@remnic/core 1.1.1 → 1.1.2

package/dist/{chunk-GKFXUTJ2.js → chunk-STGWEHYR.js}

@@ -52,7 +52,7 @@ import {
   buildBriefing,
   parseBriefingFocus,
   parseBriefingWindow
-} from "./chunk-WVVA7F5A.js";
+} from "./chunk-L7IXWRYE.js";
 import {
   parseEntityFile
 } from "./chunk-F5VP6YCB.js";
@@ -3097,4 +3097,4 @@ export {
   ENGRAM_ACCESS_WRITE_SCHEMA_VERSION,
   EngramAccessService
 };
-//# sourceMappingURL=chunk-GKFXUTJ2.js.map
+//# sourceMappingURL=chunk-STGWEHYR.js.map

package/dist/{chunk-KUB6JU6H.js → chunk-TMYO7B5P.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-LOBRX7VD.js";
 import {
   parseConfig
-} from "./chunk-BK2EFTE2.js";
+} from "./chunk-BECYBZLX.js";
 import {
   resolveCommitmentLedgerDir,
   validateCommitmentLedgerEntry
@@ -268,4 +268,4 @@ export {
   recordResumeBundle,
   getResumeBundleStatus
 };
-//# sourceMappingURL=chunk-KUB6JU6H.js.map
+//# sourceMappingURL=chunk-TMYO7B5P.js.map

package/dist/{chunk-DFTTJYSO.js → chunk-UWB5LMWY.js}

@@ -1,9 +1,9 @@
 import {
   EngramMcpServer
-} from "./chunk-HK3FGIEW.js";
+} from "./chunk-OC5OXUQ4.js";
 import {
   EngramAccessInputError
-} from "./chunk-GKFXUTJ2.js";
+} from "./chunk-STGWEHYR.js";
 import {
   isTrustZoneName
 } from "./chunk-EQINRHYR.js";
@@ -1043,4 +1043,4 @@ var EngramAccessHttpServer = class {
 export {
   EngramAccessHttpServer
 };
-//# sourceMappingURL=chunk-DFTTJYSO.js.map
+//# sourceMappingURL=chunk-UWB5LMWY.js.map

package/dist/{chunk-O5ETUNBT.js → chunk-VTU2B4VF.js}

@@ -1,3 +1,7 @@
+import {
+  resolveHomeDir
+} from "./chunk-MARWOCVP.js";
+
 // src/tokens.ts
 import fs from "fs";
 import path from "path";
@@ -18,10 +22,10 @@ var TOKEN_PREFIXES = {
   "generic-mcp": "remnic_gm_"
 };
 function defaultTokensPath() {
-  return path.join(process.env.HOME ?? "~", ".remnic", "tokens.json");
+  return path.join(resolveHomeDir(), ".remnic", "tokens.json");
 }
 function legacyTokensPath() {
-  return path.join(process.env.HOME ?? "~", ".engram", "tokens.json");
+  return path.join(resolveHomeDir(), ".engram", "tokens.json");
 }
 function resolveReadPath(tokensPath) {
   const primary = tokensPath ?? defaultTokensPath();
@@ -139,4 +143,4 @@ export {
   getAllValidTokensCached,
   resolveConnectorFromToken
 };
-//# sourceMappingURL=chunk-O5ETUNBT.js.map
+//# sourceMappingURL=chunk-VTU2B4VF.js.map

package/dist/chunk-VTU2B4VF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tokens.ts"],"sourcesContent":["/**\n * Token management for Remnic multi-connector auth.\n *\n * Manages per-connector tokens in ~/.remnic/tokens.json.\n * Each connector gets a unique token with a recognizable prefix.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { randomBytes } from \"node:crypto\";\nimport { resolveHomeDir } from \"./runtime/env.js\";\n\nexport interface TokenEntry {\n  token: string;\n  connector: string;\n  createdAt: string;\n}\n\nexport interface TokenStore {\n  tokens: TokenEntry[];\n}\n\nconst TOKEN_PREFIXES: Record<string, string> = {\n  \"openclaw\": \"remnic_oc_\",\n  \"claude-code\": \"remnic_cc_\",\n  \"codex-cli\": \"remnic_cx_\",\n  \"codex\": \"remnic_cx_\",\n  \"hermes\": \"remnic_hm_\",\n  \"replit\": \"remnic_rl_\",\n  \"cursor\": \"remnic_cu_\",\n  \"cline\": \"remnic_cl_\",\n  \"github-copilot\": \"remnic_gh_\",\n  \"roo-code\": \"remnic_rc_\",\n  \"windsurf\": \"remnic_ws_\",\n  \"amp\": \"remnic_am_\",\n  \"generic-mcp\": \"remnic_gm_\",\n};\n\nfunction defaultTokensPath(): string {\n  return path.join(resolveHomeDir(), \".remnic\", \"tokens.json\");\n}\n\nfunction legacyTokensPath(): string {\n  return path.join(resolveHomeDir(), \".engram\", \"tokens.json\");\n}\n\nfunction resolveReadPath(tokensPath?: string): string {\n  const primary = tokensPath ?? defaultTokensPath();\n  if (tokensPath) return primary;\n  if (fs.existsSync(primary)) return primary;\n  const legacy = legacyTokensPath();\n  return fs.existsSync(legacy) ? legacy : primary;\n}\n\nfunction ensureDir(filePath: string): void {\n  const dir = path.dirname(filePath);\n  fs.mkdirSync(dir, { recursive: true });\n}\n\nexport function loadTokenStore(tokensPath?: string): TokenStore {\n  const p = resolveReadPath(tokensPath);\n  try {\n    const raw = JSON.parse(fs.readFileSync(p, \"utf8\"));\n    if (Array.isArray(raw.tokens)) {\n      return { tokens: raw.tokens };\n    }\n    // Migrate legacy flat-map format: { \"connector\": \"token_value\", ... }\n    if (typeof raw === \"object\" && raw !== null && !Array.isArray(raw)) {\n      const migrated: TokenEntry[] = [];\n      for (const [key, value] of Object.entries(raw)) {\n        if (key === \"tokens\") continue; // skip if tokens key exists but isn't array\n        if (typeof value === \"string\" && value.length > 0) {\n          migrated.push({ token: value, connector: key, createdAt: new Date().toISOString() });\n        }\n      }\n      if (migrated.length > 0) {\n        const store: TokenStore = { tokens: migrated };\n        // Auto-migrate: rewrite in new format (best-effort, don't lose tokens on write failure)\n        try {\n          saveTokenStore(store, tokensPath);\n        } catch {\n          // Migration write failed (e.g., read-only fs) — still return parsed tokens\n        }\n        return store;\n      }\n    }\n    return { tokens: [] };\n  } catch {\n    return { tokens: [] };\n  }\n}\n\nexport function saveTokenStore(store: TokenStore, tokensPath?: string): void {\n  const p = tokensPath ?? defaultTokensPath();\n  ensureDir(p);\n  fs.writeFileSync(p, JSON.stringify(store, null, 2) + \"\\n\", { mode: 0o600 });\n  // Tighten permissions on pre-existing files (writeFileSync mode only applies to new files)\n  try { fs.chmodSync(p, 0o600); } catch { /* ignore on platforms without chmod */ }\n}\n\n/**\n * Build a TokenEntry candidate WITHOUT saving it to the store.\n * Callers use this when they need to defer the save until after a\n * dependent write (e.g. Hermes config.yaml) succeeds — see\n * commitTokenEntry() to persist the candidate.\n */\nexport function buildTokenEntry(connector: string): TokenEntry {\n  const prefix = TOKEN_PREFIXES[connector] ?? \"remnic_xx_\";\n  const token = prefix + randomBytes(24).toString(\"hex\");\n  return {\n    token,\n    connector,\n    createdAt: new Date().toISOString(),\n  };\n}\n\n/**\n * Persist a pre-built TokenEntry into the store, replacing any existing\n * entry for the same connector. Used together with buildTokenEntry() when\n * the caller wants to defer the save until after a dependent write succeeds.\n *\n * For transactional rollback, callers should snapshot the full store via\n * loadTokenStore() BEFORE calling commitTokenEntry() and restore it with\n * saveTokenStore() on failure. A full-store snapshot handles partial writes\n * of tokens.json atomically — single-entry restore via the return value is\n * insufficient because if this function throws during saveTokenStore, the\n * return statement never executes (UXJI/UXJT fix).\n */\nexport function commitTokenEntry(entry: TokenEntry, tokensPath?: string): void {\n  const store = loadTokenStore(tokensPath);\n  store.tokens = store.tokens.filter((t) => t.connector !== entry.connector);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n}\n\nexport function generateToken(connector: string, tokensPath?: string): TokenEntry {\n  const store = loadTokenStore(tokensPath);\n\n  // Remove existing token for this connector\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n\n  const entry = buildTokenEntry(connector);\n  store.tokens.push(entry);\n  saveTokenStore(store, tokensPath);\n  return entry;\n}\n\nexport function listTokens(tokensPath?: string): TokenEntry[] {\n  return loadTokenStore(tokensPath).tokens;\n}\n\nexport function revokeToken(connector: string, tokensPath?: string): boolean {\n  const store = loadTokenStore(tokensPath);\n  const before = store.tokens.length;\n  store.tokens = store.tokens.filter((t) => t.connector !== connector);\n  if (store.tokens.length < before) {\n    saveTokenStore(store, tokensPath);\n    return true;\n  }\n  return false;\n}\n\nexport function getAllValidTokens(tokensPath?: string): string[] {\n  return loadTokenStore(tokensPath).tokens.map((t) => t.token);\n}\n\n// Cached token loader to avoid synchronous disk I/O on every HTTP request.\n// Re-reads tokens.json at most once per TTL interval (default 5s).\nconst TOKEN_CACHE_TTL_MS = 5_000;\nlet _cachedTokens: string[] = [];\nlet _cachedAt = 0;\nlet _cachedPath: string | undefined;\n\nexport function getAllValidTokensCached(tokensPath?: string): string[] {\n  const now = Date.now();\n  if (now - _cachedAt < TOKEN_CACHE_TTL_MS && tokensPath === _cachedPath) return _cachedTokens;\n  _cachedTokens = getAllValidTokens(tokensPath);\n  _cachedAt = now;\n  _cachedPath = tokensPath;\n  return _cachedTokens;\n}\n\nexport function resolveConnectorFromToken(token: string, tokensPath?: string): string | undefined {\n  return loadTokenStore(tokensPath).tokens.find((t) => t.token === token)?.connector;\n}\n"],"mappings":";;;;;AAOA,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,SAAS,mBAAmB;AAa5B,IAAM,iBAAyC;AAAA,EAC7C,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,aAAa;AAAA,EACb,SAAS;AAAA,EACT,UAAU;AAAA,EACV,UAAU;AAAA,EACV,UAAU;AAAA,EACV,SAAS;AAAA,EACT,kBAAkB;AAAA,EAClB,YAAY;AAAA,EACZ,YAAY;AAAA,EACZ,OAAO;AAAA,EACP,eAAe;AACjB;AAEA,SAAS,oBAA4B;AACnC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,mBAA2B;AAClC,SAAO,KAAK,KAAK,eAAe,GAAG,WAAW,aAAa;AAC7D;AAEA,SAAS,gBAAgB,YAA6B;AACpD,QAAM,UAAU,cAAc,kBAAkB;AAChD,MAAI,WAAY,QAAO;AACvB,MAAI,GAAG,WAAW,OAAO,EAAG,QAAO;AACnC,QAAM,SAAS,iBAAiB;AAChC,SAAO,GAAG,WAAW,MAAM,IAAI,SAAS;AAC1C;AAEA,SAAS,UAAU,UAAwB;AACzC,QAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,KAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACvC;AAEO,SAAS,eAAe,YAAiC;AAC9D,QAAM,IAAI,gBAAgB,UAAU;AACpC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,GAAG,aAAa,GAAG,MAAM,CAAC;AACjD,QAAI,MAAM,QAAQ,IAAI,MAAM,GAAG;AAC7B,aAAO,EAAE,QAAQ,IAAI,OAAO;AAAA,IAC9B;AAEA,QAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,CAAC,MAAM,QAAQ,GAAG,GAAG;AAClE,YAAM,WAAyB,CAAC;AAChC,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,YAAI,QAAQ,SAAU;AACtB,YAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,mBAAS,KAAK,EAAE,OAAO,OAAO,WAAW,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,QACrF;AAAA,MACF;AACA,UAAI,SAAS,SAAS,GAAG;AACvB,cAAM,QAAoB,EAAE,QAAQ,SAAS;AAE7C,YAAI;AACF,yBAAe,OAAO,UAAU;AAAA,QAClC,QAAQ;AAAA,QAER;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,EACtB,QAAQ;AACN,WAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,EACtB;AACF;AAEO,SAAS,eAAe,OAAmB,YAA2B;AAC3E,QAAM,IAAI,cAAc,kBAAkB;AAC1C,YAAU,CAAC;AACX,KAAG,cAAc,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAE1E,MAAI;AAAE,OAAG,UAAU,GAAG,GAAK;AAAA,EAAG,QAAQ;AAAA,EAA0C;AAClF;AAQO,SAAS,gBAAgB,WAA+B;AAC7D,QAAM,SAAS,eAAe,SAAS,KAAK;AAC5C,QAAM,QAAQ,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AACrD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,EACpC;AACF;AAcO,SAAS,iBAAiB,OAAmB,YAA2B;AAC7E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,MAAM,SAAS;AACzE,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAClC;AAEO,SAAS,cAAc,WAAmB,YAAiC;AAChF,QAAM,QAAQ,eAAe,UAAU;AAGvC,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AAEnE,QAAM,QAAQ,gBAAgB,SAAS;AACvC,QAAM,OAAO,KAAK,KAAK;AACvB,iBAAe,OAAO,UAAU;AAChC,SAAO;AACT;AAEO,SAAS,WAAW,YAAmC;AAC5D,SAAO,eAAe,UAAU,EAAE;AACpC;AAEO,SAAS,YAAY,WAAmB,YAA8B;AAC3E,QAAM,QAAQ,eAAe,UAAU;AACvC,QAAM,SAAS,MAAM,OAAO;AAC5B,QAAM,SAAS,MAAM,OAAO,OAAO,CAAC,MAAM,EAAE,cAAc,SAAS;AACnE,MAAI,MAAM,OAAO,SAAS,QAAQ;AAChC,mBAAe,OAAO,UAAU;AAChC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,YAA+B;AAC/D,SAAO,eAAe,UAAU,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAC7D;AAIA,IAAM,qBAAqB;AAC3B,IAAI,gBAA0B,CAAC;AAC/B,IAAI,YAAY;AAChB,IAAI;AAEG,SAAS,wBAAwB,YAA+B;AACrE,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,MAAM,YAAY,sBAAsB,eAAe,YAAa,QAAO;AAC/E,kBAAgB,kBAAkB,UAAU;AAC5C,cAAY;AACZ,gBAAc;AACd,SAAO;AACT;AAEO,SAAS,0BAA0B,OAAe,YAAyC;AAChG,SAAO,eAAe,UAAU,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,GAAG;AAC3E;","names":[]}

