256: z5.string().regex(/^[0-9a-f]{64}$/),
+  bytes: z5.number().int().positive(),
+  context: z5.number().int().min(64).max(1048576).default(4096),
+  installed_at: z5.string().max(64)
+});
+var manifestSchema = z5.object({
+  version: z5.literal(1),
+  models: z5.array(installedModelSchema).max(MODEL_LIMITS.maxModels).default([])
+});
+var MODEL_REGISTRY = [
+  {
+    id: "qwen3-0.6b",
+    kind: "gguf",
+    size_b: 0.6,
+    repo: "unsloth/Qwen3-0.6B-GGUF",
+    revision: "50968a4468ef4233ed78cd7c3de230dd1d61a56b",
+    file: "Qwen3-0.6B-Q4_0.gguf",
+    sha256: "33bcc57074ec7b6eada5a90651ee546ec0c2b271002c22baf9f1b2dd1e8f75cb",
+    bytes: 382156480,
+    context: 2048,
+    description: "Qwen3 0.6B Q4_0: experimental diagnostic model (365 MiB)",
+    experimental: true
+  },
+  {
+    id: "qwen3-1.7b",
+    kind: "gguf",
+    size_b: 1.7,
+    repo: "unsloth/Qwen3-1.7B-GGUF",
+    revision: "d7f544eead698dbd1f15126ef60b45a1e1933222",
+    file: "Qwen3-1.7B-Q4_K_M.gguf",
+    sha256: "b139949c5bd74937ad8ed8c8cf3d9ffb1e99c866c823204dc42c0d91fa181897",
+    bytes: 1107409472,
+    context: 2048,
+    description: "Qwen3 1.7B Q4_K_M: experimental default local model (1.0 GiB)",
+    experimental: true
+  },
+  {
+    id: "qwen3.5-4b",
+    kind: "gguf",
+    size_b: 4,
+    repo: "unsloth/Qwen3.5-4B-GGUF",
+    revision: "e87f176479d0855a907a41277aca2f8ee7a09523",
+    file: "Qwen3.5-4B-Q4_K_M.gguf",
+    sha256: "00fe7986ff5f6b463e62455821146049db6f9313603938a70800d1fb69ef11a4",
+    bytes: 2740937888,
+    context: 2048,
+    description: "Qwen3.5 4B Q4_K_M: experimental local decision model (2.6 GiB)",
+    experimental: true
+  }
+];
+function modelsDir(home) {
+  return join2(home, "models");
+}
+function manifestPath(home) {
+  return join2(modelsDir(home), "manifest.json");
+}
+function loadManifestChecked(home) {
+  const path = manifestPath(home);
+  if (!existsSync2(path))
+    return { ok: true, manifest: { version: 1, models: [] } };
+  let parsed;
+  try {
+    const stats = lstatSync(path);
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+      return { ok: false, message: "model manifest is not a regular file" };
+    }
+    if (stats.size > MODEL_LIMITS.maxManifestBytes) {
+      return { ok: false, message: `model manifest exceeds ${MODEL_LIMITS.maxManifestBytes} bytes` };
+    }
+    parsed = JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return { ok: false, message: `model manifest is not valid JSON: ${path}` };
+  }
+  const records = typeof parsed === "object" && parsed !== null && "models" in parsed ? parsed.models : undefined;
+  if (Array.isArray(records) && records.some((model) => {
+    if (typeof model !== "object" || model === null)
+      return false;
+    const record = model;
+    return record["kind"] === "scorer" || record["kind"] === "needle" || Object.keys(record).some((key) => key.startsWith("engine_")) || typeof record["file"] === "string" && /\.(pt|cact)$/.test(record["file"]);
+  })) {
+    return {
+      ok: false,
+      message: "legacy scorer/Needle model inventory is unsupported; use a new SYS1_HOME for Qwen. Existing manifest and model files were not changed."
+    };
+  }
+  const result = manifestSchema.safeParse(parsed);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    return {
+      ok: false,
+      message: `invalid model manifest${issue === undefined ? "" : ` at ${issue.path.join(".")}: ${issue.message}`}`
+    };
+  }
+  return { ok: true, manifest: result.data };
+}
+
+class ModelStoreError extends Error {
+  name = "ModelStoreError";
+}
+function loadManifest(home) {
+  const result = loadManifestChecked(home);
+  if (!result.ok)
+    throw new ModelStoreError(result.message);
+  return result.manifest;
+}
+function saveManifest(home, manifest) {
+  const current = loadManifestChecked(home);
+  if (!current.ok)
+    throw new ModelStoreError(current.message);
+  const parsed = manifestSchema.parse(manifest);
+  mkdirSync2(modelsDir(home), { recursive: true, mode: 448 });
+  const path = manifestPath(home);
+  const temporary = `${path}.tmp`;
+  writeFileSync2(temporary, `${JSON.stringify(parsed, null, 2)}
+`, { mode: 384 });
+  renameSync(temporary, path);
+  chmodSync2(path, 384);
+}
+function modelFilePath(home, model) {
+  return join2(modelsDir(home), model.file);
+}
+function inspectGgufFile(path) {
+  let descriptor = null;
+  try {
+    const stats = lstatSync(path);
+    if (!stats.isFile() || stats.isSymbolicLink()) {
+      return { ok: false, message: "model path is not a regular file" };
+    }
+    if (stats.size < 24)
+      return { ok: false, message: "GGUF header is truncated" };
+    descriptor = openSync(path, "r");
+    const header = Buffer.alloc(24);
+    const bytesRead = readSync(descriptor, header, 0, header.length, 0);
+    if (bytesRead !== header.length)
+      return { ok: false, message: "GGUF header is truncated" };
+    if (header.toString("ascii", 0, 4) !== "GGUF") {
+      return { ok: false, message: "file does not start with GGUF magic" };
+    }
+    const version = header.readUInt32LE(4);
+    if (version < 1 || version > 3) {
+      return { ok: false, message: `unsupported GGUF version ${version}` };
+    }
+    const tensors = header.readBigUInt64LE(8);
+    const metadata2 = header.readBigUInt64LE(16);
+    if (tensors > BigInt(MODEL_LIMITS.maxGgufTensors)) {
+      return { ok: false, message: "GGUF tensor count exceeds the admission limit" };
+    }
+    if (metadata2 > BigInt(MODEL_LIMITS.maxGgufMetadataEntries)) {
+      return { ok: false, message: "GGUF metadata count exceeds the admission limit" };
+    }
+    return {
+      ok: true,
+      version,
+      tensors: Number(tensors),
+      metadata_entries: Number(metadata2),
+      bytes: stats.size
+    };
+  } catch (error) {
+    return { ok: false, message: error instanceof Error ? error.message : "cannot inspect GGUF" };
+  } finally {
+    if (descriptor !== null)
+      closeSync(descriptor);
+  }
+}
+function installedModels(home) {
+  return loadManifest(home).models.filter((model) => {
+    try {
+      const stats = lstatSync(modelFilePath(home, model));
+      if (!stats.isFile() || stats.isSymbolicLink())
+        return false;
+      return true;
+    } catch {
+      return false;
+    }
+  });
+}
+function findInstalled(home, id) {
+  return installedModels(home).find((model) => model.id === id);
+}
+function findRegistry(id) {
+  return MODEL_REGISTRY.find((entry) => entry.id === id);
+}
+function resolvePullTarget(ref) {
+  const entry = findRegistry(ref);
+  if (entry !== undefined) {
+    if (!/^[0-9a-f]{40}$/.test(entry.revision)) {
+      return { error: `invalid registry revision for ${entry.id}; expected an immutable 40-character commit` };
+    }
+    return { kind: "registry", entry };
+  }
+  if (ref.startsWith("hf:")) {
+    const rest = ref.slice(3);
+    const colon = rest.lastIndexOf(":");
+    if (colon <= 0)
+      return { error: "hf ref looks like hf:<org>/<repo>:<file.gguf>" };
+    const repo = rest.slice(0, colon);
+    const file = rest.slice(colon + 1);
+    if (!/^[\w.-]+\/[\w.-]+$/.test(repo))
+      return { error: `bad repo ${repo}` };
+    const segments = file.split("/");
+    if (!/^[\w./-]+\.gguf$/.test(file) || file.startsWith("/") || segments.some((segment) => segment === "." || segment === "..")) {
+      return { error: `file must be a relative .gguf path: ${file}` };
+    }
+    const modelKind = "gguf";
+    const id = file.replace(/\.gguf$/, "").toLowerCase().replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64);
+    if (!modelIdSchema.safeParse(id).success)
+      return { error: `cannot derive a model id from ${file}` };
+    return { kind: "hf", modelKind, repo, file, id };
+  }
+  return { error: `unknown model ${ref}; run \`sys1 pull --list\` for the registry` };
+}
+async function fetchHfSha256(repo, file, fetchFn) {
+  try {
+    const dir = file.includes("/") ? file.slice(0, file.lastIndexOf("/")) : "";
+    const treePath = dir.length > 0 ? `/${dir}` : "";
+    const response = await fetchFn(`https://huggingface.co/api/models/${repo}/tree/main${treePath}`, {
+      signal: AbortSignal.timeout(15000)
+    });
+    if (!response.ok)
+      return null;
+    const entries = await response.json();
+    if (!Array.isArray(entries))
+      return null;
+    const base = file.includes("/") ? file.slice(file.lastIndexOf("/") + 1) : file;
+    for (const item of entries) {
+      if (typeof item !== "object" || item === null)
+        continue;
+      const path = item["path"];
+      if (path !== file && path !== base)
+        continue;
+      const lfs = item["lfs"];
+      if (typeof lfs === "object" && lfs !== null) {
+        const oid = lfs["oid"];