package/dist/{chunk-RGLL5SPU.js → chunk-XXVWLXSG.js}

@@ -1860,4 +1860,4 @@ export {
   defaultTierMigrationCycleBudget,
   CompoundingEngine
 };
-//# sourceMappingURL=chunk-RGLL5SPU.js.map
+//# sourceMappingURL=chunk-XXVWLXSG.js.map

package/dist/{chunk-XZ2TIKGC.js → chunk-Y7R2XJ5Q.js}

@@ -51,9 +51,8 @@ async function getGatewayResolver() {
   return null;
 }
 async function findRuntimeModules() {
-  const { readdirSync } = await import("fs");
+  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import("fs");
   const { createRequire } = await import("module");
-  const { execFileSync } = await import("child_process");
   const candidates = [];
   const distDirs = [];
   const pushDistDirs = (entryPath) => {
@@ -75,7 +74,6 @@ async function findRuntimeModules() {
   } catch {
   }
   try {
-    const { realpathSync } = await import("fs");
     const mainScript = process.argv[1];
     if (mainScript) {
       const realScript = realpathSync(mainScript);
@@ -86,12 +84,8 @@ async function findRuntimeModules() {
   } catch {
   }
   try {
-    const openclawBin = execFileSync("which", ["openclaw"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
+    const openclawBin = findExecutableOnPath("openclaw", accessSync, statSync, constants.X_OK);
     if (openclawBin) {
-      const { realpathSync } = await import("fs");
       pushDistDirs(realpathSync(openclawBin));
     }
   } catch {
@@ -109,6 +103,27 @@ async function findRuntimeModules() {
   }
   return candidates;
 }
+function findExecutableOnPath(executableName, access, stat, executableMode) {
+  const pathEnv = readEnvVar("PATH");
+  if (!pathEnv) return void 0;
+  const pathExts = process.platform === "win32" ? (readEnvVar("PATHEXT") ?? ".EXE;.CMD;.BAT;.COM").split(";").filter((ext) => ext.length > 0) : [""];
+  const hasExtension = path.extname(executableName).length > 0;
+  for (const dir of pathEnv.split(path.delimiter)) {
+    if (!dir) continue;
+    const candidateNames = process.platform === "win32" && !hasExtension ? pathExts.map((ext) => `${executableName}${ext}`) : [executableName];
+    for (const candidateName of candidateNames) {
+      const candidate = path.join(dir, candidateName);
+      try {
+        access(candidate, executableMode);
+        if (!stat(candidate).isFile()) continue;
+        return candidate;
+      } catch {
+      }
+    }
+  }
+  return void 0;
+}
+var __findExecutableOnPathForTest = findExecutableOnPath;
 async function resolveProviderApiKey(providerId, apiKeyValue, gatewayConfig, agentDir) {
   const resolvedAgentDir = path.resolve(
     agentDir ?? path.join(os.homedir(), ".openclaw", "agents", "main", "agent")
@@ -185,9 +200,10 @@ function __setGatewayResolverForTest(resolver) {
 }
 
 export {
+  __findExecutableOnPathForTest,
   resolveProviderApiKey,
   getGatewayRuntimeAuthForModel,
   clearSecretCache,
   __setGatewayResolverForTest
 };
-//# sourceMappingURL=chunk-XZ2TIKGC.js.map
+//# sourceMappingURL=chunk-Y7R2XJ5Q.js.map

package/dist/chunk-Y7R2XJ5Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/resolve-provider-secret.ts"],"sourcesContent":["import { log } from \"./logger.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport path from \"node:path\";\nimport os from \"node:os\";\n\n/**\n * Resolve a provider API key using OpenClaw's own auth resolution system.\n *\n * This module delegates to the gateway's `resolveApiKeyForProvider()` function,\n * which handles all secret reference formats (SecretRef objects, auth profiles,\n * \"secretref-managed\" markers, environment variables, etc.) using the same\n * codepath the gateway uses for its own agent sessions.\n *\n * For plain-text API keys, a fast path returns them directly without\n * involving the gateway auth system.\n *\n * Results are cached per provider for the gateway process lifetime.\n */\n\ntype ResolveApiKeyFn = (params: {\n  provider: string;\n  cfg?: unknown;\n  agentDir?: string;\n}) => Promise<{ apiKey?: string; source?: string; mode?: string } | null>;\n\n/**\n * Resolve request-ready auth for a model, including provider-owned transforms\n * (e.g., OAuth token exchange, base URL override for openai-codex).\n */\nexport type GetRuntimeAuthForModelFn = (params: {\n  model: { provider: string; id: string; api?: string; baseUrl?: string };\n  cfg?: unknown;\n  workspaceDir?: string;\n}) => Promise<{\n  apiKey?: string;\n  baseUrl?: string;\n  source?: string;\n  mode?: string;\n  profileId?: string;\n} | null>;\n\nlet _resolveApiKeyForProvider: ResolveApiKeyFn | null = null;\nlet _getRuntimeAuthForModel: GetRuntimeAuthForModelFn | null = null;\nlet _resolverLoaded = false;\nlet _resolverNextRetryAt = 0;\nconst RESOLVER_RETRY_BACKOFF_MS = 60_000; // 1 minute between retries after first failure\nconst resolvedCache = new Map<string, string | undefined>();\n\n/**\n * Lazily load the gateway's resolveApiKeyForProvider function.\n * Returns null if not available (e.g., running outside the gateway process).\n */\nasync function getGatewayResolver(): Promise<ResolveApiKeyFn | null> {\n  if (_resolverLoaded) {\n    return _resolveApiKeyForProvider;\n  }\n  // Backoff: don't re-scan filesystem on every call when module wasn't found.\n  // After a failure, wait RESOLVER_RETRY_BACKOFF_MS before trying again.\n  if (_resolverNextRetryAt > 0 && Date.now() < _resolverNextRetryAt) {\n    return null;\n  }\n\n  try {\n    // The gateway bundles this in a runtime chunk — import it dynamically.\n    // This import path is stable across gateway versions since it's a named runtime export.\n    const candidates = [\n      // Try glob-matching the runtime module name (hash varies per build)\n      ...await findRuntimeModules(),\n    ];\n\n    const { pathToFileURL } = await import(\"node:url\");\n    for (const candidate of candidates) {\n      try {\n        // Convert native path to file:// URL for cross-platform ESM import compatibility\n        const importUrl = pathToFileURL(candidate).href;\n        const mod = await import(importUrl);\n        if (typeof mod.resolveApiKeyForProvider === \"function\") {\n          _resolveApiKeyForProvider = mod.resolveApiKeyForProvider;\n          if (typeof mod.getRuntimeAuthForModel === \"function\") {\n            _getRuntimeAuthForModel = mod.getRuntimeAuthForModel;\n            log.debug(\"loaded gateway getRuntimeAuthForModel from runtime module\");\n          }\n          _resolverLoaded = true;\n          log.debug(\"loaded gateway resolveApiKeyForProvider from runtime module\");\n          return _resolveApiKeyForProvider;\n        }\n      } catch {\n        // Try next candidate\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  // Backoff before retrying — avoid repeated fs scanning.\n  // Retries after RESOLVER_RETRY_BACKOFF_MS so the resolver can\n  // recover if the gateway restarts or the module becomes available.\n  _resolverNextRetryAt = Date.now() + RESOLVER_RETRY_BACKOFF_MS;\n  log.debug(`gateway resolveApiKeyForProvider not available — will retry after ${RESOLVER_RETRY_BACKOFF_MS / 1000}s`);\n  return null;\n}\n\n/**\n * Find the gateway's model-auth runtime module by scanning the dist directory.\n * Uses require.resolve to find the openclaw package regardless of install method.\n */\nasync function findRuntimeModules(): Promise<string[]> {\n  const { accessSync, constants, readdirSync, realpathSync, statSync } = await import(\"node:fs\");\n  const { createRequire } = await import(\"node:module\");\n  const candidates: string[] = [];\n\n  // Discover the openclaw dist directory from the installed package,\n  // regardless of how it was installed (Homebrew, npm global, local, etc.)\n  const distDirs: string[] = [];\n  const pushDistDirs = (entryPath: string): void => {\n    const resolvedEntryDir = path.dirname(entryPath);\n    const packageRoot = path.basename(resolvedEntryDir) === \"dist\"\n      ? path.resolve(resolvedEntryDir, \"..\")\n      : resolvedEntryDir;\n    const candidateDistDirs = [\n      path.join(packageRoot, \"dist\"),\n      path.join(packageRoot, \"..\", \"dist\"),\n    ];\n    for (const candidate of candidateDistDirs) {\n      const resolved = path.resolve(candidate);\n      if (!distDirs.includes(resolved)) distDirs.push(resolved);\n    }\n  };\n\n  try {\n    // require.resolve finds the package from the current process context\n    const req = createRequire(import.meta.url);\n    const openclawMain = req.resolve(\"openclaw\");\n    pushDistDirs(openclawMain);\n  } catch {\n    // openclaw not resolvable from plugin context — try alternate paths\n  }\n\n  // Fallback: infer from the running process (gateway runs from its own dist/)\n  // Use fs.realpathSync to resolve symlinks (e.g., /usr/local/bin/openclaw → actual path)\n  try {\n    const mainScript = process.argv[1];\n    if (mainScript) {\n      const realScript = realpathSync(mainScript);\n      if (realScript.includes(\"openclaw\")) {\n        pushDistDirs(realScript);\n      }\n    }\n  } catch {\n    // Silent\n  }\n\n  // Fallback: inspect the installed openclaw binary on PATH (Homebrew/global npm)\n  // without spawning `which`. OpenClaw's plugin installer blocks process-launch\n  // patterns in packaged plugins.\n  try {\n    const openclawBin = findExecutableOnPath(\"openclaw\", accessSync, statSync, constants.X_OK);\n    if (openclawBin) {\n      pushDistDirs(realpathSync(openclawBin));\n    }\n  } catch {\n    // Silent\n  }\n\n  for (const dir of distDirs) {\n    try {\n      const files = readdirSync(dir);\n      for (const f of files) {\n        if (f.startsWith(\"runtime-model-auth.runtime-\") && f.endsWith(\".js\")) {\n          candidates.push(path.join(dir, f));\n        }\n      }\n    } catch {\n      // Directory doesn't exist — skip\n    }\n  }\n\n  return candidates;\n}\n\nfunction findExecutableOnPath(\n  executableName: string,\n  access: (path: string, mode?: number) => void,\n  stat: (path: string) => { isFile(): boolean },\n  executableMode: number,\n): string | undefined {\n  const pathEnv = readEnvVar(\"PATH\");\n  if (!pathEnv) return undefined;\n\n  const pathExts = process.platform === \"win32\"\n    ? (readEnvVar(\"PATHEXT\") ?? \".EXE;.CMD;.BAT;.COM\")\n        .split(\";\")\n        .filter((ext) => ext.length > 0)\n    : [\"\"];\n  const hasExtension = path.extname(executableName).length > 0;\n\n  for (const dir of pathEnv.split(path.delimiter)) {\n    if (!dir) continue;\n    const candidateNames = process.platform === \"win32\" && !hasExtension\n      ? pathExts.map((ext) => `${executableName}${ext}`)\n      : [executableName];\n\n    for (const candidateName of candidateNames) {\n      const candidate = path.join(dir, candidateName);\n      try {\n        access(candidate, executableMode);\n        if (!stat(candidate).isFile()) continue;\n        return candidate;\n      } catch {\n        // Try the next PATH entry.\n      }\n    }\n  }\n\n  return undefined;\n}\n\nexport const __findExecutableOnPathForTest = findExecutableOnPath;\n\n/**\n * Resolve a provider API key from various OpenClaw formats.\n *\n * Resolution order:\n * 1. Plain-text string → returned immediately\n * 2. Gateway's resolveApiKeyForProvider → handles all secret ref formats\n * 3. Environment variable fallback (PROVIDER_NAME_API_KEY)\n * 4. undefined → provider is skipped in the fallback chain\n */\nexport async function resolveProviderApiKey(\n  providerId: string,\n  apiKeyValue: unknown,\n  gatewayConfig?: unknown,\n  agentDir?: string,\n): Promise<string | undefined> {\n  const resolvedAgentDir = path.resolve(\n    agentDir ?? path.join(os.homedir(), \".openclaw\", \"agents\", \"main\", \"agent\"),\n  );\n\n  // Check cache first\n  const cacheKey = `provider:${providerId}:agentDir:${resolvedAgentDir}`;\n  if (resolvedCache.has(cacheKey)) {\n    return resolvedCache.get(cacheKey);\n  }\n\n  let resolved: string | undefined;\n\n  // Fast path: plain-text string that looks like an actual API key\n  if (typeof apiKeyValue === \"string\" && apiKeyValue.trim().length > 0) {\n    // Skip known non-API-key markers used by the gateway for auth modes\n    // that don't use bearer tokens (OAuth, local endpoints, GCP credentials)\n    if (\n      apiKeyValue === \"secretref-managed\" ||\n      apiKeyValue.endsWith(\"-oauth\") ||\n      apiKeyValue.endsWith(\"-local\") ||\n      apiKeyValue === \"lm-studio\" ||\n      apiKeyValue.startsWith(\"gcp-\")\n    ) {\n      // Fall through to gateway resolver / env var fallback\n    } else {\n      resolved = apiKeyValue;\n      resolvedCache.set(cacheKey, resolved);\n      return resolved;\n    }\n  }\n\n  // The API key is either a SecretRef object, \"secretref-managed\", or empty.\n  // Try the gateway's own auth resolution system first.\n  const resolver = await getGatewayResolver();\n  if (resolver) {\n    try {\n      const auth = await resolver({ provider: providerId, cfg: gatewayConfig, agentDir: resolvedAgentDir });\n      if (auth?.apiKey) {\n        resolved = auth.apiKey;\n        log.debug(`resolved API key for provider \"${providerId}\" via gateway auth (source: ${auth.source ?? \"unknown\"}, mode: ${auth.mode ?? \"unknown\"})`);\n        resolvedCache.set(cacheKey, resolved);\n        return resolved;\n      }\n    } catch (err) {\n      log.debug(\n        `gateway auth resolution failed for provider \"${providerId}\": ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  // Environment variable fallback\n  resolved = resolveFromEnv(providerId);\n  if (resolved) {\n    log.debug(`resolved API key for provider \"${providerId}\" from environment variable`);\n  } else {\n    log.debug(`could not resolve API key for provider \"${providerId}\" — skipping`);\n  }\n\n  // Only cache successful resolutions — failures are retried on next call\n  // so providers can recover after transient issues (e.g., 1Password agent restart)\n  if (resolved) {\n    resolvedCache.set(cacheKey, resolved);\n  }\n  return resolved;\n}\n\n/**\n * Try to resolve an API key from environment variables.\n */\nfunction resolveFromEnv(providerId: string): string | undefined {\n  const normalized = providerId.toUpperCase().replace(/[^A-Z0-9]/g, \"_\");\n  const candidates = [\n    `${normalized}_API_KEY`,\n    `${normalized}_TOKEN`,\n  ];\n  for (const envVar of candidates) {\n    const value = readEnvVar(envVar);\n    if (value && value.trim().length > 0) {\n      return value.trim();\n    }\n  }\n  return undefined;\n}\n\n/**\n * Get the gateway's getRuntimeAuthForModel function, if available.\n * This resolves request-ready auth including provider-owned transforms\n * (OAuth token exchange, base URL override for codex/copilot/etc.).\n * Must be called after at least one resolveProviderApiKey() call to\n * trigger the lazy module load.\n */\nexport async function getGatewayRuntimeAuthForModel(): Promise<GetRuntimeAuthForModelFn | null> {\n  // Ensure the runtime module has been loaded\n  await getGatewayResolver();\n  return _getRuntimeAuthForModel;\n}\n\n/**\n * Clear the resolution cache (useful for testing or key rotation).\n */\nexport function clearSecretCache(): void {\n  resolvedCache.clear();\n  _resolveApiKeyForProvider = null;\n  _getRuntimeAuthForModel = null;\n  _resolverLoaded = false;\n  _resolverNextRetryAt = 0;\n}\n\nexport function __setGatewayResolverForTest(resolver: ResolveApiKeyFn | null): void {\n  _resolveApiKeyForProvider = resolver;\n  _resolverLoaded = resolver !== null;\n  _resolverNextRetryAt = 0;\n}\n"],"mappings":";;;;;;;;AAEA,OAAO,UAAU;AACjB,OAAO,QAAQ;AAsCf,IAAI,4BAAoD;AACxD,IAAI,0BAA2D;AAC/D,IAAI,kBAAkB;AACtB,IAAI,uBAAuB;AAC3B,IAAM,4BAA4B;AAClC,IAAM,gBAAgB,oBAAI,IAAgC;AAM1D,eAAe,qBAAsD;AACnE,MAAI,iBAAiB;AACnB,WAAO;AAAA,EACT;AAGA,MAAI,uBAAuB,KAAK,KAAK,IAAI,IAAI,sBAAsB;AACjE,WAAO;AAAA,EACT;AAEA,MAAI;AAGF,UAAM,aAAa;AAAA;AAAA,MAEjB,GAAG,MAAM,mBAAmB;AAAA,IAC9B;AAEA,UAAM,EAAE,cAAc,IAAI,MAAM,OAAO,KAAU;AACjD,eAAW,aAAa,YAAY;AAClC,UAAI;AAEF,cAAM,YAAY,cAAc,SAAS,EAAE;AAC3C,cAAM,MAAM,MAAM,OAAO;AACzB,YAAI,OAAO,IAAI,6BAA6B,YAAY;AACtD,sCAA4B,IAAI;AAChC,cAAI,OAAO,IAAI,2BAA2B,YAAY;AACpD,sCAA0B,IAAI;AAC9B,gBAAI,MAAM,2DAA2D;AAAA,UACvE;AACA,4BAAkB;AAClB,cAAI,MAAM,6DAA6D;AACvE,iBAAO;AAAA,QACT;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,yBAAuB,KAAK,IAAI,IAAI;AACpC,MAAI,MAAM,0EAAqE,4BAA4B,GAAI,GAAG;AAClH,SAAO;AACT;AAMA,eAAe,qBAAwC;AACrD,QAAM,EAAE,YAAY,WAAW,aAAa,cAAc,SAAS,IAAI,MAAM,OAAO,IAAS;AAC7F,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,QAAa;AACpD,QAAM,aAAuB,CAAC;AAI9B,QAAM,WAAqB,CAAC;AAC5B,QAAM,eAAe,CAAC,cAA4B;AAChD,UAAM,mBAAmB,KAAK,QAAQ,SAAS;AAC/C,UAAM,cAAc,KAAK,SAAS,gBAAgB,MAAM,SACpD,KAAK,QAAQ,kBAAkB,IAAI,IACnC;AACJ,UAAM,oBAAoB;AAAA,MACxB,KAAK,KAAK,aAAa,MAAM;AAAA,MAC7B,KAAK,KAAK,aAAa,MAAM,MAAM;AAAA,IACrC;AACA,eAAW,aAAa,mBAAmB;AACzC,YAAM,WAAW,KAAK,QAAQ,SAAS;AACvC,UAAI,CAAC,SAAS,SAAS,QAAQ,EAAG,UAAS,KAAK,QAAQ;AAAA,IAC1D;AAAA,EACF;AAEA,MAAI;AAEF,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,UAAM,eAAe,IAAI,QAAQ,UAAU;AAC3C,iBAAa,YAAY;AAAA,EAC3B,QAAQ;AAAA,EAER;AAIA,MAAI;AACF,UAAM,aAAa,QAAQ,KAAK,CAAC;AACjC,QAAI,YAAY;AACd,YAAM,aAAa,aAAa,UAAU;AAC1C,UAAI,WAAW,SAAS,UAAU,GAAG;AACnC,qBAAa,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,MAAI;AACF,UAAM,cAAc,qBAAqB,YAAY,YAAY,UAAU,UAAU,IAAI;AACzF,QAAI,aAAa;AACf,mBAAa,aAAa,WAAW,CAAC;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,aAAW,OAAO,UAAU;AAC1B,QAAI;AACF,YAAM,QAAQ,YAAY,GAAG;AAC7B,iBAAW,KAAK,OAAO;AACrB,YAAI,EAAE,WAAW,6BAA6B,KAAK,EAAE,SAAS,KAAK,GAAG;AACpE,qBAAW,KAAK,KAAK,KAAK,KAAK,CAAC,CAAC;AAAA,QACnC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,qBACP,gBACA,QACA,MACA,gBACoB;AACpB,QAAM,UAAU,WAAW,MAAM;AACjC,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,WAAW,QAAQ,aAAa,WACjC,WAAW,SAAS,KAAK,uBACvB,MAAM,GAAG,EACT,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC,IACjC,CAAC,EAAE;AACP,QAAM,eAAe,KAAK,QAAQ,cAAc,EAAE,SAAS;AAE3D,aAAW,OAAO,QAAQ,MAAM,KAAK,SAAS,GAAG;AAC/C,QAAI,CAAC,IAAK;AACV,UAAM,iBAAiB,QAAQ,aAAa,WAAW,CAAC,eACpD,SAAS,IAAI,CAAC,QAAQ,GAAG,cAAc,GAAG,GAAG,EAAE,IAC/C,CAAC,cAAc;AAEnB,eAAW,iBAAiB,gBAAgB;AAC1C,YAAM,YAAY,KAAK,KAAK,KAAK,aAAa;AAC9C,UAAI;AACF,eAAO,WAAW,cAAc;AAChC,YAAI,CAAC,KAAK,SAAS,EAAE,OAAO,EAAG;AAC/B,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,IAAM,gCAAgC;AAW7C,eAAsB,sBACpB,YACA,aACA,eACA,UAC6B;AAC7B,QAAM,mBAAmB,KAAK;AAAA,IAC5B,YAAY,KAAK,KAAK,GAAG,QAAQ,GAAG,aAAa,UAAU,QAAQ,OAAO;AAAA,EAC5E;AAGA,QAAM,WAAW,YAAY,UAAU,aAAa,gBAAgB;AACpE,MAAI,cAAc,IAAI,QAAQ,GAAG;AAC/B,WAAO,cAAc,IAAI,QAAQ;AAAA,EACnC;AAEA,MAAI;AAGJ,MAAI,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,SAAS,GAAG;AAGpE,QACE,gBAAgB,uBAChB,YAAY,SAAS,QAAQ,KAC7B,YAAY,SAAS,QAAQ,KAC7B,gBAAgB,eAChB,YAAY,WAAW,MAAM,GAC7B;AAAA,IAEF,OAAO;AACL,iBAAW;AACX,oBAAc,IAAI,UAAU,QAAQ;AACpC,aAAO;AAAA,IACT;AAAA,EACF;AAIA,QAAM,WAAW,MAAM,mBAAmB;AAC1C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,EAAE,UAAU,YAAY,KAAK,eAAe,UAAU,iBAAiB,CAAC;AACpG,UAAI,MAAM,QAAQ;AAChB,mBAAW,KAAK;AAChB,YAAI,MAAM,kCAAkC,UAAU,+BAA+B,KAAK,UAAU,SAAS,WAAW,KAAK,QAAQ,SAAS,GAAG;AACjJ,sBAAc,IAAI,UAAU,QAAQ;AACpC,eAAO;AAAA,MACT;AAAA,IACF,SAAS,KAAK;AACZ,UAAI;AAAA,QACF,gDAAgD,UAAU,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAClH;AAAA,IACF;AAAA,EACF;AAGA,aAAW,eAAe,UAAU;AACpC,MAAI,UAAU;AACZ,QAAI,MAAM,kCAAkC,UAAU,6BAA6B;AAAA,EACrF,OAAO;AACL,QAAI,MAAM,2CAA2C,UAAU,mBAAc;AAAA,EAC/E;AAIA,MAAI,UAAU;AACZ,kBAAc,IAAI,UAAU,QAAQ;AAAA,EACtC;AACA,SAAO;AACT;AAKA,SAAS,eAAe,YAAwC;AAC9D,QAAM,aAAa,WAAW,YAAY,EAAE,QAAQ,cAAc,GAAG;AACrE,QAAM,aAAa;AAAA,IACjB,GAAG,UAAU;AAAA,IACb,GAAG,UAAU;AAAA,EACf;AACA,aAAW,UAAU,YAAY;AAC/B,UAAM,QAAQ,WAAW,MAAM;AAC/B,QAAI,SAAS,MAAM,KAAK,EAAE,SAAS,GAAG;AACpC,aAAO,MAAM,KAAK;AAAA,IACpB;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,gCAA0E;AAE9F,QAAM,mBAAmB;AACzB,SAAO;AACT;AAKO,SAAS,mBAAyB;AACvC,gBAAc,MAAM;AACpB,8BAA4B;AAC5B,4BAA0B;AAC1B,oBAAkB;AAClB,yBAAuB;AACzB;AAEO,SAAS,4BAA4B,UAAwC;AAClF,8BAA4B;AAC5B,oBAAkB,aAAa;AAC/B,yBAAuB;AACzB;","names":[]}