+        if (typeof oid === "string" && /^[0-9a-f]{64}$/.test(oid))
+          return oid;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function downloadVerified(url, tmpPath, expectedSha, expectedBytes, fetchFn, onProgress) {
+  let response;
+  try {
+    response = await fetchFn(url, {
+      redirect: "follow",
+      signal: AbortSignal.timeout(MODEL_LIMITS.downloadTimeoutMs)
+    });
+  } catch (error) {
+    return { ok: false, message: `download failed: ${error instanceof Error ? error.name : "transport"}` };
+  }
+  if (!response.ok || response.body === null) {
+    return { ok: false, message: `download failed: HTTP ${response.status} for ${url}` };
+  }
+  const lengthHeader = response.headers.get("content-length");
+  const contentLength = lengthHeader === null ? null : Number(lengthHeader);
+  if (contentLength !== null && Number.isFinite(contentLength) && contentLength > MODEL_LIMITS.maxModelBytes) {
+    return { ok: false, message: "model exceeds the 8 GiB store limit" };
+  }
+  if (expectedBytes !== null && contentLength !== null && Number.isFinite(contentLength) && contentLength !== expectedBytes) {
+    return { ok: false, message: `remote size mismatch for ${url}` };
+  }
+  const hash = createHash("sha256");
+  const sink = createWriteStream(tmpPath, { mode: 384 });
+  let writeFailure;
+  sink.on("error", (error) => {
+    writeFailure = error;
+  });
+  let received = 0;
+  try {
+    const reader = response.body.getReader();
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done)
+        break;
+      received += value.byteLength;
+      if (received > MODEL_LIMITS.maxModelBytes) {
+        throw new Error("model exceeds the 8 GiB store limit");
+      }
+      hash.update(value);
+      if (!sink.write(value)) {
+        await new Promise((resolveDrain, rejectDrain) => {
+          const drained = () => {
+            sink.off("error", failed);
+            resolveDrain();
+          };
+          const failed = (error) => {
+            sink.off("drain", drained);
+            rejectDrain(error);
+          };
+          sink.once("drain", drained);
+          sink.once("error", failed);
+        });
+      }
+      if (writeFailure !== undefined)
+        throw writeFailure;
+      onProgress?.(received, expectedBytes);
+    }
+    await new Promise((resolveEnd, rejectEnd) => {
+      sink.once("finish", resolveEnd);
+      sink.once("error", rejectEnd);
+      sink.end();
+    });
+    if (writeFailure !== undefined)
+      throw writeFailure;
+  } catch (error) {
+    sink.destroy();
+    rmSync(tmpPath, { force: true });
+    return { ok: false, message: `download failed: ${error instanceof Error ? error.message : "io"}` };
+  }
+  const digest = hash.digest("hex");
+  if (digest !== expectedSha) {
+    rmSync(tmpPath, { force: true });
+    return {
+      ok: false,
+      message: `sha256 mismatch: got ${digest.slice(0, 16)}…, expected ${expectedSha.slice(0, 16)}…`
+    };
+  }
+  if (expectedBytes !== null && received !== expectedBytes) {
+    rmSync(tmpPath, { force: true });
+    return { ok: false, message: `size mismatch: got ${received}, expected ${expectedBytes}` };
+  }
+  return { ok: true, received, digest };
+}
+async function pullModel(home, ref, options = {}) {
+  const target = resolvePullTarget(ref);
+  if ("error" in target)
+    return { ok: false, message: target.error };
+  const fetchFn = options.fetchFn ?? fetch;
+  const id = target.kind === "registry" ? target.entry.id : target.id;
+  const repo = target.kind === "registry" ? target.entry.repo : target.repo;
+  const revision = target.kind === "registry" ? target.entry.revision : "main";
+  const file = target.kind === "registry" ? target.entry.file : target.file;
+  const modelKind = target.kind === "registry" ? target.entry.kind : target.modelKind;
+  const loaded = loadManifestChecked(home);
+  if (!loaded.ok)
+    return { ok: false, message: loaded.message };
+  const manifest = loaded.manifest;
+  if (manifest.models.some((model) => model.id === id)) {
+    return { ok: false, message: `${id} is already installed` };
+  }
+  const extension = KIND_EXTENSIONS[modelKind];
+  const finalPath = join2(modelsDir(home), `${id}.${extension}`);
+  if (existsSync2(finalPath)) {
+    return { ok: false, message: `${finalPath} exists but is not registered; move it before pulling` };
+  }
+  if (manifest.models.length >= MODEL_LIMITS.maxModels) {
+    return { ok: false, message: `model store is full (${MODEL_LIMITS.maxModels})` };
+  }
+  let expectedSha = options.sha256;
+  let expectedBytes = null;
+  if (target.kind === "registry") {
+    expectedSha = target.entry.sha256;
+    expectedBytes = target.entry.bytes;
+  } else if (expectedSha === undefined) {
+    expectedSha = await fetchHfSha256(repo, file, fetchFn) ?? undefined;
+  }
+  if (expectedSha === undefined) {
+    return {
+      ok: false,
+      message: `no sha256 available for ${repo}:${file}; pass --sha256 to verify the download`
+    };
+  }
+  mkdirSync2(modelsDir(home), { recursive: true, mode: 448 });
+  const tmpPath = `${finalPath}.download`;
+  const weights = await downloadVerified(`https://huggingface.co/${repo}/resolve/${revision}/${file}`, tmpPath, expectedSha, expectedBytes, fetchFn, options.onProgress);
+  if (!weights.ok)
+    return { ok: false, message: weights.message ?? "download failed" };
+  const received = weights.received ?? 0;
+  const digest = weights.digest ?? "";
+  const inspection = inspectGgufFile(tmpPath);
+  if (!inspection.ok) {
+    rmSync(tmpPath, { force: true });
+    return { ok: false, message: `invalid GGUF ${file}: ${inspection.message}` };
+  }
+  renameSync(tmpPath, finalPath);
+  chmodSync2(finalPath, 384);
+  const next = structuredClone(manifest);
+  next.models.push({
+    id,
+    kind: modelKind,
+    file: `${id}.${extension}`,
+    ...target.kind === "registry" ? { size_b: target.entry.size_b } : {},
+    source: `hf:${repo}:${file}`,
+    sha256: digest,
+    bytes: received,
+    context: target.kind === "registry" ? target.entry.context : 2048,
+    installed_at: new Date().toISOString()
+  });
+  saveManifest(home, next);
+  return { ok: true, id, path: finalPath, bytes: received };
+}
+function removeModel(home, id) {
+  const loaded = loadManifestChecked(home);
+  if (!loaded.ok)
+    return { ok: false, message: loaded.message };
+  const manifest = loaded.manifest;
+  const model = manifest.models.find((entry) => entry.id === id);
+  if (model === undefined)
+    return { ok: false, message: `no installed model named ${id}` };
+  rmSync(modelFilePath(home, model), { force: true });
+  manifest.models = manifest.models.filter((entry) => entry.id !== id);
+  saveManifest(home, manifest);
+  return { ok: true, message: `removed ${id}` };
+}
+async function hashFile(path) {
+  const hash = createHash("sha256");
+  try {
+    for await (const chunk of createReadStream(path))
+      hash.update(chunk);
+    return hash.digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function verifyModel(home, id) {
+  const loaded = loadManifestChecked(home);
+  if (!loaded.ok)
+    return { ok: false, message: loaded.message };
+  const model = loaded.manifest.models.find((entry) => entry.id === id);
+  if (model === undefined)
+    return { ok: false, message: `no installed model named ${id}` };
+  const path = modelFilePath(home, model);
+  const actual = await hashFile(path);
+  if (actual === null)
+    return { ok: false, message: "cannot read model" };
+  if (actual !== model.sha256) {
+    return { ok: false, expected: model.sha256, actual, message: "sha256 mismatch" };
+  }
+  const gguf = inspectGgufFile(path);
+  if (!gguf.ok) {
+    return {
+      ok: false,
+      expected: model.sha256,
+      actual,
+      message: `invalid GGUF: ${gguf.message}`
+    };
+  }
+  return { ok: true, expected: model.sha256, actual, gguf };
+}
+function storeBytes(home) {
+  return installedModels(home).reduce((total, model) => {
+    let bytes = 0;
+    try {
+      bytes += statSync(modelFilePath(home, model)).size;
+    } catch {
+      return total;
+    }
+    return total + bytes;
+  }, 0);
+}
+
+// src/local/runner.ts
+var BUILTIN_PREFIX = "local-";
+function builtinName(modelId) {
+  return `${BUILTIN_PREFIX}${modelId}`;
+}
+function builtinCandidates(home, enabled, selectedModel = DEFAULT_LOCAL_MODELS.quality) {
+  if (!enabled)
+    return [];
+  return installedModels(home).map((model) => ({
+    name: builtinName(model.id),
+    kind: "local",
+    builtin: true,
+    model,
+    available: true,
+    models: [model.id],
+    size_b: model.size_b ?? null,
+    cost_rank: 0,
+    explicitOnly: model.id !== selectedModel,
+    capabilities: { maxOptions: DECIDE_LIMITS.maxLabels }
+  }));
+}
+function defaultEngineFactory(contextSize, evalTimeoutMs) {
+  return (model, path) => new LlamaEngine({
+    modelPath: path,
+    modelId: model.id,
+    contextSize,
+    evalTimeoutMs
+  });
+}
+
+class LocalRunner {
+  options;
+  engines = new Map;
+  shutdownController = new AbortController;
+  requestQueue = Promise.resolve();
+  constructor(options) {
+    this.options = options;
+  }
+  loadedModels() {
+    return [...this.engines.keys()];
+  }
+  residentCount() {
+    return this.engines.size;
+  }
+  async evictOldest() {
+    let oldest = null;
+    for (const [id, entry] of this.engines) {
+      if (oldest === null || entry.touched < oldest.touched)
+        oldest = { id, touched: entry.touched };
+    }
+    if (oldest === null)
+      return;
+    const stale = this.engines.get(oldest.id);
+    this.engines.delete(oldest.id);
+    if (stale !== undefined)
+      await stale.engine.dispose().catch(() => {});
+  }
+  async engineFor(model) {
+    const cached = this.engines.get(model.id);
+    if (cached !== undefined) {
+      cached.touched = Date.now();
+      return cached.engine;
+    }
+    if (this.residentCount() >= this.options.maxLoadedModels) {
+      await this.evictOldest();
+    }
+    const engine = this.options.engineFactory(model, modelFilePath(this.options.home, model));
+    this.engines.set(model.id, { engine, touched: Date.now() });
+    return engine;
+  }
+  decide(request, modelId, signal) {
+    const activeSignal = signal === undefined ? this.shutdownController.signal : AbortSignal.any([signal, this.shutdownController.signal]);
+    const run = this.requestQueue.then(() => this.decideNow(request, modelId, activeSignal)).catch((error) => ({
+      ok: false,
+      error: {
+        type: error instanceof LocalInputError ? "local_question_unsupported" : activeSignal.aborted ? "inference_timeout" : "inference_failed",
+        message: error instanceof Error ? error.message : "local inference failed"
+      }
+    }));
+    this.requestQueue = run;
+    return run;
+  }
+  async decideNow(request, modelId, signal) {
+    signal?.throwIfAborted();
+    const model = findInstalled(this.options.home, modelId);
+    if (model === undefined) {
+      return {
+        ok: false,
+        error: { type: "unknown_model", message: `no installed model named ${modelId}` }
+      };
+    }
+    return this.decideGguf(request, model, signal);
+  }
+  async decideGguf(request, model, signal) {
+    const questions = questionEntries(request);
+    const unsupported = questions.find(([, question]) => question.type === "choice" ? Object.keys(question.criteria).length > DECIDE_LIMITS.maxLabels : question.type === "score" && question.criteria.length > DECIDE_LIMITS.maxLabels);
+    if (unsupported !== undefined) {
+      return {
+        ok: false,
+        error: {
+          type: "local_question_unsupported",
+          message: `builtin GGUF models support at most ${DECIDE_LIMITS.maxLabels} choice options`
+        }
+      };
+    }
+    let engine;
+    try {
+      engine = await this.engineFor(model);
+    } catch (error) {
+      return {
+        ok: false,
+        error: {
+          type: "engine_unavailable",
+          message: error instanceof Error ? error.message : "engine failed to load"
+        }
+      };
+    }
+    const answers = {};
+    const diagnostics = {};
+    let inputTokens = 0;
+    try {
+      signal?.throwIfAborted();
+      for (const [name, question] of questions) {
+        signal?.throwIfAborted();
+        const labels = answerLabels(question);
+        const prompt = decisionPrompt(request.state, question);
+        const distribution = await engine.firstTokenDistribution(prompt, signal);
+        inputTokens += distribution.inputTokens;
+        const mass = aggregateMass(distribution.entries, labels);
+        const outcome = outcomeFromMass(mass, labels);
+        if (outcome === null) {
+          return {
+            ok: false,
+            error: {
+              type: "inference_unreadable",
+              message: `model assigned no probability mass to allowed labels for ${name}`
+            }
+          };
+        }
+        answers[name] = toLocalAnswer(question, outcome);
+        diagnostics[name] = {
+          coverage: Math.round(outcome.coverage * 1000) / 1000,
+          concentration: Math.round(confidenceOf(outcome.distribution) * 1000) / 1000
+        };
+      }
+    } catch (error) {
+      const unavailable2 = error instanceof EngineUnavailableError;
+      return {
+        ok: false,
+        error: {
+          type: error instanceof LocalInputError ? "local_question_unsupported" : signal?.aborted === true ? "inference_timeout" : unavailable2 ? "engine_unavailable" : "inference_failed",
+          message: error instanceof Error ? error.message : "local inference failed"
+        }
+      };
+    }
+    return {
+      ok: true,
+      adapter: "generic-gguf",
+      response: toLocalResponse(model.id, answers, {
+        input_tokens: inputTokens,
+        output_tokens: 0
+      }),
+      diagnostics
+    };
+  }
+  async dispose() {
+    this.shutdownController.abort();
+    await this.requestQueue.catch(() => {});
+    const engines = [...this.engines.values()];
+    this.engines.clear();
+    await Promise.all(engines.map((entry) => entry.engine.dispose().catch(() => {})));
+  }
+}
+
+// src/backends.ts
+var HOSTED_BACKEND_NAME = "typesafe";
+var MAX_PROBE_BYTES = 1048576;
+var MAX_RESPONSE_BYTES2 = 4194304;
+function trimTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/")
+    end -= 1;
+  return value.slice(0, end);
+}
+function boundedSignal(timeoutMs, signal) {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  return signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+}
+var modelsResponseSchema = z6.union([
+  z6.object({ data: z6.array(z6.union([z6.string(), z6.object({ id: z6.string() })])) }),
+  z6.object({ models: z6.array(z6.union([z6.string(), z6.object({ id: z6.string() })])) }),
+  z6.array(z6.union([z6.string(), z6.object({ id: z6.string() })]))
+]);
+var limitsResponseSchema = z6.object({
+  max_answers_per_question: z6.number().int().positive().optional(),
+  max_questions: z6.number().int().positive().optional()
+}).loose();
+function extractModelIds(body) {
+  const parsed = modelsResponseSchema.safeParse(body);
+  if (!parsed.success)
+    return [];
+  const list = Array.isArray(parsed.data) ? parsed.data : ("data" in parsed.data) ? parsed.data.data : parsed.data.models;
+  return list.map((entry) => typeof entry === "string" ? entry : entry.id).filter((id) => id.length > 0).slice(0, 512);
+}
+function extractBackendCapabilities(body) {
+  const parsed = limitsResponseSchema.safeParse(body);
+  if (!parsed.success)
+    return null;
+  return {
+    ...parsed.data.max_answers_per_question === undefined ? {} : { maxOptions: parsed.data.max_answers_per_question },
+    ...parsed.data.max_questions === undefined ? {} : { maxQuestions: parsed.data.max_questions }
+  };
+}
+function constrainedCapabilities(configured, published) {
+  const maxOptions = configured?.maxOptions === undefined ? published.maxOptions : published.maxOptions === undefined ? configured.maxOptions : Math.min(configured.maxOptions, published.maxOptions);
+  const maxQuestions = configured?.maxQuestions === undefined ? published.maxQuestions : published.maxQuestions === undefined ? configured.maxQuestions : Math.min(configured.maxQuestions, published.maxQuestions);
+  return {
+    ...maxOptions === undefined ? {} : { maxOptions },
+    ...maxQuestions === undefined ? {} : { maxQuestions }
+  };
+}
+function runtimeBackends(config, env, home) {
+  const backends = [];
+  if (config.hosted.enabled) {
+    const apiKey = env[config.hosted.api_key_env];
+    if (apiKey !== undefined && apiKey.length > 0) {
+      backends.push({
+        name: HOSTED_BACKEND_NAME,
+        kind: "hosted",
+        available: false,
+        models: [config.hosted.model],
+        size_b: null,
+        cost_rank: 0,
+        base_url: trimTrailingSlashes(config.hosted.base_url),
+        headers: { authorization: `Bearer ${apiKey}` },
+        default_model: config.hosted.model
+      });
+    }
+  }
+  for (const local of config.backends) {
+    if (!local.enabled)
+      continue;
+    backends.push(localRuntimeBackend(local));
+  }
+  if (home !== undefined && config.local.enabled && config.routing.policy !== "hosted-only") {
+    for (const candidate of builtinCandidates(home, true, config.local.model)) {
+      backends.push({
+        name: candidate.name,
+        kind: "local",
+        available: candidate.available,
+        models: candidate.models,
+        size_b: candidate.size_b,