package/dist/{chunk-ALXMCZEU.js → chunk-Z2E7VW55.js}

@@ -1,3 +1,6 @@
+import {
+  readEnvVar
+} from "./chunk-MARWOCVP.js";
 import {
   log
 } from "./chunk-2ODBA7MQ.js";
@@ -15,7 +18,7 @@ var EmbeddingTimeoutError = class extends Error {
 var DEFAULT_EMBEDDING_LOOKUP_TIMEOUT_MS = 5e3;
 var DEFAULT_EMBEDDING_INDEX_TIMEOUT_MS = 12e4;
 function resolveEmbeddingLookupTimeoutMs() {
-  const raw = process.env.REMNIC_EMBEDDING_FETCH_TIMEOUT_MS;
+  const raw = readEnvVar("REMNIC_EMBEDDING_FETCH_TIMEOUT_MS");
   if (raw) {
     const parsed = Number(raw);
     if (Number.isFinite(parsed) && parsed > 0) {
@@ -25,7 +28,7 @@ function resolveEmbeddingLookupTimeoutMs() {
   return DEFAULT_EMBEDDING_LOOKUP_TIMEOUT_MS;
 }
 function resolveEmbeddingIndexTimeoutMs() {
-  const raw = process.env.REMNIC_EMBEDDING_INDEX_TIMEOUT_MS;
+  const raw = readEnvVar("REMNIC_EMBEDDING_INDEX_TIMEOUT_MS");
   if (raw) {
     const parsed = Number(raw);
     if (Number.isFinite(parsed) && parsed > 0) {
@@ -329,4 +332,4 @@ export {
   EmbeddingTimeoutError,
   EmbeddingFallback
 };
-//# sourceMappingURL=chunk-ALXMCZEU.js.map
+//# sourceMappingURL=chunk-Z2E7VW55.js.map