+        cost_rank: candidate.cost_rank,
+        explicitOnly: candidate.explicitOnly,
+        capabilities: candidate.capabilities,
+        base_url: "",
+        headers: {},
+        default_model: candidate.model.id,
+        builtin: {
+          model: candidate.model,
+          path: join3(modelsDir(home), candidate.model.file)
+        }
+      });
+    }
+  }
+  return backends;
+}
+function localRuntimeBackend(local) {
+  const hostname = new URL(local.base_url).hostname;
+  const host = hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
+  return {
+    name: local.name,
+    explicitOnly: true,
+    kind: isLoopbackHost(host) ? "local" : "hosted",
+    available: false,
+    models: [local.model],
+    size_b: local.size_b ?? null,
+    cost_rank: local.cost_rank ?? 0,
+    ...local.capabilities === undefined ? {} : {
+      capabilities: {
+        ...local.capabilities.max_options === undefined ? {} : { maxOptions: local.capabilities.max_options },
+        ...local.capabilities.max_questions === undefined ? {} : { maxQuestions: local.capabilities.max_questions }
+      }
+    },
+    base_url: trimTrailingSlashes(local.base_url),
+    headers: {},
+    default_model: local.model,
+    ...local.adapter === undefined ? {} : { adapter: local.adapter }
+  };
+}
+async function probeLimits(backend, timeoutMs, fetchFn, signal) {
+  try {
+    const activeSignal = boundedSignal(timeoutMs, signal);
+    activeSignal.throwIfAborted();
+    const response = await fetchFn(`${backend.base_url}/v1/limits`, {
+      method: "GET",
+      headers: { accept: "application/json", ...backend.headers },
+      redirect: "manual",
+      signal: activeSignal
+    });
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      return;
+    }
+    const published = extractBackendCapabilities(JSON.parse(await readBoundedText(response, MAX_PROBE_BYTES, activeSignal)));
+    if (published === null)
+      return;
+    backend.capabilities = constrainedCapabilities(backend.capabilities, published);
+  } catch {}
+}
+async function probeBackend(backend, timeoutMs, fetchFn = fetch, signal) {
+  signal?.throwIfAborted();
+  if (backend.builtin !== undefined) {
+    const present = existsSync3(backend.builtin.path);
+    return {
+      available: present,
+      models: backend.models,
+      latency_ms: 0,
+      detail: present ? null : "model file missing"
+    };
+  }
+  const started = Date.now();
+  try {
+    const activeSignal = boundedSignal(timeoutMs, signal);
+    const response = await fetchFn(`${backend.base_url}/v1/models`, {
+      method: "GET",
+      headers: { accept: "application/json", ...backend.headers },
+      redirect: "manual",
+      signal: activeSignal
+    });
+    const latency = Date.now() - started;
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      return {
+        available: false,
+        models: backend.models,
+        latency_ms: latency,
+        detail: `GET /v1/models -> ${response.status}`
+      };
+    }
+    const body = JSON.parse(await readBoundedText(response, MAX_PROBE_BYTES, activeSignal));
+    const models = extractModelIds(body);
+    await probeLimits(backend, timeoutMs, fetchFn, signal);
+    return {
+      available: true,
+      models: models.length > 0 ? models : backend.models,
+      latency_ms: latency,
+      detail: null
+    };
+  } catch (error) {
+    return {
+      available: false,
+      models: backend.models,
+      latency_ms: null,
+      detail: error instanceof Error ? error.name : "probe_failed"
+    };
+  }
+}
+async function probeAll(backends, timeoutMs, fetchFn = fetch, signal) {
+  const results = await Promise.all(backends.map(async (backend) => {
+    const result = await probeBackend(backend, timeoutMs, fetchFn, signal);
+    backend.available = result.available;
+    backend.models = result.models;
+    return [backend.name, result];
+  }));
+  return new Map(results);
+}
+async function forwardToBackend(backend, rawBody, resolvedModel, timeoutMs, fetchFn = fetch, signal) {
+  let body = rawBody;
+  if (resolvedModel !== undefined) {
+    try {
+      const parsed = JSON.parse(rawBody);
+      parsed["model"] = resolvedModel;
+      body = JSON.stringify(parsed);
+    } catch {}
+  }
+  const activeSignal = boundedSignal(timeoutMs, signal);
+  let response;
+  try {
+    activeSignal.throwIfAborted();
+    response = await fetchFn(`${backend.base_url}/v1/systemone`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json",
+        ...backend.headers
+      },
+      body,
+      redirect: "manual",
+      signal: activeSignal
+    });
+  } catch (error) {
+    const detail = error instanceof Error && error.name === "TimeoutError" ? "backend timeout" : error instanceof Error ? error.name : "transport failure";
+    return { kind: "transport", detail };
+  }
+  try {
+    const text = await readBoundedText(response, MAX_RESPONSE_BYTES2, activeSignal);
+    return {
+      kind: "response",
+      status: response.status,
+      body: text,
+      content_type: response.headers.get("content-type") ?? "application/json"
+    };
+  } catch (error) {
+    return {
+      kind: "response",
+      status: 502,
+      body: JSON.stringify(errorBody(error instanceof HttpBodyLimitError ? "backend_response_too_large" : "backend_response_unreadable", error instanceof HttpBodyLimitError ? "backend response exceeds 4 MiB" : "backend response body could not be read")),
+      content_type: "application/json"
+    };
+  }
+}
+// src/qualification.ts
+var QUALIFICATION_BODY_LIMIT = 4194304;
+async function boundedText(response) {
+  if (response.body === null)
+    return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (;; ) {
+      const next = await reader.read();
+      if (next.done)
+        break;
+      size += next.value.byteLength;
+      if (size > QUALIFICATION_BODY_LIMIT) {
+        await reader.cancel();
+        throw new Error("response exceeds 4 MiB");
+      }
+      chunks.push(next.value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return new TextDecoder().decode(Buffer.concat(chunks, size));
+}
+async function requestJson(url, init, timeoutMs, fetchFn) {
+  try {
+    const response = await fetchFn(url, {
+      ...init,
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const text = await boundedText(response);
+    if (!response.ok)
+      return { ok: false, detail: `HTTP ${response.status}` };
+    try {
+      return { ok: true, body: JSON.parse(text) };
+    } catch {
+      return { ok: false, detail: "response is not valid JSON" };
+    }
+  } catch (error) {
+    return {
+      ok: false,
+      detail: error instanceof Error ? error.message.slice(0, 256) : "request failed"
+    };
+  }
+}
+function withoutTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/")
+    end -= 1;
+  return value.slice(0, end);
+}
+function distributionTotal(probabilities) {
+  return Object.values(probabilities).reduce((sum, probability) => sum + probability, 0);
+}
+function responseContract(body) {
+  const parsed = systemOneResponseSchema.safeParse(body);
+  if (!parsed.success)
+    return "response does not match the System One schema";
+  const refund = parsed.data.answers["refund"];
+  const department = parsed.data.answers["department"];
+  const urgency = parsed.data.answers["urgency"];
+  if (refund?.type !== "noul" || department?.type !== "choice" || urgency?.type !== "score") {
+    return "response does not preserve the requested answer types";
+  }
+  if (Object.keys(parsed.data.answers).length !== 3) {
+    return "response answer keys differ from the request";
+  }
+  if (Object.keys(department.probabilities).sort().join(",") !== "billing,technical") {
+    return "choice probability keys differ from the request";
+  }
+  if (Object.keys(urgency.legend).join(",") !== "0,1,2" || Object.keys(urgency.probabilities).join(",") !== "0,1,2") {
+    return "score keys differ from the request";
+  }
+  if (Math.abs(distributionTotal(department.probabilities) - 1) > 0.02) {
+    return "choice probabilities are not normalized";
+  }
+  if (Math.abs(distributionTotal(urgency.probabilities) - 1) > 0.02) {
+    return "score probabilities are not normalized";
+  }
+  const expected = Object.entries(urgency.probabilities).reduce((sum, [level, probability]) => sum + Number(level) * probability, 0);
+  if (Math.abs(expected - urgency.score) > 0.02) {
+    return "score does not match its probability-weighted levels";
+  }
+  return null;
+}
+var QUALIFICATION_REQUEST = {
+  state: "The customer was charged twice, requests a refund, and can still use checkout.",
+  questions: {
+    refund: {
+      type: "noul",
+      instructions: "Does the customer explicitly request a refund?"