package/dist/chunk-Z2E7VW55.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/embedding-fallback.ts"],"sourcesContent":["import path from \"node:path\";\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { log } from \"./logger.js\";\nimport { readEnvVar } from \"./runtime/env.js\";\nimport type { PluginConfig } from \"./types.js\";\n\ntype EmbeddingProviderType = \"openai\" | \"local\";\n\ntype ProviderConfig = {\n  type: EmbeddingProviderType;\n  model: string;\n  endpoint: string;\n  headers: Record<string, string>;\n};\n\ntype EmbeddingIndexEntry = {\n  vector: number[];\n  path: string;\n};\n\ntype EmbeddingIndexFile = {\n  version: 1;\n  provider: EmbeddingProviderType;\n  model: string;\n  entries: Record<string, EmbeddingIndexEntry>;\n};\n\nconst DEFAULT_OPENAI_MODEL = \"text-embedding-3-small\";\n\n/**\n * Thrown by `EmbeddingFallback.search()` (via `embed()`) when the embedding\n * backend is effectively unavailable on the lookup path — either because the\n * HTTP fetch exceeded its deadline OR because the endpoint returned a non-2xx\n * status code. Callers that need to distinguish a backend outage from \"no\n * candidates\" can `instanceof`-check against this class.\n *\n * Round 9 fix (Finding UZqB): previously a timeout returned null from embed(),\n * which caused search() to return [] silently. decideSemanticDedup then\n * classified the result as no_candidates instead of backend_unavailable, so\n * the per-batch batchBackendUnavailable short-circuit never activated and\n * batches of N facts each paid a full timeout roundtrip.\n *\n * Round 10 fix (Findings Ui1J + Ui1L): search() now only re-throws this error\n * when the caller explicitly passes `{ throwOnTimeout: true }`. Without that\n * flag search() catches it and returns [] instead, preserving fail-open\n * semantics for recall-path callers (searchEmbeddingFallback) that have no\n * try/catch. Only the semantic-dedup path (semanticDedupLookup) passes the\n * flag so it can still reach decideSemanticDedup's backend_unavailable branch.\n *\n * Round 11 fix (Finding Ur_J): `embed()` now also throws this error from the\n * lookup path when the HTTP response is non-2xx (e.g. 429, 500, 503). Without\n * this, repeated 5xx outages would each return null → [] → no_candidates and\n * subsequent facts in the same batch would all pay full roundtrips instead of\n * tripping the per-batch backend_unavailable short-circuit.\n *\n * The class name is kept for backward compatibility — `EmbeddingTimeoutError`\n * now signals \"lookup backend unavailable\" rather than strictly \"timed out\".\n */\nexport class EmbeddingTimeoutError extends Error {\n  override readonly name = \"EmbeddingTimeoutError\" as const;\n  constructor(message: string) {\n    super(message);\n  }\n}\n\n/**\n * Maximum time to wait for an embedding HTTP request on the LOOKUP/query\n * path before giving up.\n *\n * The write-time semantic dedup guard in orchestrator.persistExtraction()\n * blocks each candidate fact on an embedding lookup. If the embedding\n * endpoint hangs (degraded OpenAI, stalled local gateway, DNS timeout),\n * extraction would otherwise stall indefinitely — a single bad backend\n * could freeze the entire persist loop. Bounding the fetch here ensures\n * the decision path fails open (returns null) within a predictable window\n * and writes proceed as non-duplicates.\n *\n * Tests can override via REMNIC_EMBEDDING_FETCH_TIMEOUT_MS so they don't\n * have to wait the full default on hung-fetch assertions.\n *\n * Related: joshuaswarren/remnic#373, PR #399 P1/P2 review.\n */\nconst DEFAULT_EMBEDDING_LOOKUP_TIMEOUT_MS = 5000;\n\n/**\n * Maximum time to wait for an embedding HTTP request on the INDEX path.\n *\n * Indexing runs asynchronously after a memory has already been persisted\n * to disk. It does not block extraction or writes — it only updates the\n * embedding index used by later semantic dedup lookups. A slow local\n * CPU-backed embedding model can legitimately take tens of seconds per\n * call, so applying the short lookup timeout here silently dropped index\n * updates and caused later dedup lookups to miss recently persisted\n * memories. Use a much larger budget on this path.\n *\n * Tests can override via REMNIC_EMBEDDING_INDEX_TIMEOUT_MS.\n */\nconst DEFAULT_EMBEDDING_INDEX_TIMEOUT_MS = 120_000;\n\nfunction resolveEmbeddingLookupTimeoutMs(): number {\n  const raw = readEnvVar(\"REMNIC_EMBEDDING_FETCH_TIMEOUT_MS\");\n  if (raw) {\n    const parsed = Number(raw);\n    if (Number.isFinite(parsed) && parsed > 0) {\n      return Math.floor(parsed);\n    }\n  }\n  return DEFAULT_EMBEDDING_LOOKUP_TIMEOUT_MS;\n}\n\nfunction resolveEmbeddingIndexTimeoutMs(): number {\n  const raw = readEnvVar(\"REMNIC_EMBEDDING_INDEX_TIMEOUT_MS\");\n  if (raw) {\n    const parsed = Number(raw);\n    if (Number.isFinite(parsed) && parsed > 0) {\n      return Math.floor(parsed);\n    }\n  }\n  return DEFAULT_EMBEDDING_INDEX_TIMEOUT_MS;\n}\n\n/**\n * Options for the low-level embed() call.\n *\n * `mode` selects the timeout profile:\n *   - \"lookup\" (default): bounded by the short lookup budget; fails open fast.\n *   - \"index\": bounded by a much longer budget so slow backends can still\n *     index newly persisted memories.\n */\nexport type EmbedMode = \"lookup\" | \"index\";\n\nexport class EmbeddingFallback {\n  private readonly indexPath: string;\n  private loaded: EmbeddingIndexFile | null = null;\n\n  constructor(private readonly config: PluginConfig) {\n    this.indexPath = path.join(config.memoryDir, \"state\", \"embeddings.json\");\n  }\n\n  async isAvailable(): Promise<boolean> {\n    return (await this.resolveProvider()) !== null;\n  }\n\n  /**\n   * Embed an array of texts and return their embedding vectors.\n   *\n   * This is the public batch-embed interface used by semantic chunking\n   * (Finding 1, PR #420 post-merge). Texts are grouped into batches of\n   * `embeddingBatchSize` (from `semanticChunkingConfig`, default 32) and\n   * each batch is dispatched concurrently via `Promise.all()`. This\n   * preserves the semantic intent of `embeddingBatchSize` — without batching,\n   * every text incurred a sequential HTTP round-trip, making the batch size\n   * config ineffective. (PR #439 post-merge Finding 2.)\n   *\n   * If the provider is unavailable or any single embedding fails, the method\n   * throws so the caller can fall back to recursive chunking.\n   */\n  async embedTexts(texts: string[]): Promise<number[][]> {\n    const provider = await this.resolveProvider();\n    if (!provider) {\n      throw new Error(\"Embedding provider is not available\");\n    }\n\n    const batchSize = Math.max(\n      1,\n      this.config.semanticChunkingConfig?.embeddingBatchSize ?? 32,\n    );\n\n    const vectors: number[][] = [];\n    for (let i = 0; i < texts.length; i += batchSize) {\n      const batch = texts.slice(i, i + batchSize);\n      const batchResults = await Promise.all(\n        batch.map((text) => this.embed(text, provider, { mode: \"lookup\" })),\n      );\n      for (const vec of batchResults) {\n        if (!vec) {\n          throw new Error(\"Embedding returned null for input text\");\n        }\n        vectors.push(vec);\n      }\n    }\n    return vectors;\n  }\n\n  /**\n   * Nearest-neighbor search against the embedding index.\n   *\n   * @param query         The query string to embed and search for.\n   * @param limit         Max number of hits to return.\n   * @param options       Optional filters.\n   *   - `pathPrefix`   Restrict candidates to entries whose indexed `path`\n   *                    starts with this prefix (relative to `memoryDir`).\n   *                    Used by the semantic dedup guard to scope lookups\n   *                    to the target namespace so a high-similarity hit\n   *                    from a different namespace can't suppress a write\n   *                    in the target namespace. Default: no filter.\n   *   - `pathExcludePrefixes`\n   *                    Exclude any entry whose indexed `path` starts with\n   *                    any of these prefixes. Used for the default\n   *                    namespace case: when the default namespace lives at\n   *                    `memoryDir` root (legacy layout) we still want to\n   *                    exclude `namespaces/<other>/…` entries.\n   */\n  async search(\n    query: string,\n    limit: number,\n    options: {\n      pathPrefix?: string;\n      pathExcludePrefixes?: readonly string[];\n      /**\n       * When true, an `EmbeddingTimeoutError` from the embedding backend is\n       * re-thrown to the caller. Use this on the semantic-dedup path so\n       * `decideSemanticDedup`'s catch block can classify the result as\n       * `reason=\"backend_unavailable\"` and activate the per-batch\n       * short-circuit.\n       *\n       * When false (the default), a timeout is caught here and search()\n       * returns [] instead — preserving fail-open semantics for the recall\n       * path (`searchEmbeddingFallback`) which has no surrounding try/catch.\n       * Without this gate a timed-out embedding request on the recall path\n       * would propagate as an unhandled rejection and abort recall entirely.\n       * (Round 10 fix, Findings Ui1J + Ui1L.)\n       */\n      throwOnTimeout?: boolean;\n    } = {},\n  ): Promise<Array<{ id: string; score: number; path: string }>> {\n    const provider = await this.resolveProvider();\n    if (!provider) return [];\n\n    const index = await this.loadIndex(provider);\n    const ids = Object.keys(index.entries);\n    if (ids.length === 0) return [];\n\n    let queryVector: number[] | null;\n    try {\n      queryVector = await this.embed(query, provider, { mode: \"lookup\" });\n    } catch (err) {\n      if (err instanceof EmbeddingTimeoutError) {\n        if (options.throwOnTimeout) {\n          throw err;\n        }\n        // Fail-open: recall-path callers get an empty result rather than an\n        // unhandled rejection that would abort recall entirely.\n        log.debug(\"embedding fallback search: timeout on lookup, returning [] (throwOnTimeout=false)\");\n        return [];\n      }\n      throw err;\n    }\n    if (!queryVector) return [];\n\n    const includePrefix = normalizePathPrefix(options.pathPrefix);\n    const excludePrefixes = (options.pathExcludePrefixes ?? [])\n      .map((p) => normalizePathPrefix(p))\n      .filter((p): p is string => typeof p === \"string\");\n\n    const scored = ids\n      .map((id) => {\n        const entry = index.entries[id];\n        return {\n          id,\n          path: entry.path,\n          score: cosineSimilarity(queryVector, entry.vector),\n        };\n      })\n      .filter((r) => {\n        if (!Number.isFinite(r.score)) return false;\n        const normalized = normalizeEntryPath(r.path);\n        if (includePrefix !== undefined && !normalized.startsWith(includePrefix)) {\n          return false;\n        }\n        for (const excl of excludePrefixes) {\n          if (normalized.startsWith(excl)) return false;\n        }\n        return true;\n      })\n      .sort((a, b) => b.score - a.score)\n      .slice(0, Math.max(1, limit));\n\n    return scored;\n  }\n\n  async indexFile(memoryId: string, content: string, filePath: string): Promise<void> {\n    const provider = await this.resolveProvider();\n    if (!provider) return;\n    // Indexing is not on the write-critical path: a newly persisted memory\n    // has already been written to disk by the time we reach this call. Use\n    // the long \"index\" timeout so slow local embedding backends can still\n    // add the entry to the index. Previously this used the short lookup\n    // budget and silently dropped updates, leaving later dedup lookups\n    // blind to the memory. Related: PR #399 P2.\n    const vector = await this.embed(content, provider, { mode: \"index\" });\n    if (!vector) return;\n\n    const index = await this.loadIndex(provider);\n    const relPath = toMemoryRelativePath(this.config.memoryDir, filePath);\n    index.entries[memoryId] = {\n      vector,\n      path: relPath,\n    };\n    await this.saveIndex(index);\n  }\n\n  async removeFromIndex(memoryId: string): Promise<void> {\n    const provider = await this.resolveProvider();\n    if (!provider) return;\n\n    const index = await this.loadIndex(provider);\n    if (!index.entries[memoryId]) return;\n    delete index.entries[memoryId];\n    await this.saveIndex(index);\n  }\n\n  private async resolveProvider(): Promise<ProviderConfig | null> {\n    if (!this.config.embeddingFallbackEnabled) return null;\n\n    const preferred = this.config.embeddingFallbackProvider;\n    const providers = preferred === \"auto\" ? [\"openai\", \"local\"] : [preferred];\n\n    for (const p of providers) {\n      if (p === \"openai\" && this.config.openaiApiKey) {\n        const baseUrl = this.config.openaiBaseUrl ?? \"https://api.openai.com/v1\";\n        return {\n          type: \"openai\",\n          model: DEFAULT_OPENAI_MODEL,\n          endpoint: `${baseUrl.replace(/\\/$/, \"\")}/embeddings`,\n          headers: {\n            \"Content-Type\": \"application/json\",\n            Authorization: `Bearer ${this.config.openaiApiKey}`,\n          },\n        };\n      }\n\n      if (p === \"local\" && this.config.localLlmEnabled && this.config.localLlmUrl) {\n        const base = this.config.localLlmUrl.replace(/\\/$/, \"\");\n        const endpoint = /\\/v1$/i.test(base) ? `${base}/embeddings` : `${base}/v1/embeddings`;\n        const headers: Record<string, string> = {\n          \"Content-Type\": \"application/json\",\n          ...(this.config.localLlmHeaders ?? {}),\n        };\n        if (this.config.localLlmApiKey && this.config.localLlmAuthHeader !== false) {\n          headers.Authorization = `Bearer ${this.config.localLlmApiKey}`;\n        }\n        return {\n          type: \"local\",\n          model: this.config.localLlmModel || DEFAULT_OPENAI_MODEL,\n          endpoint,\n          headers,\n        };\n      }\n    }\n\n    return null;\n  }\n\n  private async embed(\n    input: string,\n    provider: ProviderConfig,\n    options: { mode?: EmbedMode } = {},\n  ): Promise<number[] | null> {\n    // Bound the fetch so a hung embedding endpoint cannot stall callers.\n    // The lookup path uses a short budget (see DEFAULT_EMBEDDING_LOOKUP_TIMEOUT_MS\n    // docblock) so semantic dedup fails open fast. The index path uses a\n    // much longer budget because slow local backends (CPU embedding models)\n    // otherwise drop index updates and blind later dedup lookups. See\n    // DEFAULT_EMBEDDING_INDEX_TIMEOUT_MS docblock and PR #399 P2 review.\n    const mode: EmbedMode = options.mode ?? \"lookup\";\n    const timeoutMs =\n      mode === \"index\"\n        ? resolveEmbeddingIndexTimeoutMs()\n        : resolveEmbeddingLookupTimeoutMs();\n    try {\n      const res = await fetch(provider.endpoint, {\n        method: \"POST\",\n        headers: provider.headers,\n        body: JSON.stringify({\n          model: provider.model,\n          input: input.slice(0, 8000),\n          encoding_format: \"float\",\n        }),\n        signal: AbortSignal.timeout(timeoutMs),\n      });\n      if (!res.ok) {\n        log.debug(`embedding fallback request failed: ${provider.type} ${res.status}`);\n        // Round 11 fix (Finding Ur_J): on the LOOKUP path, a non-2xx response\n        // means the embedding backend is effectively unavailable. Throw the\n        // tagged error so search() (when called with throwOnTimeout) propagates\n        // to decideSemanticDedup's backend_unavailable branch, activating the\n        // per-batch short-circuit. Without this, repeated 429/5xx responses\n        // would silently return [] for every fact in the batch.\n        //\n        // On the INDEX path a non-2xx is non-fatal (the memory is already\n        // persisted; index update can be skipped) — return null there.\n        if (mode === \"lookup\") {\n          throw new EmbeddingTimeoutError(\n            `embedding backend returned ${res.status} (${provider.type})`,\n          );\n        }\n        return null;\n      }\n      const payload = (await res.json()) as any;\n      const vector = payload?.data?.[0]?.embedding;\n      if (!Array.isArray(vector)) return null;\n      return vector.map((n: unknown) => Number(n)).filter((n: number) => Number.isFinite(n));\n    } catch (err) {\n      // Round 11 (Finding Ur_J): the !res.ok branch above throws\n      // EmbeddingTimeoutError directly. Re-throw it here so the catch does\n      // not swallow our own intentional signal back into a null return.\n      if (err instanceof EmbeddingTimeoutError) {\n        throw err;\n      }\n      // AbortSignal.timeout throws a DOMException with name \"TimeoutError\";\n      // surface at warn level so operators can distinguish slow backends from\n      // generic errors.\n      const isTimeout =\n        err instanceof Error &&\n        (err.name === \"TimeoutError\" || err.name === \"AbortError\");\n      if (isTimeout) {\n        log.warn(\n          `embedding fallback fetch timed out after ${timeoutMs}ms (${provider.type}, mode=${mode})`,\n        );\n        // Round 9 fix (Finding UZqB): on the LOOKUP path a timeout means the\n        // embedding backend is effectively unavailable — re-throw so that\n        // search() propagates the error to semanticDedupLookup, which lets it\n        // reach decideSemanticDedup's catch block and return\n        // reason=\"backend_unavailable\". Without this, search() would silently\n        // return [] and the per-batch batchBackendUnavailable flag would never\n        // flip, causing subsequent facts in the same batch to each pay a full\n        // timeout roundtrip (N × timeout instead of 1 × timeout).\n        //\n        // On the INDEX path a timeout is not fatal (the memory is already\n        // persisted; index update can be skipped) — return null there so\n        // indexFile() stays non-blocking.\n        if (mode === \"lookup\") {\n          throw new EmbeddingTimeoutError(\n            `embedding backend timed out after ${timeoutMs}ms (${provider.type})`,\n          );\n        }\n      } else {\n        // Round 12 fix (PR #399 thread PRRT_kwDORJXyws56U6Gi): non-timeout\n        // transport failures (ECONNREFUSED, DNS errors, TLS failures) are just\n        // as fatal as timeouts on the LOOKUP path — the embedding backend is\n        // effectively unreachable. Throw EmbeddingTimeoutError so that\n        // search() (when called with throwOnTimeout:true) propagates the error\n        // to decideSemanticDedup's backend_unavailable branch, activating the\n        // per-batch short-circuit. Without this, each fact in the batch would\n        // pay a full ECONNREFUSED roundtrip and return null → [] → no_candidates,\n        // preventing batchBackendUnavailable from ever being set.\n        //\n        // On the INDEX path a transport failure is non-fatal — the memory is\n        // already persisted; index update can be safely skipped.\n        if (mode === \"lookup\") {\n          log.warn(\n            `embedding fallback transport error on lookup path (${provider.type}): ${err}`,\n          );\n          throw new EmbeddingTimeoutError(\n            `embedding backend transport failure (${provider.type}): ${err instanceof Error ? err.message : String(err)}`,\n          );\n        }\n        log.debug(`embedding fallback error: ${err}`);\n      }\n      return null;\n    }\n  }\n\n  private async loadIndex(provider: ProviderConfig): Promise<EmbeddingIndexFile> {\n    if (this.loaded && this.loaded.provider === provider.type && this.loaded.model === provider.model) {\n      return this.loaded;\n    }\n\n    try {\n      const raw = await readFile(this.indexPath, \"utf-8\");\n      const parsed = JSON.parse(raw) as EmbeddingIndexFile;\n      if (parsed && parsed.version === 1 && parsed.entries && typeof parsed.entries === \"object\") {\n        this.loaded = {\n          version: 1,\n          provider: provider.type,\n          model: provider.model,\n          entries: parsed.entries,\n        };\n        return this.loaded;\n      }\n    } catch {\n      // ignore and create a new index\n    }\n\n    this.loaded = {\n      version: 1,\n      provider: provider.type,\n      model: provider.model,\n      entries: {},\n    };\n    return this.loaded;\n  }\n\n  private async saveIndex(index: EmbeddingIndexFile): Promise<void> {\n    await mkdir(path.dirname(this.indexPath), { recursive: true });\n    await writeFile(this.indexPath, JSON.stringify(index), \"utf-8\");\n    this.loaded = index;\n  }\n}\n\nfunction toMemoryRelativePath(memoryDir: string, filePath: string): string {\n  if (!path.isAbsolute(filePath)) return filePath;\n  const rel = path.relative(memoryDir, filePath);\n  return rel.startsWith(\"..