+    },
+    department: {
+      type: "choice",
+      instructions: "Which team should handle this request?",
+      criteria: {
+        billing: "Charges, payments, and refunds",
+        technical: "Software defects and unavailable features"
+      }
+    },
+    urgency: {
+      type: "score",
+      instructions: "Rate current operational urgency.",
+      criteria: ["no active impact", "limited impact", "critical outage"]
+    }
+  }
+};
+async function qualifyBackend(backend, options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const base = withoutTrailingSlashes(backend.base_url);
+  const checks = [];
+  const modelsResponse = await requestJson(`${base}/v1/models`, { method: "GET", redirect: "manual", headers: { accept: "application/json" } }, options.probeTimeoutMs, fetchFn);
+  if (!modelsResponse.ok) {
+    checks.push({ id: "models", status: "fail", summary: "model discovery failed", detail: modelsResponse.detail });
+  } else {
+    const models = extractModelIds(modelsResponse.body);
+    checks.push(models.includes(backend.model) ? { id: "models", status: "pass", summary: `backend serves ${backend.model}` } : {
+      id: "models",
+      status: "fail",
+      summary: `backend does not advertise ${backend.model}`,
+      detail: models.length === 0 ? "no valid model ids returned" : `advertised: ${models.slice(0, 8).join(", ")}`
+    });
+  }
+  const limitsResponse = await requestJson(`${base}/v1/limits`, { method: "GET", redirect: "manual", headers: { accept: "application/json" } }, options.probeTimeoutMs, fetchFn);
+  if (!limitsResponse.ok) {
+    checks.push(backend.capabilities === undefined ? { id: "limits", status: "warn", summary: "backend does not publish limits", detail: limitsResponse.detail } : { id: "limits", status: "fail", summary: "configured capabilities could not be verified", detail: limitsResponse.detail });
+  } else {
+    const capabilities = extractBackendCapabilities(limitsResponse.body);
+    if (capabilities === null) {
+      checks.push({ id: "limits", status: "fail", summary: "limits response is invalid" });
+    } else {
+      const configured = backend.capabilities;
+      const tooSmall = configured?.max_options !== undefined && (capabilities.maxOptions === undefined || capabilities.maxOptions < configured.max_options) || configured?.max_questions !== undefined && (capabilities.maxQuestions === undefined || capabilities.maxQuestions < configured.max_questions);
+      checks.push(tooSmall ? { id: "limits", status: "fail", summary: "published limits are below the configured capabilities" } : {
+        id: "limits",
+        status: "pass",
+        summary: `limits published${capabilities.maxOptions === undefined ? "" : ` · ${capabilities.maxOptions} options`}${capabilities.maxQuestions === undefined ? "" : ` · ${capabilities.maxQuestions} questions`}`
+      });
+    }
+  }
+  const qualification = { ...QUALIFICATION_REQUEST, model: backend.model };
+  const decisionResponse = await requestJson(`${base}/v1/systemone`, {
+    method: "POST",
+    redirect: "manual",
+    headers: { accept: "application/json", "content-type": "application/json" },
+    body: JSON.stringify(backend.adapter === "kev" ? adaptKevRequest(qualification) : qualification)
+  }, options.requestTimeoutMs, fetchFn);
+  if (!decisionResponse.ok) {
+    checks.push({ id: "systemone", status: "fail", summary: "System One qualification request failed", detail: decisionResponse.detail });
+  } else {
+    let issue;
+    if (backend.adapter === "kev") {
+      try {
+        adaptKevResponse(qualification, decisionResponse.body);
+        issue = null;
+      } catch {
+        issue = "response does not match the Kev decision contract";
+      }
+    } else {
+      issue = responseContract(decisionResponse.body);
+    }
+    checks.push(issue === null ? { id: "systemone", status: "pass", summary: "noul, choice, and score response is conformant" } : { id: "systemone", status: "fail", summary: issue });
+  }
+  return {
+    version: 1,
+    backend: backend.name,
+    base_url: base,
+    model: backend.model,
+    ok: checks.every((check) => check.status !== "fail"),
+    checks
+  };
+}
+// src/gateway.ts
+var SYS1_VERSION = "0.17.0";
+var MAX_ATTEMPTS = 2;
+function currentConfig(deps) {
+  return deps.reloadConfig === undefined ? deps.config : deps.reloadConfig();
+}
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "content-type": "application/json", ...headers }
+  });
+}
+function forwardModel(requested, backend) {
+  if (requested === undefined || requested === "auto")
+    return backend.default_model;
+  const slash = requested.indexOf("/");
+  if (slash > 0)
+    return requested.slice(slash + 1);
+  return requested;
+}
+function localDiagnosticHeaders(adapter, diagnostics) {
+  const values = diagnostics === undefined ? [] : Object.values(diagnostics);
+  const coverage = values.length === 0 ? 0 : Math.min(...values.map((value) => value.coverage));
+  const concentration = values.length === 0 ? 0 : Math.min(...values.map((value) => value.concentration));
+  return {
+    "x-sys1-local-adapter": adapter ?? "generic-gguf",
+    "x-sys1-local-min-coverage": coverage.toFixed(3),
+    "x-sys1-local-min-concentration": concentration.toFixed(3)
+  };
+}
+function createFetchHandler(deps) {
+  const fetchFn = deps.fetchFn ?? fetch;
+  let runner = deps.localRunner ?? null;
+  function localRunner(config) {
+    if (deps.home === undefined)
+      return null;
+    if (runner === null) {
+      runner = new LocalRunner({
+        home: deps.home,
+        maxLoadedModels: config.local.max_loaded_models,
+        engineFactory: defaultEngineFactory(config.local.context_tokens, config.local.eval_timeout_ms)
+      });
+    }
+    return runner;
+  }
+  async function boundedLocalDecision(active, body, modelId, signal) {
+    signal.throwIfAborted();
+    let onAbort;
+    const cancelled = new Promise((_, reject) => {
+      onAbort = () => reject(signal.reason);
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+      return await Promise.race([
+        active.decide(body, modelId, signal),
+        cancelled
+      ]);
+    } finally {
+      if (onAbort !== undefined)
+        signal.removeEventListener("abort", onAbort);
+    }
+  }
+  function loadActiveConfig() {
+    try {
+      return currentConfig(deps);
+    } catch (error) {
+      return json(errorBody("config_invalid", error instanceof Error ? error.message : "config could not be loaded"), 503);
+    }
+  }
+  async function handleModels(config, signal) {
+    const backends = runtimeBackends(config, deps.env, deps.home);
+    await probeAll(backends, config.gateway.probe_timeout_ms, fetchFn, signal);
+    signal.throwIfAborted();
+    const data = backends.flatMap((backend) => backend.models.map((id) => ({
+      id,
+      backend: backend.name,
+      kind: backend.kind,
+      available: backend.available,
+      capabilities: backend.capabilities ?? null,
+      explicit_only: backend.explicitOnly === true,
+      ...backend.adapter === undefined ? {} : { adapter: backend.adapter }
+    })));
+    return json({ object: "list", data });
+  }
+  async function handleSystemOne(request, config, signal) {
+    const lengthHeader = request.headers.get("content-length");
+    if (lengthHeader !== null && Number(lengthHeader) > PROTOCOL_LIMITS.maxBodyBytes) {
+      return json(errorBody("request_too_large", "body exceeds 1 MiB"), 413);
+    }
+    let rawBody;
+    try {
+      rawBody = await readBoundedText(request, PROTOCOL_LIMITS.maxBodyBytes, signal);
+    } catch (error) {
+      signal.throwIfAborted();
+      return error instanceof HttpBodyLimitError ? json(errorBody("request_too_large", "body exceeds 1 MiB"), 413) : json(errorBody("request_unreadable", "request body could not be read"), 400);
+    }
+    let parsedJson;
+    try {
+      parsedJson = JSON.parse(rawBody);
+    } catch {
+      return json(errorBody("invalid_json", "request body is not valid JSON"), 400);
+    }
+    const parsed = systemOneRequestSchema.safeParse(parsedJson);
+    if (!parsed.success) {
+      const issue = parsed.error.issues[0];
+      const where = issue === undefined ? "" : `${issue.path.join(".")}: `;
+      const what = issue === undefined ? "invalid request" : issue.message;
+      return json(errorBody("invalid_request", `${where}${what}`), 422);
+    }
+    const body = parsed.data;
+    if (serializedBytes(body.state) > PROTOCOL_LIMITS.maxStateBytes) {
+      return json(errorBody("request_too_large", "state exceeds 256 KiB"), 413);
+    }
+    const backends = runtimeBackends(config, deps.env, deps.home);
+    if (backends.length === 0) {
+      return json(errorBody("no_backend_configured", "no backends configured; run `sys1 setup`, `sys1 jev enable`, or add a backend with `sys1 backend add`"), 503);
+    }
+    const policy = config.routing.policy;
+    const allowedProbes = backends.filter((backend) => policy === "local-only" ? backend.kind === "local" : policy === "hosted-only" ? backend.kind === "hosted" : true);
+    await probeAll(allowedProbes, config.gateway.probe_timeout_ms, fetchFn, signal);
+    signal.throwIfAborted();
+    const pinned = body.model !== undefined && body.model.includes("/");
+    const needs = requestNeeds(body);
+    let remaining = backends;
+    let lastTransport = null;
+    let attempts = 0;
+    for (let attempt = 0;attempt < MAX_ATTEMPTS && remaining.length > 0; attempt += 1) {
+      signal.throwIfAborted();
+      const choice = chooseBackend(policy, body.model, remaining, needs);
+      if (!choice.ok) {
+        if (lastTransport !== null)
+          break;