\") ? filePath : rel;\n}\n\n/**\n * Normalize an index entry path to forward-slashes for stable prefix\n * comparison. Entries are stored as `path.relative(memoryDir, …)` output,\n * which on Windows uses back-slashes. Normalize both sides so prefix\n * matching is OS-independent.\n *\n * Also strip a leading `./` so this helper's output is symmetric with\n * `normalizePathPrefix` below. `toMemoryRelativePath` is a pass-through for\n * non-absolute filePath inputs, so an index entry could legitimately carry a\n * stored path like `\"./namespaces/alpha/facts/f.md\"`. Without this strip, a\n * caller-supplied prefix `\"./namespaces/alpha\"` (which `normalizePathPrefix`\n * rewrites to `\"namespaces/alpha/\"`) would silently miss that entry and\n * namespace-scoped dedup would either let a near-duplicate through or fail\n * to exclude a cross-namespace hit.\n */\nfunction normalizeEntryPath(p: string): string {\n  let out = p.replace(/\\\\/g, \"/\");\n  if (out.startsWith(\"./\")) out = out.slice(2);\n  return out;\n}\n\n/**\n * Normalize a caller-supplied path prefix:\n *   - Return `undefined` for nullish/empty input (no filter).\n *   - Replace back-slashes with forward-slashes.\n *   - Strip a leading `./`.\n *   - Ensure a trailing `/` so `\"namespaces/a\"` doesn't accidentally match\n *     `\"namespaces/another/…\"`.\n */\nfunction normalizePathPrefix(prefix: string | undefined): string | undefined {\n  if (prefix === undefined || prefix === null) return undefined;\n  let p = String(prefix).replace(/\\\\/g, \"/\");\n  if (p.startsWith(\"./\")) p = p.slice(2);\n  if (p.length === 0) return undefined;\n  if (!p.endsWith(\"/\")) p = `${p}/`;\n  return p;\n}\n\nfunction cosineSimilarity(a: number[], b: number[]): number {\n  const n = Math.min(a.length, b.length);\n  if (n === 0) return 0;\n  let dot = 0;\n  let normA = 0;\n  let normB = 0;\n  for (let i = 0; i < n; i++) {\n    const av = a[i] ?? 0;\n    const bv = b[i] ?? 0;\n    dot += av * bv;\n    normA += av * av;\n    normB += bv * bv;\n  }\n  const denom = Math.sqrt(normA) * Math.sqrt(normB);\n  if (denom === 0) return 0;\n  return dot / denom;\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,UAAU;AACjB,SAAS,OAAO,UAAU,iBAAiB;AA0B3C,IAAM,uBAAuB;AA+BtB,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC7B,OAAO;AAAA,EACzB,YAAY,SAAiB;AAC3B,UAAM,OAAO;AAAA,EACf;AACF;AAmBA,IAAM,sCAAsC;AAe5C,IAAM,qCAAqC;AAE3C,SAAS,kCAA0C;AACjD,QAAM,MAAM,WAAW,mCAAmC;AAC1D,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iCAAyC;AAChD,QAAM,MAAM,WAAW,mCAAmC;AAC1D,MAAI,KAAK;AACP,UAAM,SAAS,OAAO,GAAG;AACzB,QAAI,OAAO,SAAS,MAAM,KAAK,SAAS,GAAG;AACzC,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B;AAAA,EACF;AACA,SAAO;AACT;AAYO,IAAM,oBAAN,MAAwB;AAAA,EAI7B,YAA6B,QAAsB;AAAtB;AAC3B,SAAK,YAAY,KAAK,KAAK,OAAO,WAAW,SAAS,iBAAiB;AAAA,EACzE;AAAA,EAF6B;AAAA,EAHZ;AAAA,EACT,SAAoC;AAAA,EAM5C,MAAM,cAAgC;AACpC,WAAQ,MAAM,KAAK,gBAAgB,MAAO;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,WAAW,OAAsC;AACrD,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,MAAM,qCAAqC;AAAA,IACvD;AAEA,UAAM,YAAY,KAAK;AAAA,MACrB;AAAA,MACA,KAAK,OAAO,wBAAwB,sBAAsB;AAAA,IAC5D;AAEA,UAAM,UAAsB,CAAC;AAC7B,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,WAAW;AAChD,YAAM,QAAQ,MAAM,MAAM,GAAG,IAAI,SAAS;AAC1C,YAAM,eAAe,MAAM,QAAQ;AAAA,QACjC,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,MAAM,UAAU,EAAE,MAAM,SAAS,CAAC,CAAC;AAAA,MACpE;AACA,iBAAW,OAAO,cAAc;AAC9B,YAAI,CAAC,KAAK;AACR,gBAAM,IAAI,MAAM,wCAAwC;AAAA,QAC1D;AACA,gBAAQ,KAAK,GAAG;AAAA,MAClB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBA,MAAM,OACJ,OACA,OACA,UAkBI,CAAC,GACwD;AAC7D,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,SAAU,QAAO,CAAC;AAEvB,UAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ;AAC3C,UAAM,MAAM,OAAO,KAAK,MAAM,OAAO;AACrC,QAAI,IAAI,WAAW,EAAG,QAAO,CAAC;AAE9B,QAAI;AACJ,QAAI;AACF,oBAAc,MAAM,KAAK,MAAM,OAAO,UAAU,EAAE,MAAM,SAAS,CAAC;AAAA,IACpE,SAAS,KAAK;AACZ,UAAI,eAAe,uBAAuB;AACxC,YAAI,QAAQ,gBAAgB;AAC1B,gBAAM;AAAA,QACR;AAGA,YAAI,MAAM,mFAAmF;AAC7F,eAAO,CAAC;AAAA,MACV;AACA,YAAM;AAAA,IACR;AACA,QAAI,CAAC,YAAa,QAAO,CAAC;AAE1B,UAAM,gBAAgB,oBAAoB,QAAQ,UAAU;AAC5D,UAAM,mBAAmB,QAAQ,uBAAuB,CAAC,GACtD,IAAI,CAAC,MAAM,oBAAoB,CAAC,CAAC,EACjC,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAEnD,UAAM,SAAS,IACZ,IAAI,CAAC,OAAO;AACX,YAAM,QAAQ,MAAM,QAAQ,EAAE;AAC9B,aAAO;AAAA,QACL;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,OAAO,iBAAiB,aAAa,MAAM,MAAM;AAAA,MACnD;AAAA,IACF,CAAC,EACA,OAAO,CAAC,MAAM;AACb,UAAI,CAAC,OAAO,SAAS,EAAE,KAAK,EAAG,QAAO;AACtC,YAAM,aAAa,mBAAmB,EAAE,IAAI;AAC5C,UAAI,kBAAkB,UAAa,CAAC,WAAW,WAAW,aAAa,GAAG;AACxE,eAAO;AAAA,MACT;AACA,iBAAW,QAAQ,iBAAiB;AAClC,YAAI,WAAW,WAAW,IAAI,EAAG,QAAO;AAAA,MAC1C;AACA,aAAO;AAAA,IACT,CAAC,EACA,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAChC,MAAM,GAAG,KAAK,IAAI,GAAG,KAAK,CAAC;AAE9B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,UAAU,UAAkB,SAAiB,UAAiC;AAClF,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,SAAU;AAOf,UAAM,SAAS,MAAM,KAAK,MAAM,SAAS,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpE,QAAI,CAAC,OAAQ;AAEb,UAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ;AAC3C,UAAM,UAAU,qBAAqB,KAAK,OAAO,WAAW,QAAQ;AACpE,UAAM,QAAQ,QAAQ,IAAI;AAAA,MACxB;AAAA,MACA,MAAM;AAAA,IACR;AACA,UAAM,KAAK,UAAU,KAAK;AAAA,EAC5B;AAAA,EAEA,MAAM,gBAAgB,UAAiC;AACrD,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,CAAC,SAAU;AAEf,UAAM,QAAQ,MAAM,KAAK,UAAU,QAAQ;AAC3C,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,WAAO,MAAM,QAAQ,QAAQ;AAC7B,UAAM,KAAK,UAAU,KAAK;AAAA,EAC5B;AAAA,EAEA,MAAc,kBAAkD;AAC9D,QAAI,CAAC,KAAK,OAAO,yBAA0B,QAAO;AAElD,UAAM,YAAY,KAAK,OAAO;AAC9B,UAAM,YAAY,cAAc,SAAS,CAAC,UAAU,OAAO,IAAI,CAAC,SAAS;AAEzE,eAAW,KAAK,WAAW;AACzB,UAAI,MAAM,YAAY,KAAK,OAAO,cAAc;AAC9C,cAAM,UAAU,KAAK,OAAO,iBAAiB;AAC7C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO;AAAA,UACP,UAAU,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAAA,UACvC,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,eAAe,UAAU,KAAK,OAAO,YAAY;AAAA,UACnD;AAAA,QACF;AAAA,MACF;AAEA,UAAI,MAAM,WAAW,KAAK,OAAO,mBAAmB,KAAK,OAAO,aAAa;AAC3E,cAAM,OAAO,KAAK,OAAO,YAAY,QAAQ,OAAO,EAAE;AACtD,cAAM,WAAW,SAAS,KAAK,IAAI,IAAI,GAAG,IAAI,gBAAgB,GAAG,IAAI;AACrE,cAAM,UAAkC;AAAA,UACtC,gBAAgB;AAAA,UAChB,GAAI,KAAK,OAAO,mBAAmB,CAAC;AAAA,QACtC;AACA,YAAI,KAAK,OAAO,kBAAkB,KAAK,OAAO,uBAAuB,OAAO;AAC1E,kBAAQ,gBAAgB,UAAU,KAAK,OAAO,cAAc;AAAA,QAC9D;AACA,eAAO;AAAA,UACL,MAAM;AAAA,UACN,OAAO,KAAK,OAAO,iBAAiB;AAAA,UACpC;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,MACZ,OACA,UACA,UAAgC,CAAC,GACP;AAO1B,UAAM,OAAkB,QAAQ,QAAQ;AACxC,UAAM,YACJ,SAAS,UACL,+BAA+B,IAC/B,gCAAgC;AACtC,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,SAAS,UAAU;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,SAAS;AAAA,QAClB,MAAM,KAAK,UAAU;AAAA,UACnB,OAAO,SAAS;AAAA,UAChB,OAAO,MAAM,MAAM,GAAG,GAAI;AAAA,UAC1B,iBAAiB;AAAA,QACnB,CAAC;AAAA,QACD,QAAQ,YAAY,QAAQ,SAAS;AAAA,MACvC,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,YAAI,MAAM,sCAAsC,SAAS,IAAI,IAAI,IAAI,MAAM,EAAE;AAU7E,YAAI,SAAS,UAAU;AACrB,gBAAM,IAAI;AAAA,YACR,8BAA8B,IAAI,MAAM,KAAK,SAAS,IAAI;AAAA,UAC5D;AAAA,QACF;AACA,eAAO;AAAA,MACT;AACA,YAAM,UAAW,MAAM,IAAI,KAAK;AAChC,YAAM,SAAS,SAAS,OAAO,CAAC,GAAG;AACnC,UAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO;AACnC,aAAO,OAAO,IAAI,CAAC,MAAe,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,MAAc,OAAO,SAAS,CAAC,CAAC;AAAA,IACvF,SAAS,KAAK;AAIZ,UAAI,eAAe,uBAAuB;AACxC,cAAM;AAAA,MACR;AAIA,YAAM,YACJ,eAAe,UACd,IAAI,SAAS,kBAAkB,IAAI,SAAS;AAC/C,UAAI,WAAW;AACb,YAAI;AAAA,UACF,4CAA4C,SAAS,OAAO,SAAS,IAAI,UAAU,IAAI;AAAA,QACzF;AAaA,YAAI,SAAS,UAAU;AACrB,gBAAM,IAAI;AAAA,YACR,qCAAqC,SAAS,OAAO,SAAS,IAAI;AAAA,UACpE;AAAA,QACF;AAAA,MACF,OAAO;AAaL,YAAI,SAAS,UAAU;AACrB,cAAI;AAAA,YACF,sDAAsD,SAAS,IAAI,MAAM,GAAG;AAAA,UAC9E;AACA,gBAAM,IAAI;AAAA,YACR,wCAAwC,SAAS,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,UAC7G;AAAA,QACF;AACA,YAAI,MAAM,6BAA6B,GAAG,EAAE;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAc,UAAU,UAAuD;AAC7E,QAAI,KAAK,UAAU,KAAK,OAAO,aAAa,SAAS,QAAQ,KAAK,OAAO,UAAU,SAAS,OAAO;AACjG,aAAO,KAAK;AAAA,IACd;AAEA,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,WAAW,OAAO;AAClD,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,UAAU,OAAO,YAAY,KAAK,OAAO,WAAW,OAAO,OAAO,YAAY,UAAU;AAC1F,aAAK,SAAS;AAAA,UACZ,SAAS;AAAA,UACT,UAAU,SAAS;AAAA,UACnB,OAAO,SAAS;AAAA,UAChB,SAAS,OAAO;AAAA,QAClB;AACA,eAAO,KAAK;AAAA,MACd;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,SAAK,SAAS;AAAA,MACZ,SAAS;AAAA,MACT,UAAU,SAAS;AAAA,MACnB,OAAO,SAAS;AAAA,MAChB,SAAS,CAAC;AAAA,IACZ;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,UAAU,OAA0C;AAChE,UAAM,MAAM,KAAK,QAAQ,KAAK,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7D,UAAM,UAAU,KAAK,WAAW,KAAK,UAAU,KAAK,GAAG,OAAO;AAC9D,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,WAAmB,UAA0B;AACzE,MAAI,CAAC,KAAK,WAAW,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,KAAK,SAAS,WAAW,QAAQ;AAC7C,SAAO,IAAI,WAAW,IAAI,IAAI,WAAW;AAC3C;AAiBA,SAAS,mBAAmB,GAAmB;AAC7C,MAAI,MAAM,EAAE,QAAQ,OAAO,GAAG;AAC9B,MAAI,IAAI,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,CAAC;AAC3C,SAAO;AACT;AAUA,SAAS,oBAAoB,QAAgD;AAC3E,MAAI,WAAW,UAAa,WAAW,KAAM,QAAO;AACpD,MAAI,IAAI,OAAO,MAAM,EAAE,QAAQ,OAAO,GAAG;AACzC,MAAI,EAAE,WAAW,IAAI,EAAG,KAAI,EAAE,MAAM,CAAC;AACrC,MAAI,EAAE,WAAW,EAAG,QAAO;AAC3B,MAAI,CAAC,EAAE,SAAS,GAAG,EAAG,KAAI,GAAG,CAAC;AAC9B,SAAO;AACT;AAEA,SAAS,iBAAiB,GAAa,GAAqB;AAC1D,QAAM,IAAI,KAAK,IAAI,EAAE,QAAQ,EAAE,MAAM;AACrC,MAAI,MAAM,EAAG,QAAO;AACpB,MAAI,MAAM;AACV,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,KAAK,EAAE,CAAC,KAAK;AACnB,UAAM,KAAK,EAAE,CAAC,KAAK;AACnB,WAAO,KAAK;AACZ,aAAS,KAAK;AACd,aAAS,KAAK;AAAA,EAChB;AACA,QAAM,QAAQ,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK;AAChD,MAAI,UAAU,EAAG,QAAO;AACxB,SAAO,MAAM;AACf;","names":[]}