+        const status = choice.reason === "unknown_model" ? 404 : choice.reason === "request_unsupported" || choice.reason === "policy_restricted" ? 422 : 503;
+        return json(errorBody(choice.reason, choice.detail), status);
+      }
+      const backend = choice.backend;
+      const hopRequest = { ...body, model: forwardModel(body.model, backend) ?? backend.default_model };
+      const forwardedBody = backend.adapter === "kev" ? JSON.stringify(adaptKevRequest(hopRequest)) : rawBody;
+      if (new TextEncoder().encode(forwardedBody).byteLength > PROTOCOL_LIMITS.maxBodyBytes) {
+        return json(errorBody("request_too_large", "adapted request body exceeds 1 MiB"), 413);
+      }
+      attempts += 1;
+      let result;
+      if (backend.builtin !== undefined) {
+        const active = localRunner(config);
+        if (active === null) {
+          result = {
+            kind: "response",
+            status: 503,
+            body: JSON.stringify(errorBody("engine_unavailable", "local runner unavailable")),
+            content_type: "application/json"
+          };
+        } else {
+          const decided = await boundedLocalDecision(active, body, backend.builtin.model.id, signal);
+          result = decided.ok ? {
+            kind: "response",
+            status: 200,
+            body: JSON.stringify(decided.response),
+            content_type: "application/json",
+            extra_headers: localDiagnosticHeaders(decided.adapter, decided.diagnostics)
+          } : {
+            kind: "response",
+            status: decided.error?.type === "local_question_unsupported" ? 422 : decided.error?.type === "inference_timeout" ? 504 : decided.error?.type === "engine_unavailable" ? 503 : 502,
+            body: JSON.stringify(errorBody(decided.error?.type ?? "inference_failed", decided.error?.type === "local_question_unsupported" ? "request exceeds the local adapter's supported input limits" : decided.error?.type === "inference_timeout" ? "local inference timed out" : "local inference could not answer the request")),
+            content_type: "application/json"
+          };
+        }
+      } else {
+        result = await forwardToBackend(backend, forwardedBody, forwardModel(body.model, backend), config.gateway.request_timeout_ms, fetchFn, signal);
+      }
+      signal.throwIfAborted();
+      if (result.kind === "response") {
+        let status = result.status;
+        let responseBody = result.body;
+        let contentType = result.content_type;
+        if (status >= 200 && status < 300) {
+          contentType = "application/json";
+          try {
+            const value = JSON.parse(responseBody ?? "");
+            responseBody = JSON.stringify(backend.adapter === "kev" ? adaptKevResponse(hopRequest, value) : validateResponseForRequest(body, value));
+          } catch {
+            status = 502;
+            responseBody = JSON.stringify(errorBody("backend_response_invalid", "backend response does not match the requested decision contract"));
+          }
+        }
+        return new Response([204, 205, 304].includes(status) ? null : responseBody, {
+          status,
+          headers: {
+            "content-type": contentType,
+            "x-sys1-backend": backend.name,
+            "x-sys1-attempts": String(attempt + 1),
+            ...backend.adapter === "kev" && status >= 200 && status < 300 ? { "x-sys1-adapter": "kev", "x-sys1-probability-decimals": "2" } : {},
+            ..."extra_headers" in result ? result.extra_headers : {}
+          }
+        });
+      }
+      lastTransport = result.detail;
+      if (pinned)
+        break;
+      remaining = remaining.filter((candidate) => candidate.name !== backend.name);
+    }
+    return json(errorBody("no_backend_available", `no reachable backend answered the request${lastTransport === null ? "" : ` (${lastTransport})`}`), 503, { "x-sys1-attempts": String(attempts) });
+  }
+  return async function handler(request) {
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === "/healthz") {
+      return json({
+        ok: true,
+        version: SYS1_VERSION,
+        ...deps.daemon === undefined || request.headers.get("authorization") !== `Bearer ${deps.daemon.instance}` ? {} : { pid: process.pid, instance: deps.daemon.instance }
+      });
+    }
+    if (request.method === "POST" && url.pathname === "/_sys1/shutdown" && deps.daemon !== undefined) {
+      if (request.headers.get("authorization") !== `Bearer ${deps.daemon.instance}`) {
+        return json(errorBody("unauthorized", "daemon ownership proof required"), 401);
+      }
+      const daemon = deps.daemon;
+      setTimeout(() => {
+        Promise.resolve().then(() => daemon.onShutdown()).catch(() => {});
+      }, 0);
+      return json({ ok: true }, 202);
+    }
+    const models = request.method === "GET" && url.pathname === "/v1/models";
+    const decision = request.method === "POST" && url.pathname === "/v1/systemone";
+    if (models || decision) {
+      const config = loadActiveConfig();
+      if (config instanceof Response)
+        return config;
+      const controller = new AbortController;
+      const signal = controller.signal;
+      const onCallerAbort = () => controller.abort(request.signal.reason);
+      request.signal.addEventListener("abort", onCallerAbort, { once: true });
+      if (request.signal.aborted)
+        onCallerAbort();
+      const timer = setTimeout(() => {
+        controller.abort(new DOMException("request deadline exceeded", "TimeoutError"));
+      }, config.gateway.request_timeout_ms);
+      try {
+        signal.throwIfAborted();
+        return await (models ? handleModels(config, signal) : handleSystemOne(request, config, signal));
+      } catch (error) {
+        if (request.signal.aborted) {
+          return json(errorBody("request_cancelled", "caller cancelled the request"), 499);
+        }
+        if (signal.aborted) {
+          return json(errorBody("inference_timeout", "request deadline exceeded"), 504);
+        }
+        if (error instanceof ModelStoreError) {
+          return json(errorBody("model_store_invalid", "local model inventory is invalid; run `sys1 doctor`. Legacy scorer/Needle inventories require a new SYS1_HOME; existing files were not changed."), 503);
+        }
+        return json(errorBody("gateway_unavailable", "gateway could not process the request"), 503);
+      } finally {
+        clearTimeout(timer);
+        request.signal.removeEventListener("abort", onCallerAbort);
+      }
+    }
+    return json(errorBody("not_found", "unknown route"), 404);
+  };
+}
+function networkAdmission(request) {
+  const url = new URL(request.url);
+  const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname;
+  if (!isLoopbackHost(hostname) || url.username !== "" || url.password !== "") {
+    return json(errorBody("request_host_forbidden", "gateway requires a loopback request authority"), 403);
+  }
+  const host = request.headers.get("host");
+  if (host !== null) {
+    try {
+      const authority = new URL(`${url.protocol}//${host}`);
+      if (authority.origin !== url.origin || authority.username !== "" || authority.password !== "" || authority.pathname !== "/" || authority.search !== "" || authority.hash !== "") {
+        return json(errorBody("request_host_forbidden", "request Host must match its loopback authority"), 403);
+      }
+    } catch {
+      return json(errorBody("request_host_forbidden", "request Host is invalid"), 403);
+    }
+  }
+  if (request.headers.has("origin") || request.headers.has("sec-fetch-site")) {
+    return json(errorBody("browser_request_forbidden", "browser requests are not supported by the local gateway"), 403);
+  }
+  if (request.method === "POST" && url.pathname === "/v1/systemone" && request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
+    return json(errorBody("unsupported_media_type", "decision requests require application/json"), 415);
+  }
+  return null;
+}
+function createNetworkFetchHandler(deps) {
+  const handler = createFetchHandler(deps);
+  return async (request) => {
+    const rejected = networkAdmission(request);
+    if (rejected !== null) {
+      request.body?.cancel().catch(() => {});
+      return rejected;
+    }
+    return handler(request);
+  };
+}
+function startGateway(deps) {
+  const config = configSchema.parse(deps.config);
+  const localRunner = deps.localRunner ?? (deps.home === undefined ? undefined : new LocalRunner({
+    home: deps.home,
+    maxLoadedModels: config.local.max_loaded_models,
+    engineFactory: defaultEngineFactory(config.local.context_tokens, config.local.eval_timeout_ms)
+  }));
+  const handler = createNetworkFetchHandler({ ...deps, config, ...localRunner === undefined ? {} : { localRunner } });
+  const server = Bun.serve({
+    hostname: config.gateway.host,
+    port: deps.port ?? config.gateway.port,
+    fetch: handler,
+    maxRequestBodySize: PROTOCOL_LIMITS.maxBodyBytes
+  });
+  const boundPort = server.port ?? deps.port ?? config.gateway.port;
+  return {
+    url: `http://${config.gateway.host.includes(":") ? `[${config.gateway.host}]` : config.gateway.host}:${boundPort}`,
+    port: boundPort,
+    stop: async () => {
+      const disposing = localRunner?.dispose();
+      await server.stop(true);
+      if (disposing !== undefined)
+        await disposing;
+    }
+  };
+}
+// src/doctor.ts
+import {
+  accessSync,
+  constants,
+  existsSync as existsSync5,
+  readdirSync,
+  statSync as statSync2
+} from "node:fs";
+import { dirname } from "node:path";
+
+// src/daemon.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync3, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { z as z7 } from "zod";
+var pidFileSchema = z7.object({
+  pid: z7.number().int().positive(),
+  port: z7.number().int().positive(),
+  host: loopbackHostSchema,
+  instance: z7.string().uuid(),
+  started_at: z7.string()
+});
+function readPidFile(home) {
+  const path = pidPath(home);
+  if (!existsSync4(path))
+    return null;
+  try {
+    const parsed = pidFileSchema.safeParse(JSON.parse(readFileSync3(path, "utf8")));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function gatewayUrl(host, port) {
+  return `http://${host.includes(":") && !host.startsWith("[") ? `[${host}]` : host}:${port}`;
+}
+async function healthz(host, port, timeoutMs = 1500, fetchFn = fetch) {
+  try {
+    const response = await fetchFn(`${gatewayUrl(host, port)}/healthz`, {
+      signal: AbortSignal.timeout(timeoutMs),
+      redirect: "error"
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function ownedHealth(record, fetchFn = fetch) {
+  try {
+    const response = await fetchFn(`${gatewayUrl(record.host, record.port)}/healthz`, {
+      headers: { authorization: `Bearer ${record.instance}` },
+      signal: AbortSignal.timeout(1500),
+      redirect: "error"
+    });
+    if (!response.ok)
+      return false;
+    const value = JSON.parse(await readBoundedText(response, 4096, AbortSignal.timeout(1500)));
+    const parsed = z7.object({ ok: z7.literal(true), pid: z7.number(), instance: z7.string() }).safeParse(value);
+    return parsed.success && parsed.data.pid === record.pid && parsed.data.instance === record.instance;
+  } catch {
+    return false;
+  }
+}
+async function daemonStatus(home, config, fetchFn = fetch) {
+  const record = readPidFile(home);
+  if (record !== null && processAlive(record.pid)) {
+    if (await ownedHealth(record, fetchFn)) {
+      return {
+        state: "running",
+        pid: record.pid,
+        port: record.port,
+        host: record.host,
+        started_at: record.started_at
+      };
+    }
+    return { state: "stale_pidfile", pid: record.pid };
+  }
+  if (record !== null)
+    return { state: "stale_pidfile", pid: record.pid };
+  if (await healthz(config.gateway.host, config.gateway.port, 800, fetchFn)) {
+    return { state: "foreign_listener", port: config.gateway.port };
+  }
+  return { state: "stopped" };
+}
+async function daemonUp(options) {
+  const { home, config, cliEntry, env } = options;
+  const fetchFn = options.fetchFn ?? fetch;
+  const waitMs = options.waitMs ?? 8000;
+  const prior = await daemonStatus(home, config, fetchFn);
+  if (prior.state === "running") {
+    return {
+      ok: false,
+      message: `already running (pid ${prior.pid}) at ${gatewayUrl(prior.host, prior.port)}`
+    };
+  }
+  if (prior.state === "foreign_listener") {
+    return {
+      ok: false,
+      message: `port ${prior.port} already serves a health check not owned by sys1; pick another with --port`
+    };
+  }
+  mkdirSync3(home, { recursive: true, mode: 448 });
+  const log = openSync2(logPath(home), "a");
+  const child = Bun.spawn([process.execPath, cliEntry, "serve", "--daemon-child", "--port", String(config.gateway.port)], {
+    stdin: "ignore",
+    stdout: log,
+    stderr: log,
+    env: { ...env, SYS1_HOME: home },
+    detached: true
+  });
+  child.unref();
+  const deadline = Date.now() + waitMs;
+  while (Date.now() < deadline) {
+    const record = readPidFile(home);
+    if (record !== null && record.pid === child.pid && processAlive(record.pid)) {
+      if (await ownedHealth(record, fetchFn)) {
+        return {
+          ok: true,
+          message: "running",
+          pid: record.pid,
+          url: gatewayUrl(record.host, record.port)
+        };
+      }
+    }
+    if (child.exitCode !== null) {
+      return {
+        ok: false,
+        message: `daemon exited during startup (code ${child.exitCode}); see ${logPath(home)}`
+      };
+    }
+    await Bun.sleep(100);
+  }
+  return { ok: false, message: `daemon did not become healthy within ${waitMs}ms` };
+}
+async function daemonDown(home, config, fetchFn = fetch) {
+  const record = readPidFile(home);
+  if (record === null) {
+    const state = await daemonStatus(home, config, fetchFn);
+    if (state.state === "foreign_listener") {
+      return {
+        ok: false,
+        message: `port ${state.port} answers but has no sys1 pid file; refusing to stop it`
+      };
+    }
+    return { ok: true, message: "not running" };
+  }
+  if (!processAlive(record.pid)) {
+    rmSync2(pidPath(home), { force: true });
+    return { ok: true, message: "not running (cleared stale pid file)" };
+  }
+  if (!await ownedHealth(record, fetchFn)) {
+    return { ok: false, message: "daemon ownership could not be verified; refusing to signal a saved PID" };
+  }
+  try {
+    const response = await fetchFn(`${gatewayUrl(record.host, record.port)}/_sys1/shutdown`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${record.instance}` },
+      signal: AbortSignal.timeout(1500),
+      redirect: "error"
+    });
+    if (response.status !== 202)
+      return { ok: false, message: "daemon refused authenticated shutdown" };
+    await response.body?.cancel();
+  } catch {
+    return { ok: false, message: "daemon shutdown could not be confirmed" };
+  }
+  const deadline = Date.now() + 5000;
+  while (Date.now() < deadline) {
+    if (!processAlive(record.pid) || readPidFile(home)?.instance !== record.instance) {
+      return { ok: true, message: `stopped daemon ${record.pid}` };
+    }
+    await Bun.sleep(100);
+  }
+  return { ok: false, message: "daemon accepted shutdown but has not exited; no PID signal sent" };
+}
+function writePidFile(home, pid, host, port, instance) {
+  const temporary = `${pidPath(home)}.${crypto.randomUUID()}.tmp`;
+  try {
+    writeFileSync3(temporary, `${JSON.stringify({ pid, host, port, instance, started_at: new Date().toISOString() })}
+`, { mode: 384, flag: "wx" });
+    renameSync2(temporary, pidPath(home));
+  } finally {
+    rmSync2(temporary, { force: true });
+  }
+}
+function clearPidFile(home, pid) {
+  const record = readPidFile(home);
+  if (record !== null && record.pid === pid) {
+    rmSync2(pidPath(home), { force: true });
+  }
+}
+
+// src/doctor.ts
+function compareVersion(actual, required) {
+  const left = actual.split(".").map((part) => Number(part));
+  const right = required.split(".").map((part) => Number(part));
+  for (let i = 0;i < Math.max(left.length, right.length); i += 1) {
+    const a = left[i] ?? 0;
+    const b = right[i] ?? 0;
+    if (a !== b)
+      return a > b ? 1 : -1;
+  }
+  return 0;
+}
+function boundedDetail(value, home) {
+  return value.replaceAll(home, "$SYS1_HOME").slice(0, 512);
+}
+function stateDirectoryCheck(home) {
+  if (home.length === 0 || home.length > 4096) {
+    return { id: "state.directory", status: "fail", summary: "the state folder path is invalid; set SYS1_HOME to a folder you can write to" };
+  }
+  let target = home;
+  for (let i = 0;i < 32 && !existsSync5(target); i += 1) {
+    const parent = dirname(target);
+    if (parent === target)
+      break;
+    target = parent;
+  }
+  try {
+    const stats = statSync2(target);
+    if (!stats.isDirectory()) {
+      return { id: "state.directory", status: "fail", summary: "the state folder path points inside a file, not a folder" };
+    }
+    accessSync(target, constants.R_OK | constants.W_OK);
+    return {
+      id: "state.directory",
+      status: "pass",
+      summary: existsSync5(home) ? "state folder is readable and writable" : "state folder can be created"
+    };
+  } catch {
+    return { id: "state.directory", status: "fail", summary: "state folder isn't readable and writable" };
+  }
+}
+function inspectModelFile(home, model) {
+  const path = modelFilePath(home, model);
+  return inspectGgufFile(path);
+}
+function modelChecks(home) {
+  const loaded = loadManifestChecked(home);
+  if (!loaded.ok) {
+    return {
+      manifest: {
+        id: "models.manifest",
+        status: "fail",
+        summary: "the list of installed models is damaged",
+        detail: boundedDetail(loaded.message, home)
+      },
+      files: { id: "models.files", status: "fail", summary: "model files can't be checked" },
+      inventory: { id: "models.inventory", status: "warn", summary: "model folder can't be compared with the installed list" },
+      validModelIds: []
+    };
+  }
+  const manifest = loaded.manifest;
+  const problems = [];
+  for (const model of manifest.models) {
+    const inspection = inspectModelFile(home, model);
+    if (!inspection.ok) {
+      problems.push({ id: model.id, issue: boundedDetail(inspection.message ?? "inspection failed", home) });
+    } else if (inspection.bytes !== model.bytes) {
+      problems.push({ id: model.id, issue: "file size differs from the size recorded at install" });
+    }
+  }
+  let inventory = {
+    id: "models.inventory",
+    status: "pass",
+    summary: "model folder has no leftover or unknown files"
+  };
+  const directory = modelsDir(home);
+  if (existsSync5(directory)) {
+    try {
+      const entries = readdirSync(directory, { withFileTypes: true }).slice(0, 257);
+      const admitted = new Set(manifest.models.map((model) => model.file));
+      const stale = entries.filter((entry) => entry.name.endsWith(".download") || entry.name.endsWith(".tmp")).length;
+      const orphaned = entries.filter((entry) => entry.isFile() && /\.(gguf|pt|cact|exe)$|^[^.]+\.engine$/.test(entry.name) && !entry.name.endsWith(".download") && !admitted.has(entry.name)).length;
+      const links = entries.filter((entry) => entry.isSymbolicLink()).length;
+      if (entries.length > 256 || stale > 0 || orphaned > 0 || links > 0) {
+        inventory = {
+          id: "models.inventory",