package/dist/cli.js

@@ -84,11 +84,11 @@ import {
   runWorkProductStatusCliCommand,
   runWorkProjectCliCommand,
   runWorkTaskCliCommand
-} from "./chunk-INXV5JBT.js";
+} from "./chunk-LOIMBRDE.js";
 import "./chunk-VDX363PS.js";
-import "./chunk-KUB6JU6H.js";
+import "./chunk-TMYO7B5P.js";
 import "./chunk-PVPWZSSI.js";
-import "./chunk-B5WXLVDY.js";
+import "./chunk-6YJHX2DL.js";
 import "./chunk-HL4DB7TO.js";
 import "./chunk-ULYOGL6R.js";
 import "./chunk-ZPKBYX2F.js";
@@ -96,7 +96,7 @@ import "./chunk-3SLRNYNG.js";
 import "./chunk-LIRZNNUP.js";
 import "./chunk-Y4Z4I6WK.js";
 import "./chunk-ASAITVLA.js";
-import "./chunk-EPQJM2GC.js";
+import "./chunk-GA5P7RST.js";
 import "./chunk-PYXS46O7.js";
 import "./chunk-3QKK7QOS.js";
 import "./chunk-CUPFXL3J.js";
@@ -104,18 +104,18 @@ import "./chunk-JRNQ3RNA.js";
 import "./chunk-SPI27QT6.js";
 import "./chunk-CULXMQJH.js";
 import "./chunk-E6K4NIEU.js";
-import "./chunk-7I7FKFZH.js";
+import "./chunk-NBVAS5MT.js";
 import "./chunk-YRMVARQP.js";
-import "./chunk-YNQKWQT4.js";
+import "./chunk-4HQS2HPX.js";
 import "./chunk-U66YHYC7.js";
 import "./chunk-EABGC2TL.js";
 import "./chunk-LOBRX7VD.js";
 import "./chunk-HMDCOMYU.js";
 import "./chunk-JXS5PDQ7.js";
-import "./chunk-LK6SGL53.js";
+import "./chunk-OR64ZGRZ.js";
 import "./chunk-7SEAZFFB.js";
 import "./chunk-K6WK37A6.js";
-import "./chunk-BK2EFTE2.js";
+import "./chunk-BECYBZLX.js";
 import "./chunk-Z5LAYHGJ.js";
 import "./chunk-C6QPK5GG.js";
 import "./chunk-C2EFFULQ.js";
@@ -125,11 +125,10 @@ import "./chunk-6HZ6AO2P.js";
 import "./chunk-URB2WSKZ.js";
 import "./chunk-PVGDJXVK.js";
 import "./chunk-NGAVDO7E.js";
-import "./chunk-DFTTJYSO.js";
-import "./chunk-HK3FGIEW.js";
+import "./chunk-UWB5LMWY.js";
+import "./chunk-OC5OXUQ4.js";
 import "./chunk-IQT3XTKW.js";
-import "./chunk-MARWOCVP.js";
-import "./chunk-GKFXUTJ2.js";
+import "./chunk-STGWEHYR.js";
 import "./chunk-ZAIM4TUE.js";
 import "./chunk-SOBJ6NEY.js";
 import "./chunk-3OGMS3PE.js";
@@ -144,7 +143,7 @@ import "./chunk-RBBWYEFJ.js";
 import "./chunk-DT5TVLJE.js";
 import "./chunk-N5AKDXAI.js";
 import "./chunk-TBBDFYXW.js";
-import "./chunk-WVVA7F5A.js";
+import "./chunk-L7IXWRYE.js";
 import "./chunk-F5VP6YCB.js";
 import "./chunk-LTCGGW2D.js";
 import "./chunk-4KAN3GZ3.js";
@@ -158,6 +157,7 @@ import "./chunk-M62O4P4T.js";
 import "./chunk-4DJQYKMN.js";
 import "./chunk-X6GF3FX2.js";
 import "./chunk-FAAFWE4G.js";
+import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
 import "./chunk-DGXUHMOV.js";
 import "./chunk-LPSF4OQH.js";

package/dist/config.js

@@ -1,10 +1,10 @@
 import {
   VALID_MEMORY_CATEGORIES,
   parseConfig
-} from "./chunk-BK2EFTE2.js";
+} from "./chunk-BECYBZLX.js";
 import "./chunk-Z5LAYHGJ.js";
-import "./chunk-MARWOCVP.js";
 import "./chunk-4DJQYKMN.js";
+import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
 export {
   VALID_MEMORY_CATEGORIES,

package/dist/embedding-fallback.js

@@ -1,7 +1,8 @@
 import {
   EmbeddingFallback,
   EmbeddingTimeoutError
-} from "./chunk-ALXMCZEU.js";
+} from "./chunk-Z2E7VW55.js";
+import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
 export {
   EmbeddingFallback,

package/dist/{engine-F3GOXGE5.js → engine-72LSIWQP.js}

@@ -1,7 +1,7 @@
 import {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
-} from "./chunk-RGLL5SPU.js";
+} from "./chunk-XXVWLXSG.js";
 import "./chunk-F5VP6YCB.js";
 import "./chunk-LTCGGW2D.js";
 import "./chunk-4KAN3GZ3.js";
@@ -20,4 +20,4 @@ export {
   CompoundingEngine,
   defaultTierMigrationCycleBudget
 };
-//# sourceMappingURL=engine-F3GOXGE5.js.map
+//# sourceMappingURL=engine-72LSIWQP.js.map

package/dist/extraction.js

@@ -1,24 +1,24 @@
 import {
   ExtractionEngine
-} from "./chunk-S3EEFKNY.js";
+} from "./chunk-DIXB44VE.js";
 import "./chunk-NZLQTHS5.js";
 import "./chunk-54V4BZWP.js";
 import "./chunk-NBNN5GOB.js";
 import "./chunk-FEMOX5AD.js";
-import "./chunk-JL2PU6AI.js";
+import "./chunk-R2XRID2N.js";
 import "./chunk-VEWZZM3H.js";
 import "./chunk-GZCUW5IC.js";
-import "./chunk-LK6SGL53.js";
+import "./chunk-OR64ZGRZ.js";
 import "./chunk-EJI5XIBB.js";
-import "./chunk-3GXCSUXR.js";
-import "./chunk-XZ2TIKGC.js";
+import "./chunk-AYXIPSZO.js";
+import "./chunk-Y7R2XJ5Q.js";
 import "./chunk-ODWDQNRE.js";
 import "./chunk-Y27UJK6V.js";
 import "./chunk-UZB5KHKX.js";
-import "./chunk-MARWOCVP.js";
 import "./chunk-EEQLFRUM.js";
 import "./chunk-QDW3E4RD.js";
 import "./chunk-M62O4P4T.js";
+import "./chunk-MARWOCVP.js";
 import "./chunk-2ODBA7MQ.js";
 export {
   ExtractionEngine

package/dist/fallback-llm.js

@@ -1,7 +1,7 @@
 import {
   FallbackLlmClient
-} from "./chunk-3GXCSUXR.js";
-import "./chunk-XZ2TIKGC.js";
+} from "./chunk-AYXIPSZO.js";
+import "./chunk-Y7R2XJ5Q.js";
 import "./chunk-ODWDQNRE.js";
 import "./chunk-Y27UJK6V.js";
 import "./chunk-UZB5KHKX.js";