+          status: "warn",
+          summary: "model folder has files sys1 didn't install (leftover downloads, unknown models or links); check them before deleting",
+          detail: {
+            stale_downloads: stale,
+            orphaned_ggufs: orphaned,
+            symbolic_links: links,
+            inventory_truncated: entries.length > 256
+          }
+        };
+      }
+    } catch {
+      inventory = { id: "models.inventory", status: "fail", summary: "model folder can't be read" };
+    }
+  }
+  return {
+    manifest: {
+      id: "models.manifest",
+      status: "pass",
+      summary: `${manifest.models.length} model${manifest.models.length === 1 ? "" : "s"} installed`
+    },
+    files: problems.length === 0 ? {
+      id: "models.files",
+      status: "pass",
+      summary: `${manifest.models.length} model file${manifest.models.length === 1 ? "" : "s"} present and readable`
+    } : {
+      id: "models.files",
+      status: "fail",
+      summary: `${problems.length} model file${problems.length === 1 ? " is" : "s are"} missing or damaged; run sys1 pull again`,
+      detail: problems
+    },
+    inventory,
+    validModelIds: manifest.models.filter((model) => !problems.some((problem) => problem.id === model.id)).map((model) => model.id)
+  };
+}
+function routingCheck(config, env, validModelIds) {
+  const hosted = config.hosted.enabled && (env[config.hosted.api_key_env]?.length ?? 0) > 0;
+  const local = config.local.enabled && validModelIds.includes(config.local.model);
+  const explicit = config.backends.filter((backend) => {
+    if (!backend.enabled)
+      return false;
+    const hostname = new URL(backend.base_url).hostname.replace(/^\[|\]$/g, "");
+    const onMachine = isLoopbackHost(hostname);
+    return config.routing.policy === "local-only" ? onMachine : config.routing.policy === "hosted-only" ? !onMachine : true;
+  }).length;
+  if (explicit > 0 && (config.routing.policy === "hosted-only" ? !hosted : config.routing.policy === "local-only" ? !local : !hosted && !local)) {
+    return { id: "routing.candidates", status: "warn", summary: 'only named HTTP backends are set up; each request must name one as "model": "backend/model"' };
+  }
+  if (config.routing.policy === "hosted-only" && !hosted) {
+    return { id: "routing.candidates", status: "fail", summary: "routing is set to hosted Jev only, but no Jev credential is set" };
+  }
+  if (config.routing.policy === "local-only" && !local) {
+    return { id: "routing.candidates", status: "fail", summary: `local model ${config.local.model} isn't available; run sys1 setup or name another backend in each request` };
+  }
+  if (!hosted && !local) {
+    return { id: "routing.candidates", status: "warn", summary: `nothing can answer requests yet: local model ${config.local.model} isn't installed or turned on` };
+  }
+  return {
+    id: "routing.candidates",
+    status: "pass",
+    summary: "at least one model can answer requests",
+    detail: { hosted, local }
+  };
+}
+function daemonCheck(state) {
+  switch (state.state) {
+    case "running":
+      return { id: "daemon", status: "pass", summary: "background gateway is running" };
+    case "stopped":
+      return { id: "daemon", status: "pass", summary: "background gateway is stopped" };
+    case "stale_pidfile":
+      return { id: "daemon", status: "warn", summary: "background gateway isn't responding, or its process record is out of date" };
+    case "foreign_listener":
+      return { id: "daemon", status: "fail", summary: "another program is using the gateway port" };
+  }
+}
+async function runDoctor(options) {
+  const env = options.env ?? process.env;
+  const runtimeVersion = options.runtimeVersion ?? Bun.version;
+  const checks = [];
+  checks.push(compareVersion(runtimeVersion, "1.3.14") >= 0 ? { id: "runtime.bun", status: "pass", summary: `Bun ${runtimeVersion} is supported` } : { id: "runtime.bun", status: "fail", summary: `Bun ${runtimeVersion} is below 1.3.14` });
+  checks.push(stateDirectoryCheck(options.home));
+  const loadedConfig = loadConfig(options.home);
+  const config = loadedConfig.ok ? loadedConfig.config : DEFAULT_CONFIG;
+  checks.push(loadedConfig.ok ? { id: "config", status: "pass", summary: loadedConfig.existed ? "settings are valid" : "no settings file yet; the defaults are valid" } : {
+    id: "config",
+    status: "fail",
+    summary: "the settings file is invalid",
+    detail: boundedDetail(loadedConfig.message, options.home)
+  });
+  const nativeProbe = options.nativeProbe ?? probeNativeRuntime;
+  if (!config.local.enabled) {
+    checks.push({ id: "native.runtime", status: "pass", summary: "local model is turned off" });
+  } else {
+    const native = await nativeProbe();
+    checks.push(native.ok ? {
+      id: "native.runtime",
+      status: "pass",
+      summary: `local model runtime (llama.cpp) is available via ${native.backend ?? "cpu"}`,
+      detail: {
+        gpu_offloading: native.gpu_offloading ?? false,
+        supported_backends: native.supported_backends ?? [],
+        ...native.elapsed_ms !== undefined && Number.isSafeInteger(native.elapsed_ms) && native.elapsed_ms >= 0 ? { native_probe_ms: native.elapsed_ms } : {}
+      }
+    } : {
+      id: "native.runtime",
+      status: "fail",
+      summary: "local model runtime (llama.cpp) isn't available on this computer",
+      ...native.message === undefined ? {} : { detail: boundedDetail(native.message, options.home) }
+    });
+  }
+  const models = modelChecks(options.home);
+  checks.push(models.manifest, models.files, models.inventory);
+  checks.push(loadedConfig.ok ? routingCheck(config, env, models.validModelIds) : { id: "routing.candidates", status: "fail", summary: "routing can't be checked until the config is fixed" });
+  if (loadedConfig.ok) {
+    const daemonProbe = options.daemonProbe ?? daemonStatus;
+    checks.push(daemonCheck(await daemonProbe(options.home, config)));
+  } else {
+    checks.push({ id: "daemon", status: "warn", summary: "gateway check skipped because the config is invalid" });
+  }
+  const counts = checks.reduce((result, check) => {
+    result[check.status] += 1;
+    return result;
+  }, { pass: 0, warn: 0, fail: 0 });
+  return { ok: counts.fail === 0, version: 1, checks, counts };
+}
+// src/runtime.ts
+function createRouter(options) {
+  const config = configSchema.parse(options.config);
+  if (options.env === undefined)
+    throw new Error("createRouter requires an explicit env object");
+  const owned = options.localRunner === undefined && options.home !== undefined;
+  const runner = options.localRunner ?? (options.home === undefined ? undefined : new LocalRunner({
+    home: options.home,
+    maxLoadedModels: config.local.max_loaded_models,
+    engineFactory: defaultEngineFactory(config.local.context_tokens, config.local.eval_timeout_ms)
+  }));
+  const handler = createFetchHandler({
+    config,
+    env: { ...options.env },
+    ...options.home === undefined ? {} : { home: options.home },
+    ...runner === undefined ? {} : { localRunner: runner },
+    ...options.fetchFn === undefined ? {} : { fetchFn: options.fetchFn }
+  });
+  const shutdown = new AbortController;
+  let disposal;
+  const handle = async (request) => {
+    if (shutdown.signal.aborted) {
+      return Response.json(errorBody("router_disposed", "embedded router is disposed"), { status: 503 });
+    }
+    return handler(new Request(request, { signal: AbortSignal.any([request.signal, shutdown.signal]) }));
+  };
+  const client = createClient({
+    timeoutMs: config.gateway.request_timeout_ms,
+    fetch: (input, init) => handle(new Request(input, init))
+  });
+  return {
+    evaluate: client.evaluate,
+    fetch: handle,
+    dispose() {
+      if (disposal === undefined) {
+        shutdown.abort();
+        disposal = owned ? runner.dispose() : Promise.resolve();
+      }
+      return disposal;
+    }
+  };
+}
+export {
+  writePidFile,
+  verifyModel,
+  toLocalResponse,
+  toLocalAnswer,
+  systemOneResponseSchema,
+  systemOneRequestSchema,
+  sys1Home,
+  storeBytes,
+  startGateway,
+  setConfigValue,
+  serializedBytes,
+  scoreQuestionSchema,
+  scoreAnswerSchema,
+  saveManifest,
+  saveConfig,
+  runtimeBackends,
+  runDoctor,
+  routingPolicySchema,
+  resolvePullTarget,
+  requestNeeds,
+  removeModel,
+  readPidFile,
+  questionSchema,
+  qualifyBackend,
+  pullModel,
+  processAlive,
+  probeNativeRuntime,
+  probeBackend,
+  probeAll,
+  platformRecommendation,
+  outcomeFromMass,
+  noulQuestionSchema,
+  noulAnswerSchema,
+  modelsDir,
+  modelFilePath,
+  manifestPath,
+  loopbackHostSchema,
+  localBackendSchema,
+  loadManifestChecked,
+  loadManifest,
+  loadConfig,
+  isLoopbackHost,
+  installedModels,
+  inspectGgufFile,
+  healthz,
+  forwardToBackend,
+  findRegistry,
+  findInstalled,
+  extractModelIds,
+  extractBackendCapabilities,
+  errorBody,
+  entrySchema,
+  defaultEngineFactory,
+  decisionPrompt,
+  daemonUp,
+  daemonStatus,
+  daemonDown,
+  createRouter,
+  createProfile,
+  createFetchHandler,
+  createClient,
+  configSchema,
+  confidenceOf,
+  clearPidFile,
+  chooseBackend,
+  choiceQuestionSchema,
+  choiceAnswerSchema,
+  builtinName,
+  builtinCandidates,
+  answerSchema,
+  answerLabels,
+  aggregateMass,
+  Sys1ProfileError,
+  Sys1ClientError,
+  SYS1_VERSION,
+  SETTABLE_KEYS,
+  ROUTING_POLICIES,
+  PROTOCOL_LIMITS,
+  ModelStoreError,
+  MODEL_REGISTRY,
+  MODEL_LIMITS,
+  MODEL_KINDS,
+  LocalRunner,
+  LlamaEngine,
+  LOCAL_MODEL_TIERS,
+  HOSTED_BACKEND_NAME,
+  EngineUnavailableError,
+  DEFAULT_LOCAL_MODELS,
+  DEFAULT_CONFIG,
+  DEFAULT_BASE_URL,
+  DECISION_LABELS,
+  DECIDE_LIMITS,
+  BUILTIN_PREFIX
+};